diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index ec85b96ac..4973afe44 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -183,7 +183,16 @@ jobs:
         with:
           node-version: ${{ steps.shared-setup.outputs.node-version }}
           cache: npm
-          cache-dependency-path: crates/trusted-server-integration-tests/browser/package-lock.json
+          cache-dependency-path: |
+            crates/trusted-server-integration-tests/browser/package-lock.json
+            crates/trusted-server-js/lib/package-lock.json
+
+      - name: Build TSJS browser fixtures
+        working-directory: crates/trusted-server-js/lib
+        run: |
+          npm ci
+          npm run build
+          npm run build:prebid-external
 
       - name: Install Playwright
         working-directory: crates/trusted-server-integration-tests/browser
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f29355745..3dbd82a35 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,10 +9,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- **Breaking** — Replaced the legacy APS contextual integration with APS OpenRTB at `/e/pb/bid`. APS configuration now uses canonical `account_id` (`pub_id` remains a compatibility alias), no longer requires APS-specific slot IDs, and defaults script creative eligibility off. Operators must update the endpoint, disable native APS demand for Trusted Server cohorts, and prepare GAM/Universal Creative targeting for `hb_bidder=aps` before rollout. APS renderer winners now preserve the upstream bid `id`, omit `crid` when APS omits it, and carry `ext.trusted_server.renderer` instead of `adm`; external `/auction` consumers must support this response shape.
 - **Breaking** — `bid_param_zone_overrides` inner values must now be JSON objects; previously non-object or empty values (`"header" = "x"`, `"header" = {}`) were accepted and silently produced a dead rule at runtime. They now fail at startup with a configuration error. Operators upgrading should audit their `bid_param_zone_overrides` config for non-object zone entries.
 - **Breaking** — Integration configuration strings are no longer globally reinterpreted as JSON scalars. Operators upgrading should audit `[integrations.*]` settings and use native TOML/typed-config booleans and numbers (for example, `enabled = true`, not `enabled = "true"`); quoted numeric and boolean scalars now fail validation instead of silently converting.
 - **Breaking** — Sourcepoint browser module inclusion now requires explicit `[integrations.sourcepoint].enabled = true`; operators relying on the previous unconditional Sourcepoint module should enable the integration before upgrading.
 - The SPA re-auction endpoint moved from `/__ts/page-bids` to `/_ts/page-bids`, joining every other internal route in the `/_ts/` namespace. The old path stays registered as a deprecated alias so already-loaded bundles keep serving ads, and responses on it carry a `Link: …; rel="deprecation"` header so remaining traffic is measurable from edge logs; removal is tracked in [#970](https://github.com/IABTechLab/trusted-server/issues/970). Two deployment notes: audit `[[handlers]]` for patterns broad enough to cover `/_ts` (for example `^/_ts`), which would put this browser-facing endpoint behind Basic Auth and return `401` to every visitor — scope them to `^/_ts/admin`; and prefer rolling forward over rolling back, since a server reverted past this release does not register the canonical path. In both cases the shipped client falls back to the deprecated alias, so the exposure is bounded until that alias is removed.
+- Added optional APS `inventory_domain` and `inventory_page_origin` overrides for deployments whose edge hostname differs from the APS-authorized inventory identity.
+- Preserved APS renderer capabilities through the client-side `trustedServer` Prebid adapter, allowing its generated `hb_adid` to render through GAM and Prebid Universal Creative instead of producing an empty creative.
 
 ### Security
 
@@ -20,6 +23,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Added opt-in APS HTTP debug metadata for controlled test sites, exposing the direct request and response under `/auction` provider metadata using the Prebid Server `debug.httpcalls` shape.
+- Added typed APS renderer transport for direct auctions and GAM/Prebid Universal Creative, using a minimized one-bid envelope, a fragment-bound nonce, and an opaque sandboxed renderer endpoint.
 - Added Osano consent mirror integration docs and public enablement guidance.
 - Implemented basic authentication for configurable endpoint paths (#73)
 - Added integrations guide with example `testlight` integration
diff --git a/TESTING.md b/TESTING.md
index e1ac1c3a2..e5ccba4cf 100644
--- a/TESTING.md
+++ b/TESTING.md
@@ -46,8 +46,8 @@ curl -X POST http://localhost:7676/auction \
 
 **With Orchestrator Enabled** (`auction.enabled = true`):
 - Logs showing: `"Using auction orchestrator"`
-- Parallel execution of APS (mocked) and Prebid (real)
-- GAM mediation (mocked) selecting winning bids
+- Parallel execution of APS OpenRTB and Prebid Server
+- Optional mock-adserver mediation selecting winning bids
 - Final response with winning creatives
 
 **With Orchestrator Disabled** (`auction.enabled = false`):
@@ -66,11 +66,13 @@ providers = ["prebid", "aps"]
 mediator = "adserver_mock"  # If set: mediation, if omitted: highest bid wins
 timeout_ms = 2000
 
-# Mock provider configs
+# APS OpenRTB provider. The built-in production endpoint is used when
+# endpoint is omitted; use only an account authorized for test traffic.
 [integrations.aps]
 enabled = true
-mock = true
-mock_price = 2.50
+account_id = "example-account"
+timeout_ms = 800
+debug = false
 
 [integrations.adserver_mock]
 enabled = true
@@ -90,10 +92,10 @@ mediator = "adserver_mock"  # Mediator configured = parallel mediation strategy
 ```
 
 **Expected Flow:**
-1. Prebid queries real SSPs
-2. APS returns mock bids ($2.50 CPM)
-3. AdServer Mock mediates between all bids
-4. Winning creative returned
+1. Prebid queries its configured bidders through Prebid Server
+2. APS sends an OpenRTB request for eligible banner impressions
+3. AdServer Mock mediates the provider responses
+4. The winning creative or typed APS renderer is returned
 
 ### Scenario 2: Parallel Only (No Mediation)
 **Config:**
@@ -131,8 +133,9 @@ INFO: Running 2 bidders in parallel
 INFO: Requesting bids from: prebid
 INFO: Prebid returned 2 bids (time: 120ms)
 INFO: Requesting bids from: aps
-INFO: APS (MOCK): returning 2 bids in 80ms
-INFO: GAM mediation: slot 'header-banner' won by 'amazon-aps' at $2.50 CPM
+INFO: APS requests bids for 2 impressions
+INFO: APS returns 2 accepted bids in 80ms
+INFO: GAM mediation: slot 'header-banner' won by 'aps' at $2.50 CPM
 ```
 
 ### Verify Provider Registration
@@ -156,18 +159,19 @@ INFO: Registering auction provider: adserver_mock
 
 ## Next Steps
 
-1. **Test with real Prebid Server** - Verify Prebid bids work correctly
-2. **Implement real APS** - Replace mock with actual Amazon TAM API calls
-3. **Implement real GAM** - Add Google Ad Manager API integration
-4. **Add metrics** - Track bid rates, win rates, latency per provider
+1. **Verify Prebid Server demand** - Confirm configured bidders return expected test bids
+2. **Verify APS eligibility** - Confirm the test account, inventory identity, and `/e/pb/bid` endpoint are authorized
+3. **Exercise renderer security** - Run the APS browser integration suite for iframe and script creatives
+4. **Add metrics** - Track bid rates, win rates, latency, and aggregate drop reasons per provider
 
-## Mock Provider Behavior
+## Provider Behavior
 
 ### APS (Amazon)
-- Returns bids for all slots
-- Default mock price: $2.50 CPM
-- Always returns 2 bids
-- Response time: ~80ms (simulated)
+- Sends real OpenRTB requests for eligible banner slots
+- Safely drops malformed, unsupported, or unrenderable bids and reports aggregate reasons
+- Reduces multiple APS candidates to one winner per impression
+- Returns typed renderer descriptors rather than exposing `adm` outside the sandbox
+- Automated tests intercept upstream traffic and use fictional response fixtures
 
 ### AdServer Mock
 - Acts as mediator by calling mocktioneer's mediation endpoint
diff --git a/crates/trusted-server-core/src/auction/README.md b/crates/trusted-server-core/src/auction/README.md
index dcc9e1506..7c5c21462 100644
--- a/crates/trusted-server-core/src/auction/README.md
+++ b/crates/trusted-server-core/src/auction/README.md
@@ -117,7 +117,7 @@ When a request arrives at the `/auction` endpoint, it goes through the following
                               ▼
 ┌──────────────────────────────────────────────────────────────────────┐
 │  9. Each Provider Processes Request                                  │
-│     - Transform AuctionRequest → Provider format (e.g., APS TAM)     │
+│     - Transform AuctionRequest → Provider OpenRTB request            │
 │     - Send HTTP request to provider endpoint                         │
 │     - Parse provider response                                        │
 │     - Transform → AuctionResponse with Bid[]                         │
@@ -188,30 +188,21 @@ AdSlot {
 
 #### 3. Provider Execution
 Each registered provider (APS, Prebid, etc.) receives the `AuctionRequest` and:
-- Transforms it to their specific format (e.g., APS TAM, OpenRTB)
+- Transforms it to the provider's OpenRTB request format
 - Makes HTTP request to their endpoint
 - Parses the response
 - Returns `AuctionResponse` with `Bid[]`
 
 For example, APS provider:
 ```rust
-// Transform AuctionRequest → ApsBidRequest
-let aps_request = ApsBidRequest {
-    pub_id: "5128",
-    slots: vec![
-        ApsSlot {
-            slot_id: "header-banner",
-            sizes: vec![[728, 90], [970, 250]],
-            slot_name: Some("header-banner"),
-        }
-    ],
-    page_url: Some("https://example.com"),
-    ua: Some("Mozilla/5.0..."),
-    timeout: Some(800),
-};
-
-// HTTP POST to http://localhost:6767/e/dtb/bid
-// Parse response → AuctionResponse
+// Transform AuctionRequest → APS OpenRTB request
+// - ext.account = configured account_id
+// - ext.sdk = { source: "prebid", version: "2.2.0" }
+// - banner slots become secure impressions with matching formats/floors
+// - existing consent, identity, device, and geo privacy gates apply
+
+// HTTP POST to https://aps.example.com/e/pb/bid
+// Parse decoded-price response → AuctionResponse with a typed renderer
 ```
 
