diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index ec85b96a..4973afe4 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -183,7 +183,16 @@ jobs:
         with:
           node-version: ${{ steps.shared-setup.outputs.node-version }}
           cache: npm
-          cache-dependency-path: crates/trusted-server-integration-tests/browser/package-lock.json
+          cache-dependency-path: |
+            crates/trusted-server-integration-tests/browser/package-lock.json
+            crates/trusted-server-js/lib/package-lock.json
+
+      - name: Build TSJS browser fixtures
+        working-directory: crates/trusted-server-js/lib
+        run: |
+          npm ci
+          npm run build
+          npm run build:prebid-external
 
       - name: Install Playwright
         working-directory: crates/trusted-server-integration-tests/browser
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5bc49c80..fd9f0566 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,8 +9,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- **Breaking** — Replaced the legacy APS contextual integration with APS OpenRTB at `/e/pb/bid`. APS configuration now uses canonical `account_id` (`pub_id` remains a compatibility alias), no longer requires APS-specific slot IDs, and defaults script creative eligibility off. Operators must update the endpoint, disable native APS demand for Trusted Server cohorts, and prepare GAM/Universal Creative targeting for `hb_bidder=aps` before rollout. APS renderer winners now preserve the upstream bid `id`, omit `crid` when APS omits it, and carry `ext.trusted_server.renderer` instead of `adm`; external `/auction` consumers must support this response shape.
 - **Breaking** — `bid_param_zone_overrides` inner values must now be JSON objects; previously non-object or empty values (`"header" = "x"`, `"header" = {}`) were accepted and silently produced a dead rule at runtime. They now fail at startup with a configuration error. Operators upgrading should audit their `bid_param_zone_overrides` config for non-object zone entries.
 - **Breaking** — Sourcepoint browser module inclusion now requires explicit `[integrations.sourcepoint].enabled = true`; operators relying on the previous unconditional Sourcepoint module should enable the integration before upgrading.
+- Added optional APS `inventory_domain` and `inventory_page_origin` overrides for deployments whose edge hostname differs from the APS-authorized inventory identity.
+- Preserved APS renderer capabilities through the client-side `trustedServer` Prebid adapter, allowing its generated `hb_adid` to render through GAM and Prebid Universal Creative instead of producing an empty creative.
 
 ### Security
 
@@ -18,6 +21,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Added opt-in APS HTTP debug metadata for controlled test sites, exposing the direct request and response under `/auction` provider metadata using the Prebid Server `debug.httpcalls` shape.
+- Added typed APS renderer transport for direct auctions and GAM/Prebid Universal Creative, using a minimized one-bid envelope, a fragment-bound nonce, and an opaque sandboxed renderer endpoint.
 - Added Osano consent mirror integration docs and public enablement guidance.
 - Implemented basic authentication for configurable endpoint paths (#73)
 - Added integrations guide with example `testlight` integration
diff --git a/TESTING.md b/TESTING.md
index e1ac1c3a..e5ccba4c 100644
--- a/TESTING.md
+++ b/TESTING.md
@@ -46,8 +46,8 @@ curl -X POST http://localhost:7676/auction \
 
 **With Orchestrator Enabled** (`auction.enabled = true`):
 - Logs showing: `"Using auction orchestrator"`
-- Parallel execution of APS (mocked) and Prebid (real)
-- GAM mediation (mocked) selecting winning bids
+- Parallel execution of APS OpenRTB and Prebid Server
+- Optional mock-adserver mediation selecting winning bids
 - Final response with winning creatives
 
 **With Orchestrator Disabled** (`auction.enabled = false`):
@@ -66,11 +66,13 @@ providers = ["prebid", "aps"]
 mediator = "adserver_mock"  # If set: mediation, if omitted: highest bid wins
 timeout_ms = 2000
 
-# Mock provider configs
+# APS OpenRTB provider. The built-in production endpoint is used when
+# endpoint is omitted; use only an account authorized for test traffic.
 [integrations.aps]
 enabled = true
-mock = true
-mock_price = 2.50
+account_id = "example-account"
+timeout_ms = 800
+debug = false
 
 [integrations.adserver_mock]
 enabled = true
@@ -90,10 +92,10 @@ mediator = "adserver_mock"  # Mediator configured = parallel mediation strategy
 ```
 
 **Expected Flow:**
-1. Prebid queries real SSPs
-2. APS returns mock bids ($2.50 CPM)
-3. AdServer Mock mediates between all bids
-4. Winning creative returned
+1. Prebid queries its configured bidders through Prebid Server
+2. APS sends an OpenRTB request for eligible banner impressions
+3. AdServer Mock mediates the provider responses
+4. The winning creative or typed APS renderer is returned
 
 ### Scenario 2: Parallel Only (No Mediation)
 **Config:**
@@ -131,8 +133,9 @@ INFO: Running 2 bidders in parallel
 INFO: Requesting bids from: prebid
 INFO: Prebid returned 2 bids (time: 120ms)
 INFO: Requesting bids from: aps
-INFO: APS (MOCK): returning 2 bids in 80ms
-INFO: GAM mediation: slot 'header-banner' won by 'amazon-aps' at $2.50 CPM
+INFO: APS requests bids for 2 impressions
+INFO: APS returns 2 accepted bids in 80ms
+INFO: GAM mediation: slot 'header-banner' won by 'aps' at $2.50 CPM
 ```
 
 ### Verify Provider Registration
@@ -156,18 +159,19 @@ INFO: Registering auction provider: adserver_mock
 
 ## Next Steps
 
-1. **Test with real Prebid Server** - Verify Prebid bids work correctly
-2. **Implement real APS** - Replace mock with actual Amazon TAM API calls
-3. **Implement real GAM** - Add Google Ad Manager API integration
-4. **Add metrics** - Track bid rates, win rates, latency per provider
+1. **Verify Prebid Server demand** - Confirm configured bidders return expected test bids
+2. **Verify APS eligibility** - Confirm the test account, inventory identity, and `/e/pb/bid` endpoint are authorized
+3. **Exercise renderer security** - Run the APS browser integration suite for iframe and script creatives
+4. **Add metrics** - Track bid rates, win rates, latency, and aggregate drop reasons per provider
 
-## Mock Provider Behavior
+## Provider Behavior
 
 ### APS (Amazon)
-- Returns bids for all slots
-- Default mock price: $2.50 CPM
-- Always returns 2 bids
-- Response time: ~80ms (simulated)
+- Sends real OpenRTB requests for eligible banner slots
+- Safely drops malformed, unsupported, or unrenderable bids and reports aggregate reasons
+- Reduces multiple APS candidates to one winner per impression
+- Returns typed renderer descriptors rather than exposing `adm` outside the sandbox
+- Automated tests intercept upstream traffic and use fictional response fixtures
 
 ### AdServer Mock
 - Acts as mediator by calling mocktioneer's mediation endpoint
diff --git a/crates/trusted-server-core/src/auction/README.md b/crates/trusted-server-core/src/auction/README.md
index dcc9e150..44ba9ce1 100644
--- a/crates/trusted-server-core/src/auction/README.md
+++ b/crates/trusted-server-core/src/auction/README.md
@@ -117,7 +117,7 @@ When a request arrives at the `/auction` endpoint, it goes through the following
                               ▼
 ┌──────────────────────────────────────────────────────────────────────┐
 │  9. Each Provider Processes Request                                  │
-│     - Transform AuctionRequest → Provider format (e.g., APS TAM)     │
+│     - Transform AuctionRequest → Provider OpenRTB request            │
 │     - Send HTTP request to provider endpoint                         │
 │     - Parse provider response                                        │
 │     - Transform → AuctionResponse with Bid[]                         │
@@ -188,30 +188,21 @@ AdSlot {
 
 #### 3. Provider Execution
 Each registered provider (APS, Prebid, etc.) receives the `AuctionRequest` and:
-- Transforms it to their specific format (e.g., APS TAM, OpenRTB)
+- Transforms it to the provider's OpenRTB request format
 - Makes HTTP request to their endpoint
 - Parses the response
 - Returns `AuctionResponse` with `Bid[]`
 
 For example, APS provider:
 ```rust
-// Transform AuctionRequest → ApsBidRequest
-let aps_request = ApsBidRequest {
-    pub_id: "5128",
-    slots: vec![
-        ApsSlot {
-            slot_id: "header-banner",
-            sizes: vec![[728, 90], [970, 250]],
-            slot_name: Some("header-banner"),
-        }
-    ],
-    page_url: Some("https://example.com"),
-    ua: Some("Mozilla/5.0..."),
-    timeout: Some(800),
-};
-
-// HTTP POST to http://localhost:6767/e/dtb/bid
-// Parse response → AuctionResponse
+// Transform AuctionRequest → APS OpenRTB request
+// - ext.account = configured account_id
+// - ext.sdk = { source: "prebid", version: "2.2.0" }
+// - banner slots become secure impressions with matching formats/floors
+// - existing consent, identity, device, and geo privacy gates apply
+
+// HTTP POST to https://aps.example.com/e/pb/bid
+// Parse decoded-price response → AuctionResponse with a typed renderer
 ```
 
 #### 4. Response Assembly
@@ -222,17 +213,29 @@ The orchestrator collects all bids and creates an OpenRTB response:
   "id": "auction-response",
   "seatbid": [
     {
-      "seat": "amazon-aps",
+      "seat": "aps",
       "bid": [
         {
-          "id": "amazon-aps-header-banner",
+          "id": "fictional-selected-bid-id",
           "impid": "header-banner",
           "price": 2.5,
-          "adm": "<iframe src=\"/first-party/proxy?tsurl=...\">",
           "w": 728,
           "h": 90,
-          "crid": "amazon-aps-creative",
-          "adomain": ["amazon.com"]
+          "ext": {
+            "trusted_server": {
+              "renderer": {
+                "type": "aps",
+                "version": 1,
+                "accountId": "example-account",
+                "bidId": "fictional-selected-bid-id",
+                "tagType": "iframe",
+                "creativeUrl": "https://creative.example/render",
+                "aaxResponse": "<base64 minimized one-bid envelope>",
+                "width": 728,
+                "height": 90
+              }
+            }
+          }
         }
       ]
     }
diff --git a/crates/trusted-server-core/src/auction/formats.rs b/crates/trusted-server-core/src/auction/formats.rs
index 441828a1..558385e3 100644
--- a/crates/trusted-server-core/src/auction/formats.rs
+++ b/crates/trusted-server-core/src/auction/formats.rs
@@ -10,6 +10,7 @@ use http::{HeaderValue, Request, Response, StatusCode, header};
 use serde::Deserialize;
 use serde_json::Value as JsonValue;
 use std::collections::HashMap;
+use url::Url;
 use uuid::Uuid;
 
 use crate::auction::context::ContextValue;
@@ -19,7 +20,10 @@ use crate::creative;
 use crate::ec::eids::encode_eids_header;
 use crate::error::TrustedServerError;
 use crate::geo::GeoInfo;
-use crate::openrtb::{OpenRtbBid, OpenRtbResponse, ResponseExt, SeatBid, ToExt, to_openrtb_i32};
+use crate::openrtb::{
+    BidExt, BidTrustedServerExt, OpenRtbBid, OpenRtbResponse, ResponseExt, SeatBid, ToExt,
+    to_openrtb_i32,
+};
 use crate::platform::RuntimeServices;
 use crate::settings::Settings;
 
@@ -84,6 +88,49 @@ pub struct BannerUnit {
     pub sizes: Vec<Vec<u32>>,
 }
 
+const MAX_PUBLISHER_PAGE_URL_BYTES: usize = 8192;
+
+fn publisher_page_url(req: &Request<EdgeBody>, publisher_domain: &str) -> String {
+    let fallback = format!("https://{publisher_domain}");
+    let Some(candidate) = req
+        .headers()
+        .get(header::REFERER)
+        .and_then(|value| value.to_str().ok())
+        .filter(|value| value.len() <= MAX_PUBLISHER_PAGE_URL_BYTES)
+    else {
+        log::debug!(
+            "Auction page URL: using publisher origin because Referer is absent or invalid"
+        );
+        return fallback;
+    };
+    let Ok(mut parsed) = Url::parse(candidate) else {
+        log::debug!("Auction page URL: using publisher origin because Referer is not a URL");
+        return fallback;
+    };
+    let publisher_domain = publisher_domain.trim_end_matches('.').to_ascii_lowercase();
+    let host_matches = !publisher_domain.is_empty()
+        && parsed.host_str().is_some_and(|host| {
+            let host = host.trim_end_matches('.').to_ascii_lowercase();
+            host == publisher_domain
+                || host
+                    .strip_suffix(&publisher_domain)
+                    .is_some_and(|prefix| prefix.ends_with('.'))
+        });
+    if !matches!(parsed.scheme(), "http" | "https")
+        || !host_matches
+        || !parsed.username().is_empty()
+        || parsed.password().is_some()
+    {
+        log::debug!(
+            "Auction page URL: using publisher origin because Referer is not publisher-owned HTTP(S)"
+        );
+        return fallback;
+    }
+    parsed.set_query(None);
+    parsed.set_fragment(None);
+    parsed.to_string()
+}
+
 /// Convert tsjs/Prebid.js request format to internal [`AuctionRequest`].
 ///
 /// The `consent` parameter carries decoded consent signals extracted from the
@@ -194,12 +241,14 @@ pub fn convert_tsjs_to_auction_request(
         }
     }
 
+    let page_url = publisher_page_url(req, &settings.publisher.domain);
+
     Ok(AuctionRequest {
         id: Uuid::new_v4().to_string(),
         slots,
         publisher: PublisherInfo {
             domain: settings.publisher.domain.clone(),
-            page_url: Some(format!("https://{}", settings.publisher.domain)),
+            page_url: Some(page_url.clone()),
         },
         user: UserInfo {
             id: ec_id,
@@ -209,7 +258,7 @@ pub fn convert_tsjs_to_auction_request(
         device,
         site: Some(SiteInfo {
             domain: settings.publisher.domain.clone(),
-            page: format!("https://{}", settings.publisher.domain),
+            page: page_url,
         }),
         context,
     })
@@ -217,7 +266,7 @@ pub fn convert_tsjs_to_auction_request(
 
 /// Convert `OrchestrationResult` to `OpenRTB` response format.
 ///
-/// Returns rewritten creative HTML directly in the `adm` field for inline delivery.
+/// Returns rewritten ordinary creative HTML in `adm` or a typed renderer extension.
 ///
 /// # Errors
 ///
@@ -250,8 +299,21 @@ pub fn convert_to_openrtb_response(
         let width = to_openrtb_i32(bid.width, "width", &bid_context);
         let height = to_openrtb_i32(bid.height, "height", &bid_context);
 
-        // Process creative HTML if present - — sanitize dangerous markup first, then rewrite URLs.
-        let creative_html = if let Some(ref raw_creative) = bid.creative {
+        // Ordinary markup remains on the mandatory sanitize/rewrite path. A
+        // typed renderer is serialized separately and never enters the HTML sanitizer.
+        let (adm, ext) = if let Some(raw_creative) = bid
+            .creative
+            .as_deref()
+            .filter(|creative| !creative.trim().is_empty())
+        {
+            if bid.renderer.is_some() {
+                log::warn!(
+                    "Auction {}: winning bid for slot '{}' from '{}' has both creative markup and a renderer; using creative markup",
+                    auction_request.id,
+                    slot_id,
+                    bid.bidder
+                );
+            }
             let sanitized = creative::sanitize_creative_html(raw_creative);
             let rewritten = creative::rewrite_creative_html(settings, &sanitized);
 
@@ -264,26 +326,45 @@ pub fn convert_to_openrtb_response(
                 rewritten.len()
             );
 
-            rewritten
+            (Some(rewritten), None)
+        } else if let Some(renderer) = bid.renderer.as_ref() {
+            let Some(ext) = (BidExt {
+                trusted_server: BidTrustedServerExt { renderer },
+            })
+            .to_ext() else {
+                log::warn!(
+                    "Auction {}: skipping winning bid for slot '{}' from '{}' because its renderer extension could not be serialized",
+                    auction_request.id,
+                    slot_id,
+                    bid.bidder
+                );
+                continue;
+            };
+            (None, Some(ext))
         } else {
-            // No creative provided (e.g., from mediation layer that returns iframe URLs)
             log::warn!(
-                "No creative HTML for auction {} slot {} - mediation should have provided creative",
+                "Auction {}: skipping winning bid for slot '{}' from '{}' because it has no render source",
                 auction_request.id,
-                slot_id
+                slot_id,
+                bid.bidder
             );
-            String::new()
+            continue;
         };
 
         let openrtb_bid = OpenRtbBid {
-            id: Some(format!("{}-{}", bid.bidder, slot_id)),
+            id: bid
+                .bid_id
+                .clone()
+                .or_else(|| Some(format!("{}-{}", bid.bidder, slot_id))),
             impid: Some(slot_id.to_string()),
             price: Some(price),
-            adm: Some(creative_html),
-            crid: Some(format!("{}-creative", bid.bidder)),
+            adm,
+            adid: bid.ad_id.clone(),
+            crid: bid.creative_id.clone(),
             w: width,
             h: height,
             adomain: bid.adomain.clone().unwrap_or_default(),
+            ext,
             ..Default::default()
         };
 
@@ -365,7 +446,9 @@ pub fn convert_to_openrtb_response(
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::auction::types::{AuctionResponse, Bid, BidStatus};
+    use crate::auction::types::{
+        ApsRendererV1, ApsTagType, AuctionResponse, Bid, BidRenderer, BidStatus,
+    };
     use crate::openrtb::{Eid, Uid};
     use crate::platform::test_support::noop_services;
     use crate::test_support::tests::create_test_settings;
@@ -437,7 +520,10 @@ mod tests {
             height: 250,
             nurl: None,
             burl: None,
+            bid_id: Some(format!("{bidder}-{slot_id}")),
             ad_id: None,
+            creative_id: Some(format!("{bidder}-creative")),
+            renderer: None,
             cache_id: None,
             cache_host: None,
             cache_path: None,
@@ -605,6 +691,63 @@ mod tests {
         );
     }
 
+    #[test]
+    fn publisher_page_url_accepts_publisher_hosts_and_strips_private_components() {
+        for (candidate, expected) in [
+            (
+                "https://publisher.example.com/article?id=1#comments",
+                "https://publisher.example.com/article",
+            ),
+            (
+                "http://news.publisher.example.com/nested/story?token=secret",
+                "http://news.publisher.example.com/nested/story",
+            ),
+            (
+                "https://www.publisher.example.com/",
+                "https://www.publisher.example.com/",
+            ),
+        ] {
+            let request = Request::builder()
+                .uri("https://publisher.example.com/auction")
+                .header(header::REFERER, candidate)
+                .body(EdgeBody::empty())
+                .expect("should build request");
+            assert_eq!(
+                publisher_page_url(&request, "Publisher.Example.Com"),
+                expected,
+                "should sanitize publisher-owned Referer"
+            );
+        }
+    }
+
+    #[test]
+    fn publisher_page_url_rejects_untrusted_or_oversized_referers() {
+        let oversized = format!(
+            "https://publisher.example.com/{}",
+            "x".repeat(MAX_PUBLISHER_PAGE_URL_BYTES)
+        );
+        for candidate in [
+            "https://other.example/article",
+            "https://publisher.example.com.evil.example/article",
+            "https://evilpublisher.example.com/article",
+            "javascript:alert(1)",
+            "https://user:password@publisher.example.com/article",
+            "not a url",
+            &oversized,
+        ] {
+            let request = Request::builder()
+                .uri("https://publisher.example.com/auction")
+                .header(header::REFERER, candidate)
+                .body(EdgeBody::empty())
+                .expect("should build request");
+            assert_eq!(
+                publisher_page_url(&request, "publisher.example.com"),
+                "https://publisher.example.com",
+                "should reject {candidate}"
+            );
+        }
+    }
+
     #[test]
     fn convert_tsjs_to_auction_request_maps_banner_sizes_to_formats() {
         let settings = make_settings();
@@ -933,22 +1076,185 @@ mod tests {
     }
 