 #### 4. Response Assembly
@@ -222,17 +213,29 @@ The orchestrator collects all bids and creates an OpenRTB response:
   "id": "auction-response",
   "seatbid": [
     {
-      "seat": "amazon-aps",
+      "seat": "aps",
       "bid": [
         {
-          "id": "amazon-aps-header-banner",
+          "id": "fictional-selected-bid-id",
           "impid": "header-banner",
           "price": 2.5,
-          "adm": "<iframe src=\"/first-party/proxy?tsurl=...\">",
           "w": 728,
           "h": 90,
-          "crid": "amazon-aps-creative",
-          "adomain": ["amazon.com"]
+          "ext": {
+            "trusted_server": {
+              "renderer": {
+                "type": "aps",
+                "version": 1,
+                "accountId": "example-account",
+                "bidId": "fictional-selected-bid-id",
+                "tagType": "iframe",
+                "creativeUrl": "https://creative.example/render",
+                "aaxResponse": "<base64 minimized one-bid envelope>",
+                "width": 728,
+                "height": 90
+              }
+            }
+          }
         }
       ]
     }
@@ -478,9 +481,9 @@ timeout_ms = 500
 
 ```rust
 use async_trait::async_trait;
-use crate::auction::provider::AuctionProvider;
+use crate::auction::provider::{AuctionProvider, ProviderRequestOutcome};
 use crate::auction::types::{AuctionContext, AuctionRequest, AuctionResponse};
-use crate::platform::{PlatformPendingRequest, PlatformResponse};
+use crate::platform::PlatformResponse;
 
 pub struct YourAuctionProvider {
     config: YourConfig,
@@ -496,10 +499,10 @@ impl AuctionProvider for YourAuctionProvider {
         &self,
         request: &AuctionRequest,
         _context: &AuctionContext<'_>,
-    ) -> Result<PlatformPendingRequest, Report<TrustedServerError>> {
+    ) -> Result<ProviderRequestOutcome, Report<TrustedServerError>> {
         // 1. Transform AuctionRequest to your provider's format
-        // 2. Launch HTTP request through services.http_client().send_async(...)
-        // 3. Return PlatformPendingRequest for the orchestrator to await
+        // 2. Launch through services.http_client().send_async(...)
+        // 3. Wrap the handle with ProviderRequestOutcome::pending(...)
         todo!()
     }
 
diff --git a/crates/trusted-server-core/src/auction/endpoints.rs b/crates/trusted-server-core/src/auction/endpoints.rs
index 1d959c05d..814f0d02a 100644
--- a/crates/trusted-server-core/src/auction/endpoints.rs
+++ b/crates/trusted-server-core/src/auction/endpoints.rs
@@ -24,7 +24,10 @@ use crate::platform::RuntimeServices;
 use crate::settings::Settings;
 
 use super::AuctionOrchestrator;
-use super::formats::{convert_to_openrtb_response, convert_tsjs_to_auction_request};
+use super::formats::{
+    convert_to_openrtb_response, convert_to_openrtb_response_with_report,
+    convert_tsjs_to_auction_request,
+};
 use super::telemetry::{
     AuctionObservationContext, AuctionSource, AuctionTerminalOutcome, build_auction_events,
     emit_auction_events_best_effort_lazy,
@@ -317,26 +320,52 @@ pub async fn handle_auction(
         }
     };
 
+    let conversion = match convert_to_openrtb_response_with_report(
+        &result,
+        settings,
+        &auction_request,
+        ec_context.ec_allowed(),
+    ) {
+        Ok(conversion) => conversion,
+        Err(error) => {
+            let elapsed_ms = observation.elapsed_ms();
+            emit_auction_events_best_effort_lazy(services, || {
+                build_auction_events(
+                    observation,
+                    AuctionTerminalOutcome::ExecutionFailed {
+                        request: Some(&auction_request),
+                        provider_responses: &result.provider_responses,
+                        reason: "response_conversion_failed",
+                        elapsed_ms,
+                    },
+                )
+            })
+            .await;
+            return Err(error);
+        }
+    };
+
     emit_auction_events_best_effort_lazy(services, || {
         build_auction_events(
             observation,
             AuctionTerminalOutcome::Completed {
                 request: &auction_request,
                 result: &result,
+                delivered_winner_slots: Some(&conversion.delivery.delivered_winner_slots),
             },
         )
     })
     .await;
 
     log::info!(
-        "Auction completed: {} providers, {} winning bids, {}ms total",
+        "Auction completed: {} providers, {} delivered winning bids, {} dropped winners, {}ms total",
         result.provider_responses.len(),
-        result.winning_bids.len(),
+        conversion.delivery.delivered_winner_slots.len(),
+        conversion.delivery.dropped_winner_count,
         result.total_time_ms
     );
 
-    // Convert to OpenRTB response format with inline creative HTML
-    convert_to_openrtb_response(&result, settings, &auction_request, ec_context.ec_allowed())
+    Ok(conversion.response)
 }
 
 /// Resolves partner EIDs from the KV identity graph for bidstream decoration.
@@ -546,7 +575,7 @@ pub(crate) fn merge_auction_eids(
 mod tests {
     use super::*;
     use crate::auction::config::AuctionConfig;
-    use crate::auction::provider::AuctionProvider;
+    use crate::auction::provider::{AuctionProvider, ProviderRequestOutcome};
     use crate::auction::telemetry::{AuctionEventBatch, AuctionTelemetrySink};
     use crate::auction::types::{AuctionRequest, AuctionResponse};
     use crate::consent::jurisdiction::Jurisdiction;
@@ -555,7 +584,7 @@ mod tests {
     use crate::platform::test_support::{
         NoopBackend, NoopConfigStore, NoopGeo, NoopHttpClient, NoopSecretStore, noop_services,
     };
-    use crate::platform::{ClientInfo, PlatformPendingRequest, PlatformResponse};
+    use crate::platform::{ClientInfo, PlatformResponse};
     use crate::test_support::tests::create_test_settings;
     use base64::Engine as _;
     use base64::engine::general_purpose::STANDARD as BASE64;
@@ -620,7 +649,7 @@ mod tests {
             &self,
             _request: &AuctionRequest,
             _context: &AuctionContext<'_>,
-        ) -> Result<PlatformPendingRequest, Report<TrustedServerError>> {
+        ) -> Result<ProviderRequestOutcome, Report<TrustedServerError>> {
             panic!("provider must not be contacted when the consent gate denies the auction");
         }
 
@@ -742,7 +771,7 @@ mod tests {
             &self,
             request: &AuctionRequest,
             _context: &AuctionContext<'_>,
-        ) -> Result<PlatformPendingRequest, Report<TrustedServerError>> {
+        ) -> Result<ProviderRequestOutcome, Report<TrustedServerError>> {
             *self.had_eids.lock().expect("should lock captured eids") =
                 Some(request.user.eids.is_some());
             Err(Report::new(TrustedServerError::Auction {
diff --git a/crates/trusted-server-core/src/auction/formats.rs b/crates/trusted-server-core/src/auction/formats.rs
index 441828a18..6be479205 100644
--- a/crates/trusted-server-core/src/auction/formats.rs
+++ b/crates/trusted-server-core/src/auction/formats.rs
@@ -9,7 +9,8 @@ use error_stack::{Report, ResultExt, ensure};
 use http::{HeaderValue, Request, Response, StatusCode, header};
 use serde::Deserialize;
 use serde_json::Value as JsonValue;
-use std::collections::HashMap;
+use std::collections::{BTreeMap, HashMap, HashSet};
+use url::Url;
 use uuid::Uuid;
 
 use crate::auction::context::ContextValue;
@@ -19,7 +20,10 @@ use crate::creative;
 use crate::ec::eids::encode_eids_header;
 use crate::error::TrustedServerError;
 use crate::geo::GeoInfo;
-use crate::openrtb::{OpenRtbBid, OpenRtbResponse, ResponseExt, SeatBid, ToExt, to_openrtb_i32};
+use crate::openrtb::{
+    BidExt, BidTrustedServerExt, OpenRtbBid, OpenRtbResponse, ResponseExt, SeatBid, ToExt,
+    to_openrtb_i32,
+};
 use crate::platform::RuntimeServices;
 use crate::settings::Settings;
 
@@ -84,6 +88,66 @@ pub struct BannerUnit {
     pub sizes: Vec<Vec<u32>>,
 }
 
+const MAX_PUBLISHER_PAGE_URL_BYTES: usize = 8192;
+
+/// Sanitize publisher page identity before forwarding it into the bidstream.
+///
+/// The candidate must be credential-free HTTP(S) on the configured publisher
+/// host or a DNS-boundary subdomain. Query and fragment components are always
+/// removed to prevent client-controlled private data from reaching providers.
+/// Accepting publisher subdomains is deliberate; deployments with delegated or
+/// user-content subdomains should account for that inventory trust boundary.
+pub(crate) fn sanitize_publisher_page_url(
+    candidate: Option<&str>,
+    publisher_domain: &str,
+) -> String {
+    let fallback = format!("https://{publisher_domain}");
+    let Some(candidate) = candidate.filter(|value| value.len() <= MAX_PUBLISHER_PAGE_URL_BYTES)
+    else {
+        log::debug!("Auction page URL: using publisher origin because input is absent or invalid");
+        return fallback;
+    };
+    let Ok(mut parsed) = Url::parse(candidate) else {
+        log::debug!("Auction page URL: using publisher origin because input is not a URL");
+        return fallback;
+    };
+    let publisher_domain = publisher_domain.trim_end_matches('.').to_ascii_lowercase();
+    let host_matches = !publisher_domain.is_empty()
+        && parsed.host_str().is_some_and(|host| {
+            let host = host.trim_end_matches('.').to_ascii_lowercase();
+            host == publisher_domain
+                || host
+                    .strip_suffix(&publisher_domain)
+                    .is_some_and(|prefix| prefix.ends_with('.'))
+        });
+    if !matches!(parsed.scheme(), "http" | "https")
+        || !host_matches
+        || !parsed.username().is_empty()
+        || parsed.password().is_some()
+    {
+        log::debug!(
+            "Auction page URL: using publisher origin because input is not publisher-owned HTTP(S)"
+        );
+        return fallback;
+    }
+    parsed.set_query(None);
+    parsed.set_fragment(None);
+    parsed.to_string()
+}
+
+fn publisher_page_url(req: &Request<EdgeBody>, publisher_domain: &str) -> String {
+    let candidate = req.headers().get(header::REFERER).and_then(|value| {
+        value.to_str().map_or_else(
+            |_| {
+                log::debug!("Auction page URL: ignoring non-ASCII Referer header");
+                None
+            },
+            Some,
+        )
+    });
+    sanitize_publisher_page_url(candidate, publisher_domain)
+}
+
 /// Convert tsjs/Prebid.js request format to internal [`AuctionRequest`].
 ///
 /// The `consent` parameter carries decoded consent signals extracted from the
@@ -194,12 +258,14 @@ pub fn convert_tsjs_to_auction_request(
         }
     }
 
+    let page_url = publisher_page_url(req, &settings.publisher.domain);
+
     Ok(AuctionRequest {
         id: Uuid::new_v4().to_string(),
         slots,
         publisher: PublisherInfo {
             domain: settings.publisher.domain.clone(),
-            page_url: Some(format!("https://{}", settings.publisher.domain)),
+            page_url: Some(page_url.clone()),
         },
         user: UserInfo {
             id: ec_id,
@@ -209,15 +275,44 @@ pub fn convert_tsjs_to_auction_request(
         device,
         site: Some(SiteInfo {
             domain: settings.publisher.domain.clone(),
-            page: format!("https://{}", settings.publisher.domain),
+            page: page_url,
         }),
         context,
     })
 }
 
+/// Delivery facts produced while serializing winning bids.
+#[derive(Debug, Default)]
+pub(crate) struct AuctionDeliveryReport {
+    /// Winning slot IDs included in the serialized response.
+    pub delivered_winner_slots: HashSet<String>,
+    /// Winners omitted because they could not be delivered safely.
+    pub dropped_winner_count: usize,
+    /// Machine-readable reasons for omitted winners.
+    pub dropped_winner_reasons: BTreeMap<String, usize>,
+}
+
+impl AuctionDeliveryReport {
+    fn record_drop(&mut self, reason: &str) {
+        self.dropped_winner_count += 1;
+        *self
+            .dropped_winner_reasons
+            .entry(reason.to_string())
+            .or_default() += 1;
+    }
+}
+
+/// Serialized response and the delivery facts used to produce it.
+pub(crate) struct OpenRtbResponseConversion {
+    /// HTTP response returned to the auction client.
+    pub response: Response<EdgeBody>,
+    /// Delivery facts for telemetry and diagnostics.
+    pub delivery: AuctionDeliveryReport,
+}
+
 /// Convert `OrchestrationResult` to `OpenRTB` response format.
 ///
-/// Returns rewritten creative HTML directly in the `adm` field for inline delivery.
+/// Returns rewritten ordinary creative HTML in `adm` or a typed renderer extension.
 ///
 /// # Errors
 ///
@@ -230,8 +325,20 @@ pub fn convert_to_openrtb_response(
     auction_request: &AuctionRequest,
     ec_allowed: bool,
 ) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
-    // Build OpenRTB-style seatbid array
+    Ok(
+        convert_to_openrtb_response_with_report(result, settings, auction_request, ec_allowed)?
+            .response,
+    )
+}
+
+pub(crate) fn convert_to_openrtb_response_with_report(
+    result: &OrchestrationResult,
+    settings: &Settings,
+    auction_request: &AuctionRequest,
+    ec_allowed: bool,
+) -> Result<OpenRtbResponseConversion, Report<TrustedServerError>> {
     let mut seatbids = Vec::with_capacity(result.winning_bids.len());
+    let mut delivery = AuctionDeliveryReport::default();
 
     for (slot_id, bid) in &result.winning_bids {
         let price = bid.price.ok_or_else(|| {
@@ -250,8 +357,21 @@ pub fn convert_to_openrtb_response(
         let width = to_openrtb_i32(bid.width, "width", &bid_context);
         let height = to_openrtb_i32(bid.height, "height", &bid_context);
 
-        // Process creative HTML if present - — sanitize dangerous markup first, then rewrite URLs.
-        let creative_html = if let Some(ref raw_creative) = bid.creative {
+        // Ordinary markup remains on the mandatory sanitize/rewrite path. A
+        // typed renderer is serialized separately and never enters the HTML sanitizer.
+        let (adm, ext) = if let Some(raw_creative) = bid
+            .creative
+            .as_deref()
+            .filter(|creative| !creative.trim().is_empty())
+        {
+            if bid.renderer.is_some() {
+                log::warn!(
+                    "Auction {}: winning bid for slot '{}' from '{}' has both creative markup and a renderer; using creative markup",
+                    auction_request.id,
+                    slot_id,
+                    bid.bidder
+                );
+            }
             let sanitized = creative::sanitize_creative_html(raw_creative);
             let rewritten = creative::rewrite_creative_html(settings, &sanitized);
 
@@ -264,26 +384,47 @@ pub fn convert_to_openrtb_response(
                 rewritten.len()
             );
 
-            rewritten
+            (Some(rewritten), None)
+        } else if let Some(renderer) = bid.renderer.as_ref() {
+            let Some(ext) = (BidExt {
+                trusted_server: BidTrustedServerExt { renderer },
+            })
+            .to_ext() else {
+                log::warn!(
+                    "Auction {}: skipping winning bid for slot '{}' from '{}' because its renderer extension could not be serialized",
+                    auction_request.id,
+                    slot_id,
+                    bid.bidder
+                );
+                delivery.record_drop("renderer_extension_serialization_failed");
+                continue;
+            };
+            (None, Some(ext))
         } else {
-            // No creative provided (e.g., from mediation layer that returns iframe URLs)
             log::warn!(
-                "No creative HTML for auction {} slot {} - mediation should have provided creative",
+                "Auction {}: skipping winning bid for slot '{}' from '{}' because it has no render source",
                 auction_request.id,
-                slot_id
+                slot_id,
+                bid.bidder
             );
-            String::new()
+            delivery.record_drop("no_render_source");
+            continue;
         };
 
         let openrtb_bid = OpenRtbBid {
-            id: Some(format!("{}-{}", bid.bidder, slot_id)),
+            id: bid
+                .bid_id
+                .clone()
+                .or_else(|| Some(format!("{}-{}", bid.bidder, slot_id))),
             impid: Some(slot_id.to_string()),
             price: Some(price),
-            adm: Some(creative_html),
-            crid: Some(format!("{}-creative", bid.bidder)),
+            adm,
+            adid: bid.ad_id.clone(),
+            crid: bid.creative_id.clone(),
             w: width,
             h: height,
             adomain: bid.adomain.clone().unwrap_or_default(),
+            ext,
             ..Default::default()
         };
 
@@ -292,6 +433,7 @@ pub fn convert_to_openrtb_response(
             bid: vec![openrtb_bid],
             ..Default::default()
         });
+        delivery.delivered_winner_slots.insert(slot_id.clone());
     }
 
     // Determine strategy name for response metadata
@@ -318,6 +460,8 @@ pub fn convert_to_openrtb_response(
                 total_bids: result.total_bids(),
                 time_ms: result.total_time_ms,
                 provider_details,
+                dropped_winner_count: delivery.dropped_winner_count,
+                dropped_winner_reasons: delivery.dropped_winner_reasons.clone(),
             },
         }
         .to_ext(),
@@ -359,13 +503,15 @@ pub fn convert_to_openrtb_response(
         }
     }
 
-    Ok(response)
+    Ok(OpenRtbResponseConversion { response, delivery })
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::auction::types::{AuctionResponse, Bid, BidStatus};
+    use crate::auction::types::{
+        ApsRendererV1, ApsTagType, AuctionResponse, Bid, BidRenderer, BidStatus,
+    };
     use crate::openrtb::{Eid, Uid};
     use crate::platform::test_support::noop_services;
     use crate::test_support::tests::create_test_settings;
@@ -437,7 +583,10 @@ mod tests {
             height: 250,
             nurl: None,
             burl: None,
+            bid_id: Some(format!("{bidder}-{slot_id}")),
             ad_id: None,
+            creative_id: Some(format!("{bidder}-creative")),
+            renderer: None,
             cache_id: None,
             cache_host: None,
             cache_path: None,
@@ -507,6 +656,28 @@ mod tests {
         .expect("should convert banner request")
     }
 
+    #[test]
+    fn response_serializes_prebid_immediate_no_bid_without_error_metadata() {
+        let request = make_auction_request();
+        let settings = make_settings();
+        let mut result = make_empty_result();
+        result.provider_responses = vec![AuctionResponse::no_bid("prebid", 0)];
+
+        let response = convert_to_openrtb_response(&result, &settings, &request, false)
+            .expect("should serialize immediate no-bid response");
+        let json = response_json(response);
+        let details = &json["ext"]["orchestrator"]["provider_details"][0];
+
+        assert_eq!(details["name"], "prebid");
+        assert_eq!(details["status"], "nobid");
+        assert_eq!(details["bid_count"], 0);
+        assert_eq!(details["bidders"], json!([]));
+        assert!(
+            details.get("metadata").is_none(),
+            "should omit empty launch/error metadata"
+        );
+    }
+
     #[test]
     fn response_includes_eid_headers_when_eids_present() {
         let mut request = make_auction_request();
@@ -605,6 +776,63 @@ mod tests {
         );
     }
 
+    #[test]
+    fn publisher_page_url_accepts_publisher_hosts_and_strips_private_components() {
+        for (candidate, expected) in [
+            (
+                "https://publisher.example.com/article?id=1#comments",
+                "https://publisher.example.com/article",
+            ),
+            (
+                "http://news.publisher.example.com/nested/story?token=secret",
+                "http://news.publisher.example.com/nested/story",
+            ),
+            (
+                "https://www.publisher.example.com/",
+                "https://www.publisher.example.com/",
+            ),
+        ] {
+            let request = Request::builder()
+                .uri("https://publisher.example.com/auction")
+                .header(header::REFERER, candidate)
+                .body(EdgeBody::empty())
+                .expect("should build request");
+            assert_eq!(
+                publisher_page_url(&request, "Publisher.Example.Com"),
+                expected,
+                "should sanitize publisher-owned Referer"
+            );
+        }
+    }
+
+    #[test]
+    fn publisher_page_url_rejects_untrusted_or_oversized_referers() {
+        let oversized = format!(
+            "https://publisher.example.com/{}",
+            "x".repeat(MAX_PUBLISHER_PAGE_URL_BYTES)
+        );
+        for candidate in [
+            "https://other.example/article",
+            "https://publisher.example.com.evil.example/article",
+            "https://evilpublisher.example.com/article",
+            "javascript:alert(1)",
+            "https://user:password@publisher.example.com/article",
+            "not a url",
+            &oversized,
+        ] {
+            let request = Request::builder()
+                .uri("https://publisher.example.com/auction")
+                .header(header::REFERER, candidate)
+                .body(EdgeBody::empty())
+                .expect("should build request");
+            assert_eq!(
+                publisher_page_url(&request, "publisher.example.com"),
+                "https://publisher.example.com",
+                "should reject {candidate}"
+            );
+        }
+    }
+
     #[test]
     fn convert_tsjs_to_auction_request_maps_banner_sizes_to_formats() {
         let settings = make_settings();
@@ -933,22 +1161,201 @@ mod tests {
     }
 
     #[test]
-    fn convert_to_openrtb_response_serializes_missing_creative_as_empty_adm() {
+    fn convert_to_openrtb_response_preserves_aps_debug_metadata() {
         let settings = make_settings();
         let auction_request = make_auction_request();
-        let mut bid = make_bid("div-gpt-top", "appnexus", Some(2.75));
-        bid.creative = None;
+        let bid = make_bid("div-gpt-top", "aps", Some(2.75));
+        let debug = json!({
+            "httpcalls": {
+                "aps": [{
+                    "requestbody": "{\"id\":\"fictional-auction\"}",
+                    "requestheaders": {"content-type": ["application/json"]},
+                    "responsebody": "{\"seatbid\":[]}",
+                    "responseheaders": {"content-type": ["application/json"]},
+                    "status": 200,
+                    "uri": "https://aps.example/openrtb"
+                }]
+            }
+        });
+        let result = OrchestrationResult {
+            provider_responses: vec![AuctionResponse {
+                provider: "aps".to_string(),
+                bids: vec![bid.clone()],
+                status: BidStatus::Success,
+                response_time_ms: 42,
+                metadata: HashMap::from([("debug".to_string(), debug.clone())]),
+            }],
+            mediator_response: None,
+            winning_bids: HashMap::from([(bid.slot_id.clone(), bid)]),
+            total_time_ms: 50,
+            metadata: HashMap::new(),
+        };
+
+        let response = convert_to_openrtb_response(&result, &settings, &auction_request, false)
+            .expect("should convert APS response with debug metadata");
+        let json = response_json(response);
+
+        assert_eq!(
+            json["ext"]["orchestrator"]["provider_details"][0]["metadata"]["debug"], debug,
+            "should preserve APS debug metadata in the auction response"
+        );
+    }
+
+    #[test]
+    fn convert_to_openrtb_response_skips_invalid_winners_without_dropping_valid_slots() {
+        let settings = make_settings();
+        let auction_request = make_auction_request();
+        let mut missing = make_bid("missing", "invalid", Some(3.0));
+        missing.creative = None;
+        let mut whitespace = make_bid("whitespace", "invalid", Some(2.9));
+        whitespace.creative = Some(" \n\t ".to_string());
+        let ordinary = make_bid("ordinary", "appnexus", Some(2.75));
+        let mut renderer = make_bid("renderer", "aps", Some(2.5));
+        renderer.creative = Some("  ".to_string());
+        renderer.bid_id = Some("upstream-renderer-bid".to_string());
+        renderer.creative_id = None;
+        renderer.renderer = Some(BidRenderer::Aps(ApsRendererV1 {
+            version: 1,
+            account_id: "example-account".to_string(),
+            bid_id: "upstream-renderer-bid".to_string(),
+            creative_id: None,
+            tag_type: ApsTagType::Iframe,
+            creative_url: "https://creative.example/render".to_string(),
+            aax_response: "fictional-base64".to_string(),
+            width: 300,
+            height: 250,
+        }));
+        let result = OrchestrationResult {
+            provider_responses: vec![],
+            mediator_response: None,
+            winning_bids: HashMap::from([
+                (missing.slot_id.clone(), missing),
+                (whitespace.slot_id.clone(), whitespace),
+                (ordinary.slot_id.clone(), ordinary),
+                (renderer.slot_id.clone(), renderer),
+            ]),
+            total_time_ms: 50,
+            metadata: HashMap::new(),
+        };
+
+        let conversion =
+            convert_to_openrtb_response_with_report(&result, &settings, &auction_request, false)
+                .expect("should omit invalid winners and preserve valid slots");
+        assert_eq!(
+            conversion.delivery.delivered_winner_slots,
+            HashSet::from(["ordinary".to_string(), "renderer".to_string()]),
+            "should report only serialized winners as delivered"
+        );
+        assert_eq!(conversion.delivery.dropped_winner_count, 2);
+        assert_eq!(
+            conversion.delivery.dropped_winner_reasons["no_render_source"],
+            2
+        );
+        let json = response_json(conversion.response);
+        let bids: Vec<&JsonValue> = json["seatbid"]
+            .as_array()
+            .expect("should include valid seatbids")
+            .iter()
+            .map(|seatbid| &seatbid["bid"][0])
+            .collect();
+
+        assert_eq!(bids.len(), 2, "should omit only invalid winners");
+        assert_eq!(json["ext"]["orchestrator"]["dropped_winner_count"], 2);
+        assert_eq!(
+            json["ext"]["orchestrator"]["dropped_winner_reasons"]["no_render_source"],
+            2
+        );
+        let ordinary = bids
+            .iter()
+            .find(|bid| bid["impid"] == "ordinary")
+            .expect("should preserve ordinary winner");
+        assert_eq!(ordinary["adm"], "<div>Ad</div>");
+        let renderer = bids
+            .iter()
+            .find(|bid| bid["impid"] == "renderer")
+            .expect("should preserve renderer winner");
+        assert!(renderer.get("adm").is_none(), "should omit renderer adm");
+        assert!(
+            renderer.get("crid").is_none(),
+            "should omit absent upstream crid"
+        );
+        assert_eq!(renderer["id"], "upstream-renderer-bid");
+        assert!(renderer.get("ext").is_some(), "should include renderer ext");
+    }
+
+    #[test]
+    fn convert_to_openrtb_response_prefers_creative_when_both_render_sources_exist() {
+        let settings = make_settings();
+        let auction_request = make_auction_request();
+        let mut bid = make_bid("div-gpt-top", "aps", Some(2.75));
+        bid.renderer = Some(BidRenderer::Aps(ApsRendererV1 {
+            version: 1,
+            account_id: "example-account".to_string(),
+            bid_id: "fictional-bid".to_string(),
+            creative_id: None,
+            tag_type: ApsTagType::Iframe,
+            creative_url: "https://creative.example/render".to_string(),
+            aax_response: "fictional-base64".to_string(),
+            width: 300,
+            height: 250,
+        }));
         let result = make_result(bid);
 
         let response = convert_to_openrtb_response(&result, &settings, &auction_request, false)
-            .expect("should convert bid without creative HTML");
+            .expect("should prefer ordinary creative markup");
+        let json = response_json(response);
+        let bid = &json["seatbid"][0]["bid"][0];
 
-        assert_eq!(response.status(), StatusCode::OK, "should return OK");
+        assert_eq!(bid["adm"], "<div>Ad</div>");
+        assert!(
+            bid.get("ext").is_none(),
+            "should omit renderer extension when creative markup wins precedence"
+        );
+    }
+
+    #[test]
+    fn convert_to_openrtb_response_emits_typed_aps_renderer_without_adm() {
+        let settings = make_settings();
+        let auction_request = make_auction_request();
+        let mut bid = make_bid("div-gpt-top", "aps", Some(2.75));
+        bid.creative = None;
+        bid.bid_id = Some("fictional-bid".to_string());
+        bid.ad_id = Some("fictional-ad".to_string());
+        bid.creative_id = Some("fictional-creative".to_string());
+        bid.renderer = Some(BidRenderer::Aps(ApsRendererV1 {
+            version: 1,
+            account_id: "example-account".to_string(),
+            bid_id: "fictional-bid".to_string(),
+            creative_id: Some("fictional-creative".to_string()),
+            tag_type: ApsTagType::Iframe,
+            creative_url: "https://creative.example/render".to_string(),
+            aax_response: "fictional-base64".to_string(),
+            width: 300,
+            height: 250,
+        }));
+        let result = make_result(bid);
+
+        let response = convert_to_openrtb_response(&result, &settings, &auction_request, false)
+            .expect("should convert APS renderer bid");
         let json = response_json(response);
+        let bid = json["seatbid"][0]["bid"][0]
+            .as_object()
+            .expect("should serialize bid object");
+
+        assert!(
+            !bid.contains_key("adm"),
+            "should omit adm for renderer bids"
+        );
+        assert_eq!(bid["id"], json!("fictional-bid"));
+        assert_eq!(bid["adid"], json!("fictional-ad"));
+        assert_eq!(bid["crid"], json!("fictional-creative"));
+        assert_eq!(
+            bid["ext"]["trusted_server"]["renderer"]["type"],
+            json!("aps")
+        );
         assert_eq!(
-            json["seatbid"][0]["bid"][0]["adm"],
-            json!(""),
-            "should serialize missing creative as empty adm"
+            bid["ext"]["trusted_server"]["renderer"]["bidId"],
+            json!("fictional-bid")
         );
     }
 
diff --git a/crates/trusted-server-core/src/auction/orchestrator.rs b/crates/trusted-server-core/src/auction/orchestrator.rs
index 71afa7c50..89dad43a9 100644
--- a/crates/trusted-server-core/src/auction/orchestrator.rs
+++ b/crates/trusted-server-core/src/auction/orchestrator.rs
@@ -1,7 +1,9 @@
 //! Auction orchestrator for managing multi-provider auctions.
 
+use edgezero_core::body::Body as EdgeBody;
 use error_stack::{Report, ResultExt};
-use std::collections::{HashMap, HashSet};
+use http::Request;
+use std::collections::HashMap;
 use std::sync::Arc;
 use std::time::Duration;
 use web_time::Instant;
@@ -10,7 +12,7 @@ use crate::error::TrustedServerError;
 use crate::platform::{PlatformPendingRequest, RuntimeServices};
 
 use super::config::AuctionConfig;
-use super::provider::AuctionProvider;
+use super::provider::{AuctionProvider, ProviderParseState, ProviderRequestOutcome};
 use super::telemetry::AbandonedProviderCall;
 use super::types::{AuctionContext, AuctionRequest, AuctionResponse, Bid, BidStatus};
 
@@ -23,15 +25,24 @@ use super::types::{AuctionContext, AuctionRequest, AuctionResponse, Bid, BidStat
 /// TTFB ≈ auction timeout.
 pub struct DispatchedAuction {
     pending_requests: Vec<PlatformPendingRequest>,
-    backend_to_provider: HashMap<String, (String, Instant, Arc<dyn AuctionProvider>)>,
-    launch_responses: Vec<AuctionResponse>,
+    backend_to_provider: HashMap<String, ProviderLaunchState>,
+    completed_responses: Vec<AuctionResponse>,
     auction_start: Instant,
     timeout_ms: u32,
     floor_prices: HashMap<String, f64>,
+    provider_request_context: Box<Request<EdgeBody>>,
     /// Carried so the mediator call in collect can pass it as the auction request.
     request: AuctionRequest,
 }
 
+struct ProviderLaunchState {
+    provider_name: String,
+    started_at: Instant,
+    provider: Arc<dyn AuctionProvider>,
+    effective_timeout_ms: u32,
+    parse_state: Option<ProviderParseState>,
+}
+
 /// Outcome of attempting to dispatch split-phase auction provider requests.
 pub enum DispatchAuctionOutcome {
     /// No provider request was started and no provider failure was observed.
@@ -45,7 +56,7 @@ pub enum DispatchAuctionOutcome {
         /// Elapsed dispatch time.
         elapsed_ms: u64,
     },
-    /// One or more provider requests are in flight.
+    /// One or more providers produced an immediate response or started a request.
     Dispatched(DispatchedAuction),
 }
 
@@ -64,14 +75,19 @@ impl DispatchedAuction {
         let abandoned = self
             .backend_to_provider
             .into_values()
-            .map(|(provider_name, start_time, _)| {
+            .map(|state| {
                 AbandonedProviderCall::bidder(
-                    provider_name,
-                    Some(u32::try_from(start_time.elapsed().as_millis()).unwrap_or(u32::MAX)),
+                    state.provider_name,
+                    Some(u32::try_from(state.started_at.elapsed().as_millis()).unwrap_or(u32::MAX)),
                 )
             })
             .collect();
-        (self.request, self.launch_responses, abandoned, elapsed_ms)
+        (
+            self.request,
+            self.completed_responses,
+            abandoned,
+            elapsed_ms,
+        )
     }
 }
 
@@ -81,10 +97,11 @@ impl DispatchedAuction {
         Self {
             pending_requests: Vec::new(),
             backend_to_provider: HashMap::new(),
-            launch_responses: Vec::new(),
+            completed_responses: Vec::new(),
             auction_start: Instant::now(),
             timeout_ms,
             floor_prices: HashMap::new(),
+            provider_request_context: Box::new(Request::new(EdgeBody::empty())),
             request,
         }
     }
@@ -162,6 +179,15 @@ fn remaining_budget_ms(start: Instant, timeout_ms: u32) -> u32 {
     timeout_ms.saturating_sub(elapsed)
 }
 
+fn snapshot_context_request(request: &Request<EdgeBody>) -> Request<EdgeBody> {
+    let mut snapshot = Request::new(EdgeBody::empty());
+    *snapshot.method_mut() = request.method().clone();
+    *snapshot.uri_mut() = request.uri().clone();
+    *snapshot.version_mut() = request.version();
+    *snapshot.headers_mut() = request.headers().clone();
+    snapshot
+}
+
 /// Manages auction execution across multiple providers.
 pub struct AuctionOrchestrator {
     config: AuctionConfig,
@@ -199,35 +225,6 @@ impl AuctionOrchestrator {
             return Ok(());
         }
 
-        // A provider listed twice would launch the same auction request twice
-        // (its backend name canonicalizes identically), so the duplicate is
-        // detected only after the second outbound send has already fired. Reject
-        // it at startup instead.
-        let mut seen = HashSet::new();
-        for provider_name in &self.config.providers {
-            if !seen.insert(provider_name.as_str()) {
-                return Err(Report::new(TrustedServerError::Configuration {
-                    message: format!(
-                        "Auction provider `{provider_name}` is listed more than once in [auction].providers; each provider may appear at most once"
-                    ),
-                }));
-            }
-        }
-
-        // A provider that is also the mediator would be called twice per
-        // auction — once in the bidding phase and again as the mediator. The
-        // mediator's own demand already flows through its mediation response,
-        // so the overlap is never a legitimate configuration.
-        if let Some(mediator_name) = &self.config.mediator
-            && seen.contains(mediator_name.as_str())
-        {
-            return Err(Report::new(TrustedServerError::Configuration {
-                message: format!(
-                    "Auction mediator `{mediator_name}` is also listed in [auction].providers; a provider may not mediate its own auction"
-                ),
-            }));
-        }
-
         for provider_name in self
             .config
             .providers
@@ -313,19 +310,10 @@ impl AuctionOrchestrator {
 
             // Give the mediator only the remaining time from the auction
             // deadline, not the full timeout — the bidding phase already
-            // consumed part of it, and the mediator has no select-loop
-            // deadline backstop. The platform canonicalizes the value for
-            // backend-name stability (see
-            // `PlatformBackend::canonicalize_transport_timeout_ms`); it never
-            // exceeds the remaining budget. See the transport-deadline note on
-            // `run_providers_parallel` for the limits of this bound.
+            // consumed part of it.
             let remaining_ms = remaining_budget_ms(mediation_start, context.timeout_ms);
-            let mediator_timeout = context
-                .services
-                .backend()
-                .canonicalize_transport_timeout_ms(remaining_ms, mediator.timeout_ms());
 
-            if mediator_timeout == 0 {
+            if remaining_ms == 0 {
                 log::warn!("Auction timeout exhausted during bidding phase; skipping mediator");
                 let winning = self.select_winning_bids(&provider_responses, &floor_prices);
                 return Ok(OrchestrationResult {
@@ -340,57 +328,60 @@ impl AuctionOrchestrator {
             let mediator_context = AuctionContext {
                 settings: context.settings,
                 request: context.request,
-                timeout_ms: mediator_timeout,
+                // Bound by both the remaining auction budget and the mediator's
+                // own configured timeout, matching the dispatched collect path.
+                timeout_ms: remaining_ms.min(mediator.timeout_ms()),
                 provider_responses: Some(&provider_responses),
                 services: context.services,
             };
 
             let start_time = Instant::now();
-            let pending = mediator
+            let mediator_resp = match mediator
                 .request_bids(request, &mediator_context)
                 .await
                 .change_context(TrustedServerError::Auction {
                     message: format!("Mediator {} failed to launch", mediator.provider_name()),
-                })?;
-
-            let platform_resp = mediator_context
-                .services
-                .http_client()
-                .wait(pending)
-                .await
-                .change_context(TrustedServerError::Auction {
-                    message: format!("Mediator {} request failed", mediator.provider_name()),
-                })?;
-
-            let response_time_ms = start_time.elapsed().as_millis() as u64;
-            // Use the context-aware parse so mediators (e.g. adserver_mock) can
-            // restore nurl/burl/ad_id and PBS cache fields from the collected SSP
-            // responses. The dispatched collect path already does this; the
-            // synchronous mediation path used by POST /auction and
-            // /_ts/page-bids must match or mediated cache bids lose the metadata
-            // needed for creative rendering and win/billing beacons.
-            let mediator_resp = mediator
-                .parse_response_with_context(
-                    platform_resp,
-                    response_time_ms,
-                    request,
-                    &mediator_context,
-                )
-                .await
-                .change_context(TrustedServerError::Auction {
-                    message: format!("Mediator {} parse failed", mediator.provider_name()),
-                })?;
+                })? {
+                ProviderRequestOutcome::Immediate(response) => response,
+                ProviderRequestOutcome::Pending {
+                    request: pending,
+                    parse_state,
+                } => {
+                    let platform_resp = mediator_context
+                        .services
+                        .http_client()
+                        .wait(pending)
+                        .await
+                        .change_context(TrustedServerError::Auction {
+                            message: format!(
+                                "Mediator {} request failed",
+                                mediator.provider_name()
+                            ),
+                        })?;
+
+                    mediator
+                        .parse_response_with_context_and_state(
+                            platform_resp,
+                            start_time.elapsed().as_millis() as u64,
+                            request,
+                            &mediator_context,
+                            parse_state.as_deref(),
+                        )
+                        .await
+                        .change_context(TrustedServerError::Auction {
+                            message: format!("Mediator {} parse failed", mediator.provider_name()),
+                        })?
+                }
+            };
 
-            // Extract winning bids from mediator response
-            // Filter out bids without decoded prices - mediator should have decoded all prices
+            // Extract only mediator bids with comparable numeric prices.
             let winning = mediator_resp
                 .bids
                 .iter()
                 .filter_map(|bid| {
                     if bid.price.is_none() {
                         log::warn!(
-                            "Mediator '{}' returned bid for slot '{}' without decoded price - skipping. \
-                             Mediator should decode all prices including APS bids.",
+                            "Mediator '{}' returned bid for slot '{}' without a price - skipping",
                             mediator.provider_name(),
                             bid.slot_id
                         );
@@ -481,11 +472,11 @@ impl AuctionOrchestrator {
         let auction_start = Instant::now();
 
         // Phase 1: Launch all requests concurrently and build mapping
-        // Maps backend_name -> (provider_name, start_time, provider)
-        let mut backend_to_provider: HashMap<String, (&str, Instant, &dyn AuctionProvider)> =
-            HashMap::new();
-        let mut pending_requests: Vec<crate::platform::PlatformPendingRequest> = Vec::new();
+        // Maps backend_name to provider state retained for response parsing.
+        let mut backend_to_provider: HashMap<String, ProviderLaunchState> = HashMap::new();
+        let mut pending_requests: Vec<PlatformPendingRequest> = Vec::new();
         let mut responses = Vec::new();
+        let mut immediate_response_count = 0usize;
 
         for provider_name in provider_names {
             let provider = match self.providers.get(provider_name) {
@@ -506,51 +497,16 @@ impl AuctionOrchestrator {
 
             // Give each provider only the remaining time from the auction
             // deadline so that backend transport timeouts do not extend past
-            // the overall budget. The platform canonicalizes the value for
-            // backend-name stability (see
-            // `PlatformBackend::canonicalize_transport_timeout_ms`).
+            // the overall budget. Also respect the provider's own configured
+            // timeout when it is tighter than the remaining budget.
             let remaining_ms = remaining_budget_ms(auction_start, context.timeout_ms);
-            let effective_timeout = context
-                .services
-                .backend()
-                .canonicalize_transport_timeout_ms(remaining_ms, provider.timeout_ms());
+            let effective_timeout = remaining_ms.min(provider.timeout_ms());
 
             if effective_timeout == 0 {
                 log::warn!("Auction timeout exhausted before launching provider request; skipping");
                 continue;
             }
 
-            // Get the backend name for this provider to map responses back.
-            // Must be computed after effective_timeout since the timeout is
-            // part of the backend name.
-            let backend_name = match provider.backend_name(context.services, effective_timeout) {
-                Some(name) => name,
-                None => {
-                    log::warn!(
-                        "Provider '{}' has no backend_name, skipping",
-                        provider.provider_name()
-                    );
-                    continue;
-                }
-            };
-
-            // Pre-launch guard: `request_bids` fires the outbound send, and
-            // discarding the returned pending handle afterwards does not retract
-            // it. If another provider this auction already claimed the predicted
-            // backend name, skip *before* dispatching so a duplicate never hits
-            // the wire. The post-launch check below stays as a defense for a
-            // provider that resolves to an unexpected name.
-            if backend_to_provider.contains_key(&backend_name) {
-                log::warn!(
-                    "Provider '{}' predicted backend name '{}' already claimed by another provider \
-                     this auction; skipping launch before dispatch to avoid a duplicate request",
-                    provider.provider_name(),
-                    backend_name,
-                );
-                responses.push(provider_launch_failed_response(provider.provider_name(), 0));
-                continue;
-            }
-
             let provider_context = AuctionContext {
                 settings: context.settings,
                 request: context.request,
@@ -560,55 +516,60 @@ impl AuctionOrchestrator {
             };
 
             log::info!(
-                "Launching bid request to: {} (backend: {}, budget: {}ms)",
+                "Launching bid request to '{}' with a {}ms budget",
                 provider.provider_name(),
-                backend_name,
                 effective_timeout
             );
 
             let start_time = Instant::now();
             match provider.request_bids(request, &provider_context).await {
-                Ok(pending) => {
-                    let request_backend_name = pending
-                        .backend_name()
-                        .map(str::to_string)
-                        .unwrap_or_else(|| {
+                Ok(ProviderRequestOutcome::Pending {
+                    request: pending,
+                    parse_state,
+                }) => {
+                    let request_backend_name = pending.backend_name().map(str::to_string).or_else(|| {
+                        provider.backend_name(context.services, effective_timeout).inspect(|name| {
                             log::warn!(
-                                "Provider '{}' pending request returned no backend name; \
-                             using predicted name '{}'",
+                                "Provider '{}' pending request returned no backend name; using predicted name '{}'",
                                 provider.provider_name(),
-                                backend_name,
+                                name,
                             );
-                            backend_name.clone()
-                        });
-                    // Post-launch defense: the resolved name differs from the
-                    // prediction and collides with another provider's. Responses
-                    // are correlated by backend name, so inserting here would
-                    // overwrite the first mapping and misattribute or drop a
-                    // response. Fail this launch attributably instead.
-                    if backend_to_provider.contains_key(&request_backend_name) {
-                        let response_time_ms = start_time.elapsed().as_millis() as u64;
+                        })
+                    });
+                    let Some(request_backend_name) = request_backend_name else {
                         log::warn!(
-                            "Provider '{}' resolved to backend name '{}' already claimed by another \
-                             provider this auction; skipping launch to avoid response misattribution",
-                            provider.provider_name(),
-                            request_backend_name,
+                            "Provider '{}' pending request has no backend name; response cannot be correlated",
+                            provider.provider_name()
                         );
                         responses.push(provider_launch_failed_response(
                             provider.provider_name(),
-                            response_time_ms,
+                            start_time.elapsed().as_millis() as u64,
                         ));
-                    } else {
-                        backend_to_provider.insert(
-                            request_backend_name.clone(),
-                            (provider.provider_name(), start_time, provider.as_ref()),
-                        );
-                        pending_requests.push(pending);
-                        log::debug!(
-                            "Request to '{}' launched successfully",
-                            provider.provider_name()
-                        );
-                    }
+                        continue;
+                    };
+                    backend_to_provider.insert(
+                        request_backend_name,
+                        ProviderLaunchState {
+                            provider_name: provider.provider_name().to_string(),
+                            started_at: start_time,
+                            provider: Arc::clone(provider),
+                            effective_timeout_ms: effective_timeout,
+                            parse_state,
+                        },
+                    );
+                    pending_requests.push(pending);
+                    log::debug!(
+                        "Request to '{}' launched successfully",
+                        provider.provider_name()
+                    );
+                }
+                Ok(ProviderRequestOutcome::Immediate(response)) => {
+                    immediate_response_count += 1;
+                    log::debug!(
+                        "Provider '{}' completed without an upstream request",
+                        provider.provider_name()
+                    );
+                    responses.push(response);
                 }
                 Err(e) => {
                     let response_time_ms = start_time.elapsed().as_millis() as u64;
@@ -626,6 +587,9 @@ impl AuctionOrchestrator {
         }
 
         if pending_requests.is_empty() {
+            if immediate_response_count > 0 {
+                return Ok(responses);
+            }
             return Err(Report::new(TrustedServerError::Auction {
                 message: format!(
                     "All {} configured provider(s) skipped or failed to launch",
@@ -641,25 +605,14 @@ impl AuctionOrchestrator {
         );
 
         // Phase 2: Wait for responses using select() to process as they become ready.
-        // After each select() returns, check elapsed time and drop remaining
-        // requests once the auction deadline passes.
+        // Enforce the auction deadline: after each select() returns, check
+        // elapsed time and drop remaining requests if the timeout is exceeded.
         //
-        // TRANSPORT-DEADLINE NOTE: this select loop is the only *absolute*
-        // wall-clock bound on the parallel path — it drops still-pending
-        // requests once `auction_start.elapsed()` exceeds the deadline. The
-        // per-backend transport timeouts set in Phase 1 are a complementary,
-        // not equivalent, bound: Fastly's connect timeout is a fixed ~1s, the
-        // first-byte timeout only starts after the connection is established,
-        // and the between-bytes timeout is an inactivity timer that resets on
-        // every byte received. A backend that connects slowly or trickles one
-        // byte just inside the between-bytes window can therefore outlive the
-        // configured budget. Bounding them to the remaining budget (Phase 1)
-        // guarantees they never *extend past* the deadline by their own
-        // configuration, but does not by itself enforce a hard total-response
-        // deadline. Paths without this select loop (the mediator and the
-        // dispatched-collect body read) inherit that weaker bound; a true
-        // absolute deadline carried through the platform HTTP API is tracked
-        // as follow-up work (see the streaming/deadline effort, #849).
+        // NOTE: `select()` blocks until at least one backend responds and, on
+        // some adapters, buffers the selected response body before returning.
+        // Hard deadline enforcement therefore depends on every backend's
+        // first-byte and between-bytes timeouts being set to at most the
+        // remaining auction budget, which Phase 1 above guarantees.
         let mut remaining = pending_requests;
 
         while !remaining.is_empty() {
@@ -686,21 +639,24 @@ impl AuctionOrchestrator {
                         .unwrap_or_default()
                         .to_string();
 
-                    if let Some((provider_name, start_time, provider)) =
-                        backend_to_provider.remove(&backend_name)
-                    {
-                        let response_time_ms = start_time.elapsed().as_millis() as u64;
-
-                        // Use the context-aware parse so a provider overriding
-                        // `parse_response_with_context` behaves identically on the
-                        // parallel (`/auction`, page-bids) and collect (publisher)
-                        // paths. The default impl delegates to `parse_response`.
-                        match provider
-                            .parse_response_with_context(
+                    if let Some(state) = backend_to_provider.remove(&backend_name) {
+                        let response_time_ms = state.started_at.elapsed().as_millis() as u64;
+                        let provider_context = AuctionContext {
+                            settings: context.settings,
+                            request: context.request,
+                            timeout_ms: state.effective_timeout_ms,
+                            provider_responses: context.provider_responses,
+                            services: context.services,
+                        };
+
+                        match state
+                            .provider
+                            .parse_response_with_context_and_state(
                                 response,
                                 response_time_ms,
                                 request,
-                                context,
+                                &provider_context,
+                                state.parse_state.as_deref(),
                             )
                             .await
                         {
@@ -719,11 +675,11 @@ impl AuctionOrchestrator {
                                 // This warning reports provider parse failures only; no secret values are logged.
                                 log::warn!(
                                     "Provider '{}' failed to parse response: {:?}",
-                                    provider_name,
+                                    state.provider_name,
                                     e
                                 );
                                 responses.push(provider_error_response(
-                                    provider_name,
+                                    &state.provider_name,
                                     response_time_ms,
                                     ERROR_TYPE_PARSE_RESPONSE,
                                     &e,
@@ -739,13 +695,15 @@ impl AuctionOrchestrator {
                 }
                 Err(e) => {
                     if let Some(ref backend_name) = failed_backend_name {
-                        if let Some((provider_name, start_time, _)) =
-                            backend_to_provider.remove(backend_name)
-                        {
-                            let response_time_ms = start_time.elapsed().as_millis() as u64;
-                            log::warn!("Provider '{}' request failed: {:?}", provider_name, e);
+                        if let Some(state) = backend_to_provider.remove(backend_name) {
+                            let response_time_ms = state.started_at.elapsed().as_millis() as u64;
+                            log::warn!(
+                                "Provider '{}' request failed: {:?}",
+                                state.provider_name,
+                                e
+                            );
                             responses.push(provider_transport_failed_response(
-                                provider_name,
+                                &state.provider_name,
                                 response_time_ms,
                             ));
                         } else {
@@ -776,18 +734,22 @@ impl AuctionOrchestrator {
             }
         }
 
-        for (provider_name, start_time, _) in backend_to_provider.into_values() {
-            let response_time_ms = start_time.elapsed().as_millis() as u64;
-            log::warn!("Provider '{provider_name}' timed out before auction collection completed");
-            responses.push(provider_timeout_response(provider_name, response_time_ms));
+        for state in backend_to_provider.into_values() {
+            let response_time_ms = state.started_at.elapsed().as_millis() as u64;
+            log::warn!(
+                "Provider '{}' timed out before auction collection completed",
+                state.provider_name
+            );
+            responses.push(provider_timeout_response(
+                &state.provider_name,
+                response_time_ms,
+            ));
         }
 
         Ok(responses)
     }
 
-    /// Select the best bid for each slot from all responses.
-    /// Note: Bids with None price (e.g., APS bids with encoded prices) are skipped
-    /// when no mediator is configured, as we cannot compare them without decoding.
+    /// Select the best decoded-price bid for each slot from all responses.
     fn select_winning_bids(
         &self,
         responses: &[AuctionResponse],
@@ -801,13 +763,11 @@ impl AuctionOrchestrator {
             }
 
             for bid in &response.bids {
-                // Skip bids without decoded prices (e.g., APS bids)
-                // These require mediation layer to decode
                 let bid_price = match bid.price {
                     Some(p) => p,
                     None => {
                         log::debug!(
-                            "Skipping bid for slot '{}' from '{}' - price requires mediation to decode",
+                            "Skipping bid for slot '{}' from '{}' without a comparable price",
                             bid.slot_id,
                             bid.bidder
                         );
@@ -842,30 +802,28 @@ impl AuctionOrchestrator {
         }
 
         let starting_count = winning_bids.len();
-        winning_bids.retain(|slot_id, bid| match (floor_prices.get(slot_id), bid.price) {
-            (Some(floor), Some(price)) if price >= *floor => true,
-            (Some(_), Some(_)) => {
-                log::info!(
-                    "Dropping winning bid below floor price for slot '{}'",
-                    slot_id
-                );
-                false
-            }
-            (_, None) => {
-                // Any caller that needs to keep an undecoded (encoded-price)
-                // bid must decode it *before* invoking this function — both
-                // `select_winning_bids` and the mediator path already do.
-                // Letting `None`-price bids through here would cause
-                // `winning_bids.len()` to overcount what `build_bid_map`
-                // downstream is willing to emit, so they get dropped instead.
-                log::debug!(
-                    "Dropping bid for slot '{}' - no decoded price (caller must decode before apply_floor_prices)",
-                    slot_id
-                );
-                false
-            }
-            (None, Some(_)) => true,
-        });
+        winning_bids.retain(
+            |slot_id, bid| match (floor_prices.get(slot_id), bid.price) {
+                (Some(floor), Some(price)) if price >= *floor => true,
+                (Some(_), Some(_)) => {
+                    log::info!(
+                        "Dropping winning bid below floor price for slot '{}'",
+                        slot_id
+                    );
+                    false
+                }
+                (_, None) => {
+                    // Every downstream response requires a comparable numeric price,
+                    // so bids without one are always dropped before delivery.
+                    log::debug!(
+                        "Dropping bid for slot '{}' without a comparable price",
+                        slot_id
+                    );
+                    false
+                }
+                (None, Some(_)) => true,
+            },
+        );
 
         if winning_bids.len() != starting_count {
             log::info!(
@@ -944,10 +902,10 @@ impl AuctionOrchestrator {
         }
 
         let auction_start = Instant::now();
-        let mut backend_to_provider: HashMap<String, (String, Instant, Arc<dyn AuctionProvider>)> =
-            HashMap::new();
+        let mut backend_to_provider: HashMap<String, ProviderLaunchState> = HashMap::new();
         let mut pending_requests: Vec<PlatformPendingRequest> = Vec::new();
-        let mut launch_responses: Vec<AuctionResponse> = Vec::new();
+        let mut completed_responses: Vec<AuctionResponse> = Vec::new();
+        let mut immediate_response_count = 0usize;
 
         for provider_name in provider_names {
             let provider = match self.providers.get(provider_name) {
@@ -968,13 +926,8 @@ impl AuctionOrchestrator {
                 continue;
             }
 
-            // Remaining budget canonicalized by the platform for backend-name
-            // stability (see `PlatformBackend::canonicalize_transport_timeout_ms`).
             let remaining_ms = remaining_budget_ms(auction_start, context.timeout_ms);
-            let effective_timeout = context
-                .services
-                .backend()
-                .canonicalize_transport_timeout_ms(remaining_ms, provider.timeout_ms());
+            let effective_timeout = remaining_ms.min(provider.timeout_ms());
 
             if effective_timeout == 0 {
                 log::warn!(
@@ -985,32 +938,6 @@ impl AuctionOrchestrator {
                 continue;
             }
 
-            let backend_name = match provider.backend_name(context.services, effective_timeout) {
-                Some(name) => name,
-                None => {
-                    log::warn!(
-                        "Provider '{}' has no backend_name, skipping",
-                        provider.provider_name()
-                    );
-                    continue;
-                }
-            };
-
-            // Pre-launch guard: skip before `request_bids` fires the outbound
-            // send when another provider this auction already claimed the
-            // predicted backend name (see the parallel path). Dropping the
-            // pending handle afterwards would not retract the request.
-            if backend_to_provider.contains_key(&backend_name) {
-                log::warn!(
-                    "Provider '{}' predicted backend name '{}' already claimed by another provider \
-                     this auction; skipping dispatch before send to avoid a duplicate request",
-                    provider.provider_name(),
-                    backend_name,
-                );
-                launch_responses.push(provider_launch_failed_response(provider.provider_name(), 0));
-                continue;
-            }
-
             let provider_context = AuctionContext {
                 settings: context.settings,
                 request: context.request,
@@ -1021,58 +948,46 @@ impl AuctionOrchestrator {
 
             let start_time = Instant::now();
             match provider.request_bids(request, &provider_context).await {
-                Ok(pending) => {
-                    // Correlate on the *resolved* backend name the pending
-                    // request carries, falling back to the prediction only when
-                    // the adapter left it unset. Collection keys on the name the
-                    // response reports (Fastly's `get_backend_name()`), so keying
-                    // the map on the prediction here would drop a response whose
-                    // resolved name diverged. Mirrors run_providers_parallel.
-                    let request_backend_name = pending
+                Ok(ProviderRequestOutcome::Pending {
+                    request: pending,
+                    parse_state,
+                }) => {
+                    let backend_name = pending
                         .backend_name()
                         .map(str::to_string)
-                        .unwrap_or_else(|| {
-                            log::warn!(
-                                "Provider '{}' pending request returned no backend name; \
-                                 using predicted name '{}'",
-                                provider.provider_name(),
-                                backend_name,
-                            );
-                            backend_name.clone()
-                        });
-                    // Post-launch defense: a resolved backend name already claimed
-                    // by another provider this auction would misattribute the
-                    // collected response, so fail this launch attributably rather
-                    // than overwrite the mapping.
-                    if backend_to_provider.contains_key(&request_backend_name) {
-                        let response_time_ms = start_time.elapsed().as_millis() as u64;
+                        .or_else(|| provider.backend_name(context.services, effective_timeout));
+                    let Some(backend_name) = backend_name else {
                         log::warn!(
-                            "Provider '{}' resolved to backend name '{}' already claimed by another \
-                             provider this auction; skipping dispatch to avoid response misattribution",
-                            provider.provider_name(),
-                            request_backend_name,
+                            "Provider '{}' pending request has no backend name; response cannot be correlated",
+                            provider.provider_name()
                         );
-                        launch_responses.push(provider_launch_failed_response(
+                        completed_responses.push(provider_launch_failed_response(
                             provider.provider_name(),
-                            response_time_ms,
+                            start_time.elapsed().as_millis() as u64,
                         ));
-                    } else {
-                        log::info!(
-                            "Dispatching bid request to '{}' (backend: {}, budget: {}ms)",
-                            provider.provider_name(),
-                            request_backend_name,
-                            effective_timeout
-                        );
-                        backend_to_provider.insert(
-                            request_backend_name.clone(),
-                            (
-                                provider.provider_name().to_string(),
-                                start_time,
-                                Arc::clone(provider),
-                            ),
-                        );
-                        pending_requests.push(pending.with_backend_name(request_backend_name));
-                    }
+                        continue;
+                    };
+                    log::info!(
+                        "Dispatching bid request to '{}' (backend: {}, budget: {}ms)",
+                        provider.provider_name(),
+                        backend_name,
+                        effective_timeout
+                    );
+                    backend_to_provider.insert(
+                        backend_name.clone(),
+                        ProviderLaunchState {
+                            provider_name: provider.provider_name().to_string(),
+                            started_at: start_time,
+                            provider: Arc::clone(provider),
+                            effective_timeout_ms: effective_timeout,
+                            parse_state,
+                        },
+                    );
+                    pending_requests.push(pending.with_backend_name(backend_name));
+                }
+                Ok(ProviderRequestOutcome::Immediate(response)) => {
+                    immediate_response_count += 1;
+                    completed_responses.push(response);
                 }
                 Err(e) => {
                     let response_time_ms = start_time.elapsed().as_millis() as u64;
@@ -1081,7 +996,7 @@ impl AuctionOrchestrator {
                         provider.provider_name(),
                         e
                     );
-                    launch_responses.push(provider_launch_failed_response(
+                    completed_responses.push(provider_launch_failed_response(
                         provider.provider_name(),
                         response_time_ms,
                     ));
@@ -1089,31 +1004,33 @@ impl AuctionOrchestrator {
             }
         }
 
-        if pending_requests.is_empty() {
-            return if launch_responses.is_empty() {
+        if pending_requests.is_empty() && immediate_response_count == 0 {
+            return if completed_responses.is_empty() {
                 DispatchAuctionOutcome::NotStarted
             } else {
                 DispatchAuctionOutcome::DispatchFailed {
                     request: request.clone(),
-                    provider_responses: launch_responses,
+                    provider_responses: completed_responses,
                     elapsed_ms: auction_start.elapsed().as_millis() as u64,
                 }
             };
         }
 
         log::info!(
-            "Dispatched {} SSP requests (timeout: {}ms); Fastly host will race them against origin",
+            "Dispatched {} SSP request(s) with {} immediate response(s) (timeout: {}ms)",
             pending_requests.len(),
+            immediate_response_count,
             context.timeout_ms
         );
 
         DispatchAuctionOutcome::Dispatched(DispatchedAuction {
             pending_requests,
             backend_to_provider,
-            launch_responses,
+            completed_responses,
             auction_start,
             timeout_ms: context.timeout_ms,
             floor_prices: self.floor_prices_by_slot(request),
+            provider_request_context: Box::new(snapshot_context_request(context.request)),
             request: request.clone(),
         })
     }
@@ -1137,10 +1054,11 @@ impl AuctionOrchestrator {
         let DispatchedAuction {
             pending_requests,
             mut backend_to_provider,
-            launch_responses,
+            completed_responses,
             auction_start,
             timeout_ms,
             floor_prices,
+            provider_request_context,
             request,
         } = dispatched;
 
@@ -1151,7 +1069,7 @@ impl AuctionOrchestrator {
             remaining_budget_ms(auction_start, timeout_ms),
         );
 
-        let mut responses: Vec<AuctionResponse> = launch_responses;
+        let mut responses: Vec<AuctionResponse> = completed_responses;
         let mut remaining = pending_requests;
 
         while !remaining.is_empty() {
@@ -1180,18 +1098,23 @@ impl AuctionOrchestrator {
             match ready {
                 Ok(platform_response) => {
                     let backend_name = platform_response.backend_name.clone().unwrap_or_default();
-                    if let Some((provider_name, start_time, provider)) =
-                        backend_to_provider.remove(&backend_name)
-                    {
-                        let response_time_ms = start_time.elapsed().as_millis() as u64;
-                        // Mirror run_providers_parallel: use the context-aware
-                        // parse so providers behave identically on both paths.
-                        match provider
-                            .parse_response_with_context(
+                    if let Some(state) = backend_to_provider.remove(&backend_name) {
+                        let response_time_ms = state.started_at.elapsed().as_millis() as u64;
+                        let provider_context = AuctionContext {
+                            settings: context.settings,
+                            request: &provider_request_context,
+                            timeout_ms: state.effective_timeout_ms,
+                            provider_responses: context.provider_responses,
+                            services: context.services,
+                        };
+                        match state
+                            .provider
+                            .parse_response_with_context_and_state(
                                 platform_response,
                                 response_time_ms,
                                 &request,
-                                context,
+                                &provider_context,
+                                state.parse_state.as_deref(),
                             )
                             .await
                         {
@@ -1205,11 +1128,13 @@ impl AuctionOrchestrator {
                                 responses.push(auction_response);
                             }
                             Err(e) => {
-                                log::warn!("Provider '{}' parse failed: {:?}", provider_name, e);
-                                // Mirror the parallel path so a parse failure is
-                                // attributed (error_type + message) in provider_details.
+                                log::warn!(
+                                    "Provider '{}' parse failed: {:?}",
+                                    state.provider_name,
+                                    e
+                                );
                                 responses.push(provider_error_response(
-                                    &provider_name,
+                                    &state.provider_name,
                                     response_time_ms,
                                     ERROR_TYPE_PARSE_RESPONSE,
                                     &e,
@@ -1228,13 +1153,15 @@ impl AuctionOrchestrator {
                     // the provider behind `failed_backend_name` so it appears in
                     // provider_details instead of vanishing.
                     if let Some(ref backend_name) = failed_backend_name {
-                        if let Some((provider_name, start_time, _)) =
-                            backend_to_provider.remove(backend_name)
-                        {
-                            let response_time_ms = start_time.elapsed().as_millis() as u64;
-                            log::warn!("Provider '{}' request failed: {:?}", provider_name, e);
+                        if let Some(state) = backend_to_provider.remove(backend_name) {
+                            let response_time_ms = state.started_at.elapsed().as_millis() as u64;
+                            log::warn!(
+                                "Provider '{}' request failed: {:?}",
+                                state.provider_name,
+                                e
+                            );
                             responses.push(provider_transport_failed_response(
-                                &provider_name,
+                                &state.provider_name,
                                 response_time_ms,
                             ));
                         } else {
@@ -1262,12 +1189,16 @@ impl AuctionOrchestrator {
             // `remaining_budget_ms`.
         }
 
-        for (provider_name, start_time, _) in backend_to_provider.values() {
-            let response_time_ms = start_time.elapsed().as_millis() as u64;
+        for state in backend_to_provider.values() {
+            let response_time_ms = state.started_at.elapsed().as_millis() as u64;
             log::warn!(
-                "Provider '{provider_name}' timed out before dispatched auction collection completed"
+                "Provider '{}' timed out before dispatched auction collection completed",
+                state.provider_name
             );
-            responses.push(provider_timeout_response(provider_name, response_time_ms));
+            responses.push(provider_timeout_response(
+                &state.provider_name,
+                response_time_ms,
+            ));
         }
         backend_to_provider.clear();
 
@@ -1275,28 +1206,15 @@ impl AuctionOrchestrator {
             match self.providers.get(mediator_name.as_str()) {
                 Some(mediator) => {
                     // Cap the mediator at whichever is tighter: its own configured
-                    // timeout or the remaining auction budget (A_deadline). Giving
-                    // the mediator an uncapped timeout would let it hold `</body>`
-                    // well past A_deadline, so the effective value must never
-                    // exceed the remaining budget.
-                    //
-                    // Caveat: unlike the parallel select loop, this path has no
-                    // absolute wall-clock backstop around the mediator call, and a
-                    // backend transport timeout bounds first-byte/inactivity rather
-                    // than total response time (see the transport-deadline note on
-                    // `run_providers_parallel`). Capping the value to the remaining
-                    // budget therefore prevents the mediator from *extending* the
-                    // hold by its own configuration, but a slow-connecting or
-                    // byte-trickling mediator can still overrun; a true absolute
-                    // deadline is tracked as follow-up (#849).
-                    //
-                    // The platform canonicalizes the value for backend-name
-                    // stability (see `PlatformBackend::canonicalize_transport_timeout_ms`).
+                    // timeout or the remaining auction budget (A_deadline).  The old
+                    // comment here claimed origin drain could exhaust the budget before
+                    // collection, but SSP backends are given first-byte and between-bytes
+                    // timeouts equal to effective_timeout (capped at their provider
+                    // timeout) at dispatch time, so they cannot run past A_deadline
+                    // independently. Giving the mediator an uncapped timeout lets it run
+                    // past A_deadline, violating the bounded hold invariant.
                     let remaining = remaining_budget_ms(auction_start, timeout_ms);
-                    let mediator_timeout = services
-                        .backend()
-                        .canonicalize_transport_timeout_ms(remaining, mediator.timeout_ms());
-                    if mediator_timeout == 0 {
+                    if remaining == 0 {
                         log::warn!(
                             "A_deadline exhausted before mediator '{}' — returning {} SSP bids without mediation",
                             mediator.provider_name(),
@@ -1311,6 +1229,7 @@ impl AuctionOrchestrator {
                             metadata: HashMap::new(),
                         };
                     }
+                    let mediator_timeout = remaining.min(mediator.timeout_ms());
                     let mediator_start = Instant::now();
                     log::info!(
                         "Running mediator '{}' with {}ms budget (A_deadline remaining: {}ms, configured: {}ms)",
@@ -1336,77 +1255,76 @@ impl AuctionOrchestrator {
                         provider_responses: Some(&responses),
                         services: context.services,
                     };
-                    match mediator.request_bids(&request, &mediator_context).await {
-                        Ok(pending) => {
-                            let platform_resp = services.http_client().wait(pending).await;
-                            match platform_resp.change_context(TrustedServerError::Auction {
-                                message: format!(
-                                    "Mediator {} request failed",
-                                    mediator.provider_name()
-                                ),
-                            }) {
-                                Ok(platform_resp) => {
-                                    let response_time_ms =
-                                        mediator_start.elapsed().as_millis() as u64;
-                                    // Mirror run_parallel_mediation: use the
-                                    // context-aware parse so the mediator sees
-                                    // the collected provider responses.
-                                    match mediator
-                                        .parse_response_with_context(
-                                            platform_resp,
-                                            response_time_ms,
-                                            &request,
-                                            &mediator_context,
-                                        )
-                                        .await
-                                    {
-                                        Ok(mediator_resp) => {
-                                            let winning = mediator_resp
-                                                .bids
-                                                .iter()
-                                                .filter_map(|bid| {
-                                                    if bid.price.is_none() {
-                                                        log::warn!(
-                                                            "Mediator '{}' returned bid for slot '{}' without decoded price - skipping",
-                                                            mediator.provider_name(),
-                                                            bid.slot_id
-                                                        );
-                                                        None
-                                                    } else {
-                                                        Some((bid.slot_id.clone(), bid.clone()))
-                                                    }
-                                                })
-                                                .collect();
-                                            let winning =
-                                                self.apply_floor_prices(winning, &floor_prices);
-                                            (Some(mediator_resp), winning)
-                                        }
-                                        Err(e) => {
-                                            log::warn!(
-                                                "Mediator '{}' parse failed: {:?}",
-                                                mediator.provider_name(),
-                                                e
-                                            );
-                                            let winning =
-                                                self.select_winning_bids(&responses, &floor_prices);
-                                            (None, winning)
-                                        }
+                    let mediator_response =
+                        match mediator.request_bids(&request, &mediator_context).await {
+                            Ok(ProviderRequestOutcome::Immediate(response)) => Some(response),
+                            Ok(ProviderRequestOutcome::Pending {
+                                request: pending,
+                                parse_state,
+                            }) => match services.http_client().wait(pending).await.change_context(
+                                TrustedServerError::Auction {
+                                    message: format!(
+                                        "Mediator {} request failed",
+                                        mediator.provider_name()
+                                    ),
+                                },
+                            ) {
+                                Ok(platform_resp) => match mediator
+                                    .parse_response_with_context_and_state(
+                                        platform_resp,
+                                        mediator_start.elapsed().as_millis() as u64,
+                                        &request,
+                                        &mediator_context,
+                                        parse_state.as_deref(),
+                                    )
+                                    .await
+                                {
+                                    Ok(response) => Some(response),
+                                    Err(error) => {
+                                        log::warn!(
+                                            "Mediator '{}' parse failed: {:?}",
+                                            mediator.provider_name(),
+                                            error
+                                        );
+                                        None
                                     }
+                                },
+                                Err(error) => {
+                                    log::warn!("Mediator request failed: {:?}", error);
+                                    None
                                 }
-                                Err(e) => {
-                                    log::warn!("Mediator request failed: {:?}", e);
-                                    (None, self.select_winning_bids(&responses, &floor_prices))
-                                }
+                            },
+                            Err(error) => {
+                                log::warn!(
+                                    "Mediator '{}' failed to dispatch: {:?}",
+                                    mediator.provider_name(),
+                                    error
+                                );
+                                None
                             }
-                        }
-                        Err(e) => {
-                            log::warn!(
-                                "Mediator '{}' failed to dispatch: {:?}",
-                                mediator.provider_name(),
-                                e
-                            );
-                            (None, self.select_winning_bids(&responses, &floor_prices))
-                        }
+                        };
+
+                    if let Some(mediator_response) = mediator_response {
+                        let winning = mediator_response
+                            .bids
+                            .iter()
+                            .filter_map(|bid| {
+                                if bid.price.is_none() {
+                                    log::warn!(
+                                        "Mediator '{}' returned bid for slot '{}' without decoded price - skipping",
+                                        mediator.provider_name(),
+                                        bid.slot_id
+                                    );
+                                    None
+                                } else {
+                                    Some((bid.slot_id.clone(), bid.clone()))
+                                }
+                            })
+                            .collect();
+                        let winning = self.apply_floor_prices(winning, &floor_prices);
+                        (Some(mediator_response), winning)
+                    } else {
+                        (None, self.select_winning_bids(&responses, &floor_prices))
                     }
                 }
                 None => {
@@ -1482,25 +1400,21 @@ mod tests {
 
     use crate::auction::config::AuctionConfig;
     use crate::auction::orchestrator::DispatchAuctionOutcome;
-    use crate::auction::provider::AuctionProvider;
+    use crate::auction::provider::{AuctionProvider, ProviderRequestOutcome};
     use crate::auction::test_support::create_test_auction_context;
     use crate::auction::types::{
-        AdFormat, AdSlot, AuctionContext, AuctionRequest, AuctionResponse, Bid, BidStatus,
-        MediaType, PublisherInfo, UserInfo,
+        AdFormat, AdSlot, ApsRendererV1, ApsTagType, AuctionContext, AuctionRequest,
+        AuctionResponse, Bid, BidRenderer, BidStatus, MediaType, PublisherInfo, UserInfo,
     };
     use crate::error::TrustedServerError;
     use crate::platform::test_support::{
-        StubHttpClient, build_services_with_backend_and_http_client,
-        build_services_with_http_client,
-    };
-    use crate::platform::{
-        PlatformBackend, PlatformBackendSpec, PlatformError, PlatformHttpRequest,
-        PlatformPendingRequest, PlatformResponse, RuntimeServices,
+        StubHttpClient, build_services_with_http_client, noop_services,
     };
+    use crate::platform::{PlatformHttpRequest, PlatformResponse, RuntimeServices};
     use crate::test_support::tests::crate_test_settings_str;
     use error_stack::{Report, ResultExt};
     use std::collections::{HashMap, HashSet};
-    use std::sync::{Arc, Mutex};
+    use std::sync::Arc;
 
     use super::AuctionOrchestrator;
 
@@ -1508,56 +1422,9 @@ mod tests {
     // Minimal test double for AuctionProvider
     // ---------------------------------------------------------------------------
 
-    /// Minimal stub provider. Optionally records the transport timeouts it
-    /// observes, keeping the value passed to `backend_name` (which derives the
-    /// predicted backend name) separate from the `context.timeout_ms` handed to
-    /// `request_bids` (which configures the registered request). Recording them
-    /// separately lets tests assert the orchestrator hands the *same*
-    /// canonicalized value to both — a divergence would land responses in the
-    /// "unknown backend" branch and drop bids.
     struct StubAuctionProvider {
         name: &'static str,
         backend: &'static str,
-        configured_timeout_ms: u32,
-        predicted_timeouts: Option<Arc<Mutex<Vec<u32>>>>,
-        request_timeouts: Option<Arc<Mutex<Vec<u32>>>>,
-    }
-
-    impl StubAuctionProvider {
-        fn new(name: &'static str, backend: &'static str) -> Self {
-            Self {
-                name,
-                backend,
-                configured_timeout_ms: 2000,
-                predicted_timeouts: None,
-                request_timeouts: None,
-            }
-        }
-
-        fn recording(
-            name: &'static str,
-            backend: &'static str,
-            configured_timeout_ms: u32,
-            predicted_timeouts: Arc<Mutex<Vec<u32>>>,
-            request_timeouts: Arc<Mutex<Vec<u32>>>,
-        ) -> Self {
-            Self {
-                name,
-                backend,
-                configured_timeout_ms,
-                predicted_timeouts: Some(predicted_timeouts),
-                request_timeouts: Some(request_timeouts),
-            }
-        }
-
-        fn record(slot: &Option<Arc<Mutex<Vec<u32>>>>, timeout_ms: u32) {
-            if let Some(observed) = slot {
-                observed
-                    .lock()
-                    .expect("should lock observed timeouts")
-                    .push(timeout_ms);
-            }
-        }
     }
 
     #[async_trait::async_trait(?Send)]
@@ -1570,8 +1437,7 @@ mod tests {
             &self,
             _request: &AuctionRequest,
             context: &AuctionContext<'_>,
-        ) -> Result<PlatformPendingRequest, Report<TrustedServerError>> {
-            Self::record(&self.request_timeouts, context.timeout_ms);
+        ) -> Result<ProviderRequestOutcome, Report<TrustedServerError>> {
             let req = PlatformHttpRequest::new(
                 http::Request::builder()
                     .method("POST")
@@ -1588,6 +1454,7 @@ mod tests {
                 .change_context(TrustedServerError::Auction {
                     message: "stub launch failed".to_string(),
                 })
+                .map(ProviderRequestOutcome::pending)
         }
 
         async fn parse_response(
@@ -1602,84 +1469,31 @@ mod tests {
             ))
         }
 
-        fn timeout_ms(&self) -> u32 {
-            self.configured_timeout_ms
-        }
-
-        fn backend_name(&self, _services: &RuntimeServices, timeout_ms: u32) -> Option<String> {
-            Self::record(&self.predicted_timeouts, timeout_ms);
-            Some(self.backend.to_string())
-        }
-    }
-
-    /// Provider whose `backend_name` prediction deliberately differs from the
-    /// backend name its `request_bids` puts on the wire (the resolved name the
-    /// pending request carries and collection correlates by). Models an adapter
-    /// that resolves a name unequal to the orchestrator's prediction, exercising
-    /// the dispatched path's resolved-name correlation and post-launch guard.
-    struct DivergentBackendProvider {
-        name: &'static str,
-        predicted: &'static str,
-        resolved: &'static str,
-    }
-
-    impl DivergentBackendProvider {
-        fn new(name: &'static str, predicted: &'static str, resolved: &'static str) -> Self {
-            Self {
-                name,
-                predicted,
-                resolved,
-            }
-        }
-    }
-
-    #[async_trait::async_trait(?Send)]
-    impl AuctionProvider for DivergentBackendProvider {
-        fn provider_name(&self) -> &'static str {
-            self.name
-        }
-
-        async fn request_bids(
+        async fn parse_response_with_context(
             &self,
+            response: PlatformResponse,
+            response_time_ms: u64,
             _request: &AuctionRequest,
             context: &AuctionContext<'_>,
-        ) -> Result<PlatformPendingRequest, Report<TrustedServerError>> {
-            let req = PlatformHttpRequest::new(
-                http::Request::builder()
-                    .method("POST")
-                    .uri("https://example.com/bid")
-                    .body(edgezero_core::body::Body::empty())
-                    .expect("should build stub bid request"),
-                self.resolved,
-            );
-            context
-                .services
-                .http_client()
-                .send_async(req)
-                .await
-                .change_context(TrustedServerError::Auction {
-                    message: "stub launch failed".to_string(),
-                })
-        }
-
-        async fn parse_response(
-            &self,
-            _response: PlatformResponse,
-            response_time_ms: u64,
         ) -> Result<AuctionResponse, Report<TrustedServerError>> {
-            Ok(AuctionResponse::success(
-                self.name,
-                vec![],
-                response_time_ms,
-            ))
+            let referer = context
+                .request
+                .headers()
+                .get(http::header::REFERER)
+                .and_then(|value| value.to_str().ok());
+            Ok(self
+                .parse_response(response, response_time_ms)
+                .await?
+                .with_metadata("context_referer", serde_json::json!(referer))
+                .with_metadata("context_timeout_ms", serde_json::json!(context.timeout_ms)))
         }
 
         fn timeout_ms(&self) -> u32 {
-            2000
+            125
         }
 
         fn backend_name(&self, _services: &RuntimeServices, _timeout_ms: u32) -> Option<String> {
-            Some(self.predicted.to_string())
+            Some(self.backend.to_string())
         }
     }
 
@@ -1688,6 +1502,44 @@ mod tests {
     /// the synchronous mediation path calls `parse_response_with_context`.
     struct CacheRestoringMediator;
 
+    fn auction_bid(bidder: &str, price: f64) -> Bid {
+        let renderer = (bidder == "aps").then(|| {
+            BidRenderer::Aps(ApsRendererV1 {
+                version: 1,
+                account_id: "example-account".to_string(),
+                bid_id: "aps-selected-bid".to_string(),
+                creative_id: None,
+                tag_type: ApsTagType::Iframe,
+                creative_url: "https://creative.example/render".to_string(),
+                aax_response: "fictional-base64".to_string(),
+                width: 300,
+                height: 250,
+            })
+        });
+        Bid {
+            slot_id: "slot-1".to_string(),
+            price: Some(price),
+            currency: "USD".to_string(),
+            creative: renderer
+                .is_none()
+                .then(|| "<div>ordinary</div>".to_string()),
+            adomain: None,
+            bidder: bidder.to_string(),
+            width: 300,
+            height: 250,
+            nurl: None,
+            burl: None,
+            bid_id: (bidder == "aps").then(|| "aps-selected-bid".to_string()),
+            ad_id: None,
+            creative_id: None,
+            renderer,
+            cache_id: None,
+            cache_host: None,
+            cache_path: None,
+            metadata: HashMap::new(),
+        }
+    }
+
     fn mediated_bid(nurl: Option<String>) -> Bid {
         Bid {
             slot_id: "header-banner".to_string(),
@@ -1700,7 +1552,10 @@ mod tests {
             height: 90,
             nurl: nurl.clone(),
             burl: nurl,
+            bid_id: None,
             ad_id: Some("creative-123".to_string()),
+            creative_id: None,
+            renderer: None,
             cache_id: Some("cache-abc".to_string()),
             cache_host: None,
             cache_path: None,
@@ -1718,7 +1573,7 @@ mod tests {
             &self,
             _request: &AuctionRequest,
             context: &AuctionContext<'_>,
-        ) -> Result<PlatformPendingRequest, Report<TrustedServerError>> {
+        ) -> Result<ProviderRequestOutcome, Report<TrustedServerError>> {
             let req = PlatformHttpRequest::new(
                 http::Request::builder()
                     .method("POST")
@@ -1735,6 +1590,7 @@ mod tests {
                 .change_context(TrustedServerError::Auction {
                     message: "mediator launch failed".to_string(),
                 })
+                .map(ProviderRequestOutcome::pending)
         }
 
         async fn parse_response(
@@ -1774,6 +1630,41 @@ mod tests {
         }
     }
 
+    struct ImmediateMediator;
+
+    #[async_trait::async_trait(?Send)]
+    impl AuctionProvider for ImmediateMediator {
+        fn provider_name(&self) -> &'static str {
+            "immediate-mediator"
+        }
+
+        async fn request_bids(
+            &self,
+            _request: &AuctionRequest,
+            _context: &AuctionContext<'_>,
+        ) -> Result<ProviderRequestOutcome, Report<TrustedServerError>> {
+            Ok(ProviderRequestOutcome::Immediate(AuctionResponse::success(
+                self.provider_name(),
+                vec![mediated_bid(Some(
+                    "https://nurl.example/immediate".to_string(),
+                ))],
+                0,
+            )))
+        }
+
+        async fn parse_response(
+            &self,
+            _response: PlatformResponse,
+            _response_time_ms: u64,
+        ) -> Result<AuctionResponse, Report<TrustedServerError>> {
+            panic!("immediate mediator response should not be parsed");
+        }
+
+        fn timeout_ms(&self) -> u32 {
+            2000
+        }
+    }
+
     #[tokio::test]
     async fn mediated_bid_preserves_restored_fields_through_run_auction() {
         // run_parallel_mediation must parse the mediator response via
@@ -1795,10 +1686,10 @@ mod tests {
             ..Default::default()
         };
         let mut orchestrator = AuctionOrchestrator::new(config);
-        orchestrator.register_provider(Arc::new(StubAuctionProvider::new(
-            "bidder",
-            "bidder-backend",
-        )));
+        orchestrator.register_provider(Arc::new(StubAuctionProvider {
+            name: "bidder",
+            backend: "bidder-backend",
+        }));
         orchestrator.register_provider(Arc::new(CacheRestoringMediator));
 
         let request = create_test_auction_request();
@@ -1837,21 +1728,84 @@ mod tests {
         );
     }
 
-    fn create_test_auction_request() -> AuctionRequest {
-        AuctionRequest {
-            id: "test-auction-123".to_string(),
-            slots: vec![
-                AdSlot {
-                    id: "header-banner".to_string(),
-                    formats: vec![AdFormat {
-                        media_type: MediaType::Banner,
-                        width: 728,
-                        height: 90,
-                    }],
-                    floor_price: Some(1.50),
-                    targeting: HashMap::new(),
-                    bidders: HashMap::new(),
-                },
+    #[tokio::test]
+    async fn immediate_mediator_completes_in_sync_and_split_paths() {
+        for split in [false, true] {
+            let stub = Arc::new(StubHttpClient::new());
+            stub.push_response(200, b"{}".to_vec());
+            let services = build_services_with_http_client(stub);
+            let config = AuctionConfig {
+                enabled: true,
+                providers: vec!["bidder".to_string()],
+                mediator: Some("immediate-mediator".to_string()),
+                timeout_ms: 2000,
+                ..Default::default()
+            };
+            let mut orchestrator = AuctionOrchestrator::new(config);
+            orchestrator.register_provider(Arc::new(StubAuctionProvider {
+                name: "bidder",
+                backend: "bidder-backend",
+            }));
+            orchestrator.register_provider(Arc::new(ImmediateMediator));
+            let request = create_test_auction_request();
+            let settings = create_test_settings();
+            let downstream = http::Request::new(edgezero_core::body::Body::empty());
+            let context = AuctionContext {
+                settings: &settings,
+                request: &downstream,
+                timeout_ms: 2000,
+                provider_responses: None,
+                services: &services,
+            };
+
+            let result = if split {
+                let DispatchAuctionOutcome::Dispatched(dispatched) =
+                    orchestrator.dispatch_auction(&request, &context).await
+                else {
+                    panic!("bidder request should dispatch");
+                };
+                orchestrator
+                    .collect_dispatched_auction(dispatched, &services, &context)
+                    .await
+            } else {
+                orchestrator
+                    .run_auction(&request, &context)
+                    .await
+                    .expect("auction with immediate mediator should complete")
+            };
+
+            assert_eq!(
+                result
+                    .mediator_response
+                    .as_ref()
+                    .map(|response| response.provider.as_str()),
+                Some("immediate-mediator")
+            );
+            assert_eq!(
+                result
+                    .winning_bids
+                    .get("header-banner")
+                    .and_then(|bid| bid.nurl.as_deref()),
+                Some("https://nurl.example/immediate")
+            );
+        }
+    }
+
+    fn create_test_auction_request() -> AuctionRequest {
+        AuctionRequest {
+            id: "test-auction-123".to_string(),
+            slots: vec![
+                AdSlot {
+                    id: "header-banner".to_string(),
+                    formats: vec![AdFormat {
+                        media_type: MediaType::Banner,
+                        width: 728,
+                        height: 90,
+                    }],
+                    floor_price: Some(1.50),
+                    targeting: HashMap::new(),
+                    bidders: HashMap::new(),
+                },
                 AdSlot {
                     id: "sidebar".to_string(),
                     formats: vec![AdFormat {
@@ -1884,6 +1838,38 @@ mod tests {
         crate::settings::Settings::from_toml(&settings_str).expect("should parse test settings")
     }
 
+    struct ImmediateNoBidProvider;
+
+    #[async_trait::async_trait(?Send)]
+    impl AuctionProvider for ImmediateNoBidProvider {
+        fn provider_name(&self) -> &'static str {
+            "immediate"
+        }
+
+        async fn request_bids(
+            &self,
+            _request: &AuctionRequest,
+            _context: &AuctionContext<'_>,
+        ) -> Result<ProviderRequestOutcome, Report<TrustedServerError>> {
+            Ok(ProviderRequestOutcome::Immediate(AuctionResponse::no_bid(
+                "immediate",
+                0,
+            )))
+        }
+
+        async fn parse_response(
+            &self,
+            _response: PlatformResponse,
+            _response_time_ms: u64,
+        ) -> Result<AuctionResponse, Report<TrustedServerError>> {
+            panic!("immediate response should not be parsed");
+        }
+
+        fn timeout_ms(&self) -> u32 {
+            2000
+        }
+    }
+
     struct LaunchFailingProvider;
 
     #[async_trait::async_trait(?Send)]
@@ -1896,7 +1882,7 @@ mod tests {
             &self,
             _request: &AuctionRequest,
             _context: &AuctionContext<'_>,
-        ) -> Result<PlatformPendingRequest, Report<TrustedServerError>> {
+        ) -> Result<ProviderRequestOutcome, Report<TrustedServerError>> {
             Err(Report::new(TrustedServerError::Auction {
                 message: "launch failed in test provider".to_string(),
             }))
@@ -1921,6 +1907,124 @@ mod tests {
         }
     }
 
+    fn immediate_test_context<'a>(
+        settings: &'a crate::settings::Settings,
+        request: &'a http::Request<edgezero_core::body::Body>,
+        services: &'a RuntimeServices,
+    ) -> AuctionContext<'a> {
+        AuctionContext {
+            settings,
+            request,
+            timeout_ms: 2000,
+            provider_responses: None,
+            services,
+        }
+    }
+
+    #[tokio::test]
+    async fn synchronous_auction_accepts_an_all_immediate_no_bid_result() {
+        let config = AuctionConfig {
+            enabled: true,
+            providers: vec!["immediate".to_string()],
+            timeout_ms: 2000,
+            ..Default::default()
+        };
+        let mut orchestrator = AuctionOrchestrator::new(config);
+        orchestrator.register_provider(Arc::new(ImmediateNoBidProvider));
+        let settings = create_test_settings();
+        let services = noop_services();
+        let downstream = http::Request::new(edgezero_core::body::Body::empty());
+        let context = immediate_test_context(&settings, &downstream, &services);
+
+        let result = orchestrator
+            .run_auction(&create_test_auction_request(), &context)
+            .await
+            .expect("all-immediate auction should complete");
+
+        assert_eq!(result.provider_responses.len(), 1);
+        assert_eq!(result.provider_responses[0].status, BidStatus::NoBid);
+        assert!(result.winning_bids.is_empty());
+    }
+
+    #[tokio::test]
+    async fn split_auction_accepts_an_all_immediate_no_bid_result() {
+        let config = AuctionConfig {
+            enabled: true,
+            providers: vec!["immediate".to_string()],
+            timeout_ms: 2000,
+            ..Default::default()
+        };
+        let mut orchestrator = AuctionOrchestrator::new(config);
+        orchestrator.register_provider(Arc::new(ImmediateNoBidProvider));
+        let settings = create_test_settings();
+        let services = noop_services();
+        let downstream = http::Request::new(edgezero_core::body::Body::empty());
+        let context = immediate_test_context(&settings, &downstream, &services);
+
+        let DispatchAuctionOutcome::Dispatched(dispatched) = orchestrator
+            .dispatch_auction(&create_test_auction_request(), &context)
+            .await
+        else {
+            panic!("enabled immediate provider should dispatch");
+        };
+        let result = orchestrator
+            .collect_dispatched_auction(dispatched, &services, &context)
+            .await;
+
+        assert_eq!(result.provider_responses.len(), 1);
+        assert_eq!(result.provider_responses[0].status, BidStatus::NoBid);
+        assert!(result.winning_bids.is_empty());
+    }
+
+    #[tokio::test]
+    async fn immediate_and_pending_providers_complete_in_sync_and_split_paths() {
+        for split in [false, true] {
+            let config = AuctionConfig {
+                enabled: true,
+                providers: vec!["immediate".to_string(), "pending".to_string()],
+                timeout_ms: 2000,
+                ..Default::default()
+            };
+            let mut orchestrator = AuctionOrchestrator::new(config);
+            orchestrator.register_provider(Arc::new(ImmediateNoBidProvider));
+            orchestrator.register_provider(Arc::new(StubAuctionProvider {
+                name: "pending",
+                backend: "pending-backend",
+            }));
+            let stub = Arc::new(StubHttpClient::new());
+            stub.push_response(200, b"{}".to_vec());
+            let services = build_services_with_http_client(stub);
+            let settings = create_test_settings();
+            let downstream = http::Request::new(edgezero_core::body::Body::empty());
+            let context = immediate_test_context(&settings, &downstream, &services);
+            let request = create_test_auction_request();
+
+            let result = if split {
+                let DispatchAuctionOutcome::Dispatched(dispatched) =
+                    orchestrator.dispatch_auction(&request, &context).await
+                else {
+                    panic!("mixed immediate/pending auction should dispatch");
+                };
+                orchestrator
+                    .collect_dispatched_auction(dispatched, &services, &context)
+                    .await
+            } else {
+                orchestrator
+                    .run_auction(&request, &context)
+                    .await
+                    .expect("mixed immediate/pending auction should complete")
+            };
+
+            assert_eq!(result.provider_responses.len(), 2);
+            assert!(result.provider_responses.iter().any(|response| {
+                response.provider == "immediate" && response.status == BidStatus::NoBid
+            }));
+            assert!(result.provider_responses.iter().any(|response| {
+                response.provider == "pending" && response.status == BidStatus::Success
+            }));
+        }
+    }
+
     #[test]
     fn provider_error_response_includes_diagnostic_metadata() {
         let error = Report::new(TrustedServerError::Auction {
@@ -2039,7 +2143,10 @@ mod tests {
                 height: 250,
                 nurl: None,
                 burl: None,
+                bid_id: None,
                 ad_id: None,
+                creative_id: None,
+                renderer: None,
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
@@ -2059,7 +2166,10 @@ mod tests {
                 height: 250,
                 nurl: None,
                 burl: None,
+                bid_id: None,
                 ad_id: None,
+                creative_id: None,
+                renderer: None,
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
@@ -2081,21 +2191,14 @@ mod tests {
         );
     }
 
-    // TODO: Re-enable provider integration tests after implementing mock support
-    // for `PlatformHttpClient::send_async()`. Mock providers currently cannot
-    // create realistic pending requests for the select loop without real
-    // platform-backed transport handles.
-    //
-    // Untested timeout enforcement paths (require real backends):
+    // Timeout paths still need a controllable delayed pending response:
     // - Deadline check in select() loop (drops remaining requests)
     // - Mediator skip when remaining_ms == 0 (bidding exhausts budget)
     // - Provider skip when effective_timeout == 0 (budget exhausted before launch)
     // - Provider context receives reduced timeout_ms per remaining budget
     //
-    // Follow-up: introduce a thin abstraction over `PlatformHttpClient::select()`
-    // so the deadline/drop logic can be unit-tested with mock futures instead
-    // of requiring real platform backends. An `#[ignore]` integration test
-    // exercising the full path via Viceroy would also catch regressions.
+    // Follow-up: extend StubHttpClient with delayed responses so these paths can
+    // be asserted deterministically without real backends or wall-clock races.
 
     #[test]
     fn test_no_providers_configured() {
@@ -2160,51 +2263,6 @@ mod tests {
         });
     }
 
-    #[test]
-    fn rejects_duplicate_configured_providers() {
-        // A provider listed twice canonicalizes to one backend name, so the
-        // duplicate would only be caught after its second outbound request had
-        // already fired. Startup validation must reject it up front.
-        let config = AuctionConfig {
-            enabled: true,
-            providers: vec!["prebid".to_string(), "prebid".to_string()],
-            timeout_ms: 2000,
-            ..Default::default()
-        };
-        let orchestrator = AuctionOrchestrator::new(config);
-
-        let err = orchestrator
-            .validate_configured_provider_names()
-            .expect_err("should reject a provider listed more than once");
-        assert!(
-            err.to_string().contains("listed more than once"),
-            "should explain the duplicate provider, got: {err}"
-        );
-    }
-
-    #[test]
-    fn rejects_mediator_also_listed_as_provider() {
-        // A provider acting as its own mediator would be called twice per
-        // auction (bidding phase, then mediation); its demand already flows
-        // through the mediation response, so reject the overlap at startup.
-        let config = AuctionConfig {
-            enabled: true,
-            providers: vec!["prebid".to_string()],
-            mediator: Some("prebid".to_string()),
-            timeout_ms: 2000,
-            ..Default::default()
-        };
-        let orchestrator = AuctionOrchestrator::new(config);
-
-        let err = orchestrator
-            .validate_configured_provider_names()
-            .expect_err("should reject a mediator that is also a provider");
-        assert!(
-            err.to_string().contains("may not mediate its own auction"),
-            "should explain the mediator/provider overlap, got: {err}"
-        );
-    }
-
     #[test]
     fn test_orchestrator_is_enabled() {
         let config = AuctionConfig {
@@ -2257,86 +2315,38 @@ mod tests {
         );
     }
 
-    /// Test backend whose [`PlatformBackend::canonicalize_transport_timeout_ms`]
-    /// returns a fixed value regardless of the wall-clock budget, so the
-    /// orchestrator's transport-timeout wiring can be asserted without timing
-    /// flakiness. Records every `(remaining_ms, configured_ms)` pair it sees.
-    ///
-    /// The exact quantization arithmetic lives in the Fastly adapter (the only
-    /// platform that overrides `canonicalize_transport_timeout_ms`); these core
-    /// tests only prove the orchestrator applies whatever the platform returns
-    /// and applies it identically to the predicted name and the launched
-    /// request.
-    struct CanonicalTimeoutBackend {
-        canonical_ms: u32,
-        calls: Arc<Mutex<Vec<(u32, u32)>>>,
-    }
-
-    impl CanonicalTimeoutBackend {
-        fn new(canonical_ms: u32, calls: Arc<Mutex<Vec<(u32, u32)>>>) -> Self {
-            Self {
-                canonical_ms,
-                calls,
-            }
-        }
-    }
-
-    impl PlatformBackend for CanonicalTimeoutBackend {
-        fn predict_name(
-            &self,
-            _spec: &PlatformBackendSpec,
-        ) -> Result<String, Report<PlatformError>> {
-            Ok("stub-backend".to_owned())
-        }
-
-        fn ensure(&self, _spec: &PlatformBackendSpec) -> Result<String, Report<PlatformError>> {
-            Ok("stub-backend".to_owned())
-        }
-
-        fn canonicalize_transport_timeout_ms(&self, remaining_ms: u32, configured_ms: u32) -> u32 {
-            self.calls
-                .lock()
-                .expect("should lock canonicalize calls")
-                .push((remaining_ms, configured_ms));
-            self.canonical_ms
-        }
-    }
-
     #[test]
-    fn parallel_launch_applies_canonical_timeout_to_name_and_request() {
+    fn select_error_is_attributed_to_correct_provider() {
         futures::executor::block_on(async {
-            // The orchestrator must hand the platform-canonicalized value to
-            // BOTH `backend_name` (which derives the correlation key) and
-            // `request_bids` (via `context.timeout_ms`). Recording them
-            // separately and asserting exact equality catches a regression that
-            // predicts one bucket but registers another — which would drop the
-            // response into the "unknown backend" branch.
+            // Arrange: two stub providers backed by distinct backend names.
+            // The stub HTTP client injects a select() error for the first request
+            // that completes (backend-a). backend-b should still produce a success.
             let stub = Arc::new(StubHttpClient::new());
-            stub.push_response(200, b"{}".to_vec());
-            let calls = Arc::new(Mutex::new(Vec::new()));
-            let backend = Arc::new(CanonicalTimeoutBackend::new(750, Arc::clone(&calls)));
-            let services = build_services_with_backend_and_http_client(backend, stub);
+            stub.push_response(200, b"{}".to_vec()); // consumed by send_async for backend-a
+            stub.push_response(200, b"{}".to_vec()); // consumed by send_async for backend-b
+            stub.push_select_error(); // first select() reports backend-a as failed
+
+            let services = build_services_with_http_client(stub);
             // SAFETY: `Box::leak` creates a `'static` reference for test use only.
             // The leaked allocation is bounded to the test process lifetime.
             let services: &'static RuntimeServices = Box::leak(Box::new(services));
 
-            let predicted = Arc::new(Mutex::new(Vec::new()));
-            let requested = Arc::new(Mutex::new(Vec::new()));
             let config = AuctionConfig {
                 enabled: true,
-                providers: vec!["bidder".to_string()],
+                providers: vec!["provider-a".to_string(), "provider-b".to_string()],
                 timeout_ms: 2000,
                 mediator: None,
                 ..Default::default()
             };
             let mut orchestrator = AuctionOrchestrator::new(config);
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::recording(
-                "bidder",
-                "bidder-backend",
-                1000,
-                Arc::clone(&predicted),
-                Arc::clone(&requested),
-            )));
+            orchestrator.register_provider(Arc::new(StubAuctionProvider {
+                name: "provider-a",
+                backend: "backend-a",
+            }));
+            orchestrator.register_provider(Arc::new(StubAuctionProvider {
+                name: "provider-b",
+                backend: "backend-b",
+            }));
 
             let request = create_test_auction_request();
             let settings = create_test_settings();
@@ -2353,68 +2363,143 @@ mod tests {
                 services,
             };
 
-            orchestrator
+            // Act
+            let result = orchestrator
                 .run_auction(&request, &context)
                 .await
-                .expect("should complete auction");
+                .expect("should complete auction even when one provider errors");
 
-            let predicted = predicted.lock().expect("should lock predicted");
-            let requested = requested.lock().expect("should lock requested");
+            // Assert: exactly two responses — one error, one success.
             assert_eq!(
-                *predicted,
-                vec![750],
-                "backend_name should receive the canonicalized value"
+                result.provider_responses.len(),
+                2,
+                "should collect responses from both providers"
             );
+
+            let provider_a = result
+                .provider_responses
+                .iter()
+                .find(|r| r.provider == "provider-a")
+                .expect("should have provider-a response");
+            let provider_b = result
+                .provider_responses
+                .iter()
+                .find(|r| r.provider == "provider-b")
+                .expect("should have provider-b response");
+
             assert_eq!(
-                *requested,
-                vec![750],
-                "request_bids should receive the same canonicalized value"
+                provider_a.status,
+                BidStatus::Error,
+                "provider-a should be marked error — select() Err was attributed via failed_backend_name"
             );
             assert_eq!(
-                *predicted, *requested,
-                "predicted and registered transport timeouts must be identical"
+                provider_b.status,
+                BidStatus::Success,
+                "provider-b should succeed — error was correctly isolated to provider-a"
             );
+        });
+    }
+
+    #[test]
+    fn dispatched_collection_reuses_provider_launch_context() {
+        futures::executor::block_on(async {
+            let stub = Arc::new(StubHttpClient::new());
+            stub.push_response(200, b"{}".to_vec());
+            let services = build_services_with_http_client(stub);
+            let config = AuctionConfig {
+                enabled: true,
+                providers: vec!["provider-a".to_string()],
+                timeout_ms: 750,
+                mediator: None,
+                ..Default::default()
+            };
+            let mut orchestrator = AuctionOrchestrator::new(config);
+            orchestrator.register_provider(Arc::new(StubAuctionProvider {
+                name: "provider-a",
+                backend: "backend-a",
+            }));
+            let request = create_test_auction_request();
+            let settings = create_test_settings();
+            let downstream = http::Request::builder()
+                .uri("https://publisher.example/article")
+                .header(http::header::REFERER, "https://referrer.example/source")
+                .body(edgezero_core::body::Body::empty())
+                .expect("should build downstream request");
+            let dispatch_context = AuctionContext {
+                settings: &settings,
+                request: &downstream,
+                timeout_ms: 750,
+                provider_responses: None,
+                services: &services,
+            };
+            let dispatched = match orchestrator
+                .dispatch_auction(&request, &dispatch_context)
+                .await
+            {
+                DispatchAuctionOutcome::Dispatched(dispatched) => dispatched,
+                _ => panic!("should dispatch provider request"),
+            };
+            let placeholder = http::Request::builder()
+                .uri("https://placeholder.invalid/")
+                .body(edgezero_core::body::Body::empty())
+                .expect("should build placeholder request");
+            let collect_context = AuctionContext {
+                settings: &settings,
+                request: &placeholder,
+                timeout_ms: 750,
+                provider_responses: None,
+                services: &services,
+            };
 
-            let calls = calls.lock().expect("should lock calls");
-            assert_eq!(calls.len(), 1, "should canonicalize once for the launch");
-            let (remaining_ms, configured_ms) = calls[0];
+            let result = orchestrator
+                .collect_dispatched_auction(dispatched, &services, &collect_context)
+                .await;
+
+            let response = result
+                .provider_responses
+                .first()
+                .expect("should collect provider response");
             assert_eq!(
-                configured_ms, 1000,
-                "should pass the provider's configured timeout as the configured bound"
+                response.metadata["context_referer"], "https://referrer.example/source",
+                "should parse with the downstream request used at launch"
             );
-            assert!(
-                remaining_ms > 0 && remaining_ms <= 2000,
-                "should pass the live remaining budget, got {remaining_ms}ms"
+            assert_eq!(
+                response.metadata["context_timeout_ms"], 125,
+                "should parse with the provider-capped launch timeout"
             );
         });
     }
 
     #[test]
-    fn zero_canonical_timeout_skips_parallel_launch() {
+    fn rejects_multi_provider_fanout_before_launch_on_sequential_platform() {
         futures::executor::block_on(async {
-            // A platform that canonicalizes to zero signals "budget exhausted";
-            // the orchestrator must skip the launch. With the only provider
-            // skipped, no requests launch and the auction errors.
+            // Arrange: two configured providers on a platform whose HTTP
+            // client executes send_async eagerly (no concurrent fan-out).
             let stub = Arc::new(StubHttpClient::new());
-            let calls = Arc::new(Mutex::new(Vec::new()));
-            let backend = Arc::new(CanonicalTimeoutBackend::new(0, Arc::clone(&calls)));
-            let services = build_services_with_backend_and_http_client(backend, stub);
+            stub.set_concurrent_fanout(false);
+            let stub_for_assertion = Arc::clone(&stub);
+
+            let services = build_services_with_http_client(stub);
             // SAFETY: `Box::leak` creates a `'static` reference for test use only.
             // The leaked allocation is bounded to the test process lifetime.
             let services: &'static RuntimeServices = Box::leak(Box::new(services));
 
             let config = AuctionConfig {
                 enabled: true,
-                providers: vec!["bidder".to_string()],
+                providers: vec!["provider-a".to_string(), "provider-b".to_string()],
                 timeout_ms: 2000,
                 mediator: None,
                 ..Default::default()
             };
             let mut orchestrator = AuctionOrchestrator::new(config);
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::new(
-                "bidder",
-                "bidder-backend",
-            )));
+            orchestrator.register_provider(Arc::new(StubAuctionProvider {
+                name: "provider-a",
+                backend: "backend-a",
+            }));
+            orchestrator.register_provider(Arc::new(StubAuctionProvider {
+                name: "provider-b",
+                backend: "backend-b",
+            }));
 
             let request = create_test_auction_request();
             let settings = create_test_settings();
@@ -2431,622 +2516,7 @@ mod tests {
                 services,
             };
 
-            let result = orchestrator.run_auction(&request, &context).await;
-            assert!(
-                result.is_err(),
-                "should error when the only provider is skipped for an exhausted budget"
-            );
-        });
-    }
-
-    #[test]
-    fn synchronous_mediation_applies_canonical_timeout_to_mediator() {
-        futures::executor::block_on(async {
-            // The mediator runs after the bidding phase and has no select-loop
-            // backstop; it must still receive the platform-canonicalized value
-            // for both prediction and request.
-            let stub = Arc::new(StubHttpClient::new());
-            stub.push_response(200, b"{}".to_vec()); // bidder send_async
-            stub.push_response(200, b"{}".to_vec()); // mediator send_async
-            let calls = Arc::new(Mutex::new(Vec::new()));
-            let backend = Arc::new(CanonicalTimeoutBackend::new(500, Arc::clone(&calls)));
-            let services = build_services_with_backend_and_http_client(backend, stub);
-            // SAFETY: `Box::leak` creates a `'static` reference for test use only.
-            // The leaked allocation is bounded to the test process lifetime.
-            let services: &'static RuntimeServices = Box::leak(Box::new(services));
-
-            let predicted = Arc::new(Mutex::new(Vec::new()));
-            let requested = Arc::new(Mutex::new(Vec::new()));
-            let config = AuctionConfig {
-                enabled: true,
-                providers: vec!["bidder".to_string()],
-                mediator: Some("mediator".to_string()),
-                timeout_ms: 2000,
-                ..Default::default()
-            };
-            let mut orchestrator = AuctionOrchestrator::new(config);
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::new(
-                "bidder",
-                "bidder-backend",
-            )));
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::recording(
-                "mediator",
-                "mediator-backend",
-                2000,
-                Arc::clone(&predicted),
-                Arc::clone(&requested),
-            )));
-
-            let request = create_test_auction_request();
-            let settings = create_test_settings();
-            let req = http::Request::builder()
-                .method(http::Method::GET)
-                .uri("https://example.com/test")
-                .body(edgezero_core::body::Body::empty())
-                .expect("should build request");
-            let context = AuctionContext {
-                settings: &settings,
-                request: &req,
-                timeout_ms: 2000,
-                provider_responses: None,
-                services,
-            };
-
-            orchestrator
-                .run_auction(&request, &context)
-                .await
-                .expect("should complete mediated auction");
-
-            let predicted = predicted.lock().expect("should lock predicted");
-            let requested = requested.lock().expect("should lock requested");
-            // The orchestrator hands the mediator its budget through
-            // `context.timeout_ms` and calls `request_bids` directly; it does not
-            // call the mediator's `backend_name` (the mediator self-registers its
-            // backend), so only the request side is observed here.
-            assert!(
-                predicted.is_empty(),
-                "orchestrator should not separately predict a backend name for the mediator"
-            );
-            assert_eq!(
-                *requested,
-                vec![500],
-                "mediator request should use the canonical value"
-            );
-        });
-    }
-
-    #[test]
-    fn dispatched_collect_applies_canonical_timeout_to_both_paths() {
-        futures::executor::block_on(async {
-            // Same wiring invariant on the split dispatch/collect path used by
-            // publisher page rendering: the dispatched bidder and the collected
-            // mediator both receive the canonicalized value for prediction and
-            // request.
-            let stub = Arc::new(StubHttpClient::new());
-            stub.push_response(200, b"{}".to_vec()); // bidder send_async
-            stub.push_response(200, b"{}".to_vec()); // mediator send_async
-            let calls = Arc::new(Mutex::new(Vec::new()));
-            let backend = Arc::new(CanonicalTimeoutBackend::new(500, Arc::clone(&calls)));
-            let services = build_services_with_backend_and_http_client(backend, stub);
-            // SAFETY: `Box::leak` creates a `'static` reference for test use only.
-            // The leaked allocation is bounded to the test process lifetime.
-            let services: &'static RuntimeServices = Box::leak(Box::new(services));
-
-            let bidder_predicted = Arc::new(Mutex::new(Vec::new()));
-            let bidder_requested = Arc::new(Mutex::new(Vec::new()));
-            let mediator_predicted = Arc::new(Mutex::new(Vec::new()));
-            let mediator_requested = Arc::new(Mutex::new(Vec::new()));
-            let config = AuctionConfig {
-                enabled: true,
-                providers: vec!["bidder".to_string()],
-                mediator: Some("mediator".to_string()),
-                timeout_ms: 2000,
-                ..Default::default()
-            };
-            let mut orchestrator = AuctionOrchestrator::new(config);
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::recording(
-                "bidder",
-                "bidder-backend",
-                2000,
-                Arc::clone(&bidder_predicted),
-                Arc::clone(&bidder_requested),
-            )));
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::recording(
-                "mediator",
-                "mediator-backend",
-                2000,
-                Arc::clone(&mediator_predicted),
-                Arc::clone(&mediator_requested),
-            )));
-
-            let request = create_test_auction_request();
-            let settings = create_test_settings();
-            let req = http::Request::builder()
-                .method(http::Method::GET)
-                .uri("https://example.com/test")
-                .body(edgezero_core::body::Body::empty())
-                .expect("should build request");
-            let context = AuctionContext {
-                settings: &settings,
-                request: &req,
-                timeout_ms: 2000,
-                provider_responses: None,
-                services,
-            };
-
-            let dispatched = match orchestrator.dispatch_auction(&request, &context).await {
-                DispatchAuctionOutcome::Dispatched(dispatched) => dispatched,
-                _ => panic!("should dispatch the bidder request"),
-            };
-            orchestrator
-                .collect_dispatched_auction(dispatched, services, &context)
-                .await;
-
-            let bidder_predicted = bidder_predicted
-                .lock()
-                .expect("should lock bidder predicted");
-            let bidder_requested = bidder_requested
-                .lock()
-                .expect("should lock bidder requested");
-            assert_eq!(
-                *bidder_predicted,
-                vec![500],
-                "dispatched bidder name should use canonical value"
-            );
-            assert_eq!(
-                *bidder_requested,
-                vec![500],
-                "dispatched bidder request should use canonical value"
-            );
-            assert_eq!(
-                *bidder_predicted, *bidder_requested,
-                "dispatched bidder predicted and registered timeouts must be identical"
-            );
-
-            let mediator_predicted = mediator_predicted
-                .lock()
-                .expect("should lock mediator predicted");
-            let mediator_requested = mediator_requested
-                .lock()
-                .expect("should lock mediator requested");
-            // As on the synchronous path, the orchestrator calls the mediator's
-            // `request_bids` directly without predicting a backend name for it.
-            assert!(
-                mediator_predicted.is_empty(),
-                "orchestrator should not separately predict a backend name for the mediator"
-            );
-            assert_eq!(
-                *mediator_requested,
-                vec![500],
-                "mediator request should use the canonical value"
-            );
-        });
-    }
-
-    #[test]
-    fn parallel_duplicate_backend_name_fails_second_provider_attributably() {
-        futures::executor::block_on(async {
-            // Two providers that canonicalize to the SAME backend name (e.g. two
-            // auction providers behind one gateway origin). The correlation map
-            // keys on backend name, so the second must not silently overwrite
-            // the first — it must fail attributably so no bid is misparsed or
-            // lost.
-            let stub = Arc::new(StubHttpClient::new());
-            stub.push_response(200, b"{}".to_vec()); // provider-a send_async
-            stub.push_response(200, b"{}".to_vec()); // provider-b send_async (dropped after guard)
-            let services = build_services_with_http_client(stub);
-            // SAFETY: `Box::leak` creates a `'static` reference for test use only.
-            // The leaked allocation is bounded to the test process lifetime.
-            let services: &'static RuntimeServices = Box::leak(Box::new(services));
-
-            let config = AuctionConfig {
-                enabled: true,
-                providers: vec!["provider-a".to_string(), "provider-b".to_string()],
-                timeout_ms: 2000,
-                mediator: None,
-                ..Default::default()
-            };
-            let mut orchestrator = AuctionOrchestrator::new(config);
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::new(
-                "provider-a",
-                "shared-backend",
-            )));
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::new(
-                "provider-b",
-                "shared-backend",
-            )));
-
-            let request = create_test_auction_request();
-            let settings = create_test_settings();
-            let req = http::Request::builder()
-                .method(http::Method::GET)
-                .uri("https://example.com/test")
-                .body(edgezero_core::body::Body::empty())
-                .expect("should build request");
-            let context = AuctionContext {
-                settings: &settings,
-                request: &req,
-                timeout_ms: 2000,
-                provider_responses: None,
-                services,
-            };
-
-            let result = orchestrator
-                .run_auction(&request, &context)
-                .await
-                .expect("should complete auction despite the name collision");
-
-            assert_eq!(
-                result.provider_responses.len(),
-                2,
-                "should account for both providers"
-            );
-            let provider_a = result
-                .provider_responses
-                .iter()
-                .find(|r| r.provider == "provider-a")
-                .expect("should have provider-a response");
-            let provider_b = result
-                .provider_responses
-                .iter()
-                .find(|r| r.provider == "provider-b")
-                .expect("should have provider-b response");
-            assert_eq!(
-                provider_a.status,
-                BidStatus::Success,
-                "the first provider on the shared name should launch and succeed"
-            );
-            assert_eq!(
-                provider_b.status,
-                BidStatus::Error,
-                "the second provider on the shared name should fail attributably, not be dropped"
-            );
-        });
-    }
-
-    #[test]
-    fn dispatched_duplicate_backend_name_fails_second_provider_attributably() {
-        futures::executor::block_on(async {
-            // Same collision defense on the dispatch/collect path.
-            let stub = Arc::new(StubHttpClient::new());
-            stub.push_response(200, b"{}".to_vec()); // provider-a send_async
-            stub.push_response(200, b"{}".to_vec()); // provider-b send_async (dropped after guard)
-            let services = build_services_with_http_client(stub);
-            // SAFETY: `Box::leak` creates a `'static` reference for test use only.
-            // The leaked allocation is bounded to the test process lifetime.
-            let services: &'static RuntimeServices = Box::leak(Box::new(services));
-
-            let config = AuctionConfig {
-                enabled: true,
-                providers: vec!["provider-a".to_string(), "provider-b".to_string()],
-                timeout_ms: 2000,
-                mediator: None,
-                ..Default::default()
-            };
-            let mut orchestrator = AuctionOrchestrator::new(config);
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::new(
-                "provider-a",
-                "shared-backend",
-            )));
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::new(
-                "provider-b",
-                "shared-backend",
-            )));
-
-            let request = create_test_auction_request();
-            let settings = create_test_settings();
-            let req = http::Request::builder()
-                .method(http::Method::GET)
-                .uri("https://example.com/test")
-                .body(edgezero_core::body::Body::empty())
-                .expect("should build request");
-            let context = AuctionContext {
-                settings: &settings,
-                request: &req,
-                timeout_ms: 2000,
-                provider_responses: None,
-                services,
-            };
-
-            let dispatched = match orchestrator.dispatch_auction(&request, &context).await {
-                DispatchAuctionOutcome::Dispatched(dispatched) => dispatched,
-                _ => panic!("should dispatch the first provider despite the name collision"),
-            };
-            let result = orchestrator
-                .collect_dispatched_auction(dispatched, services, &context)
-                .await;
-
-            let provider_b = result
-                .provider_responses
-                .iter()
-                .find(|r| r.provider == "provider-b")
-                .expect("should have provider-b response");
-            assert_eq!(
-                provider_b.status,
-                BidStatus::Error,
-                "the second provider on the shared name should fail attributably, not be dropped"
-            );
-        });
-    }
-
-    #[test]
-    fn dispatched_resolved_backend_name_diverging_from_prediction_still_correlates() {
-        futures::executor::block_on(async {
-            // The dispatched path must correlate on the backend name the pending
-            // request resolves to, not the orchestrator's prediction. A provider
-            // whose resolved name differs from its prediction would otherwise land
-            // its response in the "unknown backend" branch and drop the bid.
-            let stub = Arc::new(StubHttpClient::new());
-            stub.push_response(200, b"{}".to_vec());
-            let services = build_services_with_http_client(stub);
-            // SAFETY: `Box::leak` creates a `'static` reference for test use only.
-            // The leaked allocation is bounded to the test process lifetime.
-            let services: &'static RuntimeServices = Box::leak(Box::new(services));
-
-            let config = AuctionConfig {
-                enabled: true,
-                providers: vec!["provider-a".to_string()],
-                timeout_ms: 2000,
-                mediator: None,
-                ..Default::default()
-            };
-            let mut orchestrator = AuctionOrchestrator::new(config);
-            orchestrator.register_provider(Arc::new(DivergentBackendProvider::new(
-                "provider-a",
-                "predicted-backend",
-                "resolved-backend",
-            )));
-
-            let request = create_test_auction_request();
-            let settings = create_test_settings();
-            let req = http::Request::builder()
-                .method(http::Method::GET)
-                .uri("https://example.com/test")
-                .body(edgezero_core::body::Body::empty())
-                .expect("should build request");
-            let context = AuctionContext {
-                settings: &settings,
-                request: &req,
-                timeout_ms: 2000,
-                provider_responses: None,
-                services,
-            };
-
-            let dispatched = match orchestrator.dispatch_auction(&request, &context).await {
-                DispatchAuctionOutcome::Dispatched(dispatched) => dispatched,
-                _ => panic!("should dispatch the diverging provider"),
-            };
-            let result = orchestrator
-                .collect_dispatched_auction(dispatched, services, &context)
-                .await;
-
-            let provider_a = result
-                .provider_responses
-                .iter()
-                .find(|r| r.provider == "provider-a")
-                .expect("should have provider-a response");
-            assert_eq!(
-                provider_a.status,
-                BidStatus::Success,
-                "response should correlate by the resolved backend name, not the prediction"
-            );
-        });
-    }
-
-    #[test]
-    fn dispatched_post_launch_resolved_name_collision_fails_second_provider_attributably() {
-        futures::executor::block_on(async {
-            // Two providers with *distinct* predictions that resolve to the SAME
-            // backend name. The pre-launch guard keys on the predictions and lets
-            // both through; only the post-launch guard, reading the resolved name,
-            // can catch the collision. The second must fail attributably.
-            let stub = Arc::new(StubHttpClient::new());
-            stub.push_response(200, b"{}".to_vec()); // provider-a send_async
-            stub.push_response(200, b"{}".to_vec()); // provider-b send_async (dropped after guard)
-            let services = build_services_with_http_client(stub);
-            // SAFETY: `Box::leak` creates a `'static` reference for test use only.
-            // The leaked allocation is bounded to the test process lifetime.
-            let services: &'static RuntimeServices = Box::leak(Box::new(services));
-
-            let config = AuctionConfig {
-                enabled: true,
-                providers: vec!["provider-a".to_string(), "provider-b".to_string()],
-                timeout_ms: 2000,
-                mediator: None,
-                ..Default::default()
-            };
-            let mut orchestrator = AuctionOrchestrator::new(config);
-            orchestrator.register_provider(Arc::new(DivergentBackendProvider::new(
-                "provider-a",
-                "predicted-a",
-                "shared-resolved",
-            )));
-            orchestrator.register_provider(Arc::new(DivergentBackendProvider::new(
-                "provider-b",
-                "predicted-b",
-                "shared-resolved",
-            )));
-
-            let request = create_test_auction_request();
-            let settings = create_test_settings();
-            let req = http::Request::builder()
-                .method(http::Method::GET)
-                .uri("https://example.com/test")
-                .body(edgezero_core::body::Body::empty())
-                .expect("should build request");
-            let context = AuctionContext {
-                settings: &settings,
-                request: &req,
-                timeout_ms: 2000,
-                provider_responses: None,
-                services,
-            };
-
-            let dispatched = match orchestrator.dispatch_auction(&request, &context).await {
-                DispatchAuctionOutcome::Dispatched(dispatched) => dispatched,
-                _ => {
-                    panic!("should dispatch the first provider despite the resolved-name collision")
-                }
-            };
-            let result = orchestrator
-                .collect_dispatched_auction(dispatched, services, &context)
-                .await;
-
-            let provider_a = result
-                .provider_responses
-                .iter()
-                .find(|r| r.provider == "provider-a")
-                .expect("should have provider-a response");
-            let provider_b = result
-                .provider_responses
-                .iter()
-                .find(|r| r.provider == "provider-b")
-                .expect("should have provider-b response");
-            assert_eq!(
-                provider_a.status,
-                BidStatus::Success,
-                "the first provider on the shared resolved name should launch and succeed"
-            );
-            assert_eq!(
-                provider_b.status,
-                BidStatus::Error,
-                "the second provider colliding on the resolved name should fail attributably"
-            );
-        });
-    }
-
-    #[test]
-    fn select_error_is_attributed_to_correct_provider() {
-        futures::executor::block_on(async {
-            // Arrange: two stub providers backed by distinct backend names.
-            // The stub HTTP client injects a select() error for the first request
-            // that completes (backend-a). backend-b should still produce a success.
-            let stub = Arc::new(StubHttpClient::new());
-            stub.push_response(200, b"{}".to_vec()); // consumed by send_async for backend-a
-            stub.push_response(200, b"{}".to_vec()); // consumed by send_async for backend-b
-            stub.push_select_error(); // first select() reports backend-a as failed
-
-            let services = build_services_with_http_client(stub);
-            // SAFETY: `Box::leak` creates a `'static` reference for test use only.
-            // The leaked allocation is bounded to the test process lifetime.
-            let services: &'static RuntimeServices = Box::leak(Box::new(services));
-
-            let config = AuctionConfig {
-                enabled: true,
-                providers: vec!["provider-a".to_string(), "provider-b".to_string()],
-                timeout_ms: 2000,
-                mediator: None,
-                ..Default::default()
-            };
-            let mut orchestrator = AuctionOrchestrator::new(config);
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::new(
-                "provider-a",
-                "backend-a",
-            )));
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::new(
-                "provider-b",
-                "backend-b",
-            )));
-
-            let request = create_test_auction_request();
-            let settings = create_test_settings();
-            let req = http::Request::builder()
-                .method(http::Method::GET)
-                .uri("https://example.com/test")
-                .body(edgezero_core::body::Body::empty())
-                .expect("should build request");
-            let context = AuctionContext {
-                settings: &settings,
-                request: &req,
-                timeout_ms: 2000,
-                provider_responses: None,
-                services,
-            };
-
-            // Act
-            let result = orchestrator
-                .run_auction(&request, &context)
-                .await
-                .expect("should complete auction even when one provider errors");
-
-            // Assert: exactly two responses — one error, one success.
-            assert_eq!(
-                result.provider_responses.len(),
-                2,
-                "should collect responses from both providers"
-            );
-
-            let provider_a = result
-                .provider_responses
-                .iter()
-                .find(|r| r.provider == "provider-a")
-                .expect("should have provider-a response");
-            let provider_b = result
-                .provider_responses
-                .iter()
-                .find(|r| r.provider == "provider-b")
-                .expect("should have provider-b response");
-
-            assert_eq!(
-                provider_a.status,
-                BidStatus::Error,
-                "provider-a should be marked error — select() Err was attributed via failed_backend_name"
-            );
-            assert_eq!(
-                provider_b.status,
-                BidStatus::Success,
-                "provider-b should succeed — error was correctly isolated to provider-a"
-            );
-        });
-    }
-
-    #[test]
-    fn rejects_multi_provider_fanout_before_launch_on_sequential_platform() {
-        futures::executor::block_on(async {
-            // Arrange: two configured providers on a platform whose HTTP
-            // client executes send_async eagerly (no concurrent fan-out).
-            let stub = Arc::new(StubHttpClient::new());
-            stub.set_concurrent_fanout(false);
-            let stub_for_assertion = Arc::clone(&stub);
-
-            let services = build_services_with_http_client(stub);
-            // SAFETY: `Box::leak` creates a `'static` reference for test use only.
-            // The leaked allocation is bounded to the test process lifetime.
-            let services: &'static RuntimeServices = Box::leak(Box::new(services));
-
-            let config = AuctionConfig {
-                enabled: true,
-                providers: vec!["provider-a".to_string(), "provider-b".to_string()],
-                timeout_ms: 2000,
-                mediator: None,
-                ..Default::default()
-            };
-            let mut orchestrator = AuctionOrchestrator::new(config);
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::new(
-                "provider-a",
-                "backend-a",
-            )));
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::new(
-                "provider-b",
-                "backend-b",
-            )));
-
-            let request = create_test_auction_request();
-            let settings = create_test_settings();
-            let req = http::Request::builder()
-                .method(http::Method::GET)
-                .uri("https://example.com/test")
-                .body(edgezero_core::body::Body::empty())
-                .expect("should build request");
-            let context = AuctionContext {
-                settings: &settings,
-                request: &req,
-                timeout_ms: 2000,
-                provider_responses: None,
-                services,
-            };
-
-            // Act
+            // Act
             let result = orchestrator.run_auction(&request, &context).await;
 
             // Assert: rejected before any provider request launches.
@@ -3087,14 +2557,14 @@ mod tests {
                 ..Default::default()
             };
             let mut orchestrator = AuctionOrchestrator::new(config);
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::new(
-                "provider-a",
-                "backend-a",
-            )));
-            orchestrator.register_provider(Arc::new(StubAuctionProvider::new(
-                "provider-b",
-                "backend-b",
-            )));
+            orchestrator.register_provider(Arc::new(StubAuctionProvider {
+                name: "provider-a",
+                backend: "backend-a",
+            }));
+            orchestrator.register_provider(Arc::new(StubAuctionProvider {
+                name: "provider-b",
+                backend: "backend-b",
+            }));
 
             let request = create_test_auction_request();
             let settings = create_test_settings();
@@ -3127,14 +2597,42 @@ mod tests {
     }
 
     #[test]
-    fn test_apply_floor_prices_drops_bids_with_undecoded_price() {
-        // Bids that reach apply_floor_prices with `price=None` cannot have a
-        // floor compared against them — and they would not survive downstream
-        // (build_bid_map filters them) — so apply_floor_prices drops them so
-        // the count it reports matches what eventually ships to the client.
-        // Both production paths (select_winning_bids and the mediator filter)
-        // already decode/skip None prices before calling this function; this
-        // test pins the contract.
+    fn decoded_aps_bid_competes_directly_by_cpm() {
+        let orchestrator = AuctionOrchestrator::new(AuctionConfig::default());
+        let floor_prices = HashMap::new();
+        let response = |provider: &str, bid: Bid| AuctionResponse::success(provider, vec![bid], 1);
+
+        let aps_wins = orchestrator.select_winning_bids(
+            &[
+                response("aps", auction_bid("aps", 2.0)),
+                response("ordinary", auction_bid("ordinary", 1.0)),
+            ],
+            &floor_prices,
+        );
+        let winner = aps_wins.get("slot-1").expect("should select APS bid");
+        assert_eq!(winner.bidder, "aps");
+        assert!(winner.renderer.is_some());
+        assert!(winner.creative.is_none());
+
+        let ordinary_wins = orchestrator.select_winning_bids(
+            &[
+                response("aps", auction_bid("aps", 2.0)),
+                response("ordinary", auction_bid("ordinary", 3.0)),
+            ],
+            &floor_prices,
+        );
+        assert_eq!(
+            ordinary_wins
+                .get("slot-1")
+                .expect("should select ordinary bid")
+                .bidder,
+            "ordinary"
+        );
+    }
+
+    #[test]
+    fn test_apply_floor_prices_drops_bids_without_price() {
+        // Price-less bids cannot be compared or delivered and remain fail-closed.
         let orchestrator = AuctionOrchestrator::new(AuctionConfig::default());
         let mut floor_prices = HashMap::new();
         floor_prices.insert("slot-1".to_string(), 1.00);
@@ -3153,18 +2651,14 @@ mod tests {
                 height: 250,
                 nurl: None,
                 burl: None,
+                bid_id: None,
                 ad_id: None,
+                creative_id: None,
+                renderer: None,
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
-                metadata: {
-                    let mut m = HashMap::new();
-                    m.insert(
-                        "amznbid".to_string(),
-                        serde_json::json!("encoded_price_data"),
-                    );
-                    m
-                },
+                metadata: HashMap::new(),
             },
         );
 
@@ -3176,15 +2670,13 @@ mod tests {
         );
         assert!(
             !filtered.contains_key("slot-1"),
-            "slot-1 should not survive when its bid has no decoded price"
+            "slot-1 should not survive when its bid has no price"
         );
     }
 
     #[test]
     fn test_apply_floor_prices_drops_decoded_aps_bid_below_floor() {
-        // After mediation decodes an APS bid, apply_floor_prices must enforce the
-        // slot floor on the resulting price=Some(x) value. This test simulates the
-        // state of a bid after mediator decoding: price is Some, amznbid is gone.
+        // APS supplies decoded price at the provider boundary, so normal floors apply.
         let orchestrator = AuctionOrchestrator::new(AuctionConfig::default());
         let mut floor_prices = HashMap::new();
         floor_prices.insert("atf".to_string(), 0.50);
@@ -3203,7 +2695,10 @@ mod tests {
                 height: 250,
                 nurl: None,
                 burl: None,
+                bid_id: None,
                 ad_id: None,
+                creative_id: None,
+                renderer: None,
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
@@ -3239,7 +2734,10 @@ mod tests {
                 height: 250,
                 nurl: None,
                 burl: None,
+                bid_id: None,
                 ad_id: None,
+                creative_id: None,
+                renderer: None,
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
diff --git a/crates/trusted-server-core/src/auction/provider.rs b/crates/trusted-server-core/src/auction/provider.rs
index 86305bf1b..766bd7a08 100644
--- a/crates/trusted-server-core/src/auction/provider.rs
+++ b/crates/trusted-server-core/src/auction/provider.rs
@@ -1,5 +1,7 @@
 //! Trait definition for auction providers.
 
+use core::any::Any;
+
 use async_trait::async_trait;
 use error_stack::Report;
 
@@ -8,20 +10,56 @@ use crate::platform::{PlatformPendingRequest, PlatformResponse, RuntimeServices}
 
 use super::types::{AuctionContext, AuctionRequest, AuctionResponse};
 
+/// Provider-local state carried from request dispatch to response parsing.
+pub type ProviderParseState = Box<dyn Any + Send + Sync>;
+
+/// Result of asking a provider to start a bid request.
+pub enum ProviderRequestOutcome {
+    /// An upstream request is in flight and must be awaited by the orchestrator.
+    Pending {
+        /// Platform-specific pending request handle.
+        request: PlatformPendingRequest,
+        /// Optional provider-local state consumed when the response is parsed.
+        parse_state: Option<ProviderParseState>,
+    },
+    /// A complete provider response that required no upstream request.
+    Immediate(AuctionResponse),
+}
+
+impl ProviderRequestOutcome {
+    /// Wrap an ordinary pending provider request without parse state.
+    #[must_use]
+    pub fn pending(request: PlatformPendingRequest) -> Self {
+        Self::Pending {
+            request,
+            parse_state: None,
+        }
+    }
+
+    /// Wrap a pending provider request with provider-local parse state.
+    #[must_use]
+    pub fn pending_with_state(
+        request: PlatformPendingRequest,
+        parse_state: ProviderParseState,
+    ) -> Self {
+        Self::Pending {
+            request,
+            parse_state: Some(parse_state),
+        }
+    }
+}
+
 /// Trait implemented by all auction providers (Prebid, APS, GAM, etc.).
 #[async_trait(?Send)]
 pub trait AuctionProvider: Send + Sync {
     /// Unique identifier for this provider (e.g., "prebid", "aps", "gam").
     fn provider_name(&self) -> &'static str;
 
-    /// Submit a bid request to this provider and return a pending request.
+    /// Submit a bid request to this provider.
     ///
-    /// Implementations should:
-    /// - Transform `AuctionRequest` to provider-specific format
-    /// - Make an HTTP call through `context.services.http_client().send_async(...)`
-    /// - Return [`PlatformPendingRequest`] for the orchestrator to await
-    ///
-    /// The orchestrator will handle waiting for responses and parsing them.
+    /// Implementations normally return a pending upstream request, but may return
+    /// an immediate response for a legitimate outcome that requires no HTTP call.
+    /// The orchestrator handles waiting for and parsing pending responses.
     ///
     /// # Errors
     ///
@@ -32,7 +70,7 @@ pub trait AuctionProvider: Send + Sync {
         &self,
         request: &AuctionRequest,
         context: &AuctionContext<'_>,
-    ) -> Result<PlatformPendingRequest, Report<TrustedServerError>>;
+    ) -> Result<ProviderRequestOutcome, Report<TrustedServerError>>;
 
     /// Parse the response from the provider into an `AuctionResponse`.
     ///
@@ -71,6 +109,27 @@ pub trait AuctionProvider: Send + Sync {
         self.parse_response(response, response_time_ms).await
     }
 
+    /// Parse a response with access to provider-local dispatch state.
+    ///
+    /// The default ignores `parse_state` and preserves the context-aware parser
+    /// contract. Providers should downcast only state they created themselves.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the response cannot be parsed into a valid [`AuctionResponse`].
+    async fn parse_response_with_context_and_state(
+        &self,
+        response: PlatformResponse,
+        response_time_ms: u64,
+        request: &AuctionRequest,
+        context: &AuctionContext<'_>,
+        parse_state: Option<&(dyn Any + Send + Sync)>,
+    ) -> Result<AuctionResponse, Report<TrustedServerError>> {
+        let _ = parse_state;
+        self.parse_response_with_context(response, response_time_ms, request, context)
+            .await
+    }
+
     /// Check if this provider supports a specific media type.
     fn supports_media_type(&self, media_type: &super::types::MediaType) -> bool {
         // By default, support banner ads
diff --git a/crates/trusted-server-core/src/auction/telemetry.rs b/crates/trusted-server-core/src/auction/telemetry.rs
index 02752c6f9..b3e049eaf 100644
--- a/crates/trusted-server-core/src/auction/telemetry.rs
+++ b/crates/trusted-server-core/src/auction/telemetry.rs
@@ -212,6 +212,8 @@ pub enum AuctionTerminalOutcome<'a> {
         request: &'a AuctionRequest,
         /// Orchestration result.
         result: &'a OrchestrationResult,
+        /// Winners actually serialized for delivery, when conversion can drop bids.
+        delivered_winner_slots: Option<&'a HashSet<String>>,
     },
     /// Execution failure.
     ExecutionFailed {
@@ -506,7 +508,11 @@ pub fn build_auction_events(
     let mut rows = Vec::new();
 
     match terminal {
-        AuctionTerminalOutcome::Completed { request, result } => {
+        AuctionTerminalOutcome::Completed {
+            request,
+            result,
+            delivered_winner_slots,
+        } => {
             push_summary(
                 &mut rows,
                 &observation,
@@ -514,7 +520,7 @@ pub fn build_auction_events(
                 AuctionTerminalStatus::Completed,
                 None,
                 result.total_time_ms,
-                result.winning_bids.len(),
+                delivered_winner_slots.map_or(result.winning_bids.len(), HashSet::len),
             );
             push_provider_rows(
                 &mut rows,
@@ -532,7 +538,14 @@ pub fn build_auction_events(
                     "mediator",
                 );
             }
-            push_bid_rows(&mut rows, &observation, &event_ts, request, result);
+            push_bid_rows(
+                &mut rows,
+                &observation,
+                &event_ts,
+                request,
+                result,
+                delivered_winner_slots,
+            );
         }
         AuctionTerminalOutcome::ExecutionFailed {
             request: _,
@@ -682,6 +695,7 @@ fn push_bid_rows(
     event_ts: &str,
     request: &AuctionRequest,
     result: &OrchestrationResult,
+    delivered_winner_slots: Option<&HashSet<String>>,
 ) {
     let mut matched_wins = HashSet::new();
 
@@ -691,7 +705,9 @@ fn push_bid_rows(
                 .winning_bids
                 .iter()
                 .find(|(slot_id, winning)| {
-                    !matched_wins.contains(*slot_id) && bid_matches_winning_bid(bid, winning)
+                    delivered_winner_slots.is_none_or(|slots| slots.contains(*slot_id))
+                        && !matched_wins.contains(*slot_id)
+                        && bid_matches_winning_bid(bid, winning)
                 })
                 .map(|(slot_id, winning)| (slot_id.clone(), winning));
             let (is_win, price) = if let Some((slot_id, winning)) = matched_slot {
@@ -714,7 +730,9 @@ fn push_bid_rows(
 
     if let Some(mediator_response) = &result.mediator_response {
         for (slot_id, winning) in &result.winning_bids {
-            if matched_wins.contains(slot_id) {
+            if delivered_winner_slots.is_some_and(|slots| !slots.contains(slot_id))
+                || matched_wins.contains(slot_id)
+            {
                 continue;
             }
             if mediator_response
@@ -960,7 +978,10 @@ mod tests {
             height: 250,
             nurl: None,
             burl: None,
+            bid_id: None,
             ad_id: ad_id.map(str::to_owned),
+            creative_id: None,
+            renderer: None,
             cache_id: None,
             cache_host: None,
             cache_path: None,
@@ -1039,6 +1060,7 @@ mod tests {
             AuctionTerminalOutcome::Completed {
                 request: &request,
                 result: &result,
+                delivered_winner_slots: None,
             },
         );
 
@@ -1078,6 +1100,45 @@ mod tests {
         );
     }
 
+    #[test]
+    fn completed_events_do_not_mark_dropped_winners_as_delivered() {
+        let request = test_request("ts-ec-derived-id");
+        let provider_success = AuctionResponse::success(
+            "prebid",
+            vec![bid("slot-1", "kargo", Some("ad-1"), Some(1.25))],
+            42,
+        );
+        let result = OrchestrationResult {
+            provider_responses: vec![provider_success.clone()],
+            mediator_response: None,
+            winning_bids: HashMap::from([("slot-1".to_owned(), provider_success.bids[0].clone())]),
+            total_time_ms: 42,
+            metadata: HashMap::new(),
+        };
+        let delivered = HashSet::new();
+        let batch = build_auction_events(
+            AuctionObservationContext::for_test(AuctionSource::AuctionApi, "/auction", 1),
+            AuctionTerminalOutcome::Completed {
+                request: &request,
+                result: &result,
+                delivered_winner_slots: Some(&delivered),
+            },
+        );
+
+        let summary = batch
+            .rows()
+            .iter()
+            .find(|row| row.event_kind == "summary")
+            .expect("should emit summary row");
+        assert_eq!(summary.winning_bid_count, Some(0));
+        let bid_row = batch
+            .rows()
+            .iter()
+            .find(|row| row.event_kind == "bid")
+            .expect("should preserve parsed bid telemetry");
+        assert_eq!(bid_row.is_win, Some(0));
+    }
+
     #[test]
     fn provider_call_maps_http_status_errors_to_their_own_bucket() {
         // A non-2xx upstream status (e.g. a PBS 4xx/5xx) is tagged
@@ -1103,6 +1164,7 @@ mod tests {
             AuctionTerminalOutcome::Completed {
                 request: &request,
                 result: &result,
+                delivered_winner_slots: None,
             },
         );
 
@@ -1140,6 +1202,7 @@ mod tests {
             AuctionTerminalOutcome::Completed {
                 request: &request,
                 result: &result,
+                delivered_winner_slots: None,
             },
         );
         let winning_rows: Vec<_> = batch
@@ -1179,6 +1242,7 @@ mod tests {
             AuctionTerminalOutcome::Completed {
                 request: &request,
                 result: &result,
+                delivered_winner_slots: None,
             },
         )
         .to_ndjson(4096)
diff --git a/crates/trusted-server-core/src/auction/types.rs b/crates/trusted-server-core/src/auction/types.rs
index 14c7713f8..0165be9a0 100644
--- a/crates/trusted-server-core/src/auction/types.rs
+++ b/crates/trusted-server-core/src/auction/types.rs
@@ -3,13 +3,17 @@
 use edgezero_core::body::Body as EdgeBody;
 use http::Request;
 use serde::{Deserialize, Serialize};
-use std::collections::HashMap;
+use std::collections::{BTreeMap, HashMap};
 
 use crate::auction::context::ContextValue;
 use crate::geo::GeoInfo;
 use crate::platform::RuntimeServices;
 use crate::settings::Settings;
 
+fn is_zero(value: &usize) -> bool {
+    *value == 0
+}
+
 /// Represents a unified auction request across all providers.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct AuctionRequest {
@@ -171,18 +175,71 @@ pub struct AuctionResponse {
     pub metadata: HashMap<String, serde_json::Value>,
 }
 
+/// APS creative tag type accepted by the Trusted Server renderer.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum ApsTagType {
+    /// APS loads the creative URL in a nested iframe.
+    Iframe,
+    /// APS fetches creative HTML and executes it in its nested renderer frame.
+    Script,
+}
+
+/// Version 1 APS renderer descriptor shared with browser clients.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ApsRendererV1 {
+    /// Renderer contract version.
+    pub version: u8,
+    /// APS account identifier used to initialize the fixed runner.
+    pub account_id: String,
+    /// Selected `OpenRTB` bid identifier.
+    pub bid_id: String,
+    /// Optional `OpenRTB` creative identifier.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub creative_id: Option<String>,
+    /// APS creative delivery mode.
+    pub tag_type: ApsTagType,
+    /// HTTPS creative URL consumed by the fixed APS runner.
+    pub creative_url: String,
+    /// Base64-encoded exact one-bid APS response envelope.
+    pub aax_response: String,
+    /// Creative width.
+    pub width: u32,
+    /// Creative height.
+    pub height: u32,
+}
+
+/// Typed browser renderer capability carried by a bid.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "type", rename_all = "lowercase")]
+pub enum BidRenderer {
+    /// APS renderer version 1.
+    Aps(ApsRendererV1),
+}
+
+impl BidRenderer {
+    /// Return the APS renderer descriptor when this is an APS renderer.
+    #[must_use]
+    pub fn as_aps(&self) -> Option<&ApsRendererV1> {
+        match self {
+            Self::Aps(renderer) => Some(renderer),
+        }
+    }
+}
+
 /// Individual bid from a provider.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Bid {
     /// Slot this bid is for
     pub slot_id: String,
-    /// Bid price in CPM
-    /// None for APS bids where price is encoded and must be decoded by mediation layer
+    /// Bid price in CPM.
     pub price: Option<f64>,
     /// Currency code (e.g., "USD")
     pub currency: String,
-    /// Creative markup (HTML/VAST)
-    /// None when the bidder doesn't provide creative HTML (e.g., APS/TAM)
+    /// Creative markup (HTML/VAST).
+    ///
+    /// `None` when the bid uses a typed [`BidRenderer`] instead.
     pub creative: Option<String>,
     /// Advertiser domain
     pub adomain: Option<Vec<String>>,
@@ -196,8 +253,15 @@ pub struct Bid {
     pub nurl: Option<String>,
     /// Billing notification URL
     pub burl: Option<String>,
-    /// Ad ID from the bidder
+    /// `OpenRTB` bid identifier.
+    pub bid_id: Option<String>,
+    /// Ad ID from the bidder.
     pub ad_id: Option<String>,
+    /// Optional `OpenRTB` creative identifier.
+    pub creative_id: Option<String>,
+    /// Typed browser renderer capability.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub renderer: Option<BidRenderer>,
     /// Prebid Cache UUID for this bid.
     ///
     /// Populated from `ext.prebid.cache.bids.cacheId` in the PBS response.
@@ -214,8 +278,7 @@ pub struct Bid {
     /// Populated from the path of `ext.prebid.cache.bids.url`. Used as
     /// `hb_cache_path` targeting value. `None` when cache is absent.
     pub cache_path: Option<String>,
-    /// Provider-specific bid metadata
-    /// For APS bids, contains encoded price in "amznbid" field
+    /// Provider-specific bid metadata.
     pub metadata: HashMap<String, serde_json::Value>,
 }
 
@@ -264,6 +327,12 @@ pub struct OrchestratorExt {
     /// Per-provider breakdown of the auction.
     #[serde(default)]
     pub provider_details: Vec<ProviderSummary>,
+    /// Winners omitted during final response conversion.
+    #[serde(default, skip_serializing_if = "is_zero")]
+    pub dropped_winner_count: usize,
+    /// Machine-readable reasons for omitted winners.
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub dropped_winner_reasons: BTreeMap<String, usize>,
 }
 
 /// Status of bid response.
@@ -338,7 +407,10 @@ mod tests {
             height: 250,
             nurl: None,
             burl: None,
+            bid_id: None,
             ad_id: None,
+            creative_id: None,
+            renderer: None,
             cache_id: None,
             cache_host: None,
             cache_path: None,
@@ -467,7 +539,10 @@ mod tests {
             height: 250,
             nurl: None,
             burl: None,
+            bid_id: None,
             ad_id: Some("bid-id".to_string()),
+            creative_id: None,
+            renderer: None,
             cache_id: Some("cache-uuid".to_string()),
             cache_host: Some("cache.example.com".to_string()),
             cache_path: Some("/pbc/v1/cache".to_string()),
@@ -492,6 +567,62 @@ mod tests {
         );
     }
 
+    #[test]
+    fn aps_renderer_serializes_to_versioned_camel_case_contract() {
+        let renderer = BidRenderer::Aps(ApsRendererV1 {
+            version: 1,
+            account_id: "example-account-id".to_string(),
+            bid_id: "fictional-bid-id".to_string(),
+            creative_id: Some("fictional-creative-id".to_string()),
+            tag_type: ApsTagType::Iframe,
+            creative_url: "https://creative.example/render".to_string(),
+            aax_response: "base64-data".to_string(),
+            width: 300,
+            height: 250,
+        });
+
+        let serialized = serde_json::to_value(&renderer).expect("should serialize renderer");
+
+        assert_eq!(
+            serialized,
+            json!({
+                "type": "aps",
+                "version": 1,
+                "accountId": "example-account-id",
+                "bidId": "fictional-bid-id",
+                "creativeId": "fictional-creative-id",
+                "tagType": "iframe",
+                "creativeUrl": "https://creative.example/render",
+                "aaxResponse": "base64-data",
+                "width": 300,
+                "height": 250
+            }),
+            "should match renderer wire contract"
+        );
+    }
+
+    #[test]
+    fn aps_renderer_omits_absent_creative_id() {
+        let renderer = BidRenderer::Aps(ApsRendererV1 {
+            version: 1,
+            account_id: "example-account-id".to_string(),
+            bid_id: "fictional-bid-id".to_string(),
+            creative_id: None,
+            tag_type: ApsTagType::Iframe,
+            creative_url: "https://creative.example/render".to_string(),
+            aax_response: "base64-data".to_string(),
+            width: 300,
+            height: 250,
+        });
+
+        let serialized = serde_json::to_value(&renderer).expect("should serialize renderer");
+
+        assert!(
+            serialized.get("creativeId").is_none(),
+            "should omit absent creative ID"
+        );
+    }
+
     #[test]
     fn media_type_defaults_to_banner() {
         assert_eq!(
@@ -514,7 +645,10 @@ mod tests {
             height: 250,
             nurl: None,
             burl: None,
+            bid_id: None,
             ad_id: Some("prebid-ad-id-abc".to_string()),
+            creative_id: None,
+            renderer: None,
             cache_id: None,
             cache_host: None,
             cache_path: None,
diff --git a/crates/trusted-server-core/src/creative_opportunities.rs b/crates/trusted-server-core/src/creative_opportunities.rs
index 9ce741f3f..fb4f5b89f 100644
--- a/crates/trusted-server-core/src/creative_opportunities.rs
+++ b/crates/trusted-server-core/src/creative_opportunities.rs
@@ -62,6 +62,12 @@ impl CreativeOpportunitiesConfig {
     pub fn validate_runtime(&self) -> Result<(), String> {
         for slot in &self.slot {
             slot.validate_runtime(&self.gam_network_id)?;
+            if slot.providers.aps.is_some() {
+                log::warn!(
+                    "creative opportunity slot '{}': providers.aps is retained only for configuration compatibility and is ignored by APS OpenRTB",
+                    slot.id
+                );
+            }
         }
 
         Ok(())
@@ -275,8 +281,9 @@ impl CreativeOpportunitySlot {
 
     /// Converts this slot into an [`AdSlot`] ready for use in an auction request.
     ///
-    /// Provider-specific params (e.g., APS `slotID`, PBS bidder params) are wired
-    /// into the `bidders` map keyed by provider/bidder name.
+    /// Prebid Server bidder params are wired into the `bidders` map keyed by
+    /// bidder name. Legacy APS slot params are accepted in configuration but
+    /// intentionally ignored by the APS `OpenRTB` provider.
     ///
     /// When [`PrebidSlotParams::bidders`] is empty, a `trustedServer` entry is
     /// injected so [`PrebidAuctionProvider`] expands all `config.bidders`
@@ -285,12 +292,6 @@ impl CreativeOpportunitySlot {
     #[must_use]
     pub fn to_ad_slot(&self) -> AdSlot {
         let mut bidders: HashMap<String, serde_json::Value> = HashMap::new();
-        if let Some(ref aps) = self.providers.aps {
-            bidders.insert(
-                "aps".to_string(),
-                serde_json::json!({ "slotID": aps.slot_id }),
-            );
-        }
         if let Some(ref prebid) = self.providers.prebid {
             if prebid.bidders.is_empty() {
                 // No explicit per-bidder override: let the Prebid provider expand
@@ -364,7 +365,10 @@ impl CreativeOpportunityFormat {
 #[derive(Debug, Clone, Default, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
 pub struct SlotProviders {
-    /// Amazon Publisher Services (APS/TAM) slot parameters.
+    /// Legacy APS slot parameters, retained only for configuration compatibility.
+    ///
+    /// APS `OpenRTB` uses the canonical creative-opportunity slot ID and does not
+    /// forward this value to APS or Prebid Server.
     pub aps: Option<ApsSlotParams>,
     /// Prebid Server inline bidder parameters.
     ///
@@ -374,11 +378,11 @@ pub struct SlotProviders {
     pub prebid: Option<PrebidSlotParams>,
 }
 
-/// APS-specific parameters for a slot.
+/// Legacy APS-specific parameters retained for configuration compatibility.
 #[derive(Debug, Clone, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
 pub struct ApsSlotParams {
-    /// The APS slot ID string used when making TAM bid requests.
+    /// Deprecated legacy slot ID. APS `OpenRTB` ignores this value.
     pub slot_id: String,
 }
 
@@ -617,16 +621,15 @@ mod tests {
     }
 
     #[test]
-    fn to_ad_slot_wires_aps_params_into_bidders() {
+    fn to_ad_slot_ignores_legacy_aps_params() {
         let mut slot = make_slot("atf", vec!["/"]);
         slot.providers.aps = Some(ApsSlotParams {
-            slot_id: "aps-slot-atf".to_string(),
+            slot_id: "legacy-aps-slot-atf".to_string(),
         });
         let ad_slot = slot.to_ad_slot();
-        let aps_params = ad_slot.bidders.get("aps").expect("should have aps bidder");
-        assert_eq!(
-            aps_params.get("slotID").and_then(|v| v.as_str()),
-            Some("aps-slot-atf"),
+        assert!(
+            !ad_slot.bidders.contains_key("aps"),
+            "legacy APS params must not enable APS through Prebid Server"
         );
     }
 
diff --git a/crates/trusted-server-core/src/integrations/adserver_mock.rs b/crates/trusted-server-core/src/integrations/adserver_mock.rs
index 8fd3f9ddb..3c12c35f8 100644
--- a/crates/trusted-server-core/src/integrations/adserver_mock.rs
+++ b/crates/trusted-server-core/src/integrations/adserver_mock.rs
@@ -16,7 +16,7 @@ use std::time::Duration;
 use validator::Validate;
 
 use crate::auction::context::{ContextQueryParams, build_url_with_context_params};
-use crate::auction::provider::AuctionProvider;
+use crate::auction::provider::{AuctionProvider, ProviderRequestOutcome};
 use crate::auction::types::{
     AuctionContext, AuctionRequest, AuctionResponse, Bid, BidStatus, MediaType,
 };
@@ -25,9 +25,7 @@ use crate::integrations::{
     UPSTREAM_RTB_MAX_RESPONSE_BYTES, collect_response_bounded,
     ensure_integration_backend_with_timeout, predict_integration_backend_name,
 };
-use crate::platform::{
-    PlatformHttpRequest, PlatformPendingRequest, PlatformResponse, RuntimeServices,
-};
+use crate::platform::{PlatformHttpRequest, PlatformResponse, RuntimeServices};
 use crate::settings::{IntegrationConfig, Settings};
 
 // ============================================================================
@@ -119,7 +117,7 @@ fn build_bid_index(bidder_responses: &[AuctionResponse]) -> BidIndex {
             // be mis-attributed during mediation. Low severity for the mock
             // mediator, but log it so the collision is visible.
             if index.insert(key, bid.clone()).is_some() {
-                log::debug!(
+                log::warn!(
                     "adserver_mock: duplicate bid for (provider '{}', slot '{}', bidder '{}'); keeping the last — win/billing URL restoration may be mis-attributed",
                     response.provider,
                     bid.slot_id,
@@ -159,9 +157,7 @@ impl AdServerMockProvider {
 
     /// Build mediation request from auction request and bidder responses.
     ///
-    /// Handles both:
-    /// - Regular bids with decoded prices (price field set)
-    /// - APS-style bids with encoded prices (price=None, encoded price in metadata)
+    /// Only bids with decoded numeric prices are eligible for mediation.
     fn build_mediation_request(
         &self,
         request: &AuctionRequest,
@@ -175,14 +171,15 @@ impl AdServerMockProvider {
                 let bids: Vec<Json> = response
                     .bids
                     .iter()
-                    .map(|bid| {
-                        // Mocktioneer mediator always requires a numeric `price` field.
-                        // APS bids carry price as an opaque encoded string (`amznbid`)
-                        // that cannot be decoded client-side; use `bid.price` when set
-                        // (a real decoded value) or fall back to a mock floor price for
-                        // test/demo purposes.
-                        let price = bid.price.unwrap_or(1.50);
-                        json!({
+                    .filter_map(|bid| {
+                        let Some(price) = bid.price else {
+                            log::debug!(
+                                "adserver_mock: omitting bid for slot '{}' without decoded price",
+                                bid.slot_id
+                            );
+                            return None;
+                        };
+                        Some(json!({
                             "imp_id": bid.slot_id,
                             "price": price,
                             "adm": bid.creative,
@@ -190,7 +187,7 @@ impl AdServerMockProvider {
                             "h": bid.height,
                             "crid": format!("{}-creative", bid.bidder),
                             "adomain": bid.adomain,
-                        })
+                        }))
                     })
                     .collect();
 
@@ -254,7 +251,7 @@ impl AdServerMockProvider {
     }
 
     /// Parse `OpenRTB` response from mediation endpoint.
-    /// Mediation returns decoded prices for all bids (including APS bids that were encoded).
+    /// Mediation returns decoded prices for all selected bids.
     ///
     /// `bid_index` is the SSP-bid lookup built from the auction context's
     /// bidder responses. The mock mediator does not echo render/accounting
@@ -307,7 +304,11 @@ impl AdServerMockProvider {
                     slot_id,
                     price: bid["price"].as_f64(),
                     currency: "USD".to_string(),
-                    creative: bid["adm"].as_str().map(String::from),
+                    creative: if original.is_some_and(|bid| bid.renderer.is_some()) {
+                        None
+                    } else {
+                        bid["adm"].as_str().map(String::from)
+                    },
                     width,
                     height,
                     bidder: restored_bidder,
@@ -318,7 +319,10 @@ impl AdServerMockProvider {
                     }),
                     nurl: original.and_then(|b| b.nurl.clone()),
                     burl: original.and_then(|b| b.burl.clone()),
-                    ad_id: original.and_then(|b| b.ad_id.clone()),
+                    bid_id: original.and_then(|bid| bid.bid_id.clone()),
+                    ad_id: original.and_then(|bid| bid.ad_id.clone()),
+                    creative_id: original.and_then(|bid| bid.creative_id.clone()),
+                    renderer: original.and_then(|bid| bid.renderer.clone()),
                     cache_id: original.and_then(|b| b.cache_id.clone()),
                     cache_host: original.and_then(|b| b.cache_host.clone()),
                     cache_path: original.and_then(|b| b.cache_path.clone()),
@@ -392,7 +396,7 @@ impl AuctionProvider for AdServerMockProvider {
         &self,
         request: &AuctionRequest,
         context: &AuctionContext<'_>,
-    ) -> Result<PlatformPendingRequest, Report<TrustedServerError>> {
+    ) -> Result<ProviderRequestOutcome, Report<TrustedServerError>> {
         // Get bidder responses from context (passed by orchestrator for mediation)
         let bidder_responses = context.provider_responses.unwrap_or(&[]);
 
@@ -476,7 +480,7 @@ impl AuctionProvider for AdServerMockProvider {
                 message: "Failed to send mediation request".to_string(),
             })?;
 
-        Ok(pending)
+        Ok(ProviderRequestOutcome::pending(pending))
     }
 
     async fn parse_response(
@@ -614,6 +618,39 @@ mod tests {
         }
     }
 
+    fn aps_bid(bid_id: &str, price: f64) -> Bid {
+        Bid {
+            slot_id: "header-banner".to_string(),
+            price: Some(price),
+            currency: "USD".to_string(),
+            creative: None,
+            width: 728,
+            height: 90,
+            bidder: "aps".to_string(),
+            adomain: Some(vec!["advertiser.example".to_string()]),
+            nurl: None,
+            burl: None,
+            bid_id: Some(bid_id.to_string()),
+            ad_id: None,
+            creative_id: Some(format!("creative-{bid_id}")),
+            renderer: Some(BidRenderer::Aps(ApsRendererV1 {
+                version: 1,
+                account_id: "example-account".to_string(),
+                bid_id: bid_id.to_string(),
+                creative_id: Some(format!("creative-{bid_id}")),
+                tag_type: ApsTagType::Iframe,
+                creative_url: format!("https://creative.example/{bid_id}"),
+                aax_response: format!("fictional-{bid_id}-base64"),
+                width: 728,
+                height: 90,
+            })),
+            cache_id: None,
+            cache_host: None,
+            cache_path: None,
+            metadata: HashMap::new(),
+        }
+    }
+
     #[test]
     fn test_build_mediation_request() {
         let config = AdServerMockConfig {
@@ -629,7 +666,7 @@ mod tests {
 
         let bidder_responses = vec![
             AuctionResponse {
-                provider: "amazon-aps".to_string(),
+                provider: "aps".to_string(),
                 status: BidStatus::Success,
                 bids: vec![Bid {
                     slot_id: "header-banner".to_string(),
@@ -638,11 +675,14 @@ mod tests {
                     creative: Some("<div>APS Ad</div>".to_string()),
                     width: 728,
                     height: 90,
-                    bidder: "amazon-aps".to_string(),
-                    adomain: Some(vec!["amazon.com".to_string()]),
+                    bidder: "aps".to_string(),
+                    adomain: Some(vec!["advertiser.example".to_string()]),
                     nurl: None,
                     burl: None,
+                    bid_id: None,
                     ad_id: None,
+                    creative_id: None,
+                    renderer: None,
                     cache_id: None,
                     cache_host: None,
                     cache_path: None,
@@ -665,7 +705,10 @@ mod tests {
                     adomain: None,
                     nurl: Some("https://ssp.example/win?id=mock-bid-001".to_string()),
                     burl: Some("https://ssp.example/bill?id=mock-bid-001".to_string()),
+                    bid_id: None,
                     ad_id: Some("mock-bid-001".to_string()),
+                    creative_id: None,
+                    renderer: None,
                     cache_id: None,
                     cache_host: None,
                     cache_path: None,
@@ -784,7 +827,20 @@ mod tests {
                 height: 90,
                 nurl: Some("https://ssp.example/win".to_string()),
                 burl: Some("https://ssp.example/bill".to_string()),
+                bid_id: Some("source-bid-id".to_string()),
                 ad_id: Some("bid-impression-id".to_string()),
+                creative_id: Some("source-creative-id".to_string()),
+                renderer: Some(BidRenderer::Aps(ApsRendererV1 {
+                    version: 1,
+                    account_id: "example-account".to_string(),
+                    bid_id: "source-bid-id".to_string(),
+                    creative_id: Some("source-creative-id".to_string()),
+                    tag_type: ApsTagType::Iframe,
+                    creative_url: "https://creative.example/render".to_string(),
+                    aax_response: "fictional-base64".to_string(),
+                    width: 728,
+                    height: 90,
+                })),
                 cache_id: Some("cache-uuid".to_string()),
                 cache_host: Some("cache.example".to_string()),
                 cache_path: Some("/cache".to_string()),
@@ -812,11 +868,14 @@ mod tests {
             Some("https://ssp.example/bill"),
             "should restore burl"
         );
+        assert_eq!(bid.bid_id.as_deref(), Some("source-bid-id"));
         assert_eq!(
             bid.ad_id.as_deref(),
             Some("bid-impression-id"),
             "should restore ad_id"
         );
+        assert_eq!(bid.creative_id.as_deref(), Some("source-creative-id"));
+        assert!(bid.renderer.is_some(), "should restore typed renderer");
         assert_eq!(
             bid.cache_id.as_deref(),
             Some("cache-uuid"),
@@ -834,6 +893,80 @@ mod tests {
         );
     }
 
+    #[test]
+    fn reduced_aps_bid_avoids_mediation_index_renderer_collision() {
+        let provider = AdServerMockProvider::new(AdServerMockConfig::default());
+
+        // Document why APS must reduce before mediation: the mediator index is
+        // intentionally last-write-wins for identical provider/slot/bidder keys.
+        let unreduced = AuctionResponse::success(
+            "aps",
+            vec![aps_bid("selected", 2.0), aps_bid("losing-last", 1.0)],
+            1,
+        );
+        let collision_index = build_bid_index(&[unreduced]);
+        let key = (
+            "aps".to_string(),
+            "header-banner".to_string(),
+            "aps".to_string(),
+        );
+        assert_eq!(
+            collision_index
+                .get(&key)
+                .and_then(|bid| bid.bid_id.as_deref()),
+            Some("losing-last"),
+            "an unreduced response would restore the last candidate's renderer"
+        );
+
+        let reduced = AuctionResponse::success("aps", vec![aps_bid("selected", 2.0)], 1);
+        let mediation_request = provider
+            .build_mediation_request(
+                &create_test_auction_request(),
+                std::slice::from_ref(&reduced),
+            )
+            .expect("should build mediation request from reduced APS response");
+        assert_eq!(
+            mediation_request["ext"]["bidder_responses"][0]["bids"]
+                .as_array()
+                .map(Vec::len),
+            Some(1)
+        );
+
+        let reduced_index = build_bid_index(&[reduced]);
+        let mediated = provider.parse_mediation_response(
+            &json!({
+                "seatbid": [{
+                    "seat": "aps",
+                    "bid": [{
+                        "impid": "header-banner",
+                        "price": 2.0,
+                        "w": 728,
+                        "h": 90,
+                        "crid": "aps-creative"
+                    }]
+                }]
+            }),
+            2,
+            &reduced_index,
+        );
+        let winner = mediated
+            .bids
+            .first()
+            .expect("should restore mediated APS winner");
+        assert_eq!(winner.bid_id.as_deref(), Some("selected"));
+        assert_eq!(
+            winner
+                .renderer
+                .as_ref()
+                .expect("should restore APS renderer")
+                .as_aps()
+                .expect("should be APS renderer")
+                .bid_id,
+            "selected"
+        );
+        assert!(winner.creative.is_none());
+    }
+
     #[test]
     fn test_parse_empty_mediation_response() {
         let config = AdServerMockConfig::default();
@@ -853,8 +986,8 @@ mod tests {
     }
 
     #[test]
-    fn test_mediation_request_handles_none_creative() {
-        // Test that bids without creative HTML (e.g., APS) are properly sent to mediation
+    fn test_mediation_request_handles_decoded_bid_without_creative() {
+        // Typed-renderer bids retain their decoded price when sent to mediation.
         let config = AdServerMockConfig::default();
         let provider = AdServerMockProvider::new(config);
 
@@ -885,29 +1018,28 @@ mod tests {
             context: HashMap::new(),
         };
 
-        // APS bid with encoded price (price=None, amznbid in metadata)
-        let mut aps_metadata = HashMap::new();
-        aps_metadata.insert("amznbid".to_string(), json!("encoded-price-value"));
-
         let bidder_responses = vec![AuctionResponse {
             provider: "aps".to_string(),
             status: BidStatus::Success,
             bids: vec![Bid {
                 slot_id: "slot-1".to_string(),
-                price: None, // APS bids have no decoded price
+                price: Some(1.75),
                 currency: "USD".to_string(),
-                creative: None, // APS doesn't provide creative
+                creative: None,
                 width: 300,
                 height: 250,
-                bidder: "amazon-aps".to_string(),
-                adomain: Some(vec!["amazon.com".to_string()]),
+                bidder: "aps".to_string(),
+                adomain: Some(vec!["advertiser.example".to_string()]),
                 nurl: None,
                 burl: None,
+                bid_id: None,
                 ad_id: None,
+                creative_id: None,
+                renderer: None,
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
-                metadata: aps_metadata,
+                metadata: HashMap::new(),
             }],
             response_time_ms: 100,
             metadata: HashMap::new(),
@@ -920,20 +1052,16 @@ mod tests {
         // Verify the mediation request structure
         assert_eq!(mediation_req["id"], "test-auction");
 
-        // Check that the bid was included with encoded_price
         let bidder_resp = &mediation_req["ext"]["bidder_responses"][0];
         assert_eq!(bidder_resp["bidder"], "aps");
 
         let bid = &bidder_resp["bids"][0];
         assert_eq!(bid["imp_id"], "slot-1");
 
-        // APS bids have no decoded price (bid.price == None), so the mock floor
-        // price (1.50) is used.  Mocktioneer requires a numeric price field and
-        // does not accept an opaque encoded_price string.
         assert_eq!(
             bid["price"].as_f64(),
-            Some(1.50),
-            "APS bids with no decoded price should fall back to mock floor price 1.50"
+            Some(1.75),
+            "should preserve the decoded APS price"
         );
         // adm should be null (not a string)
         assert!(
@@ -1010,8 +1138,7 @@ mod tests {
 
     #[test]
     fn test_parse_mediation_response_with_missing_prices() {
-        // Test that mediator response with missing price fields returns None prices
-        // This tests the scenario where mediation failed to decode APS prices
+        // A malformed mediator response can still omit a selected bid price.
         let config = AdServerMockConfig::default();
         let provider = AdServerMockProvider::new(config);
 
diff --git a/crates/trusted-server-core/src/integrations/aps.rs b/crates/trusted-server-core/src/integrations/aps.rs
index 60c22265d..44f4203ef 100644
--- a/crates/trusted-server-core/src/integrations/aps.rs
+++ b/crates/trusted-server-core/src/integrations/aps.rs
@@ -1,239 +1,180 @@
-//! Amazon Publisher Services (APS/TAM) integration.
-//!
-//! This module provides the APS auction provider for server-side bidding.
+//! Amazon Publisher Services (APS/TAM) `OpenRTB` integration.
+
+use std::collections::{BTreeMap, HashMap};
+use std::sync::Arc;
+use std::time::Duration;
 
 use async_trait::async_trait;
+use base64::{Engine as _, engine::general_purpose::STANDARD as BASE64_STANDARD};
 use edgezero_core::body::Body as EdgeBody;
 use error_stack::{Report, ResultExt};
-use http::{Method, header};
+use http::header::HeaderName;
+use http::{HeaderMap, Method, StatusCode, header};
+use serde::de::{self, Visitor};
 use serde::{Deserialize, Serialize};
 use serde_json::{Value as Json, json};
-use std::collections::HashMap;
-use std::time::Duration;
-use validator::Validate;
+use url::Url;
+use validator::{Validate, ValidationError};
 
-use crate::auction::provider::AuctionProvider;
-use crate::auction::types::{AuctionContext, AuctionRequest, AuctionResponse, Bid, MediaType};
+use crate::auction::provider::{AuctionProvider, ProviderRequestOutcome};
+use crate::auction::types::{
+    AdSlot, ApsRendererV1, ApsTagType, AuctionContext, AuctionRequest, AuctionResponse, Bid,
+    BidRenderer, MediaType,
+};
 use crate::error::TrustedServerError;
 use crate::integrations::{
+    IntegrationEndpoint, IntegrationProxy, IntegrationRegistration,
     UPSTREAM_RTB_MAX_RESPONSE_BYTES, collect_response_bounded,
     ensure_integration_backend_with_timeout, predict_integration_backend_name,
 };
-use crate::platform::{
-    PlatformHttpRequest, PlatformPendingRequest, PlatformResponse, RuntimeServices,
+use crate::openrtb::{
+    Banner, Device, Format, Geo, Imp, OpenRtbRequest, Publisher, Regs, RegsExt, Site, ToExt, User,
+    UserExt, to_openrtb_i32,
 };
-
-use crate::settings::IntegrationConfig;
-
-// ============================================================================
-// APS TAM API Types
-// ============================================================================
-
-/// APS TAM bid request format based on /e/dtb/bid endpoint.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-struct ApsBidRequest {
-    /// Publisher ID
-    #[serde(rename = "pubId")]
-    pub_id: String,
-
-    /// Slot configurations
-    slots: Vec<ApsSlot>,
-
-    /// Page URL
-    #[serde(rename = "pageUrl", skip_serializing_if = "Option::is_none")]
-    page_url: Option<String>,
-
-    /// User agent
-    #[serde(rename = "ua", skip_serializing_if = "Option::is_none")]
-    user_agent: Option<String>,
-
-    /// Timeout in milliseconds
-    #[serde(skip_serializing_if = "Option::is_none")]
-    timeout: Option<u32>,
-
-    /// GDPR consent information.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    gdpr: Option<ApsGdprConsent>,
-
-    /// US Privacy (CCPA) string.
-    #[serde(rename = "usPrivacy", skip_serializing_if = "Option::is_none")]
-    us_privacy: Option<String>,
-
-    /// GPP consent string.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    gpp: Option<String>,
-
-    /// GPP section IDs as comma-separated string.
-    #[serde(rename = "gppSid", skip_serializing_if = "Option::is_none")]
-    gpp_sid: Option<String>,
+use crate::platform::{PlatformHttpRequest, PlatformResponse, RuntimeServices};
+use crate::settings::{IntegrationConfig, Settings};
+
+const APS_INTEGRATION_ID: &str = "aps";
+const APS_RENDERER_ROUTE: &str = "/integrations/aps/renderer";
+const DEFAULT_CURRENCY: &str = "USD";
+const APS_SDK_SOURCE: &str = "prebid";
+const APS_SDK_VERSION: &str = "2.2.0";
+const MAX_ACCOUNT_ID_BYTES: usize = 1024;
+const MAX_CREATIVE_ID_BYTES: usize = 1024;
+const MAX_DEBUG_RESPONSE_PREVIEW_BYTES: usize = 512;
+const MAX_CREATIVE_URL_BYTES: usize = 4096;
+const MAX_LANGUAGE_BYTES: usize = 8;
+const MAX_PAGE_URL_BYTES: usize = 8192;
+const MAX_RENDER_ENVELOPE_BYTES: usize = 256 * 1024;
+const APS_RENDERER_CSP: &str = "default-src 'none'; sandbox allow-forms allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-scripts allow-top-navigation-by-user-activation; script-src 'unsafe-inline' https:; connect-src https:; frame-src https:; img-src https: data:; media-src https: blob:; style-src 'unsafe-inline' https:; font-src https: data:;";
+
+const APS_RENDERER_DOCUMENT: &str = r#"<!doctype html>
+<meta charset="utf-8">
+<script>
+(function(){
+'use strict';
+var match=/^#tsaps=([A-Za-z0-9_-]{22,128})$/.exec(location.hash);
+var expected=match&&match[1];
+try{history.replaceState(null,'',location.pathname+location.search);}catch(_error){}
+if(!expected)return;
+function keys(value,expectedKeys){
+ if(!value||typeof value!=='object'||Array.isArray(value))return false;
+ var actual=Object.keys(value).sort();
+ return actual.length===expectedKeys.length&&actual.every(function(key,index){return key===expectedKeys[index];});
 }
-
-/// GDPR consent information for APS requests.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-struct ApsGdprConsent {
-    /// Whether GDPR applies to this request.
-    enabled: bool,
-    /// TCF v2 consent string.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    consent: Option<String>,
-}
-
-/// APS slot configuration.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-struct ApsSlot {
-    /// Slot identifier
-    #[serde(rename = "slotID")]
-    slot_id: String,
-
-    /// Ad sizes [[width, height], ...]
-    sizes: Vec<[u32; 2]>,
-
-    /// Slot name (optional)
-    #[serde(rename = "slotName", skip_serializing_if = "Option::is_none")]
-    slot_name: Option<String>,
-}
-
-/// APS TAM bid response format matching real Amazon API.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-struct ApsBidResponse {
-    /// Contextual wrapper containing all response data
-    contextual: ApsContextual,
-}
-
-/// APS Contextual response containing slots and metadata.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-struct ApsContextual {
-    /// Array of slot responses (one per requested slot)
-    #[serde(default)]
-    slots: Vec<ApsSlotResponse>,
-
-    /// Event tracking host
-    #[serde(skip_serializing_if = "Option::is_none")]
-    host: Option<String>,
-
-    /// Response status ("ok", "error", etc.)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    status: Option<String>,
-
-    /// Client-side feature enablement flag
-    #[serde(skip_serializing_if = "Option::is_none")]
-    cfe: Option<bool>,
-
-    /// Event tracking enabled
-    #[serde(skip_serializing_if = "Option::is_none")]
-    ev: Option<bool>,
-
-    /// Client feature name (CSM script path)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    cfn: Option<String>,
-
-    /// Callback version
-    #[serde(skip_serializing_if = "Option::is_none")]
-    cb: Option<String>,
-
-    /// Campaign tracking URL
-    #[serde(skip_serializing_if = "Option::is_none")]
-    cmp: Option<String>,
+function validRenderer(renderer){
+ if(!keys(renderer,['aaxResponse','accountId','bidId','creativeId','creativeUrl','height','tagType','type','version','width'])&&
+    !keys(renderer,['aaxResponse','accountId','bidId','creativeUrl','height','tagType','type','version','width']))return false;
+ if(renderer.type!=='aps'||renderer.version!==1||typeof renderer.accountId!=='string'||!renderer.accountId||new TextEncoder().encode(renderer.accountId).length>1024)return false;
+ if(typeof renderer.bidId!=='string'||!renderer.bidId||!Number.isInteger(renderer.width)||renderer.width<=0||!Number.isInteger(renderer.height)||renderer.height<=0)return false;
+ if(Object.prototype.hasOwnProperty.call(renderer,'creativeId')&&(typeof renderer.creativeId!=='string'||!renderer.creativeId||new TextEncoder().encode(renderer.creativeId).length>1024))return false;
+ if(renderer.tagType!=='iframe'&&renderer.tagType!=='script')return false;
+ if(typeof renderer.creativeUrl!=='string'||new TextEncoder().encode(renderer.creativeUrl).length>4096)return false;
+ if(typeof renderer.aaxResponse!=='string'||!renderer.aaxResponse||renderer.aaxResponse.length>349528)return false;
+ try{
+  var url=new URL(renderer.creativeUrl);
+  if(url.protocol!=='https:'||url.username||url.password||url.origin===location.origin)return false;
+  var binary=atob(renderer.aaxResponse);
+  if(binary.length>262144||btoa(binary)!==renderer.aaxResponse)return false;
+  var bytes=Uint8Array.from(binary,function(character){return character.charCodeAt(0);});
+  var decoded=JSON.parse(new TextDecoder('utf-8',{fatal:true}).decode(bytes));
+  if(!keys(decoded,['seatbid'])||!Array.isArray(decoded.seatbid)||decoded.seatbid.length!==1)return false;
+  var seat=decoded.seatbid[0];
+  if(!keys(seat,['bid'])||!Array.isArray(seat.bid)||seat.bid.length!==1)return false;
+  var bid=seat.bid[0];
+  if(!keys(bid,['ext','h','id','price','w'])||!keys(bid.ext,['creativeurl','tagtype']))return false;
+  return bid.id===renderer.bidId&&bid.w===renderer.width&&bid.h===renderer.height&&
+   bid.ext.creativeurl===renderer.creativeUrl&&bid.ext.tagtype===renderer.tagType&&
+   typeof bid.price==='number'&&Number.isFinite(bid.price)&&bid.price>=0;
+ }catch(_error){return false;}
 }
-
-/// Individual APS slot response matching real Amazon format.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-struct ApsSlotResponse {
-    /// Slot ID this response is for
-    #[serde(rename = "slotID")]
-    slot_id: String,
-
-    /// Creative size (e.g., "300x250")
-    size: String,
-
-    /// Creative ID
-    #[serde(skip_serializing_if = "Option::is_none")]
-    crid: Option<String>,
-
-    /// Media type ("d" for display, "v" for video)
-    #[serde(rename = "mediaType", skip_serializing_if = "Option::is_none")]
-    media_type: Option<String>,
-
-    /// Fill indicator flag ("1" = filled, "0" = no fill)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    fif: Option<String>,
-
-    /// List of targeting key names that are set on this slot
-    #[serde(default)]
-    targeting: Vec<String>,
-
-    /// List of metadata field names
-    #[serde(default)]
-    meta: Vec<String>,
-
-    // Targeting key-value pairs (returned as flat fields)
-    /// Amazon impression ID (unique identifier for this bid)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    amzniid: Option<String>,
-
-    /// Amazon encoded bid price
-    #[serde(skip_serializing_if = "Option::is_none")]
-    amznbid: Option<String>,
-
-    /// Amazon encoded price (alternative encoding)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    amznp: Option<String>,
-
-    /// Amazon size in `WxH` format (e.g., "300x250")
-    #[serde(skip_serializing_if = "Option::is_none")]
-    amznsz: Option<String>,
-
-    /// Amazon auction context type ("OPEN", "PRIVATE", etc.)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    amznactt: Option<String>,
+function receive(event){
+ if(event.source!==parent)return;
+ var message=event.data;
+ if(!keys(message,['nonce','renderer'])||message.nonce!==expected||!validRenderer(message.renderer))return;
+ removeEventListener('message',receive);
+ var acceptedNonce=expected;
+ expected='';
+ var renderer=message.renderer;
+ window._aps=window._aps instanceof Map?window._aps:new Map();
+ var account=window._aps.get(renderer.accountId);
+ if(!account){
+  account={queue:[],store:new Map([['listeners',new Map()]])};
+  window._aps.set(renderer.accountId,account);
+ }
+ account.queue.push(new CustomEvent('prebid/creative/render',{detail:{aaxResponse:renderer.aaxResponse,seatBidId:renderer.bidId}}));
+ var script=document.createElement('script');
+ script.src='https://client.aps.amazon-adsystem.com/prebid-creative.js';
+ script.onload=function(){parent.postMessage({message:'trusted-server/aps/renderer-ready',nonce:acceptedNonce},'*');};
+ script.onerror=function(){parent.postMessage({message:'trusted-server/aps/renderer-failed',nonce:acceptedNonce},'*');};
+ document.head.appendChild(script);
 }
+addEventListener('message',receive);
+})();
+</script>
+"#;
 
-// ============================================================================
-// Real APS Provider
-// ============================================================================
-
-/// Configuration for APS integration.
+/// Configuration for the APS `OpenRTB` integration.
 #[derive(Debug, Clone, Deserialize, Serialize, Validate)]
+#[validate(schema(function = "validate_inventory_identity_override"))]
 pub struct ApsConfig {
-    /// Whether APS integration is enabled
+    /// Whether APS integration is enabled.
     #[serde(default = "default_enabled")]
     pub enabled: bool,
-
-    /// APS publisher ID (accepts both string and integer from config)
-    #[serde(deserialize_with = "deserialize_pub_id")]
-    pub pub_id: String,
-
-    /// APS API endpoint
+    /// APS account ID. `pub_id` remains a deserialization alias only.
+    #[serde(alias = "pub_id", deserialize_with = "deserialize_account_id")]
+    pub account_id: String,
+    /// APS `OpenRTB` endpoint.
     #[serde(default = "default_endpoint")]
-    #[validate(url)]
+    #[validate(custom(function = "validate_aps_endpoint"))]
     pub endpoint: String,
-
-    /// Timeout in milliseconds
+    /// Timeout in milliseconds.
     #[serde(default = "default_timeout_ms")]
     pub timeout_ms: u32,
+    /// Whether to include the APS HTTP exchange in auction response metadata.
+    ///
+    /// This default-off metadata is unredacted and client-visible. It can contain
+    /// identity, consent, page, account, bid, and creative data. Enable it only
+    /// on controlled test sites and never in production.
+    #[serde(default)]
+    pub debug: bool,
+    /// Whether APS script creatives are eligible before winner selection.
+    #[serde(default)]
+    pub allow_script_creatives: bool,
+    /// APS-authorized inventory domain used instead of the deployment hostname.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[validate(custom(function = "validate_inventory_domain"))]
+    pub inventory_domain: Option<String>,
+    /// Canonical HTTPS origin used for APS `site.page` while preserving its sanitized path.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[validate(custom(function = "validate_inventory_page_origin"))]
+    pub inventory_page_origin: Option<String>,
 }
 
-/// Custom deserializer for `pub_id` that accepts both string and integer
-fn deserialize_pub_id<'de, D>(deserializer: D) -> Result<String, D::Error>
+fn deserialize_account_id<'de, D>(deserializer: D) -> Result<String, D::Error>
 where
     D: serde::Deserializer<'de>,
 {
-    use serde::de::{self, Visitor};
-    use std::fmt;
+    struct AccountIdVisitor;
 
-    struct PubIdVisitor;
-
-    impl<'de> Visitor<'de> for PubIdVisitor {
+    impl Visitor<'_> for AccountIdVisitor {
         type Value = String;
 
-        fn expecting(&self, formatter: &mut fmt::Formatter) -> fmt::Result {
-            formatter.write_str("a string or integer for pub_id")
+        fn expecting(&self, formatter: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+            formatter.write_str("a non-empty string or integer for account_id")
         }
 
         fn visit_str<E>(self, value: &str) -> Result<String, E>
         where
             E: de::Error,
         {
+            let value = value.trim();
+            if value.is_empty() {
+                return Err(E::custom("account_id must not be empty"));
+            }