     #[test]
-    fn convert_to_openrtb_response_serializes_missing_creative_as_empty_adm() {
+    fn convert_to_openrtb_response_preserves_aps_debug_metadata() {
         let settings = make_settings();
         let auction_request = make_auction_request();
-        let mut bid = make_bid("div-gpt-top", "appnexus", Some(2.75));
-        bid.creative = None;
+        let bid = make_bid("div-gpt-top", "aps", Some(2.75));
+        let debug = json!({
+            "httpcalls": {
+                "aps": [{
+                    "requestbody": "{\"id\":\"fictional-auction\"}",
+                    "requestheaders": {"content-type": ["application/json"]},
+                    "responsebody": "{\"seatbid\":[]}",
+                    "responseheaders": {"content-type": ["application/json"]},
+                    "status": 200,
+                    "uri": "https://aps.example/openrtb"
+                }]
+            }
+        });
+        let result = OrchestrationResult {
+            provider_responses: vec![AuctionResponse {
+                provider: "aps".to_string(),
+                bids: vec![bid.clone()],
+                status: BidStatus::Success,
+                response_time_ms: 42,
+                metadata: HashMap::from([("debug".to_string(), debug.clone())]),
+            }],
+            mediator_response: None,
+            winning_bids: HashMap::from([(bid.slot_id.clone(), bid)]),
+            total_time_ms: 50,
+            metadata: HashMap::new(),
+        };
+
+        let response = convert_to_openrtb_response(&result, &settings, &auction_request, false)
+            .expect("should convert APS response with debug metadata");
+        let json = response_json(response);
+
+        assert_eq!(
+            json["ext"]["orchestrator"]["provider_details"][0]["metadata"]["debug"], debug,
+            "should preserve APS debug metadata in the auction response"
+        );
+    }
+
+    #[test]
+    fn convert_to_openrtb_response_skips_invalid_winners_without_dropping_valid_slots() {
+        let settings = make_settings();
+        let auction_request = make_auction_request();
+        let mut missing = make_bid("missing", "invalid", Some(3.0));
+        missing.creative = None;
+        let mut whitespace = make_bid("whitespace", "invalid", Some(2.9));
+        whitespace.creative = Some(" \n\t ".to_string());
+        let ordinary = make_bid("ordinary", "appnexus", Some(2.75));
+        let mut renderer = make_bid("renderer", "aps", Some(2.5));
+        renderer.creative = Some("  ".to_string());
+        renderer.bid_id = Some("upstream-renderer-bid".to_string());
+        renderer.creative_id = None;
+        renderer.renderer = Some(BidRenderer::Aps(ApsRendererV1 {
+            version: 1,
+            account_id: "example-account".to_string(),
+            bid_id: "upstream-renderer-bid".to_string(),
+            creative_id: None,
+            tag_type: ApsTagType::Iframe,
+            creative_url: "https://creative.example/render".to_string(),
+            aax_response: "fictional-base64".to_string(),
+            width: 300,
+            height: 250,
+        }));
+        let result = OrchestrationResult {
+            provider_responses: vec![],
+            mediator_response: None,
+            winning_bids: HashMap::from([
+                (missing.slot_id.clone(), missing),
+                (whitespace.slot_id.clone(), whitespace),
+                (ordinary.slot_id.clone(), ordinary),
+                (renderer.slot_id.clone(), renderer),
+            ]),
+            total_time_ms: 50,
+            metadata: HashMap::new(),
+        };
+
+        let response = convert_to_openrtb_response(&result, &settings, &auction_request, false)
+            .expect("should omit invalid winners and preserve valid slots");
+        let json = response_json(response);
+        let bids: Vec<&JsonValue> = json["seatbid"]
+            .as_array()
+            .expect("should include valid seatbids")
+            .iter()
+            .map(|seatbid| &seatbid["bid"][0])
+            .collect();
+
+        assert_eq!(bids.len(), 2, "should omit only invalid winners");
+        let ordinary = bids
+            .iter()
+            .find(|bid| bid["impid"] == "ordinary")
+            .expect("should preserve ordinary winner");
+        assert_eq!(ordinary["adm"], "<div>Ad</div>");
+        let renderer = bids
+            .iter()
+            .find(|bid| bid["impid"] == "renderer")
+            .expect("should preserve renderer winner");
+        assert!(renderer.get("adm").is_none(), "should omit renderer adm");
+        assert!(
+            renderer.get("crid").is_none(),
+            "should omit absent upstream crid"
+        );
+        assert_eq!(renderer["id"], "upstream-renderer-bid");
+        assert!(renderer.get("ext").is_some(), "should include renderer ext");
+    }
+
+    #[test]
+    fn convert_to_openrtb_response_prefers_creative_when_both_render_sources_exist() {
+        let settings = make_settings();
+        let auction_request = make_auction_request();
+        let mut bid = make_bid("div-gpt-top", "aps", Some(2.75));
+        bid.renderer = Some(BidRenderer::Aps(ApsRendererV1 {
+            version: 1,
+            account_id: "example-account".to_string(),
+            bid_id: "fictional-bid".to_string(),
+            creative_id: None,
+            tag_type: ApsTagType::Iframe,
+            creative_url: "https://creative.example/render".to_string(),
+            aax_response: "fictional-base64".to_string(),
+            width: 300,
+            height: 250,
+        }));
         let result = make_result(bid);
 
         let response = convert_to_openrtb_response(&result, &settings, &auction_request, false)
-            .expect("should convert bid without creative HTML");
+            .expect("should prefer ordinary creative markup");
+        let json = response_json(response);
+        let bid = &json["seatbid"][0]["bid"][0];
 
-        assert_eq!(response.status(), StatusCode::OK, "should return OK");
+        assert_eq!(bid["adm"], "<div>Ad</div>");
+        assert!(
+            bid.get("ext").is_none(),
+            "should omit renderer extension when creative markup wins precedence"
+        );
+    }
+
+    #[test]
+    fn convert_to_openrtb_response_emits_typed_aps_renderer_without_adm() {
+        let settings = make_settings();
+        let auction_request = make_auction_request();
+        let mut bid = make_bid("div-gpt-top", "aps", Some(2.75));
+        bid.creative = None;
+        bid.bid_id = Some("fictional-bid".to_string());
+        bid.ad_id = Some("fictional-ad".to_string());
+        bid.creative_id = Some("fictional-creative".to_string());
+        bid.renderer = Some(BidRenderer::Aps(ApsRendererV1 {
+            version: 1,
+            account_id: "example-account".to_string(),
+            bid_id: "fictional-bid".to_string(),
+            creative_id: Some("fictional-creative".to_string()),
+            tag_type: ApsTagType::Iframe,
+            creative_url: "https://creative.example/render".to_string(),
+            aax_response: "fictional-base64".to_string(),
+            width: 300,
+            height: 250,
+        }));
+        let result = make_result(bid);
+
+        let response = convert_to_openrtb_response(&result, &settings, &auction_request, false)
+            .expect("should convert APS renderer bid");
         let json = response_json(response);
+        let bid = json["seatbid"][0]["bid"][0]
+            .as_object()
+            .expect("should serialize bid object");
+
+        assert!(
+            !bid.contains_key("adm"),
+            "should omit adm for renderer bids"
+        );
+        assert_eq!(bid["id"], json!("fictional-bid"));
+        assert_eq!(bid["adid"], json!("fictional-ad"));
+        assert_eq!(bid["crid"], json!("fictional-creative"));
+        assert_eq!(
+            bid["ext"]["trusted_server"]["renderer"]["type"],
+            json!("aps")
+        );
         assert_eq!(
-            json["seatbid"][0]["bid"][0]["adm"],
-            json!(""),
-            "should serialize missing creative as empty adm"
+            bid["ext"]["trusted_server"]["renderer"]["bidId"],
+            json!("fictional-bid")
         );
     }
 
diff --git a/crates/trusted-server-core/src/auction/orchestrator.rs b/crates/trusted-server-core/src/auction/orchestrator.rs
index bee63856..f23818b0 100644
--- a/crates/trusted-server-core/src/auction/orchestrator.rs
+++ b/crates/trusted-server-core/src/auction/orchestrator.rs
@@ -1,6 +1,8 @@
 //! Auction orchestrator for managing multi-provider auctions.
 
+use edgezero_core::body::Body as EdgeBody;
 use error_stack::{Report, ResultExt};
+use http::Request;
 use std::collections::HashMap;
 use std::sync::Arc;
 use std::time::Duration;
@@ -23,11 +25,12 @@ use super::types::{AuctionContext, AuctionRequest, AuctionResponse, Bid, BidStat
 /// TTFB ≈ auction timeout.
 pub struct DispatchedAuction {
     pending_requests: Vec<PlatformPendingRequest>,
-    backend_to_provider: HashMap<String, (String, Instant, Arc<dyn AuctionProvider>)>,
+    backend_to_provider: HashMap<String, (String, Instant, Arc<dyn AuctionProvider>, u32)>,
     launch_responses: Vec<AuctionResponse>,
     auction_start: Instant,
     timeout_ms: u32,
     floor_prices: HashMap<String, f64>,
+    provider_request_context: Box<Request<EdgeBody>>,
     /// Carried so the mediator call in collect can pass it as the auction request.
     request: AuctionRequest,
 }
@@ -64,7 +67,7 @@ impl DispatchedAuction {
         let abandoned = self
             .backend_to_provider
             .into_values()
-            .map(|(provider_name, start_time, _)| {
+            .map(|(provider_name, start_time, _, _)| {
                 AbandonedProviderCall::bidder(
                     provider_name,
                     Some(u32::try_from(start_time.elapsed().as_millis()).unwrap_or(u32::MAX)),
@@ -85,6 +88,7 @@ impl DispatchedAuction {
             auction_start: Instant::now(),
             timeout_ms,
             floor_prices: HashMap::new(),
+            provider_request_context: Box::new(Request::new(EdgeBody::empty())),
             request,
         }
     }
@@ -162,6 +166,15 @@ fn remaining_budget_ms(start: Instant, timeout_ms: u32) -> u32 {
     timeout_ms.saturating_sub(elapsed)
 }
 
+fn snapshot_context_request(request: &Request<EdgeBody>) -> Request<EdgeBody> {
+    let mut snapshot = Request::new(EdgeBody::empty());
+    *snapshot.method_mut() = request.method().clone();
+    *snapshot.uri_mut() = request.uri().clone();
+    *snapshot.version_mut() = request.version();
+    *snapshot.headers_mut() = request.headers().clone();
+    snapshot
+}
+
 /// Manages auction execution across multiple providers.
 pub struct AuctionOrchestrator {
     config: AuctionConfig,
@@ -345,16 +358,14 @@ impl AuctionOrchestrator {
                     message: format!("Mediator {} parse failed", mediator.provider_name()),
                 })?;
 
-            // Extract winning bids from mediator response
-            // Filter out bids without decoded prices - mediator should have decoded all prices
+            // Extract only mediator bids with comparable numeric prices.
             let winning = mediator_resp
                 .bids
                 .iter()
                 .filter_map(|bid| {
                     if bid.price.is_none() {
                         log::warn!(
-                            "Mediator '{}' returned bid for slot '{}' without decoded price - skipping. \
-                             Mediator should decode all prices including APS bids.",
+                            "Mediator '{}' returned bid for slot '{}' without a price - skipping",
                             mediator.provider_name(),
                             bid.slot_id
                         );
@@ -445,8 +456,8 @@ impl AuctionOrchestrator {
         let auction_start = Instant::now();
 
         // Phase 1: Launch all requests concurrently and build mapping
-        // Maps backend_name -> (provider_name, start_time, provider)
-        let mut backend_to_provider: HashMap<String, (&str, Instant, &dyn AuctionProvider)> =
+        // Maps backend_name to provider state retained for response parsing.
+        let mut backend_to_provider: HashMap<String, (&str, Instant, &dyn AuctionProvider, u32)> =
             HashMap::new();
         let mut pending_requests: Vec<crate::platform::PlatformPendingRequest> = Vec::new();
         let mut responses = Vec::new();
@@ -526,7 +537,12 @@ impl AuctionOrchestrator {
                         });
                     backend_to_provider.insert(
                         request_backend_name.clone(),
-                        (provider.provider_name(), start_time, provider.as_ref()),
+                        (
+                            provider.provider_name(),
+                            start_time,
+                            provider.as_ref(),
+                            effective_timeout,
+                        ),
                     );
                     pending_requests.push(pending);
                     log::debug!(
@@ -599,10 +615,17 @@ impl AuctionOrchestrator {
                         .unwrap_or_default()
                         .to_string();
 
-                    if let Some((provider_name, start_time, provider)) =
+                    if let Some((provider_name, start_time, provider, effective_timeout)) =
                         backend_to_provider.remove(&backend_name)
                     {
                         let response_time_ms = start_time.elapsed().as_millis() as u64;
+                        let provider_context = AuctionContext {
+                            settings: context.settings,
+                            request: context.request,
+                            timeout_ms: effective_timeout,
+                            provider_responses: context.provider_responses,
+                            services: context.services,
+                        };
 
                         // Use the context-aware parse so a provider overriding
                         // `parse_response_with_context` behaves identically on the
@@ -613,7 +636,7 @@ impl AuctionOrchestrator {
                                 response,
                                 response_time_ms,
                                 request,
-                                context,
+                                &provider_context,
                             )
                             .await
                         {
@@ -652,7 +675,7 @@ impl AuctionOrchestrator {
                 }
                 Err(e) => {
                     if let Some(ref backend_name) = failed_backend_name {
-                        if let Some((provider_name, start_time, _)) =
+                        if let Some((provider_name, start_time, _, _)) =
                             backend_to_provider.remove(backend_name)
                         {
                             let response_time_ms = start_time.elapsed().as_millis() as u64;
@@ -689,7 +712,7 @@ impl AuctionOrchestrator {
             }
         }
 
-        for (provider_name, start_time, _) in backend_to_provider.into_values() {
+        for (provider_name, start_time, _, _) in backend_to_provider.into_values() {
             let response_time_ms = start_time.elapsed().as_millis() as u64;
             log::warn!("Provider '{provider_name}' timed out before auction collection completed");
             responses.push(provider_timeout_response(provider_name, response_time_ms));
@@ -698,9 +721,7 @@ impl AuctionOrchestrator {
         Ok(responses)
     }
 
-    /// Select the best bid for each slot from all responses.
-    /// Note: Bids with None price (e.g., APS bids with encoded prices) are skipped
-    /// when no mediator is configured, as we cannot compare them without decoding.
+    /// Select the best decoded-price bid for each slot from all responses.
     fn select_winning_bids(
         &self,
         responses: &[AuctionResponse],
@@ -714,13 +735,11 @@ impl AuctionOrchestrator {
             }
 
             for bid in &response.bids {
-                // Skip bids without decoded prices (e.g., APS bids)
-                // These require mediation layer to decode
                 let bid_price = match bid.price {
                     Some(p) => p,
                     None => {
                         log::debug!(
-                            "Skipping bid for slot '{}' from '{}' - price requires mediation to decode",
+                            "Skipping bid for slot '{}' from '{}' without a comparable price",
                             bid.slot_id,
                             bid.bidder
                         );
@@ -755,30 +774,28 @@ impl AuctionOrchestrator {
         }
 
         let starting_count = winning_bids.len();
-        winning_bids.retain(|slot_id, bid| match (floor_prices.get(slot_id), bid.price) {
-            (Some(floor), Some(price)) if price >= *floor => true,
-            (Some(_), Some(_)) => {
-                log::info!(
-                    "Dropping winning bid below floor price for slot '{}'",
-                    slot_id
-                );
-                false
-            }
-            (_, None) => {
-                // Any caller that needs to keep an undecoded (encoded-price)
-                // bid must decode it *before* invoking this function — both
-                // `select_winning_bids` and the mediator path already do.
-                // Letting `None`-price bids through here would cause
-                // `winning_bids.len()` to overcount what `build_bid_map`
-                // downstream is willing to emit, so they get dropped instead.
-                log::debug!(
-                    "Dropping bid for slot '{}' - no decoded price (caller must decode before apply_floor_prices)",
-                    slot_id
-                );
-                false
-            }
-            (None, Some(_)) => true,
-        });
+        winning_bids.retain(
+            |slot_id, bid| match (floor_prices.get(slot_id), bid.price) {
+                (Some(floor), Some(price)) if price >= *floor => true,
+                (Some(_), Some(_)) => {
+                    log::info!(
+                        "Dropping winning bid below floor price for slot '{}'",
+                        slot_id
+                    );
+                    false
+                }
+                (_, None) => {
+                    // Every downstream response requires a comparable numeric price,
+                    // so bids without one are always dropped before delivery.
+                    log::debug!(
+                        "Dropping bid for slot '{}' without a comparable price",
+                        slot_id
+                    );
+                    false
+                }
+                (None, Some(_)) => true,
+            },
+        );
 
         if winning_bids.len() != starting_count {
             log::info!(
@@ -857,8 +874,10 @@ impl AuctionOrchestrator {
         }
 
         let auction_start = Instant::now();
-        let mut backend_to_provider: HashMap<String, (String, Instant, Arc<dyn AuctionProvider>)> =
-            HashMap::new();
+        let mut backend_to_provider: HashMap<
+            String,
+            (String, Instant, Arc<dyn AuctionProvider>, u32),
+        > = HashMap::new();
         let mut pending_requests: Vec<PlatformPendingRequest> = Vec::new();
         let mut launch_responses: Vec<AuctionResponse> = Vec::new();
 
@@ -927,6 +946,7 @@ impl AuctionOrchestrator {
                             provider.provider_name().to_string(),
                             start_time,
                             Arc::clone(provider),
+                            effective_timeout,
                         ),
                     );
                     pending_requests.push(pending.with_backend_name(backend_name));
@@ -971,6 +991,7 @@ impl AuctionOrchestrator {
             auction_start,
             timeout_ms: context.timeout_ms,
             floor_prices: self.floor_prices_by_slot(request),
+            provider_request_context: Box::new(snapshot_context_request(context.request)),
             request: request.clone(),
         })
     }
@@ -998,6 +1019,7 @@ impl AuctionOrchestrator {
             auction_start,
             timeout_ms,
             floor_prices,
+            provider_request_context,
             request,
         } = dispatched;
 
@@ -1037,10 +1059,17 @@ impl AuctionOrchestrator {
             match ready {
                 Ok(platform_response) => {
                     let backend_name = platform_response.backend_name.clone().unwrap_or_default();
-                    if let Some((provider_name, start_time, provider)) =
+                    if let Some((provider_name, start_time, provider, effective_timeout)) =
                         backend_to_provider.remove(&backend_name)
                     {
                         let response_time_ms = start_time.elapsed().as_millis() as u64;
+                        let provider_context = AuctionContext {
+                            settings: context.settings,
+                            request: &provider_request_context,
+                            timeout_ms: effective_timeout,
+                            provider_responses: context.provider_responses,
+                            services: context.services,
+                        };
                         // Mirror run_providers_parallel: use the context-aware
                         // parse so providers behave identically on both paths.
                         match provider
@@ -1048,7 +1077,7 @@ impl AuctionOrchestrator {
                                 platform_response,
                                 response_time_ms,
                                 &request,
-                                context,
+                                &provider_context,
                             )
                             .await
                         {
@@ -1085,7 +1114,7 @@ impl AuctionOrchestrator {
                     // the provider behind `failed_backend_name` so it appears in
                     // provider_details instead of vanishing.
                     if let Some(ref backend_name) = failed_backend_name {
-                        if let Some((provider_name, start_time, _)) =
+                        if let Some((provider_name, start_time, _, _)) =
                             backend_to_provider.remove(backend_name)
                         {
                             let response_time_ms = start_time.elapsed().as_millis() as u64;
@@ -1119,7 +1148,7 @@ impl AuctionOrchestrator {
             // `remaining_budget_ms`.
         }
 
-        for (provider_name, start_time, _) in backend_to_provider.values() {
+        for (provider_name, start_time, _, _) in backend_to_provider.values() {
             let response_time_ms = start_time.elapsed().as_millis() as u64;
             log::warn!(
                 "Provider '{provider_name}' timed out before dispatched auction collection completed"
@@ -1330,8 +1359,8 @@ mod tests {
     use crate::auction::provider::AuctionProvider;
     use crate::auction::test_support::create_test_auction_context;
     use crate::auction::types::{
-        AdFormat, AdSlot, AuctionContext, AuctionRequest, AuctionResponse, Bid, BidStatus,
-        MediaType, PublisherInfo, UserInfo,
+        AdFormat, AdSlot, ApsRendererV1, ApsTagType, AuctionContext, AuctionRequest,
+        AuctionResponse, Bid, BidRenderer, BidStatus, MediaType, PublisherInfo, UserInfo,
     };
     use crate::error::TrustedServerError;
     use crate::platform::test_support::{StubHttpClient, build_services_with_http_client};
@@ -1395,8 +1424,27 @@ mod tests {
             ))
         }
 
+        async fn parse_response_with_context(
+            &self,
+            response: PlatformResponse,
+            response_time_ms: u64,
+            _request: &AuctionRequest,
+            context: &AuctionContext<'_>,
+        ) -> Result<AuctionResponse, Report<TrustedServerError>> {
+            let referer = context
+                .request
+                .headers()
+                .get(http::header::REFERER)
+                .and_then(|value| value.to_str().ok());
+            Ok(self
+                .parse_response(response, response_time_ms)
+                .await?
+                .with_metadata("context_referer", serde_json::json!(referer))
+                .with_metadata("context_timeout_ms", serde_json::json!(context.timeout_ms)))
+        }
+
         fn timeout_ms(&self) -> u32 {
-            2000
+            125
         }
 
         fn backend_name(&self, _services: &RuntimeServices, _timeout_ms: u32) -> Option<String> {
@@ -1409,6 +1457,44 @@ mod tests {
     /// the synchronous mediation path calls `parse_response_with_context`.
     struct CacheRestoringMediator;
 
+    fn auction_bid(bidder: &str, price: f64) -> Bid {
+        let renderer = (bidder == "aps").then(|| {
+            BidRenderer::Aps(ApsRendererV1 {
+                version: 1,
+                account_id: "example-account".to_string(),
+                bid_id: "aps-selected-bid".to_string(),
+                creative_id: None,
+                tag_type: ApsTagType::Iframe,
+                creative_url: "https://creative.example/render".to_string(),
+                aax_response: "fictional-base64".to_string(),
+                width: 300,
+                height: 250,
+            })
+        });
+        Bid {
+            slot_id: "slot-1".to_string(),
+            price: Some(price),
+            currency: "USD".to_string(),
+            creative: renderer
+                .is_none()
+                .then(|| "<div>ordinary</div>".to_string()),
+            adomain: None,
+            bidder: bidder.to_string(),
+            width: 300,
+            height: 250,
+            nurl: None,
+            burl: None,
+            bid_id: (bidder == "aps").then(|| "aps-selected-bid".to_string()),
+            ad_id: None,
+            creative_id: None,
+            renderer,
+            cache_id: None,
+            cache_host: None,
+            cache_path: None,
+            metadata: HashMap::new(),
+        }
+    }
+
     fn mediated_bid(nurl: Option<String>) -> Bid {
         Bid {
             slot_id: "header-banner".to_string(),
@@ -1421,7 +1507,10 @@ mod tests {
             height: 90,
             nurl: nurl.clone(),
             burl: nurl,
+            bid_id: None,
             ad_id: Some("creative-123".to_string()),
+            creative_id: None,
+            renderer: None,
             cache_id: Some("cache-abc".to_string()),
             cache_host: None,
             cache_path: None,
@@ -1760,7 +1849,10 @@ mod tests {
                 height: 250,
                 nurl: None,
                 burl: None,
+                bid_id: None,
                 ad_id: None,
+                creative_id: None,
+                renderer: None,
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
@@ -1780,7 +1872,10 @@ mod tests {
                 height: 250,
                 nurl: None,
                 burl: None,
+                bid_id: None,
                 ad_id: None,
+                creative_id: None,
+                renderer: None,
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
@@ -2018,6 +2113,76 @@ mod tests {
         });
     }
 
+    #[test]
+    fn dispatched_collection_reuses_provider_launch_context() {
+        futures::executor::block_on(async {
+            let stub = Arc::new(StubHttpClient::new());
+            stub.push_response(200, b"{}".to_vec());
+            let services = build_services_with_http_client(stub);
+            let config = AuctionConfig {
+                enabled: true,
+                providers: vec!["provider-a".to_string()],
+                timeout_ms: 750,
+                mediator: None,
+                ..Default::default()
+            };
+            let mut orchestrator = AuctionOrchestrator::new(config);
+            orchestrator.register_provider(Arc::new(StubAuctionProvider {
+                name: "provider-a",
+                backend: "backend-a",
+            }));
+            let request = create_test_auction_request();
+            let settings = create_test_settings();
+            let downstream = http::Request::builder()
+                .uri("https://publisher.example/article")
+                .header(http::header::REFERER, "https://referrer.example/source")
+                .body(edgezero_core::body::Body::empty())
+                .expect("should build downstream request");
+            let dispatch_context = AuctionContext {
+                settings: &settings,
+                request: &downstream,
+                timeout_ms: 750,
+                provider_responses: None,
+                services: &services,
+            };
+            let dispatched = match orchestrator
+                .dispatch_auction(&request, &dispatch_context)
+                .await
+            {
+                DispatchAuctionOutcome::Dispatched(dispatched) => dispatched,
+                _ => panic!("should dispatch provider request"),
+            };
+            let placeholder = http::Request::builder()
+                .uri("https://placeholder.invalid/")
+                .body(edgezero_core::body::Body::empty())
+                .expect("should build placeholder request");
+            let collect_context = AuctionContext {
+                settings: &settings,
+                request: &placeholder,
+                timeout_ms: 750,
+                provider_responses: None,
+                services: &services,
+            };
+
+            let result = orchestrator
+                .collect_dispatched_auction(dispatched, &services, &collect_context)
+                .await;
+
+            let response = result
+                .provider_responses
+                .first()
+                .expect("should collect provider response");
+            assert_eq!(
+                response.metadata["context_referer"], "https://referrer.example/source",
+                "should parse with the downstream request used at launch"
+            );
+            assert_eq!(
+                response.metadata["context_timeout_ms"], 125,
+                "should parse with the provider-capped launch timeout"
+            );
+        });
+    }
+
     #[test]
     fn rejects_multi_provider_fanout_before_launch_on_sequential_platform() {
         futures::executor::block_on(async {
@@ -2145,14 +2310,42 @@ mod tests {
     }
 
     #[test]
-    fn test_apply_floor_prices_drops_bids_with_undecoded_price() {
-        // Bids that reach apply_floor_prices with `price=None` cannot have a
-        // floor compared against them — and they would not survive downstream
-        // (build_bid_map filters them) — so apply_floor_prices drops them so
-        // the count it reports matches what eventually ships to the client.
-        // Both production paths (select_winning_bids and the mediator filter)
-        // already decode/skip None prices before calling this function; this
-        // test pins the contract.
+    fn decoded_aps_bid_competes_directly_by_cpm() {
+        let orchestrator = AuctionOrchestrator::new(AuctionConfig::default());
+        let floor_prices = HashMap::new();
+        let response = |provider: &str, bid: Bid| AuctionResponse::success(provider, vec![bid], 1);
+
+        let aps_wins = orchestrator.select_winning_bids(
+            &[
+                response("aps", auction_bid("aps", 2.0)),
+                response("ordinary", auction_bid("ordinary", 1.0)),
+            ],
+            &floor_prices,
+        );
+        let winner = aps_wins.get("slot-1").expect("should select APS bid");
+        assert_eq!(winner.bidder, "aps");
+        assert!(winner.renderer.is_some());
+        assert!(winner.creative.is_none());
+
+        let ordinary_wins = orchestrator.select_winning_bids(
+            &[
+                response("aps", auction_bid("aps", 2.0)),
+                response("ordinary", auction_bid("ordinary", 3.0)),
+            ],
+            &floor_prices,
+        );
+        assert_eq!(
+            ordinary_wins
+                .get("slot-1")
+                .expect("should select ordinary bid")
+                .bidder,
+            "ordinary"
+        );
+    }
+
+    #[test]
+    fn test_apply_floor_prices_drops_bids_without_price() {
+        // Price-less bids cannot be compared or delivered and remain fail-closed.
         let orchestrator = AuctionOrchestrator::new(AuctionConfig::default());
         let mut floor_prices = HashMap::new();
         floor_prices.insert("slot-1".to_string(), 1.00);
@@ -2171,18 +2364,14 @@ mod tests {
                 height: 250,
                 nurl: None,
                 burl: None,
+                bid_id: None,
                 ad_id: None,
+                creative_id: None,
+                renderer: None,
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
-                metadata: {
-                    let mut m = HashMap::new();
-                    m.insert(
-                        "amznbid".to_string(),
-                        serde_json::json!("encoded_price_data"),
-                    );
-                    m
-                },
+                metadata: HashMap::new(),
             },
         );
 
@@ -2194,15 +2383,13 @@ mod tests {
         );
         assert!(
             !filtered.contains_key("slot-1"),
-            "slot-1 should not survive when its bid has no decoded price"
+            "slot-1 should not survive when its bid has no price"
         );
     }
 
     #[test]
     fn test_apply_floor_prices_drops_decoded_aps_bid_below_floor() {
-        // After mediation decodes an APS bid, apply_floor_prices must enforce the
-        // slot floor on the resulting price=Some(x) value. This test simulates the
-        // state of a bid after mediator decoding: price is Some, amznbid is gone.
+        // APS supplies decoded price at the provider boundary, so normal floors apply.
         let orchestrator = AuctionOrchestrator::new(AuctionConfig::default());
         let mut floor_prices = HashMap::new();
         floor_prices.insert("atf".to_string(), 0.50);
@@ -2221,7 +2408,10 @@ mod tests {
                 height: 250,
                 nurl: None,
                 burl: None,
+                bid_id: None,
                 ad_id: None,
+                creative_id: None,
+                renderer: None,
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
@@ -2257,7 +2447,10 @@ mod tests {
                 height: 250,
                 nurl: None,
                 burl: None,
+                bid_id: None,
                 ad_id: None,
+                creative_id: None,
+                renderer: None,
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
diff --git a/crates/trusted-server-core/src/auction/telemetry.rs b/crates/trusted-server-core/src/auction/telemetry.rs
index d6344536..c252f535 100644
--- a/crates/trusted-server-core/src/auction/telemetry.rs
+++ b/crates/trusted-server-core/src/auction/telemetry.rs
@@ -960,7 +960,10 @@ mod tests {
             height: 250,
             nurl: None,
             burl: None,
+            bid_id: None,
             ad_id: ad_id.map(str::to_owned),
+            creative_id: None,
+            renderer: None,
             cache_id: None,
             cache_host: None,
             cache_path: None,
diff --git a/crates/trusted-server-core/src/auction/types.rs b/crates/trusted-server-core/src/auction/types.rs
index 14c7713f..f67faa30 100644
--- a/crates/trusted-server-core/src/auction/types.rs
+++ b/crates/trusted-server-core/src/auction/types.rs
@@ -171,18 +171,71 @@ pub struct AuctionResponse {
     pub metadata: HashMap<String, serde_json::Value>,
 }
 
+/// APS creative tag type accepted by the Trusted Server renderer.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum ApsTagType {
+    /// APS loads the creative URL in a nested iframe.
+    Iframe,
+    /// APS fetches creative HTML and executes it in its nested renderer frame.
+    Script,
+}
+
+/// Version 1 APS renderer descriptor shared with browser clients.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ApsRendererV1 {
+    /// Renderer contract version.
+    pub version: u8,
+    /// APS account identifier used to initialize the fixed runner.
+    pub account_id: String,
+    /// Selected `OpenRTB` bid identifier.
+    pub bid_id: String,
+    /// Optional `OpenRTB` creative identifier.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub creative_id: Option<String>,
+    /// APS creative delivery mode.
+    pub tag_type: ApsTagType,
+    /// HTTPS creative URL consumed by the fixed APS runner.
+    pub creative_url: String,
+    /// Base64-encoded exact one-bid APS response envelope.
+    pub aax_response: String,
+    /// Creative width.
+    pub width: u32,
+    /// Creative height.
+    pub height: u32,
+}
+
+/// Typed browser renderer capability carried by a bid.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "type", rename_all = "lowercase")]
+pub enum BidRenderer {
+    /// APS renderer version 1.
+    Aps(ApsRendererV1),
+}
+
+impl BidRenderer {
+    /// Return the APS renderer descriptor when this is an APS renderer.
+    #[must_use]
+    pub fn as_aps(&self) -> Option<&ApsRendererV1> {
+        match self {
+            Self::Aps(renderer) => Some(renderer),
+        }
+    }
+}
+
 /// Individual bid from a provider.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Bid {
     /// Slot this bid is for
     pub slot_id: String,
-    /// Bid price in CPM
-    /// None for APS bids where price is encoded and must be decoded by mediation layer
+    /// Bid price in CPM.
     pub price: Option<f64>,
     /// Currency code (e.g., "USD")
     pub currency: String,
-    /// Creative markup (HTML/VAST)
-    /// None when the bidder doesn't provide creative HTML (e.g., APS/TAM)
+    /// Creative markup (HTML/VAST).
+    ///
+    /// `None` when the bid uses a typed [`BidRenderer`] instead.
     pub creative: Option<String>,
     /// Advertiser domain
     pub adomain: Option<Vec<String>>,
@@ -196,8 +249,15 @@ pub struct Bid {
     pub nurl: Option<String>,
     /// Billing notification URL
     pub burl: Option<String>,
-    /// Ad ID from the bidder
+    /// `OpenRTB` bid identifier.
+    pub bid_id: Option<String>,
+    /// Ad ID from the bidder.
     pub ad_id: Option<String>,
+    /// Optional `OpenRTB` creative identifier.
+    pub creative_id: Option<String>,
+    /// Typed browser renderer capability.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub renderer: Option<BidRenderer>,
     /// Prebid Cache UUID for this bid.
     ///
     /// Populated from `ext.prebid.cache.bids.cacheId` in the PBS response.
@@ -214,8 +274,7 @@ pub struct Bid {
     /// Populated from the path of `ext.prebid.cache.bids.url`. Used as
     /// `hb_cache_path` targeting value. `None` when cache is absent.
     pub cache_path: Option<String>,
-    /// Provider-specific bid metadata
-    /// For APS bids, contains encoded price in "amznbid" field
+    /// Provider-specific bid metadata.
     pub metadata: HashMap<String, serde_json::Value>,
 }
 
@@ -338,7 +397,10 @@ mod tests {
             height: 250,
             nurl: None,
             burl: None,
+            bid_id: None,
             ad_id: None,
+            creative_id: None,
+            renderer: None,
             cache_id: None,
             cache_host: None,
             cache_path: None,
@@ -467,7 +529,10 @@ mod tests {
             height: 250,
             nurl: None,
             burl: None,
+            bid_id: None,
             ad_id: Some("bid-id".to_string()),
+            creative_id: None,
+            renderer: None,
             cache_id: Some("cache-uuid".to_string()),
             cache_host: Some("cache.example.com".to_string()),
             cache_path: Some("/pbc/v1/cache".to_string()),
@@ -492,6 +557,62 @@ mod tests {
         );
     }
 
+    #[test]
+    fn aps_renderer_serializes_to_versioned_camel_case_contract() {
+        let renderer = BidRenderer::Aps(ApsRendererV1 {
+            version: 1,
+            account_id: "example-account-id".to_string(),
+            bid_id: "fictional-bid-id".to_string(),
+            creative_id: Some("fictional-creative-id".to_string()),
+            tag_type: ApsTagType::Iframe,
+            creative_url: "https://creative.example/render".to_string(),
+            aax_response: "base64-data".to_string(),
+            width: 300,
+            height: 250,
+        });
+
+        let serialized = serde_json::to_value(&renderer).expect("should serialize renderer");
+
+        assert_eq!(
+            serialized,
+            json!({
+                "type": "aps",
+                "version": 1,
+                "accountId": "example-account-id",
+                "bidId": "fictional-bid-id",
+                "creativeId": "fictional-creative-id",
+                "tagType": "iframe",
+                "creativeUrl": "https://creative.example/render",
+                "aaxResponse": "base64-data",
+                "width": 300,
+                "height": 250
+            }),
+            "should match renderer wire contract"
+        );
+    }
+
+    #[test]
+    fn aps_renderer_omits_absent_creative_id() {
+        let renderer = BidRenderer::Aps(ApsRendererV1 {
+            version: 1,
+            account_id: "example-account-id".to_string(),
+            bid_id: "fictional-bid-id".to_string(),
+            creative_id: None,
+            tag_type: ApsTagType::Iframe,
+            creative_url: "https://creative.example/render".to_string(),
+            aax_response: "base64-data".to_string(),
+            width: 300,
+            height: 250,
+        });
+
+        let serialized = serde_json::to_value(&renderer).expect("should serialize renderer");
+
+        assert!(
+            serialized.get("creativeId").is_none(),
+            "should omit absent creative ID"
+        );
+    }
+
     #[test]
     fn media_type_defaults_to_banner() {
         assert_eq!(
@@ -514,7 +635,10 @@ mod tests {
             height: 250,
             nurl: None,
             burl: None,
+            bid_id: None,
             ad_id: Some("prebid-ad-id-abc".to_string()),
+            creative_id: None,
+            renderer: None,
             cache_id: None,
             cache_host: None,
             cache_path: None,
diff --git a/crates/trusted-server-core/src/creative_opportunities.rs b/crates/trusted-server-core/src/creative_opportunities.rs
index 9ce741f3..fb4f5b89 100644
--- a/crates/trusted-server-core/src/creative_opportunities.rs
+++ b/crates/trusted-server-core/src/creative_opportunities.rs
@@ -62,6 +62,12 @@ impl CreativeOpportunitiesConfig {
     pub fn validate_runtime(&self) -> Result<(), String> {
         for slot in &self.slot {
             slot.validate_runtime(&self.gam_network_id)?;
+            if slot.providers.aps.is_some() {
+                log::warn!(
+                    "creative opportunity slot '{}': providers.aps is retained only for configuration compatibility and is ignored by APS OpenRTB",
+                    slot.id
+                );
+            }
         }
 
         Ok(())
@@ -275,8 +281,9 @@ impl CreativeOpportunitySlot {
 
     /// Converts this slot into an [`AdSlot`] ready for use in an auction request.
     ///
-    /// Provider-specific params (e.g., APS `slotID`, PBS bidder params) are wired
-    /// into the `bidders` map keyed by provider/bidder name.
+    /// Prebid Server bidder params are wired into the `bidders` map keyed by
+    /// bidder name. Legacy APS slot params are accepted in configuration but
+    /// intentionally ignored by the APS `OpenRTB` provider.
     ///
     /// When [`PrebidSlotParams::bidders`] is empty, a `trustedServer` entry is
     /// injected so [`PrebidAuctionProvider`] expands all `config.bidders`
@@ -285,12 +292,6 @@ impl CreativeOpportunitySlot {
     #[must_use]
     pub fn to_ad_slot(&self) -> AdSlot {
         let mut bidders: HashMap<String, serde_json::Value> = HashMap::new();
-        if let Some(ref aps) = self.providers.aps {
-            bidders.insert(
-                "aps".to_string(),
-                serde_json::json!({ "slotID": aps.slot_id }),
-            );
-        }
         if let Some(ref prebid) = self.providers.prebid {
             if prebid.bidders.is_empty() {
                 // No explicit per-bidder override: let the Prebid provider expand
@@ -364,7 +365,10 @@ impl CreativeOpportunityFormat {
 #[derive(Debug, Clone, Default, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
 pub struct SlotProviders {
-    /// Amazon Publisher Services (APS/TAM) slot parameters.
+    /// Legacy APS slot parameters, retained only for configuration compatibility.
+    ///
+    /// APS `OpenRTB` uses the canonical creative-opportunity slot ID and does not
+    /// forward this value to APS or Prebid Server.
     pub aps: Option<ApsSlotParams>,
     /// Prebid Server inline bidder parameters.
     ///
@@ -374,11 +378,11 @@ pub struct SlotProviders {
     pub prebid: Option<PrebidSlotParams>,
 }
 