+            if value.len() > MAX_ACCOUNT_ID_BYTES {
+                return Err(E::custom("account_id is too large"));
+            }
             Ok(value.to_string())
         }
 
@@ -241,7 +182,7 @@ where
         where
             E: de::Error,
         {
-            Ok(value)
+            self.visit_str(&value)
         }
 
         fn visit_i64<E>(self, value: i64) -> Result<String, E>
@@ -259,7 +200,97 @@ where
         }
     }
 
-    deserializer.deserialize_any(PubIdVisitor)
+    deserializer.deserialize_any(AccountIdVisitor)
+}
+
+fn validate_aps_endpoint(value: &str) -> Result<(), ValidationError> {
+    let parsed = Url::parse(value).map_err(|_| ValidationError::new("invalid_aps_endpoint"))?;
+    if parsed.scheme() != "https"
+        || parsed.host_str().is_none()
+        || !parsed.username().is_empty()
+        || parsed.password().is_some()
+    {
+        return Err(ValidationError::new("invalid_aps_endpoint"));
+    }
+    if parsed.path().trim_end_matches('/').ends_with("/e/dtb/bid") {
+        let mut error = ValidationError::new("legacy_aps_endpoint");
+        error.message =
+            Some("legacy APS endpoint /e/dtb/bid is unsupported; migrate to /e/pb/bid".into());
+        return Err(error);
+    }
+    Ok(())
+}
+
+fn validate_inventory_domain(value: &str) -> Result<(), ValidationError> {
+    if value.trim() != value
+        || value.is_empty()
+        || value.len() > 253
+        || value.starts_with('.')
+        || value.ends_with('.')
+        || value.contains(['/', ':'])
+    {
+        return Err(ValidationError::new("invalid_aps_inventory_domain"));
+    }
+    for label in value.split('.') {
+        let bytes = label.as_bytes();
+        if label.is_empty()
+            || label.len() > 63
+            || bytes.first() == Some(&b'-')
+            || bytes.last() == Some(&b'-')
+            || !bytes
+                .iter()
+                .all(|byte| byte.is_ascii_alphanumeric() || *byte == b'-')
+        {
+            return Err(ValidationError::new("invalid_aps_inventory_domain"));
+        }
+    }
+    Ok(())
+}
+
+fn validate_inventory_page_origin(value: &str) -> Result<(), ValidationError> {
+    let parsed =
+        Url::parse(value).map_err(|_| ValidationError::new("invalid_aps_inventory_page_origin"))?;
+    if parsed.scheme() != "https"
+        || parsed.host_str().is_none()
+        || !parsed.username().is_empty()
+        || parsed.password().is_some()
+        || parsed.port().is_some()
+        || parsed.path() != "/"
+        || parsed.query().is_some()
+        || parsed.fragment().is_some()
+    {
+        return Err(ValidationError::new("invalid_aps_inventory_page_origin"));
+    }
+    Ok(())
+}
+
+fn validate_inventory_identity_override(config: &ApsConfig) -> Result<(), ValidationError> {
+    let (Some(domain), Some(origin)) = (
+        config.inventory_domain.as_deref(),
+        config.inventory_page_origin.as_deref(),
+    ) else {
+        if config.inventory_domain.is_none() && config.inventory_page_origin.is_none() {
+            return Ok(());
+        }
+        return Err(ValidationError::new(
+            "incomplete_aps_inventory_identity_override",
+        ));
+    };
+    let parsed = Url::parse(origin)
+        .map_err(|_| ValidationError::new("invalid_aps_inventory_page_origin"))?;
+    let host = parsed
+        .host_str()
+        .ok_or_else(|| ValidationError::new("invalid_aps_inventory_page_origin"))?
+        .to_ascii_lowercase();
+    let domain = domain.to_ascii_lowercase();
+    if host != domain
+        && !host
+            .strip_suffix(&domain)
+            .is_some_and(|prefix| prefix.ends_with('.'))
+    {
+        return Err(ValidationError::new("aps_inventory_origin_domain_mismatch"));
+    }
+    Ok(())
 }
 
 fn default_enabled() -> bool {
@@ -267,7 +298,7 @@ fn default_enabled() -> bool {
 }
 
 fn default_endpoint() -> String {
-    "https://aax.amazon-adsystem.com/e/dtb/bid".to_string()
+    "https://web.ads.aps.amazon-adsystem.com/e/pb/bid".to_string()
 }
 
 fn default_timeout_ms() -> u32 {
@@ -277,10 +308,14 @@ fn default_timeout_ms() -> u32 {
 impl Default for ApsConfig {
     fn default() -> Self {
         Self {
-            enabled: default_enabled(),
-            pub_id: String::new(),
+            enabled: false,
+            account_id: String::new(),
             endpoint: default_endpoint(),
             timeout_ms: default_timeout_ms(),
+            debug: false,
+            allow_script_creatives: false,
+            inventory_domain: None,
+            inventory_page_origin: None,
         }
     }
 }
@@ -291,382 +326,777 @@ impl IntegrationConfig for ApsConfig {
     }
 }
 
-/// Amazon APS auction provider.
+#[derive(Debug, Serialize)]
+struct ApsRequestExt<'a> {
+    account: &'a str,
+    sdk: ApsSdkExt,
+}
+
+impl ToExt for ApsRequestExt<'_> {}
+
+#[derive(Debug, Serialize)]
+struct ApsSdkExt {
+    source: &'static str,
+    version: &'static str,
+}
+
+struct ApsRendererInput<'a> {
+    bid_id: &'a str,
+    creative_id: Option<String>,
+    tag_type: ApsTagType,
+    creative_url: &'a str,
+    price: f64,
+    width: u32,
+    height: u32,
+}
+
+#[derive(Clone)]
+struct ApsDebugRequest {
+    body: String,
+    headers: BTreeMap<String, Vec<String>>,
+}
+
+/// APS `OpenRTB` auction provider.
 pub struct ApsAuctionProvider {
     config: ApsConfig,
 }
 
 impl ApsAuctionProvider {
-    /// Create a new APS auction provider.
+    /// Create an APS provider from validated configuration.
     #[must_use]
     pub fn new(config: ApsConfig) -> Self {
         Self { config }
     }
 
-    /// Resolve the APS-specific slot ID for a slot.
-    ///
-    /// Uses the APS slot ID from `[slot.providers.aps]` if configured; falls
-    /// back to the creative-opportunity slot ID otherwise.
-    fn aps_slot_id(slot: &crate::auction::types::AdSlot) -> String {
-        slot.bidders
-            .get("aps")
-            .and_then(|p| p.get("slotID"))
-            .and_then(|v| v.as_str())
-            .unwrap_or(&slot.id)
-            .to_string()
-    }
-
-    /// Build the APS slot ID → creative-opportunity slot ID map for `request`.
-    ///
-    /// Derived from the [`AuctionRequest`] on every call so the mapping stays
-    /// request-scoped: the provider instance is shared across concurrent
-    /// auctions on non-Fastly adapters, and instance state would let
-    /// overlapping auctions overwrite or consume each other's maps.
-    fn build_slot_id_map(request: &AuctionRequest) -> HashMap<String, String> {
-        let mut slot_id_map: HashMap<String, String> = HashMap::new();
-        for slot in &request.slots {
-            let aps_slot_id = Self::aps_slot_id(slot);
-            // Last-write-wins: two slots configuring the same
-            // `[bidders.aps].slotID` would remap one slot's bids to the
-            // wrong creative slot. Log the collision so a misconfiguration
-            // is diagnosable, mirroring the build_bid_index collision log.
-            if let Some(previous_slot_id) = slot_id_map.insert(aps_slot_id.clone(), slot.id.clone())
-            {
-                log::debug!(
-                    "APS slot ID '{aps_slot_id}' maps to multiple creative slots \
-                     ('{previous_slot_id}' overwritten by '{}'); bids for this APS \
-                     slot will resolve to the last one",
-                    slot.id,
-                );
-            }
+    fn build_regs(consent: Option<&crate::consent::ConsentContext>) -> Option<Regs> {
+        let consent = consent?;
+        let ext = RegsExt {
+            gdpr: Some(u8::from(consent.gdpr_applies)),
+            us_privacy: consent.raw_us_privacy.clone(),
+            gpp: consent.raw_gpp_string.clone(),
+            gpp_sid: consent.gpp_section_ids.clone(),
+        };
+        Some(Regs {
+            coppa: None,
+            gdpr: Some(consent.gdpr_applies),
+            us_privacy: ext.us_privacy.clone(),
+            gpp: ext.gpp.clone(),
+            gpp_sid: ext
+                .gpp_sid
+                .as_ref()
+                .map(|ids| ids.iter().map(|id| i32::from(*id)).collect())
+                .unwrap_or_default(),
+            ext: ext.to_ext(),
+        })
+    }
+
+    fn request_language(context: &AuctionContext<'_>) -> Option<String> {
+        context
+            .request
+            .headers()
+            .get(header::ACCEPT_LANGUAGE)
+            .and_then(|value| value.to_str().ok())
+            .and_then(|value| value.split(',').next())
+            .and_then(|value| value.split(';').next())
+            .and_then(|value| value.split('-').next())
+            .map(str::trim)
+            .filter(|value| !value.is_empty() && value.len() <= MAX_LANGUAGE_BYTES)
+            .map(str::to_string)
+    }
+
+    fn request_dnt(context: &AuctionContext<'_>) -> Option<bool> {
+        context
+            .request
+            .headers()
+            .get("DNT")
+            .and_then(|value| value.to_str().ok())
+            .is_some_and(|value| value.trim() == "1")
+            .then_some(true)
+    }
+
+    fn valid_http_url(value: &str) -> Option<String> {
+        if value.len() > MAX_PAGE_URL_BYTES {
+            return None;
+        }
+        let parsed = Url::parse(value).ok()?;
+        if !matches!(parsed.scheme(), "http" | "https")
+            || parsed.host_str().is_none()
+            || !parsed.username().is_empty()
+            || parsed.password().is_some()
+        {
+            return None;
         }
-        slot_id_map
+        Some(parsed.to_string())
     }
 
-    /// Convert unified `AuctionRequest` to APS TAM bid request format.
-    ///
-    /// Populates consent fields (GDPR, US Privacy, GPP) from the
-    /// [`ConsentContext`](crate::consent::ConsentContext) attached to the request.
-    ///
-    /// `timeout_ms` is the effective auction budget for this provider (already
-    /// capped by the orchestrator) — advertised to APS so it never expects more
-    /// time than the edge will actually wait.
-    fn to_aps_request(&self, request: &AuctionRequest, timeout_ms: u32) -> ApsBidRequest {
-        let slots: Vec<ApsSlot> = request
+    fn inventory_site_identity(
+        &self,
+        fallback_domain: &str,
+        fallback_page: String,
+    ) -> (String, String) {
+        let (Some(domain), Some(origin)) = (
+            self.config.inventory_domain.as_ref(),
+            self.config.inventory_page_origin.as_deref(),
+        ) else {
+            return (fallback_domain.to_string(), fallback_page);
+        };
+        let (Ok(mut canonical_page), Ok(current_page)) =
+            (Url::parse(origin), Url::parse(&fallback_page))
+        else {
+            return (fallback_domain.to_string(), fallback_page);
+        };
+        canonical_page.set_path(current_page.path());
+        canonical_page.set_query(current_page.query());
+        canonical_page.set_fragment(None);
+        (domain.clone(), canonical_page.to_string())
+    }
+
+    fn build_openrtb_request(
+        &self,
+        request: &AuctionRequest,
+        context: &AuctionContext<'_>,
+    ) -> OpenRtbRequest {
+        let imp = request
             .slots
             .iter()
-            .map(|slot| {
-                let aps_slot_id = Self::aps_slot_id(slot);
-
-                // Extract sizes from banner formats
-                let sizes: Vec<[u32; 2]> = slot
+            .filter_map(|slot| {
+                let slot_context = format!("slot '{}'", slot.id);
+                let formats: Vec<Format> = slot
                     .formats
                     .iter()
-                    .filter(|f| f.media_type == MediaType::Banner)
-                    .map(|f| [f.width, f.height])
+                    .filter(|format| format.media_type == MediaType::Banner)
+                    .filter_map(|format| {
+                        Some(Format {
+                            w: to_openrtb_i32(format.width, "format.w", &slot_context),
+                            h: to_openrtb_i32(format.height, "format.h", &slot_context),
+                            ..Default::default()
+                        })
+                        .filter(|format| format.w.is_some() && format.h.is_some())
+                    })
                     .collect();
-
-                ApsSlot {
-                    slot_id: aps_slot_id,
-                    sizes,
-                    slot_name: Some(slot.id.clone()),
-                }
+                let first = formats.first()?;
+                Some(Imp {
+                    id: Some(slot.id.clone()),
+                    banner: Some(Banner {
+                        format: formats.clone(),
+                        w: first.w,
+                        h: first.h,
+                        topframe: Some(false),
+                        ..Default::default()
+                    }),
+                    bidfloor: slot.floor_price,
+                    bidfloorcur: slot.floor_price.map(|_| DEFAULT_CURRENCY.to_string()),
+                    secure: Some(true),
+                    ..Default::default()
+                })
             })
             .collect();
 
-        // Build consent fields from ConsentContext
-        let consent_ctx = request.user.consent.as_ref();
-        let gdpr = consent_ctx.map(|ctx| ApsGdprConsent {
-            enabled: ctx.gdpr_applies,
-            consent: ctx.raw_tc_string.clone(),
-        });
-        let us_privacy = consent_ctx.and_then(|ctx| ctx.raw_us_privacy.clone());
-        let gpp = consent_ctx.and_then(|ctx| ctx.raw_gpp_string.clone());
-        let gpp_sid = consent_ctx.and_then(|ctx| {
-            ctx.gpp_section_ids.as_ref().map(|ids| {
-                ids.iter()
-                    .map(std::string::ToString::to_string)
-                    .collect::<Vec<_>>()
-                    .join(",")
-            })
+        let consent = request.user.consent.as_ref();
+        let raw_tc = consent.and_then(|value| value.raw_tc_string.clone());
+        let user = Some(User {
+            id: request.user.id.clone(),
+            consent: raw_tc.clone(),
+            ext: UserExt {
+                consent: raw_tc,
+                consented_providers_settings: None,
+                eids: request.user.eids.clone(),
+            }
+            .to_ext(),
+            ..Default::default()
         });
 
-        ApsBidRequest {
-            pub_id: self.config.pub_id.clone(),
-            slots,
-            page_url: request.publisher.page_url.clone(),
-            user_agent: request.device.as_ref().and_then(|d| d.user_agent.clone()),
-            timeout: Some(timeout_ms),
-            gdpr,
-            us_privacy,
-            gpp,
-            gpp_sid,
+        let language = Self::request_language(context);
+        let dnt = Self::request_dnt(context);
+        let device = request
+            .device
+            .as_ref()
+            .map(|device| Device {
+                ua: device.user_agent.clone(),
+                ip: device.ip.clone(),
+                geo: device.geo.as_ref().map(|geo| Geo {
+                    country: Some(geo.country.clone()),
+                    region: geo.region.clone(),
+                    city: Some(geo.city.clone()),
+                    metro: (geo.metro_code > 0).then(|| geo.metro_code.to_string()),
+                    r#type: Some(2),
+                    ..Default::default()
+                }),
+                dnt,
+                language: language.clone(),
+                ..Default::default()
+            })
+            .or_else(|| {
+                (dnt.is_some() || language.is_some()).then_some(Device {
+                    dnt,
+                    language,
+                    ..Default::default()
+                })
+            });
+
+        let page = request
+            .publisher
+            .page_url
+            .as_deref()
+            .and_then(Self::valid_http_url)
+            .unwrap_or_else(|| format!("https://{}", request.publisher.domain));
+        // For the same-origin `/auction` request, the browser Referer is the
+        // current publisher page already carried in sanitized form as
+        // `site.page`; forwarding the raw header as `site.ref` would reintroduce
+        // query-string identifiers and can leak the deployment host.
+        let (site_domain, page) = self.inventory_site_identity(&request.publisher.domain, page);
+
+        OpenRtbRequest {
+            id: Some(request.id.clone()),
+            imp,
+            site: Some(Site {
+                domain: Some(site_domain.clone()),
+                page: Some(page),
+                r#ref: None,
+                publisher: Some(Publisher {
+                    domain: Some(site_domain),
+                    ..Default::default()
+                }),
+                ..Default::default()
+            }),
+            user,
+            device,
+            regs: Self::build_regs(consent),
+            tmax: to_openrtb_i32(context.timeout_ms, "tmax", "APS request"),
+            cur: vec![DEFAULT_CURRENCY.to_string()],
+            ext: ApsRequestExt {
+                account: &self.config.account_id,
+                sdk: ApsSdkExt {
+                    source: APS_SDK_SOURCE,
+                    version: APS_SDK_VERSION,
+                },
+            }
+            .to_ext(),
+            ..Default::default()
         }
     }
 
-    /// Parse size string (e.g., "300x250") into width and height.
-    fn parse_size(size: &str) -> Option<(u32, u32)> {
-        let parts: Vec<&str> = size.split('x').collect();
-        if parts.len() == 2
-            && let (Ok(w), Ok(h)) = (parts[0].parse::<u32>(), parts[1].parse::<u32>())
-        {
-            return Some((w, h));
+    fn serialize_openrtb_request(
+        request: &OpenRtbRequest,
+    ) -> Result<Vec<u8>, Report<TrustedServerError>> {
+        serde_json::to_vec(request).change_context(TrustedServerError::Auction {
+            message: "Failed to serialize APS OpenRTB request".to_string(),
+        })
+    }
+
+    fn debug_headers(headers: &HeaderMap) -> BTreeMap<String, Vec<String>> {
+        // This metadata is returned to page JavaScript. Keep the list fail-closed so
+        // identity or authentication headers from an upstream response never leak.
+        const ALLOWED_HEADERS: &[HeaderName] = &[header::CONTENT_TYPE];
+
+        let mut values = BTreeMap::<String, Vec<String>>::new();
+        for (name, value) in headers {
+            if !ALLOWED_HEADERS.contains(name) {
+                continue;
+            }
+            let Ok(value) = value.to_str() else {
+                continue;
+            };
+            values
+                .entry(name.as_str().to_string())
+                .or_default()
+                .push(value.to_string());
         }
-        None
+        values
     }
 
-    /// Parse a single APS slot response into unified Bid format.
-    ///
-    /// Note: Price is NOT decoded here. The encoded price is stored in metadata
-    /// and will be decoded by the mediation layer (mocktioneer). This simulates
-    /// real-world APS where only Amazon/GAM can decode the proprietary price encoding.
-    fn parse_aps_slot(&self, slot: &ApsSlotResponse) -> Result<Bid, ()> {
-        // Only process filled slots (fif == "1")
-        if slot.fif.as_deref() != Some("1") {
-            return Err(());
+    fn debug_body_preview(body: &[u8]) -> String {
+        let preview_len = body.len().min(MAX_DEBUG_RESPONSE_PREVIEW_BYTES);
+        let mut preview = String::from_utf8_lossy(&body[..preview_len]).into_owned();
+        if body.len() > preview_len {
+            preview.push_str(&format!("…(truncated {} bytes)", body.len() - preview_len));
         }
+        preview
+    }
 
-        // Verify we have an encoded price field
-        let encoded_price = slot.amznbid.as_ref().or(slot.amznp.as_ref());
-        if encoded_price.is_none() {
-            log::debug!(
-                "APS: slot '{}' has no encoded price, skipping",
-                slot.slot_id
-            );
-            return Err(());
+    fn attach_debug_metadata(
+        &self,
+        response: AuctionResponse,
+        debug_enabled: bool,
+        request: Option<ApsDebugRequest>,
+        response_body: Option<&[u8]>,
+        response_headers: &BTreeMap<String, Vec<String>>,
+        status: StatusCode,
+    ) -> AuctionResponse {
+        if !debug_enabled {
+            return response;
         }
 
-        // Parse size from "WxH" format
-        let (width, height) = match Self::parse_size(&slot.size) {
-            Some(dims) => dims,
-            None => {
-                log::debug!(
-                    "APS: slot '{}' has malformed size '{}', skipping",
-                    slot.slot_id,
-                    slot.size
+        let mut http_call = json!({
+            "responseheaders": response_headers,
+            "status": status.as_u16(),
+            "uri": self.config.endpoint.clone(),
+        });
+        if let Some(http_call) = http_call.as_object_mut() {
+            if let Some(request) = request {
+                http_call.insert("requestbody".to_string(), json!(request.body));
+                http_call.insert("requestheaders".to_string(), json!(request.headers));
+            }
+            if let Some(response_body) = response_body {
+                http_call.insert(
+                    "responsebody".to_string(),
+                    json!(Self::debug_body_preview(response_body)),
                 );
-                return Err(());
             }
+        }
+        response.with_metadata(
+            "debug",
+            json!({
+                "httpcalls": {
+                    (APS_INTEGRATION_ID): [http_call]
+                }
+            }),
+        )
+    }
+
+    fn compatible_dimensions(slot: &AdSlot, width: u32, height: u32) -> bool {
+        width > 0
+            && height > 0
+            && slot.formats.iter().any(|format| {
+                format.media_type == MediaType::Banner
+                    && format.width == width
+                    && format.height == height
+            })
+    }
+
+    fn valid_creative_url(&self, value: &str, publisher_domain: &str) -> bool {
+        if value.len() > MAX_CREATIVE_URL_BYTES {
+            return false;
+        }
+        let Ok(parsed) = Url::parse(value) else {
+            return false;
         };
+        parsed.scheme() == "https"
+            && parsed
+                .host_str()
+                .is_some_and(|host| !host.eq_ignore_ascii_case(publisher_domain))
+            && parsed.username().is_empty()
+            && parsed.password().is_none()
+    }
 
-        // Build metadata from targeting keys - includes encoded price for mediation
-        let mut metadata = HashMap::new();
-        if let Some(ref amzniid) = slot.amzniid {
-            metadata.insert("amzniid".to_string(), json!(amzniid));
+    fn build_renderer(&self, input: ApsRendererInput<'_>) -> Option<BidRenderer> {
+        let tag_type_value = match input.tag_type {
+            ApsTagType::Iframe => "iframe",
+            ApsTagType::Script => "script",
+        };
+        let envelope = json!({
+            "seatbid": [{
+                "bid": [{
+                    "id": input.bid_id,
+                    "price": input.price,
+                    "w": input.width,
+                    "h": input.height,
+                    "ext": {
+                        "creativeurl": input.creative_url,
+                        "tagtype": tag_type_value
+                    }
+                }]
+            }]
+        });
+        let serialized = serde_json::to_vec(&envelope).ok()?;
+        if serialized.len() > MAX_RENDER_ENVELOPE_BYTES {
+            return None;
         }
-        if let Some(ref amznbid) = slot.amznbid {
-            metadata.insert("amznbid".to_string(), json!(amznbid));
+        Some(BidRenderer::Aps(ApsRendererV1 {
+            version: 1,
+            account_id: self.config.account_id.clone(),
+            bid_id: input.bid_id.to_string(),
+            creative_id: input.creative_id,
+            tag_type: input.tag_type,
+            creative_url: input.creative_url.to_string(),
+            aax_response: BASE64_STANDARD.encode(serialized),
+            width: input.width,
+            height: input.height,
+        }))
+    }
+
+    fn increment_reason(reasons: &mut BTreeMap<String, u64>, reason: &'static str) {
+        *reasons.entry(reason.to_string()).or_default() += 1;
+    }
+
+    fn parse_bid(
+        &self,
+        value: &Json,
+        slots: &HashMap<&str, &AdSlot>,
+        publisher_domain: &str,
+    ) -> Result<Bid, &'static str> {
+        let bid_id = value
+            .get("id")
+            .and_then(Json::as_str)
+            .filter(|value| !value.is_empty())
+            .ok_or("missing_render_source")?;
+        let slot_id = value
+            .get("impid")
+            .and_then(Json::as_str)
+            .ok_or("unknown_impid")?;
+        let slot = slots.get(slot_id).ok_or("unknown_impid")?;
+        let price = value
+            .get("price")
+            .and_then(Json::as_f64)
+            .filter(|price| price.is_finite() && *price >= 0.0)
+            .ok_or("invalid_price")?;
+        if value
+            .get("mtype")
+            .is_some_and(|mtype| mtype.as_i64() != Some(1))
+        {
+            return Err("unsupported_media_type");
         }
-        if let Some(ref amznp) = slot.amznp {
-            metadata.insert("amznp".to_string(), json!(amznp));
+        let width = value
+            .get("w")
+            .and_then(Json::as_u64)
+            .and_then(|value| u32::try_from(value).ok())
+            .ok_or("invalid_dimensions")?;
+        let height = value
+            .get("h")
+            .and_then(Json::as_u64)
+            .and_then(|value| u32::try_from(value).ok())
+            .ok_or("invalid_dimensions")?;
+        if !Self::compatible_dimensions(slot, width, height) {
+            return Err("invalid_dimensions");
         }
-        if let Some(ref amznsz) = slot.amznsz {
-            metadata.insert("amznsz".to_string(), json!(amznsz));
+        let ext = value
+            .get("ext")
+            .and_then(Json::as_object)
+            .ok_or("missing_render_source")?;
+        let creative_url = ext
+            .get("creativeurl")
+            .and_then(Json::as_str)
+            .ok_or("missing_render_source")?;
+        if !self.valid_creative_url(creative_url, publisher_domain) {
+            return Err("invalid_creative_url");
         }
-        if let Some(ref amznactt) = slot.amznactt {
-            metadata.insert("amznactt".to_string(), json!(amznactt));
+        let tag_type = match ext.get("tagtype").and_then(Json::as_str) {
+            Some("iframe") => ApsTagType::Iframe,
+            Some("script") if self.config.allow_script_creatives => ApsTagType::Script,
+            Some("script") => return Err("script_rendering_disabled"),
+            _ => return Err("unsupported_tagtype"),
+        };
+        let creative_id = value
+            .get("crid")
+            .and_then(Json::as_str)
+            .filter(|creative_id| !creative_id.is_empty())
+            .map(str::to_string);
+        if creative_id
+            .as_ref()
+            .is_some_and(|creative_id| creative_id.len() > MAX_CREATIVE_ID_BYTES)
+        {
+            return Err("creative_id_too_large");
         }
+        let renderer = self
+            .build_renderer(ApsRendererInput {
+                bid_id,
+                creative_id: creative_id.clone(),
+                tag_type,
+                creative_url,
+                price,
+                width,
+                height,
+            })
+            .ok_or("render_payload_too_large")?;
+        let adomain = value
+            .get("adomain")
+            .and_then(Json::as_array)
+            .map(|domains| {
+                domains
+                    .iter()
+                    .filter_map(Json::as_str)
+                    .map(str::to_string)
+                    .collect()
+            });
 
-        // APS doesn't return creative HTML - only targeting keys
-        // The creative will be generated by the mediation layer
-        // Price is None - will be decoded by mediation layer from amznbid metadata
         Ok(Bid {
-            slot_id: slot.slot_id.clone(),
-            price: None, // Encoded price in metadata, decoded by mediation
-            currency: "USD".to_string(),
+            slot_id: slot_id.to_string(),
+            price: Some(price),
+            currency: DEFAULT_CURRENCY.to_string(),
             creative: None,
-            adomain: None, // APS doesn't provide adomain in response
-            bidder: "amazon-aps".to_string(),
+            adomain,
+            bidder: APS_INTEGRATION_ID.to_string(),
             width,
             height,
-            nurl: None, // Real APS uses client-side event tracking
+            nurl: None,
             burl: None,
-            ad_id: None,
+            bid_id: Some(bid_id.to_string()),
+            ad_id: value.get("adid").and_then(Json::as_str).map(str::to_string),
+            creative_id,
+            renderer: Some(renderer),
             cache_id: None,
             cache_host: None,
             cache_path: None,
-            metadata,
+            metadata: HashMap::new(),
         })
     }
 
-    /// Parse APS TAM response into unified `AuctionResponse`.
-    ///
-    /// `slot_map` is the request-scoped APS slot ID → creative-opportunity
-    /// slot ID mapping built by [`Self::build_slot_id_map`].
     fn parse_aps_response(
         &self,
-        json: &Json,
+        value: &Json,
         response_time_ms: u64,
-        slot_map: &HashMap<String, String>,
+        request: &AuctionRequest,
     ) -> AuctionResponse {
-        let mut bids = Vec::new();
-
-        // Try to parse as ApsBidResponse with contextual wrapper
-        if let Ok(aps_response) = serde_json::from_value::<ApsBidResponse>(json.clone()) {
-            log::debug!(
-                "APS: parsed contextual response with {} slots",
-                aps_response.contextual.slots.len()
-            );
+        if !value.is_object()
+            || value.get("contextual").is_some()
+            || value
+                .get("cur")
+                .is_some_and(|currency| !currency.is_string())
+            || value
+                .get("seatbid")
+                .is_some_and(|seatbids| !seatbids.is_array())
+        {
+            return AuctionResponse::error(APS_INTEGRATION_ID, response_time_ms)
+                .with_metadata("drop_reasons", json!({"unexpected_response_shape": 1}));
+        }
+        if value
+            .get("cur")
+            .and_then(Json::as_str)
+            .is_some_and(|currency| !currency.eq_ignore_ascii_case(DEFAULT_CURRENCY))
+        {
+            return AuctionResponse::no_bid(APS_INTEGRATION_ID, response_time_ms)
+                .with_metadata("drop_reasons", json!({"unsupported_currency": 1}));
+        }
 
-            for slot in aps_response.contextual.slots {
-                match self.parse_aps_slot(&slot) {
-                    Ok(mut bid) => {
-                        // Remap APS slot ID (e.g. "aps-slot-atf-sidebar") back to the
-                        // creative-opportunity slot ID (e.g. "atf_sidebar_ad") so the
-                        // mediator and bid_map can match by creative slot ID.
-                        if let Some(creative_id) = slot_map.get(&bid.slot_id) {
-                            bid.slot_id = creative_id.clone();
+        let slots: HashMap<&str, &AdSlot> = request
+            .slots
+            .iter()
+            .map(|slot| (slot.id.as_str(), slot))
+            .collect();
+        let seatbids = value.get("seatbid").and_then(Json::as_array);
+        let seatbid_count = seatbids.map_or(0, Vec::len);
+        let mut reasons = BTreeMap::new();
+        let mut selected: HashMap<String, Bid> = HashMap::new();
+        let mut dropped = 0_u64;
+
+        for seatbid in seatbids.into_iter().flatten() {
+            let Some(bids) = seatbid.get("bid").and_then(Json::as_array) else {
+                dropped += 1;
+                Self::increment_reason(&mut reasons, "empty_seatbid_bids");
+                continue;
+            };
+            for value in bids {
+                match self.parse_bid(value, &slots, &request.publisher.domain) {
+                    Ok(candidate) => {
+                        let replace = selected.get(&candidate.slot_id).is_none_or(|current| {
+                            let candidate_price = candidate.price.unwrap_or_default();
+                            let current_price = current.price.unwrap_or_default();
+                            candidate_price > current_price
+                                || (candidate_price == current_price
+                                    && candidate.bid_id.as_deref().unwrap_or_default()
+                                        < current.bid_id.as_deref().unwrap_or_default())
+                        });
+                        if replace {
+                            if selected
+                                .insert(candidate.slot_id.clone(), candidate)
+                                .is_some()
+                            {
+                                dropped += 1;
+                                Self::increment_reason(&mut reasons, "lost_to_higher_bid");
+                            }
+                        } else {
+                            dropped += 1;
+                            Self::increment_reason(&mut reasons, "lost_to_higher_bid");
                         }
-                        let encoded_price = bid
-                            .metadata
-                            .get("amznbid")
-                            .and_then(|v| v.as_str())
-                            .unwrap_or("unknown");
-                        log::debug!(
-                            "APS: parsed bid for slot '{}' with encoded price (to be decoded by mediation)",
-                            bid.slot_id,
-                        );
-                        log::trace!(
-                            "APS: slot '{}' encoded price: {}",
-                            bid.slot_id,
-                            encoded_price
-                        );
-                        bids.push(bid);
                     }
-                    Err(_) => {
-                        log::debug!("APS: skipped slot (no fill or invalid)");
+                    Err(reason) => {
+                        dropped += 1;
+                        Self::increment_reason(&mut reasons, reason);
                     }
                 }
             }
-        } else {
-            log::warn!("APS: failed to parse response as contextual format");
         }
 
-        if bids.is_empty() {
-            AuctionResponse::no_bid("aps", response_time_ms)
-        } else {
-            AuctionResponse::success("aps", bids, response_time_ms)
+        if seatbid_count == 0 {
+            Self::increment_reason(&mut reasons, "empty_seatbid");
         }
+        let accepted = selected.len();
+        let metadata = [
+            ("seatbid_count".to_string(), json!(seatbid_count)),
+            ("accepted_bid_count".to_string(), json!(accepted)),
+            ("dropped_bid_count".to_string(), json!(dropped)),
+            ("drop_reasons".to_string(), json!(reasons)),
+        ];
+        let mut response = if selected.is_empty() {
+            AuctionResponse::no_bid(APS_INTEGRATION_ID, response_time_ms)
+        } else {
+            AuctionResponse::success(
+                APS_INTEGRATION_ID,
+                selected.into_values().collect(),
+                response_time_ms,
+            )
+        };
+        response.metadata.extend(metadata);
+        response
     }
 
-    /// Shared parse path for both trait entry points.
-    ///
-    /// # Errors
-    ///
-    /// Returns an error when the response body cannot be read or is not valid JSON.
     async fn parse_response_inner(
         &self,
         response: PlatformResponse,
         response_time_ms: u64,
-        slot_map: &HashMap<String, String>,
+        request: Option<&AuctionRequest>,
+        debug_request: Option<ApsDebugRequest>,
+        debug_enabled: bool,
     ) -> Result<AuctionResponse, Report<TrustedServerError>> {
         let response = response.response;
+        let status = response.status();
+        let response_headers = if debug_enabled {
+            Self::debug_headers(response.headers())
+        } else {
+            BTreeMap::new()
+        };
 
-        // Check status code
-        if !response.status().is_success() {
-            log::warn!("APS returned non-success status: {}", response.status());
-            return Ok(AuctionResponse::error("aps", response_time_ms));
+        if status == StatusCode::NO_CONTENT {
+            return Ok(self.attach_debug_metadata(
+                AuctionResponse::no_bid(APS_INTEGRATION_ID, response_time_ms),
+                debug_enabled,
+                debug_request,
+                Some(&[]),
+                &response_headers,
+                status,
+            ));
         }
-
-        // Parse response body — collect_response_bounded caps memory from misbehaving providers.
-        let body_bytes =
-            collect_response_bounded(response.into_body(), UPSTREAM_RTB_MAX_RESPONSE_BYTES, "aps")
+        if !status.is_success() {
+            log::warn!("APS returns a non-success status");
+            let body = if debug_enabled {
+                match collect_response_bounded(
+                    response.into_body(),
+                    UPSTREAM_RTB_MAX_RESPONSE_BYTES,
+                    APS_INTEGRATION_ID,
+                )
                 .await
-                .change_context(TrustedServerError::Auction {
-                    message: "Failed to read APS response body".to_string(),
-                })?;
-        let response_json: Json =
-            serde_json::from_slice(&body_bytes).change_context(TrustedServerError::Auction {
-                message: "Failed to parse APS response JSON".to_string(),
-            })?;
-
-        log::trace!("APS: received response: {:?}", response_json);
-
-        // Transform to unified format
-        let auction_response = self.parse_aps_response(&response_json, response_time_ms, slot_map);
-
+                {
+                    Ok(body) => Some(body),
+                    Err(error) => {
+                        log::warn!("Failed to read APS debug response body: {error:?}");
+                        None
+                    }
+                }
+            } else {
+                None
+            };
+            return Ok(self.attach_debug_metadata(
+                AuctionResponse::error(APS_INTEGRATION_ID, response_time_ms),
+                debug_enabled,
+                debug_request,
+                body.as_deref(),
+                &response_headers,
+                status,
+            ));
+        }
+        let body = collect_response_bounded(
+            response.into_body(),
+            UPSTREAM_RTB_MAX_RESPONSE_BYTES,
+            APS_INTEGRATION_ID,
+        )
+        .await
+        .change_context(TrustedServerError::Auction {
+            message: "Failed to read APS response body".to_string(),
+        })?;
+        log::trace!("APS response body: {}", String::from_utf8_lossy(&body));
+        let value: Json = match serde_json::from_slice(&body) {
+            Ok(value) => value,
+            Err(error) => {
+                log::warn!("Failed to parse APS response JSON: {error}");
+                let parsed = AuctionResponse::error(APS_INTEGRATION_ID, response_time_ms)
+                    .with_metadata("drop_reasons", json!({"unexpected_response_shape": 1}));
+                return Ok(self.attach_debug_metadata(
+                    parsed,
+                    debug_enabled,
+                    debug_request,
+                    Some(&body),
+                    &response_headers,
+                    status,
+                ));
+            }
+        };
+        let Some(request) = request else {
+            log::error!(
+                "APS cannot parse a successful bid response without the original auction request context"
+            );
+            let response = AuctionResponse::error(APS_INTEGRATION_ID, response_time_ms)
+                .with_metadata("drop_reasons", json!({"missing_request_context": 1}));
+            return Ok(self.attach_debug_metadata(
+                response,
+                debug_enabled,
+                debug_request,
+                Some(&body),
+                &response_headers,
+                status,
+            ));
+        };
+        let parsed = self.parse_aps_response(&value, response_time_ms, request);
         log::info!(
-            "APS returned {} bids in {}ms",
-            auction_response.bids.len(),
+            "APS returns {} accepted bids in {}ms",
+            parsed.bids.len(),
             response_time_ms
         );
-
-        Ok(auction_response)
+        Ok(self.attach_debug_metadata(
+            parsed,
+            debug_enabled,
+            debug_request,
+            Some(&body),
+            &response_headers,
+            status,
+        ))
     }
 }
 
 #[async_trait(?Send)]
 impl AuctionProvider for ApsAuctionProvider {
     fn provider_name(&self) -> &'static str {
-        "aps"
+        APS_INTEGRATION_ID
     }
 
     async fn request_bids(
         &self,
         request: &AuctionRequest,
         context: &AuctionContext<'_>,
-    ) -> Result<PlatformPendingRequest, Report<TrustedServerError>> {
-        log::info!(
-            "APS: requesting bids for {} slots (pub_id: {})",
-            request.slots.len(),
-            self.config.pub_id
-        );
-
-        // Transform to APS format. `context.timeout_ms` is the effective budget
-        // the orchestrator granted this provider — the payload must advertise
-        // the same deadline the edge backend enforces below. The APS-slot-ID →
-        // creative-slot-ID remapping is rebuilt from the request in
-        // `parse_response_with_context`, keeping it request-scoped.
-        let aps_request = self.to_aps_request(request, context.timeout_ms);
-
-        // Serialize to JSON
-        let aps_json =
-            serde_json::to_value(&aps_request).change_context(TrustedServerError::Auction {
-                message: "Failed to serialize APS bid request".to_string(),
-            })?;
-
-        log::trace!("APS: sending bid request: {:?}", aps_json);
-
-        // Create HTTP POST request
-        let aps_body =
-            serde_json::to_vec(&aps_json).change_context(TrustedServerError::Auction {
-                message: "Failed to serialize APS request body".to_string(),
-            })?;
-        let aps_req = http::Request::builder()
+    ) -> Result<ProviderRequestOutcome, Report<TrustedServerError>> {
+        let openrtb = self.build_openrtb_request(request, context);
+        if openrtb.imp.is_empty() {
+            return Err(Report::new(TrustedServerError::Auction {
+                message: "No valid APS impressions after filtering".to_string(),
+            }));
+        }
+        log::info!("APS requests bids for {} impressions", openrtb.imp.len());
+        log::trace!("APS request body: {openrtb:?}");
+        let body = Self::serialize_openrtb_request(&openrtb)?;
+        let outbound_request = http::Request::builder()
             .method(Method::POST)
             .uri(&self.config.endpoint)
             .header(header::CONTENT_TYPE, "application/json")
-            .body(EdgeBody::from(aps_body))
+            .body(EdgeBody::from(body.clone()))
             .change_context(TrustedServerError::Auction {
                 message: "Failed to build APS request".to_string(),
             })?;
-
-        // Uses context.timeout_ms (auction-scoped) rather than the 15 s fixed
-        // timeout in ensure_integration_backend, which is for proxy endpoints.
-        // Send request asynchronously with auction-scoped timeout
-        let backend_name = ensure_integration_backend_with_timeout(
+        let debug_request = self.config.debug.then(|| ApsDebugRequest {
+            body: String::from_utf8_lossy(&body).into_owned(),
+            headers: Self::debug_headers(outbound_request.headers()),
+        });
+        let backend = ensure_integration_backend_with_timeout(
             context.services,
             &self.config.endpoint,
-            "aps",
+            APS_INTEGRATION_ID,
             Duration::from_millis(u64::from(context.timeout_ms)),
         )
         .change_context(TrustedServerError::Auction {
-            message: format!(
-                "Failed to resolve backend for APS endpoint: {}",
-                self.config.endpoint
-            ),
+            message: "Failed to resolve APS backend".to_string(),
         })?;
-
         let pending = context
             .services
             .http_client()
-            .send_async(PlatformHttpRequest::new(aps_req, backend_name))
+            .send_async(PlatformHttpRequest::new(outbound_request, backend))
             .await
             .change_context(TrustedServerError::Auction {
-                message: "Failed to send async request to APS".to_string(),
+                message: "Failed to send APS request".to_string(),
             })?;
-
-        Ok(pending)
+        Ok(match debug_request {
+            Some(debug_request) => {
+                ProviderRequestOutcome::pending_with_state(pending, Box::new(debug_request))
+            }
+            None => ProviderRequestOutcome::pending(pending),
+        })
     }
 
     async fn parse_response(
@@ -674,11 +1104,7 @@ impl AuctionProvider for ApsAuctionProvider {
         response: PlatformResponse,
         response_time_ms: u64,
     ) -> Result<AuctionResponse, Report<TrustedServerError>> {
-        // No auction request available — bids keep their raw APS slot IDs. The
-        // orchestrator always calls [`Self::parse_response_with_context`], so
-        // this path only serves callers outside the orchestration flow.
-        log::debug!("APS: parsing without request context — slot ID remapping unavailable");
-        self.parse_response_inner(response, response_time_ms, &HashMap::new())
+        self.parse_response_inner(response, response_time_ms, None, None, self.config.debug)
             .await
     }
 
@@ -687,19 +1113,50 @@ impl AuctionProvider for ApsAuctionProvider {
         response: PlatformResponse,
         response_time_ms: u64,
         request: &AuctionRequest,
-        _context: &AuctionContext<'_>,
+        context: &AuctionContext<'_>,
     ) -> Result<AuctionResponse, Report<TrustedServerError>> {
-        // Rebuild the APS-slot-ID → creative-slot-ID map from the auction
-        // request so overlapping auctions on shared provider instances cannot
-        // overwrite or consume each other's mappings.
-        let slot_map = Self::build_slot_id_map(request);
-        self.parse_response_inner(response, response_time_ms, &slot_map)
-            .await
+        let _ = context;
+        self.parse_response_inner(
+            response,
+            response_time_ms,
+            Some(request),
+            None,
+            self.config.debug,
+        )
+        .await
+    }
+
+    async fn parse_response_with_context_and_state(
+        &self,
+        response: PlatformResponse,
+        response_time_ms: u64,
+        request: &AuctionRequest,
+        context: &AuctionContext<'_>,
+        parse_state: Option<&(dyn core::any::Any + Send + Sync)>,
+    ) -> Result<AuctionResponse, Report<TrustedServerError>> {
+        let _ = context;
+        let debug_request = if self.config.debug {
+            let debug_request =
+                parse_state.and_then(|state| state.downcast_ref::<ApsDebugRequest>());
+            if parse_state.is_some() && debug_request.is_none() {
+                log::warn!("APS response received unexpected provider parse state");
+            }
+            debug_request.cloned()
+        } else {
+            None
+        };
+        self.parse_response_inner(
+            response,
+            response_time_ms,
+            Some(request),
+            debug_request,
+            self.config.debug,
+        )
+        .await
     }
 
     fn supports_media_type(&self, media_type: &MediaType) -> bool {
-        // APS supports banner and video formats
-        matches!(media_type, MediaType::Banner | MediaType::Video)
+        matches!(media_type, MediaType::Banner)
     }
 
     fn timeout_ms(&self) -> u32 {
@@ -714,717 +1171,1257 @@ impl AuctionProvider for ApsAuctionProvider {
         predict_integration_backend_name(
             services,
             &self.config.endpoint,
-            "aps",
+            APS_INTEGRATION_ID,
             Duration::from_millis(u64::from(timeout_ms)),
         )
-        .inspect_err(|e| {
-            log::error!(
-                "Failed to predict backend name for APS endpoint '{}': {e:?}",
-                self.config.endpoint
-            );
-        })
+        .inspect_err(|error| log::error!("Failed to predict APS backend name: {error:?}"))
         .ok()
     }
 }
 
-// ============================================================================
-// Provider Auto-Registration
-// ============================================================================
+#[derive(Debug)]
+struct ApsRendererIntegration;
 
-use crate::settings::Settings;
-use std::sync::Arc;
+#[async_trait(?Send)]
+impl IntegrationProxy for ApsRendererIntegration {
+    fn integration_name(&self) -> &'static str {
+        APS_INTEGRATION_ID
+    }
+
+    fn routes(&self) -> Vec<IntegrationEndpoint> {
+        vec![IntegrationEndpoint::get(APS_RENDERER_ROUTE)]
+    }
 
-/// Auto-register APS provider based on settings configuration.
+    async fn handle(
+        &self,
+        _settings: &Settings,
+        _services: &RuntimeServices,
+        request: http::Request<EdgeBody>,
+    ) -> Result<http::Response<EdgeBody>, Report<TrustedServerError>> {
+        if request.method() != Method::GET || request.uri().path() != APS_RENDERER_ROUTE {
+            return http::Response::builder()
+                .status(StatusCode::NOT_FOUND)
+                .body(EdgeBody::from("Not Found"))
+                .change_context(TrustedServerError::Integration {
+                    integration: APS_INTEGRATION_ID.to_string(),
+                    message: "Failed to build APS not-found response".to_string(),
+                });
+        }
+        http::Response::builder()
+            .status(StatusCode::OK)
+            .header(header::CONTENT_TYPE, "text/html; charset=utf-8")
+            .header("x-content-type-options", "nosniff")
+            .header("referrer-policy", "no-referrer")
+            .header(header::CONTENT_SECURITY_POLICY, APS_RENDERER_CSP)
+            .body(EdgeBody::from(APS_RENDERER_DOCUMENT))
+            .change_context(TrustedServerError::Integration {
+                integration: APS_INTEGRATION_ID.to_string(),
+                message: "Failed to build APS renderer response".to_string(),
+            })
+    }
+}
+
+/// Register the APS static renderer endpoint when APS is enabled.
+///
+/// # Errors
 ///
-/// Returns the APS provider if enabled in settings.
+/// Returns an error when enabled APS configuration is invalid.
+pub fn register(
+    settings: &Settings,
+) -> Result<Option<IntegrationRegistration>, Report<TrustedServerError>> {
+    let Some(_config) = settings.integration_config::<ApsConfig>(APS_INTEGRATION_ID)? else {
+        return Ok(None);
+    };
+    let integration = Arc::new(ApsRendererIntegration);
+    Ok(Some(
+        IntegrationRegistration::builder(APS_INTEGRATION_ID)
+            .with_proxy(integration)
+            .without_js()
+            .build(),
+    ))
+}
+
+/// Register the APS auction provider when enabled.
 ///
 /// # Errors
 ///
-/// Returns an error when the APS provider is enabled with invalid
-/// configuration.
+/// Returns an error when enabled APS configuration is invalid.
 pub fn register_providers(
     settings: &Settings,
 ) -> Result<Vec<Arc<dyn AuctionProvider>>, Report<TrustedServerError>> {
-    let mut providers: Vec<Arc<dyn AuctionProvider>> = Vec::new();
-
-    // Check for real APS provider configuration
-    match settings.integration_config::<ApsConfig>("aps") {
-        Ok(Some(config)) => {
-            log::info!(
-                "Registering real APS provider (pub_id: {}, endpoint: {})",
-                config.pub_id,
-                config.endpoint
-            );
-            providers.push(Arc::new(ApsAuctionProvider::new(config)));
-        }
-        Ok(None) => {
-            log::debug!("APS integration config found but is disabled");
-        }
-        Err(e) => {
-            return Err(e);
-        }
+    let Some(config) = settings.integration_config::<ApsConfig>(APS_INTEGRATION_ID)? else {
+        return Ok(Vec::new());
+    };
+    log::info!("Registering APS OpenRTB provider");
+    if config.debug {
+        log::warn!(
+            "APS debug mode is ON — raw request and response data, including creative markup, will be included in client-visible /auction responses"
+        );
     }
-
-    Ok(providers)
+    Ok(vec![Arc::new(ApsAuctionProvider::new(config))])
 }
 
-// ============================================================================
-// Tests
-// ============================================================================
-
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::auction::types::*;
+    use crate::auction::types::{
+        AdFormat, AdSlot, AuctionContext, AuctionRequest, BidStatus, DeviceInfo, PublisherInfo,
+        UserInfo,
+    };
+    use crate::consent::ConsentContext;
+    use crate::openrtb::{Eid, Uid};
+    use crate::platform::GeoInfo;
+    use crate::platform::test_support::{
+        StubHttpClient, build_services_with_http_client, noop_services,
+    };
+    use crate::test_support::tests::create_test_settings;
+    use serde_json::json;
+
+    fn config() -> ApsConfig {
+        ApsConfig {
+            enabled: true,
+            account_id: "example-account-id".to_string(),
+            endpoint: default_endpoint(),
+            timeout_ms: 800,
+            debug: false,
+            allow_script_creatives: false,
+            inventory_domain: None,
+            inventory_page_origin: None,
+        }
+    }
 
-    fn create_test_auction_request() -> AuctionRequest {
+    fn request() -> AuctionRequest {
         AuctionRequest {
-            id: "test-auction-123".to_string(),
-            slots: vec![
-                AdSlot {
-                    id: "header-banner".to_string(),
-                    formats: vec![
-                        AdFormat {
-                            media_type: MediaType::Banner,
-                            width: 728,
-                            height: 90,
-                        },
-                        AdFormat {
-                            media_type: MediaType::Banner,
-                            width: 970,
-                            height: 250,
-                        },
-                    ],
-                    floor_price: Some(1.50),
-                    targeting: HashMap::new(),
-                    bidders: HashMap::new(),
-                },
-                AdSlot {
-                    id: "sidebar".to_string(),
-                    formats: vec![AdFormat {
-                        media_type: MediaType::Banner,
-                        width: 300,
-                        height: 250,
-                    }],
-                    floor_price: Some(1.00),
-                    targeting: HashMap::new(),
-                    bidders: HashMap::new(),
-                },
-            ],
+            id: "fictional-auction".to_string(),
+            slots: vec![AdSlot {
+                id: "fictional-slot".to_string(),
+                formats: vec![AdFormat {
+                    media_type: MediaType::Banner,
+                    width: 300,
+                    height: 250,
+                }],
+                floor_price: Some(1.0),
+                targeting: HashMap::new(),
+                bidders: HashMap::new(),
+            }],
             publisher: PublisherInfo {
-                domain: "test.com".to_string(),
-                page_url: Some("https://test.com/article".to_string()),
+                domain: "publisher.example".to_string(),
+                page_url: Some("https://publisher.example/article".to_string()),
             },
             user: UserInfo {
-                id: Some("user-123".to_string()),
+                id: Some("fictional-user".to_string()),
                 consent: None,
                 eids: None,
             },
-            device: Some(DeviceInfo {
-                user_agent: Some("Mozilla/5.0".to_string()),
-                ip: Some("192.168.1.1".to_string()),
-                geo: None,
-            }),
+            device: None,
             site: None,
             context: HashMap::new(),
         }
     }
 
-    #[test]
-    fn test_aps_request_transformation() {
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
-            timeout_ms: 800,
+    fn bid(id: &str, price: f64, tagtype: &str) -> Json {
+        json!({
+            "id": id,
+            "impid": "fictional-slot",
+            "price": price,
+            "w": 300,
+            "h": 250,
+            "crid": "fictional-creative",
+            "adomain": ["advertiser.example"],
+            "ext": {
+                "creativeurl": "https://creative.example/render",
+                "tagtype": tagtype,
+                "unknown": "discarded"
+            },
+            "adm": "<script>discarded</script>",
+            "nurl": "https://notice.example/win"
+        })
+    }
+
+    fn parse_with_context(
+        provider: &ApsAuctionProvider,
+        response: PlatformResponse,
+    ) -> AuctionResponse {
+        let settings = create_test_settings();
+        let services = noop_services();
+        let downstream = http::Request::builder()
+            .uri("https://publisher.example/auction")
+            .body(EdgeBody::empty())
+            .expect("should build downstream request");
+        let context = AuctionContext {
+            settings: &settings,
+            request: &downstream,
+            timeout_ms: 321,
+            provider_responses: None,
+            services: &services,
         };
+        let auction_request = request();
+        let debug_request = provider.config.debug.then(|| {
+            let openrtb = provider.build_openrtb_request(&auction_request, &context);
+            let body = ApsAuctionProvider::serialize_openrtb_request(&openrtb)
+                .expect("should serialize APS debug request");
+            ApsDebugRequest {
+                body: String::from_utf8_lossy(&body).into_owned(),
+                headers: BTreeMap::from([(
+                    header::CONTENT_TYPE.as_str().to_string(),
+                    vec!["application/json".to_string()],
+                )]),
+            }
+        });
+        futures::executor::block_on(
+            provider.parse_response_with_context_and_state(
+                response,
+                12,
+                &auction_request,
+                &context,
+                debug_request
+                    .as_ref()
+                    .map(|state| state as &(dyn core::any::Any + Send + Sync)),
+            ),
+        )
+        .expect("should parse APS response with context")
+    }
 
-        let provider = ApsAuctionProvider::new(config);
-        let auction_request = create_test_auction_request();
-        let aps_request = provider.to_aps_request(&auction_request, 800);
+    #[test]
+    fn config_accepts_canonical_alias_and_integer_ids() {
+        let canonical: ApsConfig = serde_json::from_value(json!({
+            "account_id": "  example-account  "
+        }))
+        .expect("should parse canonical account ID");
+        let alias: ApsConfig =
+            serde_json::from_value(json!({"pub_id": 1234})).expect("should parse legacy alias");
+        let debug: ApsConfig = serde_json::from_value(json!({
+            "account_id": "example-account",
+            "debug": true
+        }))
+        .expect("should parse debug flag");
+        assert_eq!(canonical.account_id, "example-account");
+        assert_eq!(alias.account_id, "1234");
+        assert!(!canonical.enabled);
+        assert!(!canonical.debug);
+        assert!(debug.debug);
+        assert!(!canonical.allow_script_creatives);
+        assert!(canonical.endpoint.ends_with("/e/pb/bid"));
+    }
 
-        // Verify basic fields
-        assert_eq!(aps_request.pub_id, "5128");
-        assert_eq!(aps_request.slots.len(), 2);
-        assert_eq!(
-            aps_request.page_url,
-            Some("https://test.com/article".to_string())
-        );
-        assert_eq!(aps_request.user_agent, Some("Mozilla/5.0".to_string()));
-        assert_eq!(aps_request.timeout, Some(800));
+    #[test]
+    fn config_accepts_default_and_custom_openrtb_endpoints() {
+        let default = ApsConfig {
+            account_id: "example-account".to_string(),
+            ..Default::default()
+        };
+        let custom: ApsConfig = serde_json::from_value(json!({
+            "account_id": "example-account",
+            "endpoint": "https://aps.example.com/custom/openrtb"
+        }))
+        .expect("should deserialize custom endpoint");
+
+        default
+            .validate()
+            .expect("should accept production default endpoint");
+        custom
+            .validate()
+            .expect("should accept fictional custom HTTPS endpoint");
+    }
 
-        // Verify first slot
-        let slot1 = &aps_request.slots[0];
-        assert_eq!(slot1.slot_id, "header-banner");
-        assert_eq!(slot1.sizes.len(), 2);
-        assert_eq!(slot1.sizes[0], [728, 90]);
-        assert_eq!(slot1.sizes[1], [970, 250]);
+    #[test]
+    fn config_rejects_legacy_aps_endpoint_with_migration_error() {
+        for endpoint in [
+            "https://aps.example.com/e/dtb/bid",
+            "https://aps.example.com/e/dtb/bid/",
+            "https://aps.example.com/custom/e/dtb/bid",
+        ] {
+            let parsed: ApsConfig = serde_json::from_value(json!({
+                "account_id": "example-account",
+                "endpoint": endpoint
+            }))
+            .expect("should deserialize legacy endpoint before validation");
+            let error = parsed
+                .validate()
+                .expect_err("should reject legacy endpoint");
+            assert!(
+                error.to_string().contains("migrate to /e/pb/bid"),
+                "should provide endpoint migration guidance: {error}"
+            );
+        }
+    }
 
-        // Verify second slot
-        let slot2 = &aps_request.slots[1];
-        assert_eq!(slot2.slot_id, "sidebar");
-        assert_eq!(slot2.sizes.len(), 1);
-        assert_eq!(slot2.sizes[0], [300, 250]);
+    #[test]
+    fn config_rejects_blank_duplicate_and_unsafe_endpoint() {
+        assert!(serde_json::from_value::<ApsConfig>(json!({"account_id": "   "})).is_err());
+        assert!(
+            serde_json::from_value::<ApsConfig>(
+                json!({"account_id": "x".repeat(MAX_ACCOUNT_ID_BYTES + 1)})
+            )
+            .is_err()
+        );
+        assert!(
+            serde_json::from_value::<ApsConfig>(json!({
+                "account_id": "one",
+                "pub_id": "two"
+            }))
+            .is_err()
+        );
+        for endpoint in [
+            "http://aps.example/e/pb/bid",
+            "https://",
+            "https://user:password@aps.example/e/pb/bid",
+        ] {
+            let parsed: ApsConfig = serde_json::from_value(json!({
+                "account_id": "example-account",
+                "endpoint": endpoint
+            }))
+            .expect("should deserialize before validation");
+            assert!(parsed.validate().is_err(), "should reject {endpoint}");
+        }
     }
 
     #[test]
-    fn aps_slot_id_from_bidders_map_used_in_request_and_remapped_in_response() {
-        use serde_json::json;
+    fn config_requires_safe_inventory_identity_override_pair() {
+        for value in [
+            json!({
+                "account_id": "example-account",
+                "inventory_domain": "publisher.example"
+            }),
+            json!({
+                "account_id": "example-account",
+                "inventory_page_origin": "https://www.publisher.example"
+            }),
+            json!({
+                "account_id": "example-account",
+                "inventory_domain": "publisher.example",
+                "inventory_page_origin": "http://www.publisher.example"
+            }),
+            json!({
+                "account_id": "example-account",
+                "inventory_domain": "publisher.example",
+                "inventory_page_origin": "https://www.publisher.example/path"
+            }),
+            json!({
+                "account_id": "example-account",
+                "inventory_domain": "publisher.example/path",
+                "inventory_page_origin": "https://www.publisher.example"
+            }),
+            json!({
+                "account_id": "example-account",
+                "inventory_domain": "publisher.example",
+                "inventory_page_origin": "https://unrelated.example"
+            }),
+        ] {
+            let parsed: ApsConfig =
+                serde_json::from_value(value).expect("should deserialize before validation");
+            assert!(
+                parsed.validate().is_err(),
+                "should reject unsafe or incomplete inventory identity override"
+            );
+        }
+    }
 
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: default_endpoint(),
-            timeout_ms: 800,
-        };
+    #[test]
+    fn inventory_identity_override_rewrites_site_and_preserves_page_path() {
+        let config: ApsConfig = serde_json::from_value(json!({
+            "enabled": true,
+            "account_id": "example-account",
+            "inventory_domain": "publisher.example",
+            "inventory_page_origin": "https://www.publisher.example"
+        }))
+        .expect("should deserialize APS inventory identity override");
+        config
+            .validate()
+            .expect("should validate APS inventory identity override");
         let provider = ApsAuctionProvider::new(config);
+        let mut auction_request = request();
+        auction_request.publisher.domain = "deployment.example".to_string();
+        auction_request.publisher.page_url =
+            Some("https://deployment.example/news/story?edition=fictional#section".to_string());
+        let settings = create_test_settings();
+        let services = noop_services();
+        let downstream = http::Request::builder()
+            .uri("https://deployment.example/auction")
+            .header(
+                header::REFERER,
+                "https://deployment.example/private?token=fictional#section",
+            )
+            .body(EdgeBody::empty())
+            .expect("should build downstream request");
+        let context = AuctionContext {
+            settings: &settings,
+            request: &downstream,
+            timeout_ms: 321,
+            provider_responses: None,
+            services: &services,
+        };
+
+        let serialized =
+            serde_json::to_value(provider.build_openrtb_request(&auction_request, &context))
+                .expect("should serialize APS request");
 
-        let mut bidders = HashMap::new();
-        bidders.insert(
-            "aps".to_string(),
-            json!({ "slotID": "aps-slot-atf-sidebar" }),
+        assert_eq!(serialized["site"]["domain"], "publisher.example");
+        assert_eq!(
+            serialized["site"]["page"],
+            "https://www.publisher.example/news/story?edition=fictional"
         );
-        let request = AuctionRequest {
-            id: "test".to_string(),
-            slots: vec![AdSlot {
-                id: "atf_sidebar_ad".to_string(),
-                formats: vec![AdFormat {
-                    media_type: MediaType::Banner,
-                    width: 300,
-                    height: 250,
-                }],
-                floor_price: None,
-                targeting: HashMap::new(),
-                bidders,
+        assert_eq!(
+            serialized["site"]["publisher"]["domain"],
+            "publisher.example"
+        );
+        assert!(serialized["site"].get("ref").is_none());
+        assert!(
+            !serialized["site"]
+                .to_string()
+                .contains("deployment.example"),
+            "should not leak the deployment host in any Site field"
+        );
+    }
+
+    #[test]
+    fn builds_aps_openrtb_request_with_explicit_privacy_policy() {
+        let provider = ApsAuctionProvider::new(config());
+        let mut auction_request = request();
+        auction_request.user.consent = Some(ConsentContext {
+            gdpr_applies: true,
+            raw_tc_string: Some("fictional-tcf".to_string()),
+            raw_us_privacy: Some("1YNN".to_string()),
+            raw_gpp_string: Some("fictional-gpp".to_string()),
+            gpp_section_ids: Some(vec![2, 6]),
+            ..Default::default()
+        });
+        auction_request.user.eids = Some(vec![Eid {
+            source: "identity.example".to_string(),
+            uids: vec![Uid {
+                id: "fictional-uid".to_string(),
+                atype: Some(1),
+                ext: None,
             }],
-            publisher: PublisherInfo {
-                domain: "example.com".to_string(),
-                page_url: None,
+        }]);
+        auction_request.slots[0].formats.extend([
+            AdFormat {
+                media_type: MediaType::Video,
+                width: 640,
+                height: 480,
             },
-            user: UserInfo {
-                id: Some("user-1".to_string()),
-                consent: None,
-                eids: None,
+            AdFormat {
+                media_type: MediaType::Banner,
+                width: u32::MAX,
+                height: 90,
             },
-            device: None,
-            site: None,
-            context: HashMap::new(),
+            AdFormat {
+                media_type: MediaType::Banner,
+                width: 728,
+                height: 90,
+            },
+        ]);
+        auction_request.device = Some(DeviceInfo {
+            user_agent: Some("Fictional Browser".to_string()),
+            ip: Some("192.0.2.10".to_string()),
+            geo: Some(GeoInfo {
+                city: "Example City".to_string(),
+                country: "US".to_string(),
+                continent: "NA".to_string(),
+                latitude: 12.34,
+                longitude: 56.78,
+                metro_code: 501,
+                region: Some("CA".to_string()),
+                asn: None,
+            }),
+        });
+        let settings = create_test_settings();
+        let services = noop_services();
+        let downstream = http::Request::builder()
+            .uri("https://publisher.example/auction")
+            .header("DNT", "1")
+            .header(header::ACCEPT_LANGUAGE, "en-US,en;q=0.9")
+            .header(header::REFERER, "https://referrer.example/article")
+            .body(EdgeBody::empty())
+            .expect("should build downstream request");
+        let context = AuctionContext {
+            settings: &settings,
+            request: &downstream,
+            timeout_ms: 321,
+            provider_responses: None,
+            services: &services,
         };
 
-        let aps_request = provider.to_aps_request(&request, 800);
+        let openrtb = provider.build_openrtb_request(&auction_request, &context);
+        let serialized = serde_json::to_value(openrtb).expect("should serialize request");
+
+        assert_eq!(serialized["id"], "fictional-auction");
+        assert_eq!(serialized["tmax"], 321);
+        assert_eq!(serialized["cur"], json!(["USD"]));
+        assert_eq!(serialized["ext"]["account"], "example-account-id");
         assert_eq!(
-            aps_request.slots[0].slot_id, "aps-slot-atf-sidebar",
-            "should send configured APS slot ID to APS"
+            serialized["ext"]["sdk"],
+            json!({"source": "prebid", "version": "2.2.0"})
         );
-        let slot_id_map = ApsAuctionProvider::build_slot_id_map(&request);
+        assert_eq!(serialized["imp"][0]["id"], "fictional-slot");
+        assert_eq!(serialized["imp"][0]["banner"]["w"], 300);
+        assert_eq!(serialized["imp"][0]["banner"]["h"], 250);
+        assert_eq!(serialized["imp"][0]["banner"]["topframe"], 0);
         assert_eq!(
-            slot_id_map.get("aps-slot-atf-sidebar").map(String::as_str),
-            Some("atf_sidebar_ad"),
-            "should build reverse map from APS slot ID to creative slot ID"
+            serialized["imp"][0]["banner"]["format"]
+                .as_array()
+                .map(Vec::len),
+            Some(2)
         );
-
-        let aps_response = json!({
-            "contextual": {
-                "slots": [{
-                    "slotID": "aps-slot-atf-sidebar",
-                    "size": "300x250",
-                    "fif": "1",
-                    "amznbid": "1gtm3q",
-                    "meta": ["slotID"]
-                }]
-            }
-        });
-
-        let response = provider.parse_aps_response(&aps_response, 100, &slot_id_map);
-        assert_eq!(response.bids.len(), 1, "should parse one bid");
+        assert_eq!(serialized["imp"][0]["banner"]["format"][1]["w"], 728);
+        assert_eq!(serialized["imp"][0]["bidfloor"], 1.0);
+        assert_eq!(serialized["imp"][0]["bidfloorcur"], "USD");
+        assert_eq!(serialized["imp"][0]["secure"], 1);
+        assert_eq!(serialized["site"]["domain"], "publisher.example");
+        assert_eq!(
+            serialized["site"]["page"],
+            "https://publisher.example/article"
+        );
+        assert!(
+            serialized["site"].get("ref").is_none(),
+            "should not forward the raw browser Referer"
+        );
+        assert_eq!(
+            serialized["site"]["publisher"]["domain"],
+            "publisher.example"
+        );
+        assert_eq!(serialized["device"]["ua"], "Fictional Browser");
+        assert_eq!(serialized["device"]["ip"], "192.0.2.10");
+        assert_eq!(serialized["device"]["dnt"], 1);
+        assert_eq!(serialized["device"]["language"], "en");
+        assert_eq!(serialized["device"]["geo"]["country"], "US");
+        assert!(serialized["device"]["geo"].get("lat").is_none());
+        assert!(serialized["device"]["geo"].get("lon").is_none());
+        assert_eq!(serialized["user"]["id"], "fictional-user");
+        assert_eq!(serialized["user"]["consent"], "fictional-tcf");
+        assert_eq!(serialized["user"]["ext"]["consent"], "fictional-tcf");
         assert_eq!(
-            response.bids[0].slot_id, "atf_sidebar_ad",
-            "bid slot_id should be remapped to creative slot ID"
+            serialized["user"]["ext"]["eids"][0]["source"],
+            "identity.example"
         );
+        assert_eq!(serialized["regs"]["gdpr"], 1);
+        assert_eq!(serialized["regs"]["us_privacy"], "1YNN");
+        assert_eq!(serialized["regs"]["gpp"], "fictional-gpp");
+        assert_eq!(serialized["regs"]["gpp_sid"], json!([2, 6]));
+        assert!(serialized["regs"].get("coppa").is_none());
+        assert!(serialized["ext"].get("prebid").is_none());
+        assert!(serialized["ext"].get("trusted_server").is_none());
+        assert!(serialized["imp"][0].get("ext").is_none());
     }
 
     #[test]
-    fn test_aps_response_parsing_success() {
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
-            timeout_ms: 800,
-        };
+    fn request_language_enforces_byte_limit() {
+        let settings = create_test_settings();
+        let services = noop_services();
+
+        for (header_value, expected) in [
+            ("abcdefgh-US,xy;q=0.9", Some("abcdefgh")),
+            ("abcdefghi", None),
+        ] {
+            let downstream = http::Request::builder()
+                .uri("https://publisher.example/auction")
+                .header(header::ACCEPT_LANGUAGE, header_value)
+                .body(EdgeBody::empty())
+                .expect("should build downstream request");
+            let context = AuctionContext {
+                settings: &settings,
+                request: &downstream,
+                timeout_ms: 321,
+                provider_responses: None,
+                services: &services,
+            };
 
-        let provider = ApsAuctionProvider::new(config);
-
-        // Test APS response in real contextual format
-        let aps_response = json!({
-            "contextual": {
-                "slots": [
-                    {
-                        "slotID": "header-banner",
-                        "size": "728x90",
-                        "crid": "test-crid-123",
-                        "mediaType": "d",
-                        "fif": "1",
-                        "targeting": ["amzniid", "amznbid", "amznp", "amznsz", "amznactt"],
-                        "meta": ["slotID", "mediaType", "size"],
-                        "amzniid": "test-impression-id",
-                        "amznbid": "1kt0jk0",  // Proprietary Amazon encoding (not decodable)
-                        "amznp": "1kt0jk0",
-                        "amznsz": "728x90",
-                        "amznactt": "OPEN"
-                    },
-                    {
-                        "slotID": "sidebar",
-                        "size": "300x250",
-                        "crid": "test-crid-456",
-                        "mediaType": "d",
-                        "fif": "1",
-                        "targeting": ["amzniid", "amznbid", "amznp", "amznsz", "amznactt"],
-                        "meta": ["slotID", "mediaType", "size"],
-                        "amzniid": "test-impression-id-2",
-                        "amznbid": "ewpurk",  // Proprietary Amazon encoding (not decodable)
-                        "amznp": "ewpurk",
-                        "amznsz": "300x250",
-                        "amznactt": "OPEN"
-                    }
-                ],
-                "host": "https://aax-events.amazon-adsystem.com",
-                "status": "ok",
-                "cfe": true,
-                "ev": true,
-                "cb": "6"
-            }
-        });
-
-        let auction_response = provider.parse_aps_response(&aps_response, 150, &HashMap::new());
-
-        // Verify response
-        assert_eq!(auction_response.provider, "aps");
-        assert_eq!(auction_response.status, BidStatus::Success);
-        assert_eq!(auction_response.bids.len(), 2);
-        assert_eq!(auction_response.response_time_ms, 150);
-
-        // Verify first bid - price is None (encoded, to be decoded by mediation)
-        let bid1 = &auction_response.bids[0];
-        assert_eq!(bid1.slot_id, "header-banner");
-        assert_eq!(bid1.price, None); // Price is NOT decoded - it's in metadata for mediation
-        assert_eq!(bid1.width, 728);
-        assert_eq!(bid1.height, 90);
-        assert_eq!(bid1.currency, "USD");
-        assert_eq!(bid1.bidder, "amazon-aps");
-        assert_eq!(bid1.adomain, None);
-        assert!(bid1.metadata.contains_key("amzniid"));
-        assert!(bid1.metadata.contains_key("amznbid")); // Encoded price stored here
-
-        // Verify second bid
-        let bid2 = &auction_response.bids[1];
-        assert_eq!(bid2.slot_id, "sidebar");
-        assert_eq!(bid2.price, None); // Price is NOT decoded
-        assert_eq!(bid2.width, 300);
-        assert_eq!(bid2.height, 250);
-        assert!(bid2.metadata.contains_key("amznbid")); // Encoded price in metadata
+            assert_eq!(
+                ApsAuctionProvider::request_language(&context).as_deref(),
+                expected,
+                "should enforce primary language byte limit for {header_value}"
+            );
+        }
     }
 
     #[test]
-    fn test_aps_response_parsing_no_bid() {
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
-            timeout_ms: 800,
-        };
-
-        let provider = ApsAuctionProvider::new(config);
-
-        // Empty contextual response
-        let aps_response = json!({
-            "contextual": {
-                "slots": [],
-                "status": "ok"
-            }
-        });
+    fn parses_bid_and_builds_exact_minimized_envelope() {
+        let provider = ApsAuctionProvider::new(config());
+        let response = provider.parse_aps_response(
+            &json!({"cur": "USD", "seatbid": [{"seat": 42, "bid": [bid("fictional-selected-bid-id", 1.23, "iframe")]}], "ext": {"userSyncs": []}}),
+            12,
+            &request(),
+        );
+        assert_eq!(response.bids.len(), 1);
+        let parsed = &response.bids[0];
+        assert_eq!(parsed.bidder, "aps");
+        assert_eq!(parsed.price, Some(1.23));
+        assert!(parsed.creative.is_none());
+        assert!(parsed.nurl.is_none());
+        let renderer = parsed
+            .renderer
+            .as_ref()
+            .expect("should include renderer")
+            .as_aps()
+            .expect("should be APS renderer");
+        let decoded = BASE64_STANDARD
+            .decode(&renderer.aax_response)
+            .expect("should decode renderer response");
+        let decoded: Json =
+            serde_json::from_slice(&decoded).expect("should parse renderer response");
+        let fixture: Json = serde_json::from_str(include_str!(
+            "../../../trusted-server-js/lib/test/fixtures/aps-renderer-v1.json"
+        ))
+        .expect("should parse shared APS renderer fixture");
+        assert_eq!(decoded, fixture);
+    }
 
-        let auction_response = provider.parse_aps_response(&aps_response, 100, &HashMap::new());
+    #[test]
+    fn creative_id_enforces_utf8_byte_boundary() {
+        let provider = ApsAuctionProvider::new(config());
+        let mut at_limit = bid("creative-id-limit", 1.23, "iframe");
+        at_limit["crid"] = json!("é".repeat(MAX_CREATIVE_ID_BYTES / 2));
+        let accepted =
+            provider.parse_aps_response(&json!({"seatbid": [{"bid": [at_limit]}]}), 12, &request());
+        assert_eq!(
+            accepted.bids.len(),
+            1,
+            "should accept creative ID at byte limit"
+        );
 
-        assert_eq!(auction_response.provider, "aps");
-        assert_eq!(auction_response.status, BidStatus::NoBid);
-        assert_eq!(auction_response.bids.len(), 0);
+        let mut over_limit = bid("creative-id-over-limit", 1.23, "iframe");
+        over_limit["crid"] = json!(format!("{}x", "é".repeat(MAX_CREATIVE_ID_BYTES / 2)));
+        let rejected = provider.parse_aps_response(
+            &json!({"seatbid": [{"bid": [over_limit]}]}),
+            12,
+            &request(),
+        );
+        assert!(rejected.bids.is_empty());
+        assert_eq!(
+            rejected.metadata["drop_reasons"]["creative_id_too_large"],
+            1
+        );
     }
 
     #[test]
-    fn test_aps_response_parsing_invalid_bids() {
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
-            timeout_ms: 800,
-        };
+    fn empty_creative_id_is_omitted_from_renderer() {
+        let provider = ApsAuctionProvider::new(config());
+        let mut input = bid("bid-with-empty-crid", 1.23, "iframe");
+        input["crid"] = json!("");
+        let response =
+            provider.parse_aps_response(&json!({"seatbid": [{"bid": [input]}]}), 12, &request());
+        let bid = response.bids.first().expect("should accept renderer bid");
+        assert!(bid.creative_id.is_none());
+        assert!(
+            bid.renderer
+                .as_ref()
+                .expect("should retain renderer")
+                .as_aps()
+                .expect("should be APS renderer")
+                .creative_id
+                .is_none()
+        );
+    }
 
-        let provider = ApsAuctionProvider::new(config);
+    #[test]
+    fn rejects_wrong_typed_response_level_fields() {
+        let provider = ApsAuctionProvider::new(config());
+        for value in [
+            json!({"cur": ["USD"], "seatbid": []}),
+            json!({"cur": "USD", "seatbid": "invalid"}),
+            json!({"contextual": {"slots": []}}),
+        ] {
+            let response = provider.parse_aps_response(&value, 12, &request());
+            assert!(response.bids.is_empty());
+            assert_eq!(
+                response.metadata["drop_reasons"]["unexpected_response_shape"],
+                1
+            );
+        }
+    }
 
-        // Response with invalid slots (not filled, zero price)
-        let aps_response = json!({
-            "contextual": {
-                "slots": [
-                    {
-                        "slotID": "header-banner",
-                        "size": "728x90",
-                        "fif": "0",  // Not filled
-                        "targeting": [],
-                        "meta": []
-                    },
-                    {
-                        "slotID": "sidebar",
-                        "size": "300x250",
-                        "fif": "1",
-                        "targeting": [],
-                        "meta": []
-                        // Missing price encoding - will decode to 0.0
-                    }
-                ],
-                "status": "ok"
-            }
-        });
+    #[test]
+    fn debug_metadata_matches_pbs_httpcalls_shape() {
+        let mut provider_config = config();
+        provider_config.debug = true;
+        provider_config.endpoint = "https://aps.example/openrtb".to_string();
+        let provider = ApsAuctionProvider::new(provider_config);
+        let response_body = serde_json::to_vec(&json!({
+            "cur": "USD",
+            "seatbid": [{"bid": [bid("fictional-debug-bid", 1.23, "iframe")]}]
+        }))
+        .expect("should serialize APS response fixture");
+        let platform_response = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::OK)
+                .header(header::CONTENT_TYPE, "application/json")
+                .header("x-example-debug", "first")
+                .header("x-example-debug", "second")
+                .body(EdgeBody::from(response_body.clone()))
+                .expect("should build APS response"),
+        );
 
-        let auction_response = provider.parse_aps_response(&aps_response, 100, &HashMap::new());
+        let response = parse_with_context(&provider, platform_response);
 
-        // Should return no-bid since all slots are invalid
-        assert_eq!(auction_response.status, BidStatus::NoBid);
-        assert_eq!(auction_response.bids.len(), 0);
+        assert_eq!(response.metadata["accepted_bid_count"], 1);
+        let call = &response.metadata["debug"]["httpcalls"]["aps"][0];
+        let request_body: Json = serde_json::from_str(
+            call["requestbody"]
+                .as_str()
+                .expect("should include request body as a string"),
+        )
+        .expect("should parse captured request body");
+        assert_eq!(request_body["id"], "fictional-auction");
+        assert_eq!(request_body["tmax"], 321);
+        assert_eq!(
+            call["requestheaders"]["content-type"],
+            json!(["application/json"])
+        );
+        assert_eq!(
+            call["responsebody"],
+            String::from_utf8_lossy(&response_body).as_ref()
+        );
+        assert_eq!(
+            call["responseheaders"]["content-type"],
+            json!(["application/json"])
+        );
+        assert!(
+            call["responseheaders"].get("x-example-debug").is_none(),
+            "should omit unapproved debug response headers"
+        );
+        assert_eq!(call["status"], 200);
+        assert_eq!(call["uri"], "https://aps.example/openrtb");
     }
 
     #[test]
-    fn test_aps_slot_parsing() {
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
-            timeout_ms: 800,
+    fn debug_request_metadata_matches_the_dispatched_request() {
+        let stub = Arc::new(StubHttpClient::new());
+        stub.push_response(200, br#"{"seatbid":[]}"#.to_vec());
+        let services = build_services_with_http_client(
+            Arc::clone(&stub) as Arc<dyn crate::platform::PlatformHttpClient>
+        );
+        let settings = create_test_settings();
+        let downstream = http::Request::builder()
+            .uri("https://publisher.example/auction")
+            .body(EdgeBody::empty())
+            .expect("should build downstream request");
+        let context = AuctionContext {
+            settings: &settings,
+            request: &downstream,
+            timeout_ms: 321,
+            provider_responses: None,
+            services: &services,
         };
-
-        let provider = ApsAuctionProvider::new(config);
-
-        let aps_slot = ApsSlotResponse {
-            slot_id: "test-slot".to_string(),
-            size: "728x90".to_string(),
-            crid: Some("crid-123".to_string()),
-            media_type: Some("d".to_string()),
-            fif: Some("1".to_string()),
-            targeting: vec!["amzniid".to_string(), "amznbid".to_string()],
-            meta: vec!["slotID".to_string()],
-            amzniid: Some("impression-id-123".to_string()),
-            amznbid: Some("1c7d4ow".to_string()), // Encoded price (to be decoded by mediation)
-            amznp: Some("1c7d4ow".to_string()),
-            amznsz: Some("728x90".to_string()),
-            amznactt: Some("OPEN".to_string()),
+        let mut provider_config = config();
+        provider_config.debug = true;
+        let provider = ApsAuctionProvider::new(provider_config);
+        let auction_request = request();
+
+        let outcome =
+            futures::executor::block_on(provider.request_bids(&auction_request, &context))
+                .expect("should dispatch APS request");
+        let ProviderRequestOutcome::Pending {
+            request: pending,
+            parse_state,
+        } = outcome
+        else {
+            panic!("should return a pending APS request");
         };
-
-        let bid = provider
-            .parse_aps_slot(&aps_slot)
-            .expect("should parse slot");
-
-        assert_eq!(bid.slot_id, "test-slot");
-        assert_eq!(bid.price, None); // Price NOT decoded - stored in metadata for mediation
-        assert_eq!(bid.width, 728);
-        assert_eq!(bid.height, 90);
-        assert_eq!(bid.currency, "USD");
-        assert_eq!(bid.bidder, "amazon-aps");
-        assert_eq!(bid.adomain, None);
-        assert_eq!(bid.nurl, None); // Real APS uses client-side tracking
-        assert_eq!(bid.burl, None);
-        assert!(bid.metadata.contains_key("amzniid"));
-        assert!(bid.metadata.contains_key("amznbid")); // Encoded price here
-        assert!(bid.metadata.contains_key("amznsz"));
+        let platform_response = futures::executor::block_on(services.http_client().wait(pending))
+            .expect("should collect APS response");
+        let response = futures::executor::block_on(provider.parse_response_with_context_and_state(
+            platform_response,
+            12,
+            &auction_request,
+            &context,
+            parse_state.as_deref(),
+        ))
+        .expect("should parse APS response");
+
+        let sent_body = stub
+            .recorded_request_bodies()
+            .into_iter()
+            .next()
+            .expect("should capture outbound APS body");
+        let sent_headers = stub
+            .recorded_request_headers()
+            .into_iter()
+            .next()
+            .expect("should capture outbound APS headers");
+        let sent_content_type = sent_headers
+            .iter()
+            .find(|(name, _)| name.eq_ignore_ascii_case(header::CONTENT_TYPE.as_str()))
+            .map(|(_, value)| value.as_str());
+        let call = &response.metadata["debug"]["httpcalls"]["aps"][0];
+        assert_eq!(
+            call["requestbody"],
+            String::from_utf8_lossy(&sent_body).as_ref(),
+            "debug request body should byte-match the dispatched body"
+        );
+        assert_eq!(
+            call["requestheaders"]["content-type"][0].as_str(),
+            sent_content_type,
+            "debug request headers should match the dispatched headers"
+        );
     }
 
     #[test]
-    fn test_provider_metadata() {
-        let config = ApsConfig::default();
-        let provider = ApsAuctionProvider::new(config);
+    fn disabled_debug_omits_httpcall_metadata() {
+        let provider = ApsAuctionProvider::new(config());
+        let platform_response = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::OK)
+                .body(EdgeBody::from(
+                    serde_json::to_vec(&json!({"seatbid": []}))
+                        .expect("should serialize APS no-bid response"),
+                ))
+                .expect("should build APS response"),
+        );
 
-        assert_eq!(provider.provider_name(), "aps");
-        assert!(!provider.is_enabled()); // Default is disabled
-        assert_eq!(provider.timeout_ms(), 800);
-        assert!(provider.supports_media_type(&MediaType::Banner));
-        assert!(provider.supports_media_type(&MediaType::Video));
-        assert!(!provider.supports_media_type(&MediaType::Native));
+        let response = parse_with_context(&provider, platform_response);
+
+        assert!(!response.metadata.contains_key("debug"));
+        assert_eq!(response.metadata["drop_reasons"]["empty_seatbid"], 1);
     }
 
     #[test]
-    fn aps_payload_timeout_uses_effective_auction_budget_not_provider_config() {
-        // Provider config says 1000ms but the auction budget grants only 500ms —
-        // the payload must advertise the tighter effective deadline.
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: default_endpoint(),
-            timeout_ms: 1000,
-        };
-        let provider = ApsAuctionProvider::new(config);
-        let request = create_test_auction_request();
+    fn debug_metadata_preserves_malformed_and_error_responses() {
+        let mut provider_config = config();
+        provider_config.debug = true;
+        let provider = ApsAuctionProvider::new(provider_config);
+        let malformed = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::OK)
+                .body(EdgeBody::from(b"{not-json".to_vec()))
+                .expect("should build malformed APS response"),
+        );
+        let unavailable = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::SERVICE_UNAVAILABLE)
+                .header("retry-after", "5")
+                .body(EdgeBody::from(b"temporarily unavailable".to_vec()))
+                .expect("should build unavailable APS response"),
+        );
+        let preview_limited = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::BAD_GATEWAY)
+                .body(EdgeBody::from(vec![
+                    0xff;
+                    MAX_DEBUG_RESPONSE_PREVIEW_BYTES + 1
+                ]))
+                .expect("should build preview-limited APS response"),
+        );
+        let oversized = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::BAD_GATEWAY)
+                .body(EdgeBody::from(vec![
+                    b'x';
+                    UPSTREAM_RTB_MAX_RESPONSE_BYTES + 1
+                ]))
+                .expect("should build oversized APS response"),
+        );
 
-        let aps_request = provider.to_aps_request(&request, 500);
+        let malformed = parse_with_context(&provider, malformed);
+        let unavailable = parse_with_context(&provider, unavailable);
+        let preview_limited = parse_with_context(&provider, preview_limited);
+        let oversized = parse_with_context(&provider, oversized);
 
         assert_eq!(
-            aps_request.timeout,
-            Some(500),
-            "should advertise the effective auction budget, not the provider config timeout"
+            malformed.metadata["drop_reasons"]["unexpected_response_shape"],
+            1
+        );
+        assert_eq!(
+            malformed.metadata["debug"]["httpcalls"]["aps"][0]["responsebody"],
+            "{not-json"
+        );
+        let unavailable_call = &unavailable.metadata["debug"]["httpcalls"]["aps"][0];
+        assert_eq!(unavailable.status, BidStatus::Error);
+        assert_eq!(unavailable_call["status"], 503);
+        assert_eq!(unavailable_call["responsebody"], "temporarily unavailable");
+        assert!(
+            unavailable_call["responseheaders"]
+                .get("retry-after")
+                .is_none(),
+            "should omit unapproved response headers"
+        );
+        let preview = preview_limited.metadata["debug"]["httpcalls"]["aps"][0]["responsebody"]
+            .as_str()
+            .expect("should include bounded response preview");
+        assert!(
+            preview.ends_with("…(truncated 1 bytes)"),
+            "should mark the truncated byte count"
+        );
+        assert!(
+            preview.len() <= MAX_DEBUG_RESPONSE_PREVIEW_BYTES * 3 + 32,
+            "lossy UTF-8 expansion should remain bounded"
+        );
+        let oversized_call = oversized.metadata["debug"]["httpcalls"]["aps"][0]
+            .as_object()
+            .expect("should include oversized HTTP call metadata");
+        assert_eq!(oversized.status, BidStatus::Error);
+        assert_eq!(oversized_call["status"], 502);
+        assert!(
+            !oversized_call.contains_key("responsebody"),
+            "should omit response body when bounded capture fails"
         );
     }
 
     #[test]
-    fn test_aps_request_includes_consent_fields() {
-        use crate::consent::ConsentContext;
-
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: default_endpoint(),
-            timeout_ms: 800,
-        };
-        let provider = ApsAuctionProvider::new(config);
+    fn debug_metadata_includes_no_content_response() {
+        let mut provider_config = config();
+        provider_config.debug = true;
+        let provider = ApsAuctionProvider::new(provider_config);
+        let platform_response = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::NO_CONTENT)
+                .body(EdgeBody::empty())
+                .expect("should build empty APS response"),
+        );
 
-        let mut request = create_test_auction_request();
-        request.user.consent = Some(ConsentContext {
-            raw_tc_string: Some("BOEFEAyOEFEAyAHABDENAI4AAAB9vABAASA".to_string()),
-            gdpr_applies: true,
-            raw_us_privacy: Some("1YNN".to_string()),
-            raw_gpp_string: Some("DBACNYA~CPXxRfAPXxRfA".to_string()),
-            gpp_section_ids: Some(vec![2, 6]),
-            ..Default::default()
-        });
+        let response = parse_with_context(&provider, platform_response);
 
-        let aps_request = provider.to_aps_request(&request, 800);
+        assert_eq!(response.status, BidStatus::NoBid);
+        let call = &response.metadata["debug"]["httpcalls"]["aps"][0];
+        assert_eq!(call["status"], 204);
+        assert_eq!(call["responsebody"], "");
+    }
 
-        // Verify GDPR consent
-        let gdpr = aps_request.gdpr.expect("should have gdpr");
-        assert!(gdpr.enabled);
+    #[test]
+    fn malformed_json_is_a_safe_shape_error() {
+        let provider = ApsAuctionProvider::new(config());
+        let platform_response = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::OK)
+                .body(EdgeBody::from(b"{not-json".to_vec()))
+                .expect("should build malformed APS response"),
+        );
+        let auction_request = request();
+        let response = futures::executor::block_on(provider.parse_response_inner(
+            platform_response,
+            12,
+            Some(&auction_request),
+            None,
+            false,
+        ))
+        .expect("should convert malformed JSON into a safe auction response");
+
+        assert!(response.bids.is_empty());
         assert_eq!(
-            gdpr.consent.as_deref(),
-            Some("BOEFEAyOEFEAyAHABDENAI4AAAB9vABAASA")
+            response.metadata["drop_reasons"]["unexpected_response_shape"],
+            1
         );
-
-        // Verify US Privacy
-        assert_eq!(aps_request.us_privacy.as_deref(), Some("1YNN"));
-
-        // Verify GPP
-        assert_eq!(aps_request.gpp.as_deref(), Some("DBACNYA~CPXxRfAPXxRfA"));
-        assert_eq!(aps_request.gpp_sid.as_deref(), Some("2,6"));
     }
 
     #[test]
-    fn test_aps_request_no_consent() {
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: default_endpoint(),
-            timeout_ms: 800,
-        };
-        let provider = ApsAuctionProvider::new(config);
-        let request = create_test_auction_request(); // consent is None
+    fn context_free_parse_response_reports_missing_request_context() {
+        let mut provider_config = config();
+        provider_config.debug = true;
+        let provider = ApsAuctionProvider::new(provider_config);
+        let platform_response = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::OK)
+                .body(EdgeBody::from(
+                    serde_json::to_vec(
+                        &json!({"seatbid": [{"bid": [bid("valid", 1.0, "iframe")]}]}),
+                    )
+                    .expect("should serialize APS response"),
+                ))
+                .expect("should build APS response"),
+        );
 
-        let aps_request = provider.to_aps_request(&request, 800);
+        let response = futures::executor::block_on(provider.parse_response(platform_response, 12))
+            .expect("should return an explicit context error response");
 
-        assert!(aps_request.gdpr.is_none());
-        assert!(aps_request.us_privacy.is_none());
-        assert!(aps_request.gpp.is_none());
-        assert!(aps_request.gpp_sid.is_none());
+        assert_eq!(response.status, BidStatus::Error);
+        assert!(response.bids.is_empty());
+        assert_eq!(
+            response.metadata["drop_reasons"]["missing_request_context"],
+            1
+        );
+        let call = &response.metadata["debug"]["httpcalls"]["aps"][0];
+        assert_eq!(call["status"], 200);
+        assert!(call.get("responsebody").is_some());
+        assert!(
+            call.get("requestbody").is_none() && call.get("requestheaders").is_none(),
+            "context-free parsing should omit unavailable request metadata"
+        );
     }
 
     #[test]
-    fn test_aps_request_consent_serialization() {
-        use crate::consent::ConsentContext;
-
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: default_endpoint(),
-            timeout_ms: 800,
-        };
-        let provider = ApsAuctionProvider::new(config);
+    fn no_content_and_empty_responses_are_no_bids() {
+        let provider = ApsAuctionProvider::new(config());
+        let platform_response = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::NO_CONTENT)
+                .body(EdgeBody::empty())
+                .expect("should build empty APS response"),
+        );
+        let auction_request = request();
+        let no_content = futures::executor::block_on(provider.parse_response_inner(
+            platform_response,
+            12,
+            Some(&auction_request),
+            None,
+            false,
+        ))
+        .expect("should parse 204 as no bid");
+        assert_eq!(no_content.status, BidStatus::NoBid);
+
+        for value in [json!({}), json!({"seatbid": []})] {
+            let empty = provider.parse_aps_response(&value, 12, &auction_request);
+            assert_eq!(empty.status, BidStatus::NoBid);
+            assert_eq!(empty.metadata["drop_reasons"]["empty_seatbid"], 1);
+        }
+    }
 
-        let mut request = create_test_auction_request();
-        request.user.consent = Some(ConsentContext {
-            raw_tc_string: Some("BOE".to_string()),
-            gdpr_applies: true,
-            ..Default::default()
-        });
+    #[test]
+    fn missing_seatbid_bid_array_is_counted_as_a_drop() {
+        let provider = ApsAuctionProvider::new(config());
+        let response =
+            provider.parse_aps_response(&json!({"seatbid": [{"seat": "aps"}]}), 12, &request());
+
+        assert_eq!(response.status, BidStatus::NoBid);
+        assert_eq!(response.metadata["seatbid_count"], 1);
+        assert_eq!(response.metadata["dropped_bid_count"], 1);
+        assert_eq!(response.metadata["drop_reasons"]["empty_seatbid_bids"], 1);
+    }
 
-        let aps_request = provider.to_aps_request(&request, 800);
-        let json = serde_json::to_value(&aps_request).expect("should serialize");
+    #[test]
+    fn unsupported_currency_is_a_no_bid() {
+        let provider = ApsAuctionProvider::new(config());
+        let response = provider.parse_aps_response(
+            &json!({"cur": "EUR", "seatbid": [{"bid": [bid("eur-bid", 1.0, "iframe")]}]}),
+            12,
+            &request(),
+        );
+        assert_eq!(response.status, BidStatus::NoBid);
+        assert_eq!(response.metadata["drop_reasons"]["unsupported_currency"], 1);
+    }
 
-        // GDPR fields present
-        assert_eq!(json["gdpr"]["enabled"], true);
-        assert_eq!(json["gdpr"]["consent"], "BOE");
+    #[test]
+    fn malformed_sibling_does_not_suppress_valid_bid() {
+        let provider = ApsAuctionProvider::new(config());
+        let response = provider.parse_aps_response(
+            &json!({"seatbid": [{"bid": ["malformed", bid("valid", 1.0, "iframe")]}]}),
+            12,
+            &request(),
+        );
+        assert_eq!(response.bids.len(), 1);
+        assert_eq!(response.bids[0].bid_id.as_deref(), Some("valid"));
+        assert_eq!(
+            response.metadata["drop_reasons"]["missing_render_source"],
+            1
+        );
+    }
 
-        // Absent fields should not appear (skip_serializing_if)
-        assert!(json.get("usPrivacy").is_none());
-        assert!(json.get("gpp").is_none());
-        assert!(json.get("gppSid").is_none());
+    #[test]
+    fn enabled_script_bid_keeps_typed_renderer() {
+        let mut enabled = config();
+        enabled.allow_script_creatives = true;
+        let provider = ApsAuctionProvider::new(enabled);
+        let response = provider.parse_aps_response(
+            &json!({"seatbid": [{"bid": [bid("script", 1.0, "script")]}]}),
+            12,
+            &request(),
+        );
+        let renderer = response.bids[0]
+            .renderer
+            .as_ref()
+            .expect("should keep script renderer")
+            .as_aps()
+            .expect("should be APS renderer");
+        assert_eq!(renderer.tag_type, ApsTagType::Script);
     }
 
     #[test]
-    fn test_aps_bids_have_no_creative_and_no_decoded_price() {
-        // APS doesn't provide creative HTML - it only provides targeting keys
-        // APS doesn't decode prices - only mediation layer can decode them
-        // The creative will be generated by the mediation layer (e.g., GAM or ad server)
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
-            timeout_ms: 800,
-        };
+    fn disabled_script_cannot_suppress_lower_iframe_bid() {
+        let provider = ApsAuctionProvider::new(config());
+        let response = provider.parse_aps_response(
+            &json!({"seatbid": [{"bid": [bid("script-high", 4.0, "script"), bid("iframe-low", 1.0, "iframe")]}]}),
+            12,
+            &request(),
+        );
+        assert_eq!(response.bids.len(), 1);
+        assert_eq!(response.bids[0].bid_id.as_deref(), Some("iframe-low"));
+        assert_eq!(
+            response.metadata["drop_reasons"]["script_rendering_disabled"],
+            1
+        );
+    }
 
-        let provider = ApsAuctionProvider::new(config);
+    #[test]
+    fn reduces_candidates_by_price_then_bid_id_and_reconciles_drops() {
+        let provider = ApsAuctionProvider::new(config());
+        let response = provider.parse_aps_response(
+            &json!({"seatbid": [{"bid": [
+                bid("low-incumbent", 1.0, "iframe"),
+                bid("bid-z", 2.0, "iframe"),
+                bid("bid-a", 2.0, "iframe"),
+                bid("lower-candidate", 1.5, "iframe")