-/// APS-specific parameters for a slot.
+/// Legacy APS-specific parameters retained for configuration compatibility.
 #[derive(Debug, Clone, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
 pub struct ApsSlotParams {
-    /// The APS slot ID string used when making TAM bid requests.
+    /// Deprecated legacy slot ID. APS `OpenRTB` ignores this value.
     pub slot_id: String,
 }
 
@@ -617,16 +621,15 @@ mod tests {
     }
 
     #[test]
-    fn to_ad_slot_wires_aps_params_into_bidders() {
+    fn to_ad_slot_ignores_legacy_aps_params() {
         let mut slot = make_slot("atf", vec!["/"]);
         slot.providers.aps = Some(ApsSlotParams {
-            slot_id: "aps-slot-atf".to_string(),
+            slot_id: "legacy-aps-slot-atf".to_string(),
         });
         let ad_slot = slot.to_ad_slot();
-        let aps_params = ad_slot.bidders.get("aps").expect("should have aps bidder");
-        assert_eq!(
-            aps_params.get("slotID").and_then(|v| v.as_str()),
-            Some("aps-slot-atf"),
+        assert!(
+            !ad_slot.bidders.contains_key("aps"),
+            "legacy APS params must not enable APS through Prebid Server"
         );
     }
 
diff --git a/crates/trusted-server-core/src/integrations/adserver_mock.rs b/crates/trusted-server-core/src/integrations/adserver_mock.rs
index 8fd3f9dd..a96016c6 100644
--- a/crates/trusted-server-core/src/integrations/adserver_mock.rs
+++ b/crates/trusted-server-core/src/integrations/adserver_mock.rs
@@ -119,7 +119,7 @@ fn build_bid_index(bidder_responses: &[AuctionResponse]) -> BidIndex {
             // be mis-attributed during mediation. Low severity for the mock
             // mediator, but log it so the collision is visible.
             if index.insert(key, bid.clone()).is_some() {
-                log::debug!(
+                log::warn!(
                     "adserver_mock: duplicate bid for (provider '{}', slot '{}', bidder '{}'); keeping the last — win/billing URL restoration may be mis-attributed",
                     response.provider,
                     bid.slot_id,
@@ -159,9 +159,7 @@ impl AdServerMockProvider {
 
     /// Build mediation request from auction request and bidder responses.
     ///
-    /// Handles both:
-    /// - Regular bids with decoded prices (price field set)
-    /// - APS-style bids with encoded prices (price=None, encoded price in metadata)
+    /// Only bids with decoded numeric prices are eligible for mediation.
     fn build_mediation_request(
         &self,
         request: &AuctionRequest,
@@ -175,14 +173,15 @@ impl AdServerMockProvider {
                 let bids: Vec<Json> = response
                     .bids
                     .iter()
-                    .map(|bid| {
-                        // Mocktioneer mediator always requires a numeric `price` field.
-                        // APS bids carry price as an opaque encoded string (`amznbid`)
-                        // that cannot be decoded client-side; use `bid.price` when set
-                        // (a real decoded value) or fall back to a mock floor price for
-                        // test/demo purposes.
-                        let price = bid.price.unwrap_or(1.50);
-                        json!({
+                    .filter_map(|bid| {
+                        let Some(price) = bid.price else {
+                            log::debug!(
+                                "adserver_mock: omitting bid for slot '{}' without decoded price",
+                                bid.slot_id
+                            );
+                            return None;
+                        };
+                        Some(json!({
                             "imp_id": bid.slot_id,
                             "price": price,
                             "adm": bid.creative,
@@ -190,7 +189,7 @@ impl AdServerMockProvider {
                             "h": bid.height,
                             "crid": format!("{}-creative", bid.bidder),
                             "adomain": bid.adomain,
-                        })
+                        }))
                     })
                     .collect();
 
@@ -254,7 +253,7 @@ impl AdServerMockProvider {
     }
 
     /// Parse `OpenRTB` response from mediation endpoint.
-    /// Mediation returns decoded prices for all bids (including APS bids that were encoded).
+    /// Mediation returns decoded prices for all selected bids.
     ///
     /// `bid_index` is the SSP-bid lookup built from the auction context's
     /// bidder responses. The mock mediator does not echo render/accounting
@@ -307,7 +306,11 @@ impl AdServerMockProvider {
                     slot_id,
                     price: bid["price"].as_f64(),
                     currency: "USD".to_string(),
-                    creative: bid["adm"].as_str().map(String::from),
+                    creative: if original.is_some_and(|bid| bid.renderer.is_some()) {
+                        None
+                    } else {
+                        bid["adm"].as_str().map(String::from)
+                    },
                     width,
                     height,
                     bidder: restored_bidder,
@@ -318,7 +321,10 @@ impl AdServerMockProvider {
                     }),
                     nurl: original.and_then(|b| b.nurl.clone()),
                     burl: original.and_then(|b| b.burl.clone()),
-                    ad_id: original.and_then(|b| b.ad_id.clone()),
+                    bid_id: original.and_then(|bid| bid.bid_id.clone()),
+                    ad_id: original.and_then(|bid| bid.ad_id.clone()),
+                    creative_id: original.and_then(|bid| bid.creative_id.clone()),
+                    renderer: original.and_then(|bid| bid.renderer.clone()),
                     cache_id: original.and_then(|b| b.cache_id.clone()),
                     cache_host: original.and_then(|b| b.cache_host.clone()),
                     cache_path: original.and_then(|b| b.cache_path.clone()),
@@ -614,6 +620,39 @@ mod tests {
         }
     }
 
+    fn aps_bid(bid_id: &str, price: f64) -> Bid {
+        Bid {
+            slot_id: "header-banner".to_string(),
+            price: Some(price),
+            currency: "USD".to_string(),
+            creative: None,
+            width: 728,
+            height: 90,
+            bidder: "aps".to_string(),
+            adomain: Some(vec!["advertiser.example".to_string()]),
+            nurl: None,
+            burl: None,
+            bid_id: Some(bid_id.to_string()),
+            ad_id: None,
+            creative_id: Some(format!("creative-{bid_id}")),
+            renderer: Some(BidRenderer::Aps(ApsRendererV1 {
+                version: 1,
+                account_id: "example-account".to_string(),
+                bid_id: bid_id.to_string(),
+                creative_id: Some(format!("creative-{bid_id}")),
+                tag_type: ApsTagType::Iframe,
+                creative_url: format!("https://creative.example/{bid_id}"),
+                aax_response: format!("fictional-{bid_id}-base64"),
+                width: 728,
+                height: 90,
+            })),
+            cache_id: None,
+            cache_host: None,
+            cache_path: None,
+            metadata: HashMap::new(),
+        }
+    }
+
     #[test]
     fn test_build_mediation_request() {
         let config = AdServerMockConfig {
@@ -629,7 +668,7 @@ mod tests {
 
         let bidder_responses = vec![
             AuctionResponse {
-                provider: "amazon-aps".to_string(),
+                provider: "aps".to_string(),
                 status: BidStatus::Success,
                 bids: vec![Bid {
                     slot_id: "header-banner".to_string(),
@@ -638,11 +677,14 @@ mod tests {
                     creative: Some("<div>APS Ad</div>".to_string()),
                     width: 728,
                     height: 90,
-                    bidder: "amazon-aps".to_string(),
-                    adomain: Some(vec!["amazon.com".to_string()]),
+                    bidder: "aps".to_string(),
+                    adomain: Some(vec!["advertiser.example".to_string()]),
                     nurl: None,
                     burl: None,
+                    bid_id: None,
                     ad_id: None,
+                    creative_id: None,
+                    renderer: None,
                     cache_id: None,
                     cache_host: None,
                     cache_path: None,
@@ -665,7 +707,10 @@ mod tests {
                     adomain: None,
                     nurl: Some("https://ssp.example/win?id=mock-bid-001".to_string()),
                     burl: Some("https://ssp.example/bill?id=mock-bid-001".to_string()),
+                    bid_id: None,
                     ad_id: Some("mock-bid-001".to_string()),
+                    creative_id: None,
+                    renderer: None,
                     cache_id: None,
                     cache_host: None,
                     cache_path: None,
@@ -784,7 +829,20 @@ mod tests {
                 height: 90,
                 nurl: Some("https://ssp.example/win".to_string()),
                 burl: Some("https://ssp.example/bill".to_string()),
+                bid_id: Some("source-bid-id".to_string()),
                 ad_id: Some("bid-impression-id".to_string()),
+                creative_id: Some("source-creative-id".to_string()),
+                renderer: Some(BidRenderer::Aps(ApsRendererV1 {
+                    version: 1,
+                    account_id: "example-account".to_string(),
+                    bid_id: "source-bid-id".to_string(),
+                    creative_id: Some("source-creative-id".to_string()),
+                    tag_type: ApsTagType::Iframe,
+                    creative_url: "https://creative.example/render".to_string(),
+                    aax_response: "fictional-base64".to_string(),
+                    width: 728,
+                    height: 90,
+                })),
                 cache_id: Some("cache-uuid".to_string()),
                 cache_host: Some("cache.example".to_string()),
                 cache_path: Some("/cache".to_string()),
@@ -812,11 +870,14 @@ mod tests {
             Some("https://ssp.example/bill"),
             "should restore burl"
         );
+        assert_eq!(bid.bid_id.as_deref(), Some("source-bid-id"));
         assert_eq!(
             bid.ad_id.as_deref(),
             Some("bid-impression-id"),
             "should restore ad_id"
         );
+        assert_eq!(bid.creative_id.as_deref(), Some("source-creative-id"));
+        assert!(bid.renderer.is_some(), "should restore typed renderer");
         assert_eq!(
             bid.cache_id.as_deref(),
             Some("cache-uuid"),
@@ -834,6 +895,80 @@ mod tests {
         );
     }
 
+    #[test]
+    fn reduced_aps_bid_avoids_mediation_index_renderer_collision() {
+        let provider = AdServerMockProvider::new(AdServerMockConfig::default());
+
+        // Document why APS must reduce before mediation: the mediator index is
+        // intentionally last-write-wins for identical provider/slot/bidder keys.
+        let unreduced = AuctionResponse::success(
+            "aps",
+            vec![aps_bid("selected", 2.0), aps_bid("losing-last", 1.0)],
+            1,
+        );
+        let collision_index = build_bid_index(&[unreduced]);
+        let key = (
+            "aps".to_string(),
+            "header-banner".to_string(),
+            "aps".to_string(),
+        );
+        assert_eq!(
+            collision_index
+                .get(&key)
+                .and_then(|bid| bid.bid_id.as_deref()),
+            Some("losing-last"),
+            "an unreduced response would restore the last candidate's renderer"
+        );
+
+        let reduced = AuctionResponse::success("aps", vec![aps_bid("selected", 2.0)], 1);
+        let mediation_request = provider
+            .build_mediation_request(
+                &create_test_auction_request(),
+                std::slice::from_ref(&reduced),
+            )
+            .expect("should build mediation request from reduced APS response");
+        assert_eq!(
+            mediation_request["ext"]["bidder_responses"][0]["bids"]
+                .as_array()
+                .map(Vec::len),
+            Some(1)
+        );
+
+        let reduced_index = build_bid_index(&[reduced]);
+        let mediated = provider.parse_mediation_response(
+            &json!({
+                "seatbid": [{
+                    "seat": "aps",
+                    "bid": [{
+                        "impid": "header-banner",
+                        "price": 2.0,
+                        "w": 728,
+                        "h": 90,
+                        "crid": "aps-creative"
+                    }]
+                }]
+            }),
+            2,
+            &reduced_index,
+        );
+        let winner = mediated
+            .bids
+            .first()
+            .expect("should restore mediated APS winner");
+        assert_eq!(winner.bid_id.as_deref(), Some("selected"));
+        assert_eq!(
+            winner
+                .renderer
+                .as_ref()
+                .expect("should restore APS renderer")
+                .as_aps()
+                .expect("should be APS renderer")
+                .bid_id,
+            "selected"
+        );
+        assert!(winner.creative.is_none());
+    }
+
     #[test]
     fn test_parse_empty_mediation_response() {
         let config = AdServerMockConfig::default();
@@ -853,8 +988,8 @@ mod tests {
     }
 
     #[test]
-    fn test_mediation_request_handles_none_creative() {
-        // Test that bids without creative HTML (e.g., APS) are properly sent to mediation
+    fn test_mediation_request_handles_decoded_bid_without_creative() {
+        // Typed-renderer bids retain their decoded price when sent to mediation.
         let config = AdServerMockConfig::default();
         let provider = AdServerMockProvider::new(config);
 
@@ -885,29 +1020,28 @@ mod tests {
             context: HashMap::new(),
         };
 
-        // APS bid with encoded price (price=None, amznbid in metadata)
-        let mut aps_metadata = HashMap::new();
-        aps_metadata.insert("amznbid".to_string(), json!("encoded-price-value"));
-
         let bidder_responses = vec![AuctionResponse {
             provider: "aps".to_string(),
             status: BidStatus::Success,
             bids: vec![Bid {
                 slot_id: "slot-1".to_string(),
-                price: None, // APS bids have no decoded price
+                price: Some(1.75),
                 currency: "USD".to_string(),
-                creative: None, // APS doesn't provide creative
+                creative: None,
                 width: 300,
                 height: 250,
-                bidder: "amazon-aps".to_string(),
-                adomain: Some(vec!["amazon.com".to_string()]),
+                bidder: "aps".to_string(),
+                adomain: Some(vec!["advertiser.example".to_string()]),
                 nurl: None,
                 burl: None,
+                bid_id: None,
                 ad_id: None,
+                creative_id: None,
+                renderer: None,
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
-                metadata: aps_metadata,
+                metadata: HashMap::new(),
             }],
             response_time_ms: 100,
             metadata: HashMap::new(),
@@ -920,20 +1054,16 @@ mod tests {
         // Verify the mediation request structure
         assert_eq!(mediation_req["id"], "test-auction");
 
-        // Check that the bid was included with encoded_price
         let bidder_resp = &mediation_req["ext"]["bidder_responses"][0];
         assert_eq!(bidder_resp["bidder"], "aps");
 
         let bid = &bidder_resp["bids"][0];
         assert_eq!(bid["imp_id"], "slot-1");
 
-        // APS bids have no decoded price (bid.price == None), so the mock floor
-        // price (1.50) is used.  Mocktioneer requires a numeric price field and
-        // does not accept an opaque encoded_price string.
         assert_eq!(
             bid["price"].as_f64(),
-            Some(1.50),
-            "APS bids with no decoded price should fall back to mock floor price 1.50"
+            Some(1.75),
+            "should preserve the decoded APS price"
         );
         // adm should be null (not a string)
         assert!(
@@ -1010,8 +1140,7 @@ mod tests {
 
     #[test]
     fn test_parse_mediation_response_with_missing_prices() {
-        // Test that mediator response with missing price fields returns None prices
-        // This tests the scenario where mediation failed to decode APS prices
+        // A malformed mediator response can still omit a selected bid price.
         let config = AdServerMockConfig::default();
         let provider = AdServerMockProvider::new(config);
 
diff --git a/crates/trusted-server-core/src/integrations/aps.rs b/crates/trusted-server-core/src/integrations/aps.rs
index 60c22265..46016053 100644
--- a/crates/trusted-server-core/src/integrations/aps.rs
+++ b/crates/trusted-server-core/src/integrations/aps.rs
@@ -1,239 +1,176 @@
-//! Amazon Publisher Services (APS/TAM) integration.
-//!
-//! This module provides the APS auction provider for server-side bidding.
+//! Amazon Publisher Services (APS/TAM) `OpenRTB` integration.
+
+use std::collections::{BTreeMap, HashMap};
+use std::sync::Arc;
+use std::time::Duration;
 
 use async_trait::async_trait;
+use base64::{Engine as _, engine::general_purpose::STANDARD as BASE64_STANDARD};
 use edgezero_core::body::Body as EdgeBody;
 use error_stack::{Report, ResultExt};
-use http::{Method, header};
+use http::{HeaderMap, Method, StatusCode, header};
+use serde::de::{self, Visitor};
 use serde::{Deserialize, Serialize};
 use serde_json::{Value as Json, json};
-use std::collections::HashMap;
-use std::time::Duration;
-use validator::Validate;
+use url::Url;
+use validator::{Validate, ValidationError};
 