+            ]}]}),
+            12,
+            &request(),
+        );
+        assert_eq!(response.bids.len(), 1);
+        assert_eq!(response.bids[0].bid_id.as_deref(), Some("bid-a"));
+        assert_eq!(response.metadata["accepted_bid_count"], 1);
+        assert_eq!(response.metadata["dropped_bid_count"], 3);
+        assert_eq!(response.metadata["drop_reasons"]["lost_to_higher_bid"], 3);
+    }
 
-        let aps_slot = ApsSlotResponse {
-            slot_id: "test-slot".to_string(),
-            size: "300x250".to_string(),
-            crid: Some("test-creative".to_string()),
-            media_type: Some("d".to_string()),
-            fif: Some("1".to_string()),
-            targeting: vec!["amzniid".to_string(), "amznbid".to_string()],
-            meta: vec!["slotID".to_string()],
-            amzniid: Some("imp-123".to_string()),
-            amznbid: Some("encoded-price".to_string()),
-            amznp: Some("encoded-price-alt".to_string()),
-            amznsz: Some("300x250".to_string()),
-            amznactt: Some("OPEN".to_string()),
-        };
+    #[test]
+    fn safe_drops_missing_renderer_and_invalid_dimensions() {
+        let provider = ApsAuctionProvider::new(config());
+        let mut invalid = bid("invalid", 1.0, "iframe");
+        invalid
+            .as_object_mut()
+            .expect("should be object")
+            .remove("w");
+        let response = provider.parse_aps_response(
+            &json!({"seatbid": [{"bid": [
+                {"id": "fixture", "impid": "fictional-slot", "price": 1.0, "w": 300, "h": 250, "ext": {"bidder": "aps"}},
+                invalid
+            ]}]}),
+            12,
+            &request(),
+        );
+        assert!(response.bids.is_empty());
+        assert_eq!(
+            response.metadata["drop_reasons"]["missing_render_source"],
+            1
+        );
+        assert_eq!(response.metadata["drop_reasons"]["invalid_dimensions"], 1);
+    }
 
-        let bid = provider.parse_aps_slot(&aps_slot).expect("should parse");
+    #[test]
+    fn rejects_publisher_origin_and_non_https_creative_urls() {
+        let provider = ApsAuctionProvider::new(config());
+        for creative_url in [
+            "https://publisher.example/render",
+            "http://creative.example/render",
+            "https://user:password@creative.example/render",
+        ] {
+            let mut invalid = bid("invalid-url", 1.0, "iframe");
+            invalid["ext"]["creativeurl"] = json!(creative_url);
+            let response = provider.parse_aps_response(
+                &json!({"seatbid": [{"bid": [invalid]}]}),
+                12,
+                &request(),
+            );
+            assert!(response.bids.is_empty(), "should reject {creative_url}");
+            assert_eq!(response.metadata["drop_reasons"]["invalid_creative_url"], 1);
+        }
 
-        // Key assertions:
-        // 1. creative should be None for APS bids
-        assert_eq!(bid.creative, None, "APS bids should not have creative HTML");
-        // 2. price should be None (encoded price in metadata, decoded by mediation)
-        assert_eq!(bid.price, None, "APS bids should not have decoded price");
+        let mut uppercase_publisher = request();
+        uppercase_publisher.publisher.domain = "Creative.Example".to_string();
+        let response = provider.parse_aps_response(
+            &json!({"seatbid": [{"bid": [bid("same-origin", 1.0, "iframe")]}]}),
+            12,
+            &uppercase_publisher,
+        );
+        assert!(response.bids.is_empty());
+        assert_eq!(response.metadata["drop_reasons"]["invalid_creative_url"], 1);
+    }
 
-        // Verify targeting keys are in metadata (includes encoded price)
-        assert!(bid.metadata.contains_key("amzniid"));
-        assert!(bid.metadata.contains_key("amznbid")); // Encoded price
+    #[test]
+    fn registers_and_serves_only_static_renderer_route() {
+        let integration = ApsRendererIntegration;
+        let routes = integration.routes();
+        assert_eq!(routes.len(), 1, "should register one route");
+        assert_eq!(routes[0].method, Method::GET);
+        assert_eq!(routes[0].path, APS_RENDERER_ROUTE);
+
+        let settings = create_test_settings();
+        let services = noop_services();
+        let request = http::Request::builder()
+            .method(Method::GET)
+            .uri(APS_RENDERER_ROUTE)
+            .body(EdgeBody::empty())
+            .expect("should build renderer request");
+        let response =
+            futures::executor::block_on(integration.handle(&settings, &services, request))
+                .expect("should serve renderer");
+        assert_eq!(response.status(), StatusCode::OK);
         assert_eq!(
-            bid.metadata.get("amzniid").and_then(|v| v.as_str()),
-            Some("imp-123")
+            response.headers()[header::CONTENT_TYPE],
+            "text/html; charset=utf-8"
         );
+        assert_eq!(response.headers()["x-content-type-options"], "nosniff");
+        assert_eq!(response.headers()["referrer-policy"], "no-referrer");
         assert_eq!(
-            bid.metadata.get("amznbid").and_then(|v| v.as_str()),
-            Some("encoded-price")
+            response.headers()[header::CONTENT_SECURITY_POLICY],
+            APS_RENDERER_CSP
         );
-    }
 
-    fn single_slot_request(
-        auction_id: &str,
-        aps_slot_id: &str,
-        creative_id: &str,
-    ) -> AuctionRequest {
-        let mut bidders = HashMap::new();
-        bidders.insert("aps".to_string(), json!({ "slotID": aps_slot_id }));
-        AuctionRequest {
-            id: auction_id.to_string(),
-            slots: vec![AdSlot {
-                id: creative_id.to_string(),
-                formats: vec![AdFormat {
-                    media_type: MediaType::Banner,
-                    width: 300,
-                    height: 250,
-                }],
-                floor_price: None,
-                targeting: HashMap::new(),
-                bidders,
-            }],
-            publisher: PublisherInfo {
-                domain: "example.com".to_string(),
-                page_url: None,
-            },
-            user: UserInfo {
-                id: None,
-                consent: None,
-                eids: None,
-            },
-            device: None,
-            site: None,
-            context: HashMap::new(),
-        }
+        let post = http::Request::builder()
+            .method(Method::POST)
+            .uri(APS_RENDERER_ROUTE)
+            .body(EdgeBody::empty())
+            .expect("should build method rejection request");
+        let response = futures::executor::block_on(integration.handle(&settings, &services, post))
+            .expect("should reject unsupported method");
+        assert_eq!(response.status(), StatusCode::NOT_FOUND);
     }
 
-    fn aps_platform_response(aps_slot_id: &str) -> PlatformResponse {
-        let body = json!({
-            "contextual": {
-                "slots": [{
-                    "slotID": aps_slot_id,
-                    "size": "300x250",
-                    "fif": "1",
-                    "amznbid": "1gtm3q",
-                    "meta": ["slotID"]
-                }]
-            }
-        });
-        let response = http::Response::builder()
-            .status(200)
-            .body(EdgeBody::from(
-                serde_json::to_vec(&body).expect("should serialize APS response body"),
-            ))
-            .expect("should build APS platform response");
-        PlatformResponse::new(response)
+    #[test]
+    fn enabled_config_registers_renderer_proxy() {
+        let mut settings = create_test_settings();
+        settings
+            .integrations
+            .insert_config(
+                APS_INTEGRATION_ID,
+                &json!({"enabled": true, "account_id": "example-account"}),
+            )
+            .expect("should insert APS config");
+
+        let registration = register(&settings)
+            .expect("should register APS")
+            .expect("should return enabled registration");
+
+        assert_eq!(registration.integration_id, APS_INTEGRATION_ID);
+        assert_eq!(registration.proxies.len(), 1);
+        assert!(registration.js_disabled);
     }
 
     #[test]
-    fn concurrent_auctions_parse_out_of_order_with_correct_slot_remapping() {
-        // Regression: the reverse slot map used to live on the shared provider
-        // instance, so a second auction's request_bids overwrote the first
-        // auction's map and out-of-order parses remapped bids to the wrong
-        // creative slot. The map is now derived from each parse's own request.
-        let provider = ApsAuctionProvider::new(ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: default_endpoint(),
-            timeout_ms: 800,
-        });
-
-        let request_a = single_slot_request("auction-a", "aps-slot-a", "creative_a");
-        let request_b = single_slot_request("auction-b", "aps-slot-b", "creative_b");
+    fn enabled_invalid_config_fails_provider_registration() {
+        let mut settings = create_test_settings();
+        settings
+            .integrations
+            .insert_config(
+                APS_INTEGRATION_ID,
+                &json!({
+                    "enabled": true,
+                    "account_id": "example-account",
+                    "endpoint": "http://insecure.example/openrtb"
+                }),
+            )
+            .expect("should insert invalid APS config for startup validation");
+
+        let _error = register_providers(&settings)
+            .err()
+            .expect("should reject invalid enabled APS configuration");
+    }
 
-        let settings = crate::test_support::tests::create_test_settings();
-        let http_request = http::Request::builder()
-            .uri("https://example.com/")
-            .body(EdgeBody::empty())
-            .expect("should build test request");
-        let context = crate::auction::test_support::create_test_auction_context(
-            &settings,
-            &http_request,
-            800,
+    #[test]
+    fn renderer_document_is_static_and_nonce_bound() {
+        assert!(APS_RENDERER_DOCUMENT.contains("^#tsaps="));
+        assert!(APS_RENDERER_DOCUMENT.contains("event.source!==parent"));
+        assert!(APS_RENDERER_DOCUMENT.contains("message.nonce!==expected"));
+        assert!(APS_RENDERER_DOCUMENT.contains("prebid/creative/render"));
+        assert!(APS_RENDERER_DOCUMENT.contains("window._aps instanceof Map"));
+        assert!(APS_RENDERER_DOCUMENT.contains("store:new Map([['listeners',new Map()]])"));
+        assert!(APS_RENDERER_DOCUMENT.contains("account.queue.push(new CustomEvent"));
+        assert!(
+            APS_RENDERER_DOCUMENT.contains("trusted-server/aps/renderer-ready")
+                && APS_RENDERER_DOCUMENT.contains("trusted-server/aps/renderer-failed")
         );
-
-        futures::executor::block_on(async {
-            // Parse auction B's response first, then auction A's — the reverse
-            // of dispatch order — each against its own request.
-            let response_b = provider
-                .parse_response_with_context(
-                    aps_platform_response("aps-slot-b"),
-                    100,
-                    &request_b,
-                    &context,
-                )
-                .await
-                .expect("should parse auction B response");
-            let response_a = provider
-                .parse_response_with_context(
-                    aps_platform_response("aps-slot-a"),
-                    100,
-                    &request_a,
-                    &context,
-                )
-                .await
-                .expect("should parse auction A response");
-
-            assert_eq!(
-                response_b.bids[0].slot_id, "creative_b",
-                "auction B bid should remap to auction B's creative slot"
-            );
-            assert_eq!(
-                response_a.bids[0].slot_id, "creative_a",
-                "auction A bid should remap to auction A's creative slot despite parsing last"
-            );
-        });
+        assert!(!APS_RENDERER_DOCUMENT.contains("window.apstag"));
+        assert!(
+            APS_RENDERER_DOCUMENT
+                .contains("https://client.aps.amazon-adsystem.com/prebid-creative.js")
+        );
+        assert!(!APS_RENDERER_DOCUMENT.contains("<script src="));
+        let queue_index = APS_RENDERER_DOCUMENT
+            .find("account.queue.push(new CustomEvent")
+            .expect("should queue render event");
+        let runner_index = APS_RENDERER_DOCUMENT
+            .find("document.head.appendChild(script)")
+            .expect("should dynamically load the APS runner");
+        assert!(queue_index < runner_index);
+        assert!(!APS_RENDERER_DOCUMENT.contains("allow-same-origin"));
+        assert!(APS_RENDERER_CSP.contains("default-src 'none'"));
+        assert!(APS_RENDERER_CSP.contains("sandbox allow-forms"));
+        assert!(!APS_RENDERER_CSP.contains("allow-same-origin"));
     }
 }
diff --git a/crates/trusted-server-core/src/integrations/mod.rs b/crates/trusted-server-core/src/integrations/mod.rs
index bf6d63216..7bfaf27df 100644
--- a/crates/trusted-server-core/src/integrations/mod.rs
+++ b/crates/trusted-server-core/src/integrations/mod.rs
@@ -288,6 +288,10 @@ pub(crate) struct IntegrationBuilder {
 
 pub(crate) fn builders() -> &'static [IntegrationBuilder] {
     &[
+        IntegrationBuilder {
+            id: "aps",
+            build: aps::register,
+        },
         IntegrationBuilder {
             id: "prebid",
             build: prebid::register,
diff --git a/crates/trusted-server-core/src/integrations/prebid.rs b/crates/trusted-server-core/src/integrations/prebid.rs
index 73da261f3..ddc894144 100644
--- a/crates/trusted-server-core/src/integrations/prebid.rs
+++ b/crates/trusted-server-core/src/integrations/prebid.rs
@@ -1,4 +1,4 @@
-use std::collections::{HashMap, HashSet};
+use std::collections::HashMap;
 use std::sync::Arc;
 use std::time::Duration;
 
@@ -19,7 +19,7 @@ use url::{Url, Url as ParsedUrl};
 use validator::{Validate, ValidationError};
 
 use crate::auction::orchestrator::ERROR_TYPE_HTTP_STATUS;
-use crate::auction::provider::AuctionProvider;
+use crate::auction::provider::{AuctionProvider, ProviderRequestOutcome};
 use crate::auction::types::{
     AuctionContext, AuctionRequest, AuctionResponse, Bid as AuctionBid, MediaType,
 };
@@ -38,9 +38,7 @@ use crate::openrtb::{
     OpenRtbRequest, PrebidExt, PrebidImpExt, Publisher, Regs, RegsExt, RequestExt, Site, ToExt,
     TrustedServerExt, User, UserExt, to_openrtb_i32,
 };
-use crate::platform::{
-    PlatformHttpRequest, PlatformPendingRequest, PlatformResponse, RuntimeServices,
-};
+use crate::platform::{PlatformHttpRequest, PlatformResponse, RuntimeServices};
 use crate::proxy::{ProxyRequestConfig, is_host_allowed, proxy_request};
 use crate::request_signing::{RequestSigner, SIGNING_VERSION, SigningParams};
 use crate::settings::{IntegrationConfig, Settings};
@@ -332,6 +330,21 @@ pub struct PrebidIntegrationConfig {
     pub suppress_nurl_bidders: Vec<String>,
 }
 
+fn remove_aps_bidders(config: &mut PrebidIntegrationConfig) {
+    for (field, bidders) in [
+        ("bidders", &mut config.bidders),
+        ("client_side_bidders", &mut config.client_side_bidders),
+    ] {
+        let original_len = bidders.len();
+        bidders.retain(|bidder| !bidder.eq_ignore_ascii_case("aps"));
+        if bidders.len() != original_len {
+            log::warn!(
+                "prebid: ignoring APS in integrations.prebid.{field}; configure APS under [integrations.aps]"
+            );
+        }
+    }
+}
+
 impl IntegrationConfig for PrebidIntegrationConfig {
     fn is_enabled(&self) -> bool {
         self.enabled
@@ -869,12 +882,13 @@ fn escape_html_attr(value: &str) -> String {
 fn build(
     settings: &Settings,
 ) -> Result<Option<Arc<PrebidIntegration>>, Report<TrustedServerError>> {
-    let Some(config) =
+    let Some(mut config) =
         settings.integration_config::<PrebidIntegrationConfig>(PREBID_INTEGRATION_ID)?
     else {
         return Ok(None);
     };
 
+    remove_aps_bidders(&mut config);
     validate_external_bundle_config(&config, &settings.proxy.allowed_domains)?;
 
     // Warn about bidders that appear in both lists — this is likely a config
@@ -1031,18 +1045,6 @@ impl IntegrationHeadInjector for PrebidIntegration {
     }
 }
 
-/// Returns `true` when `params` is not a usable PBS bidder-params object — an
-/// empty object `{}` or any non-object value such as `null`.
-///
-/// PBS rejects an imp whose `bidder.<name>` carries such a value, and it cannot
-/// tell a fabricated empty from an explicitly supplied one — they are identical
-/// bytes on the wire. The merge uses this to stop an unusable value from
-/// clobbering real params, and the final pass uses it to drop whatever remains.
-fn is_unusable_bidder_params(params: &Json) -> bool {
-    // `None` covers non-object values (e.g. `null`); an empty map covers `{}`.
-    params.as_object().is_none_or(serde_json::Map::is_empty)
-}
-
 fn expand_trusted_server_bidders(
     configured_bidders: &[String],
     params: &Json,
@@ -1385,14 +1387,25 @@ fn copy_request_headers(
     to: &mut http::Request<EdgeBody>,
     consent_forwarding: ConsentForwardingMode,
     client_ip: Option<std::net::IpAddr>,
+    sanitized_referer: Option<&str>,
 ) {
-    let headers_to_copy = [header::USER_AGENT, header::REFERER, header::ACCEPT_LANGUAGE];
+    let headers_to_copy = [header::USER_AGENT, header::ACCEPT_LANGUAGE];
 
     for header_name in &headers_to_copy {
         if let Some(value) = from.headers().get(header_name) {
             to.headers_mut().insert(header_name, value.clone());
         }
     }
+    if let Some(referer) = sanitized_referer {
+        match HeaderValue::from_str(referer) {
+            Ok(value) => {
+                to.headers_mut().insert(header::REFERER, value);
+            }
+            Err(error) => {
+                log::warn!("Prebid: sanitized Referer could not be encoded as a header: {error}");
+            }
+        }
+    }
 
     if let Some(ip) = client_ip
         && let Ok(value) = HeaderValue::from_str(&ip.to_string())
@@ -1452,6 +1465,17 @@ pub struct PrebidAuctionProvider {
     bid_param_override_engine: Arc<BidParamOverrideEngine>,
 }
 
+#[derive(Default)]
+struct PrebidImpressionDisposition {
+    aps_only: usize,
+    invalid: usize,
+}
+
+struct PrebidRequestBuild {
+    request: OpenRtbRequest,
+    disposition: PrebidImpressionDisposition,
+}
+
 impl PrebidAuctionProvider {
     #[cfg(test)]
     fn new(config: PrebidIntegrationConfig) -> Self {
@@ -1485,14 +1509,15 @@ impl PrebidAuctionProvider {
         }
     }
 
-    /// Convert auction request to `OpenRTB` format with all enrichments.
-    fn to_openrtb(
+    /// Build an enriched `OpenRTB` request and retain impression drop provenance.
+    fn build_openrtb(
         &self,
         request: &AuctionRequest,
         context: &AuctionContext<'_>,
         signer: Option<(&RequestSigner, String, &SigningParams)>,
         request_info: RequestInfo,
-    ) -> OpenRtbRequest {
+    ) -> PrebidRequestBuild {
+        let mut disposition = PrebidImpressionDisposition::default();
         let imps = request
             .slots
             .iter()
@@ -1518,6 +1543,7 @@ impl PrebidAuctionProvider {
                     .collect();
 
                 if formats.is_empty() {
+                    disposition.invalid += 1;
                     log::warn!(
                         "prebid: dropping imp '{}' — no valid banner formats after filtering",
                         slot.id
@@ -1533,28 +1559,31 @@ impl PrebidAuctionProvider {
                     .and_then(|p| p.get(ZONE_KEY))
                     .and_then(Json::as_str);
 
-                // Build the bidder map for PBS from two sources:
-                //   1. the `trustedServer` orchestrator entry, expanded into the
-                //      configured PBS bidders (`expand_trusted_server_bidders`);
-                //   2. direct entries naming a configured PBS bidder.
-                // The JS adapter sends "trustedServer" as the bidder (our
-                // orchestrator adapter name); provider-specific keys like "aps"
-                // run their own auction and are skipped here.
-                //
-                // The two sources are collected separately so the merge below is
-                // deterministic regardless of `slot.bidders` HashMap iteration
-                // order: direct entries win, but an unusable direct value (`{}` or
-                // a non-object) must not clobber real params from the expansion.
-                let mut expanded: HashMap<String, Json> = HashMap::new();
-                let mut direct: Vec<(String, Json)> = Vec::new();
+                // Build the bidder map for PBS.
+                // The JS adapter sends "trustedServer" as the bidder (our orchestrator
+                // adapter name). Replace it with the real PBS bidders from config.
+                // Only pass through keys that are known PBS bidders — skip provider-specific
+                // keys like "aps" which belong to their own separate auction provider.
+                let mut bidder: HashMap<String, Json> = HashMap::new();
+                let mut excluded_aps = false;
                 for (name, params) in &slot.bidders {
+                    if name.eq_ignore_ascii_case("aps") {
+                        // Trusted Server APS is a separate OpenRTB provider. Never
+                        // send native APS demand through PBS for the same cohort.
+                        excluded_aps = true;
+                        continue;
+                    }
                     if name == TRUSTED_SERVER_BIDDER {
-                        expanded.extend(expand_trusted_server_bidders(&self.config.bidders, params));
+                        bidder.extend(expand_trusted_server_bidders(&self.config.bidders, params));
+                        bidder.retain(|name, _| {
+                            let keep = !name.eq_ignore_ascii_case("aps");
+                            excluded_aps |= !keep;
+                            keep
+                        });
                     } else if self.config.bidders.iter().any(|b| b == name) {
-                        direct.push((name.clone(), params.clone()));
-                    } else if name != "aps" {
-                        // `aps` is intentionally handled by its own provider. Any
-                        // other unrecognized key is likely a misconfiguration (a
+                        bidder.insert(name.clone(), params.clone());
+                    } else {
+                        // Any other unrecognized key is likely a misconfiguration (a
                         // slot bidder absent from `config.bidders`) that silently
                         // yields an empty bidder map and a stored-request no-bid —
                         // log it so the drop is diagnosable.
@@ -1566,104 +1595,28 @@ impl PrebidAuctionProvider {
                     }
                 }
 
-                let mut bidder = expanded;
-                // Bidders whose params came from the slot itself rather than from
-                // `trustedServer` expansion. Only these can represent a publisher
-                // misconfiguration if they are dropped below; a dropped fabricated
-                // entry is the designed stored-request path.
-                let mut slot_supplied: HashSet<String> = HashSet::new();
-                for (name, params) in direct {
-                    // Direct entries win over the expansion — except when an
-                    // unusable direct value (`{}` or a non-object) would overwrite
-                    // real params the expansion already supplied. PBS cannot tell a
-                    // fabricated empty from an explicit one, so real params must not
-                    // be discarded in favour of either.
-                    let clobbers_real = is_unusable_bidder_params(&params)
-                        && bidder
-                            .get(&name)
-                            .is_some_and(|existing| !is_unusable_bidder_params(existing));
-                    if !clobbers_real {
-                        slot_supplied.insert(name.clone());
-                        bidder.insert(name, params);
-                    }
+                if excluded_aps && bidder.is_empty() {
+                    disposition.aps_only += 1;
+                    log::warn!(
+                        "prebid: dropping imp '{}' because it contains only APS demand; refusing PBS stored-request fallback",
+                        slot.id
+                    );
+                    return None;
                 }
 
-                // Apply canonical and compatibility-derived rules in normalized
-                // order. An override rule can populate a bidder that arrived with
-                // empty params, promoting a fabricated empty into a valid bidder.
+                // When no inline PBS bidder params exist (e.g. creative-opportunity slots
+                // whose PBS params live in stored requests), tell PBS to resolve bidder
+                // config from the stored request keyed by this slot ID.
+                let storedrequest = bidder.is_empty().then(|| ImpStoredRequest {
+                    id: slot.id.clone(),
+                });
+
+                // Apply canonical and compatibility-derived rules in normalized order.
                 for (name, params) in &mut bidder {
                     self.bid_param_override_engine
                         .apply(BidParamOverrideFacts { bidder: name, zone }, params);
                 }
 
-                // Drop any bidder whose params are still unusable after overrides —
-                // an empty `{}` or a non-object like `null`. Both are byte-identical
-                // to PBS regardless of whether they were fabricated or supplied
-                // explicitly, and shipping either gets the imp rejected; a single
-                // non-2xx then collapses into an auction-wide bid wipeout (see
-                // `parse_response`), so one misconfigured slot must never reach the
-                // wire.
-                //
-                // The two drop sources get different levels, one line per slot. A
-                // slot that supplied unusable params inline is a publisher mistake
-                // an operator can act on, so it warns — the PBS 400 body is
-                // otherwise discarded unless trace logging is enabled. Fabricated
-                // empties that no override rule filled are the designed
-                // creative-opportunity path (see `CreativeOpportunitySlot::to_ad_slot`),
-                // so they log at debug and do not bury the warn.
-                let mut dropped_slot_supplied: Vec<String> = Vec::new();
-                let mut dropped_fabricated: Vec<String> = Vec::new();
-                bidder.retain(|name, params| {
-                    if is_unusable_bidder_params(params) {
-                        if slot_supplied.contains(name) {
-                            dropped_slot_supplied.push(name.clone());
-                        } else {
-                            dropped_fabricated.push(name.clone());
-                        }
-                        return false;
-                    }
-                    true
-                });
-                if !dropped_slot_supplied.is_empty() {
-                    // Sorted so the line is stable across `HashMap` iteration order.
-                    dropped_slot_supplied.sort();
-                    log::warn!(
-                        "prebid: dropping slot '{}' bidders [{}] — slot supplied empty or non-object params; slot falls back to its stored request",
-                        slot.id,
-                        dropped_slot_supplied.join(", ")
-                    );
-                }
-                if !dropped_fabricated.is_empty() {
-                    dropped_fabricated.sort();
-                    log::debug!(
-                        "prebid: dropping slot '{}' bidders [{}] — expansion fabricated empty params and no override rule filled them; slot falls back to its stored request",
-                        slot.id,
-                        dropped_fabricated.join(", ")
-                    );
-                }
-
-                // When no eligible PBS bidder params remain, tell PBS to resolve
-                // bidder config from the stored request keyed by this slot ID. This
-                // covers creative-opportunity slots whose PBS params live in stored
-                // requests, and slots whose configured bidders all resolved to
-                // unusable params and were dropped above.
-                //
-                // Note the fallback set is wider than "slots with no inline params":
-                // a slot carrying real inline params for a bidder absent from
-                // `config.bidders` also lands here — that bidder is never expanded,
-                // the configured bidders fabricate empties, the drop clears them, and
-                // the real params are lost. That param loss is pre-existing (see the
-                // debug log in the build loop); it is called out here because it
-                // means an operator with `config.bidders` set but no stored request
-                // provisioned for such a slot gets a no-bid.
-                let storedrequest = if bidder.is_empty() {
-                    Some(ImpStoredRequest {
-                        id: slot.id.clone(),
-                    })
-                } else {
-                    None
-                };
-
                 Some(Imp {
                     id: Some(slot.id.clone()),
                     banner: Some(Banner {
@@ -1848,13 +1801,11 @@ impl PrebidAuctionProvider {
         }
         .to_ext();
 
-        // Extract Referer header for site.ref
-        let referer = context
-            .request
-            .headers()
-            .get(header::REFERER)
-            .and_then(|value| value.to_str().ok())
-            .map(std::string::ToString::to_string);
+        // The browser Referer identifies the current publisher page for the
+        // same-origin `/auction` request, not the page that referred the user to
+        // the publisher. `request.publisher.page_url` is already sanitized and
+        // is carried as `site.page`, so do not duplicate the raw header in
+        // `site.ref`.
 
         // Advertise the effective auction budget, not the raw provider config:
         // the orchestrator caps `context.timeout_ms` to the remaining auction
@@ -1863,13 +1814,13 @@ impl PrebidAuctionProvider {
         // edge timeouts.
         let tmax = to_openrtb_i32(context.timeout_ms, "tmax", "request");
 
-        OpenRtbRequest {
+        let request = OpenRtbRequest {
             id: Some(request.id.clone()),
             imp: imps,
             site: Some(Site {
                 domain: Some(request.publisher.domain.clone()),
                 page: page_url,
-                r#ref: referer,
+                r#ref: None,
                 publisher: Some(Publisher {
                     domain: Some(request.publisher.domain.clone()),
                     ..Default::default()
@@ -1884,9 +1835,27 @@ impl PrebidAuctionProvider {
             cur: vec![DEFAULT_CURRENCY.to_string()],
             ext,
             ..Default::default()
+        };
+
+        PrebidRequestBuild {
+            request,
+            disposition,
         }
     }
 
+    /// Convert an auction request to `OpenRTB` format with all enrichments.
+    #[cfg(test)]
+    fn to_openrtb(
+        &self,
+        request: &AuctionRequest,
+        context: &AuctionContext<'_>,
+        signer: Option<(&RequestSigner, String, &SigningParams)>,
+        request_info: RequestInfo,
+    ) -> OpenRtbRequest {
+        self.build_openrtb(request, context, signer, request_info)
+            .request
+    }
+
     /// Builds the `regs` object from a [`ConsentContext`].
     ///
     /// Populates consent fields at **both** `OpenRTB` 2.6 top-level locations
@@ -2223,10 +2192,15 @@ impl PrebidAuctionProvider {
         // not an ad ID, so it is not used as a fallback: surfacing it as `ad_id`
         // (which is exposed raw in the debug bid) would mislead any consumer that
         // treats `ad_id` as a creative identifier. Absent `adid`, `ad_id` is None.
+        let bid_id = bid_obj.get("id").and_then(|v| v.as_str()).map(String::from);
         let ad_id = bid_obj
             .get("adid")
             .and_then(|v| v.as_str())
             .map(String::from);
+        let creative_id = bid_obj
+            .get("crid")
+            .and_then(|v| v.as_str())
+            .map(String::from);
 
         let adomain = bid_obj
             .get("adomain")
@@ -2291,7 +2265,10 @@ impl PrebidAuctionProvider {
             height,
             nurl,
             burl,
+            bid_id,
             ad_id,
+            creative_id,
+            renderer: None,
             cache_id,
             cache_host,
             cache_path,
@@ -2310,7 +2287,8 @@ impl AuctionProvider for PrebidAuctionProvider {
         &self,
         request: &AuctionRequest,
         context: &AuctionContext<'_>,
-    ) -> Result<PlatformPendingRequest, Report<TrustedServerError>> {
+    ) -> Result<ProviderRequestOutcome, Report<TrustedServerError>> {
+        let request_start = web_time::Instant::now();
         log::info!("Prebid: requesting bids for {} slots", request.slots.len());
 
         // `ext.trusted_server.request_host` must be the publisher's own domain
@@ -2349,8 +2327,10 @@ impl AuctionProvider for PrebidAuctionProvider {
                 None
             };
 
-        // Convert to OpenRTB with all enrichments
-        let openrtb = self.to_openrtb(
+        let PrebidRequestBuild {
+            request: openrtb,
+            disposition,
+        } = self.build_openrtb(
             request,
             context,
             signer_with_signature
@@ -2359,10 +2339,21 @@ impl AuctionProvider for PrebidAuctionProvider {
             request_info,
         );
 
-        // An empty `imp` array violates the OpenRTB spec and wastes a network
-        // round-trip. This can happen when all slots are non-Banner or all
-        // banner dimensions overflow `i32::MAX`.
         if openrtb.imp.is_empty() {
+            let all_slots_are_aps_only = !request.slots.is_empty()
+                && disposition.invalid == 0
+                && disposition.aps_only == request.slots.len();
+            if all_slots_are_aps_only {
+                log::info!(
+                    "Prebid: returning no-bid because all {} valid impressions are APS-only",
+                    disposition.aps_only
+                );
+                return Ok(ProviderRequestOutcome::Immediate(AuctionResponse::no_bid(
+                    PREBID_INTEGRATION_ID,
+                    request_start.elapsed().as_millis() as u64,
+                )));
+            }
+
             log::info!("Prebid: skipping request — no valid impressions after filtering");
             return Err(Report::new(TrustedServerError::Prebid {
                 message: "No valid impressions after filtering".to_string(),
@@ -2396,6 +2387,7 @@ impl AuctionProvider for PrebidAuctionProvider {
             &mut pbs_req,
             self.config.consent_forwarding,
             context.services.client_info().client_ip,
+            request.publisher.page_url.as_deref(),
         );
 
         let pbs_body = serde_json::to_vec(&openrtb).change_context(TrustedServerError::Prebid {
@@ -2431,7 +2423,7 @@ impl AuctionProvider for PrebidAuctionProvider {
                 message: "Failed to send async request to Prebid Server".to_string(),
             })?;
 
-        Ok(pending)
+        Ok(ProviderRequestOutcome::pending(pending))
     }
 
     async fn parse_response(
@@ -2527,7 +2519,8 @@ mod tests {
     use crate::auction::orchestrator::OrchestrationResult;
     use crate::auction::test_support::create_test_auction_context as shared_test_auction_context;
     use crate::auction::types::{
-        AdFormat, AdSlot, AuctionContext, AuctionRequest, DeviceInfo, PublisherInfo, UserInfo,
+        AdFormat, AdSlot, AuctionContext, AuctionRequest, BidStatus, DeviceInfo, PublisherInfo,
+        UserInfo,
     };
 
     use crate::consent::{ConsentContext, ConsentSource};
@@ -2755,12 +2748,15 @@ mod tests {
             services: &services,
         };
 
-        let pending =
+        let outcome =
             futures::executor::block_on(provider.request_bids(&auction_request, &context))
                 .expect("should start request");
+        let ProviderRequestOutcome::Pending { request, .. } = outcome else {
+            panic!("should return a pending Prebid request");
+        };
 
         assert!(
-            pending.backend_name().is_some(),
+            request.backend_name().is_some(),
             "should preserve backend correlation"
         );
         assert_eq!(
@@ -4946,7 +4942,7 @@ external_bundle_sri = "sha384-AAAA"
     }
 
     #[test]
-    fn to_openrtb_sets_site_ref_from_referer_header() {
+    fn to_openrtb_omits_raw_referer_from_site_ref() {
         let provider = PrebidAuctionProvider::new(base_config());
         let auction_request = create_test_auction_request();
 
@@ -4966,10 +4962,14 @@ external_bundle_sri = "sha384-AAAA"
         );
         let site = openrtb.site.as_ref().expect("should have site");
 
+        assert!(
+            site.r#ref.is_none(),
+            "should not forward the raw browser Referer into site.ref"
+        );
         assert_eq!(
-            site.r#ref.as_deref(),
-            Some("https://google.com/search?q=test"),
-            "should set site.ref from Referer header"
+            site.page.as_deref(),
+            auction_request.publisher.page_url.as_deref(),
+            "should retain the sanitized publisher page URL"
         );
     }
 
@@ -5588,6 +5588,37 @@ external_bundle_sri = "sha384-AAAA"
         provider.to_openrtb(request, &context, None, request_info)
     }
 
+    fn call_request_bids(
+        config: PrebidIntegrationConfig,
+        request: &AuctionRequest,
+    ) -> (
+        Result<ProviderRequestOutcome, Report<TrustedServerError>>,
+        Arc<StubHttpClient>,
+    ) {
+        let provider = PrebidAuctionProvider::new(config);
+        let settings = make_settings();
+        let http_req = http::Request::builder()
+            .method(http::Method::POST)
+            .uri("https://example.com/auction")
+            .body(EdgeBody::empty())
+            .expect("should build request");
+        let stub = Arc::new(StubHttpClient::new());
+        let services = build_services_with_http_client(
+            Arc::clone(&stub) as Arc<dyn crate::platform::PlatformHttpClient>
+        );
+        let context = AuctionContext {
+            settings: &settings,
+            request: &http_req,
+            timeout_ms: 1000,
+            provider_responses: None,
+            services: &services,
+        };
+        (
+            futures::executor::block_on(provider.request_bids(request, &context)),
+            stub,
+        )
+    }
+
     fn bidder_params(ortb: &OpenRtbRequest) -> &serde_json::Map<String, Json> {
         let ext = ortb.imp[0].ext.as_ref().expect("should have imp ext");
         ext.get("prebid")
@@ -6658,26 +6689,69 @@ set = { placementId = "explicit_header" }
     // ========================================================================
 
     #[test]
-    fn to_openrtb_uses_stored_request_when_slot_has_no_pbs_bidder_params() {
-        // Slot only has "aps" provider — not a PBS bidder
-        let slot = make_slot(
-            "atf_sidebar_ad",
-            HashMap::from([("aps".to_string(), json!({"slotID": "aps-slot-atf-sidebar"}))]),
-        );
-        let request = make_auction_request(vec![slot]);
+    fn to_openrtb_drops_aps_only_slots_instead_of_using_stored_requests() {
+        for bidder in ["aps", "APS", "Aps"] {
+            let slot = make_slot(
+                "atf_sidebar_ad",
+                HashMap::from([(
+                    bidder.to_string(),
+                    json!({"slotID": "aps-slot-atf-sidebar"}),
+                )]),
+            );
+            let request = make_auction_request(vec![slot]);
 
-        let ortb = call_to_openrtb(base_config(), &request);
-        let ext = ortb.imp[0].ext.as_ref().expect("should have imp ext");
-        let prebid = ext.get("prebid").expect("should have prebid in ext");
+            let openrtb = call_to_openrtb(base_config(), &request);
+            assert!(
+                openrtb.imp.is_empty(),
+                "should drop APS-only slot for case variant {bidder}"
+            );
+        }
+    }
 
-        assert!(
-            prebid.get("bidder").is_none(),
-            "should not send inline bidder params when using stored request"
+    #[test]
+    fn request_bids_returns_no_bid_without_pbs_for_aps_only_slots() {
+        for bidder in ["aps", "APS", "Aps"] {
+            let slot = make_slot(
+                "atf_sidebar_ad",
+                HashMap::from([(
+                    bidder.to_string(),
+                    json!({"slotID": "aps-slot-atf-sidebar"}),
+                )]),
+            );
+            let request = make_auction_request(vec![slot]);
+            let (outcome, stub) = call_request_bids(base_config(), &request);
+            let ProviderRequestOutcome::Immediate(response) =
+                outcome.expect("APS-only request should be a normal outcome")
+            else {
+                panic!("APS-only request should complete immediately");
+            };
+
+            assert_eq!(response.status, BidStatus::NoBid);
+            assert!(response.bids.is_empty());
+            assert!(response.metadata.is_empty());
+            assert!(
+                stub.recorded_backend_names().is_empty(),
+                "APS-only variant {bidder} should not contact PBS"
+            );
+        }
+    }
+
+    #[test]
+    fn request_bids_keeps_mixed_aps_only_and_invalid_slots_as_an_error() {
+        let aps_slot = make_slot(
+            "aps-slot",
+            HashMap::from([("aps".to_string(), json!({"slotID": "aps-slot"}))]),
         );
-        assert_eq!(
-            prebid["storedrequest"]["id"], "atf_sidebar_ad",
-            "should use slot id as stored request id"
+        let mut invalid_slot = make_slot("invalid-slot", HashMap::new());
+        invalid_slot.formats[0].width = u32::MAX;
+        let request = make_auction_request(vec![aps_slot, invalid_slot]);
+        let (outcome, stub) = call_request_bids(base_config(), &request);
+
+        assert!(
+            outcome.is_err(),
+            "mixed invalid input should remain an error"
         );
+        assert!(stub.recorded_backend_names().is_empty());
     }
 
     #[test]
@@ -6722,308 +6796,88 @@ set = { placementId = "explicit_header" }
     }
 
     #[test]
-    fn to_openrtb_drops_fabricated_empty_bidder_params() {
-        // config.bidders lists three, but the slot supplies inline params only
-        // for kargo. Without a matching override, triplelift and criteo would
-        // expand to empty `{}` objects — invalid bidder entries PBS rejects.
-        // They must be dropped; the valid kargo bidder must still ship.
-        let config = parse_prebid_toml(
-            r#"
-[integrations.prebid]
-enabled = true
-server_url = "https://prebid.example"
-bidders = ["kargo", "triplelift", "criteo"]
-"#,
-        );
-
+    fn to_openrtb_drops_aps_only_trusted_server_expansion() {
+        let mut config = base_config();
+        config.bidders = vec!["APS".to_string()];
         let slot = make_ts_slot(
-            "ad-header-0",
-            &json!({ "kargo": { "placementId": "kn1" } }),
+            "atf_sidebar_ad",
+            &json!({"APS": {"slotID": "aps-slot-atf-sidebar"}}),
             None,
         );
         let request = make_auction_request(vec![slot]);
 
-        let ortb = call_to_openrtb(config, &request);
-        let params = bidder_params(&ortb);
-
-        assert_eq!(
-            params["kargo"]["placementId"], "kn1",
-            "should keep the valid inline bidder"
-        );
-        assert!(
-            !params.contains_key("triplelift"),
-            "should drop a fabricated empty bidder with no inline params or override"
-        );
+        let openrtb = call_to_openrtb(config, &request);
         assert!(
-            !params.contains_key("criteo"),
-            "should drop a fabricated empty bidder with no inline params or override"
-        );
-    }
-
-    #[test]
-    fn to_openrtb_prefers_direct_bidder_params_over_fabricated_empty() {
-        // A slot can carry BOTH a direct bidder entry (valid inline params) and a
-        // `trustedServer` entry whose `bidderParams` omits that bidder — the
-        // expansion fabricates an empty `{}` for the omitted bidder. Direct real
-        // params must win over that fabricated empty, and the trustedServer-supplied
-        // params for the other bidder must still ship.
-        //
-        // Looped because `slot.bidders` HashMap iteration order is randomized per
-        // map; the merge must be order-independent every time.
-        let config = parse_prebid_toml(
-            r#"
-[integrations.prebid]
-enabled = true
-server_url = "https://prebid.example"
-bidders = ["kargo", "triplelift"]
-"#,
-        );
-
-        for _ in 0..64 {
-            let slot = make_slot(
-                "ad-header-0",
-                HashMap::from([
-                    ("kargo".to_string(), json!({ "placementId": "direct-1" })),
-                    (
-                        TRUSTED_SERVER_BIDDER.to_string(),
-                        json!({ BIDDER_PARAMS_KEY: { "triplelift": { "inventoryCode": "tl-1" } } }),
-                    ),
-                ]),
-            );
-            let request = make_auction_request(vec![slot]);
-
-            let ortb = call_to_openrtb(config.clone(), &request);
-            let params = bidder_params(&ortb);
-
-            assert_eq!(
-                params["kargo"]["placementId"], "direct-1",
-                "direct bidder params must win over a fabricated empty from trustedServer expansion"
-            );
-            assert_eq!(
-                params["triplelift"]["inventoryCode"], "tl-1",
-                "trustedServer-supplied bidder params must still ship"
-            );
-        }
-    }
-
-    #[test]
-    fn to_openrtb_drops_an_explicitly_empty_bidder() {
-        // PBS cannot distinguish a publisher-supplied empty `{}` from a fabricated
-        // one — they are identical bytes on the wire and PBS rejects both. So an
-        // explicit empty is dropped just like a fabricated one, rather than shipped
-        // as `"bidder": {"kargo": {}}` (which would fail the whole auction). With no
-        // eligible bidder left, the slot falls back to its stored request.
-        let config = parse_prebid_toml(
-            r#"
-[integrations.prebid]
-enabled = true
-server_url = "https://prebid.example"
-bidders = ["kargo"]
-"#,
-        );
-
-        let slot = make_ts_slot("ad-header-0", &json!({ "kargo": {} }), None);
-        let request = make_auction_request(vec![slot]);
-
-        let ortb = call_to_openrtb(config, &request);
-        let ext = ortb.imp[0].ext.as_ref().expect("should have imp ext");
-        let prebid = ext.get("prebid").expect("should have prebid in ext");
-
-        assert!(
-            prebid.get("bidder").is_none(),
-            "should drop an explicitly supplied empty bidder object, not ship it"
-        );
-        assert_eq!(
-            prebid["storedrequest"]["id"], "ad-header-0",
-            "should fall back to the stored request once the empty bidder is dropped"
-        );
-    }
-
-    #[test]
-    fn to_openrtb_direct_empty_does_not_clobber_trusted_server_params() {
-        // A slot can carry BOTH a direct empty entry and a `trustedServer` entry
-        // whose `bidderParams` supplies real params for the same bidder. The direct
-        // empty must NOT overwrite the real params — otherwise the slot ships
-        // `"bidder": {"kargo": {}}`, the exact invalid payload this path removes.
-        // Looped because `slot.bidders` HashMap iteration order is randomized.
-        let config = parse_prebid_toml(
-            r#"
-[integrations.prebid]
-enabled = true
-server_url = "https://prebid.example"
-bidders = ["kargo"]
-"#,
+            openrtb.imp.is_empty(),
+            "should not fall back to a stored request after excluding APS expansion"
         );
-
-        for _ in 0..64 {
-            let slot = make_slot(
-                "ad-header-0",
-                HashMap::from([
-                    ("kargo".to_string(), json!({})),
-                    (
-                        TRUSTED_SERVER_BIDDER.to_string(),
-                        json!({ BIDDER_PARAMS_KEY: { "kargo": { "placementId": "ts-1" } } }),
-                    ),
-                ]),
-            );
-            let request = make_auction_request(vec![slot]);
-
-            let ortb = call_to_openrtb(config.clone(), &request);
-            let params = bidder_params(&ortb);
-
-            assert_eq!(
-                params["kargo"]["placementId"], "ts-1",
-                "a direct empty must not clobber real trustedServer-supplied params"
-            );
-        }
     }
 
     #[test]
-    fn to_openrtb_drops_non_object_bidder_params() {
-        // Non-object params (e.g. `null`, reachable via a POST that omits `params`
-        // because `BidConfig.params` is `#[serde(default)]`) are as invalid to PBS
-        // as `{}` and must be dropped, not shipped as `"bidder": {"kargo": null}`.
-        let config = parse_prebid_toml(
-            r#"
-[integrations.prebid]
-enabled = true
-server_url = "https://prebid.example"
-bidders = ["kargo"]
-"#,
-        );
-
-        let slot = make_slot(
-            "ad-header-0",
-            HashMap::from([("kargo".to_string(), Json::Null)]),
+    fn request_bids_returns_no_bid_for_aps_only_trusted_server_expansion() {
+        let mut config = base_config();
+        config.bidders = vec!["APS".to_string()];
+        let slot = make_ts_slot(
+            "atf_sidebar_ad",
+            &json!({"APS": {"slotID": "aps-slot-atf-sidebar"}}),
+            None,
         );
         let request = make_auction_request(vec![slot]);
+        let (outcome, stub) = call_request_bids(config, &request);
+        let ProviderRequestOutcome::Immediate(response) =
+            outcome.expect("APS-only expansion should be a normal outcome")
+        else {
+            panic!("APS-only expansion should complete immediately");
+        };
 
-        let ortb = call_to_openrtb(config, &request);
-        let ext = ortb.imp[0].ext.as_ref().expect("should have imp ext");
-        let prebid = ext.get("prebid").expect("should have prebid in ext");
-
-        assert!(
-            prebid.get("bidder").is_none(),
-            "should drop a null (non-object) bidder params value"
-        );
-        assert_eq!(
-            prebid["storedrequest"]["id"], "ad-header-0",
-            "should fall back to the stored request once the null bidder is dropped"
-        );
+        assert_eq!(response.status, BidStatus::NoBid);
+        assert!(stub.recorded_backend_names().is_empty());
     }
 
     #[test]
-    fn to_openrtb_falls_back_to_stored_request_for_real_params_of_unconfigured_bidder() {
-        // Real inline params naming a bidder absent from `config.bidders` do NOT
-        // ship: the bidder is never expanded, the configured bidders fabricate
-        // empties, and the drop clears them — so the slot falls back to its stored
-        // request and the real params are lost. Pins the corrected comment that this
-        // fallback can fire even when a slot carries real inline params.
-        let config = parse_prebid_toml(
-            r#"
-[integrations.prebid]
-enabled = true
-server_url = "https://prebid.example"
-bidders = ["appnexus"]
-"#,
-        );
-
+    fn trusted_server_expansion_never_enables_aps_through_pbs() {
+        let mut config = base_config();
+        config.bidders = vec!["kargo".to_string(), "APS".to_string()];
         let slot = make_ts_slot(
-            "ad-header-0",
-            &json!({ "kargo": { "placementId": "kn1" } }),
+            "in_content_ad",
+            &json!({
+                "kargo": {"placementId": "client_123"},
+                "APS": {"slotID": "legacy-aps-slot"}
+            }),
             None,
         );
         let request = make_auction_request(vec![slot]);
 
         let ortb = call_to_openrtb(config, &request);
-        let ext = ortb.imp[0].ext.as_ref().expect("should have imp ext");
-        let prebid = ext.get("prebid").expect("should have prebid in ext");
-
+        let bidder = &ortb.imp[0].ext.as_ref().expect("should have imp ext")["prebid"]["bidder"];
+        assert_eq!(bidder["kargo"]["placementId"], "client_123");
         assert!(
-            prebid.get("bidder").is_none(),
-            "real params for an unconfigured bidder are not shipped"
-        );
-        assert_eq!(
-            prebid["storedrequest"]["id"], "ad-header-0",
-            "slot falls back to its stored request when the only inline params name an unconfigured bidder"
-        );
-    }
-
-    #[test]
-    fn to_openrtb_keeps_a_fabricated_bidder_that_an_override_populates() {
-        // criteo has no inline params (fabricated empty), but an override rule
-        // fills it — so it is valid and must ship, not be dropped.
-        let config = parse_prebid_toml(
-            r#"
-[integrations.prebid]
-enabled = true
-server_url = "https://prebid.example"
-bidders = ["criteo"]
-
-[integrations.prebid.bid_param_overrides.criteo]
-networkId = 99999
-"#,
-        );
-
-        let slot = make_ts_slot("ad-header-0", &json!({}), None);
-        let request = make_auction_request(vec![slot]);
-
-        let ortb = call_to_openrtb(config, &request);
-        let params = bidder_params(&ortb);
-
-        assert_eq!(
-            params["criteo"]["networkId"], 99999,
-            "override should populate the fabricated empty bidder, keeping it"
+            bidder
+                .as_object()
+                .expect("should serialize bidder map")
+                .keys()
+                .all(|name| !name.eq_ignore_ascii_case("aps")),
+            "Trusted Server APS cohorts must not also send APS through PBS"
         );
     }
 
     #[test]
-    fn to_openrtb_falls_back_to_stored_request_when_all_bidders_are_fabricated_empty() {
-        // config.bidders present, but the slot supplies no inline params and no
-        // override matches — every configured bidder resolves to a fabricated
-        // empty and is dropped, leaving PBS to resolve via the stored request.
-        let config = parse_prebid_toml(
-            r#"
+    fn config_accepts_aps_in_prebid_bidder_lists_for_upgrade_compatibility() {
+        for (field, bidder) in [
+            ("bidders", "aps"),
+            ("bidders", "APS"),
+            ("client_side_bidders", "Aps"),
+        ] {
+            let result = parse_prebid_toml_result(&format!(
+                r#"
 [integrations.prebid]
 enabled = true
 server_url = "https://prebid.example"
-bidders = ["kargo", "triplelift"]
-"#,
-        );
-
-        let slot = make_ts_slot("ad-header-0", &json!({}), None);
-        let request = make_auction_request(vec![slot]);
-
-        let ortb = call_to_openrtb(config, &request);
-        let ext = ortb.imp[0].ext.as_ref().expect("should have imp ext");
-        let prebid = ext.get("prebid").expect("should have prebid in ext");
-
-        assert!(
-            prebid.get("bidder").is_none(),
-            "should drop all fabricated empty bidders"
-        );
-        assert_eq!(
-            prebid["storedrequest"]["id"], "ad-header-0",
-            "should fall back to stored request when no eligible bidders remain"
-        );
-    }
-
-    #[test]
-    fn to_openrtb_skips_aps_key_from_slot_bidders_in_pbs_request() {
-        let slot = make_slot(
-            "atf_sidebar_ad",
-            HashMap::from([("aps".to_string(), json!({"slotID": "aps-slot-atf-sidebar"}))]),
-        );
-        let request = make_auction_request(vec![slot]);
-
-        let ortb = call_to_openrtb(base_config(), &request);
-        let ext = ortb.imp[0].ext.as_ref().expect("should have imp ext");
-        let prebid = ext.get("prebid").expect("should have prebid in ext");
-
-        assert!(
-            prebid.get("bidder").is_none(),
-            "should not forward aps key into PBS imp.ext.prebid.bidder"
-        );
+{field} = ["{bidder}"]
+"#
+            ));
+            assert!(result.is_ok(), "should accept legacy APS in {field}");
+        }
     }
 
     #[test]
@@ -7274,6 +7128,7 @@ set = { networkId = 42 }
             "id": "bid-impression-id",
             "impid": "atf_sidebar_ad",
             "adid": "bidder-ad-id-abc",
+            "crid": "bidder-creative-id-abc",
             "price": 1.0,
             "w": 300,
             "h": 250,
@@ -7292,11 +7147,21 @@ set = { networkId = 42 }
         let bid = provider
             .parse_bid(&bid_json, "appnexus")
             .expect("should parse bid");
+        assert_eq!(
+            bid.bid_id.as_deref(),
+            Some("bid-impression-id"),
+            "should preserve OpenRTB id separately"
+        );
         assert_eq!(
             bid.ad_id.as_deref(),
             Some("bidder-ad-id-abc"),
             "should keep ad_id from adid field"
         );
+        assert_eq!(
+            bid.creative_id.as_deref(),
+            Some("bidder-creative-id-abc"),
+            "should preserve OpenRTB crid separately"
+        );
         assert_eq!(
             bid.cache_id.as_deref(),
             Some("cache-uuid-xyz"),
@@ -7309,6 +7174,10 @@ set = { networkId = 42 }
         let from = http::Request::builder()
             .uri("https://publisher.example.com/")
             .header("x-forwarded-for", "6.6.6.6")
+            .header(
+                header::REFERER,
+                "https://publisher.example.com/article?email=private#fragment",
+            )
             .header(header::USER_AGENT, "test-agent")
             .body(EdgeBody::empty())
             .expect("should build inbound request");
@@ -7322,6 +7191,7 @@ set = { networkId = 42 }
             &mut to,
             ConsentForwardingMode::Both,
             Some(std::net::IpAddr::from([203, 0, 113, 7])),
+            Some("https://publisher.example.com/article"),
         );
 
         assert_eq!(
@@ -7338,6 +7208,13 @@ set = { networkId = 42 }
             Some("test-agent"),
             "should still copy the browser User-Agent"
         );
+        assert_eq!(
+            to.headers()
+                .get(header::REFERER)
+                .and_then(|value| value.to_str().ok()),
+            Some("https://publisher.example.com/article"),
+            "should replace the raw browser Referer with the sanitized page URL"
+        );
     }
 
     #[test]
@@ -7352,7 +7229,7 @@ set = { networkId = 42 }
             .body(EdgeBody::empty())
             .expect("should build outbound request");
 
-        copy_request_headers(&from, &mut to, ConsentForwardingMode::Both, None);
+        copy_request_headers(&from, &mut to, ConsentForwardingMode::Both, None, None);
 
         assert!(
             !to.headers().contains_key("x-forwarded-for"),
diff --git a/crates/trusted-server-core/src/openrtb.rs b/crates/trusted-server-core/src/openrtb.rs
index 65237ce0e..4aded7488 100644
--- a/crates/trusted-server-core/src/openrtb.rs
+++ b/crates/trusted-server-core/src/openrtb.rs
@@ -1,7 +1,7 @@
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
 
-use crate::auction::types::OrchestratorExt;
+use crate::auction::types::{BidRenderer, OrchestratorExt};
 
 pub type OpenRtbRequest = trusted_server_openrtb::BidRequest;
 pub type OpenRtbResponse = trusted_server_openrtb::BidResponse;
@@ -171,6 +171,18 @@ pub struct ImpStoredRequest {
     pub id: String,
 }
 
+#[derive(Debug, Serialize)]
+pub struct BidExt<'a> {
+    pub trusted_server: BidTrustedServerExt<'a>,
+}
+
+impl ToExt for BidExt<'_> {}
+
+#[derive(Debug, Serialize)]
+pub struct BidTrustedServerExt<'a> {
+    pub renderer: &'a BidRenderer,
+}
+
 #[derive(Debug, Serialize)]
 pub struct ResponseExt {
     pub orchestrator: OrchestratorExt,
@@ -210,6 +222,8 @@ mod tests {
                 total_bids: 3,
                 time_ms: 12,
                 provider_details: vec![],
+                dropped_winner_count: 0,
+                dropped_winner_reasons: Default::default(),
             },
         }
         .to_ext();
diff --git a/crates/trusted-server-core/src/platform/test_support.rs b/crates/trusted-server-core/src/platform/test_support.rs
index adec4d337..7922ef1a1 100644
--- a/crates/trusted-server-core/src/platform/test_support.rs
+++ b/crates/trusted-server-core/src/platform/test_support.rs
@@ -704,6 +704,10 @@ pub(crate) fn noop_services_with_client_ip(ip: IpAddr) -> RuntimeServices {
 /// [`PlatformBackend::canonicalize_transport_timeout_ms`] returns a controlled
 /// value, so the orchestrator's transport-timeout wiring can be asserted
 /// deterministically without depending on wall-clock timing.
+#[allow(
+    dead_code,
+    reason = "retained for target-specific transport-timeout tests"
+)]
 pub(crate) fn build_services_with_backend_and_http_client(
     backend: Arc<dyn PlatformBackend>,
     http_client: Arc<dyn PlatformHttpClient>,
diff --git a/crates/trusted-server-core/src/publisher.rs b/crates/trusted-server-core/src/publisher.rs
index d5ff6c271..4993c9997 100644
--- a/crates/trusted-server-core/src/publisher.rs
+++ b/crates/trusted-server-core/src/publisher.rs
@@ -37,6 +37,7 @@ use http::{HeaderValue, Method, Request, Response, StatusCode, Uri, header};
 use crate::auction::endpoints::{
     merge_auction_eids, resolve_auction_eids, resolve_client_auction_eids,
 };
+use crate::auction::formats::sanitize_publisher_page_url;
 use crate::auction::orchestrator::{
     AuctionOrchestrator, DispatchAuctionOutcome, DispatchedAuction,
 };
@@ -1773,7 +1774,7 @@ pub(crate) fn write_bids_to_state(
     settings: &Settings,
     request_origin: &str,
     include_debug_bid: bool,
-) {
+) -> std::collections::HashSet<String> {
     log::debug!(
         "write_bids_to_state: {} winning bid(s): [{}]",
         winning_bids.len(),
@@ -1786,8 +1787,10 @@ pub(crate) fn write_bids_to_state(
         request_origin,
         include_debug_bid,
     );
+    let delivered_winner_slots = bid_map.keys().cloned().collect();
     let bids_script = build_bids_script(&bid_map);
     *ad_bids_state.lock().expect("should lock bid state") = Some(bids_script);
+    delivered_winner_slots
 }
 
 /// Maximum serialized size (in bytes) of a dump embedded in the `ts-debug`
@@ -2380,6 +2383,14 @@ async fn collect_non_html_auction(
             &make_collect_context(settings, services, &placeholder),
         )
         .await;
+    let delivered_winner_slots = write_bids_to_state(
+        &result.winning_bids,
+        params.price_granularity,
+        &params.ad_bids_state,
+        settings,
+        &request_origin(&params.request_scheme, &params.request_host),
+        settings.debug.inject_adm_for_testing,
+    );
     if let (Some(observation), Some(auction_request)) =
         (telemetry.observation, telemetry.auction_request.as_ref())
     {
@@ -2389,19 +2400,12 @@ async fn collect_non_html_auction(
                 AuctionTerminalOutcome::Completed {
                     request: auction_request,
                     result: &result,
+                    delivered_winner_slots: Some(&delivered_winner_slots),
                 },
             )
         })
         .await;
     }
-    write_bids_to_state(
-        &result.winning_bids,
-        params.price_granularity,
-        &params.ad_bids_state,
-        settings,
-        &request_origin(&params.request_scheme, &params.request_host),
-        settings.debug.inject_adm_for_testing,
-    );
 }
 
 // Private orchestration helper called only from `body_close_hold_loop`.
@@ -2426,6 +2430,18 @@ async fn collect_stream_auction(
     let result = orchestrator
         .collect_dispatched_auction(dispatched, services, &collect_ctx)
         .await;
+    log::info!(
+        "body_close_hold_loop: collect complete - {} winning bid(s)",
+        result.winning_bids.len()
+    );
+    let delivered_winner_slots = write_bids_to_state(
+        &result.winning_bids,
+        *price_granularity,
+        ad_bids_state,
+        settings,
+        request_origin,
+        settings.debug.inject_adm_for_testing,
+    );
     if let (Some(observation), Some(auction_request)) =
         (telemetry.observation, telemetry.auction_request.as_ref())
     {
@@ -2435,23 +2451,12 @@ async fn collect_stream_auction(
                 AuctionTerminalOutcome::Completed {
                     request: auction_request,
                     result: &result,
+                    delivered_winner_slots: Some(&delivered_winner_slots),
                 },
             )
         })
         .await;
     }
-    log::info!(
-        "body_close_hold_loop: collect complete - {} winning bid(s)",
-        result.winning_bids.len()
-    );
-    write_bids_to_state(
-        &result.winning_bids,
-        *price_granularity,
-        ad_bids_state,
-        settings,
-        request_origin,
-        settings.debug.inject_adm_for_testing,
-    );
 
     if settings.debug.auction_html_comment {
         prepend_auction_debug_comment("stream", &result, ad_bids_state);
@@ -3094,10 +3099,11 @@ pub(crate) fn build_auction_request(
     // so SSPs, injected creatives, and brand-safety pixels see the publisher's
     // own origin. On the SSAT proxy path `request_info.host` is the trusted
     // server edge host, which must not leak into the bid request.
-    let page_url = format!(
+    let page_candidate = format!(
         "{}://{}{}",
         request_info.scheme, publisher_domain, slots_ctx.request_path
     );
+    let page_url = sanitize_publisher_page_url(Some(&page_candidate), publisher_domain);
     let ec_id = ec_id.filter(|id| !id.is_empty());
     let request_id = ec_id.map_or_else(
         || format!("ts-req-{}", uuid::Uuid::new_v4().simple()),
@@ -3180,7 +3186,7 @@ pub(crate) fn build_bid_map(
     winning_bids
         .iter()
         .filter_map(|(slot_id, bid)| {
-            bid.price.map(|cpm| {
+            bid.price.and_then(|cpm| {
                 let bucket = price_bucket(cpm, granularity);
                 let mut obj = serde_json::Map::new();
                 obj.insert("hb_pb".to_string(), serde_json::Value::String(bucket));
@@ -3199,10 +3205,14 @@ pub(crate) fn build_bid_map(
                 if bid.height > 0 {
                     obj.insert("h".to_string(), serde_json::Value::from(bid.height));
                 }
-                // hb_adid: use PBS Cache UUID when present — the Prebid Universal Creative uses
-                // this as the cache lookup key, NOT the OpenRTB bid ID (bid.ad_id). Fall back to
-                // bid.ad_id for APS and other non-PBS providers.
-                let hb_adid = bid.cache_id.as_deref().or(bid.ad_id.as_deref());
+                // PBS Cache remains highest priority. Typed renderer bids use
+                // their selected upstream bid ID as the Universal Creative key.
+                let renderer_bid_id = bid.renderer.as_ref().and(bid.bid_id.as_deref());
+                let hb_adid = bid
+                    .cache_id
+                    .as_deref()
+                    .or(renderer_bid_id)
+                    .or(bid.ad_id.as_deref());
                 if let Some(id) = hb_adid {
                     obj.insert(
                         "hb_adid".to_string(),
@@ -3256,6 +3266,19 @@ pub(crate) fn build_bid_map(
                 // returning an empty string for oversized or unparseable markup —
                 // in which case the entry is omitted and the bridge falls back to
                 // the PBS Cache coordinates.
+                if let Some(ref renderer) = bid.renderer {
+                    let renderer = match serde_json::to_value(renderer) {
+                        Ok(renderer) => renderer,
+                        Err(error) => {
+                            log::warn!(
+                                "Skipping winning bid for slot '{}' because its typed renderer could not be serialized: {error}",
+                                slot_id
+                            );
+                            return None;
+                        }
+                    };
+                    obj.insert("renderer".to_string(), renderer);
+                }
                 if let Some(ref raw_creative) = bid.creative {
                     // Resolve ${AUCTION_PRICE} from the exact winning CPM BEFORE
                     // sanitizing, rewriting, and signing — URL rewriting would
@@ -3292,7 +3315,9 @@ pub(crate) fn build_bid_map(
                             "height": bid.height,
                             "nurl": bid.nurl,
                             "burl": bid.burl,
+                            "bid_id": bid.bid_id,
                             "ad_id": bid.ad_id,
+                            "creative_id": bid.creative_id,
                             "cache_id": bid.cache_id,
                             "cache_host": bid.cache_host,
                             "cache_path": bid.cache_path,
@@ -3300,7 +3325,7 @@ pub(crate) fn build_bid_map(
                         }),
                     );
                 }
-                (slot_id.clone(), serde_json::Value::Object(obj))
+                Some((slot_id.clone(), serde_json::Value::Object(obj)))
             })
         })
         .collect()
@@ -3659,8 +3684,8 @@ pub async fn handle_page_bids(
     // skip the live auction, matching the existing bot/prefetch behaviour.
     let ad_stack_enabled = auction_enabled && consent_allows_auction;
 
-    let winning_bids = if matched_slots.is_empty() {
-        std::collections::HashMap::new()
+    let (winning_bids, prebuilt_bid_map) = if matched_slots.is_empty() {
+        (std::collections::HashMap::new(), None)
     } else {
         // Same publisher identity as the outbound bid request — see the
         // matching note on the initial-navigation observation above.
@@ -3716,17 +3741,26 @@ pub async fn handle_page_bids(
             {
                 Ok(result) => {
                     let winning_bids = result.winning_bids.clone();
+                    let bid_map = build_bid_map(
+                        &winning_bids,
+                        co_config.price_granularity,
+                        settings,
+                        &page_bids_request_origin,
+                        settings.debug.inject_adm_for_testing,
+                    );
+                    let delivered_winner_slots = bid_map.keys().cloned().collect();
                     emit_auction_events_best_effort_lazy(services, || {
                         build_auction_events(
                             observation,
                             AuctionTerminalOutcome::Completed {
                                 request: &auction_request,
                                 result: &result,
+                                delivered_winner_slots: Some(&delivered_winner_slots),
                             },
                         )
                     })
                     .await;
-                    winning_bids
+                    (winning_bids, Some(bid_map))
                 }
                 Err(e) => {
                     log::warn!("page-bids auction failed: {e:?}");
@@ -3743,7 +3777,7 @@ pub async fn handle_page_bids(
                         )
                     })
                     .await;
-                    std::collections::HashMap::new()
+                    (std::collections::HashMap::new(), None)
                 }
             }
         } else {
@@ -3769,17 +3803,19 @@ pub async fn handle_page_bids(
                 )
             })
             .await;
-            std::collections::HashMap::new()
+            (std::collections::HashMap::new(), None)
         }
     };
 
-    let bid_map = build_bid_map(
-        &winning_bids,
-        co_config.price_granularity,
-        settings,
-        &page_bids_request_origin,
-        settings.debug.inject_adm_for_testing,
-    );
+    let bid_map = prebuilt_bid_map.unwrap_or_else(|| {
+        build_bid_map(
+            &winning_bids,
+            co_config.price_granularity,
+            settings,
+            &page_bids_request_origin,
+            settings.debug.inject_adm_for_testing,
+        )
+    });
 
     // Gate slots on the ad-stack kill switch / consent: when disabled, return no
     // slots so the SPA hook does not call `adInit()` / create GPT slots.
@@ -3876,7 +3912,10 @@ mod tests {
             height: 250,
             nurl: None,
             burl: None,
+            bid_id: None,
             ad_id: None,
+            creative_id: None,
+            renderer: None,
             cache_id: None,
             cache_host: None,
             cache_path: None,
@@ -7175,7 +7214,7 @@ mod tests {
             MatchedSlotsContext, build_ad_slots_script, build_auction_request, build_bid_map,
             build_bids_script, html_escape_for_script,
         };
-        use crate::auction::types::{Bid, MediaType};
+        use crate::auction::types::{ApsRendererV1, ApsTagType, Bid, BidRenderer, MediaType};
         use crate::consent::ConsentContext;
         use crate::creative_opportunities::{
             CreativeOpportunitiesConfig, CreativeOpportunityFormat, CreativeOpportunitySlot,
@@ -7240,7 +7279,10 @@ mod tests {
                 height: 250,
                 nurl: Some(nurl.to_string()),
                 burl: Some(burl.to_string()),
+                bid_id: None,
                 ad_id: Some(ad_id.to_string()),
+                creative_id: None,
+                renderer: None,
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
@@ -7836,7 +7878,10 @@ mod tests {
                     height: 250,
                     nurl: None,
                     burl: None,
+                    bid_id: None,
                     ad_id: Some("bid-impression-id".to_string()),
+                    creative_id: None,
+                    renderer: None,
                     cache_id: Some("f47447a0-b759-4f2f-9887-af458b79b570".to_string()),
                     cache_host: Some("openads.adsrvr.org".to_string()),
                     cache_path: Some("/cache".to_string()),
@@ -7888,7 +7933,10 @@ mod tests {
                     height: 250,
                     nurl: None,
                     burl: None,
+                    bid_id: None,
                     ad_id: Some("aps-bid-token".to_string()),
+                    creative_id: None,
+                    renderer: None,
                     cache_id: None,
                     cache_host: None,
                     cache_path: None,
@@ -7922,6 +7970,47 @@ mod tests {
             );
         }
 
+        #[test]
+        fn bid_map_exposes_aps_renderer_and_selected_bid_id() {
+            let mut bid = make_bid("atf_sidebar_ad", 1.50, "aps", "fallback-ad", "", "");
+            bid.bid_id = Some("selected-bid".to_string());
+            bid.nurl = None;
+            bid.burl = None;
+            bid.renderer = Some(BidRenderer::Aps(ApsRendererV1 {
+                version: 1,
+                account_id: "example-account".to_string(),
+                bid_id: "selected-bid".to_string(),
+                creative_id: None,
+                tag_type: ApsTagType::Iframe,
+                creative_url: "https://creative.example/render".to_string(),
+                aax_response: "fictional-base64</script>".to_string(),
+                width: 300,
+                height: 250,
+            }));
+            let winning_bids = HashMap::from([("atf_sidebar_ad".to_string(), bid)]);
+
+            let map = build_bid_map(
+                &winning_bids,
+                PriceGranularity::Dense,
+                &test_settings(),
+                "",
+                false,
+            );
+            let obj = map["atf_sidebar_ad"]
+                .as_object()
+                .expect("should include APS bid");
+
+            assert_eq!(obj["hb_bidder"], "aps");
+            assert_eq!(obj["hb_adid"], "selected-bid");
+            assert_eq!(obj["renderer"]["type"], "aps");
+            assert_eq!(obj["renderer"]["bidId"], "selected-bid");
+            assert!(obj.get("adm").is_none());
+
+            let script = build_bids_script(&map);
+            assert!(!script.contains("</script></script>"));
+            assert!(script.contains("\\u003C/script\\u003E"));
+        }
+
         #[test]
         fn bid_map_omits_hb_adid_when_both_cache_id_and_ad_id_absent() {
             let mut winning_bids = HashMap::new();
@@ -7938,7 +8027,10 @@ mod tests {
                     height: 250,
                     nurl: None,
                     burl: None,
+                    bid_id: None,
                     ad_id: None,
+                    creative_id: None,
+                    renderer: None,
                     cache_id: None,
                     cache_host: None,
                     cache_path: None,
@@ -7979,7 +8071,10 @@ mod tests {
                     height: 250,
                     nurl: None,
                     burl: None,
+                    bid_id: None,
                     ad_id: None,
+                    creative_id: None,
+                    renderer: None,
                     cache_id: None,
                     cache_host: None,
                     cache_path: None,
@@ -8099,12 +8194,12 @@ mod tests {
             );
             assert_eq!(
                 request.publisher.page_url.as_deref(),
-                Some("https://www.example.com/2024/01/my-article/?edition=fictional"),
-                "page_url host should be the configured publisher domain, not the edge host"
+                Some("https://www.example.com/2024/01/my-article/"),
+                "page_url should use configured publisher identity without client query data"
             );
             assert_eq!(
-                site.page, "https://www.example.com/2024/01/my-article/?edition=fictional",
-                "site.page host should be the configured publisher domain, not the edge host"
+                site.page, "https://www.example.com/2024/01/my-article/",
+                "site.page should use configured publisher identity without client query data"
             );
         }
 
@@ -8805,7 +8900,7 @@ mod tests {
     /// the handler emitted.
     mod navigation_publisher_domain_tests {
         use super::*;
-        use crate::auction::provider::AuctionProvider;
+        use crate::auction::provider::{AuctionProvider, ProviderRequestOutcome};
         use crate::auction::telemetry::{AuctionEventBatch, AuctionTelemetrySink};
         use crate::auction::types::AuctionRequest;
         use crate::auction::{AuctionContext, AuctionOrchestrator};
@@ -8813,7 +8908,7 @@ mod tests {
         use crate::platform::test_support::{
             NoopConfigStore, NoopGeo, NoopSecretStore, StubBackend,
         };
-        use crate::platform::{ClientInfo, PlatformPendingRequest, PlatformResponse};
+        use crate::platform::{ClientInfo, PlatformResponse};
         use crate::test_support::tests::crate_test_settings_str;
         use std::sync::Mutex;
 
@@ -8842,7 +8937,7 @@ mod tests {
                 &self,
                 request: &AuctionRequest,
                 _context: &AuctionContext<'_>,
-            ) -> Result<PlatformPendingRequest, Report<TrustedServerError>> {
+            ) -> Result<ProviderRequestOutcome, Report<TrustedServerError>> {
                 *self.captured.lock().expect("should lock captured request") =
                     Some(request.clone());
                 Err(Report::new(TrustedServerError::Auction {
diff --git a/crates/trusted-server-integration-tests/README.md b/crates/trusted-server-integration-tests/README.md
index e7263755d..1aa43cee4 100644
--- a/crates/trusted-server-integration-tests/README.md
+++ b/crates/trusted-server-integration-tests/README.md
@@ -142,6 +142,7 @@ Playwright directly.
 |---|---|
 | `script-injection` | `script#trustedserver-js` present in live DOM, no console errors |
 | `script-bundle` | JS bundle loads with 200, no parse/runtime errors, correct content type |
+| `aps-renderer` | Static route nonce gating, restrictive CSP, replay rejection, and opaque iframe/script isolation |
 
 ### Browser-level — Next.js
 
diff --git a/crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts b/crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts
new file mode 100644
index 000000000..072195219
--- /dev/null
+++ b/crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts
@@ -0,0 +1,935 @@
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { expect, test } from "@playwright/test";
+import { runtimeUrl } from "../../helpers/state.js";
+
+const RUNNER_URL = "https://client.aps.amazon-adsystem.com/prebid-creative.js";
+const IFRAME_CREATIVE_URL = "https://creative.example/iframe";
+const SCRIPT_CREATIVE_URL = "https://creative.example/script.js";
+const SANDBOX =
+    "allow-forms allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-scripts allow-top-navigation-by-user-activation";
+const TSJS_CRATE = resolve(__dirname, "../../../../trusted-server-js");
+
+function clientAuctionBundlePaths() {
+    const manifestPath = resolve(TSJS_CRATE, "dist/prebid/manifest.json");
+    const manifest = JSON.parse(readFileSync(manifestPath, "utf8")) as {
+        filename: string;
+    };
+    return {
+        core: resolve(TSJS_CRATE, "dist/tsjs-core.js"),
+        gpt: resolve(TSJS_CRATE, "dist/tsjs-gpt.js"),
+        prebid: resolve(TSJS_CRATE, "dist/prebid", manifest.filename),
+    };
+}
+
+function descriptor(
+    tagType: "iframe" | "script",
+    creativeUrl = tagType === "iframe"
+        ? IFRAME_CREATIVE_URL
+        : SCRIPT_CREATIVE_URL,
+) {
+    const envelope = {
+        seatbid: [
+            {
+                bid: [
+                    {
+                        id: `fictional-${tagType}-bid`,
+                        price: 1.23,
+                        w: 300,
+                        h: 250,
+                        ext: { creativeurl: creativeUrl, tagtype: tagType },
+                    },
+                ],
+            },
+        ],
+    };
+    return {
+        type: "aps",
+        version: 1,
+        accountId: "example-account-id",
+        bidId: `fictional-${tagType}-bid`,
+        creativeId: `fictional-${tagType}-creative`,
+        tagType,
+        creativeUrl,
+        aaxResponse: Buffer.from(JSON.stringify(envelope), "utf8").toString(
+            "base64",
+        ),
+        width: 300,
+        height: 250,
+    };
+}
+
+function testPage(rendererUrl: string) {
+    return `<!doctype html>
+<meta charset="utf-8">
+<div id="slots"></div>
+<script>
+window.apsMessages = [];
+window.startApsFrame = function(options) {
+  var slot = document.createElement('div');
+  slot.id = options.slotId;
+  slot.innerHTML = '<span class="existing">existing publisher content</span>';
+  document.getElementById('slots').appendChild(slot);
+
+  var frame = document.createElement('iframe');
+  frame.width = '300';
+  frame.height = '250';
+  frame.style.display = 'none';
+  if (!options.omitSandbox) {
+    frame.setAttribute('sandbox', ${JSON.stringify(SANDBOX)});
+  }
+  frame.src = ${JSON.stringify(rendererUrl)} +
+    (options.includeFragment === false ? '' : '#tsaps=' + options.fragmentNonce);
+
+  function receive(event) {
+    if (event.source !== frame.contentWindow || !event.data) return;
+    window.apsMessages.push({ slotId: options.slotId, data: event.data });
+    if (event.data.message === 'trusted-server/aps/renderer-ready' &&
+        event.data.nonce === options.fragmentNonce) {
+      var existing = slot.querySelector('.existing');
+      if (existing) existing.remove();
+      frame.style.display = '';
+    }
+  }
+  window.addEventListener('message', receive);
+  frame.onload = function() {
+    frame.contentWindow.postMessage({
+      nonce: options.messageNonce,
+      renderer: options.renderer
+    }, '*');
+  };
+  slot.appendChild(frame);
+};
+</script>`;
+}
+
+const FAKE_RUNNER = `(function(){
+  var runnerRead = false;
+  var runnerWrite = false;
+  try { void top.document.body; runnerRead = true; } catch (_error) {}
+  try { top.document.body.dataset.apsCompromised = 'runner'; runnerWrite = true; } catch (_error) {}
+  parent.postMessage({
+    message: 'fictional-runner-security',
+    runnerRead: runnerRead,
+    runnerWrite: runnerWrite,
+    accountMap: window._aps instanceof Map
+  }, '*');
+
+  addEventListener('message', function(event) {
+    if (event.data && event.data.message === 'fictional-creative-security') {
+      parent.postMessage(event.data, '*');
+    }
+  });
+
+  window._aps.forEach(function(account) {
+    var events = account.queue.splice(0);
+    events.forEach(function(event) {
+      var response = JSON.parse(atob(event.detail.aaxResponse));
+      var bid = response.seatbid[0].bid[0];
+      if (bid.ext.tagtype === 'iframe') {
+        var frame = document.createElement('iframe');
+        frame.setAttribute('sandbox', 'allow-scripts allow-same-origin');
+        frame.src = bid.ext.creativeurl;
+        document.body.appendChild(frame);
+      } else {
+        var script = document.createElement('script');
+        script.src = bid.ext.creativeurl;
+        document.head.appendChild(script);
+      }
+    });
+  });
+})();`;
+
+const IFRAME_CREATIVE = `<!doctype html><script>
+var creativeRead = false;
+var creativeWrite = false;
+try { void top.document.body; creativeRead = true; } catch (_error) {}
+try { top.document.body.dataset.apsCompromised = 'iframe'; creativeWrite = true; } catch (_error) {}
+parent.postMessage({
+  message: 'fictional-creative-security',
+  tagType: 'iframe',
+  creativeRead: creativeRead,
+  creativeWrite: creativeWrite
+}, '*');
+<\/script>`;
+
+const SCRIPT_CREATIVE = `(function(){
+  var creativeRead = false;
+  var creativeWrite = false;
+  try { void top.document.body; creativeRead = true; } catch (_error) {}
+  try { top.document.body.dataset.apsCompromised = 'script'; creativeWrite = true; } catch (_error) {}
+  parent.postMessage({
+    message: 'fictional-creative-security',
+    tagType: 'script',
+    creativeRead: creativeRead,
+    creativeWrite: creativeWrite
+  }, '*');
+})();`;
+
+test.describe("APS opaque renderer", () => {
+    test("renders a trustedServer adapter bid using Prebid's generated GAM ad ID", async ({
+        page,
+    }) => {
+        const apsRenderer = descriptor("iframe");
+        const responseBody = {
+            id: "fictional-auction",
+            seatbid: [
+                {
+                    seat: "aps",
+                    bid: [
+                        {
+                            id: apsRenderer.bidId,
+                            impid: "div-aps",
+                            price: 1.23,
+                            crid: apsRenderer.creativeId,
+                            w: 300,
+                            h: 250,
+                            ext: {
+                                trusted_server: { renderer: apsRenderer },
+                            },
+                        },
+                    ],
+                },
+            ],
+            ext: {},
+        };
+        let auctionRequests = 0;
+        await page.route(runtimeUrl("/aps-prebid-adapter-test"), (route) =>
+            route.fulfill({
+                status: 200,
+                contentType: "text/html",
+                body: '<!doctype html><div id="div-aps"></div><div id="div-other"></div>',
+            }),
+        );
+        await page.route(runtimeUrl("/auction"), (route) => {
+            auctionRequests += 1;
+            return route.fulfill({
+                status: 200,
+                contentType: "application/json",
+                body: JSON.stringify(responseBody),
+            });
+        });
+
+        await page.goto(runtimeUrl("/aps-prebid-adapter-test"));
+        const bundles = clientAuctionBundlePaths();
+        await page.addScriptTag({ path: bundles.gpt });
+        await page.addScriptTag({ path: bundles.prebid });
+
+        const result = await page.evaluate(async () => {
+            type PrebidBid = {
+                ad?: string;
+                adId: string;
+                bidderCode: string;
+                status?: string;
+            };
+            type PrebidApi = {
+                getAllWinningBids(): PrebidBid[];
+                getBidResponsesForAdUnitCode(code: string): {
+                    bids: PrebidBid[];
+                };
+                onEvent(
+                    name: string,
+                    callback: (value: Record<string, unknown>) => void,
+                ): void;
+                requestBids(options: Record<string, unknown>): void;
+            };
+            const pbjs = (window as unknown as { pbjs: PrebidApi }).pbjs;
+            const bidWon: string[] = [];
+            const renderSucceeded: string[] = [];
+            pbjs.onEvent("bidWon", (bid) => bidWon.push(String(bid.adId)));
+            pbjs.onEvent("adRenderSucceeded", (event) =>
+                renderSucceeded.push(String(event.adId)),
+            );
+
+            const acceptedBid = await new Promise<PrebidBid | undefined>(
+                (resolveBid) => {
+                    pbjs.requestBids({
+                        adUnits: [
+                            {
+                                code: "div-aps",
+                                mediaTypes: { banner: { sizes: [[300, 250]] } },
+                                bids: [],
+                            },
+                        ],
+                        bidsBackHandler: () =>
+                            resolveBid(
+                                pbjs
+                                    .getBidResponsesForAdUnitCode("div-aps")
+                                    .bids.find(
+                                        (bid) => bid.bidderCode === "aps",
+                                    ),
+                            ),
+                        timeout: 1_000,
+                    });
+                },
+            );
+            if (!acceptedBid)
+                throw new Error("APS bid was not accepted by Prebid");
+
+            const foreignUniversalCreativeResponse = await new Promise<
+                Record<string, unknown> | undefined
+            >((resolveResponse) => {
+                const frame = document.createElement("iframe");
+                const adIdJson = JSON.stringify(acceptedBid.adId);
+                frame.srcdoc = `<script>
+const renderChannel = new MessageChannel();
+renderChannel.port1.onmessage = function(event) {
+  parent.postMessage({ type: 'captured-foreign-prebid-response', payload: event.data }, '*');
+};
+parent.postMessage(JSON.stringify({
+  message: 'Prebid Request',
+  adId: ${adIdJson}
+}), '*', [renderChannel.port2]);
+<\/script>`;
+                let timeout = 0;
+                const receive = (event: MessageEvent) => {
+                    if (event.data?.type !== "captured-foreign-prebid-response")
+                        return;
+                    window.removeEventListener("message", receive);
+                    window.clearTimeout(timeout);
+                    resolveResponse(JSON.parse(String(event.data.payload)));
+                };
+                window.addEventListener("message", receive);
+                document.getElementById("div-other")!.appendChild(frame);
+                timeout = window.setTimeout(() => {
+                    window.removeEventListener("message", receive);
+                    resolveResponse(undefined);
+                }, 200);
+            });
+
+            const universalCreativeResponse = await new Promise<
+                Record<string, unknown>
+            >((resolveResponse, rejectResponse) => {
+                const frame = document.createElement("iframe");
+                const adIdJson = JSON.stringify(acceptedBid.adId);
+                frame.srcdoc = `<script>
+const renderChannel = new MessageChannel();
+renderChannel.port1.onmessage = function(event) {
+  parent.postMessage({ type: 'captured-prebid-response', payload: event.data }, '*');
+  const eventChannel = new MessageChannel();
+  parent.postMessage(JSON.stringify({
+    message: 'Prebid Event',
+    adId: ${adIdJson},
+    event: 'adRenderSucceeded'
+  }), '*', [eventChannel.port2]);
+};
+parent.postMessage(JSON.stringify({
+  message: 'Prebid Request',
+  adId: ${adIdJson}
+}), '*', [renderChannel.port2]);
+<\/script>`;
+                const receive = (event: MessageEvent) => {
+                    if (event.data?.type !== "captured-prebid-response") return;
+                    window.removeEventListener("message", receive);
+                    resolveResponse(JSON.parse(String(event.data.payload)));
+                };
+                window.addEventListener("message", receive);
+                document.getElementById("div-aps")!.appendChild(frame);
+                window.setTimeout(
+                    () =>
+                        rejectResponse(
+                            new Error("Universal Creative response timed out"),
+                        ),
+                    3_000,
+                );
+            });
+            await new Promise((resolveTick) =>
+                window.setTimeout(resolveTick, 50),
+            );
+
+            return {
+                acceptedAd: acceptedBid.ad,
+                acceptedAdId: acceptedBid.adId,
+                acceptedStatus: acceptedBid.status,
+                bidWon,
+                foreignUniversalCreativeResponse,
+                renderSucceeded,
+                universalCreativeResponse,
+                winningAdIds: pbjs.getAllWinningBids().map((bid) => bid.adId),
+                registrySize: Object.keys(
+                    (
+                        window as unknown as {
+                            tsjs?: {
+                                apsPrebidRenderers?: Record<string, unknown>;
+                            };
+                        }
+                    ).tsjs?.apsPrebidRenderers ?? {},
+                ).length,
+            };
+        });
+
+        expect(auctionRequests).toBe(1);
+        expect(result.acceptedAd).toBe("");
+        expect(result.acceptedAdId).not.toBe(apsRenderer.bidId);
+        expect(result.foreignUniversalCreativeResponse).toBeUndefined();
+        expect(result.universalCreativeResponse).toEqual(
+            expect.objectContaining({
+                message: "Prebid Response",
+                adId: result.acceptedAdId,
+                rendererVersion: 4,
+                apsRenderer,
+            }),
+        );
+        expect(result.bidWon).toEqual([result.acceptedAdId]);
+        expect(result.renderSucceeded).toEqual([result.acceptedAdId]);
+        expect(result.winningAdIds).toContain(result.acceptedAdId);
+        expect(result.acceptedStatus).toBe("rendered");
+        expect(result.registrySize).toBe(0);
+    });
+
+    test("enforces nonce gating and isolates iframe and script behavior under restrictive CSP", async ({
+        page,
+    }) => {
+        const rendererResponse = await page.request.get(
+            runtimeUrl("/integrations/aps/renderer"),
+        );
+        expect(rendererResponse.status()).toBe(200);
+        expect(rendererResponse.headers()["content-type"]).toContain(
+            "text/html",
+        );
+        const rendererCsp =
+            rendererResponse.headers()["content-security-policy"];
+        expect(rendererCsp).toContain("default-src 'none'");
+        expect(rendererCsp).toContain("sandbox allow-forms");
+        expect(rendererCsp).not.toContain("allow-same-origin");
+        expect(rendererResponse.headers()["referrer-policy"]).toBe(
+            "no-referrer",
+        );
+
+        let runnerRequests = 0;
+        await page.route(RUNNER_URL, async (route) => {
+            runnerRequests += 1;
+            await route.fulfill({
+                status: 200,
+                contentType: "application/javascript",
+                body: FAKE_RUNNER,
+            });
+        });
+        await page.route(IFRAME_CREATIVE_URL, async (route) => {
+            await route.fulfill({
+                status: 200,
+                contentType: "text/html",
+                body: IFRAME_CREATIVE,
+            });
+        });
+        await page.route(SCRIPT_CREATIVE_URL, async (route) => {
+            await route.fulfill({
+                status: 200,
+                contentType: "application/javascript",
+                body: SCRIPT_CREATIVE,
+            });
+        });
+        await page.route(runtimeUrl("/aps-security-test"), async (route) => {
+            await route.fulfill({
+                status: 200,
+                contentType: "text/html",
+                headers: {
+                    "Content-Security-Policy":
+                        "default-src 'none'; script-src 'unsafe-inline'; frame-src 'self'",
+                },
+                body: testPage(runtimeUrl("/integrations/aps/renderer")),
+            });
+        });
+
+        await page.goto(runtimeUrl("/aps-security-test"));
+
+        const validNonce = "ABCDEFGHIJKLMNOPQRSTUV";
+        await page.evaluate(
+            ({ renderer, nonce }) => {
+                (
+                    window as unknown as {
+                        startApsFrame(options: Record<string, unknown>): void;
+                    }
+                ).startApsFrame({
+                    slotId: "iframe-slot",
+                    fragmentNonce: nonce,
+                    messageNonce: nonce,
+                    renderer,
+                });
+            },
+            { renderer: descriptor("iframe"), nonce: validNonce },
+        );
+
+        await expect
+            .poll(async () =>
+                page.evaluate(() =>
+                    (
+                        window as unknown as {
+                            apsMessages: Array<{ data: { message?: string } }>;
+                        }
+                    ).apsMessages.some(
+                        ({ data }) =>
+                            data.message === "fictional-creative-security",
+                    ),
+                ),
+            )
+            .toBe(true);
+        await expect(page.locator("#iframe-slot .existing")).toHaveCount(0);
+
+        const validState = await page.evaluate(() => {
+            const frame = document.querySelector<HTMLIFrameElement>(
+                "#iframe-slot iframe",
+            )!;
+            const messages = (
+                window as unknown as {
+                    apsMessages: Array<{ data: Record<string, unknown> }>;
+                }
+            ).apsMessages.map(({ data }) => data);
+            let publisherCanReadFrame = false;
+            try {
+                publisherCanReadFrame = Boolean(
+                    frame.contentWindow?.document.body,
+                );
+            } catch (_error) {
+                publisherCanReadFrame = false;
+            }
+            return {
+                existing: Boolean(
+                    document.querySelector("#iframe-slot .existing"),
+                ),
+                sandbox: frame.getAttribute("sandbox"),
+                publisherCanReadFrame,
+                compromised: document.body.dataset.apsCompromised,
+                messages,
+            };
+        });
+
+        expect(validState.existing).toBe(false);
+        expect(validState.sandbox).toBe(SANDBOX);
+        expect(validState.sandbox).not.toContain("allow-same-origin");
+        expect(validState.publisherCanReadFrame).toBe(false);
+        expect(validState.compromised).toBeUndefined();
+        expect(validState.messages).toContainEqual(
+            expect.objectContaining({
+                message: "fictional-runner-security",
+                runnerRead: false,
+                runnerWrite: false,
+                accountMap: true,
+            }),
+        );
+        expect(validState.messages).toContainEqual(
+            expect.objectContaining({
+                message: "fictional-creative-security",
+                tagType: "iframe",
+                creativeRead: false,
+                creativeWrite: false,
+            }),
+        );
+
+        const cspNonce = "csp-sandbox-0123456789";
+        await page.evaluate(
+            ({ renderer, nonce }) => {
+                (
+                    window as unknown as {
+                        startApsFrame(options: Record<string, unknown>): void;
+                    }
+                ).startApsFrame({
+                    slotId: "csp-sandbox-slot",
+                    fragmentNonce: nonce,
+                    messageNonce: nonce,
+                    omitSandbox: true,
+                    renderer,
+                });
+            },
+            { renderer: descriptor("script"), nonce: cspNonce },
+        );
+        await expect
+            .poll(async () =>
+                page.evaluate(() =>
+                    (
+                        window as unknown as {
+                            apsMessages: Array<{
+                                slotId: string;
+                                data: Record<string, unknown>;
+                            }>;
+                        }
+                    ).apsMessages.some(
+                        ({ slotId, data }) =>
+                            slotId === "csp-sandbox-slot" &&
+                            data.message === "fictional-creative-security" &&
+                            data.tagType === "script",
+                    ),
+                ),
+            )
+            .toBe(true);
+        await expect(page.locator("#csp-sandbox-slot .existing")).toHaveCount(
+            0,
+        );
+        const cspState = await page.evaluate(() => {
+            const frame = document.querySelector<HTMLIFrameElement>(
+                "#csp-sandbox-slot iframe",
+            )!;
+            let publisherCanReadFrame = false;
+            try {
+                publisherCanReadFrame = Boolean(
+                    frame.contentWindow?.document.body,
+                );
+            } catch (_error) {
+                publisherCanReadFrame = false;
+            }
+            return {
+                sandbox: frame.getAttribute("sandbox"),
+                existing: Boolean(
+                    document.querySelector("#csp-sandbox-slot .existing"),
+                ),
+                publisherCanReadFrame,
+                compromised: document.body.dataset.apsCompromised,
+                messages: (
+                    window as unknown as {
+                        apsMessages: Array<{
+                            slotId: string;
+                            data: Record<string, unknown>;
+                        }>;
+                    }
+                ).apsMessages
+                    .filter(({ slotId }) => slotId === "csp-sandbox-slot")
+                    .map(({ data }) => data),
+            };
+        });
+        expect(cspState.sandbox).toBeNull();
+        expect(cspState.existing).toBe(false);
+        expect(cspState.publisherCanReadFrame).toBe(false);
+        expect(cspState.compromised).toBeUndefined();
+        expect(cspState.messages).toContainEqual(
+            expect.objectContaining({
+                message: "fictional-runner-security",
+                runnerRead: false,
+                runnerWrite: false,
+            }),
+        );
+        expect(cspState.messages).toContainEqual(
+            expect.objectContaining({
+                message: "fictional-creative-security",
+                tagType: "script",
+                creativeRead: false,
+                creativeWrite: false,
+            }),
+        );
+
+        const messagesBeforeReplay = await page.evaluate(
+            () =>
+                (
+                    window as unknown as {
+                        apsMessages: Array<{ data: Record<string, unknown> }>;
+                    }
+                ).apsMessages.length,
+        );
+        await page.evaluate(
+            ({ renderer, nonce }) => {
+                const frame = document.querySelector<HTMLIFrameElement>(
+                    "#iframe-slot iframe",
+                )!;
+                frame.contentWindow!.postMessage({ nonce, renderer }, "*");
+            },
+            { renderer: descriptor("iframe"), nonce: validNonce },
+        );
+        await page.waitForTimeout(100);
+        expect(
+            await page.evaluate(
+                () =>
+                    (
+                        window as unknown as {
+                            apsMessages: Array<{
+                                data: Record<string, unknown>;
+                            }>;
+                        }
+                    ).apsMessages.length,
+            ),
+        ).toBe(messagesBeforeReplay);
+
+        const requestsBeforeInvalid = runnerRequests;
+        const wrongNonce = "ZYXWVUTSRQPONMLKJIHGFE";
+        await page.evaluate(
+            ({ renderer, fragmentNonce, messageNonce }) => {
+                (
+                    window as unknown as {
+                        startApsFrame(options: Record<string, unknown>): void;
+                    }
+                ).startApsFrame({
+                    slotId: "mismatch-slot",
+                    fragmentNonce,
+                    messageNonce,
+                    renderer,
+                });
+            },
+            {
+                renderer: descriptor("iframe"),
+                fragmentNonce: validNonce,
+                messageNonce: wrongNonce,
+            },
+        );
+        await page.waitForTimeout(100);
+        expect(runnerRequests).toBe(requestsBeforeInvalid);
+        await expect(page.locator("#mismatch-slot .existing")).toHaveCount(1);
+
+        await page.evaluate(
+            ({ renderer, nonce }) => {
+                (
+                    window as unknown as {
+                        startApsFrame(options: Record<string, unknown>): void;
+                    }
+                ).startApsFrame({
+                    slotId: "missing-fragment-slot",
+                    fragmentNonce: nonce,
+                    messageNonce: nonce,
+                    includeFragment: false,
+                    renderer,
+                });
+            },
+            { renderer: descriptor("iframe"), nonce: validNonce },
+        );
+        await page.waitForTimeout(100);
+        expect(runnerRequests).toBe(requestsBeforeInvalid);
+        await expect(
+            page.locator("#missing-fragment-slot .existing"),
+        ).toHaveCount(1);
+
+        await page.evaluate(
+            ({ renderer, nonce }) => {
+                (
+                    window as unknown as {
+                        startApsFrame(options: Record<string, unknown>): void;
+                    }
+                ).startApsFrame({
+                    slotId: "malformed-slot",
+                    fragmentNonce: nonce,
+                    messageNonce: nonce,
+                    renderer: { ...renderer, unexpected: true },
+                });
+            },
+            { renderer: descriptor("iframe"), nonce: wrongNonce },
+        );
+        await page.waitForTimeout(100);
+        expect(runnerRequests).toBe(requestsBeforeInvalid);
+        await expect(page.locator("#malformed-slot .existing")).toHaveCount(1);
+
+        const scriptNonce = "0123456789abcdefghijkl";
+        await page.evaluate(
+            ({ renderer, nonce }) => {
+                (
+                    window as unknown as {
+                        startApsFrame(options: Record<string, unknown>): void;
+                    }
+                ).startApsFrame({
+                    slotId: "script-slot",
+                    fragmentNonce: nonce,
+                    messageNonce: nonce,
+                    renderer,
+                });
+            },
+            { renderer: descriptor("script"), nonce: scriptNonce },
+        );
+
+        await expect
+            .poll(async () =>
+                page.evaluate(() =>
+                    (
+                        window as unknown as {
+                            apsMessages: Array<{
+                                data: Record<string, unknown>;
+                            }>;
+                        }
+                    ).apsMessages.some(
+                        ({ data }) =>
+                            data.message === "fictional-creative-security" &&
+                            data.tagType === "script",
+                    ),
+                ),
+            )
+            .toBe(true);
+        await expect(page.locator("#script-slot .existing")).toHaveCount(0);
+
+        const scriptState = await page.evaluate(() => ({
+            existing: Boolean(document.querySelector("#script-slot .existing")),
+            compromised: document.body.dataset.apsCompromised,
+            scriptSecurity: (
+                window as unknown as {
+                    apsMessages: Array<{ data: Record<string, unknown> }>;
+                }
+            ).apsMessages.find(
+                ({ data }) =>
+                    data.message === "fictional-creative-security" &&
+                    data.tagType === "script",
+            )?.data,
+        }));
+        expect(scriptState.existing).toBe(false);
+        expect(scriptState.compromised).toBeUndefined();
+        expect(scriptState.scriptSecurity).toEqual(
+            expect.objectContaining({
+                creativeRead: false,
+                creativeWrite: false,
+            }),
+        );
+    });
+
+    test("rejects same-origin creative URLs through the TSJS rendering path", async ({
+        page,
+    }) => {
+        const publisherOrigin = "https://publisher.example";
+        const rendererUrl = `${publisherOrigin}/integrations/aps/renderer`;
+        const auctionUrl = `${publisherOrigin}/auction`;
+        const testUrl = `${publisherOrigin}/aps-same-origin-test`;
+        const runtimeRenderer = await page.request.get(
+            runtimeUrl("/integrations/aps/renderer"),
+        );
+        const rendererDocument = await runtimeRenderer.text();
+        let creativeUrl = SCRIPT_CREATIVE_URL;
+        let runnerRequests = 0;
+
+        await page.route(RUNNER_URL, async (route) => {
+            runnerRequests += 1;
+            await route.fulfill({
+                status: 200,
+                contentType: "application/javascript",
+                body: FAKE_RUNNER,
+            });
+        });
+        await page.route(rendererUrl, async (route) => {
+            await route.fulfill({
+                status: 200,
+                contentType: "text/html",
+                headers: {
+                    "Content-Security-Policy":
+                        runtimeRenderer.headers()["content-security-policy"],
+                    "Referrer-Policy": "no-referrer",
+                },
+                body: rendererDocument,
+            });
+        });
+        await page.route(auctionUrl, async (route) => {
+            const renderer = descriptor("script", creativeUrl);
+            await route.fulfill({
+                status: 200,
+                contentType: "application/json",
+                body: JSON.stringify({
+                    id: "fictional-auction",
+                    seatbid: [
+                        {
+                            seat: "aps",
+                            bid: [
+                                {
+                                    id: renderer.bidId,
+                                    impid: "same-origin-slot",
+                                    price: 1.23,
+                                    w: 300,
+                                    h: 250,
+                                    ext: {
+                                        trusted_server: { renderer },
+                                    },
+                                },
+                            ],
+                        },
+                    ],
+                    ext: {},
+                }),
+            });
+        });
+        await page.route(testUrl, async (route) => {
+            await route.fulfill({
+                status: 200,
+                contentType: "text/html",
+                headers: {
+                    "Content-Security-Policy":
+                        "default-src 'none'; script-src 'unsafe-inline'; connect-src 'self'; frame-src 'self'",
+                },
+                body: '<!doctype html><div id="same-origin-slot"><span class="existing">existing publisher content</span></div>',
+            });
+        });
+
+        await page.goto(testUrl);
+        await page.addScriptTag({ path: clientAuctionBundlePaths().core });
+        await page.evaluate(() => {
+            const tsjs = (
+                window as unknown as {
+                    tsjs: {
+                        addAdUnits(units: Array<Record<string, unknown>>): void;
+                        log: {
+                            info(message: string, ...args: unknown[]): void;
+                        };
+                        requestAds(): void;
+                    };
+                    auctionRenderCompletions?: number;
+                }
+            ).tsjs;
+            tsjs.addAdUnits([
+                {
+                    code: "same-origin-slot",
+                    mediaTypes: { banner: { sizes: [[300, 250]] } },
+                    bids: [],
+                },
+            ]);
+            const originalInfo = tsjs.log.info.bind(tsjs.log);
+            tsjs.log.info = (message: string, ...args: unknown[]) => {
+                if (
+                    message === "requestAds: rendered creatives from response"
+                ) {
+                    (
+                        window as unknown as {
+                            auctionRenderCompletions: number;
+                        }
+                    ).auctionRenderCompletions += 1;
+                }
+                originalInfo(message, ...args);
+            };
+            (
+                window as unknown as {
+                    auctionRenderCompletions: number;
+                }
+            ).auctionRenderCompletions = 0;
+            tsjs.requestAds();
+        });
+
+        await expect.poll(() => runnerRequests).toBe(1);
+        await expect
+            .poll(() =>
+                page.evaluate(
+                    () =>
+                        (
+                            window as unknown as {
+                                auctionRenderCompletions: number;
+                            }
+                        ).auctionRenderCompletions,
+                ),
+            )
+            .toBe(1);
+        await expect(page.locator("#same-origin-slot .existing")).toHaveCount(
+            0,
+        );
+        const productSandbox = await page
+            .locator("#same-origin-slot > iframe")
+            .getAttribute("sandbox");
+        expect(productSandbox).toBe(SANDBOX);
+        expect(productSandbox).not.toContain("allow-same-origin");
+
+        creativeUrl = `${publisherOrigin}/fictional-same-origin.js`;
+        await page.locator("#same-origin-slot").evaluate((slot) => {
+            slot.innerHTML =
+                '<span class="existing">existing publisher content</span>';
+        });
+        await page.evaluate(() => {
+            (
+                window as unknown as {
+                    tsjs: { requestAds(): void };
+                }
+            ).tsjs.requestAds();
+        });
+
+        await expect
+            .poll(() =>
+                page.evaluate(
+                    () =>
+                        (
+                            window as unknown as {
+                                auctionRenderCompletions: number;
+                            }
+                        ).auctionRenderCompletions,
+                ),
+            )
+            .toBe(2);
+        expect(runnerRequests).toBe(1);
+        await expect(page.locator("#same-origin-slot iframe")).toHaveCount(0);
+        await expect(page.locator("#same-origin-slot .existing")).toHaveCount(
+            1,
+        );
+    });
+});
diff --git a/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml b/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml
index d6b436a9f..921bf1959 100644
--- a/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml
+++ b/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml
@@ -100,10 +100,11 @@ timeout_ms = 2000
 allowed_context_keys = []
 
 [integrations.aps]
-enabled = false
-pub_id = "example-aps-publisher-id"
-endpoint = "https://aps.example.com/e/dtb/bid"
+enabled = true
+account_id = "example-aps-account-id"
+endpoint = "https://aps.example.com/e/pb/bid"
 timeout_ms = 1000
+allow_script_creatives = false
 
 [integrations.google_tag_manager]
 enabled = false
diff --git a/crates/trusted-server-js/lib/build-prebid-external.mjs b/crates/trusted-server-js/lib/build-prebid-external.mjs
index 4e89723ed..a63758c32 100644
--- a/crates/trusted-server-js/lib/build-prebid-external.mjs
+++ b/crates/trusted-server-js/lib/build-prebid-external.mjs
@@ -224,6 +224,13 @@ async function buildExternalBundle(outDir, generatedModules) {
               'node_modules/prebid.js/dist/src/src/adapterManager.js'
             ),
           },
+          {
+            find: 'prebid.js/src/adRendering.js',
+            replacement: path.resolve(
+              __dirname,
+              'node_modules/prebid.js/dist/src/src/adRendering.js'
+            ),
+          },
         ],
       },
       build: {
diff --git a/crates/trusted-server-js/lib/src/core/auction.ts b/crates/trusted-server-js/lib/src/core/auction.ts
index 40f54367a..a02684362 100644
--- a/crates/trusted-server-js/lib/src/core/auction.ts
+++ b/crates/trusted-server-js/lib/src/core/auction.ts
@@ -1,8 +1,11 @@
 // Shared auction module: builds AdRequest payloads, sends them to /auction,
-// and parses OpenRTB seatbid responses.  Used by both the core requestAds flow
+// and parses OpenRTB seatbid responses. Used by both the core requestAds flow
 // and the Prebid.js trustedServer adapter.
 
+import { parseApsRendererDescriptor } from '../integrations/aps/render';
+
 import { log } from './log';
+import type { ApsRendererV1 } from './types';
 
 // ---------------------------------------------------------------------------
 // Types
@@ -43,6 +46,8 @@ export interface AuctionBid {
   impid: string;
   /** Creative HTML (already rewritten with proxy URLs by the server). */
   adm: string;
+  /** Typed APS renderer descriptor, when the bid does not carry `adm`. */
+  renderer?: ApsRendererV1;
   /** CPM price. */
   price: number;
   /** Creative width. */
@@ -71,31 +76,31 @@ export interface AuctionBid {
 export function buildAdRequest(units: any[], options?: { eids?: AuctionEid[] }): AdRequest {
   const unitMap = new Map<string, AdRequestUnit>();
 
-  for (const u of units) {
-    const code: string = u.adUnitCode ?? u.code ?? '';
+  for (const unit of units) {
+    const code: string = unit.adUnitCode ?? unit.code ?? '';
     if (!unitMap.has(code)) {
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       const mediaTypes: any = {};
-      if (u.mediaTypes?.banner) {
+      if (unit.mediaTypes?.banner) {
         mediaTypes.banner = {
-          sizes: u.mediaTypes.banner.sizes ?? u.sizes ?? [],
+          sizes: unit.mediaTypes.banner.sizes ?? unit.sizes ?? [],
         };
       }
       unitMap.set(code, { code, mediaTypes, bids: [] });
     }
 
     // If the source object carries a `bidder` field (Prebid BidRequest style),
-    // add it as a bid entry.  Otherwise copy the existing `bids` array.
-    if (u.bidder) {
+    // add it as a bid entry. Otherwise copy the existing `bids` array.
+    if (unit.bidder) {
       unitMap.get(code)!.bids.push({
-        bidder: u.bidder,
-        params: u.params ?? {},
+        bidder: unit.bidder,
+        params: unit.params ?? {},
       });
-    } else if (Array.isArray(u.bids)) {
-      for (const b of u.bids) {
+    } else if (Array.isArray(unit.bids)) {
+      for (const bid of unit.bids) {
         unitMap.get(code)!.bids.push({
-          bidder: b.bidder ?? '',
-          params: b.params ?? {},
+          bidder: bid.bidder ?? '',
+          params: bid.params ?? {},
         });
       }
     }
@@ -115,10 +120,8 @@ export function buildAdRequest(units: any[], options?: { eids?: AuctionEid[] }):
 /**
  * Parse an OpenRTB-style response body into a flat array of {@link AuctionBid}.
  *
- * Expected shape:
- * ```json
- * { "seatbid": [{ "seat": "bidder", "bid": [{ "impid", "price", "adm", ... }] }] }
- * ```
+ * Parsing the renderer here is intentionally structural. The exact decoded
+ * APS envelope is validated immediately before any DOM or message side effect.
  */
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export function parseAuctionResponse(body: any): AuctionBid[] {
@@ -126,26 +129,34 @@ export function parseAuctionResponse(body: any): AuctionBid[] {
   const seatbids = body?.seatbid;
   if (!Array.isArray(seatbids)) return bids;
 
-  for (const sb of seatbids) {
-    const seat: string = sb.seat ?? 'unknown';
-    const sbBids = sb.bid;
-    if (!Array.isArray(sbBids)) continue;
-
-    for (const b of sbBids) {
-      // Coerce missing/null adm to '' so AuctionBid.adm is always a string.
-      // The empty-string case is filtered in renderCreativeInline via the
-      // `if (!bid.adm)` guard. The client-side `typeof !== 'string'` check in
-      // sanitizeCreativeHtml is a second line of defense for callers that bypass
-      // parseAuctionResponse and pass untrusted values directly.
+  for (const seatbid of seatbids) {
+    const seat: string = typeof seatbid?.seat === 'string' ? seatbid.seat : 'unknown';
+    const seatBids = seatbid?.bid;
+    if (!Array.isArray(seatBids)) continue;
+
+    for (const bid of seatBids) {
+      const impid = typeof bid?.impid === 'string' ? bid.impid : '';
+      const renderer = parseApsRendererDescriptor(bid?.ext?.trusted_server?.renderer);
+      const width = typeof bid?.w === 'number' ? bid.w : (renderer?.width ?? 300);
+      const height = typeof bid?.h === 'number' ? bid.h : (renderer?.height ?? 250);
+      const creativeId =
+        typeof bid?.crid === 'string' ? bid.crid : (renderer?.creativeId ?? `${seat}-${impid}`);
+
       bids.push({
-        impid: b.impid ?? '',
-        adm: b.adm ?? '',
-        price: b.price ?? 0,
-        width: b.w ?? 300,
-        height: b.h ?? 250,
+        impid,
+        // Preserve non-string untrusted values so the render-time sanitizer
+        // rejects them explicitly instead of silently converting them to an
+        // empty no-op creative.
+        adm: bid?.adm ?? '',
+        ...(renderer ? { renderer } : {}),
+        price: typeof bid?.price === 'number' ? bid.price : 0,
+        width,
+        height,
         seat,
-        creativeId: b.crid ?? `${seat}-${b.impid ?? ''}`,
-        adomain: Array.isArray(b.adomain) ? b.adomain : [],
+        creativeId,
+        adomain: Array.isArray(bid?.adomain)
+          ? bid.adomain.filter((domain: unknown): domain is string => typeof domain === 'string')
+          : [],
       });
     }
   }
@@ -170,7 +181,7 @@ export async function sendAuction(endpoint: string, request: AdRequest): Promise
   log.info('auction: sending request', { endpoint, units: request.adUnits.length });
 
   try {
-    const res = await fetch(endpoint, {
+    const response = await fetch(endpoint, {
       method: 'POST',
       headers: { 'content-type': 'application/json' },
       credentials: 'same-origin',
@@ -178,18 +189,22 @@ export async function sendAuction(endpoint: string, request: AdRequest): Promise
       keepalive: true,
     });
 
-    const ct = res.headers.get('content-type') || '';
-    if (res.ok && ct.includes('application/json')) {
-      const data: unknown = await res.json();
+    const contentType = response.headers.get('content-type') || '';
+    if (response.ok && contentType.includes('application/json')) {
+      const data: unknown = await response.json();
       const bids = parseAuctionResponse(data);
       log.info('auction: received bids', { count: bids.length });
       return bids;
     }
 
-    log.warn('auction: unexpected response', { ok: res.ok, status: res.status, ct });
+    log.warn('auction: unexpected response', {
+      ok: response.ok,
+      status: response.status,
+      ct: contentType,
+    });
     return [];
-  } catch (err) {
-    log.warn('auction: request failed', err);
+  } catch (error) {
+    log.warn('auction: request failed', error);
     return [];
   }
 }
diff --git a/crates/trusted-server-js/lib/src/core/request.ts b/crates/trusted-server-js/lib/src/core/request.ts
index e39300a14..ae352c58a 100644
--- a/crates/trusted-server-js/lib/src/core/request.ts
+++ b/crates/trusted-server-js/lib/src/core/request.ts
@@ -1,9 +1,11 @@
 // Request orchestration for tsjs: unified auction endpoint with iframe-based creative rendering.
-import { log } from './log';
+import { renderApsCreative } from '../integrations/aps/render';
+
+import { buildAdRequest, sendAuction } from './auction';
 import { collectContext } from './context';
+import { log } from './log';
 import { getAllUnits, firstSize } from './registry';
 import { createAdIframe, findSlot, buildCreativeDocument, sanitizeCreativeHtml } from './render';
-import { buildAdRequest, sendAuction } from './auction';
 
 export type RequestAdsCallback = () => void;
 export interface RequestAdsOptions {
@@ -49,6 +51,10 @@ export function requestAds(
         log.info('requestAds: got bids', { count: bids.length });
         for (const bid of bids) {
           if (!bid.impid) continue;
+          if (bid.renderer) {
+            renderApsCreative({ slotId: bid.impid, renderer: bid.renderer });
+            continue;
+          }
           if (!bid.adm) {
             log.debug('requestAds: bid has no adm, skipping', { slotId: bid.impid });
             continue;
diff --git a/crates/trusted-server-js/lib/src/core/types.ts b/crates/trusted-server-js/lib/src/core/types.ts
index 6de6959db..7cae70396 100644
--- a/crates/trusted-server-js/lib/src/core/types.ts
+++ b/crates/trusted-server-js/lib/src/core/types.ts
@@ -41,13 +41,45 @@ export interface AuctionDebugBidData {
   height?: number;
   nurl?: string | null;
   burl?: string | null;
+  bid_id?: string | null;
   ad_id?: string | null;
+  creative_id?: string | null;
   cache_id?: string | null;
   cache_host?: string | null;
   cache_path?: string | null;
   metadata?: Record<string, unknown>;
 }
 
+export type ApsTagType = 'iframe' | 'script';
+
+/** Version 1 Trusted Server APS renderer descriptor. */
+export interface ApsRendererV1 {
+  type: 'aps';
+  version: 1;
+  accountId: string;
+  bidId: string;
+  creativeId?: string;
+  tagType: ApsTagType;
+  creativeUrl: string;
+  aaxResponse: string;
+  width: number;
+  height: number;
+}
+
+export type AuctionBidRenderer = ApsRendererV1;
+
+/** A client-side Prebid bid's generated ad ID bound to its APS render capability. */
+export interface ApsPrebidRendererEntry {
+  adUnitCode: string;
+  renderer: ApsRendererV1;
+  registeredAt: number;
+  expiresAt: number;
+  /** Notify Prebid that GAM selected this bid before replying to Universal Creative. */
+  markWinner(): void;
+  /** Mark Prebid's bid rendered after the Universal Creative response is posted. */
+  markRendered(): void;
+}
+
 /** Bid targeting data from the server-side auction, injected into `window.tsjs.bids`. */
 export interface AuctionBidData {
   hb_pb?: string;
@@ -55,27 +87,13 @@ export interface AuctionBidData {
   hb_adid?: string;
   hb_cache_host?: string;
   hb_cache_path?: string;
-  /** Winning creative width; the bridge sizes the inline render from this. */
-  w?: number;
-  /** Winning creative height; the bridge sizes the inline render from this. */
-  h?: number;
   nurl?: string;
   burl?: string;
-  /**
-   * Sanitized winning creative markup for local rendering through the pbRender
-   * bridge. Present whenever the winning bid carried a creative that passed the
-   * server-side sanitize/rewrite boundary; absent when there was no creative or
-   * it was rejected (e.g. over the 1 MiB cap), in which case the bridge falls
-   * back to the PBS Cache coordinates. This is NOT gated by
-   * `inject_adm_for_testing`.
-   */
+  /** Typed winning-bid renderer capability. */
+  renderer?: AuctionBidRenderer;
+  /** Raw creative markup. Only present when `[debug] inject_adm_for_testing = true`. */
   adm?: string;
-  /**
-   * Verbose per-bid debug blob (carries the raw, un-sanitized creative among
-   * other fields). Only present when `[debug] inject_adm_for_testing = true`;
-   * its presence is also the client-side gate for the testing-only direct
-   * GAM-replace path.
-   */
+  /** Debug-only bid field mirror. Only present when `[debug] inject_adm_for_testing = true`. */
   debug_bid?: AuctionDebugBidData;
 }
 
@@ -106,6 +124,11 @@ export interface TsjsApi {
   adSlots?: AuctionSlot[];
   /** Winning bid targeting data injected before </body>. */
   bids?: Record<string, AuctionBidData>;
+  /**
+   * Bounded client-side Prebid APS renderer capabilities keyed by Prebid's generated
+   * `hb_adid`. The Universal Creative bridge consumes each entry at most once.
+   */
+  apsPrebidRenderers?: Record<string, ApsPrebidRendererEntry>;
   /** Initialises GPT slots with server-side bid targeting and calls refresh(). */
   adInit?: () => void;
   /** GPT slot objects TS defined — used to destroy stale slots on SPA navigation. */
diff --git a/crates/trusted-server-js/lib/src/integrations/aps/render.ts b/crates/trusted-server-js/lib/src/integrations/aps/render.ts
new file mode 100644
index 000000000..915b74d3c
--- /dev/null
+++ b/crates/trusted-server-js/lib/src/integrations/aps/render.ts
@@ -0,0 +1,430 @@
+import { log } from '../../core/log';
+import type { ApsPrebidRendererEntry, ApsRendererV1, TsjsApi } from '../../core/types';
+
+export const APS_RENDERER_PATH = '/integrations/aps/renderer';
+export const APS_RENDERER_SANDBOX =
+  'allow-forms allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-scripts allow-top-navigation-by-user-activation';
+export const APS_UNIVERSAL_CREATIVE_RENDERER_VERSION = 4;
+
+const MAX_ACCOUNT_ID_BYTES = 1024;
+const MAX_CREATIVE_ID_BYTES = 1024;
+const MAX_CREATIVE_URL_BYTES = 4096;
+const MAX_RENDER_ENVELOPE_BYTES = 256 * 1024;
+const MAX_RENDER_ENVELOPE_BASE64_BYTES = 4 * Math.ceil(MAX_RENDER_ENVELOPE_BYTES / 3);
+const DESCRIPTOR_KEYS = [
+  'aaxResponse',
+  'accountId',
+  'bidId',
+  'creativeUrl',
+  'height',
+  'tagType',
+  'type',
+  'version',
+  'width',
+] as const;
+const DESCRIPTOR_KEYS_WITH_CREATIVE_ID = [...DESCRIPTOR_KEYS, 'creativeId'].sort();
+const activeFrames = new WeakMap<HTMLElement, HTMLIFrameElement>();
+const pendingFrameCancels = new WeakMap<HTMLElement, () => void>();
+const RENDERER_READY_MESSAGE = 'trusted-server/aps/renderer-ready';
+const RENDERER_FAILED_MESSAGE = 'trusted-server/aps/renderer-failed';
+const RENDERER_READY_TIMEOUT_MS = 10_000;
+const MAX_PREBID_RENDERER_ENTRIES = 256;
+const DEFAULT_PREBID_RENDERER_TTL_SECONDS = 300;
+const MAX_PREBID_RENDERER_TTL_SECONDS = 3600;
+const MAX_PREBID_ID_BYTES = 1024;
+
+type ValidatedRendererCacheEntry = {
+  publisherOrigin: string;
+  renderer: ApsRendererV1;
+};
+const validatedRendererCache = new WeakMap<object, ValidatedRendererCacheEntry>();
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function hasExactKeys(
+  value: unknown,
+  expected: readonly string[]
+): value is Record<string, unknown> {
+  if (!isRecord(value)) return false;
+  const actual = Object.keys(value).sort();
+  const sortedExpected = [...expected].sort();
+  return (
+    actual.length === sortedExpected.length &&
+    actual.every((key, index) => key === sortedExpected[index])
+  );
+}
+
+/** Parse only the versioned descriptor shape; decoded-envelope trust checks happen separately. */
+export function parseApsRendererDescriptor(value: unknown): ApsRendererV1 | undefined {
+  if (
+    !hasExactKeys(value, DESCRIPTOR_KEYS) &&
+    !hasExactKeys(value, DESCRIPTOR_KEYS_WITH_CREATIVE_ID)
+  ) {
+    return undefined;
+  }
+
+  if (
+    value.type !== 'aps' ||
+    value.version !== 1 ||
+    typeof value.accountId !== 'string' ||
+    value.accountId.length === 0 ||
+    new TextEncoder().encode(value.accountId).length > MAX_ACCOUNT_ID_BYTES ||
+    typeof value.bidId !== 'string' ||
+    value.bidId.length === 0 ||
+    (Object.prototype.hasOwnProperty.call(value, 'creativeId') &&
+      (typeof value.creativeId !== 'string' ||
+        value.creativeId.length === 0 ||
+        new TextEncoder().encode(value.creativeId).length > MAX_CREATIVE_ID_BYTES)) ||
+    (value.tagType !== 'iframe' && value.tagType !== 'script') ||
+    typeof value.creativeUrl !== 'string' ||
+    typeof value.aaxResponse !== 'string' ||
+    value.aaxResponse.length > MAX_RENDER_ENVELOPE_BASE64_BYTES ||
+    !Number.isSafeInteger(value.width) ||
+    (value.width as number) <= 0 ||
+    !Number.isSafeInteger(value.height) ||
+    (value.height as number) <= 0
+  ) {
+    return undefined;
+  }
+
+  return value as unknown as ApsRendererV1;
+}
+
+function decodeStandardBase64(value: string): Uint8Array | undefined {
+  if (
+    value.length === 0 ||
+    value.length % 4 !== 0 ||
+    !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)
+  ) {
+    return undefined;
+  }
+
+  try {
+    const binary = atob(value);
+    if (binary.length > MAX_RENDER_ENVELOPE_BYTES || btoa(binary) !== value) return undefined;
+    return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+  } catch {
+    return undefined;
+  }
+}
+
+function validCreativeUrl(value: string, publisherOrigin: string): boolean {
+  if (new TextEncoder().encode(value).length > MAX_CREATIVE_URL_BYTES) return false;
+
+  try {
+    const url = new URL(value);
+    return (
+      url.protocol === 'https:' &&
+      url.username === '' &&
+      url.password === '' &&
+      url.origin !== publisherOrigin
+    );
+  } catch {
+    return false;
+  }
+}
+
+/** Fully validate the exact APS envelope and cross-check every duplicated descriptor field. */
+export function validateApsRenderer(
+  value: unknown,
+  publisherOrigin = window.location.origin
+): ApsRendererV1 | undefined {
+  if (isRecord(value)) {
+    const cached = validatedRendererCache.get(value);
+    if (cached?.publisherOrigin === publisherOrigin) return cached.renderer;
+  }
+
+  const renderer = parseApsRendererDescriptor(value);
+  if (!renderer || !validCreativeUrl(renderer.creativeUrl, publisherOrigin)) return undefined;
+
+  const bytes = decodeStandardBase64(renderer.aaxResponse);
+  if (!bytes) return undefined;
+
+  let decoded: unknown;
+  try {
+    decoded = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+  } catch {
+    return undefined;
+  }
+
+  if (!hasExactKeys(decoded, ['seatbid'])) return undefined;
+  const seatbids = decoded.seatbid;
+  if (!Array.isArray(seatbids) || seatbids.length !== 1) return undefined;
+  const seat = seatbids[0];
+  if (!hasExactKeys(seat, ['bid']) || !Array.isArray(seat.bid) || seat.bid.length !== 1) {
+    return undefined;
+  }
+
+  const bid = seat.bid[0];
+  if (!hasExactKeys(bid, ['ext', 'h', 'id', 'price', 'w'])) return undefined;
+  if (!hasExactKeys(bid.ext, ['creativeurl', 'tagtype'])) return undefined;
+
+  if (
+    bid.id !== renderer.bidId ||
+    bid.w !== renderer.width ||
+    bid.h !== renderer.height ||
+    bid.ext.creativeurl !== renderer.creativeUrl ||
+    bid.ext.tagtype !== renderer.tagType ||
+    typeof bid.price !== 'number' ||
+    !Number.isFinite(bid.price) ||
+    bid.price < 0
+  ) {
+    return undefined;
+  }
+
+  const validated = Object.freeze({ ...renderer }) as ApsRendererV1;
+  validatedRendererCache.set(value as object, { publisherOrigin, renderer: validated });
+  validatedRendererCache.set(validated, { publisherOrigin, renderer: validated });
+  return validated;
+}
+
+function validPrebidIdentity(value: unknown): value is string {
+  return (
+    typeof value === 'string' &&
+    value.length > 0 &&
+    new TextEncoder().encode(value).length <= MAX_PREBID_ID_BYTES
+  );
+}
+
+function validPrebidAdId(value: unknown): value is string {
+  return validPrebidIdentity(value) && /^[A-Za-z0-9-]+$/.test(value);
+}
+
+function prunePrebidRenderers(registry: Record<string, ApsPrebidRendererEntry>, now: number): void {
+  for (const [adId, entry] of Object.entries(registry)) {
+    if (!Number.isFinite(entry.expiresAt) || entry.expiresAt <= now) delete registry[adId];
+  }
+
+  const entries = Object.entries(registry);
+  if (entries.length <= MAX_PREBID_RENDERER_ENTRIES) return;
+  entries
+    .sort(([, left], [, right]) => left.registeredAt - right.registeredAt)
+    .slice(0, entries.length - MAX_PREBID_RENDERER_ENTRIES)
+    .forEach(([adId]) => delete registry[adId]);
+}
+
+/** Bind Prebid's generated ad ID to a fully validated APS renderer capability. */
+export function registerApsPrebidRenderer(
+  adId: unknown,
+  adUnitCode: unknown,
+  input: unknown,
+  ttlSeconds: unknown = DEFAULT_PREBID_RENDERER_TTL_SECONDS,
+  lifecycle?: { markWinner(): void; markRendered(): void }
+): boolean {
+  if (
+    !validPrebidAdId(adId) ||
+    !validPrebidIdentity(adUnitCode) ||
+    typeof lifecycle?.markWinner !== 'function' ||
+    typeof lifecycle.markRendered !== 'function'
+  ) {
+    return false;
+  }
+  const renderer = validateApsRenderer(input);
+  if (!renderer) return false;
+
+  const now = Date.now();
+  const boundedTtlSeconds =
+    typeof ttlSeconds === 'number' && Number.isFinite(ttlSeconds) && ttlSeconds > 0
+      ? Math.min(ttlSeconds, MAX_PREBID_RENDERER_TTL_SECONDS)
+      : DEFAULT_PREBID_RENDERER_TTL_SECONDS;
+  const tsjs = (window.tsjs ??= {} as TsjsApi);
+  const registry = (tsjs.apsPrebidRenderers ??= Object.create(null) as Record<
+    string,
+    ApsPrebidRendererEntry
+  >);
+  prunePrebidRenderers(registry, now);
+
+  if (!(adId in registry) && Object.keys(registry).length >= MAX_PREBID_RENDERER_ENTRIES) {
+    const oldest = Object.entries(registry).sort(
+      ([, left], [, right]) => left.registeredAt - right.registeredAt
+    )[0];
+    if (oldest) delete registry[oldest[0]];
+  }
+
+  registry[adId] = {
+    adUnitCode,
+    renderer,
+    registeredAt: now,
+    expiresAt: now + boundedTtlSeconds * 1000,
+    markWinner: lifecycle.markWinner,
+    markRendered: lifecycle.markRendered,
+  };
+  return true;
+}
+
+/** Return an unexpired Prebid APS capability without consuming it. */
+export function getApsPrebidRenderer(adId: string): ApsPrebidRendererEntry | undefined {
+  if (!validPrebidAdId(adId)) return undefined;
+  const registry = window.tsjs?.apsPrebidRenderers;
+  const entry = registry?.[adId];
+  if (!entry) return undefined;
+  if (
+    !Number.isFinite(entry.expiresAt) ||
+    entry.expiresAt <= Date.now() ||
+    typeof entry.markWinner !== 'function' ||
+    typeof entry.markRendered !== 'function'
+  ) {
+    delete registry![adId];
+    return undefined;
+  }
+  return entry;
+}
+
+/** Atomically consume the exact capability previously returned by the registry. */
+export function consumeApsPrebidRenderer(adId: string, expected: ApsPrebidRendererEntry): boolean {
+  const registry = window.tsjs?.apsPrebidRenderers;
+  if (!registry || registry[adId] !== expected) return false;
+  delete registry[adId];
+  return true;
+}
+
+function createNonce(): string | undefined {
+  if (typeof crypto === 'undefined' || typeof crypto.getRandomValues !== 'function')
+    return undefined;
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  let binary = '';
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+}
+
+/** Return the absolute, same-publisher URL used by direct and Universal Creative rendering. */
+export function apsRendererUrl(pageOrigin = window.location.origin): string | undefined {
+  try {
+    const origin = new URL(pageOrigin);
+    const url = new URL(APS_RENDERER_PATH, origin);
+    if (
+      url.origin !== origin.origin ||
+      url.pathname !== APS_RENDERER_PATH ||
+      url.search !== '' ||
+      url.hash !== ''
+    ) {
+      return undefined;
+    }
+    return url.href;
+  } catch {
+    return undefined;
+  }
+}
+
+export interface RenderApsCreativeOptions {
+  slotId: string;
+  renderer: unknown;
+}
+
+/** Render APS through the static endpoint under an outer opaque-origin sandbox. */
+export function renderApsCreative({ slotId, renderer: input }: RenderApsCreativeOptions): boolean {
+  const renderer = validateApsRenderer(input);
+  const rendererUrl = apsRendererUrl();
+  const nonce = createNonce();
+  if (!renderer || !rendererUrl || !nonce) {
+    log.warn('APS renderer: rejected descriptor');
+    return false;
+  }
+
+  const container = document.getElementById(slotId);
+  if (!container) {
+    log.warn('APS renderer: slot not found');
+    return false;
+  }
+
+  const iframe = document.createElement('iframe');
+  iframe.title = 'Ad content';
+  iframe.width = String(renderer.width);
+  iframe.height = String(renderer.height);
+  iframe.style.border = '0';
+  iframe.style.display = 'none';
+  iframe.setAttribute('sandbox', APS_RENDERER_SANDBOX);
+  iframe.src = `${rendererUrl}#tsaps=${nonce}`;
+
+  // A replacement must cancel a pending frame, not merely detach it: its
+  // message listener and ready timeout would otherwise remain live until expiry.
+  pendingFrameCancels.get(container)?.();
+  activeFrames.set(container, iframe);
+
+  let settled = false;
+  const cleanup = (): void => {
+    window.removeEventListener('message', receive);
+    window.clearTimeout(timeoutId);
+  };
+  const cancel = (): void => {
+    if (settled) return;
+    settled = true;
+    cleanup();
+    if (pendingFrameCancels.get(container) === cancel) pendingFrameCancels.delete(container);
+    if (activeFrames.get(container) === iframe) activeFrames.delete(container);
+    iframe.remove();
+  };
+  const fail = (): void => {
+    if (settled) return;
+    cancel();
+    log.warn('APS renderer: frame load failed');
+  };
+  const commit = (): void => {
+    if (settled || activeFrames.get(container) !== iframe || !iframe.isConnected) return;
+    settled = true;
+    cleanup();
+    if (pendingFrameCancels.get(container) === cancel) pendingFrameCancels.delete(container);
+    for (const child of Array.from(container.children)) {
+      if (child !== iframe) child.remove();
+    }
+    iframe.style.display = '';
+  };
+  function receive(event: MessageEvent): void {
+    if (event.source !== iframe.contentWindow || !hasExactKeys(event.data, ['message', 'nonce'])) {
+      return;
+    }
+    if (event.data.nonce !== nonce) return;
+    if (event.data.message === RENDERER_READY_MESSAGE) commit();
+    else if (event.data.message === RENDERER_FAILED_MESSAGE) fail();
+  }
+
+  window.addEventListener('message', receive);
+  iframe.addEventListener(
+    'load',
+    () => {
+      if (settled || activeFrames.get(container) !== iframe || !iframe.isConnected) return;
+      try {
+        const target = iframe.contentWindow;
+        if (!target) {
+          fail();
+          return;
+        }
+        target.postMessage({ nonce, renderer }, '*');
+      } catch {
+        fail();
+      }
+    },
+    { once: true }
+  );
+  iframe.addEventListener('error', fail, { once: true });
+
+  const timeoutId = window.setTimeout(fail, RENDERER_READY_TIMEOUT_MS);
+  pendingFrameCancels.set(container, cancel);
+  container.appendChild(iframe);
+  return true;
+}
+
+/**
+ * Static source executed by Prebid Universal Creative's dynamic-renderer frame.
+ * It reads only the validated descriptor and trusted absolute endpoint URL from data.
+ */
+export const APS_UNIVERSAL_CREATIVE_RENDERER = String.raw`(function(){window.render=function(d,_h,w){return new Promise(function(resolve,reject){
+try{var r=d&&d.apsRenderer,u=d&&d.rendererUrl;if(!r||typeof u!=="string")throw new Error("invalid APS renderer data");
+var p=new URL(u);if((p.protocol!=="https:"&&p.protocol!=="http:")||p.username||p.password||p.pathname!=="${APS_RENDERER_PATH}"||p.search||p.hash)throw new Error("invalid APS renderer URL");
+var c=w.crypto;if(!c||typeof c.getRandomValues!=="function")throw new Error("APS renderer randomness unavailable");
+var b=new Uint8Array(16);c.getRandomValues(b);var s="";for(var i=0;i<b.length;i++)s+=String.fromCharCode(b[i]);
+var n=w.btoa(s).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"");
+var f=w.document.createElement("iframe"),done=false,t;
+function clean(){w.removeEventListener("message",receive);if(t)w.clearTimeout(t);}
+function fail(){if(done)return;done=true;clean();f.remove();reject(new Error("APS renderer frame failed"));}
+function receive(e){var m=e.data;if(e.source!==f.contentWindow||!m||m.nonce!==n)return;
+if(m.message==="${RENDERER_READY_MESSAGE}"){done=true;clean();resolve();}
+else if(m.message==="${RENDERER_FAILED_MESSAGE}")fail();}
+f.width=String(r.width);f.height=String(r.height);f.style.border="0";
+f.setAttribute("sandbox","${APS_RENDERER_SANDBOX}");
+f.src=p.href+"#tsaps="+n;f.onload=function(){if(!done&&f.contentWindow)f.contentWindow.postMessage({nonce:n,renderer:r},"*");};
+f.onerror=fail;w.addEventListener("message",receive);t=w.setTimeout(fail,${RENDERER_READY_TIMEOUT_MS});w.document.body.appendChild(f);
+}catch(e){reject(e);}});};})();`;
diff --git a/crates/trusted-server-js/lib/src/integrations/gpt/index.ts b/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
index f62eb2057..169aa3afb 100644
--- a/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
+++ b/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
@@ -1,5 +1,13 @@
 import { log } from '../../core/log';
 import type { AuctionSlot, AuctionBidData, TsjsApi } from '../../core/types';
+import {
+  APS_UNIVERSAL_CREATIVE_RENDERER,
+  APS_UNIVERSAL_CREATIVE_RENDERER_VERSION,
+  apsRendererUrl,
+  consumeApsPrebidRenderer,
+  getApsPrebidRenderer,
+  validateApsRenderer,
+} from '../aps/render';
 
 import { installGptGuard } from './script_guard';
 
@@ -84,13 +92,30 @@ function slotIdForMessageSource(source: MessageEventSource | null): string | und
   if (!source) return undefined;
 
   const slots = window.tsjs?.adSlots ?? [];
-  return slots.find((slot) =>
-    candidateSlotRoots(slot.div_id).some((root) =>
+  const ownsSource = (roots: HTMLElement[]): boolean =>
+    roots.some((root) =>
       Array.from(root.querySelectorAll('iframe')).some((iframe) => iframe.contentWindow === source)
-    )
+    );
+  // Prefer exact configured IDs before prefix/container fallbacks so a nested
+  // dynamic slot cannot be claimed by an overlapping parent slot.
+  return (
+    slots.find((slot) => {
+      const root = document.getElementById(slot.div_id);
+      return root !== null && ownsSource([root]);
+    }) ?? slots.find((slot) => ownsSource(candidateSlotRoots(slot.div_id)))
   )?.id;
 }
 
+function messageSourceBelongsToAdUnit(
+  source: MessageEventSource | null,
+  adUnitCode: string
+): boolean {
+  if (!source) return false;
+  return candidateSlotRoots(adUnitCode).some((root) =>
+    Array.from(root.querySelectorAll('iframe')).some((iframe) => iframe.contentWindow === source)
+  );
+}
+
 function clearTargetingKeys(slot: GoogleTagSlot, keys: Iterable<string>): void {
   if (typeof slot.clearTargeting !== 'function') return;
 
@@ -563,7 +588,10 @@ export function installTsAdInit(): void {
         // APS: signal to apstag that bids are ready so Amazon's GAM creative
         // can render.  apstag must already be initialised on the page (which it
         // is on production publisher pages).  Safe no-op if apstag is absent.
-        if (bid.hb_bidder === 'aps' || bid.hb_bidder === 'amazon-aps') {
+        if (
+          (bid.hb_bidder === 'aps' || bid.hb_bidder === 'amazon-aps') &&
+          bid.renderer === undefined
+        ) {
           // eslint-disable-next-line @typescript-eslint/no-explicit-any
           (window as any).apstag?.setDisplayBids?.();
         }
@@ -1014,6 +1042,7 @@ export function installTsRenderBridge(): void {
   // is scoped to the slot, not the bare adId: hb_adid is not unique per bid, so
   // keying on it alone would let one slot block a distinct slot's render.
   const renderingKeys = new Set<string>();
+  const consumedPrebidApsIds = new Map<string, { expiresAt: number }>();
 
   window.addEventListener('message', (e: MessageEvent) => {
     let data: Record<string, unknown>;
@@ -1032,6 +1061,50 @@ export function installTsRenderBridge(): void {
 
     const port = e.ports?.[0];
     if (!port) return;
+
+    const now = Date.now();
+    for (const [consumedAdId, consumed] of consumedPrebidApsIds) {
+      if (consumed.expiresAt <= now) consumedPrebidApsIds.delete(consumedAdId);
+    }
+    const consumedPrebidAps = consumedPrebidApsIds.get(adId);
+    if (consumedPrebidAps) {
+      // Once TS claims an APS capability, keep the ad ID unavailable to every
+      // other iframe. Letting Prebid's global handler answer a foreign source
+      // would expose the creative despite the slot-bound capability check.
+      e.stopImmediatePropagation();
+      return;
+    }
+
+    const prebidRendererEntry = getApsPrebidRenderer(adId);
+    if (prebidRendererEntry) {
+      // Fail closed for a TS-owned APS ad ID before checking its source. Native
+      // Prebid handles ad IDs globally and would otherwise answer a request from
+      // an unrelated iframe when this slot-bound capability rejects it.
+      e.stopImmediatePropagation();
+      if (!messageSourceBelongsToAdUnit(e.source, prebidRendererEntry.adUnitCode)) return;
+      const renderer = validateApsRenderer(prebidRendererEntry.renderer);
+      const rendererUrl = apsRendererUrl();
+      if (!renderer || !rendererUrl || !consumeApsPrebidRenderer(adId, prebidRendererEntry)) return;
+      consumedPrebidApsIds.set(adId, {
+        expiresAt: prebidRendererEntry.expiresAt,
+      });
+      prebidRendererEntry.markWinner();
+      port.postMessage(
+        JSON.stringify({
+          message: 'Prebid Response',
+          adId,
+          renderer: APS_UNIVERSAL_CREATIVE_RENDERER,
+          rendererVersion: APS_UNIVERSAL_CREATIVE_RENDERER_VERSION,
+          rendererUrl,
+          apsRenderer: renderer,
+          width: renderer.width,
+          height: renderer.height,
+        })
+      );
+      prebidRendererEntry.markRendered();
+      return;
+    }
+
     const sourceSlotId = slotIdForMessageSource(e.source);
     if (!sourceSlotId) return;
 
@@ -1048,6 +1121,26 @@ export function installTsRenderBridge(): void {
     // pulling slot B's creative and firing slot B's win/billing beacons.
     if (!matchedBid || matchedBid.hb_adid !== adId) return;
 
+    if (matchedBid.renderer !== undefined) {
+      const renderer = validateApsRenderer(matchedBid.renderer);
+      const rendererUrl = apsRendererUrl();
+      if (!renderer || !rendererUrl) return;
+      e.stopImmediatePropagation();
+      port.postMessage(
+        JSON.stringify({
+          message: 'Prebid Response',
+          adId,
+          renderer: APS_UNIVERSAL_CREATIVE_RENDERER,
+          rendererVersion: APS_UNIVERSAL_CREATIVE_RENDERER_VERSION,
+          rendererUrl,
+          apsRenderer: renderer,
+          width: renderer.width,
+          height: renderer.height,
+        })
+      );
+      return;
+    }
+
     const slot = window.tsjs?.adSlots?.find((s) => s.id === slotId);
     // Prefer the winning creative's own dimensions; the first configured slot
     // format is only a fallback and mis-sizes a multi-size slot whose winner is
diff --git a/crates/trusted-server-js/lib/src/integrations/prebid/index.ts b/crates/trusted-server-js/lib/src/integrations/prebid/index.ts
index f5267cac6..024ec6d22 100644
--- a/crates/trusted-server-js/lib/src/integrations/prebid/index.ts
+++ b/crates/trusted-server-js/lib/src/integrations/prebid/index.ts
@@ -13,6 +13,7 @@
 
 import pbjs from 'prebid.js';
 import adapterManager from 'prebid.js/src/adapterManager.js';
+import { markBidAsRendered, markWinner } from 'prebid.js/src/adRendering.js';
 import 'prebid.js/modules/consentManagementTcf.js';
 import 'prebid.js/modules/consentManagementGpp.js';
 import 'prebid.js/modules/consentManagementUsp.js';
@@ -28,6 +29,7 @@ import './_adapters.generated';
 
 import { log } from '../../core/log';
 import { buildAdRequest, parseAuctionResponse } from '../../core/auction';
+import { registerApsPrebidRenderer, validateApsRenderer } from '../aps/render';
 import type { AuctionBid, AuctionEid } from '../../core/auction';
 import type { AuctionSlot } from '../../core/types';
 
@@ -35,6 +37,9 @@ import { INCLUDED_PREBID_USER_ID_MODULES } from './_user_ids.generated';
 import { PREBID_USER_ID_MODULE_REGISTRY } from './user_id_modules';
 
 const ADAPTER_CODE = 'trustedServer';
+const APS_BIDDER_CODE = 'aps';
+const APS_RENDERER_FIELD = 'trustedServerRenderer';
+const APS_BID_RESPONSE_LISTENER_SENTINEL = '__tsApsBidResponseListenerInstalled';
 // OpenRTB permits vendor-specific agent types; PAIR uses 571187.
 // Keep this range aligned with the signed 32-bit Rust/OpenRTB representation.
 const MAX_OPENRTB_ATYPE = 2_147_483_647;
@@ -207,23 +212,35 @@ export function auctionBidsToPrebidBids(auctionBids: AuctionBid[], bidRequests:
     }
   }
 
-  return auctionBids.map((bid) => {
+  return auctionBids.flatMap((bid) => {
+    // Prebid admission is the last point before the descriptor becomes a bid
+    // capability. Drop malformed APS bids rather than letting them participate
+    // in the auction without a render path.
+    const renderer = bid.renderer ? validateApsRenderer(bid.renderer) : undefined;
+    if (bid.renderer && !renderer) {
+      log.warn(`[tsjs-prebid] dropped invalid APS renderer bid for '${bid.impid}'`);
+      return [];
+    }
+
     const origReq = requestsByCode.get(bid.impid);
-    return {
-      requestId: origReq?.bidId ?? bid.impid,
-      cpm: bid.price,
-      width: bid.width,
-      height: bid.height,
-      ad: bid.adm,
-      ttl: 300,
-      creativeId: bid.creativeId,
-      netRevenue: true,
-      currency: 'USD',
-      bidderCode: bid.seat,
-      meta: {
-        advertiserDomains: bid.adomain,
+    return [
+      {
+        requestId: origReq?.bidId ?? bid.impid,
+        cpm: bid.price,
+        width: bid.width,
+        height: bid.height,
+        ad: renderer ? '' : bid.adm,
+        ...(renderer ? { [APS_RENDERER_FIELD]: renderer } : {}),
+        ttl: 300,
+        creativeId: bid.creativeId,
+        netRevenue: true,
+        currency: 'USD',
+        bidderCode: bid.seat,
+        meta: {
+          advertiserDomains: bid.adomain,
+        },
       },
-    };
+    ];
   });
 }
 
@@ -803,6 +820,41 @@ function collectAuctionEids(): AuctionEid[] | undefined {
  * 1. `window.__tsjs_prebid` — injected by the server from trusted-server.toml
  * 2. `config` argument — explicit overrides from the publisher's JS
  */
+function installApsBidResponseRegistry(): void {
+  const prebid = pbjs as typeof pbjs & Record<string, unknown>;
+  if (prebid[APS_BID_RESPONSE_LISTENER_SENTINEL] === true) return;
+
+  pbjs.onEvent('bidResponse', (rawBid) => {
+    const bid = rawBid as unknown as Record<string, unknown>;
+    const renderer = bid[APS_RENDERER_FIELD];
+    if (
+      bid['adapterCode'] !== ADAPTER_CODE ||
+      bid['bidderCode'] !== APS_BIDDER_CODE ||
+      renderer === undefined
+    ) {
+      return;
+    }
+
+    const registered = registerApsPrebidRenderer(
+      bid['adId'],
+      bid['adUnitCode'],
+      renderer,
+      bid['ttl'],
+      {
+        markWinner: () => markWinner(rawBid),
+        markRendered: () => markBidAsRendered(rawBid),
+      }
+    );
+    // Keep the executable capability only in the bounded, one-time registry. Prebid
+    // still owns the generated ad ID and ordinary GAM targeting on this bid object.
+    delete bid[APS_RENDERER_FIELD];
+    if (!registered) {
+      log.warn('[tsjs-prebid] rejected APS renderer capability that failed registration');
+    }
+  });
+  prebid[APS_BID_RESPONSE_LISTENER_SENTINEL] = true;
+}
+
 export function installPrebidNpm(config?: Partial<PrebidNpmConfig>): typeof pbjs {
   publisherAdUnitSnapshots = new Map();
   pendingPublisherBids = new Map();
@@ -831,6 +883,7 @@ export function installPrebidNpm(config?: Partial<PrebidNpmConfig>): typeof pbjs
   };
 
   auctionEndpoint = merged.endpoint ?? '/auction';
+  installApsBidResponseRegistry();
 
   // Register the trustedServer adapter using pbjs.registerBidAdapter(null, code, spec)
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
diff --git a/crates/trusted-server-js/lib/src/integrations/prebid/prebid_modules/aliases.d.ts b/crates/trusted-server-js/lib/src/integrations/prebid/prebid_modules/aliases.d.ts
index e725a80f8..8280ea216 100644
--- a/crates/trusted-server-js/lib/src/integrations/prebid/prebid_modules/aliases.d.ts
+++ b/crates/trusted-server-js/lib/src/integrations/prebid/prebid_modules/aliases.d.ts
@@ -3,3 +3,8 @@ declare module 'tsjs-prebid/liveIntentIdSystemStandard';
 declare module 'tsjs-prebid/prebidGlobal' {
   export function registerModule(name: string): void;
 }
+
+declare module 'prebid.js/src/adRendering.js' {
+  export function markBidAsRendered(bid: unknown): void;
+  export function markWinner(bid: unknown): void;
+}
diff --git a/crates/trusted-server-js/lib/test/core/auction.test.ts b/crates/trusted-server-js/lib/test/core/auction.test.ts
index 31e020eff..7e9bb2947 100644
--- a/crates/trusted-server-js/lib/test/core/auction.test.ts
+++ b/crates/trusted-server-js/lib/test/core/auction.test.ts
@@ -1,5 +1,22 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { buildAdRequest, parseAuctionResponse, sendAuction } from '../../src/core/auction';
+import envelope from '../fixtures/aps-renderer-v1.json';
+
+function apsRenderer(creativeId?: string) {
+  const bid = envelope.seatbid[0].bid[0];
+  return {
+    type: 'aps' as const,
+    version: 1 as const,
+    accountId: 'example-account-id',
+    bidId: bid.id,
+    ...(creativeId ? { creativeId } : {}),
+    tagType: 'iframe' as const,
+    creativeUrl: bid.ext.creativeurl,
+    aaxResponse: btoa(JSON.stringify(envelope)),
+    width: bid.w,
+    height: bid.h,
+  };
+}
 
 describe('auction/buildAdRequest', () => {
   it('builds from tsjs AdUnit objects', () => {
@@ -174,6 +191,83 @@ describe('auction/parseAuctionResponse', () => {
     });
   });
 
+  it('parses an APS typed renderer without requiring adm', () => {
+    const renderer = apsRenderer('fictional-creative-id');
+    const bids = parseAuctionResponse({
+      seatbid: [
+        {
+          seat: 'aps',
+          bid: [
+            {
+              id: renderer.bidId,
+              impid: 'fictional-slot',
+              price: 1.23,
+              crid: renderer.creativeId,
+              w: 300,
+              h: 250,
+              ext: { trusted_server: { renderer } },
+            },
+          ],
+        },
+      ],
+    });
+
+    expect(bids).toHaveLength(1);
+    expect(bids[0]).toEqual(
+      expect.objectContaining({
+        impid: 'fictional-slot',
+        adm: '',
+        renderer,
+        width: 300,
+        height: 250,
+        creativeId: 'fictional-creative-id',
+      })
+    );
+  });
+
+  it('parses an APS renderer with optional creativeId omitted', () => {
+    const renderer = apsRenderer();
+    const bids = parseAuctionResponse({
+      seatbid: [
+        {
+          seat: 'aps',
+          bid: [
+            {
+              impid: 'fictional-slot',
+              price: 1.23,
+              w: 300,
+              h: 250,
+              ext: { trusted_server: { renderer } },
+            },
+          ],
+        },
+      ],
+    });
+
+    expect(bids[0].renderer).toEqual(renderer);
+    expect(bids[0].creativeId).toBe('aps-fictional-slot');
+  });
+
+  it('ignores unrelated or malformed renderer extensions while retaining ordinary adm', () => {
+    const bids = parseAuctionResponse({
+      seatbid: [
+        {
+          seat: 'ordinary',
+          bid: [
+            {
+              impid: 'slot-1',
+              adm: '<div>ordinary</div>',
+              ext: { trusted_server: { renderer: { type: 'aps', version: 99 } } },
+            },
+          ],
+        },
+      ],
+    });
+
+    expect(bids[0].renderer).toBeUndefined();
+    expect(bids[0].adm).toBe('<div>ordinary</div>');
+  });
+
   it('handles multiple seatbids with multiple bids', () => {
     const body = {
       seatbid: [
diff --git a/crates/trusted-server-js/lib/test/core/request.test.ts b/crates/trusted-server-js/lib/test/core/request.test.ts
index 2c56361dc..8dffd825b 100644
--- a/crates/trusted-server-js/lib/test/core/request.test.ts
+++ b/crates/trusted-server-js/lib/test/core/request.test.ts
@@ -1,4 +1,5 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import envelope from '../fixtures/aps-renderer-v1.json';
 
 async function flushRequestAds(): Promise<void> {
   await new Promise((resolve) => setTimeout(resolve, 0));
@@ -66,6 +67,107 @@ describe('request.requestAds', () => {
     );
   });
 
+  it('dispatches a valid APS descriptor to the opaque static renderer route', async () => {
+    const apsBid = envelope.seatbid[0].bid[0];
+    const renderer = {
+      type: 'aps',
+      version: 1,
+      accountId: 'example-account-id',
+      bidId: apsBid.id,
+      tagType: apsBid.ext.tagtype,
+      creativeUrl: apsBid.ext.creativeurl,
+      aaxResponse: btoa(JSON.stringify(envelope)),
+      width: apsBid.w,
+      height: apsBid.h,
+    };
+    (globalThis as any).fetch = vi.fn().mockResolvedValue({
+      ok: true,
+      status: 200,
+      headers: { get: () => 'application/json' },
+      json: async () => ({
+        seatbid: [
+          {
+            seat: 'aps',
+            bid: [
+              {
+                impid: 'slot1',
+                price: 1.23,
+                w: 300,
+                h: 250,
+                ext: { trusted_server: { renderer } },
+              },
+            ],
+          },
+        ],
+      }),
+    });
+
+    const { addAdUnits } = await import('../../src/core/registry');
+    const { requestAds } = await import('../../src/core/request');
+    document.body.innerHTML = '<div id="slot1"><span>existing</span></div>';
+    addAdUnits({ code: 'slot1', mediaTypes: { banner: { sizes: [[300, 250]] } } } as any);
+
+    requestAds();
+    await flushRequestAds();
+
+    const iframe = document.querySelector('#slot1 iframe') as HTMLIFrameElement | null;
+    expect(iframe).not.toBeNull();
+    expect(iframe!.src).toContain('/integrations/aps/renderer#tsaps=');
+    expect(iframe!.srcdoc).toBe('');
+    expect(iframe!.getAttribute('sandbox')).not.toContain('allow-same-origin');
+    expect(document.querySelector('#slot1 span')).not.toBeNull();
+
+    const postMessage = vi.spyOn(iframe!.contentWindow!, 'postMessage');
+    iframe!.dispatchEvent(new Event('load'));
+    expect(document.querySelector('#slot1 span')).not.toBeNull();
+    expect(postMessage).toHaveBeenCalledWith(expect.objectContaining({ renderer }), '*');
+
+    const message = postMessage.mock.calls[0][0] as { nonce: string };
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        data: { message: 'trusted-server/aps/renderer-ready', nonce: message.nonce },
+        source: iframe!.contentWindow,
+      })
+    );
+    expect(document.querySelector('#slot1 span')).toBeNull();
+  });
+
+  it('does not mutate the slot for an invalid APS descriptor', async () => {
+    (globalThis as any).fetch = vi.fn().mockResolvedValue({
+      ok: true,
+      status: 200,
+      headers: { get: () => 'application/json' },
+      json: async () => ({
+        seatbid: [
+          {
+            seat: 'aps',
+            bid: [
+              {
+                impid: 'slot1',
+                ext: {
+                  trusted_server: {
+                    renderer: { type: 'aps', version: 1, aaxResponse: 'invalid' },
+                  },
+                },
+              },
+            ],
+          },
+        ],
+      }),
+    });
+
+    const { addAdUnits } = await import('../../src/core/registry');
+    const { requestAds } = await import('../../src/core/request');
+    document.body.innerHTML = '<div id="slot1"><span>existing</span></div>';
+    addAdUnits({ code: 'slot1', mediaTypes: { banner: { sizes: [[300, 250]] } } } as any);
+
+    requestAds();
+    await flushRequestAds();
+
+    expect(document.querySelector('#slot1 iframe')).toBeNull();
+    expect(document.querySelector('#slot1 span')).not.toBeNull();
+  });
+
   it('does not render on non-JSON response', async () => {
     (globalThis as any).fetch = vi.fn().mockResolvedValue({
       ok: true,
diff --git a/crates/trusted-server-js/lib/test/fixtures/aps-renderer-v1.json b/crates/trusted-server-js/lib/test/fixtures/aps-renderer-v1.json
new file mode 100644
index 000000000..f970ac68c
--- /dev/null
+++ b/crates/trusted-server-js/lib/test/fixtures/aps-renderer-v1.json
@@ -0,0 +1,18 @@
+{
+  "seatbid": [
+    {
+      "bid": [
+        {
+          "id": "fictional-selected-bid-id",
+          "price": 1.23,
+          "w": 300,
+          "h": 250,
+          "ext": {
+            "creativeurl": "https://creative.example/render",
+            "tagtype": "iframe"
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts b/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts
new file mode 100644
index 000000000..4014deebb
--- /dev/null
+++ b/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts
@@ -0,0 +1,498 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import envelope from '../../fixtures/aps-renderer-v1.json';
+import type { ApsRendererV1 } from '../../../src/core/types';
+import { log } from '../../../src/core/log';
+import {
+  APS_RENDERER_PATH,
+  APS_RENDERER_SANDBOX,
+  APS_UNIVERSAL_CREATIVE_RENDERER,
+  APS_UNIVERSAL_CREATIVE_RENDERER_VERSION,
+  apsRendererUrl,
+  getApsPrebidRenderer,
+  parseApsRendererDescriptor,
+  registerApsPrebidRenderer,
+  renderApsCreative,
+  validateApsRenderer,
+} from '../../../src/integrations/aps/render';
+
+function encodeBytes(bytes: Uint8Array): string {
+  let binary = '';
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}
+
+function encodeEnvelope(value: unknown): string {
+  return encodeBytes(new TextEncoder().encode(JSON.stringify(value)));
+}
+
+function encodeEnvelopeAtSize(size: number): string {
+  const serialized = JSON.stringify(envelope);
+  const padding = size - new TextEncoder().encode(serialized).length;
+  if (padding < 0) throw new Error('requested envelope size is too small');
+  return encodeBytes(new TextEncoder().encode(`${serialized}${' '.repeat(padding)}`));
+}
+
+function descriptor(overrides: Partial<ApsRendererV1> = {}): ApsRendererV1 {
+  const bid = envelope.seatbid[0].bid[0];
+  return {
+    type: 'aps',
+    version: 1,
+    accountId: 'example-account-id',
+    bidId: bid.id,
+    creativeId: 'fictional-creative-id',
+    tagType: bid.ext.tagtype as 'iframe',
+    creativeUrl: bid.ext.creativeurl,
+    aaxResponse: encodeEnvelope(envelope),
+    width: bid.w,
+    height: bid.h,
+    ...overrides,
+  };
+}
+
+describe('APS renderer validation', () => {
+  it('consumes the shared fictional golden envelope and supports an omitted creative ID', () => {
+    const withCreativeId = descriptor();
+    const withoutCreativeId = descriptor();
+    delete withoutCreativeId.creativeId;
+
+    expect(validateApsRenderer(withCreativeId)).toEqual(withCreativeId);
+    expect(validateApsRenderer(withoutCreativeId)).toEqual(withoutCreativeId);
+  });
+
+  it('caches an immutable validated descriptor for the same publisher origin', () => {
+    const input = descriptor();
+    const atobSpy = vi.spyOn(window, 'atob');
+
+    const first = validateApsRenderer(input, 'https://publisher.example');
+    input.width = 728;
+    const second = validateApsRenderer(first, 'https://publisher.example');
+
+    expect(first?.width).toBe(300);
+    expect(first).toBe(second);
+    expect(Object.isFrozen(first)).toBe(true);
+    expect(atobSpy).toHaveBeenCalledTimes(1);
+    expect(() => {
+      first!.width = 728;
+    }).toThrow(TypeError);
+
+    expect(validateApsRenderer(first, 'https://other-publisher.example')).toBeDefined();
+    expect(atobSpy).toHaveBeenCalledTimes(2);
+    atobSpy.mockRestore();
+  });
+
+  it('keeps auction parsing structural and leaves complete trust validation to render time', () => {
+    const renderer = descriptor({ aaxResponse: 'not-base64' });
+
+    expect(parseApsRendererDescriptor(renderer)).toEqual(renderer);
+    expect(validateApsRenderer(renderer)).toBeUndefined();
+  });
+
+  it.each([
+    ['unknown root field', { ...envelope, id: 'forbidden' }],
+    ['sibling seat', { seatbid: [...envelope.seatbid, envelope.seatbid[0]] }],
+    [
+      'sibling bid',
+      { seatbid: [{ bid: [...envelope.seatbid[0].bid, envelope.seatbid[0].bid[0]] }] },
+    ],
+    [
+      'markup',
+      {
+        seatbid: [
+          { bid: [{ ...envelope.seatbid[0].bid[0], adm: '<script>forbidden()</script>' }] },
+        ],
+      },
+    ],
+    [
+      'notification',
+      { seatbid: [{ bid: [{ ...envelope.seatbid[0].bid[0], nurl: 'https://notify.example' }] }] },
+    ],
+    [
+      'unknown extension',
+      {
+        seatbid: [
+          {
+            bid: [
+              {
+                ...envelope.seatbid[0].bid[0],
+                ext: { ...envelope.seatbid[0].bid[0].ext, userSyncs: [] },
+              },
+            ],
+          },
+        ],
+      },
+    ],
+  ])('rejects an envelope containing %s', (_name, invalidEnvelope) => {
+    expect(
+      validateApsRenderer(descriptor({ aaxResponse: encodeEnvelope(invalidEnvelope) }))
+    ).toBeUndefined();
+  });
+
+  it.each([
+    ['bid ID', { bidId: 'another-bid' }],
+    ['width', { width: 728 }],
+    ['height', { height: 90 }],
+    ['creative URL', { creativeUrl: 'https://other.example/render' }],
+    ['tag type', { tagType: 'script' as const }],
+  ])('rejects a descriptor/envelope %s mismatch', (_name, override) => {
+    expect(validateApsRenderer(descriptor(override))).toBeUndefined();
+  });
+
+  it.each([
+    'not-base64',
+    'e30',
+    '====',
+    'Zh==',
+    btoa(String.fromCharCode(0xc3, 0x28)),
+    btoa('{not json}'),
+  ])('rejects invalid base64, UTF-8, JSON, or non-canonical padding', (aaxResponse) => {
+    expect(validateApsRenderer(descriptor({ aaxResponse }))).toBeUndefined();
+  });
+
+  it('rejects non-canonical trailing bits that decode to the valid envelope', () => {
+    const canonical = encodeBytes(new TextEncoder().encode(`${JSON.stringify(envelope)} `));
+    const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+    const finalDataIndex = canonical.length - 3;
+    const canonicalIndex = alphabet.indexOf(canonical[finalDataIndex]);
+    const nonCanonical = `${canonical.slice(0, finalDataIndex)}${alphabet[canonicalIndex + 1]}==`;
+
+    expect(atob(nonCanonical)).toBe(atob(canonical));
+    expect(validateApsRenderer(descriptor({ aaxResponse: canonical }))).toBeDefined();
+    expect(validateApsRenderer(descriptor({ aaxResponse: nonCanonical }))).toBeUndefined();
+  });
+
+  it.each([
+    'http://creative.example/render',
+    'https://user:password@creative.example/render',
+    `${window.location.origin}/creative`,
+  ])('rejects an unsafe creative URL', (creativeUrl) => {
+    const invalidEnvelope = structuredClone(envelope);
+    invalidEnvelope.seatbid[0].bid[0].ext.creativeurl = creativeUrl;
+    expect(
+      validateApsRenderer(descriptor({ creativeUrl, aaxResponse: encodeEnvelope(invalidEnvelope) }))
+    ).toBeUndefined();
+  });
+
+  it('rejects unknown descriptor fields and version mismatches', () => {
+    expect(
+      parseApsRendererDescriptor({ ...descriptor(), adm: '<div>forbidden</div>' })
+    ).toBeUndefined();
+    expect(parseApsRendererDescriptor({ ...descriptor(), version: 2 })).toBeUndefined();
+  });
+
+  it('enforces account and creative ID UTF-8 byte limits', () => {
+    expect(validateApsRenderer(descriptor({ accountId: 'é'.repeat(512) }))).toBeDefined();
+    expect(validateApsRenderer(descriptor({ accountId: `${'é'.repeat(512)}x` }))).toBeUndefined();
+    expect(validateApsRenderer(descriptor({ creativeId: 'é'.repeat(512) }))).toBeDefined();
+    expect(validateApsRenderer(descriptor({ creativeId: `${'é'.repeat(512)}x` }))).toBeUndefined();
+  });
+
+  it('enforces the creative URL UTF-8 byte limit', () => {
+    const prefix = 'https://creative.example/';
+    const atLimit = `${prefix}${'a'.repeat(4096 - prefix.length)}`;
+    const overLimit = `${atLimit}x`;
+    const atLimitEnvelope = structuredClone(envelope);
+    atLimitEnvelope.seatbid[0].bid[0].ext.creativeurl = atLimit;
+    const overLimitEnvelope = structuredClone(envelope);
+    overLimitEnvelope.seatbid[0].bid[0].ext.creativeurl = overLimit;
+
+    expect(
+      validateApsRenderer(
+        descriptor({ creativeUrl: atLimit, aaxResponse: encodeEnvelope(atLimitEnvelope) })
+      )
+    ).toBeDefined();
+    expect(
+      validateApsRenderer(
+        descriptor({ creativeUrl: overLimit, aaxResponse: encodeEnvelope(overLimitEnvelope) })
+      )
+    ).toBeUndefined();
+  });
+
+  it('accepts the maximum decoded envelope and rejects one byte over', () => {
+    const atLimit = encodeEnvelopeAtSize(256 * 1024);
+    const overLimit = encodeEnvelopeAtSize(256 * 1024 + 1);
+
+    expect(atLimit).toHaveLength(349528);
+    expect(overLimit).toHaveLength(349528);
+    expect(validateApsRenderer(descriptor({ aaxResponse: atLimit }))).toBeDefined();
+    expect(validateApsRenderer(descriptor({ aaxResponse: overLimit }))).toBeUndefined();
+    expect(
+      parseApsRendererDescriptor(descriptor({ aaxResponse: `${atLimit}AAAA` }))
+    ).toBeUndefined();
+  });
+});
+
+describe('Prebid APS renderer registry', () => {
+  afterEach(() => {
+    delete window.tsjs;
+  });
+
+  it('bounds entries and evicts the oldest capability', () => {
+    for (let index = 0; index <= 256; index += 1) {
+      expect(
+        registerApsPrebidRenderer(`prebid-${index}`, 'fictional-slot', descriptor(), 300, {
+          markWinner: vi.fn(),
+          markRendered: vi.fn(),
+        })
+      ).toBe(true);
+    }
+
+    expect(Object.keys(window.tsjs?.apsPrebidRenderers ?? {})).toHaveLength(256);
+    expect(getApsPrebidRenderer('prebid-0')).toBeUndefined();
+    expect(getApsPrebidRenderer('prebid-256')).toEqual(
+      expect.objectContaining({ adUnitCode: 'fictional-slot', renderer: descriptor() })
+    );
+  });
+
+  it('rejects unsafe Prebid IDs and invalid descriptors', () => {
+    const lifecycle = { markWinner: vi.fn(), markRendered: vi.fn() };
+    expect(
+      registerApsPrebidRenderer('__proto__', 'fictional-slot', descriptor(), 300, lifecycle)
+    ).toBe(false);
+    expect(
+      registerApsPrebidRenderer(
+        'safe-prebid-id',
+        'fictional-slot',
+        descriptor({ aaxResponse: 'invalid' }),
+        300,
+        lifecycle
+      )
+    ).toBe(false);
+    expect(window.tsjs?.apsPrebidRenderers).toBeUndefined();
+  });
+});
+
+describe('direct APS rendering', () => {
+  beforeEach(() => {
+    document.body.innerHTML = '<div id="fictional-slot"><span>existing</span></div>';
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+    document.body.innerHTML = '';
+  });
+
+  it('loads the static route with a fragment-bound 128-bit nonce and opaque sandbox', () => {
+    expect(renderApsCreative({ slotId: 'fictional-slot', renderer: descriptor() })).toBe(true);
+
+    const slot = document.getElementById('fictional-slot')!;
+    const iframe = slot.querySelector('iframe')!;
+    const existing = slot.querySelector('span');
+    expect(existing).not.toBeNull();
+    expect(iframe.src).toMatch(/\/integrations\/aps\/renderer#tsaps=[A-Za-z0-9_-]{22}$/);
+    expect(iframe.getAttribute('sandbox')).toBe(APS_RENDERER_SANDBOX);
+    expect(iframe.getAttribute('sandbox')).not.toContain('allow-same-origin');
+    expect(iframe.srcdoc).toBe('');
+
+    const postMessage = vi.spyOn(iframe.contentWindow!, 'postMessage');
+    iframe.dispatchEvent(new Event('load'));
+
+    expect(slot.querySelector('span')).not.toBeNull();
+    expect(iframe.style.display).toBe('none');
+    expect(postMessage).toHaveBeenCalledTimes(1);
+    expect(postMessage).toHaveBeenCalledWith(
+      {
+        nonce: expect.stringMatching(/^[A-Za-z0-9_-]{22}$/),
+        renderer: descriptor(),
+      },
+      '*'
+    );
+
+    const message = postMessage.mock.calls[0][0] as { nonce: string };
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        data: {
+          message: 'trusted-server/aps/renderer-ready',
+          nonce: `wrong-${message.nonce}`,
+        },
+        source: iframe.contentWindow,
+      })
+    );
+    expect(slot.querySelector('span')).not.toBeNull();
+
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        data: { message: 'trusted-server/aps/renderer-ready', nonce: message.nonce },
+        source: iframe.contentWindow,
+      })
+    );
+    expect(slot.querySelector('span')).toBeNull();
+    expect(iframe.style.display).toBe('');
+  });
+
+  it('rejects a ready message with the correct nonce from a foreign window', () => {
+    expect(renderApsCreative({ slotId: 'fictional-slot', renderer: descriptor() })).toBe(true);
+
+    const slot = document.getElementById('fictional-slot')!;
+    const rendererFrame = slot.querySelector('iframe')!;
+    const postMessage = vi.spyOn(rendererFrame.contentWindow!, 'postMessage');
+    rendererFrame.dispatchEvent(new Event('load'));
+    const sent = postMessage.mock.calls[0][0] as { nonce: string };
+    const foreignFrame = document.createElement('iframe');
+    document.body.appendChild(foreignFrame);
+
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        data: { message: 'trusted-server/aps/renderer-ready', nonce: sent.nonce },
+        source: foreignFrame.contentWindow,
+      })
+    );
+
+    expect(slot.querySelector('span')).not.toBeNull();
+    expect(rendererFrame.style.display).toBe('none');
+
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        data: { message: 'trusted-server/aps/renderer-ready', nonce: sent.nonce },
+        source: rendererFrame.contentWindow,
+      })
+    );
+
+    expect(slot.querySelector('span')).toBeNull();
+    expect(rendererFrame.style.display).toBe('');
+  });
+
+  it('leaves existing slot content intact when validation or loading fails', () => {
+    expect(
+      renderApsCreative({
+        slotId: 'fictional-slot',
+        renderer: descriptor({ aaxResponse: 'invalid' }),
+      })
+    ).toBe(false);
+    expect(document.querySelector('#fictional-slot span')).not.toBeNull();
+    expect(document.querySelector('#fictional-slot iframe')).toBeNull();
+
+    expect(renderApsCreative({ slotId: 'fictional-slot', renderer: descriptor() })).toBe(true);
+    const iframe = document.querySelector('#fictional-slot iframe')!;
+    iframe.dispatchEvent(new Event('error'));
+    expect(document.querySelector('#fictional-slot span')).not.toBeNull();
+    expect(document.querySelector('#fictional-slot iframe')).toBeNull();
+  });
+
+  it('removes an unacknowledged frame without clearing publisher content', () => {
+    vi.useFakeTimers();
+    try {
+      expect(renderApsCreative({ slotId: 'fictional-slot', renderer: descriptor() })).toBe(true);
+      const iframe = document.querySelector('#fictional-slot iframe')!;
+      iframe.dispatchEvent(new Event('load'));
+
+      vi.advanceTimersByTime(10_000);
+
+      expect(document.querySelector('#fictional-slot span')).not.toBeNull();
+      expect(document.querySelector('#fictional-slot iframe')).toBeNull();
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it('immediately cancels a superseded pending frame and its timeout', () => {
+    vi.useFakeTimers();
+    const warnSpy = vi.spyOn(log, 'warn').mockImplementation(() => {});
+    try {
+      const baselineTimers = vi.getTimerCount();
+      expect(renderApsCreative({ slotId: 'fictional-slot', renderer: descriptor() })).toBe(true);
+      const firstFrame = document.querySelector('#fictional-slot iframe')!;
+      const firstPostMessage = vi.spyOn(firstFrame.contentWindow!, 'postMessage');
+      firstFrame.dispatchEvent(new Event('load'));
+      const firstSent = firstPostMessage.mock.calls[0][0] as { nonce: string };
+      const timersAfterFirst = vi.getTimerCount();
+      expect(timersAfterFirst).toBeGreaterThan(baselineTimers);
+
+      expect(renderApsCreative({ slotId: 'fictional-slot', renderer: descriptor() })).toBe(true);
+      const secondFrame = document.querySelector('#fictional-slot iframe')!;
+      expect(firstFrame.isConnected).toBe(false);
+      expect(vi.getTimerCount()).toBe(timersAfterFirst);
+      const postMessage = vi.spyOn(secondFrame.contentWindow!, 'postMessage');
+      secondFrame.dispatchEvent(new Event('load'));
+      const sent = postMessage.mock.calls[0][0] as { nonce: string };
+
+      window.dispatchEvent(
+        new MessageEvent('message', {
+          data: { message: 'trusted-server/aps/renderer-ready', nonce: firstSent.nonce },
+          source: firstFrame.contentWindow,
+        })
+      );
+      expect(document.querySelector('#fictional-slot span')).not.toBeNull();
+      expect((secondFrame as HTMLIFrameElement).style.display).toBe('none');
+
+      window.dispatchEvent(
+        new MessageEvent('message', {
+          data: { message: 'trusted-server/aps/renderer-ready', nonce: sent.nonce },
+          source: secondFrame.contentWindow,
+        })
+      );
+
+      vi.advanceTimersByTime(10_000);
+      expect(warnSpy).not.toHaveBeenCalled();
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+});
+
+describe('Universal Creative APS source', () => {
+  it('uses the deployed dynamic renderer protocol and only creates the opaque route frame', () => {
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER_VERSION).toBeGreaterThanOrEqual(4);
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).toContain('window.render=function');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).toContain('d&&d.apsRenderer');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).toContain('d&&d.rendererUrl');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).toContain(APS_RENDERER_PATH);
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).toContain(APS_RENDERER_SANDBOX);
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).not.toContain('allow-same-origin');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).not.toContain('srcdoc');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).not.toContain('document.write');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).not.toContain('creativeUrl');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).not.toContain('aaxResponse');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).not.toContain('example-account-id');
+  });
+
+  it('computes an absolute renderer URL from the publisher origin', () => {
+    expect(apsRendererUrl()).toBe(new URL(APS_RENDERER_PATH, window.location.origin).href);
+    expect(apsRendererUrl('not an origin')).toBeUndefined();
+  });
+
+  it('creates the opaque route frame and resolves only after the bound acknowledgement', async () => {
+    const dynamicWindow = window as unknown as {
+      render?: (data: Record<string, unknown>, helper: unknown, target: Window) => Promise<void>;
+    };
+    window.eval(APS_UNIVERSAL_CREATIVE_RENDERER);
+
+    try {
+      const renderer = descriptor();
+      const rendered = dynamicWindow.render!(
+        {
+          apsRenderer: renderer,
+          rendererUrl: apsRendererUrl(),
+        },
+        undefined,
+        window
+      );
+      const iframe = document.body.querySelector('iframe')!;
+      expect(iframe.src).toMatch(/\/integrations\/aps\/renderer#tsaps=[A-Za-z0-9_-]{22}$/);
+      expect(iframe.getAttribute('sandbox')).toBe(APS_RENDERER_SANDBOX);
+      expect(iframe.getAttribute('sandbox')).not.toContain('allow-same-origin');
+
+      const postMessage = vi.spyOn(iframe.contentWindow!, 'postMessage');
+      iframe.dispatchEvent(new Event('load'));
+      const sent = postMessage.mock.calls[0][0] as { nonce: string; renderer: ApsRendererV1 };
+      expect(sent.renderer).toEqual(renderer);
+
+      let settled = false;
+      void rendered.then(() => {
+        settled = true;
+      });
+      await Promise.resolve();
+      expect(settled).toBe(false);
+
+      window.dispatchEvent(
+        new MessageEvent('message', {
+          data: { message: 'trusted-server/aps/renderer-ready', nonce: sent.nonce },
+          source: iframe.contentWindow,
+        })
+      );
+      await expect(rendered).resolves.toBeUndefined();
+    } finally {
+      delete dynamicWindow.render;
+      document.body.innerHTML = '';
+    }
+  });
+});
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts
index 733c43642..6cf75f325 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts
@@ -1,4 +1,21 @@
 import { describe, it, expect, vi, beforeEach, afterEach, afterAll } from 'vitest';
+import envelope from '../../fixtures/aps-renderer-v1.json';
+
+function apsRenderer() {
+  const bid = envelope.seatbid[0].bid[0];
+  return {
+    type: 'aps' as const,
+    version: 1 as const,
+    accountId: 'example-account-id',
+    bidId: bid.id,
+    creativeId: 'fictional-creative-id',
+    tagType: 'iframe' as const,
+    creativeUrl: bid.ext.creativeurl,
+    aaxResponse: btoa(JSON.stringify(envelope)),
+    width: bid.w,
+    height: bid.h,
+  };
+}
 
 // Track every 'message' EventListener added to window across the entire test
 // file.  This lets the installTsRenderBridge suite remove all accumulated
@@ -729,7 +746,7 @@ describe('installTsAdInit', () => {
     beaconSpy.mockRestore();
   });
 
-  it('calls apstag.setDisplayBids when hb_bidder is aps', async () => {
+  it('does not call native apstag for a Trusted Server APS renderer winner', async () => {
     const setDisplayBidsSpy = vi.fn();
     (window as TestWindow).apstag = { setDisplayBids: setDisplayBidsSpy };
 
@@ -762,7 +779,12 @@ describe('installTsAdInit', () => {
         },
       ],
       bids: {
-        atf_sidebar_ad: { hb_pb: '1.50', hb_bidder: 'aps', nurl: '', burl: '' },
+        atf_sidebar_ad: {
+          hb_pb: '1.50',
+          hb_bidder: 'aps',
+          hb_adid: envelope.seatbid[0].bid[0].id,
+          renderer: apsRenderer(),
+        },
       },
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
     } as any;
@@ -771,7 +793,8 @@ describe('installTsAdInit', () => {
     installTsAdInit();
     (window as TestWindow).tsjs!.adInit!();
 
-    expect(setDisplayBidsSpy).toHaveBeenCalled();
+    expect(setDisplayBidsSpy).not.toHaveBeenCalled();
+    expect((window as TestWindow).apstag).toEqual({ setDisplayBids: setDisplayBidsSpy });
 
     delete (window as TestWindow).apstag;
   });
@@ -999,9 +1022,9 @@ describe('installTsRenderBridge', () => {
     delete (window as TestWindow).tsjs;
   });
 
-  function createTrustedSlotIframe(): Window {
+  function createTrustedSlotIframe(divId = 'div-header'): Window {
     const slot = document.createElement('div');
-    slot.id = 'div-header';
+    slot.id = divId;
     const iframe = document.createElement('iframe');
     slot.appendChild(iframe);
     document.body.appendChild(slot);
@@ -1027,6 +1050,349 @@ describe('installTsRenderBridge', () => {
     return bridgeListener!;
   }
 
+  it('serves one exact APS dynamic-renderer response without cache fetches or beacons', async () => {
+    const renderer = apsRenderer();
+    (window as TestWindow).tsjs.bids.homepage_header = {
+      hb_adid: renderer.bidId,
+      hb_bidder: 'aps',
+      hb_pb: '1.23',
+      renderer,
+      // These must not be used even if unexpected legacy fields coexist.
+      nurl: 'https://notify.example/win',
+      burl: 'https://notify.example/bill',
+      hb_cache_host: 'cache.example.com',
+      hb_cache_path: '/cache',
+    };
+
+    const beaconSpy = vi.spyOn(navigator, 'sendBeacon').mockReturnValue(true);
+    const bridgeListener = await captureBridgeListener();
+    const source = createTrustedSlotIframe();
+    const stopSpy = vi.fn();
+    const portMessages: string[] = [];
+    const fakePort = { postMessage: (message: string) => portMessages.push(message) };
+    const event = Object.assign(new Event('message'), {
+      data: JSON.stringify({ message: 'Prebid Request', adId: renderer.bidId }),
+      ports: [fakePort],
+      source,
+      stopImmediatePropagation: stopSpy,
+    }) as unknown as MessageEvent;
+
+    bridgeListener(event);
+    bridgeListener(event);
+
+    expect(stopSpy).toHaveBeenCalledTimes(2);
+    expect(fetchStub).not.toHaveBeenCalled();
+    expect(beaconSpy).not.toHaveBeenCalled();
+    // Server-rendered APS descriptors are reusable: GAM can issue repeated
+    // Universal Creative requests for the same winning ad ID.
+    expect(portMessages).toHaveLength(2);
+    const response = JSON.parse(portMessages[0]) as Record<string, unknown>;
+    expect(Object.keys(response).sort()).toEqual(
+      [
+        'adId',
+        'apsRenderer',
+        'height',
+        'message',
+        'renderer',
+        'rendererUrl',
+        'rendererVersion',
+        'width',
+      ].sort()
+    );
+    expect(response).toEqual({
+      message: 'Prebid Response',
+      adId: renderer.bidId,
+      renderer: expect.stringContaining('window.render=function'),
+      rendererVersion: 4,
+      rendererUrl: new URL('/integrations/aps/renderer', window.location.origin).href,
+      apsRenderer: renderer,
+      width: 300,
+      height: 250,
+    });
+    expect(String(response.renderer)).not.toContain(renderer.accountId);
+    expect(String(response.renderer)).not.toContain(renderer.aaxResponse);
+
+    // Universal Creative's dynamic-renderer path evaluates the returned static
+    // source and calls window.render(response, helper, targetWindow). Consume
+    // the exact bridge response through that deployed protocol shape.
+    const dynamicWindow = window as unknown as {
+      render?: (data: Record<string, unknown>, helper: unknown, target: Window) => Promise<void>;
+    };
+    window.eval(String(response.renderer));
+    try {
+      const rendered = dynamicWindow.render!(response, undefined, window);
+      const outerFrame = document.querySelector<HTMLIFrameElement>(
+        'iframe[src*="/integrations/aps/renderer#tsaps="]'
+      )!;
+      expect(outerFrame).not.toBeNull();
+      expect(outerFrame.getAttribute('sandbox')).not.toContain('allow-same-origin');
+
+      const rendererPost = vi.spyOn(outerFrame.contentWindow!, 'postMessage');
+      outerFrame.dispatchEvent(new Event('load'));
+      const sent = rendererPost.mock.calls[0][0] as { nonce: string };
+      window.dispatchEvent(
+        new MessageEvent('message', {
+          data: { message: 'trusted-server/aps/renderer-ready', nonce: sent.nonce },
+          source: outerFrame.contentWindow,
+        })
+      );
+      await expect(rendered).resolves.toBeUndefined();
+      outerFrame.remove();
+    } finally {
+      delete dynamicWindow.render;
+    }
+    beaconSpy.mockRestore();
+  });
+
+  it('serves a registered Prebid APS renderer when its generated ad ID differs from the APS bid ID', async () => {
+    const renderer = apsRenderer();
+    const prebidAdId = 'prebid-generated-ad-id';
+    const markWinner = vi.fn();
+    const markRendered = vi.fn();
+    (window as TestWindow).tsjs.apsPrebidRenderers = {
+      [prebidAdId]: {
+        adUnitCode: 'div-header',
+        renderer,
+        registeredAt: Date.now(),
+        expiresAt: Date.now() + 60_000,
+        markWinner,
+        markRendered,
+      },
+    };
+
+    const bridgeListener = await captureBridgeListener();
+    const source = createTrustedSlotIframe();
+    const stopSpy = vi.fn();
+    const portMessages: string[] = [];
+    const event = Object.assign(new Event('message'), {
+      data: JSON.stringify({ message: 'Prebid Request', adId: prebidAdId }),
+      ports: [{ postMessage: (message: string) => portMessages.push(message) }],
+      source,
+      stopImmediatePropagation: stopSpy,
+    }) as unknown as MessageEvent;
+
+    bridgeListener(event);
+    const foreignIframe = document.createElement('iframe');
+    document.body.appendChild(foreignIframe);
+    bridgeListener(
+      Object.assign(new Event('message'), {
+        data: JSON.stringify({ message: 'Prebid Request', adId: prebidAdId }),
+        ports: [{ postMessage: (message: string) => portMessages.push(message) }],
+        source: foreignIframe.contentWindow,
+        stopImmediatePropagation: stopSpy,
+      }) as unknown as MessageEvent
+    );
+
+    expect(stopSpy).toHaveBeenCalledTimes(2);
+    expect(portMessages).toHaveLength(1);
+    expect(markWinner).toHaveBeenCalledTimes(1);
+    expect(markRendered).toHaveBeenCalledTimes(1);
+    expect(JSON.parse(portMessages[0])).toEqual(
+      expect.objectContaining({
+        message: 'Prebid Response',
+        adId: prebidAdId,
+        apsRenderer: renderer,
+        width: renderer.width,
+        height: renderer.height,
+      })
+    );
+    expect(renderer.bidId).not.toBe(prebidAdId);
+    expect((window as TestWindow).tsjs.apsPrebidRenderers[prebidAdId]).toBeUndefined();
+    expect(fetchStub).not.toHaveBeenCalled();
+    foreignIframe.remove();
+  });
+
+  it('does not expose a registered Prebid APS renderer to another slot iframe', async () => {
+    const renderer = apsRenderer();
+    const prebidAdId = 'prebid-generated-ad-id';
+    (window as TestWindow).tsjs.apsPrebidRenderers = {
+      [prebidAdId]: {
+        adUnitCode: 'div-header',
+        renderer,
+        registeredAt: Date.now(),
+        expiresAt: Date.now() + 60_000,
+        markWinner: vi.fn(),
+        markRendered: vi.fn(),
+      },
+    };
+
+    const footer = document.createElement('div');
+    footer.id = 'div-footer';
+    const foreignIframe = document.createElement('iframe');
+    footer.appendChild(foreignIframe);
+    document.body.appendChild(footer);
+
+    const bridgeListener = await captureBridgeListener();
+    const stopSpy = vi.fn();
+    const portMessages: string[] = [];
+    bridgeListener(
+      Object.assign(new Event('message'), {
+        data: JSON.stringify({ message: 'Prebid Request', adId: prebidAdId }),
+        ports: [{ postMessage: (message: string) => portMessages.push(message) }],
+        source: foreignIframe.contentWindow,
+        stopImmediatePropagation: stopSpy,
+      }) as unknown as MessageEvent
+    );
+
+    expect(stopSpy).toHaveBeenCalledTimes(1);
+    expect(portMessages).toEqual([]);
+    expect((window as TestWindow).tsjs.apsPrebidRenderers[prebidAdId]).toBeDefined();
+    footer.remove();
+  });
+
+  it('drops an expired Prebid APS renderer without claiming the creative request', async () => {
+    const prebidAdId = 'expired-prebid-ad-id';
+    (window as TestWindow).tsjs.apsPrebidRenderers = {
+      [prebidAdId]: {
+        adUnitCode: 'div-header',
+        renderer: apsRenderer(),
+        registeredAt: Date.now() - 61_000,
+        expiresAt: Date.now() - 1_000,
+        markWinner: vi.fn(),
+        markRendered: vi.fn(),
+      },
+    };
+
+    const bridgeListener = await captureBridgeListener();
+    const source = createTrustedSlotIframe();
+    const stopSpy = vi.fn();
+    const portMessages: string[] = [];
+    bridgeListener(
+      Object.assign(new Event('message'), {
+        data: JSON.stringify({ message: 'Prebid Request', adId: prebidAdId }),
+        ports: [{ postMessage: (message: string) => portMessages.push(message) }],
+        source,
+        stopImmediatePropagation: stopSpy,
+      }) as unknown as MessageEvent
+    );
+
+    expect(stopSpy).not.toHaveBeenCalled();
+    expect(portMessages).toEqual([]);
+    expect((window as TestWindow).tsjs.apsPrebidRenderers[prebidAdId]).toBeUndefined();
+  });
+
+  it('validates APS data before claiming the Prebid request', async () => {
+    const renderer = { ...apsRenderer(), aaxResponse: 'invalid' };
+    (window as TestWindow).tsjs.bids.homepage_header = {
+      hb_adid: renderer.bidId,
+      hb_bidder: 'aps',
+      renderer,
+    };
+
+    const bridgeListener = await captureBridgeListener();
+    const source = createTrustedSlotIframe();
+    const stopSpy = vi.fn();
+    const portMessages: string[] = [];
+    bridgeListener(
+      Object.assign(new Event('message'), {
+        data: JSON.stringify({ message: 'Prebid Request', adId: renderer.bidId }),
+        ports: [{ postMessage: (message: string) => portMessages.push(message) }],
+        source,
+        stopImmediatePropagation: stopSpy,
+      }) as unknown as MessageEvent
+    );
+
+    expect(stopSpy).not.toHaveBeenCalled();
+    expect(portMessages).toEqual([]);
+    expect(fetchStub).not.toHaveBeenCalled();
+  });
+
+  it('accepts an APS request from a dynamic slot root resolved from its configured prefix', async () => {
+    const renderer = apsRenderer();
+    (window as TestWindow).tsjs.bids.homepage_header = {
+      hb_adid: renderer.bidId,
+      hb_bidder: 'aps',
+      renderer,
+    };
+    (window as TestWindow).tsjs.adSlots[0].div_id = 'div-header-';
+
+    const bridgeListener = await captureBridgeListener();
+    const source = createTrustedSlotIframe('div-header-dynamic');
+    const portMessages: string[] = [];
+    bridgeListener(
+      Object.assign(new Event('message'), {
+        data: JSON.stringify({ message: 'Prebid Request', adId: renderer.bidId }),
+        ports: [{ postMessage: (message: string) => portMessages.push(message) }],
+        source,
+        stopImmediatePropagation: vi.fn(),
+      }) as unknown as MessageEvent
+    );
+
+    expect(portMessages).toHaveLength(1);
+    document.getElementById('div-header-dynamic')?.remove();
+  });
+
+  it('does not let an overlapping slot prefix claim another slot iframe', async () => {
+    const renderer = apsRenderer();
+    (window as TestWindow).tsjs.bids.homepage_header = {
+      hb_adid: renderer.bidId,
+      hb_bidder: 'aps',
+      renderer,
+    };
+    (window as TestWindow).tsjs.adSlots.push({
+      id: 'homepage_header_mobile',
+      formats: [[320, 50]],
+      gam_unit_path: '/a/b/mobile',
+      div_id: 'div-header-mobile',
+      targeting: {},
+    });
+
+    const bridgeListener = await captureBridgeListener();
+    const source = createTrustedSlotIframe('div-header-mobile');
+    const portMessages: string[] = [];
+    const stopSpy = vi.fn();
+    bridgeListener(
+      Object.assign(new Event('message'), {
+        data: JSON.stringify({ message: 'Prebid Request', adId: renderer.bidId }),
+        ports: [{ postMessage: (message: string) => portMessages.push(message) }],
+        source,
+        stopImmediatePropagation: stopSpy,
+      }) as unknown as MessageEvent
+    );
+
+    expect(stopSpy).not.toHaveBeenCalled();
+    expect(portMessages).toEqual([]);
+    document.getElementById('div-header-mobile')?.remove();
+  });
+
+  it('ignores an APS ad ID requested by another configured slot', async () => {
+    const renderer = apsRenderer();
+    (window as TestWindow).tsjs.bids.homepage_header = {
+      hb_adid: renderer.bidId,
+      hb_bidder: 'aps',
+      renderer,
+    };
+    (window as TestWindow).tsjs.adSlots.push({
+      id: 'homepage_footer',
+      formats: [[300, 250]],
+      gam_unit_path: '/a/b/footer',
+      div_id: 'div-footer',
+      targeting: {},
+    });
+    const footer = document.createElement('div');
+    footer.id = 'div-footer';
+    const foreignIframe = document.createElement('iframe');
+    footer.appendChild(foreignIframe);
+    document.body.appendChild(footer);
+
+    const bridgeListener = await captureBridgeListener();
+    const stopSpy = vi.fn();
+    const portMessages: string[] = [];
+    bridgeListener(
+      Object.assign(new Event('message'), {
+        data: JSON.stringify({ message: 'Prebid Request', adId: renderer.bidId }),
+        ports: [{ postMessage: (message: string) => portMessages.push(message) }],
+        source: foreignIframe.contentWindow,
+        stopImmediatePropagation: stopSpy,
+      }) as unknown as MessageEvent
+    );
+
+    expect(stopSpy).not.toHaveBeenCalled();
+    expect(portMessages).toEqual([]);
+    expect(fetchStub).not.toHaveBeenCalled();
+    footer.remove();
+  });
+
   it('calls stopImmediatePropagation and fetches PBS Cache for a TS bid', async () => {
     const beaconSpy = vi.spyOn(navigator, 'sendBeacon').mockReturnValue(true);
     const mockAd = '<div>Test Creative</div>';
@@ -1702,7 +2068,7 @@ describe('installTsRenderBridge', () => {
     window.dispatchEvent(
       new MessageEvent('message', {
         data: JSON.stringify({ message: 'Prebid Request', adId: 'test-cache-uuid' }),
-        ports: [fakePort as MessagePort],
+        ports: [fakePort as unknown as MessagePort],
         source: foreignIframe.contentWindow,
       })
     );
@@ -1747,7 +2113,7 @@ describe('installTsRenderBridge', () => {
       new MessageEvent('message', {
         // adId belongs to slot B (homepage_footer), not slot A's iframe.
         data: JSON.stringify({ message: 'Prebid Request', adId: 'footer-uuid' }),
-        ports: [fakePort as MessagePort],
+        ports: [fakePort as unknown as MessagePort],
         source,
       })
     );
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts
index 29a8a3896..3cf0da025 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts
@@ -74,7 +74,7 @@ describe('installSpaAuctionHook', () => {
     const adInit = vi.fn();
     ts.adInit = adInit;
 
-    history.pushState({}, '', '/next-page');
+    history.pushState({}, '', '/next-page?edition=fictional#section');
     await flushAsync();
 
     expect(fetchStub).toHaveBeenCalledWith(
diff --git a/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts b/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts
index 1c7c32bb2..a0ba360ed 100644
--- a/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts
@@ -1,4 +1,21 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import envelope from '../../fixtures/aps-renderer-v1.json';
+
+function apsRenderer() {
+  const bid = envelope.seatbid[0].bid[0];
+  return {
+    type: 'aps' as const,
+    version: 1 as const,
+    accountId: 'example-account-id',
+    bidId: bid.id,
+    creativeId: 'fictional-creative-id',
+    tagType: 'iframe' as const,
+    creativeUrl: bid.ext.creativeurl,
+    aaxResponse: btoa(JSON.stringify(envelope)),
+    width: bid.w,
+    height: bid.h,
+  };
+}
 
 // Define mocks using vi.hoisted so they're available inside vi.mock factories
 const {
@@ -9,6 +26,9 @@ const {
   mockGetUserIdsAsEids,
   mockGetConfig,
   mockRemoveAdUnit,
+  mockMarkBidAsRendered,
+  mockMarkWinner,
+  mockOnEvent,
   mockPbjs,
   mockGetBidAdapter,
   mockAdapterManager,
@@ -18,6 +38,9 @@ const {
   const mockRequestBids = vi.fn();
   const mockRegisterBidAdapter = vi.fn();
   const mockGetBidAdapter = vi.fn();
+  const mockMarkBidAsRendered = vi.fn();
+  const mockMarkWinner = vi.fn();
+  const mockOnEvent = vi.fn();
   const mockGetUserIdsAsEids = vi.fn(
     () => [] as Array<{ source: string; uids?: Array<{ id: string; atype?: number }> }>
   );
@@ -49,7 +72,8 @@ const {
     getUserIdsAsEids: mockGetUserIdsAsEids,
     getConfig: mockGetConfig,
     removeAdUnit: mockRemoveAdUnit,
-    adUnits: [],
+    onEvent: mockOnEvent,
+    adUnits: [] as any[],
   };
   const mockAdapterManager = {
     getBidAdapter: mockGetBidAdapter,
@@ -62,6 +86,9 @@ const {
     mockGetUserIdsAsEids,
     mockGetConfig,
     mockRemoveAdUnit,
+    mockMarkBidAsRendered,
+    mockMarkWinner,
+    mockOnEvent,
     mockPbjs,
     mockGetBidAdapter,
     mockAdapterManager,
@@ -72,6 +99,10 @@ const {
 // The real prebid.js cannot run in jsdom, so we provide a minimal stub.
 vi.mock('prebid.js', () => ({ default: mockPbjs }));
 vi.mock('prebid.js/src/adapterManager.js', () => ({ default: mockAdapterManager }));
+vi.mock('prebid.js/src/adRendering.js', () => ({
+  markBidAsRendered: mockMarkBidAsRendered,
+  markWinner: mockMarkWinner,
+}));
 
 // Side-effect imports are no-ops in tests
 vi.mock('prebid.js/modules/consentManagementTcf.js', () => ({}));
@@ -171,6 +202,58 @@ describe('prebid/auctionBidsToPrebidBids', () => {
     });
   });
 
+  it('preserves an APS renderer without converting it to executable markup', () => {
+    const renderer = apsRenderer();
+    const auctionBids: AuctionBid[] = [
+      {
+        impid: 'div-aps',
+        adm: '<script>must not become Prebid ad markup</script>',
+        renderer,
+        price: 1.23,
+        width: 300,
+        height: 250,
+        seat: 'aps',
+        creativeId: 'fictional-creative-id',
+        adomain: ['advertiser.example'],
+      },
+    ];
+
+    const result = auctionBidsToPrebidBids(auctionBids, [
+      { adUnitCode: 'div-aps', bidId: 'prebid-request-id' },
+    ]);
+
+    expect(result).toHaveLength(1);
+    expect(result[0]).toEqual(
+      expect.objectContaining({
+        requestId: 'prebid-request-id',
+        bidderCode: 'aps',
+        ad: '',
+        trustedServerRenderer: renderer,
+      })
+    );
+  });
+
+  it('drops an APS bid whose renderer fails admission validation', () => {
+    const result = auctionBidsToPrebidBids(
+      [
+        {
+          impid: 'div-aps',
+          adm: '',
+          renderer: { ...apsRenderer(), aaxResponse: 'invalid' },
+          price: 1.23,
+          width: 300,
+          height: 250,
+          seat: 'aps',
+          creativeId: 'fictional-creative-id',
+          adomain: [],
+        },
+      ],
+      [{ adUnitCode: 'div-aps', bidId: 'prebid-request-id' }]
+    );
+
+    expect(result).toEqual([]);
+  });
+
   it('falls back to impid when no matching bidRequest found', () => {
     const auctionBids: AuctionBid[] = [
       {
@@ -240,6 +323,8 @@ describe('prebid/installPrebidNpm', () => {
     document.cookie = 'ts-eids=; Path=/; Max-Age=0';
     delete (window as any).__tsjs_prebid;
     delete (window as any).__tsjs_prebid_diagnostics;
+    delete (window as any).tsjs;
+    delete (mockPbjs as any).__tsApsBidResponseListenerInstalled;
   });
 
   afterEach(() => {
@@ -263,6 +348,77 @@ describe('prebid/installPrebidNpm', () => {
     );
   });
 
+  it('registers accepted APS descriptors under Prebid generated ad IDs', () => {
+    installPrebidNpm();
+
+    const bidResponseListener = mockOnEvent.mock.calls.find(
+      ([eventName]) => eventName === 'bidResponse'
+    )?.[1] as ((bid: Record<string, unknown>) => void) | undefined;
+    expect(bidResponseListener).toBeTypeOf('function');
+
+    const renderer = apsRenderer();
+    bidResponseListener!({
+      adapterCode: 'trustedServer',
+      bidderCode: 'aps',
+      adId: 'prebid-generated-ad-id',
+      adUnitCode: 'div-aps',
+      ttl: 300,
+      trustedServerRenderer: renderer,
+    });
+
+    const entry = (window as any).tsjs.apsPrebidRenderers['prebid-generated-ad-id'];
+    expect(entry).toEqual(
+      expect.objectContaining({
+        adUnitCode: 'div-aps',
+        renderer,
+        expiresAt: expect.any(Number),
+        markRendered: expect.any(Function),
+        markWinner: expect.any(Function),
+      })
+    );
+
+    entry.markWinner();
+    entry.markRendered();
+    expect(mockMarkWinner).toHaveBeenCalledWith(
+      expect.objectContaining({ adId: 'prebid-generated-ad-id' })
+    );
+    expect(mockMarkBidAsRendered).toHaveBeenCalledWith(
+      expect.objectContaining({ adId: 'prebid-generated-ad-id' })
+    );
+  });
+
+  it('does not register malformed or non-trusted APS renderer capabilities', () => {
+    const warnSpy = vi.spyOn(log, 'warn').mockImplementation(() => {});
+    installPrebidNpm();
+
+    const bidResponseListener = mockOnEvent.mock.calls.find(
+      ([eventName]) => eventName === 'bidResponse'
+    )?.[1] as ((bid: Record<string, unknown>) => void) | undefined;
+    const malformedBid: Record<string, unknown> = {
+      adapterCode: 'trustedServer',
+      bidderCode: 'aps',
+      adId: 'malformed-ad-id',
+      adUnitCode: 'div-aps',
+      ttl: 300,
+      trustedServerRenderer: { ...apsRenderer(), aaxResponse: 'invalid' },
+    };
+    bidResponseListener!(malformedBid);
+    bidResponseListener!({
+      adapterCode: 'publisherAdapter',
+      bidderCode: 'aps',
+      adId: 'foreign-ad-id',
+      adUnitCode: 'div-aps',
+      trustedServerRenderer: apsRenderer(),
+    });
+
+    expect((window as any).tsjs?.apsPrebidRenderers?.['malformed-ad-id']).toBeUndefined();
+    expect((window as any).tsjs?.apsPrebidRenderers?.['foreign-ad-id']).toBeUndefined();
+    expect(malformedBid).not.toHaveProperty('trustedServerRenderer');
+    expect(warnSpy).toHaveBeenCalledWith(
+      '[tsjs-prebid] rejected APS renderer capability that failed registration'
+    );
+  });
+
   it('calls setConfig with debug=false by default', () => {
     installPrebidNpm();
 
diff --git a/crates/trusted-server-js/lib/vitest.config.ts b/crates/trusted-server-js/lib/vitest.config.ts
index 97d9d84c8..ad9452899 100644
--- a/crates/trusted-server-js/lib/vitest.config.ts
+++ b/crates/trusted-server-js/lib/vitest.config.ts
@@ -11,6 +11,10 @@ export default defineConfig({
         __dirname,
         'node_modules/prebid.js/dist/src/src/adapterManager.js'
       ),
+      'prebid.js/src/adRendering.js': path.resolve(
+        __dirname,
+        'node_modules/prebid.js/dist/src/src/adRendering.js'
+      ),
     },
   },
   test: {
diff --git a/docs/guide/auction-orchestration.md b/docs/guide/auction-orchestration.md
index d75958812..e237bb2e4 100644
--- a/docs/guide/auction-orchestration.md
+++ b/docs/guide/auction-orchestration.md
@@ -10,7 +10,7 @@ Key capabilities:
 
 - **Parallel execution** — Bid requests to all providers launch concurrently using Fastly's `select()` API
 - **Strategy-based winner selection** — Automatic strategy detection based on configuration
-- **Mediator support** — Optional external mediator for decoding encoded prices (e.g., APS) and applying unified floor pricing
+- **Mediator support** — Optional external mediator for final winner selection and unified floor pricing
 - **Provider abstraction** — Pluggable provider interface for adding new demand sources
 - **Creative rewriting** — Winning creatives automatically rewritten with first-party proxy URLs
 
@@ -92,26 +92,26 @@ sequenceDiagram
     activate Mock
 
     par Parallel Provider Calls
-      Orch->>APS: POST /e/dtb/bid<br/>APS TAM format
-      Note right of Orch: { "pubId": "5128",<br/>  "slots": [{ "slotID": "header-banner",<br/>    "sizes": [[728,90]] }] }
+      Orch->>APS: POST /e/pb/bid<br/>APS OpenRTB
+      Note right of Orch: { "id": "request",<br/>  "imp": [{ "id": "header-banner",<br/>    "banner": { "w": 728, "h": 90 } }],<br/>  "ext": { "account": "example-account" } }
 
-      APS->>Mock: APS TAM request
-      Mock-->>APS: APS bid response<br/>(encoded prices, no creative)
-      Note right of Mock: { "contextual": { "slots": [{<br/>  "slotID": "header-banner",<br/>  "amznbid": "Mi41MA==", // "2.50"<br/>  "fif": "1" }] } }
+      APS->>Mock: APS OpenRTB request
+      Mock-->>APS: OpenRTB bid response<br/>(decoded price and renderer URL)
+      Note right of Mock: { "seatbid": [{ "bid": [{<br/>  "impid": "header-banner", "price": 2.50,<br/>  "ext": { "creativeurl": "https://creative.example/render",<br/>    "tagtype": "iframe" } }] }] }
 
-      APS-->>Orch: AuctionResponse<br/>(APS bids)
+      APS-->>Orch: AuctionResponse<br/>(decoded price and typed renderer)
     and
       Orch->>Prebid: POST /openrtb2/auction<br/>OpenRTB 2.x format
       Note right of Orch: { "id": "request",<br/>  "imp": [{ "id": "header-banner",<br/>    "banner": { "w": 728, "h": 90 } }] }
 
       Prebid->>Mock: OpenRTB request
-      Mock-->>Prebid: OpenRTB response<br/>(clear prices, with creative)
+      Mock-->>Prebid: OpenRTB response<br/>(decoded price with creative)
       Note right of Mock: { "seatbid": [{ "seat": "prebid",<br/>  "bid": [{ "price": 2.00, "adm": "<html>..." }] }] }
 
       Prebid-->>Orch: AuctionResponse<br/>(Prebid bids)
     end
 
-    Note over Orch: Collected bids from all providers<br/>APS: encoded prices, no creative<br/>Prebid: clear prices, with creative
+    Note over Orch: Collected decoded-price bids<br/>APS: typed renderer, no adm<br/>Prebid: sanitized creative or cache source
     deactivate Mock
     deactivate APS
     deactivate Prebid
@@ -122,23 +122,19 @@ sequenceDiagram
     rect rgb(236,253,245)
       Note over Client,Mock: Mediation Flow
       activate Med
-      Orch->>Med: POST /adserver/mediate<br/>All bids for final selection
-      Note right of Orch: { "id": "auction-123",<br/>  "imp": [...],<br/>  "ext": { "bidder_responses": [<br/>    { "bidder": "amazon-aps",<br/>      "bids": [{ "encoded_price": "Mi41MA==" }] },<br/>    { "bidder": "prebid",<br/>      "bids": [{ "price": 2.00 }] }] } }
-
-      Med->>Med: Decode APS encoded prices<br/>Apply floor prices<br/>Select highest CPM per slot
-      Note right of Med: Base64 decode: "Mi41MA==" → "2.50"<br/>Winner: APS at $2.50 vs Prebid at $2.00
+      Orch->>Med: POST /adserver/mediate<br/>Decoded-price bids for final selection
+      Note right of Orch: APS price: 2.50<br/>Prebid price: 2.00
 
+      Med->>Med: Apply mediation policy and floors<br/>Select highest CPM per slot
       Med-->>Orch: OpenRTB response with winners
-      Note right of Med: { "seatbid": [{ "seat": "amazon-aps",<br/>  "bid": [{ "price": 2.50, "impid": "header-banner" }] }] }
+      Note right of Med: APS renderer state is restored from<br/>the reduced source bid after mediation
       deactivate Med
     end
   else No Mediator (parallel_only)
     rect rgb(253,243,235)
       Note over Client,Mock: Direct Winner Selection
-      Orch->>Orch: Compare clear prices only<br/>Skip APS (encoded prices)<br/>Select highest CPM
-      Note right of Orch: APS bids skipped (encoded prices)<br/>Winner: Prebid at $2.00 (only clear price)
-
-      Note over Orch: Results: Limited winner selection<br/>Cannot compare encoded APS prices<br/>Prebid wins by default
+      Orch->>Orch: Compare decoded prices<br/>Apply slot floor<br/>Select highest CPM
+      Note right of Orch: Winner: APS at $2.50 vs Prebid at $2.00
     end
   end
 
@@ -147,12 +143,12 @@ sequenceDiagram
     Note over Client,Mock: Response Assembly
     activate TS
     activate Client
-    Orch->>Orch: Transform to OpenRTB response<br/>Generate iframe creatives<br/>Rewrite creative URLs<br/>Add orchestrator metadata
+    Orch->>Orch: Transform to OpenRTB response<br/>Preserve typed render source<br/>Rewrite ordinary creatives<br/>Add orchestrator metadata
 
     Orch-->>TS: OpenRTB BidResponse
-    Note right of Orch: { "id": "auction-response",<br/>  "seatbid": [{ "seat": "amazon-aps",<br/>    "bid": [{ "price": 2.50,<br/>      "adm": "<iframe src=\"/first-party/proxy?tsurl=...\">",<br/>      "w": 728, "h": 90 }] }] }<br/>  "ext": { "orchestrator": {<br/>    "strategy": "parallel_mediation",<br/>    "bidders": 2, "time_ms": 150 } }
+    Note right of Orch: APS winner carries ext.trusted_server.renderer<br/>with no adm; ordinary winners retain sanitized adm/cache data
 
-    TS-->>Client: 200 OpenRTB response<br/>with winning creative
+    TS-->>Client: 200 OpenRTB response<br/>with winning render capability
     deactivate Orch
     deactivate TS
   end
@@ -160,8 +156,8 @@ sequenceDiagram
   %% === Creative Rendering ===
   rect rgb(239,246,255)
     Note over Client,Mock: Creative Rendering
-    Client->>Client: Inject winning creative<br/>Render iframe<br/>Load creative through proxy
-    Note right of Client: iframe src="/first-party/proxy?tsurl=...&tstoken=sig"<br/>Ensures first-party serving<br/>Maintains privacy & security
+    Client->>Client: Validate renderer descriptor<br/>Create opaque sandbox iframe<br/>Load /integrations/aps/renderer
+    Note right of Client: Fragment-bound nonce and one-time acknowledgement<br/>No allow-same-origin on the outer frame
     deactivate Client
   end
 ```
@@ -187,8 +183,8 @@ AuctionOrchestrator.run_auction()
   ├─ Launch all providers in parallel via select()
   ├─ Collect responses as they complete
   │
-  ├─[parallel_only]─── Select highest CPM per slot (clear prices only)
-  └─[parallel_mediation]─── Forward all bids to mediator for final selection
+  ├─[parallel_only]─── Select highest decoded CPM per slot
+  └─[parallel_mediation]─── Forward decoded-price bids to mediator for final selection
   │
   ▼
 Convert OrchestrationResult → OpenRTB 2.x Response
@@ -246,21 +242,17 @@ timeout_ms = 2000
 