 use crate::auction::provider::AuctionProvider;
-use crate::auction::types::{AuctionContext, AuctionRequest, AuctionResponse, Bid, MediaType};
+use crate::auction::types::{
+    AdSlot, ApsRendererV1, ApsTagType, AuctionContext, AuctionRequest, AuctionResponse, Bid,
+    BidRenderer, MediaType,
+};
 use crate::error::TrustedServerError;
 use crate::integrations::{
+    IntegrationEndpoint, IntegrationProxy, IntegrationRegistration,
     UPSTREAM_RTB_MAX_RESPONSE_BYTES, collect_response_bounded,
     ensure_integration_backend_with_timeout, predict_integration_backend_name,
 };
+use crate::openrtb::{
+    Banner, Device, Format, Geo, Imp, OpenRtbRequest, Publisher, Regs, RegsExt, Site, ToExt, User,
+    UserExt, to_openrtb_i32,
+};
 use crate::platform::{
     PlatformHttpRequest, PlatformPendingRequest, PlatformResponse, RuntimeServices,
 };
-
-use crate::settings::IntegrationConfig;
-
-// ============================================================================
-// APS TAM API Types
-// ============================================================================
-
-/// APS TAM bid request format based on /e/dtb/bid endpoint.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-struct ApsBidRequest {
-    /// Publisher ID
-    #[serde(rename = "pubId")]
-    pub_id: String,
-
-    /// Slot configurations
-    slots: Vec<ApsSlot>,
-
-    /// Page URL
-    #[serde(rename = "pageUrl", skip_serializing_if = "Option::is_none")]
-    page_url: Option<String>,
-
-    /// User agent
-    #[serde(rename = "ua", skip_serializing_if = "Option::is_none")]
-    user_agent: Option<String>,
-
-    /// Timeout in milliseconds
-    #[serde(skip_serializing_if = "Option::is_none")]
-    timeout: Option<u32>,
-
-    /// GDPR consent information.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    gdpr: Option<ApsGdprConsent>,
-
-    /// US Privacy (CCPA) string.
-    #[serde(rename = "usPrivacy", skip_serializing_if = "Option::is_none")]
-    us_privacy: Option<String>,
-
-    /// GPP consent string.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    gpp: Option<String>,
-
-    /// GPP section IDs as comma-separated string.
-    #[serde(rename = "gppSid", skip_serializing_if = "Option::is_none")]
-    gpp_sid: Option<String>,
-}
-
-/// GDPR consent information for APS requests.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-struct ApsGdprConsent {
-    /// Whether GDPR applies to this request.
-    enabled: bool,
-    /// TCF v2 consent string.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    consent: Option<String>,
-}
-
-/// APS slot configuration.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-struct ApsSlot {
-    /// Slot identifier
-    #[serde(rename = "slotID")]
-    slot_id: String,
-
-    /// Ad sizes [[width, height], ...]
-    sizes: Vec<[u32; 2]>,
-
-    /// Slot name (optional)
-    #[serde(rename = "slotName", skip_serializing_if = "Option::is_none")]
-    slot_name: Option<String>,
-}
-
-/// APS TAM bid response format matching real Amazon API.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-struct ApsBidResponse {
-    /// Contextual wrapper containing all response data
-    contextual: ApsContextual,
+use crate::settings::{IntegrationConfig, Settings};
+
+const APS_INTEGRATION_ID: &str = "aps";
+const APS_RENDERER_ROUTE: &str = "/integrations/aps/renderer";
+const DEFAULT_CURRENCY: &str = "USD";
+const APS_SDK_SOURCE: &str = "prebid";
+const APS_SDK_VERSION: &str = "2.2.0";
+const MAX_ACCOUNT_ID_BYTES: usize = 1024;
+const MAX_CREATIVE_ID_BYTES: usize = 1024;
+const MAX_CREATIVE_URL_BYTES: usize = 4096;
+const MAX_LANGUAGE_BYTES: usize = 8;
+const MAX_PAGE_URL_BYTES: usize = 8192;
+const MAX_RENDER_ENVELOPE_BYTES: usize = 256 * 1024;
+const APS_RENDERER_CSP: &str = "default-src 'none'; sandbox allow-forms allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-scripts allow-top-navigation-by-user-activation; script-src 'unsafe-inline' https:; connect-src https:; frame-src https:; img-src https: data:; media-src https: blob:; style-src 'unsafe-inline' https:; font-src https: data:;";
+
+const APS_RENDERER_DOCUMENT: &str = r#"<!doctype html>
+<meta charset="utf-8">
+<script>
+(function(){
+'use strict';
+var match=/^#tsaps=([A-Za-z0-9_-]{22,128})$/.exec(location.hash);
+var expected=match&&match[1];
+try{history.replaceState(null,'',location.pathname+location.search);}catch(_error){}
+if(!expected)return;
+function keys(value,expectedKeys){
+ if(!value||typeof value!=='object'||Array.isArray(value))return false;
+ var actual=Object.keys(value).sort();
+ return actual.length===expectedKeys.length&&actual.every(function(key,index){return key===expectedKeys[index];});
 }
-
-/// APS Contextual response containing slots and metadata.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-struct ApsContextual {
-    /// Array of slot responses (one per requested slot)
-    #[serde(default)]
-    slots: Vec<ApsSlotResponse>,
-
-    /// Event tracking host
-    #[serde(skip_serializing_if = "Option::is_none")]
-    host: Option<String>,
-
-    /// Response status ("ok", "error", etc.)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    status: Option<String>,
-
-    /// Client-side feature enablement flag
-    #[serde(skip_serializing_if = "Option::is_none")]
-    cfe: Option<bool>,
-
-    /// Event tracking enabled
-    #[serde(skip_serializing_if = "Option::is_none")]
-    ev: Option<bool>,
-
-    /// Client feature name (CSM script path)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    cfn: Option<String>,
-
-    /// Callback version
-    #[serde(skip_serializing_if = "Option::is_none")]
-    cb: Option<String>,
-
-    /// Campaign tracking URL
-    #[serde(skip_serializing_if = "Option::is_none")]
-    cmp: Option<String>,
+function validRenderer(renderer){
+ if(!keys(renderer,['aaxResponse','accountId','bidId','creativeId','creativeUrl','height','tagType','type','version','width'])&&
+    !keys(renderer,['aaxResponse','accountId','bidId','creativeUrl','height','tagType','type','version','width']))return false;
+ if(renderer.type!=='aps'||renderer.version!==1||typeof renderer.accountId!=='string'||!renderer.accountId||new TextEncoder().encode(renderer.accountId).length>1024)return false;
+ if(typeof renderer.bidId!=='string'||!renderer.bidId||!Number.isInteger(renderer.width)||renderer.width<=0||!Number.isInteger(renderer.height)||renderer.height<=0)return false;
+ if(Object.prototype.hasOwnProperty.call(renderer,'creativeId')&&(typeof renderer.creativeId!=='string'||!renderer.creativeId||new TextEncoder().encode(renderer.creativeId).length>1024))return false;
+ if(renderer.tagType!=='iframe'&&renderer.tagType!=='script')return false;
+ if(typeof renderer.creativeUrl!=='string'||new TextEncoder().encode(renderer.creativeUrl).length>4096)return false;
+ if(typeof renderer.aaxResponse!=='string'||!renderer.aaxResponse||renderer.aaxResponse.length>349528)return false;
+ try{
+  var url=new URL(renderer.creativeUrl);
+  if(url.protocol!=='https:'||url.username||url.password||url.origin===location.origin)return false;
+  var binary=atob(renderer.aaxResponse);
+  if(binary.length>262144||btoa(binary)!==renderer.aaxResponse)return false;
+  var bytes=Uint8Array.from(binary,function(character){return character.charCodeAt(0);});
+  var decoded=JSON.parse(new TextDecoder('utf-8',{fatal:true}).decode(bytes));
+  if(!keys(decoded,['seatbid'])||!Array.isArray(decoded.seatbid)||decoded.seatbid.length!==1)return false;
+  var seat=decoded.seatbid[0];
+  if(!keys(seat,['bid'])||!Array.isArray(seat.bid)||seat.bid.length!==1)return false;
+  var bid=seat.bid[0];
+  if(!keys(bid,['ext','h','id','price','w'])||!keys(bid.ext,['creativeurl','tagtype']))return false;
+  return bid.id===renderer.bidId&&bid.w===renderer.width&&bid.h===renderer.height&&
+   bid.ext.creativeurl===renderer.creativeUrl&&bid.ext.tagtype===renderer.tagType&&
+   typeof bid.price==='number'&&Number.isFinite(bid.price)&&bid.price>=0;
+ }catch(_error){return false;}
 }
-
-/// Individual APS slot response matching real Amazon format.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-struct ApsSlotResponse {
-    /// Slot ID this response is for
-    #[serde(rename = "slotID")]
-    slot_id: String,
-
-    /// Creative size (e.g., "300x250")
-    size: String,
-
-    /// Creative ID
-    #[serde(skip_serializing_if = "Option::is_none")]
-    crid: Option<String>,
-
-    /// Media type ("d" for display, "v" for video)
-    #[serde(rename = "mediaType", skip_serializing_if = "Option::is_none")]
-    media_type: Option<String>,
-
-    /// Fill indicator flag ("1" = filled, "0" = no fill)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    fif: Option<String>,
-
-    /// List of targeting key names that are set on this slot
-    #[serde(default)]
-    targeting: Vec<String>,
-
-    /// List of metadata field names
-    #[serde(default)]
-    meta: Vec<String>,
-
-    // Targeting key-value pairs (returned as flat fields)
-    /// Amazon impression ID (unique identifier for this bid)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    amzniid: Option<String>,
-
-    /// Amazon encoded bid price
-    #[serde(skip_serializing_if = "Option::is_none")]
-    amznbid: Option<String>,
-
-    /// Amazon encoded price (alternative encoding)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    amznp: Option<String>,
-
-    /// Amazon size in `WxH` format (e.g., "300x250")
-    #[serde(skip_serializing_if = "Option::is_none")]
-    amznsz: Option<String>,
-
-    /// Amazon auction context type ("OPEN", "PRIVATE", etc.)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    amznactt: Option<String>,
+function receive(event){
+ if(event.source!==parent)return;
+ var message=event.data;
+ if(!keys(message,['nonce','renderer'])||message.nonce!==expected||!validRenderer(message.renderer))return;
+ removeEventListener('message',receive);
+ var acceptedNonce=expected;
+ expected='';
+ var renderer=message.renderer;
+ window._aps=window._aps instanceof Map?window._aps:new Map();
+ var account=window._aps.get(renderer.accountId);
+ if(!account){
+  account={queue:[],store:new Map([['listeners',new Map()]])};
+  window._aps.set(renderer.accountId,account);
+ }
+ account.queue.push(new CustomEvent('prebid/creative/render',{detail:{aaxResponse:renderer.aaxResponse,seatBidId:renderer.bidId}}));
+ var script=document.createElement('script');
+ script.src='https://client.aps.amazon-adsystem.com/prebid-creative.js';
+ script.onload=function(){parent.postMessage({message:'trusted-server/aps/renderer-ready',nonce:acceptedNonce},'*');};
+ script.onerror=function(){parent.postMessage({message:'trusted-server/aps/renderer-failed',nonce:acceptedNonce},'*');};
+ document.head.appendChild(script);
 }
+addEventListener('message',receive);
+})();
+</script>
+"#;
 
-// ============================================================================
-// Real APS Provider
-// ============================================================================
-
-/// Configuration for APS integration.
+/// Configuration for the APS `OpenRTB` integration.
 #[derive(Debug, Clone, Deserialize, Serialize, Validate)]
+#[validate(schema(function = "validate_inventory_identity_override"))]
 pub struct ApsConfig {
-    /// Whether APS integration is enabled
+    /// Whether APS integration is enabled.
     #[serde(default = "default_enabled")]
     pub enabled: bool,
-
-    /// APS publisher ID (accepts both string and integer from config)
-    #[serde(deserialize_with = "deserialize_pub_id")]
-    pub pub_id: String,
-
-    /// APS API endpoint
+    /// APS account ID. `pub_id` remains a deserialization alias only.
+    #[serde(alias = "pub_id", deserialize_with = "deserialize_account_id")]
+    pub account_id: String,
+    /// APS `OpenRTB` endpoint.
     #[serde(default = "default_endpoint")]
-    #[validate(url)]
+    #[validate(custom(function = "validate_aps_endpoint"))]
     pub endpoint: String,
-
-    /// Timeout in milliseconds
+    /// Timeout in milliseconds.
     #[serde(default = "default_timeout_ms")]
     pub timeout_ms: u32,
+    /// Whether to include the APS HTTP exchange in auction response metadata.
+    #[serde(default)]
+    pub debug: bool,
+    /// Whether APS script creatives are eligible before winner selection.
+    #[serde(default)]
+    pub allow_script_creatives: bool,
+    /// APS-authorized inventory domain used instead of the deployment hostname.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[validate(custom(function = "validate_inventory_domain"))]
+    pub inventory_domain: Option<String>,
+    /// Canonical HTTPS origin used for APS `site.page` while preserving path and query.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[validate(custom(function = "validate_inventory_page_origin"))]
+    pub inventory_page_origin: Option<String>,
 }
 
-/// Custom deserializer for `pub_id` that accepts both string and integer
-fn deserialize_pub_id<'de, D>(deserializer: D) -> Result<String, D::Error>
+fn deserialize_account_id<'de, D>(deserializer: D) -> Result<String, D::Error>
 where
     D: serde::Deserializer<'de>,
 {
-    use serde::de::{self, Visitor};
-    use std::fmt;
+    struct AccountIdVisitor;
 
-    struct PubIdVisitor;
-
-    impl<'de> Visitor<'de> for PubIdVisitor {
+    impl Visitor<'_> for AccountIdVisitor {
         type Value = String;
 
-        fn expecting(&self, formatter: &mut fmt::Formatter) -> fmt::Result {
-            formatter.write_str("a string or integer for pub_id")
+        fn expecting(&self, formatter: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+            formatter.write_str("a non-empty string or integer for account_id")
         }
 
         fn visit_str<E>(self, value: &str) -> Result<String, E>
         where
             E: de::Error,
         {
+            let value = value.trim();
+            if value.is_empty() {
+                return Err(E::custom("account_id must not be empty"));
+            }
+            if value.len() > MAX_ACCOUNT_ID_BYTES {
+                return Err(E::custom("account_id is too large"));
+            }
             Ok(value.to_string())
         }
 
@@ -241,7 +178,7 @@ where
         where
             E: de::Error,
         {
-            Ok(value)
+            self.visit_str(&value)
         }
 
         fn visit_i64<E>(self, value: i64) -> Result<String, E>
@@ -259,7 +196,97 @@ where
         }
     }
 
-    deserializer.deserialize_any(PubIdVisitor)
+    deserializer.deserialize_any(AccountIdVisitor)
+}
+
+fn validate_aps_endpoint(value: &str) -> Result<(), ValidationError> {
+    let parsed = Url::parse(value).map_err(|_| ValidationError::new("invalid_aps_endpoint"))?;
+    if parsed.scheme() != "https"
+        || parsed.host_str().is_none()
+        || !parsed.username().is_empty()
+        || parsed.password().is_some()
+    {
+        return Err(ValidationError::new("invalid_aps_endpoint"));
+    }
+    if parsed.path().trim_end_matches('/').ends_with("/e/dtb/bid") {
+        let mut error = ValidationError::new("legacy_aps_endpoint");
+        error.message =
+            Some("legacy APS endpoint /e/dtb/bid is unsupported; migrate to /e/pb/bid".into());
+        return Err(error);
+    }
+    Ok(())
+}
+
+fn validate_inventory_domain(value: &str) -> Result<(), ValidationError> {
+    if value.trim() != value
+        || value.is_empty()
+        || value.len() > 253
+        || value.starts_with('.')
+        || value.ends_with('.')
+        || value.contains(['/', ':'])
+    {
+        return Err(ValidationError::new("invalid_aps_inventory_domain"));
+    }
+    for label in value.split('.') {
+        let bytes = label.as_bytes();
+        if label.is_empty()
+            || label.len() > 63
+            || bytes.first() == Some(&b'-')
+            || bytes.last() == Some(&b'-')
+            || !bytes
+                .iter()
+                .all(|byte| byte.is_ascii_alphanumeric() || *byte == b'-')
+        {
+            return Err(ValidationError::new("invalid_aps_inventory_domain"));
+        }
+    }
+    Ok(())
+}
+
+fn validate_inventory_page_origin(value: &str) -> Result<(), ValidationError> {
+    let parsed =
+        Url::parse(value).map_err(|_| ValidationError::new("invalid_aps_inventory_page_origin"))?;
+    if parsed.scheme() != "https"
+        || parsed.host_str().is_none()
+        || !parsed.username().is_empty()
+        || parsed.password().is_some()
+        || parsed.port().is_some()
+        || parsed.path() != "/"
+        || parsed.query().is_some()
+        || parsed.fragment().is_some()
+    {
+        return Err(ValidationError::new("invalid_aps_inventory_page_origin"));
+    }
+    Ok(())
+}
+
+fn validate_inventory_identity_override(config: &ApsConfig) -> Result<(), ValidationError> {
+    let (Some(domain), Some(origin)) = (
+        config.inventory_domain.as_deref(),
+        config.inventory_page_origin.as_deref(),
+    ) else {
+        if config.inventory_domain.is_none() && config.inventory_page_origin.is_none() {
+            return Ok(());
+        }
+        return Err(ValidationError::new(
+            "incomplete_aps_inventory_identity_override",
+        ));
+    };
+    let parsed = Url::parse(origin)
+        .map_err(|_| ValidationError::new("invalid_aps_inventory_page_origin"))?;
+    let host = parsed
+        .host_str()
+        .ok_or_else(|| ValidationError::new("invalid_aps_inventory_page_origin"))?
+        .to_ascii_lowercase();
+    let domain = domain.to_ascii_lowercase();
+    if host != domain
+        && !host
+            .strip_suffix(&domain)
+            .is_some_and(|prefix| prefix.ends_with('.'))
+    {
+        return Err(ValidationError::new("aps_inventory_origin_domain_mismatch"));
+    }
+    Ok(())
 }
 
 fn default_enabled() -> bool {
@@ -267,7 +294,7 @@ fn default_enabled() -> bool {
 }
 
 fn default_endpoint() -> String {
-    "https://aax.amazon-adsystem.com/e/dtb/bid".to_string()
+    "https://web.ads.aps.amazon-adsystem.com/e/pb/bid".to_string()
 }
 
 fn default_timeout_ms() -> u32 {
@@ -277,10 +304,14 @@ fn default_timeout_ms() -> u32 {
 impl Default for ApsConfig {
     fn default() -> Self {
         Self {
-            enabled: default_enabled(),
-            pub_id: String::new(),
+            enabled: false,
+            account_id: String::new(),
             endpoint: default_endpoint(),
             timeout_ms: default_timeout_ms(),
+            debug: false,
+            allow_script_creatives: false,
+            inventory_domain: None,
+            inventory_page_origin: None,
         }
     }
 }
@@ -291,314 +322,704 @@ impl IntegrationConfig for ApsConfig {
     }
 }
 
-/// Amazon APS auction provider.
+#[derive(Debug, Serialize)]
+struct ApsRequestExt<'a> {
+    account: &'a str,
+    sdk: ApsSdkExt,
+}
+
+impl ToExt for ApsRequestExt<'_> {}
+
+#[derive(Debug, Serialize)]
+struct ApsSdkExt {
+    source: &'static str,
+    version: &'static str,
+}
+
+struct ApsRendererInput<'a> {
+    bid_id: &'a str,
+    creative_id: Option<String>,
+    tag_type: ApsTagType,
+    creative_url: &'a str,
+    price: f64,
+    width: u32,
+    height: u32,
+}
+
+struct ApsDebugRequest {
+    body: String,
+    headers: BTreeMap<String, Vec<String>>,
+}
+
+/// APS `OpenRTB` auction provider.
 pub struct ApsAuctionProvider {
     config: ApsConfig,
 }
 
 impl ApsAuctionProvider {
-    /// Create a new APS auction provider.
+    /// Create an APS provider from validated configuration.
     #[must_use]
     pub fn new(config: ApsConfig) -> Self {
         Self { config }
     }
 
-    /// Resolve the APS-specific slot ID for a slot.
-    ///
-    /// Uses the APS slot ID from `[slot.providers.aps]` if configured; falls
-    /// back to the creative-opportunity slot ID otherwise.
-    fn aps_slot_id(slot: &crate::auction::types::AdSlot) -> String {
-        slot.bidders
-            .get("aps")
-            .and_then(|p| p.get("slotID"))
-            .and_then(|v| v.as_str())
-            .unwrap_or(&slot.id)
-            .to_string()
-    }
-
-    /// Build the APS slot ID → creative-opportunity slot ID map for `request`.
-    ///
-    /// Derived from the [`AuctionRequest`] on every call so the mapping stays
-    /// request-scoped: the provider instance is shared across concurrent
-    /// auctions on non-Fastly adapters, and instance state would let
-    /// overlapping auctions overwrite or consume each other's maps.
-    fn build_slot_id_map(request: &AuctionRequest) -> HashMap<String, String> {
-        let mut slot_id_map: HashMap<String, String> = HashMap::new();
-        for slot in &request.slots {
-            let aps_slot_id = Self::aps_slot_id(slot);
-            // Last-write-wins: two slots configuring the same
-            // `[bidders.aps].slotID` would remap one slot's bids to the
-            // wrong creative slot. Log the collision so a misconfiguration
-            // is diagnosable, mirroring the build_bid_index collision log.
-            if let Some(previous_slot_id) = slot_id_map.insert(aps_slot_id.clone(), slot.id.clone())
-            {
-                log::debug!(
-                    "APS slot ID '{aps_slot_id}' maps to multiple creative slots \
-                     ('{previous_slot_id}' overwritten by '{}'); bids for this APS \
-                     slot will resolve to the last one",
-                    slot.id,
-                );
-            }
+    fn build_regs(consent: Option<&crate::consent::ConsentContext>) -> Option<Regs> {
+        let consent = consent?;
+        let ext = RegsExt {
+            gdpr: Some(u8::from(consent.gdpr_applies)),
+            us_privacy: consent.raw_us_privacy.clone(),
+            gpp: consent.raw_gpp_string.clone(),
+            gpp_sid: consent.gpp_section_ids.clone(),
+        };
+        Some(Regs {
+            coppa: None,
+            gdpr: Some(consent.gdpr_applies),
+            us_privacy: ext.us_privacy.clone(),
+            gpp: ext.gpp.clone(),
+            gpp_sid: ext
+                .gpp_sid
+                .as_ref()
+                .map(|ids| ids.iter().map(|id| i32::from(*id)).collect())
+                .unwrap_or_default(),
+            ext: ext.to_ext(),
+        })
+    }
+
+    fn request_language(context: &AuctionContext<'_>) -> Option<String> {
+        context
+            .request
+            .headers()
+            .get(header::ACCEPT_LANGUAGE)
+            .and_then(|value| value.to_str().ok())
+            .and_then(|value| value.split(',').next())
+            .and_then(|value| value.split(';').next())
+            .and_then(|value| value.split('-').next())
+            .map(str::trim)
+            .filter(|value| !value.is_empty() && value.len() <= MAX_LANGUAGE_BYTES)
+            .map(str::to_string)
+    }
+
+    fn request_dnt(context: &AuctionContext<'_>) -> Option<bool> {
+        context
+            .request
+            .headers()
+            .get("DNT")
+            .and_then(|value| value.to_str().ok())
+            .is_some_and(|value| value.trim() == "1")
+            .then_some(true)
+    }
+
+    fn valid_http_url(value: &str) -> Option<String> {
+        if value.len() > MAX_PAGE_URL_BYTES {
+            return None;
         }
-        slot_id_map
-    }
-
-    /// Convert unified `AuctionRequest` to APS TAM bid request format.
-    ///
-    /// Populates consent fields (GDPR, US Privacy, GPP) from the
-    /// [`ConsentContext`](crate::consent::ConsentContext) attached to the request.
-    ///
-    /// `timeout_ms` is the effective auction budget for this provider (already
-    /// capped by the orchestrator) — advertised to APS so it never expects more
-    /// time than the edge will actually wait.
-    fn to_aps_request(&self, request: &AuctionRequest, timeout_ms: u32) -> ApsBidRequest {
-        let slots: Vec<ApsSlot> = request
+        let parsed = Url::parse(value).ok()?;
+        if !matches!(parsed.scheme(), "http" | "https")
+            || parsed.host_str().is_none()
+            || !parsed.username().is_empty()
+            || parsed.password().is_some()
+        {
+            return None;
+        }
+        Some(parsed.to_string())
+    }
+
+    fn inventory_site_identity(
+        &self,
+        fallback_domain: &str,
+        fallback_page: String,
+    ) -> (String, String) {
+        let (Some(domain), Some(origin)) = (
+            self.config.inventory_domain.as_ref(),
+            self.config.inventory_page_origin.as_deref(),
+        ) else {
+            return (fallback_domain.to_string(), fallback_page);
+        };
+        let (Ok(mut canonical_page), Ok(current_page)) =
+            (Url::parse(origin), Url::parse(&fallback_page))
+        else {
+            return (fallback_domain.to_string(), fallback_page);
+        };
+        canonical_page.set_path(current_page.path());
+        canonical_page.set_query(current_page.query());
+        canonical_page.set_fragment(None);
+        (domain.clone(), canonical_page.to_string())
+    }
+
+    fn build_openrtb_request(
+        &self,
+        request: &AuctionRequest,
+        context: &AuctionContext<'_>,
+    ) -> OpenRtbRequest {
+        let imp = request
             .slots
             .iter()
-            .map(|slot| {
-                let aps_slot_id = Self::aps_slot_id(slot);
-
-                // Extract sizes from banner formats
-                let sizes: Vec<[u32; 2]> = slot
+            .filter_map(|slot| {
+                let slot_context = format!("slot '{}'", slot.id);
+                let formats: Vec<Format> = slot
                     .formats
                     .iter()
-                    .filter(|f| f.media_type == MediaType::Banner)
-                    .map(|f| [f.width, f.height])
+                    .filter(|format| format.media_type == MediaType::Banner)
+                    .filter_map(|format| {
+                        Some(Format {
+                            w: to_openrtb_i32(format.width, "format.w", &slot_context),
+                            h: to_openrtb_i32(format.height, "format.h", &slot_context),
+                            ..Default::default()
+                        })
+                        .filter(|format| format.w.is_some() && format.h.is_some())
+                    })
                     .collect();
-
-                ApsSlot {
-                    slot_id: aps_slot_id,
-                    sizes,
-                    slot_name: Some(slot.id.clone()),
-                }
+                let first = formats.first()?;
+                Some(Imp {
+                    id: Some(slot.id.clone()),
+                    banner: Some(Banner {
+                        format: formats.clone(),
+                        w: first.w,
+                        h: first.h,
+                        topframe: Some(false),
+                        ..Default::default()
+                    }),
+                    bidfloor: slot.floor_price,
+                    bidfloorcur: slot.floor_price.map(|_| DEFAULT_CURRENCY.to_string()),
+                    secure: Some(true),
+                    ..Default::default()
+                })
             })
             .collect();
 
-        // Build consent fields from ConsentContext
-        let consent_ctx = request.user.consent.as_ref();
-        let gdpr = consent_ctx.map(|ctx| ApsGdprConsent {
-            enabled: ctx.gdpr_applies,
-            consent: ctx.raw_tc_string.clone(),
-        });
-        let us_privacy = consent_ctx.and_then(|ctx| ctx.raw_us_privacy.clone());
-        let gpp = consent_ctx.and_then(|ctx| ctx.raw_gpp_string.clone());
-        let gpp_sid = consent_ctx.and_then(|ctx| {
-            ctx.gpp_section_ids.as_ref().map(|ids| {
-                ids.iter()
-                    .map(std::string::ToString::to_string)
-                    .collect::<Vec<_>>()
-                    .join(",")
-            })
+        let consent = request.user.consent.as_ref();
+        let raw_tc = consent.and_then(|value| value.raw_tc_string.clone());
+        let user = Some(User {
+            id: request.user.id.clone(),
+            consent: raw_tc.clone(),
+            ext: UserExt {
+                consent: raw_tc,
+                consented_providers_settings: None,
+                eids: request.user.eids.clone(),
+            }
+            .to_ext(),
+            ..Default::default()
         });
 
-        ApsBidRequest {
-            pub_id: self.config.pub_id.clone(),
-            slots,
-            page_url: request.publisher.page_url.clone(),
-            user_agent: request.device.as_ref().and_then(|d| d.user_agent.clone()),
-            timeout: Some(timeout_ms),
-            gdpr,
-            us_privacy,
-            gpp,
-            gpp_sid,
+        let language = Self::request_language(context);
+        let dnt = Self::request_dnt(context);
+        let device = request
+            .device
+            .as_ref()
+            .map(|device| Device {
+                ua: device.user_agent.clone(),
+                ip: device.ip.clone(),
+                geo: device.geo.as_ref().map(|geo| Geo {
+                    country: Some(geo.country.clone()),
+                    region: geo.region.clone(),
+                    city: Some(geo.city.clone()),
+                    metro: (geo.metro_code > 0).then(|| geo.metro_code.to_string()),
+                    r#type: Some(2),
+                    ..Default::default()
+                }),
+                dnt,
+                language: language.clone(),
+                ..Default::default()
+            })
+            .or_else(|| {
+                (dnt.is_some() || language.is_some()).then_some(Device {
+                    dnt,
+                    language,
+                    ..Default::default()
+                })
+            });
+
+        let page = request
+            .publisher
+            .page_url
+            .as_deref()
+            .and_then(Self::valid_http_url)
+            .unwrap_or_else(|| format!("https://{}", request.publisher.domain));
+        // For the same-origin `/auction` request, the browser Referer is the
+        // current publisher page already carried in sanitized form as
+        // `site.page`; forwarding the raw header as `site.ref` would reintroduce
+        // query-string identifiers and can leak the deployment host.
+        let (site_domain, page) = self.inventory_site_identity(&request.publisher.domain, page);
+
+        OpenRtbRequest {
+            id: Some(request.id.clone()),
+            imp,
+            site: Some(Site {
+                domain: Some(site_domain.clone()),
+                page: Some(page),
+                r#ref: None,
+                publisher: Some(Publisher {
+                    domain: Some(site_domain),
+                    ..Default::default()
+                }),
+                ..Default::default()
+            }),
+            user,
+            device,
+            regs: Self::build_regs(consent),
+            tmax: to_openrtb_i32(context.timeout_ms, "tmax", "APS request"),
+            cur: vec![DEFAULT_CURRENCY.to_string()],
+            ext: ApsRequestExt {
+                account: &self.config.account_id,
+                sdk: ApsSdkExt {
+                    source: APS_SDK_SOURCE,
+                    version: APS_SDK_VERSION,
+                },
+            }
+            .to_ext(),
+            ..Default::default()
         }
     }
 
-    /// Parse size string (e.g., "300x250") into width and height.
-    fn parse_size(size: &str) -> Option<(u32, u32)> {
-        let parts: Vec<&str> = size.split('x').collect();
-        if parts.len() == 2
-            && let (Ok(w), Ok(h)) = (parts[0].parse::<u32>(), parts[1].parse::<u32>())
-        {
-            return Some((w, h));
-        }
-        None
-    }
-
-    /// Parse a single APS slot response into unified Bid format.
-    ///
-    /// Note: Price is NOT decoded here. The encoded price is stored in metadata
-    /// and will be decoded by the mediation layer (mocktioneer). This simulates
-    /// real-world APS where only Amazon/GAM can decode the proprietary price encoding.
-    fn parse_aps_slot(&self, slot: &ApsSlotResponse) -> Result<Bid, ()> {
-        // Only process filled slots (fif == "1")
-        if slot.fif.as_deref() != Some("1") {
-            return Err(());
+    fn serialize_openrtb_request(
+        request: &OpenRtbRequest,
+    ) -> Result<Vec<u8>, Report<TrustedServerError>> {
+        serde_json::to_vec(request).change_context(TrustedServerError::Auction {
+            message: "Failed to serialize APS OpenRTB request".to_string(),
+        })
+    }
+
+    fn debug_headers(headers: &HeaderMap) -> BTreeMap<String, Vec<String>> {
+        let mut values = BTreeMap::<String, Vec<String>>::new();
+        for (name, value) in headers {
+            let Ok(value) = value.to_str() else {
+                continue;
+            };
+            values
+                .entry(name.as_str().to_string())
+                .or_default()
+                .push(value.to_string());
         }
+        values
+    }
+
+    fn debug_request(
+        &self,
+        request: &AuctionRequest,
+        context: &AuctionContext<'_>,
+    ) -> Result<ApsDebugRequest, Report<TrustedServerError>> {
+        let openrtb = self.build_openrtb_request(request, context);
+        let body = Self::serialize_openrtb_request(&openrtb)?;
+        Ok(ApsDebugRequest {
+            body: String::from_utf8_lossy(&body).into_owned(),
+            headers: BTreeMap::from([(
+                header::CONTENT_TYPE.as_str().to_string(),
+                vec!["application/json".to_string()],
+            )]),
+        })
+    }
 
-        // Verify we have an encoded price field
-        let encoded_price = slot.amznbid.as_ref().or(slot.amznp.as_ref());
-        if encoded_price.is_none() {
-            log::debug!(
-                "APS: slot '{}' has no encoded price, skipping",
-                slot.slot_id
+    fn attach_debug_metadata(
+        &self,
+        response: AuctionResponse,
+        request: Option<ApsDebugRequest>,
+        response_body: Option<&[u8]>,
+        response_headers: &BTreeMap<String, Vec<String>>,
+        status: StatusCode,
+    ) -> AuctionResponse {
+        let Some(request) = request else {
+            return response;
+        };
+        let mut http_call = json!({
+            "requestbody": request.body,
+            "requestheaders": request.headers,
+            "responseheaders": response_headers,
+            "status": status.as_u16(),
+            "uri": self.config.endpoint.clone(),
+        });
+        if let (Some(response_body), Some(http_call)) = (response_body, http_call.as_object_mut()) {
+            http_call.insert(
+                "responsebody".to_string(),
+                json!(String::from_utf8_lossy(response_body)),
             );
-            return Err(());
         }
+        response.with_metadata(
+            "debug",
+            json!({
+                "httpcalls": {
+                    (APS_INTEGRATION_ID): [http_call]
+                }
+            }),
+        )
+    }
 
-        // Parse size from "WxH" format
-        let (width, height) = match Self::parse_size(&slot.size) {
-            Some(dims) => dims,
-            None => {
-                log::debug!(
-                    "APS: slot '{}' has malformed size '{}', skipping",
-                    slot.slot_id,
-                    slot.size
-                );
-                return Err(());
-            }
+    fn compatible_dimensions(slot: &AdSlot, width: u32, height: u32) -> bool {
+        width > 0
+            && height > 0
+            && slot.formats.iter().any(|format| {
+                format.media_type == MediaType::Banner
+                    && format.width == width
+                    && format.height == height
+            })
+    }
+
+    fn valid_creative_url(&self, value: &str, publisher_domain: &str) -> bool {
+        if value.len() > MAX_CREATIVE_URL_BYTES {
+            return false;
+        }
+        let Ok(parsed) = Url::parse(value) else {
+            return false;
         };
+        parsed.scheme() == "https"
+            && parsed
+                .host_str()
+                .is_some_and(|host| !host.eq_ignore_ascii_case(publisher_domain))
+            && parsed.username().is_empty()
+            && parsed.password().is_none()
+    }
 
-        // Build metadata from targeting keys - includes encoded price for mediation
-        let mut metadata = HashMap::new();
-        if let Some(ref amzniid) = slot.amzniid {
-            metadata.insert("amzniid".to_string(), json!(amzniid));
+    fn build_renderer(&self, input: ApsRendererInput<'_>) -> Option<BidRenderer> {
+        let tag_type_value = match input.tag_type {
+            ApsTagType::Iframe => "iframe",
+            ApsTagType::Script => "script",
+        };
+        let envelope = json!({
+            "seatbid": [{
+                "bid": [{
+                    "id": input.bid_id,
+                    "price": input.price,
+                    "w": input.width,
+                    "h": input.height,
+                    "ext": {
+                        "creativeurl": input.creative_url,
+                        "tagtype": tag_type_value
+                    }
+                }]
+            }]
+        });
+        let serialized = serde_json::to_vec(&envelope).ok()?;
+        if serialized.len() > MAX_RENDER_ENVELOPE_BYTES {
+            return None;
         }
-        if let Some(ref amznbid) = slot.amznbid {
-            metadata.insert("amznbid".to_string(), json!(amznbid));
+        Some(BidRenderer::Aps(ApsRendererV1 {
+            version: 1,
+            account_id: self.config.account_id.clone(),
+            bid_id: input.bid_id.to_string(),
+            creative_id: input.creative_id,
+            tag_type: input.tag_type,
+            creative_url: input.creative_url.to_string(),
+            aax_response: BASE64_STANDARD.encode(serialized),
+            width: input.width,
+            height: input.height,
+        }))
+    }
+
+    fn increment_reason(reasons: &mut BTreeMap<String, u64>, reason: &'static str) {
+        *reasons.entry(reason.to_string()).or_default() += 1;
+    }
+
+    fn parse_bid(
+        &self,
+        value: &Json,
+        slots: &HashMap<&str, &AdSlot>,
+        publisher_domain: &str,
+    ) -> Result<Bid, &'static str> {
+        let bid_id = value
+            .get("id")
+            .and_then(Json::as_str)
+            .filter(|value| !value.is_empty())
+            .ok_or("missing_render_source")?;
+        let slot_id = value
+            .get("impid")
+            .and_then(Json::as_str)
+            .ok_or("unknown_impid")?;
+        let slot = slots.get(slot_id).ok_or("unknown_impid")?;
+        let price = value
+            .get("price")
+            .and_then(Json::as_f64)
+            .filter(|price| price.is_finite() && *price >= 0.0)
+            .ok_or("invalid_price")?;
+        if value
+            .get("mtype")
+            .is_some_and(|mtype| mtype.as_i64() != Some(1))
+        {
+            return Err("unsupported_media_type");
         }
-        if let Some(ref amznp) = slot.amznp {
-            metadata.insert("amznp".to_string(), json!(amznp));
+        let width = value
+            .get("w")
+            .and_then(Json::as_u64)
+            .and_then(|value| u32::try_from(value).ok())
+            .ok_or("invalid_dimensions")?;
+        let height = value
+            .get("h")
+            .and_then(Json::as_u64)
+            .and_then(|value| u32::try_from(value).ok())
+            .ok_or("invalid_dimensions")?;
+        if !Self::compatible_dimensions(slot, width, height) {
+            return Err("invalid_dimensions");
         }
-        if let Some(ref amznsz) = slot.amznsz {
-            metadata.insert("amznsz".to_string(), json!(amznsz));
+        let ext = value
+            .get("ext")
+            .and_then(Json::as_object)
+            .ok_or("missing_render_source")?;
+        let creative_url = ext
+            .get("creativeurl")
+            .and_then(Json::as_str)
+            .ok_or("missing_render_source")?;
+        if !self.valid_creative_url(creative_url, publisher_domain) {
+            return Err("invalid_creative_url");
         }
-        if let Some(ref amznactt) = slot.amznactt {
-            metadata.insert("amznactt".to_string(), json!(amznactt));
+        let tag_type = match ext.get("tagtype").and_then(Json::as_str) {
+            Some("iframe") => ApsTagType::Iframe,
+            Some("script") if self.config.allow_script_creatives => ApsTagType::Script,
+            Some("script") => return Err("script_rendering_disabled"),
+            _ => return Err("unsupported_tagtype"),
+        };
+        let creative_id = value
+            .get("crid")
+            .and_then(Json::as_str)
+            .filter(|creative_id| !creative_id.is_empty())
+            .map(str::to_string);
+        if creative_id
+            .as_ref()
+            .is_some_and(|creative_id| creative_id.len() > MAX_CREATIVE_ID_BYTES)
+        {
+            return Err("creative_id_too_large");
         }
+        let renderer = self
+            .build_renderer(ApsRendererInput {
+                bid_id,
+                creative_id: creative_id.clone(),
+                tag_type,
+                creative_url,
+                price,
+                width,
+                height,
+            })
+            .ok_or("render_payload_too_large")?;
+        let adomain = value
+            .get("adomain")
+            .and_then(Json::as_array)
+            .map(|domains| {
+                domains
+                    .iter()
+                    .filter_map(Json::as_str)
+                    .map(str::to_string)
+                    .collect()
+            });
 
-        // APS doesn't return creative HTML - only targeting keys
-        // The creative will be generated by the mediation layer
-        // Price is None - will be decoded by mediation layer from amznbid metadata
         Ok(Bid {
-            slot_id: slot.slot_id.clone(),
-            price: None, // Encoded price in metadata, decoded by mediation
-            currency: "USD".to_string(),
+            slot_id: slot_id.to_string(),
+            price: Some(price),
+            currency: DEFAULT_CURRENCY.to_string(),
             creative: None,
-            adomain: None, // APS doesn't provide adomain in response
-            bidder: "amazon-aps".to_string(),
+            adomain,
+            bidder: APS_INTEGRATION_ID.to_string(),
             width,
             height,
-            nurl: None, // Real APS uses client-side event tracking
+            nurl: None,
             burl: None,
-            ad_id: None,
+            bid_id: Some(bid_id.to_string()),
+            ad_id: value.get("adid").and_then(Json::as_str).map(str::to_string),
+            creative_id,
+            renderer: Some(renderer),
             cache_id: None,
             cache_host: None,
             cache_path: None,
-            metadata,
+            metadata: HashMap::new(),
         })
     }
 
-    /// Parse APS TAM response into unified `AuctionResponse`.
-    ///
-    /// `slot_map` is the request-scoped APS slot ID → creative-opportunity
-    /// slot ID mapping built by [`Self::build_slot_id_map`].
     fn parse_aps_response(
         &self,
-        json: &Json,
+        value: &Json,
         response_time_ms: u64,
-        slot_map: &HashMap<String, String>,
+        request: &AuctionRequest,
     ) -> AuctionResponse {
-        let mut bids = Vec::new();
-
-        // Try to parse as ApsBidResponse with contextual wrapper
-        if let Ok(aps_response) = serde_json::from_value::<ApsBidResponse>(json.clone()) {
-            log::debug!(
-                "APS: parsed contextual response with {} slots",
-                aps_response.contextual.slots.len()
-            );
+        if !value.is_object()
+            || value.get("contextual").is_some()
+            || value
+                .get("cur")
+                .is_some_and(|currency| !currency.is_string())
+            || value
+                .get("seatbid")
+                .is_some_and(|seatbids| !seatbids.is_array())
+        {
+            return AuctionResponse::error(APS_INTEGRATION_ID, response_time_ms)
+                .with_metadata("drop_reasons", json!({"unexpected_response_shape": 1}));
+        }
+        if value
+            .get("cur")
+            .and_then(Json::as_str)
+            .is_some_and(|currency| !currency.eq_ignore_ascii_case(DEFAULT_CURRENCY))
+        {
+            return AuctionResponse::no_bid(APS_INTEGRATION_ID, response_time_ms)
+                .with_metadata("drop_reasons", json!({"unsupported_currency": 1}));
+        }
 