 **How winner selection works:**
 
-1. Collect bids from all providers
-2. Group bids by slot ID
-3. For each slot, select the bid with the highest CPM
-4. Bids with `price: None` (e.g., APS encoded prices) are **skipped** — they cannot be compared without decoding
-5. Apply floor prices — drop winners below the slot's floor
+1. Collect bids from all providers.
+2. Group bids by slot ID.
+3. Skip bids without a decoded numeric price.
+4. Select the highest CPM for each slot.
+5. Apply floor prices and drop winners below the slot's floor.
 
-**Limitations:**
-
-- APS bids are effectively ignored since their prices are encoded
-- Only bidders returning clear decimal prices can compete
-- May result in lower revenue when APS would have won
+APS OpenRTB supplies decoded prices, so eligible APS bids participate directly without requiring a mediator.
 
 ### Parallel Mediation
 
-When a `mediator` is configured, all provider responses are forwarded to the mediator service for final winner selection. The mediator can decode proprietary price formats (like APS encoded bids) and apply unified floor pricing.
+When a `mediator` is configured, provider responses are forwarded to the mediator service for final winner selection and unified floor pricing.
 
 ```toml
 [auction]
@@ -272,21 +264,14 @@ timeout_ms = 2000
 
 **How mediation works:**
 
-1. Run all providers in parallel (same as parallel_only)
-2. Collect all responses
-3. Forward all bids to the mediator as a single request, including:
-   - Regular bids with clear `price` fields
-   - APS bids with `encoded_price` fields (from `amznbid` metadata)
-4. Mediator decodes APS prices, applies floor pricing, and selects the highest CPM per slot
-5. Mediator returns an OpenRTB response with winning bids at decoded prices
-6. Orchestrator filters any bids the mediator returned without a decoded price
-
-**Advantages over parallel_only:**
+1. Run all providers in parallel (same as parallel_only).
+2. Collect all responses.
+3. Forward bids with decoded numeric prices to the mediator.
+4. Let the mediator apply policy and choose a winner.
+5. Restore render/accounting state from the selected source bid.
+6. Filter any mediator winner without a decoded price.
 
-- All bidders compete on equal footing, including those with encoded prices
-- Centralized floor pricing enforcement
-- Proper APS integration — encoded bids are decoded and compared fairly
-- Higher potential revenue from broader competition
+Mediation is optional for APS. APS reduces to one candidate per impression before mediation so the selected renderer can be restored without same-slot ambiguity.
 
 ## Providers
 
@@ -354,33 +339,37 @@ bidders = ["appnexus", "rubicon"]
 
 ### APS Provider
 
-Transforms auction requests into Amazon's TAM (Transparent Ad Marketplace) format.
+Builds an independent banner OpenRTB request for Amazon Publisher Services.
 
 **Request transformation:**
 
-- `AdSlot` → `ApsSlot` with `slot_id`, `slot_name`, and `sizes` array
-- Publisher ID, page URL, user agent, and timeout included
+- banner `AdSlot` formats become secure OpenRTB impressions;
+- `ext.account` uses canonical `account_id`;
+- `ext.sdk` identifies the compatible Prebid contract; and
+- existing page, device, consent, identity, and geo privacy gates are preserved.
 
 **Response parsing:**
 
-- Bids have `price: None` — APS uses proprietary encoding (`amznbid` field is base64-encoded)
-- Bids have `creative: None` — APS does not return HTML creatives
-- Encoded price metadata (`amznbid`, `amznp`) preserved in bid metadata for the mediator
-- Only slots with `fif: "1"` (filled) are processed
-
-This is why mediation is important when using APS: without a mediator, APS bids cannot participate in winner selection.
+- decoded USD prices compete directly with other providers;
+- positive compatible dimensions and an HTTPS `creativeurl` are required;
+- script creatives are rejected before winner selection unless explicitly enabled;
+- one candidate per impression is retained deterministically; and
+- a minimized typed renderer is preserved instead of creative markup or APS notifications.
 
 ```toml
 [integrations.aps]
 enabled = true
-pub_id = "example-publisher"
-endpoint = "https://aps.example.com/e/dtb/bid"
+account_id = "example-account"
 timeout_ms = 800
+debug = false
+allow_script_creatives = false
 ```
 
+See [APS OpenRTB Integration](/guide/integrations/aps) for rollout and rendering requirements.
+
 ### AdServer Mock Mediator
 
-An external mediation service that receives all bidder responses and performs unified winner selection. The mock implementation uses base64 decoding for APS prices; a production mediator would use Amazon's proprietary decoding.
+An external mediation service that receives decoded-price bidder responses and performs final winner selection. APS prices are already decoded at the provider boundary.
 
 **Mediation request format:**
 
@@ -393,8 +382,8 @@ An external mediation service that receives all bidder responses and performs un
   "ext": {
     "bidder_responses": [
       {
-        "bidder": "amazon-aps",
-        "bids": [{ "imp_id": "header-banner", "encoded_price": "Mi41MA==" }]
+        "bidder": "aps",
+        "bids": [{ "imp_id": "header-banner", "price": 2.5, "adm": null }]
       },
       {
         "bidder": "prebid",
@@ -457,20 +446,21 @@ The unified bid format used across all providers:
 ```rust
 pub struct Bid {
     pub slot_id: String,
-    pub price: Option<f64>,           // None for APS (encoded)
+    pub price: Option<f64>,           // Missing prices fail closed
     pub currency: String,
-    pub creative: Option<String>,     // None for APS (no HTML from TAM)
+    pub creative: Option<String>,     // APS uses renderer instead of markup
     pub adomain: Option<Vec<String>>,
     pub bidder: String,
     pub width: u32,
     pub height: u32,
     pub nurl: Option<String>,         // Win notification URL
     pub burl: Option<String>,         // Billing URL
+    pub renderer: Option<BidRenderer>,
     pub metadata: HashMap<String, serde_json::Value>,
 }
 ```
 
-The `price` and `creative` fields are `Option` types specifically to handle APS, which returns encoded prices and no creative HTML. This is a key design decision — it lets the type system enforce awareness of encoded vs. decoded bids throughout the auction pipeline.
+The `price` field remains optional so missing-price bids fail closed. APS supplies a decoded price and a typed renderer instead of creative HTML; the renderer is retained through direct winner selection and mediation.
 
 ### OrchestrationResult
 
@@ -549,6 +539,45 @@ Auction results are returned in standard OpenRTB format with an `ext.orchestrato
 }
 ```
 
+APS renderer winners use the same OpenRTB response with a typed renderer extension instead of `adm`:
+
+```json
+{
+  "id": "auction-abc123",
+  "seatbid": [
+    {
+      "seat": "aps",
+      "bid": [
+        {
+          "id": "upstream-aps-bid-id",
+          "impid": "header-banner",
+          "price": 2.5,
+          "w": 728,
+          "h": 90,
+          "ext": {
+            "trusted_server": {
+              "renderer": {
+                "type": "aps",
+                "version": 1,
+                "accountId": "example-account",
+                "bidId": "upstream-aps-bid-id",
+                "tagType": "iframe",
+                "creativeUrl": "https://creative.example/render",
+                "aaxResponse": "fictional-base64-envelope",
+                "width": 728,
+                "height": 90
+              }
+            }
+          }
+        }
+      ]
+    }
+  ]
+}
+```
+
+For these bids, `id` preserves APS's upstream bid ID, `crid` is present only when APS supplies one, and `adm` is absent. TSJS understands this contract; other `/auction` consumers must render `ext.trusted_server.renderer` explicitly.
+
 EC identity is maintained with the `ts-ec` cookie; auction responses do not emit EC ID headers.
 
 ## Creative Processing
@@ -593,9 +622,10 @@ debug = false
 
 [integrations.aps]
 enabled = true
-pub_id = "example-publisher"
-endpoint = "https://aps.example.com/e/dtb/bid"
+account_id = "example-account"
 timeout_ms = 800
+debug = false
+allow_script_creatives = false
 
 [integrations.adserver_mock]
 enabled = true
@@ -629,12 +659,16 @@ price_floor = 0.50
 
 #### `[integrations.aps]`
 
-| Field        | Type   | Default                             | Description                 |
-| ------------ | ------ | ----------------------------------- | --------------------------- |
-| `enabled`    | bool   | `false`                             | Enable APS provider         |
-| `pub_id`     | string | —                                   | APS publisher ID (required) |
-| `endpoint`   | string | `https://aps.example.com/e/dtb/bid` | APS TAM endpoint            |
-| `timeout_ms` | u32    | `800`                               | Request timeout             |
+| Field                    | Type   | Default                       | Description                                                       |
+| ------------------------ | ------ | ----------------------------- | ----------------------------------------------------------------- |
+| `enabled`                | bool   | `false`                       | Enable APS provider                                               |
+| `account_id`             | string | —                             | APS account ID (required; `pub_id` is an alias)                   |
+| `endpoint`               | string | Built-in APS OpenRTB endpoint | Optional APS OpenRTB endpoint override                            |
+| `timeout_ms`             | u32    | `800`                         | Request timeout                                                   |
+| `debug`                  | bool   | `false`                       | Include the raw APS HTTP exchange in `/auction` provider metadata |
+| `inventory_domain`       | string | —                             | Override `site.domain` for APS-authorized inventory               |
+| `inventory_page_origin`  | string | —                             | HTTPS origin paired with `inventory_domain` for `site.page`       |
+| `allow_script_creatives` | bool   | `false`                       | Admit script bids before APS candidate reduction                  |
 
 #### `[integrations.adserver_mock]`
 
@@ -673,7 +707,8 @@ TRUSTED_SERVER__AUCTION__PROVIDERS=prebid,aps
 TRUSTED_SERVER__AUCTION__MEDIATOR=adserver_mock
 TRUSTED_SERVER__AUCTION__TIMEOUT_MS=2000
 TRUSTED_SERVER__INTEGRATIONS__PREBID__SERVER_URL=https://pbs.example.com
-TRUSTED_SERVER__INTEGRATIONS__APS__PUB_ID=5128
+TRUSTED_SERVER__INTEGRATIONS__APS__ACCOUNT_ID=example-account
+TRUSTED_SERVER__INTEGRATIONS__APS__DEBUG=false
 ```
 
 ## Floor Prices
@@ -682,7 +717,7 @@ Floor prices can be set per-slot in the auction request. The orchestrator enforc
 
 - In **parallel_only** mode: bids below the floor are dropped after selection
 - In **parallel_mediation** mode: the floor is sent to the mediator in `ext.config.price_floor`, and also enforced locally as a safety net
-- Bids with `price: None` (encoded prices) **pass through** floor checks — the floor is deferred to the mediator
+- Bids without a decoded numeric price are dropped before delivery in both strategies
 
 ## Error Handling
 
@@ -703,7 +738,7 @@ The auction system logs at multiple levels throughout execution:
 | Level   | Examples                                                                              |
 | ------- | ------------------------------------------------------------------------------------- |
 | `info`  | Auction request received, provider launch, bid counts, winner selection, total timing |
-| `debug` | Skipped bids (encoded prices), creative rewrite sizes                                 |
+| `debug` | Bid-drop reasons, mediation restoration notes, creative rewrite sizes                 |
 | `warn`  | Provider launch failures, parse failures, mediator bids without decoded prices        |
 
 ### Response Metadata
diff --git a/docs/guide/configuration.md b/docs/guide/configuration.md
index 8d3e5b251..dde83737e 100644
--- a/docs/guide/configuration.md
+++ b/docs/guide/configuration.md
@@ -1246,8 +1246,12 @@ timeout_ms = 2000
 
 [integrations.aps]
 enabled = true
-pub_id = "example-publisher"
-endpoint = "https://aps.example.com/e/dtb/bid"
+account_id = "example-account"
+debug = false
+# Optional pair for deployments hosted away from APS-authorized inventory.
+# inventory_domain = "publisher.example"
+# inventory_page_origin = "https://www.publisher.example"
+allow_script_creatives = false
 
 [integrations.prebid]
 enabled = true
@@ -1264,6 +1268,7 @@ TRUSTED_SERVER__AUCTION__PROVIDERS__1=prebid
 TRUSTED_SERVER__AUCTION__MEDIATOR=adserver_mock
 TRUSTED_SERVER__AUCTION__TIMEOUT_MS=2000
 TRUSTED_SERVER__AUCTION__CREATIVE_STORE=creative_store
+TRUSTED_SERVER__INTEGRATIONS__APS__DEBUG=false
 ```
 
 ## Fastly Runtime Config Store
diff --git a/docs/guide/integrations/aps.md b/docs/guide/integrations/aps.md
index 878761769..24c381cc0 100644
--- a/docs/guide/integrations/aps.md
+++ b/docs/guide/integrations/aps.md
@@ -1,412 +1,256 @@
-# Amazon Publisher Services (APS) Integration
+# Amazon Publisher Services (APS) OpenRTB Integration
 
-Server-side bidding integration for Amazon's Transparent Ad Marketplace (TAM).
+Trusted Server can request banner bids from Amazon Publisher Services (APS) through the APS OpenRTB endpoint and let their decoded USD CPMs compete with other auction providers.
 
-## Overview
+> [!IMPORTANT]
+> APS's public adapter metadata describes Prebid Server support as unavailable. Confirm edge/server-originated traffic with your APS account team before a broad production rollout. Start with an isolated cohort and disable publisher-native APS demand for that cohort to avoid duplicate demand.
 
-The APS integration enables publishers to request bids from Amazon's demand sources server-side, providing:
+## Scope
 
-- **Privacy-first bidding**: No client-side ID tracking or third-party cookies required
-- **Reduced latency**: Server-side auction reduces page load impact
-- **Unified auction**: Integrates seamlessly with other bidders (Prebid, GAM)
-- **Performance**: Async bidding with configurable timeouts
+The integration supports:
 
-## Quick Start
+- banner impressions;
+- APS OpenRTB requests to the integration's built-in production endpoint;
+- decoded-CPM winner selection with or without a mediator;
+- direct `/auction` rendering;
+- client-side `trustedServer` Prebid adapter auctions through GAM; and
+- initial-navigation and page-bids rendering through GAM/Prebid Universal Creative.
 
-Get started with server-side APS bidding in 5 minutes.
+The integration does not implement:
 
-### Prerequisites
+- video or native impressions;
+- APS user sync;
+- Trusted Server delivery of APS `nurl` or `burl`; or
+- native `apstag.setDisplayBids()` handling for Trusted Server APS winners.
 
-- Fastly Compute service configured
-- APS publisher account with valid `pub_id`
-- Rust toolchain installed (see main README)
-
-### Step 1: Configure Fastly Backend
-
-Add APS backend to your Fastly service:
-
-**Option A: Via Fastly UI**
-
-1. Go to your service → Origins
-2. Click "Create a Backend"
-3. Configure:
-   - Name: `aax.amazon-adsystem.com`
-   - Address: `aax.amazon-adsystem.com`
-   - Port: `443`
-   - Enable TLS: ✓
-
-**Option B: Via `fastly.toml`**
-
-Add to your `fastly.toml`:
-
-```toml
-[[backends]]
-name = "aax.amazon-adsystem.com"
-address = "aax.amazon-adsystem.com"
-port = 443
-use_ssl = true
-ssl_cert_hostname = "aax.amazon-adsystem.com"
-ssl_sni_hostname = "aax.amazon-adsystem.com"
-```
-
-### Step 2: Enable APS in Configuration
-
-Edit `trusted-server.toml`:
+## Configuration
 
 ```toml
-# Enable APS bidding
 [integrations.aps]
 enabled = true
-pub_id = "5128"  # Replace with your APS publisher ID
-endpoint = "https://aax.amazon-adsystem.com/e/dtb/bid"
+account_id = "example-aps-account-id"
 timeout_ms = 800
+# Include raw APS request/response data in /auction metadata on test sites only.
+debug = false
+# Set both when the deployment hostname differs from APS-authorized inventory.
+# inventory_domain = "publisher.example"
+# inventory_page_origin = "https://www.publisher.example"
+allow_script_creatives = false
 
-# Configure auction to use APS
 [auction]
 enabled = true
-strategy = "parallel_only"  # Run APS alongside other bidders
-bidders = ["aps"]  # Add other bidders like ["aps", "prebid"]
+providers = ["aps", "prebid"]
 timeout_ms = 2000
 ```
 
-### Step 3: Deploy or Test Locally
+`account_id` is the canonical field. `pub_id` remains a compatibility alias for migration, including integer values, but new configuration should not use it. Supplying both names is an error.
 
-**Deploy to Fastly:**
+`debug` defaults to `false`. Enable it only on controlled test sites because it includes the raw APS request and response, including identity, consent, device, page, account, bid, and creative data, in the client-visible `/auction` response.
 
-```bash
-cargo build --release --target wasm32-wasip1
-fastly compute publish
-```
+`allow_script_creatives` defaults to `false`. While disabled, APS script bids are rejected before per-impression reduction, floors, mediation, and winner selection. Enable it only for a controlled cohort after the browser-security checks in [Rollout](#rollout) pass.
 
-**Test Locally:**
-
-```bash
-fastly compute serve
-```
-
-### Step 4: Verify It's Working
-
-Check the logs for APS activity:
-
-```bash
-# You should see:
-INFO APS: requesting bids for 2 slots (pub_id: 5128)
-DEBUG APS: sending bid request: {...}
-DEBUG APS: received response: {...}
-INFO APS returned 2 bids in 150ms
-```
-
-## Architecture
-
-```
-Publisher Page Request
-        ↓
-Auction Orchestrator
-        ↓
-APS Provider (async)
-        ↓
-https://aax.amazon-adsystem.com/e/dtb/bid
-        ↓
-Parse APS Response → Unified Bid Format
-        ↓
-Auction Winner Selection
-```
-
-## Configuration
+Set `inventory_domain` and `inventory_page_origin` together only when the public deployment hostname differs from the inventory identity authorized by APS. The domain becomes `site.domain`. The HTTPS page origin replaces the current page's scheme and host while preserving its path and query. The origin must be the inventory domain or one of its subdomains and cannot include credentials, a port, path, query, or fragment. These values come only from operator configuration; Trusted Server never accepts APS inventory identity from the client auction payload.
 
-### Basic Setup
+APS uses ordinary auction slot IDs and banner formats. Legacy creative-opportunity APS `slot_id` configuration is accepted for compatibility but ignored, and `bidders.aps.slotID` is not required. Remove both during migration.
 
-Add to `trusted-server.toml`:
-
-```toml
-[integrations.aps]
-enabled = true
-pub_id = "5128"  # Your APS publisher ID
-endpoint = "https://aax.amazon-adsystem.com/e/dtb/bid"
-timeout_ms = 800
-```
-
-### Environment Variables
-
-Override settings via environment variables:
-
-```bash
-TRUSTED_SERVER__INTEGRATIONS__APS__ENABLED=true
-TRUSTED_SERVER__INTEGRATIONS__APS__PUB_ID=5128
-TRUSTED_SERVER__INTEGRATIONS__APS__TIMEOUT_MS=800
-```
-
-## Auction Strategies
-
-### APS Only
-
-```toml
-[auction]
-enabled = true
-bidders = ["aps"]
-# No mediator = parallel only (highest CPM wins)
-```
-
-### APS + Prebid (Parallel)
-
-Best for maximum revenue:
+The APS provider may also participate through a configured mediator:
 
 ```toml
 [auction]
 enabled = true
 providers = ["aps", "prebid"]
+mediator = "adserver_mock"
 timeout_ms = 2000
-# No mediator = all providers compete, highest CPM wins
-
-[integrations.aps]
-enabled = true
-pub_id = "5128"
-timeout_ms = 800
-
-[integrations.prebid]
-enabled = true
-server_url = "https://prebid-server.example.com"
-timeout_ms = 1000
 ```
 
-**Benefits:**
-
-- Maximum fill rate
-- Best CPM selection
-- All bidders compete equally
-
-### APS + Prebid + Mediation
+## OpenRTB request
 
-Let a mediator decide winners:
+Trusted Server builds the APS request independently from its Prebid Server request. The request includes:
 
-```toml
-[auction]
-enabled = true
-providers = ["aps", "prebid"]
-mediator = "adserver_mock"  # Enables parallel mediation (mediator decides winner)
-timeout_ms = 2000
-```
+- `ext.account` from `account_id`;
+- `ext.sdk = { "source": "prebid", "version": "2.2.0" }`;
+- secure banner impressions and configured floors;
+- page, site, device, and consent fields allowed by the existing privacy gates; and
+- eligible EIDs only when consent policy permits them.
 
-## Request Format
+Precise latitude/longitude, disallowed identifiers, unsupported media types, and Trusted Server/Prebid-only extensions are not forwarded. Unsafe or oversized page URLs are omitted or replaced by the validated publisher fallback.
 
-The integration transforms unified `AuctionRequest` to APS TAM format:
+Raw outbound and inbound payloads are logged only at TRACE level. With debug disabled, auction metadata contains only aggregate counts and drop reasons.
 
-```json
-{
-  "pubId": "5128",
-  "slots": [
-    {
-      "slotID": "header-banner",
-      "slotName": "header-banner",
-      "sizes": [
-        [728, 90],
-        [970, 250]
-      ]
-    }
-  ],
-  "pageUrl": "https://example.com/article",
-  "ua": "Mozilla/5.0...",
-  "timeout": 800
-}
-```
-
-## Response Format
+## Debug mode
 
-APS returns bids in this format:
+Set `debug = true` under `[integrations.aps]` to include the direct APS HTTP exchange in the APS provider summary returned by `POST /auction`:
 
 ```json
 {
-  "bids": [
-    {
-      "slotID": "header-banner",
-      "price": 2.5,
-      "adm": "<div>Creative HTML</div>",
-      "w": 728,
-      "h": 90,
-      "adomain": ["amazon.com"],
-      "bidId": "bid-123",
-      "nurl": "https://win-notification.com",
-      "targeting": {
-        "amzniid": "user-id",
-        "amznbid": "2.50"
+  "metadata": {
+    "debug": {
+      "httpcalls": {
+        "aps": [
+          {
+            "requestbody": "{...}",
+            "requestheaders": { "content-type": ["application/json"] },
+            "responsebody": "{...}",
+            "responseheaders": { "content-type": ["application/json"] },
+            "status": 200,
+            "uri": "https://aps.example.com/e/pb/bid"
+          }
+        ]
       }
     }
-  ]
+  }
 }
 ```
 
-The integration automatically transforms this to unified `Bid` format.
+This follows the Prebid Server `metadata.debug.httpcalls` representation. APS makes one direct HTTP call per auction, so the map uses the provider key `aps` with one entry. Request and captured response bodies are strings, and header values are arrays so repeated headers are preserved. If a non-success response body cannot be read within the existing 2 MiB upstream limit, `responsebody` is omitted rather than reported as an empty body. APS does not add PBS-only `resolvedrequest` or `bidstatus` fields.
 
-## Testing
+The debug exchange is emitted for successful responses, `204 No Content`, malformed response bodies, and non-success HTTP statuses. Transport failures and auction timeouts happen before an HTTP response reaches the parser and continue to use the orchestrator's normal error metadata.
 
-### Unit Tests
+> [!WARNING]
+> APS debug metadata is unredacted and client-visible. Use it only on controlled test sites, and disable it before production rollout.
 
-```bash
-cargo test -p trusted-server-core aps::tests
-```
+## Bid eligibility and selection
 
-### Local Testing
+APS responses must use USD when a response currency is present. Each eligible bid must have:
 
-1. Configure APS in `trusted-server.toml`
-2. Set up Fastly backend
-3. Run locally:
-   ```bash
-   fastly compute serve
-   ```
-4. Inspect logs for bid requests/responses
+- a known `impid`;
+- a finite decoded price;
+- positive `w` and `h` that match a configured banner format;
+- an HTTPS, credential-free `ext.creativeurl` on an origin other than the publisher; and
+- `ext.tagtype` equal to `iframe`, or `script` when the script gate is enabled.
 
-### Testing
+Trusted Server rejects legacy contextual response shapes and bids with markup-only render sources. It deterministically keeps one eligible APS candidate per impression by highest price, then lexicographically smallest bid ID. This reduction prevents same-slot renderer ambiguity in mediation.
 
-For local testing without live APS credentials, configure the integration with test values:
+APS bids use `aps` as both the bidder identity and `hb_bidder`, regardless of an upstream seat value. The selected APS bid ID is used for `hb_adid`. APS then competes directly against other decoded-price bids and ordinary slot floors.
 
-```toml
-[integrations.aps]
-enabled = true
-pub_id = "test-publisher-123"
-endpoint = "https://aax.amazon-adsystem.com/e/dtb/bid"
-timeout_ms = 800
-```
+## Rendering security model
 
-Run unit tests:
+Trusted Server does not insert APS creative markup into the publisher document. It serializes only the selected bid into a versioned renderer descriptor. The base64 OpenRTB envelope has exactly this shape:
 
-```bash
-cargo test -p trusted-server-core aps
+```json
+{
+  "seatbid": [
+    {
+      "bid": [
+        {
+          "id": "fictional-selected-bid-id",
+          "price": 1.23,
+          "w": 300,
+          "h": 250,
+          "ext": {
+            "creativeurl": "https://creative.example/render",
+            "tagtype": "iframe"
+          }
+        }
+      ]
+    }
+  ]
+}
 ```
 
-## Monitoring
+Seats, `impid`, markup, notifications, user-sync data, sibling bids, losing seats, and unknown fields are not exposed. The browser decodes this envelope and cross-checks the ID, dimensions, URL, and tag type before any DOM mutation or message suppression.
 
-The integration logs detailed information at different levels:
+Both rendering paths use `GET /integrations/aps/renderer`, a static Trusted Server document with its own restrictive CSP. The document initializes the account-keyed APS queue and then loads only the fixed runner at `https://client.aps.amazon-adsystem.com/prebid-creative.js`.
 
-```rust
-// Info: Auction lifecycle
-log::info!("APS: requesting bids for 2 slots (pub_id: 5128)");
-log::info!("APS returned 2 bids in 150ms");
+The outer iframe uses these sandbox permissions:
 
-// Debug: Request/response payloads
-log::debug!("APS: sending bid request: {...}");
-log::debug!("APS: received response: {...}");
-
-// Warn: Non-success responses
-log::warn!("APS returned non-success status: 400");
+```text
+allow-forms
+allow-pointer-lock
+allow-popups
+allow-popups-to-escape-sandbox
+allow-scripts
+allow-top-navigation-by-user-activation
 ```
 
-## Troubleshooting
-
-### Problem: No bids returned
-
-**Check:**
-
-1. Verify `pub_id` is correct
-2. Check backend is configured: `fastly backend list`
-3. Increase timeout: `timeout_ms = 1200`
-4. View logs with `fastly compute serve`
-
-**Possible causes:**
-
-- Invalid `pub_id` configuration
-- Timeout too short (increase `timeout_ms`)
-- Backend not configured correctly
-- APS account not active
-
-### Problem: "Backend not found" error
-
-**Solution:**
-Add backend to Fastly (see Step 1)
-
-### Problem: Parse errors
-
-**Check:**
-
-- Enable debug logging
-- Verify endpoint URL is correct
-- Check APS API for changes
+It deliberately omits `allow-same-origin`, so APS and bidder execution remains below an opaque-origin boundary. The renderer response repeats these restrictions with a CSP `sandbox` directive, preventing another embedding path from restoring publisher-origin execution by omitting the iframe attribute. Trusted Server generates a fresh 128-bit nonce, binds it in the iframe URL fragment before navigation, and requires the same one-time nonce in the parent message and renderer acknowledgement. Existing slot content is retained until the static renderer has accepted the descriptor and loaded the fixed runner.
 
-**Solutions:**
+### Direct `/auction`
 
-- Enable debug logging to inspect response
-- Verify APS endpoint is correct
-- Check for API changes (update structs if needed)
+The TSJS auction client validates the typed renderer descriptor, creates the opaque renderer iframe, and sends the minimized envelope after the frame loads. Ordinary non-APS `adm` continues through the existing sanitizer and generic creative iframe.
 
-### Timeout Errors
+### GAM and Universal Creative
 
-**Symptoms:**
+For initial navigation and page-bids, Trusted Server publishes the same descriptor in `window.tsjs.bids`. The source-checked Prebid Universal Creative bridge accepts requests only from the iframe that owns the matching `hb_adid`, validates the complete envelope, and returns a static dynamic-renderer program that creates the same opaque renderer iframe.
 
-```
-APS request failed: Timeout
-```
-
-**Solutions:**
-
-- Increase `timeout_ms` in config
-- Check backend connectivity
-- Verify DNS resolution for `aax.amazon-adsystem.com`
+For client-side `trustedServer` adapter auctions, Prebid generates its own `hb_adid`. Trusted Server binds that generated ID to the validated APS descriptor in a bounded, expiring browser registry before GAM refresh. The bridge verifies that the requesting Universal Creative iframe belongs to the same ad unit, consumes the capability once, and passes the APS bid ID separately to the Amazon runner.
 
-## Performance Tuning
+These paths do not fetch PBS Cache, fire generic APS win/billing beacons, or call `apstag.setDisplayBids()` for the Trusted Server winner. Publisher-owned native APS objects are otherwise left untouched.
 
-### Timeout Configuration
+## Publisher CSP
 
-- **Default**: 800ms (matches APS client-side behavior)
-- **Aggressive**: 500ms (reduce latency, may miss some bids)
-- **Conservative**: 1200ms (maximize fill rate)
+The publisher policy must permit the same-origin renderer route, for example:
 