-            for slot in aps_response.contextual.slots {
-                match self.parse_aps_slot(&slot) {
-                    Ok(mut bid) => {
-                        // Remap APS slot ID (e.g. "aps-slot-atf-sidebar") back to the
-                        // creative-opportunity slot ID (e.g. "atf_sidebar_ad") so the
-                        // mediator and bid_map can match by creative slot ID.
-                        if let Some(creative_id) = slot_map.get(&bid.slot_id) {
-                            bid.slot_id = creative_id.clone();
+        let slots: HashMap<&str, &AdSlot> = request
+            .slots
+            .iter()
+            .map(|slot| (slot.id.as_str(), slot))
+            .collect();
+        let seatbids = value.get("seatbid").and_then(Json::as_array);
+        let seatbid_count = seatbids.map_or(0, Vec::len);
+        let mut reasons = BTreeMap::new();
+        let mut selected: HashMap<String, Bid> = HashMap::new();
+        let mut dropped = 0_u64;
+
+        for seatbid in seatbids.into_iter().flatten() {
+            let Some(bids) = seatbid.get("bid").and_then(Json::as_array) else {
+                dropped += 1;
+                Self::increment_reason(&mut reasons, "empty_seatbid_bids");
+                continue;
+            };
+            for value in bids {
+                match self.parse_bid(value, &slots, &request.publisher.domain) {
+                    Ok(candidate) => {
+                        let replace = selected.get(&candidate.slot_id).is_none_or(|current| {
+                            let candidate_price = candidate.price.unwrap_or_default();
+                            let current_price = current.price.unwrap_or_default();
+                            candidate_price > current_price
+                                || (candidate_price == current_price
+                                    && candidate.bid_id.as_deref().unwrap_or_default()
+                                        < current.bid_id.as_deref().unwrap_or_default())
+                        });
+                        if replace {
+                            if selected
+                                .insert(candidate.slot_id.clone(), candidate)
+                                .is_some()
+                            {
+                                dropped += 1;
+                                Self::increment_reason(&mut reasons, "lost_to_higher_bid");
+                            }
+                        } else {
+                            dropped += 1;
+                            Self::increment_reason(&mut reasons, "lost_to_higher_bid");
                         }
-                        let encoded_price = bid
-                            .metadata
-                            .get("amznbid")
-                            .and_then(|v| v.as_str())
-                            .unwrap_or("unknown");
-                        log::debug!(
-                            "APS: parsed bid for slot '{}' with encoded price (to be decoded by mediation)",
-                            bid.slot_id,
-                        );
-                        log::trace!(
-                            "APS: slot '{}' encoded price: {}",
-                            bid.slot_id,
-                            encoded_price
-                        );
-                        bids.push(bid);
                     }
-                    Err(_) => {
-                        log::debug!("APS: skipped slot (no fill or invalid)");
+                    Err(reason) => {
+                        dropped += 1;
+                        Self::increment_reason(&mut reasons, reason);
                     }
                 }
             }
-        } else {
-            log::warn!("APS: failed to parse response as contextual format");
         }
 
-        if bids.is_empty() {
-            AuctionResponse::no_bid("aps", response_time_ms)
-        } else {
-            AuctionResponse::success("aps", bids, response_time_ms)
+        if seatbid_count == 0 {
+            Self::increment_reason(&mut reasons, "empty_seatbid");
         }
+        let accepted = selected.len();
+        let metadata = [
+            ("seatbid_count".to_string(), json!(seatbid_count)),
+            ("accepted_bid_count".to_string(), json!(accepted)),
+            ("dropped_bid_count".to_string(), json!(dropped)),
+            ("drop_reasons".to_string(), json!(reasons)),
+        ];
+        let mut response = if selected.is_empty() {
+            AuctionResponse::no_bid(APS_INTEGRATION_ID, response_time_ms)
+        } else {
+            AuctionResponse::success(
+                APS_INTEGRATION_ID,
+                selected.into_values().collect(),
+                response_time_ms,
+            )
+        };
+        response.metadata.extend(metadata);
+        response
     }
 
-    /// Shared parse path for both trait entry points.
-    ///
-    /// # Errors
-    ///
-    /// Returns an error when the response body cannot be read or is not valid JSON.
     async fn parse_response_inner(
         &self,
         response: PlatformResponse,
         response_time_ms: u64,
-        slot_map: &HashMap<String, String>,
+        request: Option<&AuctionRequest>,
+        debug_request: Option<ApsDebugRequest>,
     ) -> Result<AuctionResponse, Report<TrustedServerError>> {
         let response = response.response;
-
-        // Check status code
-        if !response.status().is_success() {
-            log::warn!("APS returned non-success status: {}", response.status());
-            return Ok(AuctionResponse::error("aps", response_time_ms));
+        let status = response.status();
+        let response_headers = debug_request
+            .as_ref()
+            .map_or_else(BTreeMap::new, |_| Self::debug_headers(response.headers()));
+
+        if status == StatusCode::NO_CONTENT {
+            return Ok(self.attach_debug_metadata(
+                AuctionResponse::no_bid(APS_INTEGRATION_ID, response_time_ms),
+                debug_request,
+                Some(&[]),
+                &response_headers,
+                status,
+            ));
         }
-
-        // Parse response body — collect_response_bounded caps memory from misbehaving providers.
-        let body_bytes =
-            collect_response_bounded(response.into_body(), UPSTREAM_RTB_MAX_RESPONSE_BYTES, "aps")
+        if !status.is_success() {
+            log::warn!("APS returns a non-success status");
+            let body = if debug_request.is_some() {
+                match collect_response_bounded(
+                    response.into_body(),
+                    UPSTREAM_RTB_MAX_RESPONSE_BYTES,
+                    APS_INTEGRATION_ID,
+                )
                 .await
-                .change_context(TrustedServerError::Auction {
-                    message: "Failed to read APS response body".to_string(),
-                })?;
-        let response_json: Json =
-            serde_json::from_slice(&body_bytes).change_context(TrustedServerError::Auction {
-                message: "Failed to parse APS response JSON".to_string(),
-            })?;
-
-        log::trace!("APS: received response: {:?}", response_json);
-
-        // Transform to unified format
-        let auction_response = self.parse_aps_response(&response_json, response_time_ms, slot_map);
-
+                {
+                    Ok(body) => Some(body),
+                    Err(error) => {
+                        log::warn!("Failed to read APS debug response body: {error:?}");
+                        None
+                    }
+                }
+            } else {
+                None
+            };
+            return Ok(self.attach_debug_metadata(
+                AuctionResponse::error(APS_INTEGRATION_ID, response_time_ms),
+                debug_request,
+                body.as_deref(),
+                &response_headers,
+                status,
+            ));
+        }
+        let body = collect_response_bounded(
+            response.into_body(),
+            UPSTREAM_RTB_MAX_RESPONSE_BYTES,
+            APS_INTEGRATION_ID,
+        )
+        .await
+        .change_context(TrustedServerError::Auction {
+            message: "Failed to read APS response body".to_string(),
+        })?;
+        log::trace!("APS response body: {}", String::from_utf8_lossy(&body));
+        let value: Json = match serde_json::from_slice(&body) {
+            Ok(value) => value,
+            Err(error) => {
+                log::warn!("Failed to parse APS response JSON: {error}");
+                let parsed = AuctionResponse::error(APS_INTEGRATION_ID, response_time_ms)
+                    .with_metadata("drop_reasons", json!({"unexpected_response_shape": 1}));
+                return Ok(self.attach_debug_metadata(
+                    parsed,
+                    debug_request,
+                    Some(&body),
+                    &response_headers,
+                    status,
+                ));
+            }
+        };
+        let Some(request) = request else {
+            log::error!(
+                "APS cannot parse a successful bid response without the original auction request context"
+            );
+            return Ok(AuctionResponse::error(APS_INTEGRATION_ID, response_time_ms)
+                .with_metadata("drop_reasons", json!({"missing_request_context": 1})));
+        };
+        let parsed = self.parse_aps_response(&value, response_time_ms, request);
         log::info!(
-            "APS returned {} bids in {}ms",
-            auction_response.bids.len(),
+            "APS returns {} accepted bids in {}ms",
+            parsed.bids.len(),
             response_time_ms
         );
-
-        Ok(auction_response)
+        Ok(self.attach_debug_metadata(
+            parsed,
+            debug_request,
+            Some(&body),
+            &response_headers,
+            status,
+        ))
     }
 }
 
 #[async_trait(?Send)]
 impl AuctionProvider for ApsAuctionProvider {
     fn provider_name(&self) -> &'static str {
-        "aps"
+        APS_INTEGRATION_ID
     }
 
     async fn request_bids(
@@ -606,67 +1027,40 @@ impl AuctionProvider for ApsAuctionProvider {
         request: &AuctionRequest,
         context: &AuctionContext<'_>,
     ) -> Result<PlatformPendingRequest, Report<TrustedServerError>> {
-        log::info!(
-            "APS: requesting bids for {} slots (pub_id: {})",
-            request.slots.len(),
-            self.config.pub_id
-        );
-
-        // Transform to APS format. `context.timeout_ms` is the effective budget
-        // the orchestrator granted this provider — the payload must advertise
-        // the same deadline the edge backend enforces below. The APS-slot-ID →
-        // creative-slot-ID remapping is rebuilt from the request in
-        // `parse_response_with_context`, keeping it request-scoped.
-        let aps_request = self.to_aps_request(request, context.timeout_ms);
-
-        // Serialize to JSON
-        let aps_json =
-            serde_json::to_value(&aps_request).change_context(TrustedServerError::Auction {
-                message: "Failed to serialize APS bid request".to_string(),
-            })?;
-
-        log::trace!("APS: sending bid request: {:?}", aps_json);
-
-        // Create HTTP POST request
-        let aps_body =
-            serde_json::to_vec(&aps_json).change_context(TrustedServerError::Auction {
-                message: "Failed to serialize APS request body".to_string(),
-            })?;
-        let aps_req = http::Request::builder()
+        let openrtb = self.build_openrtb_request(request, context);
+        if openrtb.imp.is_empty() {
+            return Err(Report::new(TrustedServerError::Auction {
+                message: "No valid APS impressions after filtering".to_string(),
+            }));
+        }
+        log::info!("APS requests bids for {} impressions", openrtb.imp.len());
+        log::trace!("APS request body: {openrtb:?}");
+        let body = Self::serialize_openrtb_request(&openrtb)?;
+        let request = http::Request::builder()
             .method(Method::POST)
             .uri(&self.config.endpoint)
             .header(header::CONTENT_TYPE, "application/json")
-            .body(EdgeBody::from(aps_body))
+            .body(EdgeBody::from(body))
             .change_context(TrustedServerError::Auction {
                 message: "Failed to build APS request".to_string(),
             })?;
-
-        // Uses context.timeout_ms (auction-scoped) rather than the 15 s fixed
-        // timeout in ensure_integration_backend, which is for proxy endpoints.
-        // Send request asynchronously with auction-scoped timeout
-        let backend_name = ensure_integration_backend_with_timeout(
+        let backend = ensure_integration_backend_with_timeout(
             context.services,
             &self.config.endpoint,
-            "aps",
+            APS_INTEGRATION_ID,
             Duration::from_millis(u64::from(context.timeout_ms)),
         )
         .change_context(TrustedServerError::Auction {
-            message: format!(
-                "Failed to resolve backend for APS endpoint: {}",
-                self.config.endpoint
-            ),
+            message: "Failed to resolve APS backend".to_string(),
         })?;
-
-        let pending = context
+        context
             .services
             .http_client()
-            .send_async(PlatformHttpRequest::new(aps_req, backend_name))
+            .send_async(PlatformHttpRequest::new(request, backend))
             .await
             .change_context(TrustedServerError::Auction {
-                message: "Failed to send async request to APS".to_string(),
-            })?;
-
-        Ok(pending)
+                message: "Failed to send APS request".to_string(),
+            })
     }
 
     async fn parse_response(
@@ -674,11 +1068,7 @@ impl AuctionProvider for ApsAuctionProvider {
         response: PlatformResponse,
         response_time_ms: u64,
     ) -> Result<AuctionResponse, Report<TrustedServerError>> {
-        // No auction request available — bids keep their raw APS slot IDs. The
-        // orchestrator always calls [`Self::parse_response_with_context`], so
-        // this path only serves callers outside the orchestration flow.
-        log::debug!("APS: parsing without request context — slot ID remapping unavailable");
-        self.parse_response_inner(response, response_time_ms, &HashMap::new())
+        self.parse_response_inner(response, response_time_ms, None, None)
             .await
     }
 
@@ -687,19 +1077,25 @@ impl AuctionProvider for ApsAuctionProvider {
         response: PlatformResponse,
         response_time_ms: u64,
         request: &AuctionRequest,
-        _context: &AuctionContext<'_>,
+        context: &AuctionContext<'_>,
     ) -> Result<AuctionResponse, Report<TrustedServerError>> {
-        // Rebuild the APS-slot-ID → creative-slot-ID map from the auction
-        // request so overlapping auctions on shared provider instances cannot
-        // overwrite or consume each other's mappings.
-        let slot_map = Self::build_slot_id_map(request);
-        self.parse_response_inner(response, response_time_ms, &slot_map)
+        let debug_request = if self.config.debug {
+            match self.debug_request(request, context) {
+                Ok(debug_request) => Some(debug_request),
+                Err(error) => {
+                    log::warn!("Failed to build APS debug request metadata: {error:?}");
+                    None
+                }
+            }
+        } else {
+            None
+        };
+        self.parse_response_inner(response, response_time_ms, Some(request), debug_request)
             .await
     }
 
     fn supports_media_type(&self, media_type: &MediaType) -> bool {
-        // APS supports banner and video formats
-        matches!(media_type, MediaType::Banner | MediaType::Video)
+        matches!(media_type, MediaType::Banner)
     }
 
     fn timeout_ms(&self) -> u32 {
@@ -714,717 +1110,1131 @@ impl AuctionProvider for ApsAuctionProvider {
         predict_integration_backend_name(
             services,
             &self.config.endpoint,
-            "aps",
+            APS_INTEGRATION_ID,
             Duration::from_millis(u64::from(timeout_ms)),
         )
-        .inspect_err(|e| {
-            log::error!(
-                "Failed to predict backend name for APS endpoint '{}': {e:?}",
-                self.config.endpoint
-            );
-        })
+        .inspect_err(|error| log::error!("Failed to predict APS backend name: {error:?}"))
         .ok()
     }
 }
 
-// ============================================================================
-// Provider Auto-Registration
-// ============================================================================
+#[derive(Debug)]
+struct ApsRendererIntegration;
 
-use crate::settings::Settings;
-use std::sync::Arc;
+#[async_trait(?Send)]
+impl IntegrationProxy for ApsRendererIntegration {
+    fn integration_name(&self) -> &'static str {
+        APS_INTEGRATION_ID
+    }
+
+    fn routes(&self) -> Vec<IntegrationEndpoint> {
+        vec![IntegrationEndpoint::get(APS_RENDERER_ROUTE)]
+    }
+
+    async fn handle(
+        &self,
+        _settings: &Settings,
+        _services: &RuntimeServices,
+        request: http::Request<EdgeBody>,
+    ) -> Result<http::Response<EdgeBody>, Report<TrustedServerError>> {
+        if request.method() != Method::GET || request.uri().path() != APS_RENDERER_ROUTE {
+            return http::Response::builder()
+                .status(StatusCode::NOT_FOUND)
+                .body(EdgeBody::from("Not Found"))
+                .change_context(TrustedServerError::Integration {
+                    integration: APS_INTEGRATION_ID.to_string(),
+                    message: "Failed to build APS not-found response".to_string(),
+                });
+        }
+        http::Response::builder()
+            .status(StatusCode::OK)
+            .header(header::CONTENT_TYPE, "text/html; charset=utf-8")
+            .header("x-content-type-options", "nosniff")
+            .header("referrer-policy", "no-referrer")
+            .header(header::CONTENT_SECURITY_POLICY, APS_RENDERER_CSP)
+            .body(EdgeBody::from(APS_RENDERER_DOCUMENT))
+            .change_context(TrustedServerError::Integration {
+                integration: APS_INTEGRATION_ID.to_string(),
+                message: "Failed to build APS renderer response".to_string(),
+            })
+    }
+}
 
-/// Auto-register APS provider based on settings configuration.
+/// Register the APS static renderer endpoint when APS is enabled.
+///
+/// # Errors
 ///
-/// Returns the APS provider if enabled in settings.
+/// Returns an error when enabled APS configuration is invalid.
+pub fn register(
+    settings: &Settings,
+) -> Result<Option<IntegrationRegistration>, Report<TrustedServerError>> {
+    let Some(_config) = settings.integration_config::<ApsConfig>(APS_INTEGRATION_ID)? else {
+        return Ok(None);
+    };
+    let integration = Arc::new(ApsRendererIntegration);
+    Ok(Some(
+        IntegrationRegistration::builder(APS_INTEGRATION_ID)
+            .with_proxy(integration)
+            .without_js()
+            .build(),
+    ))
+}
+
+/// Register the APS auction provider when enabled.
 ///
 /// # Errors
 ///
-/// Returns an error when the APS provider is enabled with invalid
-/// configuration.
+/// Returns an error when enabled APS configuration is invalid.
 pub fn register_providers(
     settings: &Settings,
 ) -> Result<Vec<Arc<dyn AuctionProvider>>, Report<TrustedServerError>> {
-    let mut providers: Vec<Arc<dyn AuctionProvider>> = Vec::new();
-
-    // Check for real APS provider configuration
-    match settings.integration_config::<ApsConfig>("aps") {
-        Ok(Some(config)) => {
-            log::info!(
-                "Registering real APS provider (pub_id: {}, endpoint: {})",
-                config.pub_id,
-                config.endpoint
-            );
-            providers.push(Arc::new(ApsAuctionProvider::new(config)));
-        }
-        Ok(None) => {
-            log::debug!("APS integration config found but is disabled");
-        }
-        Err(e) => {
-            return Err(e);
-        }
+    let Some(config) = settings.integration_config::<ApsConfig>(APS_INTEGRATION_ID)? else {
+        return Ok(Vec::new());
+    };
+    log::info!("Registering APS OpenRTB provider");
+    if config.debug {
+        log::warn!(
+            "APS debug mode is ON — raw request and response data, including creative markup, will be included in client-visible /auction responses"
+        );
     }
-
-    Ok(providers)
+    Ok(vec![Arc::new(ApsAuctionProvider::new(config))])
 }
 
-// ============================================================================
-// Tests
-// ============================================================================
-
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::auction::types::*;
+    use crate::auction::types::{
+        AdFormat, AdSlot, AuctionContext, AuctionRequest, BidStatus, DeviceInfo, PublisherInfo,
+        UserInfo,
+    };
+    use crate::consent::ConsentContext;
+    use crate::openrtb::{Eid, Uid};
+    use crate::platform::GeoInfo;
+    use crate::platform::test_support::noop_services;
+    use crate::test_support::tests::create_test_settings;
+    use serde_json::json;
+
+    fn config() -> ApsConfig {
+        ApsConfig {
+            enabled: true,
+            account_id: "example-account-id".to_string(),
+            endpoint: default_endpoint(),
+            timeout_ms: 800,
+            debug: false,
+            allow_script_creatives: false,
+            inventory_domain: None,
+            inventory_page_origin: None,
+        }
+    }
 