-```toml
-[integrations.aps]
-timeout_ms = 800  # Balance latency vs fill rate
+```text
+frame-src 'self'
 ```
 
-### Orchestrator Timeout
+Do not add `allow-same-origin` to the outer renderer sandbox. The renderer endpoint supplies its own CSP for the fixed runner and HTTPS creative resources.
 
-Ensure orchestrator timeout exceeds provider timeout:
+Before enabling script creatives, verify under the publisher's actual CSP that both iframe and script-tag creatives:
 
-```toml
-[auction]
-timeout_ms = 2000  # > sum of all provider timeouts
+- render and size correctly;
+- cannot read or modify `top.document`;
+- cannot restore publisher-origin execution;
+- reject malformed descriptors, nonce mismatches, and replay; and
+- work through both direct and GAM/Universal Creative paths.
 
-[integrations.aps]
-timeout_ms = 800
+If script rendering requires weakening the outer sandbox, leave `allow_script_creatives = false` and consult APS instead.
 
-[integrations.prebid]
-timeout_ms = 1000
-```
+## Migration from the legacy APS integration
 
-## Integration with Client-Side
+This release is a direct protocol cutover:
 
-While this implementation focuses on server-side bidding, you can optionally add client-side components later:
+1. Replace the legacy `/e/dtb/bid` endpoint with `/e/pb/bid`.
+2. Rename `pub_id` to `account_id`.
+3. Remove APS-specific slot ID configuration and remove `aps` from Prebid Server bidder lists. Trusted Server also filters APS from PBS requests for this path.
+4. Prepare GAM line items and Universal Creative for `hb_bidder=aps` and the selected APS `hb_adid`.
+5. Disable publisher-native APS demand for the Trusted Server test cohort.
 
-1. **ID Resolution**: Integrate third-party ID vendors client-side
-2. **Analytics**: Load `aps_csm.js` for viewability tracking
-3. **Config Loading**: Fetch `/configs/{pub_id}` for advanced settings
+There is no legacy runtime switch. Roll back by disabling `[integrations.aps]`, restoring native APS for the cohort, or deploying the prior binary.
 
-See the original network flow documentation for client-side patterns.
+## Rollout
 
-## Future Enhancements
+Use fictional values in source-controlled configuration and fixtures. Supply controlled account details out of band.
 
-Potential additions for complete APS TAM parity:
+1. Obtain APS account-team confirmation for edge-originated OpenRTB traffic.
+2. Enable Trusted Server APS only for an isolated cohort and disable native APS demand there.
+3. Keep `allow_script_creatives = false` and observe iframe bids through direct and GAM paths.
+4. Confirm outbound privacy fields, aggregate diagnostics, decoded-price competition, line-item targeting, dimensions, click-throughs, and opaque-origin isolation.
+5. Run the restrictive-CSP browser proof for script behavior.
+6. Only then enable script creatives for the isolated cohort and validate them in a real browser.
+7. Expand traffic only after APS confirmation and successful controlled validation.
 
-1. **Video Support**: Add video slot formats
-2. **ID Enrichment**: Server-side ID resolution (LiveRamp, ID5, etc.)
-3. **Advanced Targeting**: Pass user segments, geo data
-4. **Config API**: Fetch APS configuration from `/configs/{pub_id}`
-5. **Analytics**: Integrate with APS measurement endpoints
+## Troubleshooting
 
-## Reference
+### No APS bids
 
-- **APS TAM Docs**: https://aps.amazon.com/aps/transparent-ad-marketplace-api/
-- **Integration Code**: `crates/trusted-server-core/src/integrations/aps.rs`
-- **Tests**: `crates/trusted-server-core/src/integrations/aps.rs#tests`
-- **Example Config**: `trusted-server.toml`
+- Confirm `account_id` and account eligibility with APS.
+- Confirm the endpoint is `/e/pb/bid` and uses HTTPS without credentials.
+- If the deployment hostname differs from APS-authorized inventory, configure both `inventory_domain` and `inventory_page_origin` with the APS-approved identity.
+- Ensure `aps` appears in `auction.providers`.
+- Check aggregate APS drop reasons for currency, dimensions, render source, URL, tag type, or script-gate rejection.
+- Confirm the provider timeout fits inside the auction timeout.
+- On a controlled test site, set `debug = true` and inspect `ext.orchestrator.provider_details[].metadata.debug.httpcalls.aps` in the `/auction` response.
 
-## Support
+### Winner targets but does not render
 
-Questions? Issues?
+- Confirm `GET /integrations/aps/renderer` returns HTML with its CSP and `Referrer-Policy: no-referrer`.
+- Confirm publisher CSP permits `frame-src 'self'`.
+- Confirm the GAM creative uses the supported Prebid Universal Creative bridge and the winning `hb_adid`.
+- For client-side `trustedServer` adapter auctions, confirm Prebid's `bidResponse` contains a generated `adId` and that the corresponding capability appears briefly in `window.tsjs.apsPrebidRenderers` before rendering.
+- Ensure no native APS path is trying to handle the same cohort.
+- Keep script creatives disabled while diagnosing iframe rendering.
 
-1. Check logs: `fastly compute serve`
-2. Run tests: `cargo test aps`
-3. Verify configuration in `trusted-server.toml`
-4. Review this documentation
+## Verification
 
----
+```bash
+cargo test-fastly integrations::aps
+cargo test-fastly auction::orchestrator
+cargo test-fastly integrations::adserver_mock
 
-**Status**: ✅ Production Ready (Server-Side Bidding)
+cd crates/trusted-server-js/lib
+npx vitest run test/integrations/aps/render.test.ts test/core/auction.test.ts
+```
 
-**Last Updated**: 2025-12-23
+See `crates/trusted-server-core/src/integrations/aps.rs` for the request/parser implementation and `crates/trusted-server-js/lib/src/integrations/aps/render.ts` for the browser renderer contract.
diff --git a/docs/roadmap.md b/docs/roadmap.md
index d76c14b96..e0b16e336 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -75,6 +75,12 @@ Our development is focused on three key areas:
 - Real-time cohort updates
 - Secure Signals integration
 
+**Amazon Publisher Services (APS) OpenRTB Integration**
+
+- Banner OpenRTB bidding with decoded-price competition
+- Opaque sandboxed rendering for direct and GAM/Universal Creative paths
+- Controlled rollout pending APS account-team confirmation for edge-originated traffic
+
 ### Planned for 2026
 
 **Full Google Ad Manager (GAM) Support**
@@ -84,12 +90,6 @@ Our development is focused on three key areas:
 - Programmatic guaranteed support
 - First-party GAM reporting
 
-**Amazon Publisher Services (APS) Integration**
-
-- Transparent Ad Marketplace (TAM) support
-- A9 bidding integration
-- First-party APS header bidding
-
 **Kargo SSP Integration**
 
 - Native Kargo bid adapter
diff --git a/docs/superpowers/plans/2026-07-15-aps-openrtb-first-class-integration.md b/docs/superpowers/plans/2026-07-15-aps-openrtb-first-class-integration.md
new file mode 100644
index 000000000..b90fe5fe8
--- /dev/null
+++ b/docs/superpowers/plans/2026-07-15-aps-openrtb-first-class-integration.md
@@ -0,0 +1,893 @@
+# Amazon APS OpenRTB First-Class Integration Implementation Plan
+
+> **For agentic workers:** Implement task-by-task with tests first. Do not use bare
+> `cargo test --workspace`; use the adapter-aware aliases from `.cargo/config.toml`.
+> Commit or push only when the supervising user explicitly requests it.
+
+**Goal:** Replace the legacy APS `/e/dtb/bid` integration with APS OpenRTB,
+participate with decoded prices without mediation, and render APS banner creatives in
+the direct-auction and GPT/page-bids browser paths.
+
+**Architecture:** Keep APS request/response policy in an APS-specific OpenRTB adapter.
+Map the response into the shared `Bid` plus a typed, versioned APS renderer descriptor.
+Carry that descriptor through `/auction` and the publisher bid map. TSJS builds a
+Trusted Server-owned bootstrap for the fixed APS `prebid-creative.js` runner and
+executes it in the approved sandbox. Ordinary `adm` remains on the existing mandatory
+sanitize/rewrite path.
+
+**Tech stack:** Rust 2024, generated OpenRTB types, serde/serde_json, base64 0.22,
+error-stack, URL validation, TypeScript, Vitest, Prebid Universal Creative messaging.
+
+**Spec:**
+`docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md`
+
+**Branch:** `issue-764-aps-openrtb`
+
+---
+
+## Context and guardrails for every task
+
+- APS may be implemented and tested before production edge support is confirmed.
+  Broad production rollout remains blocked until the APS account team confirms the
+  Fastly/edge contract.
+- Send APS SDK identity `{ "source": "prebid", "version": "2.2.0" }`.
+- Build the exact renderer allowlist: one bid with only `id`, `price`, `w`, `h`,
+  `ext.creativeurl`, and `ext.tagtype`. Do not preserve unknown fields or silently
+  expose the complete APS response.
+- The outer renderer sandbox must omit `allow-same-origin`.
+  `allow_script_creatives` is a server-side capability gate that defaults false;
+  disabled script bids must be dropped before candidate reduction/winner selection.
+  Enable it only under the staged opaque-origin and controlled-account test policy.
+- APS user sync and APS `nurl`/`burl` delivery are out of scope. Do not add either
+  browser path.
+- Cut over directly. Keep `pub_id` as an alias only; do not add a legacy protocol
+  switch.
+- When a Trusted Server APS renderer is present, do not call
+  `apstag.setDisplayBids()`.
+- Banner only. Do not advertise APS video support in this issue.
+- Do not weaken `sanitize_creative_html` or its tests.
+- Raw APS requests/responses remain TRACE-only. Never log real account IDs, EIDs,
+  consent strings, creative URLs, bid tokens, or response bodies at normal levels.
+- All committed fixtures/docs use fictional `example` values. Controlled test-account
+  values stay out of the repository and terminal transcripts intended for review.
+- Use `error-stack`; no anyhow/eyre/thiserror in core code.
+- Use `log::` macros, not `println!`; use descriptive `expect("should ...")`, not
+  `unwrap()`.
+- Run the focused test immediately after each production-code change.
+
+---
+
+## File map
+
+### Rust core
+
+- `crates/trusted-server-core/src/auction/types.rs`: bid identifiers and typed
+  renderer contract.
+- `crates/trusted-server-core/src/openrtb.rs`: narrowly scoped request/bid extension
+  serialization types if they are shared outside APS.
+- `crates/trusted-server-core/src/integrations/aps.rs`: configuration, OpenRTB request,
+  response parser, exact renderer envelope, candidate reduction, static renderer route,
+  diagnostics and provider dispatch.
+- `crates/trusted-server-core/src/integrations/mod.rs`: register the APS proxy route as
+  well as the separate auction provider.
+- `crates/trusted-server-core/src/auction/formats.rs`: page derivation and `/auction`
+  renderer extension.
+- `crates/trusted-server-core/src/auction/orchestrator.rs`: decoded-price direct-winner
+  coverage and stale-comment removal.
+- `crates/trusted-server-core/src/integrations/adserver_mock.rs`: preserve renderer and
+  IDs through mediation.
+- `crates/trusted-server-core/src/publisher.rs`: normal bid-map renderer transport and
+  APS `hb_adid`.
+
+### Browser
+
+- `crates/trusted-server-js/lib/src/core/types.ts`: APS renderer wire type.
+- `crates/trusted-server-js/lib/src/core/auction.ts`: parse `/auction` renderer ext.
+- `crates/trusted-server-js/lib/src/core/request.ts`: direct APS render dispatch.
+- New `crates/trusted-server-js/lib/src/integrations/aps/render.ts`: exact envelope
+  decoding/cross-checking, opaque renderer frame creation and postMessage dispatch.
+- `crates/trusted-server-js/lib/src/integrations/gpt/index.ts`: exact APS Universal
+  Creative bridge, APS beacon suppression and native-APS hook removal.
+- New `crates/trusted-server-js/lib/test/fixtures/aps-renderer-v1.json`: shared Rust/TS
+  golden wire fixture.
+- New `crates/trusted-server-js/lib/test/integrations/aps/render.test.ts` plus existing
+  core/GPT tests.
+- `crates/trusted-server-integration-tests/browser/`: restrictive-CSP and opaque-origin
+  Playwright coverage.
+
+### Configuration and docs
+
+- `trusted-server.example.toml`
+- `docs/guide/integrations/aps.md`
+- `CHANGELOG.md`
+
+---
+
+## Task 1: Add typed bid identifiers and renderer state
+
+**What:** Give the shared auction model enough typed state to distinguish OpenRTB bid,
+ad, and creative IDs and carry a validated APS renderer without using arbitrary
+metadata.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/auction/types.rs`
+- Modify: every production/test `Bid { ... }` construction found by
+  `rg -n 'Bid \{' crates/trusted-server-core`
+- Test: `crates/trusted-server-core/src/auction/types.rs`
+
+- [ ] Add failing serde tests for a bid with:
+  - separate `bid_id`, `ad_id`, and `creative_id`;
+  - an APS renderer version, account ID, selected bid ID, tag type, creative URL,
+    encoded response, and dimensions; and
+  - `renderer = None` omission for ordinary bids.
+- [ ] Define a strict `ApsTagType` enum with only `Iframe` and `Script`.
+- [ ] Define a versioned, typed renderer enum/descriptor. The serialized renderer must
+      use camelCase and a discriminator equivalent to:
+
+  ```json
+  {
+    "type": "aps",
+    "version": 1,
+    "accountId": "example-account-id",
+    "bidId": "fictional-bid-id",
+    "creativeId": "fictional-creative-id",
+    "tagType": "iframe",
+    "creativeUrl": "https://creative.example/render",
+    "aaxResponse": "base64-data",
+    "width": 300,
+    "height": 250
+  }
+  ```
+
+- [ ] Add to `Bid`:
+  - `bid_id: Option<String>`;
+  - `creative_id: Option<String>`; and
+  - `renderer: Option<...>`.
+- [ ] Make descriptor `creativeId` optional and omit it when APS does not return
+      `crid`; add a serde test for the absent-`crid` case.
+- [ ] Correct stale comments saying APS prices are encoded or that APS has no creative
+      delivery mechanism.
+- [ ] Update every `Bid` literal. Use `None` outside production parser paths; do not use
+      serde defaults to hide missed production mappings.
+- [ ] Update Prebid's `parse_bid` to preserve OpenRTB `id` as `bid_id` and `crid` as
+      `creative_id`, while retaining the existing strict `adid -> ad_id` semantics.
+- [ ] Run the focused tests:
+
+  ```bash
+  cargo test-fastly auction::types
+  cargo test-fastly integrations::prebid::tests::parse_bid
+  ```
+
+- [ ] Run `cargo fmt --all` and `cargo check-fastly` before proceeding.
+
+**Expected result:** Shared bids can represent APS renderer state without overloading
+`ad_id` or leaking renderer data through general metadata.
+
+---
+
+## Task 2: Cut APS configuration over to the OpenRTB contract
+
+**What:** Replace the public APS configuration terminology and default endpoint before
+replacing request/response behavior.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/integrations/aps.rs`
+- Test: existing APS test module in the same file
+
+- [ ] Add failing configuration tests proving:
+  - `account_id = "example-account-id"` deserializes;
+  - legacy `pub_id` deserializes to the same field;
+  - string and integer compatibility is retained;
+  - empty and whitespace-only strings fail validation;
+  - surrounding whitespace is trimmed deterministically;
+  - supplying both names fails as a duplicate field;
+  - the default endpoint is `/e/pb/bid`;
+  - HTTP, missing-host, and credential-bearing endpoint overrides fail validation; and
+  - APS remains disabled by default; and
+  - `allow_script_creatives` defaults false.
+- [ ] Rename `ApsConfig.pub_id` to `account_id`, using `pub_id` only as a serde alias.
+      Trim string values, reject empty-after-trim, normalize integers to strings, and
+      rename the custom deserializer/error text accordingly.
+- [ ] Add `allow_script_creatives: bool` with a serde default of `false`. Treat it as a
+      server-side bid-eligibility capability, not a browser-only rendering preference.
+- [ ] Change `default_endpoint()` to the built-in production APS `/e/pb/bid` endpoint. Use `https://aps.example.com/e/pb/bid` only for documentation and test overrides.
+
+- [ ] Replace generic URL-only endpoint validation with a custom check requiring HTTPS,
+      a non-empty host, and no username/password. Do not add a plaintext test exception:
+      the endpoint response is trusted to select executable renderer data.
+- [ ] Remove account IDs from registration and request INFO logs. Log only that APS was
+      registered and the endpoint/provider-safe state needed operationally.
+- [ ] Change `supports_media_type` to banner only.
+- [ ] Run:
+
+  ```bash
+  cargo test-fastly integrations::aps::tests
+  ```
+
+- [ ] Run `cargo fmt --all -- --check`.
+
+**Expected result:** Existing configs continue through `pub_id`, new configs use
+`account_id`, and no runtime protocol switch is introduced.
+
+---
+
+## Task 3: Replace the legacy request builder with APS OpenRTB
+
+**What:** Delete the private `/e/dtb/bid` request types and build the request described
+by the design spec from trusted auction context.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/integrations/aps.rs`
+- Modify only if useful: `crates/trusted-server-core/src/openrtb.rs`
+- Modify: `crates/trusted-server-core/src/auction/formats.rs`
+- Test: APS and auction-format test modules
+
+### 3.1 Request fixture tests
+
+- [ ] Add a failing complete-request test with fictional values. Assert exact JSON for:
+  - request `id`, `tmax`, and `cur = ["USD"]`;
+  - `ext.account`;
+  - `ext.sdk.source = "prebid"` and `version = "2.2.0"`;
+  - one impression per eligible slot with direct `imp.id` mapping;
+  - banner `format`, first `w`/`h`, `topframe = 0`, floor, floor currency, and
+    unconditional `secure = 1`;
+  - site page/domain/publisher fields;
+  - consent-allowed user ID and EIDs;
+  - UA/IP/language/DNT and coarse geo;
+  - TCF/USP/GPP registrations with COPPA omitted because no trusted signal exists; and
+  - absence of all PBS-only request and impression extensions.
+- [ ] Add focused privacy/validation tests:
+  - latitude/longitude are omitted while permitted coarse geo remains;
+  - gated-out user/EID values stay absent;
+  - no user data, keywords, gender, YOB, customdata, cookies, or arbitrary headers;
+  - non-banner slots are omitted;
+  - dimensions above `i32::MAX` are omitted safely;
+  - empty/invalid formats cannot create a malformed impression;
+  - configured and effective timeout use the orchestrator-granted budget.
+
+### 3.2 `/auction` page derivation
+
+- [ ] Add failing tests to `auction/formats.rs` proving:
+  - a valid same-publisher HTTP(S) `Referer` becomes the `/auction` current page;
+  - userinfo, wrong-host, non-HTTP(S), malformed, and oversized URLs are rejected;
+  - rejection falls back to the configured publisher origin; and
+  - no unrestricted browser body field is accepted as page context.
+- [ ] Implement a small private URL-validation helper. Reuse it in APS referrer
+      handling if practical, but do not make it a broad URL-policy refactor.
+
+### 3.3 Implementation
+
+- [ ] Remove `ApsBidRequest`, `ApsSlot`, legacy consent wrappers, slot-ID fallback, and
+      `to_aps_request`.
+- [ ] Add APS request extension types locally in `aps.rs` unless another module must
+      serialize them. Implement `ToExt` consistently with existing OpenRTB extension
+      types.
+- [ ] Implement `build_openrtb_request(&AuctionRequest, &AuctionContext)` using generated
+      OpenRTB types and `to_openrtb_i32`.
+- [ ] Build registrations from the existing `ConsentContext` placements. Copy only the
+      small field mapping needed by APS; do not expose/refactor the PBS builder in this
+      task.
+- [ ] Derive `site.ref` only from a valid HTTP(S) downstream `Referer` that differs from
+      the normalized current page.
+- [ ] Change `request_bids` to serialize/send the OpenRTB body with
+      `Content-Type: application/json`, the existing bounded auction timeout, and no
+      forwarded cookies.
+- [ ] Keep serialized request logging at TRACE.
+- [ ] Run:
+
+  ```bash
+  cargo test-fastly integrations::aps::tests
+  cargo test-fastly auction::formats
+  cargo check-fastly
+  ```
+
+- [ ] Review serialized request fixtures against the immutable upstream request code;
+      explicitly confirm no `ext.prebid` or Trusted Server signing extension appears.
+
+**Expected result:** Every eligible APS banner slot produces a standards-based OpenRTB
+impression with explicit APS and privacy policy.
+
+---
+
+## Task 4: Parse APS OpenRTB and build the minimized renderer envelope
+
+**What:** Replace `contextual.slots` parsing with strict `seatbid` parsing, decoded CPM,
+one APS candidate per impression, and the exact renderer envelope.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/integrations/aps.rs`
+- Test: APS test module
+
+### 4.1 Add failing response tests
+
+- [ ] A runner-compatible banner bid maps:
+  - `id -> bid_id`;
+  - optional `adid -> ad_id` and `crid -> creative_id`;
+  - `impid -> slot_id`;
+  - decoded price/USD, dimensions and domains;
+  - `Bid.bidder = "aps"` regardless of upstream seat; and
+  - `ext.creativeurl`/`ext.tagtype` into the typed renderer.
+- [ ] Missing, string, numeric, and unexpected seat values never become `Bid.bidder` or
+      `hb_bidder` and do not invalidate an otherwise valid bid.
+- [ ] A valid runner-compatible bid without `crid` remains renderable with no
+      `creativeId` in the descriptor.
+- [ ] The immutable official adapter fixture (`ext.bidder` only) is an expected safe
+      drop because the live runner requires `creativeurl`/`tagtype`.
+- [ ] `iframe` and `script` parse into strict enum variants. With
+      `allow_script_creatives = false`, every script bid is safe-dropped before
+      per-impression reduction and winner selection; iframe bids remain eligible.
+- [ ] With one higher-priced script bid and one lower-priced iframe bid for the same
+      impression, the disabled script cannot win and the iframe candidate survives.
+      With only disabled script bids, APS returns no bid.
+- [ ] An APS bid with `adm` but no valid URL/tag type is dropped. When valid renderer
+      metadata coexists with `adm`, all markup is excluded from the browser envelope
+      and `Bid.creative`.
+- [ ] HTTP 204, empty/missing `seatbid`, and seat bids with no bids are normal no-bids.
+- [ ] Legacy `{ "contextual": ... }` is `Error`/`unexpected_response_shape`.
+- [ ] Drop individual bids with unknown/missing `impid`, invalid price/currency/media,
+      missing/zero/out-of-range/incompatible `w` or `h`, missing bid ID, invalid tag
+      type, disabled script capability, or invalid creative URL.
+- [ ] Creative URLs using HTTP, credentials, excessive length, malformed syntax, or the
+      configured publisher origin are rejected.
+- [ ] One structurally malformed bid does not discard another valid bid. Invalid JSON or
+      non-representable numeric literals fail the complete response.
+- [ ] APS `nurl`/`burl` are intentionally discarded, and top-level `ext.userSyncs`
+      reaches neither `Bid`, diagnostics, nor renderer data.
+- [ ] Diagnostics contain only fixed reason/count keys and never IDs, URLs, payloads,
+      account values, seats, or raw extension data.
+
+### 4.2 Exact envelope and collision tests
+
+- [ ] Add `test/fixtures/aps-renderer-v1.json` containing exactly:
+  - root `seatbid`;
+  - one seat object containing only `bid`;
+  - one bid containing only `id`, `price`, `w`, `h`, and `ext`; and
+  - `ext` containing only `creativeurl` and `tagtype`.
+- [ ] Assert Rust serialization equals that golden JSON semantically and that decoded
+      `aaxResponse` has no top-level ID/currency, seat, impid, ad/crid/domain,
+      notifications, markup, syncs, sibling bids, or unknown extensions.
+- [ ] Remove unknown fields after transient parsing; do not copy an upstream extension
+      map wholesale into the renderer envelope.
+- [ ] Add a response over the 256 KiB pre-base64 cap and assert
+      `render_payload_too_large`.
+- [ ] Add two valid APS bids with the same impression/seat. Assert the parser returns
+      only the highest price; for a tie, lexicographically lowest bid ID wins with its
+      own matching renderer payload.
+
+### 4.3 Implementation
+
+- [ ] Remove all legacy request/response types, slot maps and tests.
+- [ ] Special-case HTTP 204 before body collection/JSON parsing.
+- [ ] Parse the response as `serde_json::Value`, validate response-level fields, then
+      validate each bid independently so a wrong-typed bid cannot discard valid
+      siblings.
+- [ ] Set `Bid.bidder = "aps"`; discard upstream seat/network ID unless a bounded typed
+      internal consumer is introduced. Set APS `nurl = None` and `burl = None`.
+- [ ] Require present, positive, compatible `w` and `h`. Apply
+      `allow_script_creatives` before adding a candidate to the per-impression group so
+      a disabled script cannot reach floors, mediation, or winner selection.
+- [ ] Validate creative URL against the configured publisher origin and build the exact
+      allowlisted envelope from new values rather than cloning upstream objects.
+- [ ] Group accepted candidates by `impid`, reduce deterministically to one, then build
+      the final `AuctionResponse` and aggregate diagnostics.
+- [ ] Preserve `collect_response_bounded(..., UPSTREAM_RTB_MAX_RESPONSE_BYTES, "aps")`,
+      TRACE-only raw body logging, and safe aggregate normal logs.
+- [ ] Run:
+
+  ```bash
+  cargo test-fastly integrations::aps::tests
+  cargo fmt --all -- --check
+  cargo clippy-fastly
+  ```
+
+**Expected result:** APS returns at most one priced, renderer-compatible candidate per
+impression, with an exact browser envelope and stable `bidder = "aps"`.
+
+---
+
+## Task 5: Emit APS winners through `/auction` and prove direct selection
+
+**What:** Use the new identifiers and renderer in the OpenRTB response without
+manufacturing an empty creative, then replace the old mediation assumptions.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/auction/formats.rs`
+- Modify: `crates/trusted-server-core/src/openrtb.rs` if a typed bid extension helper is
+  useful
+- Modify: `crates/trusted-server-core/src/auction/orchestrator.rs`
+- Test: format and orchestrator test modules
+
+### 5.1 Failing tests
+
+- [ ] `/auction` maps `Bid.bid_id`, `ad_id`, and optional `creative_id` to OpenRTB
+      `id`, `adid`, and optional `crid` instead of fabricating APS identifiers.
+- [ ] An APS renderer winner has no `adm` key and has
+      `ext.trusted_server.renderer` with the complete versioned descriptor—not a
+      `{type,version}` abbreviation.
+- [ ] A normal `Bid.creative` is still sanitized and rewritten before becoming `adm`.
+- [ ] A winning bid with neither creative nor renderer fails explicitly; it does not
+      serialize `adm: ""`.
+- [ ] A renderer descriptor does not enter the HTML sanitizer.
+- [ ] APS decoded price wins with no mediator when it is highest.
+- [ ] APS loses to a higher clear-price bid.
+- [ ] APS is removed below a slot floor.
+- [ ] Optional mediator presence does not make decoded APS pricing special.
+
+### 5.2 Implementation
+
+- [ ] Add a typed bid-extension serializer for `trusted_server.renderer`.
+- [ ] In `convert_to_openrtb_response`:
+  - preserve real bid/ad/creative IDs;
+  - process `creative` only through the existing sanitize/rewrite branch;
+  - emit renderer ext only for a typed renderer; and
+  - return an auction error for a winner with no render source.
+- [ ] Remove stale “mediation should have provided creative” APS assumptions and encoded
+      price comments.
+- [ ] Replace old orchestrator APS tests with decoded-price/floor tests. Do not change the
+      winner algorithm itself.
+- [ ] Run:
+
+  ```bash
+  cargo test-fastly auction::formats
+  cargo test-fastly auction::orchestrator
+  cargo fmt --all -- --check
+  ```
+
+**Expected result:** Direct clients receive a priced APS winner with an explicit render
+capability and never mistake an empty `adm` for a creative.
+
+---
+
+## Task 6: Preserve APS renderer state through mediation and publisher bid maps
+
+**What:** Ensure both publisher paths expose the same APS descriptor and a mediator
+cannot accidentally strip it.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/integrations/adserver_mock.rs`
+- Modify: `crates/trusted-server-core/src/publisher.rs`
+- Test: tests in both files
+
+### 6.1 Mediation tests
+
+- [ ] Add a regression test documenting the current collision: two unreduced APS bids
+      with the same provider/slot/bidder overwrite the `(provider, slot, bidder)` index
+      and can restore the wrong renderer.
+- [ ] Feed the parser's reduced APS response into mediation and prove only the selected
+      source bid reaches the index/request and its bid ID/renderer survive reconstruction.
+- [ ] Keep the broader mediator index unchanged in this issue; APS avoids its existing
+      ambiguity by returning one candidate per impression. Extend restoration only for
+      `bid_id`, optional `creative_id`, and renderer while preserving existing non-APS
+      notification/cache behavior.
+- [ ] Run:
+
+  ```bash
+  cargo test-fastly integrations::adserver_mock
+  ```
+
+### 6.2 Bid-map tests
+
+- [ ] Add failing `build_bid_map` tests proving:
+  - APS renderer is present when `include_adm = false`;
+  - renderer data is identical for initial-page and page-bids serialization;
+  - `hb_bidder` is always `aps`, never upstream seat/network ID;
+  - `hb_adid` uses APS selected `bid_id` ahead of OpenRTB `adid`;
+  - PBS Cache UUID remains highest priority for PBS bids;
+  - APS `nurl`/`burl` are absent while existing non-APS notifications are unchanged;
+  - no general metadata is exposed in normal mode;
+  - `aaxResponse` and account data survive `build_bids_script` escaping without
+    breaking out of the script; and
+  - a non-APS bid has no renderer property.
+- [ ] Update `build_bid_map` to serialize typed renderer data normally while retaining
+      `adm`/`debug_bid` only under the existing debug flag.
+- [ ] Set APS `hb_adid` from the descriptor's selected bid ID. Preserve current cache and
+      ad-ID fallbacks.
+- [ ] Update `debug_bid` deliberately: IDs may be shown under existing debug behavior,
+      but do not duplicate the potentially large encoded renderer envelope there.
+- [ ] Run:
+
+  ```bash
+  cargo test-fastly publisher
+  cargo fmt --all -- --check
+  ```
+
+**Expected result:** Direct, mediated, initial-navigation, and SPA auction paths retain
+one typed APS render contract without exposing losing bids or arbitrary metadata.
+
+---
+
+## Task 7: Add the opaque APS renderer endpoint and direct-auction integration
+
+**What:** Serve a static renderer document with its own CSP, validate the exact data the
+vendor consumes, and keep all APS/bidder execution below an outer opaque-origin
+sandbox.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/integrations/aps.rs`
+- Modify: `crates/trusted-server-core/src/integrations/mod.rs`
+- New: `crates/trusted-server-js/lib/src/integrations/aps/render.ts`
+- New: `crates/trusted-server-js/lib/test/integrations/aps/render.test.ts`
+- New: `crates/trusted-server-js/lib/test/fixtures/aps-renderer-v1.json`
+- Modify: `crates/trusted-server-js/lib/src/core/types.ts`
+- Modify: `crates/trusted-server-js/lib/src/core/auction.ts`
+- Modify: `crates/trusted-server-js/lib/src/core/request.ts`
+- Modify: `crates/trusted-server-js/lib/test/core/auction.test.ts`
+- Modify/add: `crates/trusted-server-integration-tests/browser/`
+
+### 7.1 Shared wire contract
+
+- [ ] Add TypeScript discriminated types matching the Rust descriptor, with optional
+      `creativeId`.
+- [ ] Make the shared fictional JSON fixture the source of truth: Rust serialization
+      equals it and TS tests import it.
+- [ ] Add `/auction` parser tests for valid renderer ext, absent APS `adm`, optional
+      creative ID, ordinary non-APS `adm`, unrelated ext, and malformed descriptors.
+- [ ] Keep parsing structural; complete trust validation happens before DOM/message
+      side effects.
+
+### 7.2 Static renderer endpoint
+
+- [ ] Add APS to `integrations::builders()` as a proxy registration using the same
+      validated `ApsConfig`, `.with_proxy(...)`, and `.without_js()`.
+- [ ] Register only `GET /integrations/aps/renderer` and return a static document—no
+      account, bid, URL, or response data in HTML.
+- [ ] Add Rust tests for exact route registration, method rejection, content type,
+      `nosniff`, `Referrer-Policy: no-referrer`, and the explicit renderer CSP. The CSP
+      must repeat the approved sandbox tokens without `allow-same-origin` so direct
+      embedding cannot bypass the opaque boundary.
+- [ ] Before loading the vendor runner, the static initializer reads and strictly
+      validates the expected nonce from the iframe URL fragment, stores it, removes the
+      fragment from visible history, and installs its one-message listener.
+- [ ] The static script accepts one parent message, verifies `event.source`, version,
+      exact structure, and equality with the independently fragment-bound nonce, then
+      removes its listener, initializes the official account queue, dispatches
+      `prebid/creative/render`, and dynamically loads the fixed runner. Reply with the
+      accepted nonce only after runner load (or report runner failure). Because the
+      sandbox origin is opaque, use `"*"` as the target origin in both directions but
+      require the exact child/source window and one-time nonce.
+- [ ] Load only the fixed Amazon runner URL; do not interpolate renderer data into
+      script text, HTML, `srcdoc`, `document.write`, or another executable sink.
+- [ ] Run:
+
+  ```bash
+  cargo test-fastly integrations::aps
+  cargo test-fastly integrations::tests
+  ```
+
+### 7.3 Decode and cross-check consumed data
+
+- [ ] `validateApsRenderer` must base64-decode UTF-8 JSON and require the exact allowlist:
+      one seat, one bid, exact bid/ext keys, finite price, dimensions, URL, and tag type.
+- [ ] Cross-check decoded ID/dimensions/URL/tag type against descriptor fields.
+- [ ] Reject unknown keys, markup, notifications, syncs, invalid base64/UTF-8/JSON,
+      non-HTTPS or credential-bearing URLs, and URLs matching `location.origin`.
+- [ ] Validate before slot clearing, `stopImmediatePropagation`, iframe creation, or
+      `postMessage`.
+- [ ] Repeat message/envelope validation inside the static renderer document.
+
+### 7.4 Opaque direct renderer
+
+- [ ] `renderApsCreative` creates a sized iframe with `src` set to
+      `/integrations/aps/renderer`; it never uses outer `srcdoc`.
+- [ ] Apply exactly these tokens and assert `allow-same-origin` is absent:
+
+  ```text
+  allow-forms
+  allow-pointer-lock
+  allow-popups
+  allow-popups-to-escape-sandbox
+  allow-scripts
+  allow-top-navigation-by-user-activation
+  ```
+
+- [ ] Generate at least 128 random bits per frame with `crypto.getRandomValues`, encode
+      them as strict base64url, and set `iframe.src` to the trusted renderer URL with
+      that nonce in the fragment before insertion/navigation. After load, post the
+      validated descriptor with the same nonce. Clear existing content and reveal the
+      frame only after an exact source- and nonce-bound runner-ready acknowledgement;
+      remove an unacknowledged or failed hidden frame after a bounded timeout.
+- [ ] Reject a missing/malformed fragment, nonce mismatch, repeat, or stale message; a
+      nonce carried only in the posted message is not sufficient.
+- [ ] Leave existing slot content intact on validation/load failure and log no payload,
+      account, URL or bid ID.
+- [ ] Dispatch valid APS renderer bids before ordinary non-APS `adm`; do not change the
+      generic sanitizer/renderer.
+
+### 7.5 Restrictive-CSP and origin proof
+
+- [ ] Add Playwright coverage using a restrictive publisher CSP that permits only
+      `frame-src 'self'` for the renderer route.
+- [ ] Use a local fictional runner/creative implementation matching observed APS
+      iframe/script behavior; CI must not depend on the live Amazon script.
+- [ ] Prove iframe and fetched-HTML script creatives cannot read or modify
+      `top.document`, even though the nested vendor frame requests
+      `allow-same-origin`. Also embed the renderer without an iframe sandbox attribute
+      and prove the response-level CSP sandbox still keeps it opaque.
+- [ ] Prove the renderer route's CSP permits required HTTPS ad resources, the outer
+      frame stays opaque, malformed/mismatched envelopes or fragment/message nonce
+      mismatches do not clear slots, replay is rejected, and the runner can size/render
+      without parent-origin `frameElement` access.
+- [ ] Keep `allow_script_creatives = false` for normal traffic during local browser
+      proof. If script rendering/resizing fails, keep the server gate false and stop for
+      an APS-supported isolated renderer contract. Never add `allow-same-origin` to the
+      outer frame.
+- [ ] Run:
+
+  ```bash
+  cd crates/trusted-server-js/lib
+  npx vitest run test/integrations/aps/render.test.ts test/core/auction.test.ts
+  node build-all.mjs
+  npm run format
+
+  cd ../../../crates/trusted-server-integration-tests/browser
+  npx playwright test
+  ```
+
+**Expected result:** Direct APS rendering uses a separately served document below an
+opaque outer sandbox with a pre-bound, one-time nonce; script bids cannot win while the
+default-off server capability is disabled.
+
+---
+
+## Task 8: Integrate APS with the GPT/Prebid Universal Creative bridge
+
+**What:** Serve APS descriptors through the existing source-checked `Prebid Request`
+message path and stop signaling the native APS SDK for TS winners.
+
+**Files:**
+
+- Modify: `crates/trusted-server-js/lib/src/integrations/gpt/index.ts`
+- Modify: `crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts`
+- Modify if needed: `crates/trusted-server-js/lib/test/integrations/gpt/index.test.ts`
+- Reuse: `src/integrations/aps/render.ts`
+
+### 8.1 Add failing bridge tests
+
+- [ ] A matching APS `hb_adid` and renderer:
+  - is accepted only from the owning slot's message source;
+  - is fully decoded/cross-checked before `stopImmediatePropagation()`;
+  - does not fetch PBS Cache or fire generic nurl/burl beacons;
+  - posts one exact serializable `Prebid Response` using the deployed Universal
+    Creative renderer version; and
+  - creates only the opaque renderer-route iframe before posting the descriptor.
+- [ ] Two concurrent requests for the same APS ad ID do not double-render.
+- [ ] An APS descriptor requested from another slot is ignored.
+- [ ] Invalid renderer data does not stop another legitimate handler and does not clear
+      a slot.
+- [ ] Existing debug-ADM and PBS Cache tests remain green.
+- [ ] `adInit()` does not call `apstag.setDisplayBids()` for a bid with a Trusted Server
+      APS renderer, even if `window.apstag` exists.
+- [ ] A publisher-owned native APS SDK remains otherwise untouched; TS does not delete,
+      reinitialize, or monkey-patch it.
+
+### 8.2 Implement bridge support
+
+- [ ] Import the shared envelope validator/opaque-frame helper without importing the
+      full Prebid bundle.
+- [ ] Add the APS branch after source-slot ownership and full renderer validation, before
+      debug ADM/PBS Cache branches.
+- [ ] Define and fixture-test the exact Universal Creative message object, including
+      `rendererVersion`; do not describe or send a non-cloneable function.
+- [ ] Compute an absolute `/integrations/aps/renderer` URL from the trusted publisher
+      page origin before crossing into GAM; a relative URL in the creative frame would
+      resolve against GAM. Validate that URL separately from APS data.
+- [ ] Keep renderer source static and limited to creating the sandboxed iframe with that
+      absolute renderer URL plus a fresh nonce fragment, then post validated data and
+      the matching nonce after load and resolve only after the source- and nonce-bound
+      renderer-ready acknowledgement.
+- [ ] Preserve `renderingAdIds` and live `window.tsjs.bids`. Do not call
+      `fireWinBillingBeacons` for APS; existing non-APS beacon deduplication is unchanged.
+- [ ] Remove the `apstag?.setDisplayBids?.()` block that treats every APS targeting bid
+      as a native SDK bid. Update comments accordingly.
+- [ ] Run:
+
+  ```bash
+  cd crates/trusted-server-js/lib
+  npx vitest run \
+    test/integrations/aps/render.test.ts \
+    test/integrations/gpt/ad_init.test.ts \
+    test/integrations/gpt/index.test.ts \
+    test/integrations/gpt/spa_hook.test.ts
+  npm run format
+  ```
+
+**Expected result:** Initial navigation and SPA page-bids render the selected APS bid
+through the same typed bootstrap, without relying on native `apstag` state.
+
+---
+
+## Task 9: Update operator configuration, migration docs, and changelog
+
+**What:** Replace all legacy public guidance and document test/rollout dependencies.
+
+**Files:**
+
+- Modify: `trusted-server.example.toml`
+- Rewrite: `docs/guide/integrations/aps.md`
+- Modify: `CHANGELOG.md`
+- Review references found by:
+
+  ```bash
+  rg -n 'e/dtb/bid|pub_id|amznbid|amznp|setDisplayBids|APS.*mediat' \
+    --glob '!target/**' .
+  ```
+
+- [ ] Change the example to `account_id` and `/e/pb/bid`, with fictional values.
+- [ ] Document `pub_id` as a compatibility alias and duplicate-name failure.
+- [ ] Remove any claim that `slot_id`/`bidders.aps.slotID` is required for the OpenRTB
+      provider.
+- [ ] Document banner-only scope, USD comparison, decoded-price direct winners, and
+      aggregate diagnostics.
+- [ ] Document both rendering paths, static renderer endpoint, fixed APS runner URL,
+      exact envelope allowlist, fragment-bound nonce, outer sandbox without
+      `allow-same-origin`, renderer endpoint/publisher CSP requirements, and the
+      default-off `allow_script_creatives` server gate.
+- [ ] State that user sync and Trusted Server firing of APS `nurl`/`burl` are not
+      implemented.
+- [ ] State that public APS metadata says PBS unsupported and production edge traffic
+      still requires account-team confirmation.
+- [ ] Add a cohort rollout checklist:
+  - TS APS enabled;
+  - native APS demand disabled for that cohort;
+  - GAM line item/Universal Creative prepared for `hb_bidder=aps` and selected
+    `hb_adid`;
+  - iframe rendering observed first while `allow_script_creatives = false`;
+  - script enabled only for the isolated cohort after local browser proof, then observed
+    in a real browser; and
+  - no real IDs/tokens captured in docs or fixtures.
+- [ ] Document rollback as disabling APS, restoring native APS for the cohort, or binary
+      rollback—not a legacy config switch.
+- [ ] Add a breaking/migration changelog entry for endpoint and canonical field changes.
+- [ ] Run:
+
+  ```bash
+  cd docs
+  npx prettier --write \
+    superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md \
+    superpowers/plans/2026-07-15-aps-openrtb-first-class-integration.md \
+    guide/integrations/aps.md
+  npm run format
+  ```
+
+**Expected result:** Operators cannot accidentally configure the old protocol or assume
+user sync/video/native SDK behavior that no longer exists.
+
+---
+
+## Task 10: Controlled APS and browser verification
+
+**What:** Validate the uncertain external contract without putting account-specific
+material into source control.
+
+**Prerequisites:** Controlled APS account/config supplied out of band; native APS demand
+disabled for the test cohort; representative GAM line items and publisher CSP; local
+restrictive-CSP/opaque-origin script proof already passing.
+
+- [ ] Deploy with APS enabled only in the controlled cohort and
+      `allow_script_creatives = false` initially.
+- [ ] Prove with parser/orchestrator telemetry and tests that disabled script bids are
+      removed before candidate reduction/winner selection and cannot leave a winning
+      slot without a renderer.
+- [ ] Confirm the outbound body has:
+  - `/e/pb/bid` endpoint;
+  - `ext.account` from operator config;
+  - `ext.sdk = { source: "prebid", version: "2.2.0" }`;
+  - expected impressions, floors, page/device/privacy fields; and
+  - no latitude/longitude or disallowed identity fields.
+- [ ] Confirm a bid returns a decoded price and can beat another provider with no
+      mediator.
+- [ ] Confirm the browser receives the exact one-bid allowlist in `aaxResponse`, with no
+      seat, impid, IDs beyond selected bid ID, domains, notifications, markup, syncs,
+      unknown extensions, sibling bids, or losing seats.
+- [ ] Confirm the immutable official no-renderer fixture safe-drops and separately
+      observe real `creativeurl`/`tagtype` responses.
+- [ ] Exercise a real `tagtype=iframe` response through direct `/auction` and
+      navigation/page-bids/GAM while the script gate remains false.
+- [ ] Only after the local browser proof, set `allow_script_creatives = true` for this
+      isolated cohort and exercise a real `tagtype=script` response through both paths.
+      Do not enable it for other traffic yet.
+- [ ] Verify the exact envelope works with the current APS runner. If it does not, record
+      only missing field names/shape, stop rollout, consult APS, and update spec/tests;
+      never preserve unknown fields or fall back to the full response.
+- [ ] Verify the outer frame has an opaque origin, restrictive publisher CSP succeeds,
+      click-through/dimensions work, and bidder content cannot access parent DOM.
+- [ ] If the fixed runner cannot render/resize script creatives without outer
+      `allow-same-origin`, restore `allow_script_creatives = false` and stop; do not
+      weaken the boundary.
+- [ ] Verify `apstag.setDisplayBids()` is not called for the TS winner and APS is not
+      participating twice.
+- [ ] Verify INFO/WARN logs and auction summaries contain no raw response or sensitive
+      values.
+- [ ] Obtain APS account-team confirmation before enabling broad production traffic.
+
+**Expected result:** Iframe creatives render under the default policy; script creatives
+become winner-eligible only for the staged cohort after both browser proof phases pass,
+or the server gate returns to false and rollout stops with a bounded contract gap.
+
+---
+
+## Task 11: Final regression and repository verification
+
+Run the complete required matrix from the repository root.
+
+### Rust formatting, tests, and lint
+
+- [ ] Run:
+
+  ```bash
+  cargo fmt --all -- --check
+  cargo test-fastly
+  cargo test-axum
+  cargo test-cloudflare
+  cargo test-spin
+  cargo clippy-fastly
+  cargo clippy-axum
+  cargo clippy-cloudflare
+  cargo clippy-cloudflare-wasm
+  cargo clippy-spin-native
+  cargo clippy-spin-wasm
+  ```
+
+### Cross-adapter parity
+
+- [ ] Run:
+
+  ```bash
+  cargo test \
+    --manifest-path crates/trusted-server-integration-tests/Cargo.toml \
+    --test parity
+  ```
+
+### JS and docs
+
+- [ ] Run:
+
+  ```bash
+  (cd crates/trusted-server-js/lib && node build-all.mjs)
+  (cd crates/trusted-server-js/lib && npx vitest run)
+  (cd crates/trusted-server-js/lib && npm run format)
+  (cd crates/trusted-server-integration-tests/browser && npx playwright test)
+  (cd docs && npm run format)
+  ```
+
+### Final review
+
+- [ ] Run:
+
+  ```bash
+  git diff --check
+  git status --short
+  ```
+
+- [ ] Review every `Bid` construction and mediator conversion for the new identifiers
+      and renderer field.
+- [ ] Review every `adm` assignment and prove it still passes through server
+      sanitization.
+- [ ] Review every renderer serialization boundary and prove only winning APS data is
+      exposed.
+- [ ] Review logs for account IDs, URLs, bid IDs, payloads, and consent/EID leakage.
+- [ ] Verify no real controlled-account data entered source, tests, docs, comments, or
+      snapshots.
+- [ ] Compare the final behavior against all acceptance criteria in the design spec.
+
+---
+
+## Suggested implementation checkpoints
+
+If commits are requested, keep reviewable checkpoints aligned with the tasks:
+
+1. `Add typed APS renderer state to auction bids`
+2. `Build APS OpenRTB requests`
+3. `Parse APS OpenRTB responses`
+4. `Carry APS renderer metadata to clients`
+5. `Render APS creatives in TSJS and GPT`
+6. `Document APS OpenRTB migration`
+
+Do not combine unrelated refactors with these checkpoints.
diff --git a/docs/superpowers/specs/2026-03-19-auction-orchestration-flow-design.md b/docs/superpowers/specs/2026-03-19-auction-orchestration-flow-design.md
index 02a86d629..4ecfa9e75 100644
--- a/docs/superpowers/specs/2026-03-19-auction-orchestration-flow-design.md
+++ b/docs/superpowers/specs/2026-03-19-auction-orchestration-flow-design.md
@@ -1,5 +1,11 @@
 # 🎯 Auction Orchestration Flow
 
+> [!WARNING]
+> The APS portions of this historical design are superseded by
+> [APS OpenRTB First-Class Integration](./2026-07-15-aps-openrtb-first-class-integration-design.md).
+> The legacy `/e/dtb/bid` contextual flow and encoded-price mediation described below
+> are not current runtime behavior.
+
 ## 🔄 System Flow Diagram
 
 ```mermaid
diff --git a/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md b/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md
new file mode 100644
index 000000000..2f79577ed
--- /dev/null
+++ b/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md
@@ -0,0 +1,843 @@
+# Amazon APS OpenRTB First-Class Integration Design
+
+**Date:** 2026-07-15<br>
+**Status:** Approved for implementation and test; production rollout remains subject to APS account-team validation<br>
+**Issue:** [#764 — Add the Amazon APS Prebid Adapter as first class integration](https://github.com/IABTechLab/trusted-server/issues/764)
+
+---
+
+## 1. Goal
+
+Replace Trusted Server's legacy Amazon Publisher Services (APS/TAM) wire contract
+with the OpenRTB contract used by the official APS Prebid.js adapter, so APS can:
+
+1. receive a valid OpenRTB request for each eligible banner slot;
+2. return a decoded CPM that competes directly without a mediator;
+3. render winning `iframe` and `script` creatives through a deliberate APS browser
+   renderer; and
+4. preserve Trusted Server's existing privacy, sanitization, bounded-I/O, and
+   observability invariants.
+
+The integration uses its built-in production OpenRTB endpoint by default. Examples use a fictional override endpoint.
+
+The implementation may proceed against fictional fixtures and a controlled APS test
+account before APS confirms Fastly/edge-originated production support. Lack of that
+confirmation is a rollout gate, not an implementation blocker.
+
+---
+
+## 2. Approved decisions
+
+| Decision                  | Resolution                                                                                                                                                                                                                                                                               |
+| ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Edge/server support       | Implement and test now; do not claim production support until APS confirms it for the account.                                                                                                                                                                                           |
+| APS SDK identity          | Send `ext.sdk.source = "prebid"`, which APS has approved as the starting identity. Match the current adapter version with `ext.sdk.version = "2.2.0"`.                                                                                                                                   |
+| Creative response payload | Send an exact allowlisted envelope containing one bid with only `id`, `price`, `w`, `h`, `ext.creativeurl`, and `ext.tagtype`. Do not preserve unknown fields or silently fall back to the full response.                                                                                |
+| Sandbox compatibility     | APS confirmed `allow-same-origin` compatibility, but Trusted Server must not grant it on the outer security boundary. The outer renderer iframe has an opaque origin; descendant APS frames cannot relax an ancestor sandbox restriction. `script` remains disabled until browser proof. |
+| APS notifications         | Do not expose or fire APS `nurl`/`burl` in this issue. The fixed APS runner owns creative tracking until APS approves a separate notification contract.                                                                                                                                  |
+| APS user sync             | Out of scope. Do not expose or execute `ext.userSyncs`.                                                                                                                                                                                                                                  |
+| Migration                 | Cut over directly. Keep `pub_id` only as a configuration alias; do not retain a legacy/OpenRTB protocol switch.                                                                                                                                                                          |
+| Native APS coexistence    | When a Trusted Server APS renderer descriptor is present, Trusted Server must not call `apstag.setDisplayBids()`. The test cohort must disable native APS demand to avoid duplicate participation.                                                                                       |
+
+---
+
+## 3. Primary upstream evidence
+
+The design follows immutable official APS/Prebid sources:
+
+- [APS endpoint and adapter version](https://github.com/prebid/Prebid.js/blob/cf8537da6b54223aea1bb29c6f939ba3b615a273/modules/apsBidAdapter.js#L16-L21)
+- [OpenRTB request enrichment and privacy filtering](https://github.com/prebid/Prebid.js/blob/cf8537da6b54223aea1bb29c6f939ba3b615a273/modules/apsBidAdapter.js#L118-L187)
+- [Request dispatch](https://github.com/prebid/Prebid.js/blob/cf8537da6b54223aea1bb29c6f939ba3b615a273/modules/apsBidAdapter.js#L247-L265)
+- [Creative construction](https://github.com/prebid/Prebid.js/blob/cf8537da6b54223aea1bb29c6f939ba3b615a273/modules/apsBidAdapter.js#L279-L313)
+- [Purpose-1-gated user sync behavior](https://github.com/prebid/Prebid.js/blob/cf8537da6b54223aea1bb29c6f939ba3b615a273/modules/apsBidAdapter.js#L322-L345)
+- [Official APS adapter documentation and capability metadata](https://github.com/prebid/prebid.github.io/blob/adc4af1425c3433c81ee85560519cab0f7d17887/dev-docs/aps.md)
+
+The capability metadata says `pbjs: true` and `pbs: false`. The public source proves
+browser Prebid behavior; it does not by itself establish an approved production
+server-to-server contract for Fastly or another edge runtime.
+
+The immutable adapter test fixture is not a renderer contract: it accepts a banner bid
+whose extension contains only `bidder`, then verifies that the adapter builds the
+script wrapper. The unversioned live `prebid-creative.js` observed on 2026-07-15
+(SHA-256 `ac99774f4d0f6b34aed7584952661007125345b7433970edd832e8451f9a6aef`)
+requires `bid.id`, `price`, `w`, `h`, `ext.creativeurl`, and `ext.tagtype`. This
+live-runner observation is intentionally treated as unverified behavior: the official
+fixture must safe-drop in Trusted Server, while controlled-account responses provide
+the separate renderer-compatible test path.
+
+---
+
+## 4. Current-state problems
+
+`crates/trusted-server-core/src/integrations/aps.rs` currently:
+
+- POSTs a private `pubId`/`slots`/`pageUrl` payload to `/e/dtb/bid`;
+- requires per-slot `bidders.aps.slotID` or falls back to the incoming slot ID;
+- parses `contextual.slots` rather than OpenRTB `seatbid`;
+- stores encoded `amznbid`/`amznp` values in metadata;
+- sets `Bid.price = None` and `Bid.creative = None`; and
+- therefore cannot produce a direct no-mediator winner or a normal creative.
+
+The generic winner selector intentionally ignores price-less bids. The publisher bid
+map also starts from `bid.price`, so the current behavior is internally consistent but
+cannot satisfy #764.
+
+The existing Prebid provider has a mature OpenRTB builder, but that builder also owns
+PBS-specific bidder params, stored requests, request signing, debug behavior,
+`ext.prebid`, and consent-forwarding policy. Reusing it wholesale would couple APS to
+PBS and increase regression risk.
+
+---
+
+## 5. Scope and non-goals
+
+### 5.1 In scope
+
+- APS banner OpenRTB request construction.
+- APS OpenRTB response/no-bid parsing.
+- Decoded-price direct winner selection.
+- A typed APS renderer descriptor.
+- APS creative rendering in both:
+  - direct `POST /auction` TSJS rendering; and
+  - publisher navigation/page-bids through the GPT/Prebid Universal Creative bridge.
+- Safe aggregate diagnostics.
+- Configuration and documentation migration.
+- Controlled APS account/browser testing for `iframe` and `script` tag types.
+
+### 5.2 Out of scope
+
+- APS video/VAST support. Although the upstream adapter advertises video, this issue
+  enables banner only until Trusted Server has a designed video delivery path.
+- APS `ext.userSyncs` execution or exposure.
+- A generic third-party renderer framework for arbitrary providers.
+- Refactoring the entire Prebid OpenRTB builder.
+- Retaining the legacy `/e/dtb/bid` request/parser behind a runtime switch.
+- Server-side creative URL fetching or caching.
+- Changes to the global HTML sanitizer's allowed elements or attributes.
+- Production support claims before APS account-team confirmation.
+
+---
+
+## 6. Configuration contract and cutover
+
+The canonical configuration becomes:
+
+```toml
+[integrations.aps]
+enabled = false
+account_id = "example-account-id"
+timeout_ms = 800
+allow_script_creatives = false
+```
+
+### 6.1 Compatibility
+
+- Rename `pub_id` to `account_id` in the Rust type, example configuration, and docs.
+- Accept `pub_id` as a serde alias for `account_id` for existing operator configs.
+- Continue accepting a string or integer value during migration. Trim strings, reject
+  empty-after-trim values, and normalize integers to strings.
+- If both names are supplied, deserialization must fail as a duplicate field rather
+  than silently selecting one.
+- Keep `endpoint` as an operator-owned test/override setting, but require HTTPS with a
+  non-empty host and no URL credentials. Its configured endpoint must implement this
+  OpenRTB contract; it is not a legacy-protocol switch. There is no plaintext test
+  exception because the APS response is trusted to select an executable renderer.
+- APS remains disabled by default.
+- `allow_script_creatives` is a separate server-side capability gate and defaults to
+  `false`. It may be set to `true` only for an isolated test cohort after the
+  restrictive-CSP/opaque-origin Playwright proof passes, and may remain enabled for
+  production only after controlled-account `tagtype=script` validation.
+
+### 6.2 Slot configuration
+
+The OpenRTB impression ID is the Trusted Server slot ID. APS's official adapter has no
+per-impression bidder parameters, so the provider no longer reads
+`bidders.aps.slotID`. Existing generic creative-opportunity configuration may continue
+to deserialize that value during migration, but APS documentation must mark it unused
+and remove it from new examples.
+
+---
+
+## 7. APS OpenRTB request design
+
+### 7.1 Builder boundary
+
+Implement an APS-specific builder in `integrations/aps.rs` using the generated types
+re-exported by `openrtb.rs`.
+
+Do not make `PrebidAuctionProvider::to_openrtb` public. Initially duplicate the small
+common mappings so APS policy remains explicit. A provider-neutral helper may be
+extracted later only when tests prove byte-for-byte parity for the fields it owns.
+
+### 7.2 Request shape
+
+For each eligible slot, emit one `imp`:
+
+- `imp.id = slot.id`;
+- banner-only `banner.format` entries for valid dimensions;
+- first valid format in `banner.w`/`banner.h` for APS compatibility;
+- `bidfloor` and `bidfloorcur = "USD"` when a floor exists;
+- `banner.topframe = 0`, matching the official framed-delivery fixture;
+- `secure = 1` unconditionally because APS creative delivery is HTTPS-only; and
+- no `imp.ext.prebid`, stored request, or bidder-parameter extension.
+
+At request level emit:
+
+- `id = AuctionRequest.id`;
+- `tmax = context.timeout_ms`, the same effective budget enforced by the backend;
+- `cur = ["USD"]`;
+- `site.domain`, `site.page`, publisher data, and a valid referrer when known;
+- consent-allowed `user.id` and already-gated EIDs;
+- trusted device UA and client IP;
+- coarse device geo with latitude and longitude explicitly omitted;
+- valid `Accept-Language` and DNT signals from the downstream request;
+- TCF, USP, GPP, and GPP SID signals in their existing Trusted Server OpenRTB
+  placements. COPPA remains omitted because Trusted Server has no trusted COPPA signal
+  source in this issue; and
+- APS request extension:
+
+```json
+{
+  "ext": {
+    "account": "example-account-id",
+    "sdk": {
+      "source": "prebid",
+      "version": "2.2.0"
+    }
+  }
+}
+```
+
+### 7.3 Page and referrer provenance
+
+- Publisher navigation and page-bids continue using the server-derived scheme, host,
+  and matched request path.
+- `POST /auction` should use a valid same-publisher `Referer` URL as the current page
+  instead of always reducing the page to `https://<configured-domain>`; otherwise it
+  falls back to the configured publisher origin.
+- A candidate URL must use HTTP(S), have no userinfo, be length-bounded, and match the
+  configured publisher host before it can become `site.page`.
+- `site.ref` is emitted only when a valid HTTP(S) downstream `Referer` differs from the
+  normalized current page. If the endpoint request's `Referer` is simply the current
+  page, omit `site.ref` rather than mislabeling it as the document's prior referrer.
+- Do not add an unrestricted client-provided URL or copy arbitrary headers.
+
+### 7.4 Privacy rules
+
+The provider consumes the privacy-filtered `AuctionRequest`; it does not independently
+weaken endpoint decisions.
+
+- Existing auction consent denial still returns before contacting APS.
+- APS only receives `request.user.eids`, which endpoint code has already gated.
+- Do not serialize `user.data`, `user.keywords`, `user.gender`, `yob`, `customdata`, or
+  arbitrary context into APS.
+- Remove precise `device.geo.lat` and `device.geo.lon` even if available.
+- Do not forward browser cookies or arbitrary X-\* headers to APS.
+- Request and response payloads may be logged only at TRACE.
+
+---
+
+## 8. Response validation and unified bid mapping
+
+Parse the response envelope as `serde_json::Value`, validate response-level fields,
+and deserialize or validate each `seatbid[].bid[]` independently. This preserves valid
+siblings when one bid has a wrong field type while retaining extension maps needed for
+APS creative metadata. Syntactically invalid JSON still fails the whole response.
+
+### 8.1 Response-level validation
+
+- HTTP `204 No Content` is a normal APS no-bid and returns before body collection or
+  JSON parsing.
+- Other non-success HTTP statuses produce provider `Error` without reflecting the body.
+- Body collection remains capped by `UPSTREAM_RTB_MAX_RESPONSE_BYTES`.
+- Invalid JSON, including a non-representable numeric literal such as an overflowing
+  exponent under the repository's default `serde_json` configuration, or a legacy
+  `contextual` envelope is an error with safe reason `unexpected_response_shape`.
+- Empty/missing `seatbid`, or seat bids containing no bids, is a normal no-bid.
+- Currency must be absent or case-insensitive USD. A non-USD response is dropped
+  because Trusted Server has no currency conversion before winner comparison.
+- Top-level `ext.userSyncs` is ignored and must not enter diagnostics or renderer data.
+
+### 8.2 Bid-level validation
+
+A bid is eligible only when:
+
+- `impid` matches a slot in the request;
+- `price` is finite and non-negative;
+- `mtype` is absent or banner-compatible;
+- `w` and `h` are both present, non-zero, safely convert to `u32`, and are compatible
+  with the requested slot; and
+- it has APS `ext.creativeurl` plus a usable bid ID and an eligible `ext.tagtype`:
+  `iframe` is eligible, while `script` is eligible only when the server-side
+  `allow_script_creatives` capability is enabled. This check happens before candidate
+  reduction and winner selection, so a disabled or otherwise unrenderable script bid
+  cannot win and blank the slot.
+
+An APS `adm` without a valid renderer descriptor is not independently renderable in the
+normal publisher flow and must therefore be dropped. If APS supplies `adm` alongside a
+valid descriptor, remove all markup from the minimized envelope and do not copy it into
+`Bid.creative`. If controlled testing proves markup is required, stop for a separate
+security review rather than forwarding it unsanitized.
+
+`creativeurl` must be an HTTPS URL without userinfo, must not match the configured
+publisher origin, and must stay within a bounded serialized length. Validate the same
+rules again in the browser. It comes only from the HTTPS APS endpoint response, never
+from the client. Unknown tag types and recognized-but-disabled `script` bids are dropped rather than
+passed through.
+
+The pinned official adapter response fixture lacks `creativeurl` and `tagtype`; Trusted
+Server must include that fixture as an expected safe-drop test. A separate fictional
+fixture models the live runner's required extension fields. Controlled APS-account
+validation of both observed tag types remains a rollout prerequisite.
+
+### 8.3 Unified fields and APS candidate reduction
+
+Extend `Bid` with generic identifiers and a typed optional renderer:
+
+```text
+bid_id       <- OpenRTB bid.id
+ad_id        <- OpenRTB bid.adid
+creative_id  <- optional OpenRTB bid.crid
+renderer     <- typed APS renderer descriptor for every accepted APS bid
+```
+
+Set `Bid.bidder = "aps"` unconditionally. Upstream `seat` and `ext.bidder` are APS
+network metadata, not the adapter identity; normalize them only into bounded internal
+fields if an operational consumer is identified, otherwise discard them. Missing,
+numeric, or unexpected seat values do not invalidate an otherwise valid bid and never
+become `hb_bidder`.
+
+Map decoded price, currency, `impid`, dimensions, and `adomain`. Do not map APS `nurl`
+or `burl` in this issue; the vendor runner owns APS creative tracking until a separate
+notification policy is approved.
+
+Before returning `AuctionResponse`, collapse multiple valid APS candidates for the same
+impression to one candidate: highest decoded price wins, with lexicographically lowest
+bid ID as a deterministic tie-break. This produces the same APS result as direct
+winner selection and prevents the current mediator's `(provider, slot, bidder)`
+last-write-wins index from attaching another APS bid's renderer. The mediator still
+restores `bid_id`, optional `creative_id`, and `renderer` for that single APS candidate.
+A two-bids/same-slot/same-seat test is mandatory.
+
+### 8.4 Diagnostics
+
+With APS debug mode disabled, `AuctionResponse.metadata` may contain only bounded aggregate fields, for example:
+
+```json
+{
+  "seatbid_count": 1,
+  "accepted_bid_count": 1,
+  "dropped_bid_count": 0,
+  "drop_reasons": {}
+}
+```
+
+Allowed reason keys are fixed enums such as:
+
+- `empty_seatbid`;
+- `unknown_impid`;
+- `invalid_price`;
+- `unsupported_currency`;
+- `unsupported_media_type`;
+- `invalid_dimensions`;
+- `missing_render_source`;
+- `unsupported_tagtype`;
+- `script_rendering_disabled`;
+- `invalid_creative_url`;
+- `render_payload_too_large`; and
+- `unexpected_response_shape`.
+
+Do not include account IDs, bid IDs, URLs, tokens, consent strings, raw extensions, or
+raw bodies in INFO/WARN diagnostics. Client-facing provider summaries follow the same
+rule by default.
+
+An explicit `[integrations.aps].debug = true` exception is available for controlled test
+sites. It includes the unredacted direct APS request and response under
+`metadata.debug.httpcalls.aps`, using the same request body, request headers, response
+body, response headers, status, and URI fields exposed by Prebid Server debug output.
+If a non-success response body cannot be captured within the existing 2 MiB upstream
+limit, omit `responsebody` rather than misreporting it as empty. The flag defaults to
+`false` and must not change parsing, eligibility, or selection.
+
+---
+
+## 9. Exact APS renderer response envelope
+
+The official adapter gives `prebid-creative.js` the base64-encoded complete response
+and selected bid ID. Trusted Server instead sends an exact allowlisted envelope based
+on the fields required by the live runner observed on 2026-07-15:
+
+```json
+{
+  "seatbid": [
+    {
+      "bid": [
+        {
+          "id": "fictional-selected-bid-id",
+          "price": 1.23,
+          "w": 300,
+          "h": 250,
+          "ext": {
+            "creativeurl": "https://creative.example/render",
+            "tagtype": "iframe"
+          }
+        }
+      ]
+    }
+  ]
+}
+```
+
+The allowlist is exact:
+
+- root: `seatbid` only;
+- selected seat object: `bid` only;
+- selected bid: `id`, `price`, `w`, `h`, and `ext` only; and
+- selected bid extension: `creativeurl` and `tagtype` only.
+
+Do not include top-level ID/currency/extensions, upstream seat, `impid`, `adid`, `crid`,
+`adomain`, notifications, markup, native data, user syncs, unknown extensions, sibling
+bids, or losing seats. Unknown fields may exist transiently while the server validates
+an upstream bid, but they are discarded before renderer construction.
+
+Serialize the allowlisted object once, enforce a 256 KiB pre-base64 maximum, then
+base64 encode with the standard alphabet. Store it in the typed renderer descriptor,
+not general metadata. If the envelope exceeds the cap, drop the bid as non-renderable.
+If controlled APS testing proves the exact envelope insufficient, stop and review the
+specific missing field with APS; do not widen it or fall back to the full response
+automatically.
+
+A single fictional golden fixture under the TSJS test fixtures is the source of truth:
+Rust serialization must equal it, and TypeScript parsing/validation/render-dispatch
+tests must consume that same file.
+
+---
+
+## 10. Renderer descriptor and browser wire formats
+
+### 10.1 Typed descriptor
+
+The Rust and TypeScript contracts represent the same versioned data:
+
+```json
+{
+  "type": "aps",
+  "version": 1,
+  "accountId": "example-account-id",
+  "bidId": "fictional-selected-bid-id",
+  "creativeId": "fictional-creative-id",
+  "tagType": "iframe",
+  "creativeUrl": "https://creative.example/render",
+  "aaxResponse": "base64-data",
+  "width": 300,
+  "height": 250
+}
+```
+
+Only `iframe` and `script` are valid tag-type values. `creativeId` is optional and is
+omitted when APS does not return `crid`; the live runner does not consume it. Version
+mismatch is fail-closed. The APS account identifier is not a secret, but it must still
+be safely serialized and must never be hardcoded from a real account in repository
+fixtures.
+
+### 10.2 `POST /auction`
+
+For APS renderer bids, the OpenRTB response bid contains the complete descriptor:
+
+```json
+{
+  "id": "fictional-selected-bid-id",
+  "impid": "fictional-slot",
+  "price": 1.23,
+  "crid": "fictional-creative-id",
+  "w": 300,
+  "h": 250,
+  "ext": {
+    "trusted_server": {
+      "renderer": {
+        "type": "aps",
+        "version": 1,
+        "accountId": "example-account-id",
+        "bidId": "fictional-selected-bid-id",
+        "creativeId": "fictional-creative-id",
+        "tagType": "iframe",
+        "creativeUrl": "https://creative.example/render",
+        "aaxResponse": "eyJzZWF0YmlkIjpbeyJiaWQiOltdfV19",
+        "width": 300,
+        "height": 250
+      }
+    }
+  }
+}
+```
+
+`creativeId`/`crid` are omitted together when APS does not return `crid`. `adm` is
+omitted, not serialized as an empty string. Ordinary non-APS `adm` behavior is
+unchanged.
+
+### 10.3 Publisher navigation and page-bids
+
+`build_bid_map` adds the same complete descriptor as a normal, non-debug `renderer`
+property for APS winners:
+
+```json
+{
+  "fictional-slot": {
+    "hb_pb": "1.23",
+    "hb_bidder": "aps",
+    "hb_adid": "fictional-selected-bid-id",
+    "renderer": {
+      "type": "aps",
+      "version": 1,
+      "accountId": "example-account-id",
+      "bidId": "fictional-selected-bid-id",
+      "creativeId": "fictional-creative-id",
+      "tagType": "iframe",
+      "creativeUrl": "https://creative.example/render",
+      "aaxResponse": "eyJzZWF0YmlkIjpbeyJiaWQiOltdfV19",
+      "width": 300,
+      "height": 250
+    }
+  }
+}
+```
+
+`hb_adid` priority becomes:
+
+1. PBS Cache UUID for cached Prebid bids;
+2. APS renderer selected bid ID;
+3. existing OpenRTB `adid` fallback.
+
+The complete renderer object is emitted only for the winning bid. It is not gated by
+`debug.inject_adm_for_testing`, and general bid metadata remains debug-only.
+
+---
+
+## 11. Browser rendering design
+
+### 11.1 Static renderer endpoint
+
+Do not put the APS initializer and runner into publisher-origin `srcdoc`. Register APS
+as a proxy-capable integration (without an automatic JS bundle) and serve a static
+renderer document at:
+
+```text
+GET /integrations/aps/renderer
+```
+
+The document contains only static Trusted Server initialization code and the fixed
+`https://client.aps.amazon-adsystem.com/prebid-creative.js` script. Before loading the
+vendor runner, the static initializer reads a strictly encoded, cryptographically
+random per-frame nonce from the iframe URL fragment, stores it as the expected nonce,
+and removes the fragment from visible history. The fragment is not sent in the HTTP
+request. It then receives one versioned renderer descriptor from its embedding parent
+through `postMessage`, verifies `event.source === parent`, and requires the message
+nonce to equal the independently established expected nonce. After the first accepted
+message it removes the listener, initializes the account-keyed APS queue, dispatches
+`CustomEvent("prebid/creative/render", { detail: { aaxResponse, seatBidId } })`, and only
+then dynamically inserts the fixed runner script. On runner load or failure it sends a
+source-bound response carrying the accepted nonce. Because the sandboxed document has
+an opaque origin, both directions use `"*"` as the `postMessage` target origin and rely
+on the exact child/parent window, source checks, one-time fragment-bound nonce, and full
+descriptor validation.
+
+The descriptor is data, never generated script text. No APS-provided HTML, script text,
+URL, account value, or decoded JSON is concatenated into an executable context. The
+vendor runner URL is a compile-time constant. The response carries
+`Content-Type: text/html`, `X-Content-Type-Options: nosniff`,
+`Referrer-Policy: no-referrer`, and a CSP `sandbox` directive containing the
+approved tokens without `allow-same-origin`. The response-level sandbox preserves the
+opaque boundary even if another embedding path omits its iframe sandbox attribute.
+
+### 11.2 Opaque outer sandbox
+
+Both direct and GPT flows load the static endpoint through `iframe.src`, not `srcdoc`,
+with this outer sandbox:
+
+```text
+allow-forms
+allow-pointer-lock
+allow-popups
+allow-popups-to-escape-sandbox
+allow-scripts
+allow-top-navigation-by-user-activation
+```
+
+The outer boundary deliberately omits `allow-same-origin`. The live APS runner grants
+`allow-same-origin` to the nested frame it creates, but a descendant cannot relax an
+ancestor sandbox's origin restriction. Therefore both `iframe` and fetched-HTML
+`script` creatives remain under the outer opaque-origin boundary rather than inheriting
+the publisher origin.
+
+This is a compatibility hypothesis, not an assumption: the current runner also touches
+`frameElement` while resizing. `tagtype=script` is rejected server-side before winner
+selection while `allow_script_creatives` is false. The capability may be enabled for an
+isolated test cohort only after a real-browser test proves that the fixed runner renders
+and resizes correctly without publisher-origin access, and may be enabled beyond that
+cohort only after controlled-account validation. If either test fails, keep the gate
+off and obtain an APS-supported isolated renderer page/origin; do not add
+`allow-same-origin` back to the outer boundary.
+
+### 11.3 Browser validation of consumed data
+
+Before creating or messaging the renderer iframe, TSJS must decode `aaxResponse` and
+validate the exact envelope consumed by the vendor runner:
+
+- root contains only one `seatbid` entry;
+- that entry contains only one `bid`;
+- the bid has exactly `id`, `price`, `w`, `h`, and `ext`;
+- `ext` has exactly `creativeurl` and `tagtype`;
+- bid ID, dimensions, creative URL, and tag type equal the duplicated descriptor fields;
+- price is finite and non-negative;
+- tag type is `iframe`, or `script` from a response the server emitted only after its
+  default-off `allow_script_creatives` eligibility gate;
+- creative URL is bounded HTTPS without credentials and does not match the publisher
+  origin; and
+- no markup, notifications, syncs, or unknown fields are present.
+
+Validation happens before slot clearing, `stopImmediatePropagation()`, iframe creation,
+or message dispatch. The static renderer document repeats the structural/message
+validation as defense in depth.
+
+### 11.4 Direct `/auction` flow
+
+`parseAuctionResponse` accepts either ordinary sanitized `adm` or a structurally typed
+renderer. The request loop performs the full decoded-envelope validation, dispatches a
+valid APS descriptor to `renderApsCreative`, and sends ordinary markup to
+`renderCreativeInline`.
+
+`renderApsCreative` generates at least 128 bits of randomness with
+`crypto.getRandomValues`, base64url-encodes it, and binds it to the static renderer URL
+as a fragment before assigning `iframe.src`. After load, it posts the validated
+descriptor with the same nonce, then waits for an exact source- and nonce-bound runner
+ready acknowledgement before clearing existing content or showing the frame. A runner
+failure or bounded acknowledgement timeout removes the hidden frame. A malformed
+descriptor, malformed fragment, nonce mismatch, replay, stale message, or runner load
+failure leaves existing slot content intact and emits a safe warning.
+
+### 11.5 GPT/page-bids flow
+
+Extend `installTsRenderBridge` while retaining the existing `Prebid Request` parsing and
+source-slot ownership validation. For a valid APS winner, return the exact serializable
+Prebid Universal Creative dynamic-renderer shape, including the supported renderer
+version. The static Trusted Server renderer source may only create the opaque outer
+iframe, load `/integrations/aps/renderer`, post the already validated descriptor, and
+resolve only after the source- and nonce-bound ready acknowledgement; APS or bidder code
+never executes in the Universal Creative renderer frame itself.
+Fixture-test this message against the deployed Universal Creative protocol rather than
+assuming a function can be structured-cloned. Include a trusted absolute
+`rendererUrl`, computed from the publisher page origin by TSJS, because a relative URL
+inside the GAM creative would resolve against the GAM origin. The dynamic renderer
+must accept only that data field and the validated APS descriptor.
+
+Call `stopImmediatePropagation()` only after ownership and complete envelope validation
+succeed. Preserve in-flight render deduplication, but do not invoke the generic
+win/billing beacon path for APS. Existing debug-ADM and PBS Cache branches remain
+unchanged.
+
+When the winning bid has a Trusted Server APS renderer, do not call
+`apstag.setDisplayBids()`. The native APS SDK may remain installed by the CMS for other
+cohorts, but it is not the renderer or bid source for that TS winner.
+
+### 11.6 CSP and real-browser gate
+
+Because the outer frame navigates to a real response, it uses that response's CSP
+instead of inheriting publisher `srcdoc` CSP. The renderer endpoint starts from this
+explicit ad-compatible policy, tightened if controlled testing permits:
+
+```text
+default-src 'none';
+script-src 'unsafe-inline' https:;
+connect-src https:;
+frame-src https:;
+img-src https: data:;
+media-src https: blob:;
+style-src 'unsafe-inline' https:;
+font-src https: data:;
+```
+
+The publisher must permit `frame-src 'self'` for the direct renderer endpoint. The GAM
+Universal Creative context must also permit framing the absolute publisher renderer
+URL. The broad HTTPS resource allowances apply only inside the opaque sandbox and are
+required because the APS runner and bidder HTML may load arbitrary HTTPS ad resources.
+
+Add a Playwright test under `crates/trusted-server-integration-tests/browser` with a
+restrictive publisher CSP. It must prove the renderer endpoint loads, APS initializes,
+both tag types obey the outer opaque-origin boundary, a fictional script creative
+cannot access `top.document`, and malformed descriptors do not clear the slot. The server-side `allow_script_creatives` gate stays false during normal winner
+selection until this test passes. It may then be enabled only for the controlled test
+cohort needed to validate real rendering and remains false elsewhere until that
+validation also passes.
+
+---
+
+## 12. Sanitization and security invariants
+
+- `sanitize_creative_html` remains mandatory for every ordinary
+  `Bid.creative`/`adm` value.
+- Its element, attribute, URI, size, and fail-closed rules do not change.
+- APS executable rendering is a separate typed capability; it is never disguised as
+  sanitized `adm`.
+- Only a server-validated APS descriptor with an exact browser-validated envelope can
+  select that capability.
+- Unknown providers cannot request the APS renderer through arbitrary metadata.
+- The server never fetches `creativeurl`, avoiding an SSRF/redirect/content-type
+  service in the auction path.
+- Server and browser both require a bounded HTTPS creative URL without credentials and
+  reject the publisher origin.
+- APS/bidder execution occurs only below an outer opaque-origin sandbox. No test may
+  treat absence of `innerHTML` alone as proof; cover `srcdoc`, script text,
+  `document.write`, and message-driven sinks.
+- Existing same-origin/no-CORS-preflight protection for page-bids remains unchanged.
+- Per-user injected HTML stays private/non-shared, and page-bids stays no-store.
+- Existing upstream body caps and auction deadlines remain in force.
+
+---
+
+## 13. APS notification policy
+
+Do not map APS `nurl` or `burl` into the shared browser bid map in this issue. The live
+APS runner owns creative tracking, the official fixture does not establish that Trusted
+Server should fire OpenRTB notifications, and the direct `/auction` path has no matching
+notification lifecycle.
+
+This also prevents an APS-controlled URL from causing a credentialed same-origin POST
+through the current generic `sendBeacon`/fetch helper. If APS later requires Trusted
+Server notification delivery, design it separately with one explicit owner, bounded
+HTTPS URLs, publisher-origin rejection, omitted credentials, no referrer, macro policy,
+and equivalent direct/GPT tests. Existing non-APS notification behavior is unchanged by
+#764.
+
+---
+
+## 14. User sync policy
+
+APS user sync is explicitly out of scope:
+
+- ignore `BidResponse.ext.userSyncs`;
+- do not put sync URLs into `AuctionResponse.metadata`;
+- do not include them in the minimized renderer envelope;
+- do not fetch them at the edge; and
+- do not add image/iframe sync behavior to TSJS.
+
+A future implementation requires a separate spec covering Purpose 1, regional policy,
+URL allowlisting, deduplication, browser timing, and observability.
+
+---
+
+## 15. Logging and telemetry
+
+- Request/response bodies: TRACE only.
+- Routine request log: provider and eligible slot count, without account ID.
+- Routine response log: status, elapsed time, accepted count, and bounded dropped
+  count.
+- WARN: static condition plus slot/request-safe context; never include response body,
+  creative URL, bid token, EID, consent string, or account ID.
+- Client-facing provider summaries: aggregate reason keys/counts only.
+- Existing auction telemetry receives decoded price, currency, ad domain, and ad ID.
+  It must not receive the encoded renderer envelope.
+
+---
+
+## 16. Rollout and rollback
+
+### 16.1 Controlled rollout
+
+1. Implement server parsing and exact fictional fixtures with APS disabled and
+   `allow_script_creatives = false` by default.
+2. Prove disabled script bids are dropped before candidate reduction/winner selection.
+3. Pass the restrictive-CSP Playwright and opaque-origin access tests using the local
+   fictional script runner while the server gate remains false for normal traffic.
+4. Configure a controlled APS test account out of band.
+5. Enable Trusted Server APS only for a test cohort, disable native APS demand there,
+   and temporarily set `allow_script_creatives = true` only for that isolated cohort.
+6. Verify the official fixture safe-drops and a real account returns the unverified
+   `creativeurl`/`tagtype` contract.
+7. Verify both observed tag types through direct and GPT paths. If script cannot operate
+   below the opaque outer sandbox, set the gate false again and stop.
+8. Confirm the exact allowlisted envelope works with `prebid-creative.js`.
+9. Confirm GAM line items and the Universal Creative route request `hb_bidder=aps` and
+   the selected `hb_adid`.
+10. Obtain APS confirmation for Fastly/edge-originated production traffic before broad
+    rollout.
+
+### 16.2 Rollback
+
+- Immediate traffic rollback: set `[integrations.aps].enabled = false`.
+- Restore native APS participation for the affected cohort if required.
+- Binary rollback remains available if the old provider must temporarily be restored.
+- The new code does not retain a dormant legacy parser or protocol switch.
+
+---
+
+## 17. Required code areas
+
+| File                                                              | Change                                                                                                                                                       |
+| ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `crates/trusted-server-core/src/integrations/aps.rs`              | Replace legacy wire types, build/parse OpenRTB, reduce one APS candidate per imp, build the exact envelope, and serve the static renderer endpoint with CSP. |
+| `crates/trusted-server-core/src/integrations/mod.rs`              | Register the APS proxy integration in addition to the auction provider.                                                                                      |
+| `crates/trusted-server-core/src/openrtb.rs`                       | Add only narrowly scoped APS/request/response extension types if needed.                                                                                     |
+| `crates/trusted-server-core/src/auction/types.rs`                 | Add generic bid/creative identifiers and typed optional renderer. Remove stale encoded-price comments.                                                       |
+| `crates/trusted-server-core/src/auction/formats.rs`               | Preserve IDs; sanitize ordinary `adm`; emit the full APS renderer extension and omit empty `adm`.                                                            |
+| `crates/trusted-server-core/src/auction/orchestrator.rs`          | Replace encoded-price assumptions/tests with decoded APS direct-winner coverage.                                                                             |
+| `crates/trusted-server-core/src/integrations/adserver_mock.rs`    | Preserve renderer/identifiers for the single reduced APS candidate and test the prior two-bid collision case.                                                |
+| `crates/trusted-server-core/src/publisher.rs`                     | Emit APS renderer in the normal bid map, force `hb_bidder=aps`, and use selected bid ID for `hb_adid` without APS notifications.                             |
+| `crates/trusted-server-js/lib/test/fixtures/aps-renderer-v1.json` | Shared fictional golden wire fixture consumed by Rust and TypeScript tests.                                                                                  |
+| `crates/trusted-server-js/lib/src/core/auction.ts`                | Parse the typed renderer extension.                                                                                                                          |
+| `crates/trusted-server-js/lib/src/core/request.ts`                | Validate and dispatch APS descriptors to the opaque renderer endpoint.                                                                                       |
+| `crates/trusted-server-js/lib/src/core/types.ts`                  | Define shared APS renderer wire types with optional creative ID.                                                                                             |
+| `crates/trusted-server-js/lib/src/integrations/aps/render.ts`     | Decode/cross-check the exact envelope, create the opaque outer iframe, and message the static endpoint.                                                      |
+| `crates/trusted-server-js/lib/src/integrations/gpt/index.ts`      | Serve APS through the exact Universal Creative wire shape; skip generic beacons and native `apstag` for TS APS winners.                                      |
+| `crates/trusted-server-integration-tests/browser/`                | Add restrictive-CSP, opaque-origin, script/iframe, and parent-DOM isolation coverage.                                                                        |
+| `trusted-server.example.toml`                                     | Document canonical OpenRTB APS configuration with fictional values.                                                                                          |
+| `docs/guide/integrations/aps.md`                                  | Replace legacy setup, request, response, rendering, privacy, and rollout documentation.                                                                      |
+| `CHANGELOG.md`                                                    | Record the APS wire/config migration and support caveat.                                                                                                     |
+
+---
+
+## 18. Acceptance criteria
+
+1. APS receives the specified OpenRTB request for each eligible banner slot with
+   `topframe=0` and `secure=1`.
+2. Request fixtures prove trimmed account/SDK/USD, floors, trusted page/device context,
+   consent/EIDs, existing privacy registrations, and omission of precise coordinates
+   and unsupported COPPA claims.
+3. HTTP 204 and empty `seatbid` are no-bids; malformed/legacy responses are safely
+   diagnosed.
+4. The official no-renderer fixture safe-drops; every accepted APS bid has present,
+   valid `w`/`h` and the unverified-but-validated URL/tag-type renderer contract.
+5. `Bid.bidder`/`hb_bidder` are always `aps`, independent of upstream seat.
+6. Multiple APS bids for one impression reduce deterministically to one candidate, and
+   mediation cannot restore another candidate's renderer.
+7. APS can win without a mediator and is rejected normally below the floor.
+8. The browser envelope contains exactly the allowlisted fields and matches the full
+   descriptor; Rust and TypeScript share one golden fixture.
+9. The outer renderer iframe has no `allow-same-origin`; descendant iframe/script
+   creatives cannot access publisher DOM in the restrictive-CSP Playwright test.
+10. `allow_script_creatives` defaults false; while false, script bids are dropped before
+    candidate reduction and cannot win. It is enabled only under the staged browser and
+    controlled-account policy; otherwise script remains fail-closed.
+11. The renderer binds a one-time nonce through the iframe URL fragment before
+    messaging and rejects malformed, mismatched, replayed, or stale messages before
+    clearing content or stopping another renderer handler.
+12. Ordinary non-APS `adm` sanitization and PBS Cache rendering remain unchanged.
+13. APS user sync and APS `nurl`/`burl` browser delivery remain absent.
+14. Native `apstag.setDisplayBids()` is not called for a TS APS renderer winner.
+15. Raw request/response bodies remain TRACE-only.
+16. All repository CI, adapter, JS, browser, parity, and docs-format gates pass.
+
+---
+
+## 19. Known risks and follow-ups
+
+| Risk                                                                   | Handling                                                                                                                                                                    |
+| ---------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| APS has not confirmed production Fastly/edge traffic                   | Continue implementation/testing; block broad rollout pending confirmation.                                                                                                  |
+| Official fixture and live runner disagree on creative extension fields | Safe-drop the official fixture, pin the observed runner hash/date as evidence only, and require controlled-account validation.                                              |
+| Exact envelope may omit a field used by a future runner                | Stop and review with APS; never preserve unknown fields or fall back to the full response automatically.                                                                    |
+| Fixed unversioned vendor script can change independently               | Monitor the real-browser contract and require review before changing URL, envelope, CSP, or sandbox behavior.                                                               |
+| Runner may fail without outer `allow-same-origin`                      | Keep the server-side `allow_script_creatives` gate false unless the opaque-boundary Playwright and controlled-account tests pass; never restore publisher-origin execution. |
+| Broad ad-compatible CSP permits arbitrary HTTPS resources              | Scope it to the opaque renderer document; publisher CSP only needs to frame the same-origin renderer endpoint.                                                              |
+| Existing native APS and TS APS can duplicate demand                    | Cohort-gate and disable native APS participation wherever TS APS is enabled.                                                                                                |
+| APS notifications may be required for billing                          | Do not guess; vendor runner owns tracking until APS approves a separately secured notification contract.                                                                    |
+| APS video responses could appear                                       | Advertise banner-only support and drop non-banner `mtype` until a separate video design exists.                                                                             |
diff --git a/scripts/integration-tests-browser.sh b/scripts/integration-tests-browser.sh
index ce5e64387..714de510b 100755
--- a/scripts/integration-tests-browser.sh
+++ b/scripts/integration-tests-browser.sh
@@ -18,6 +18,7 @@ cd "$REPO_ROOT"
 
 ORIGIN_PORT="${INTEGRATION_ORIGIN_PORT:-8888}"
 BROWSER_DIR="crates/trusted-server-integration-tests/browser"
+TSJS_LIB_DIR="crates/trusted-server-js/lib"
 NODE_VERSION="$(grep '^nodejs ' .tool-versions | awk '{print $2}')"
 
 if [ -z "$NODE_VERSION" ]; then
@@ -55,6 +56,14 @@ cd "$REPO_ROOT/$BROWSER_DIR"
 npm ci
 npx playwright install chromium
 
+# --- Build browser-side Trusted Server and external Prebid fixtures ---
+echo "==> Building TSJS browser fixtures..."
+cd "$REPO_ROOT/$TSJS_LIB_DIR"
+npm ci
+npm run build
+npm run build:prebid-external
+cd "$REPO_ROOT/$BROWSER_DIR"
+
 # --- Export env vars for global-setup.ts ---
 export WASM_BINARY_PATH="$REPO_ROOT/target/wasm32-wasip1/release/trusted-server-adapter-fastly.wasm"
 export INTEGRATION_ORIGIN_PORT="$ORIGIN_PORT"
diff --git a/trusted-server.example.toml b/trusted-server.example.toml
index 26d95d681..7fc412717 100644
--- a/trusted-server.example.toml
+++ b/trusted-server.example.toml
@@ -118,9 +118,15 @@ allowed_context_keys = []
 
 [integrations.aps]
 enabled = false
-pub_id = "your-aps-publisher-id"
-endpoint = "https://aps.example.com/e/dtb/bid"
+account_id = "example-aps-account-id"
 timeout_ms = 1000
+# Include raw APS request/response data in /auction metadata on test sites only.
+debug = false
+# Set both when the deployment hostname differs from APS-authorized inventory.
+# inventory_domain = "publisher.example"
+# inventory_page_origin = "https://www.publisher.example"
+# Script creatives require separate security validation before opt-in.
+allow_script_creatives = false
 
 [integrations.google_tag_manager]
 enabled = false