-    fn create_test_auction_request() -> AuctionRequest {
+    fn request() -> AuctionRequest {
         AuctionRequest {
-            id: "test-auction-123".to_string(),
-            slots: vec![
-                AdSlot {
-                    id: "header-banner".to_string(),
-                    formats: vec![
-                        AdFormat {
-                            media_type: MediaType::Banner,
-                            width: 728,
-                            height: 90,
-                        },
-                        AdFormat {
-                            media_type: MediaType::Banner,
-                            width: 970,
-                            height: 250,
-                        },
-                    ],
-                    floor_price: Some(1.50),
-                    targeting: HashMap::new(),
-                    bidders: HashMap::new(),
-                },
-                AdSlot {
-                    id: "sidebar".to_string(),
-                    formats: vec![AdFormat {
-                        media_type: MediaType::Banner,
-                        width: 300,
-                        height: 250,
-                    }],
-                    floor_price: Some(1.00),
-                    targeting: HashMap::new(),
-                    bidders: HashMap::new(),
-                },
-            ],
+            id: "fictional-auction".to_string(),
+            slots: vec![AdSlot {
+                id: "fictional-slot".to_string(),
+                formats: vec![AdFormat {
+                    media_type: MediaType::Banner,
+                    width: 300,
+                    height: 250,
+                }],
+                floor_price: Some(1.0),
+                targeting: HashMap::new(),
+                bidders: HashMap::new(),
+            }],
             publisher: PublisherInfo {
-                domain: "test.com".to_string(),
-                page_url: Some("https://test.com/article".to_string()),
+                domain: "publisher.example".to_string(),
+                page_url: Some("https://publisher.example/article".to_string()),
             },
             user: UserInfo {
-                id: Some("user-123".to_string()),
+                id: Some("fictional-user".to_string()),
                 consent: None,
                 eids: None,
             },
-            device: Some(DeviceInfo {
-                user_agent: Some("Mozilla/5.0".to_string()),
-                ip: Some("192.168.1.1".to_string()),
-                geo: None,
-            }),
+            device: None,
             site: None,
             context: HashMap::new(),
         }
     }
 
-    #[test]
-    fn test_aps_request_transformation() {
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
-            timeout_ms: 800,
-        };
-
-        let provider = ApsAuctionProvider::new(config);
-        let auction_request = create_test_auction_request();
-        let aps_request = provider.to_aps_request(&auction_request, 800);
+    fn bid(id: &str, price: f64, tagtype: &str) -> Json {
+        json!({
+            "id": id,
+            "impid": "fictional-slot",
+            "price": price,
+            "w": 300,
+            "h": 250,
+            "crid": "fictional-creative",
+            "adomain": ["advertiser.example"],
+            "ext": {
+                "creativeurl": "https://creative.example/render",
+                "tagtype": tagtype,
+                "unknown": "discarded"
+            },
+            "adm": "<script>discarded</script>",
+            "nurl": "https://notice.example/win"
+        })
+    }
 
-        // Verify basic fields
-        assert_eq!(aps_request.pub_id, "5128");
-        assert_eq!(aps_request.slots.len(), 2);
-        assert_eq!(
-            aps_request.page_url,
-            Some("https://test.com/article".to_string())
-        );
-        assert_eq!(aps_request.user_agent, Some("Mozilla/5.0".to_string()));
-        assert_eq!(aps_request.timeout, Some(800));
+    fn parse_with_context(
+        provider: &ApsAuctionProvider,
+        response: PlatformResponse,
+    ) -> AuctionResponse {
+        let settings = create_test_settings();
+        let services = noop_services();
+        let downstream = http::Request::builder()
+            .uri("https://publisher.example/auction")
+            .body(EdgeBody::empty())
+            .expect("should build downstream request");
+        let context = AuctionContext {
+            settings: &settings,
+            request: &downstream,
+            timeout_ms: 321,
+            provider_responses: None,
+            services: &services,
+        };
+        futures::executor::block_on(provider.parse_response_with_context(
+            response,
+            12,
+            &request(),
+            &context,
+        ))
+        .expect("should parse APS response with context")
+    }
 
-        // Verify first slot
-        let slot1 = &aps_request.slots[0];
-        assert_eq!(slot1.slot_id, "header-banner");
-        assert_eq!(slot1.sizes.len(), 2);
-        assert_eq!(slot1.sizes[0], [728, 90]);
-        assert_eq!(slot1.sizes[1], [970, 250]);
+    #[test]
+    fn config_accepts_canonical_alias_and_integer_ids() {
+        let canonical: ApsConfig = serde_json::from_value(json!({
+            "account_id": "  example-account  "
+        }))
+        .expect("should parse canonical account ID");
+        let alias: ApsConfig =
+            serde_json::from_value(json!({"pub_id": 1234})).expect("should parse legacy alias");
+        let debug: ApsConfig = serde_json::from_value(json!({
+            "account_id": "example-account",
+            "debug": true
+        }))
+        .expect("should parse debug flag");
+        assert_eq!(canonical.account_id, "example-account");
+        assert_eq!(alias.account_id, "1234");
+        assert!(!canonical.enabled);
+        assert!(!canonical.debug);
+        assert!(debug.debug);
+        assert!(!canonical.allow_script_creatives);
+        assert!(canonical.endpoint.ends_with("/e/pb/bid"));
+    }
 
-        // Verify second slot
-        let slot2 = &aps_request.slots[1];
-        assert_eq!(slot2.slot_id, "sidebar");
-        assert_eq!(slot2.sizes.len(), 1);
-        assert_eq!(slot2.sizes[0], [300, 250]);
+    #[test]
+    fn config_accepts_default_and_custom_openrtb_endpoints() {
+        let default = ApsConfig {
+            account_id: "example-account".to_string(),
+            ..Default::default()
+        };
+        let custom: ApsConfig = serde_json::from_value(json!({
+            "account_id": "example-account",
+            "endpoint": "https://aps.example.com/custom/openrtb"
+        }))
+        .expect("should deserialize custom endpoint");
+
+        default
+            .validate()
+            .expect("should accept production default endpoint");
+        custom
+            .validate()
+            .expect("should accept fictional custom HTTPS endpoint");
     }
 
     #[test]
-    fn aps_slot_id_from_bidders_map_used_in_request_and_remapped_in_response() {
-        use serde_json::json;
+    fn config_rejects_legacy_aps_endpoint_with_migration_error() {
+        for endpoint in [
+            "https://aps.example.com/e/dtb/bid",
+            "https://aps.example.com/e/dtb/bid/",
+            "https://aps.example.com/custom/e/dtb/bid",
+        ] {
+            let parsed: ApsConfig = serde_json::from_value(json!({
+                "account_id": "example-account",
+                "endpoint": endpoint
+            }))
+            .expect("should deserialize legacy endpoint before validation");
+            let error = parsed
+                .validate()
+                .expect_err("should reject legacy endpoint");
+            assert!(
+                error.to_string().contains("migrate to /e/pb/bid"),
+                "should provide endpoint migration guidance: {error}"
+            );
+        }
+    }
 
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: default_endpoint(),
-            timeout_ms: 800,
-        };
+    #[test]
+    fn config_rejects_blank_duplicate_and_unsafe_endpoint() {
+        assert!(serde_json::from_value::<ApsConfig>(json!({"account_id": "   "})).is_err());
+        assert!(
+            serde_json::from_value::<ApsConfig>(
+                json!({"account_id": "x".repeat(MAX_ACCOUNT_ID_BYTES + 1)})
+            )
+            .is_err()
+        );
+        assert!(
+            serde_json::from_value::<ApsConfig>(json!({
+                "account_id": "one",
+                "pub_id": "two"
+            }))
+            .is_err()
+        );
+        for endpoint in [
+            "http://aps.example/e/pb/bid",
+            "https://",
+            "https://user:password@aps.example/e/pb/bid",
+        ] {
+            let parsed: ApsConfig = serde_json::from_value(json!({
+                "account_id": "example-account",
+                "endpoint": endpoint
+            }))
+            .expect("should deserialize before validation");
+            assert!(parsed.validate().is_err(), "should reject {endpoint}");
+        }
+    }
+
+    #[test]
+    fn config_requires_safe_inventory_identity_override_pair() {
+        for value in [
+            json!({
+                "account_id": "example-account",
+                "inventory_domain": "publisher.example"
+            }),
+            json!({
+                "account_id": "example-account",
+                "inventory_page_origin": "https://www.publisher.example"
+            }),
+            json!({
+                "account_id": "example-account",
+                "inventory_domain": "publisher.example",
+                "inventory_page_origin": "http://www.publisher.example"
+            }),
+            json!({
+                "account_id": "example-account",
+                "inventory_domain": "publisher.example",
+                "inventory_page_origin": "https://www.publisher.example/path"
+            }),
+            json!({
+                "account_id": "example-account",
+                "inventory_domain": "publisher.example/path",
+                "inventory_page_origin": "https://www.publisher.example"
+            }),
+            json!({
+                "account_id": "example-account",
+                "inventory_domain": "publisher.example",
+                "inventory_page_origin": "https://unrelated.example"
+            }),
+        ] {
+            let parsed: ApsConfig =
+                serde_json::from_value(value).expect("should deserialize before validation");
+            assert!(
+                parsed.validate().is_err(),
+                "should reject unsafe or incomplete inventory identity override"
+            );
+        }
+    }
+
+    #[test]
+    fn inventory_identity_override_rewrites_site_and_preserves_page_path() {
+        let config: ApsConfig = serde_json::from_value(json!({
+            "enabled": true,
+            "account_id": "example-account",
+            "inventory_domain": "publisher.example",
+            "inventory_page_origin": "https://www.publisher.example"
+        }))
+        .expect("should deserialize APS inventory identity override");
+        config
+            .validate()
+            .expect("should validate APS inventory identity override");
         let provider = ApsAuctionProvider::new(config);
+        let mut auction_request = request();
+        auction_request.publisher.domain = "deployment.example".to_string();
+        auction_request.publisher.page_url =
+            Some("https://deployment.example/news/story?edition=fictional#section".to_string());
+        let settings = create_test_settings();
+        let services = noop_services();
+        let downstream = http::Request::builder()
+            .uri("https://deployment.example/auction")
+            .header(
+                header::REFERER,
+                "https://deployment.example/private?token=fictional#section",
+            )
+            .body(EdgeBody::empty())
+            .expect("should build downstream request");
+        let context = AuctionContext {
+            settings: &settings,
+            request: &downstream,
+            timeout_ms: 321,
+            provider_responses: None,
+            services: &services,
+        };
 
-        let mut bidders = HashMap::new();
-        bidders.insert(
-            "aps".to_string(),
-            json!({ "slotID": "aps-slot-atf-sidebar" }),
+        let serialized =
+            serde_json::to_value(provider.build_openrtb_request(&auction_request, &context))
+                .expect("should serialize APS request");
+
+        assert_eq!(serialized["site"]["domain"], "publisher.example");
+        assert_eq!(
+            serialized["site"]["page"],
+            "https://www.publisher.example/news/story?edition=fictional"
         );
-        let request = AuctionRequest {
-            id: "test".to_string(),
-            slots: vec![AdSlot {
-                id: "atf_sidebar_ad".to_string(),
-                formats: vec![AdFormat {
-                    media_type: MediaType::Banner,
-                    width: 300,
-                    height: 250,
-                }],
-                floor_price: None,
-                targeting: HashMap::new(),
-                bidders,
+        assert_eq!(
+            serialized["site"]["publisher"]["domain"],
+            "publisher.example"
+        );
+        assert!(serialized["site"].get("ref").is_none());
+        assert!(
+            !serialized["site"]
+                .to_string()
+                .contains("deployment.example"),
+            "should not leak the deployment host in any Site field"
+        );
+    }
+
+    #[test]
+    fn builds_aps_openrtb_request_with_explicit_privacy_policy() {
+        let provider = ApsAuctionProvider::new(config());
+        let mut auction_request = request();
+        auction_request.user.consent = Some(ConsentContext {
+            gdpr_applies: true,
+            raw_tc_string: Some("fictional-tcf".to_string()),
+            raw_us_privacy: Some("1YNN".to_string()),
+            raw_gpp_string: Some("fictional-gpp".to_string()),
+            gpp_section_ids: Some(vec![2, 6]),
+            ..Default::default()
+        });
+        auction_request.user.eids = Some(vec![Eid {
+            source: "identity.example".to_string(),
+            uids: vec![Uid {
+                id: "fictional-uid".to_string(),
+                atype: Some(1),
+                ext: None,
             }],
-            publisher: PublisherInfo {
-                domain: "example.com".to_string(),
-                page_url: None,
+        }]);
+        auction_request.slots[0].formats.extend([
+            AdFormat {
+                media_type: MediaType::Video,
+                width: 640,
+                height: 480,
             },
-            user: UserInfo {
-                id: Some("user-1".to_string()),
-                consent: None,
-                eids: None,
+            AdFormat {
+                media_type: MediaType::Banner,
+                width: u32::MAX,
+                height: 90,
             },
-            device: None,
-            site: None,
-            context: HashMap::new(),
+            AdFormat {
+                media_type: MediaType::Banner,
+                width: 728,
+                height: 90,
+            },
+        ]);
+        auction_request.device = Some(DeviceInfo {
+            user_agent: Some("Fictional Browser".to_string()),
+            ip: Some("192.0.2.10".to_string()),
+            geo: Some(GeoInfo {
+                city: "Example City".to_string(),
+                country: "US".to_string(),
+                continent: "NA".to_string(),
+                latitude: 12.34,
+                longitude: 56.78,
+                metro_code: 501,
+                region: Some("CA".to_string()),
+                asn: None,
+            }),
+        });
+        let settings = create_test_settings();
+        let services = noop_services();
+        let downstream = http::Request::builder()
+            .uri("https://publisher.example/auction")
+            .header("DNT", "1")
+            .header(header::ACCEPT_LANGUAGE, "en-US,en;q=0.9")
+            .header(header::REFERER, "https://referrer.example/article")
+            .body(EdgeBody::empty())
+            .expect("should build downstream request");
+        let context = AuctionContext {
+            settings: &settings,
+            request: &downstream,
+            timeout_ms: 321,
+            provider_responses: None,
+            services: &services,
         };
 
-        let aps_request = provider.to_aps_request(&request, 800);
+        let openrtb = provider.build_openrtb_request(&auction_request, &context);
+        let serialized = serde_json::to_value(openrtb).expect("should serialize request");
+
+        assert_eq!(serialized["id"], "fictional-auction");
+        assert_eq!(serialized["tmax"], 321);
+        assert_eq!(serialized["cur"], json!(["USD"]));
+        assert_eq!(serialized["ext"]["account"], "example-account-id");
         assert_eq!(
-            aps_request.slots[0].slot_id, "aps-slot-atf-sidebar",
-            "should send configured APS slot ID to APS"
+            serialized["ext"]["sdk"],
+            json!({"source": "prebid", "version": "2.2.0"})
         );
-        let slot_id_map = ApsAuctionProvider::build_slot_id_map(&request);
+        assert_eq!(serialized["imp"][0]["id"], "fictional-slot");
+        assert_eq!(serialized["imp"][0]["banner"]["w"], 300);
+        assert_eq!(serialized["imp"][0]["banner"]["h"], 250);
+        assert_eq!(serialized["imp"][0]["banner"]["topframe"], 0);
         assert_eq!(
-            slot_id_map.get("aps-slot-atf-sidebar").map(String::as_str),
-            Some("atf_sidebar_ad"),
-            "should build reverse map from APS slot ID to creative slot ID"
+            serialized["imp"][0]["banner"]["format"]
+                .as_array()
+                .map(Vec::len),
+            Some(2)
         );
-
-        let aps_response = json!({
-            "contextual": {
-                "slots": [{
-                    "slotID": "aps-slot-atf-sidebar",
-                    "size": "300x250",
-                    "fif": "1",
-                    "amznbid": "1gtm3q",
-                    "meta": ["slotID"]
-                }]
-            }
-        });
-
-        let response = provider.parse_aps_response(&aps_response, 100, &slot_id_map);
-        assert_eq!(response.bids.len(), 1, "should parse one bid");
+        assert_eq!(serialized["imp"][0]["banner"]["format"][1]["w"], 728);
+        assert_eq!(serialized["imp"][0]["bidfloor"], 1.0);
+        assert_eq!(serialized["imp"][0]["bidfloorcur"], "USD");
+        assert_eq!(serialized["imp"][0]["secure"], 1);
+        assert_eq!(serialized["site"]["domain"], "publisher.example");
         assert_eq!(
-            response.bids[0].slot_id, "atf_sidebar_ad",
-            "bid slot_id should be remapped to creative slot ID"
+            serialized["site"]["page"],
+            "https://publisher.example/article"
         );
+        assert!(
+            serialized["site"].get("ref").is_none(),
+            "should not forward the raw browser Referer"
+        );
+        assert_eq!(
+            serialized["site"]["publisher"]["domain"],
+            "publisher.example"
+        );
+        assert_eq!(serialized["device"]["ua"], "Fictional Browser");
+        assert_eq!(serialized["device"]["ip"], "192.0.2.10");
+        assert_eq!(serialized["device"]["dnt"], 1);
+        assert_eq!(serialized["device"]["language"], "en");
+        assert_eq!(serialized["device"]["geo"]["country"], "US");
+        assert!(serialized["device"]["geo"].get("lat").is_none());
+        assert!(serialized["device"]["geo"].get("lon").is_none());
+        assert_eq!(serialized["user"]["id"], "fictional-user");
+        assert_eq!(serialized["user"]["consent"], "fictional-tcf");
+        assert_eq!(serialized["user"]["ext"]["consent"], "fictional-tcf");
+        assert_eq!(
+            serialized["user"]["ext"]["eids"][0]["source"],
+            "identity.example"
+        );
+        assert_eq!(serialized["regs"]["gdpr"], 1);
+        assert_eq!(serialized["regs"]["us_privacy"], "1YNN");
+        assert_eq!(serialized["regs"]["gpp"], "fictional-gpp");
+        assert_eq!(serialized["regs"]["gpp_sid"], json!([2, 6]));
+        assert!(serialized["regs"].get("coppa").is_none());
+        assert!(serialized["ext"].get("prebid").is_none());
+        assert!(serialized["ext"].get("trusted_server").is_none());
+        assert!(serialized["imp"][0].get("ext").is_none());
     }
 
     #[test]
-    fn test_aps_response_parsing_success() {
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
-            timeout_ms: 800,
-        };
+    fn request_language_enforces_byte_limit() {
+        let settings = create_test_settings();
+        let services = noop_services();
+
+        for (header_value, expected) in [
+            ("abcdefgh-US,xy;q=0.9", Some("abcdefgh")),
+            ("abcdefghi", None),
+        ] {
+            let downstream = http::Request::builder()
+                .uri("https://publisher.example/auction")
+                .header(header::ACCEPT_LANGUAGE, header_value)
+                .body(EdgeBody::empty())
+                .expect("should build downstream request");
+            let context = AuctionContext {
+                settings: &settings,
+                request: &downstream,
+                timeout_ms: 321,
+                provider_responses: None,
+                services: &services,
+            };
 
-        let provider = ApsAuctionProvider::new(config);
-
-        // Test APS response in real contextual format
-        let aps_response = json!({
-            "contextual": {
-                "slots": [
-                    {
-                        "slotID": "header-banner",
-                        "size": "728x90",
-                        "crid": "test-crid-123",
-                        "mediaType": "d",
-                        "fif": "1",
-                        "targeting": ["amzniid", "amznbid", "amznp", "amznsz", "amznactt"],
-                        "meta": ["slotID", "mediaType", "size"],
-                        "amzniid": "test-impression-id",
-                        "amznbid": "1kt0jk0",  // Proprietary Amazon encoding (not decodable)
-                        "amznp": "1kt0jk0",
-                        "amznsz": "728x90",
-                        "amznactt": "OPEN"
-                    },
-                    {
-                        "slotID": "sidebar",
-                        "size": "300x250",
-                        "crid": "test-crid-456",
-                        "mediaType": "d",
-                        "fif": "1",
-                        "targeting": ["amzniid", "amznbid", "amznp", "amznsz", "amznactt"],
-                        "meta": ["slotID", "mediaType", "size"],
-                        "amzniid": "test-impression-id-2",
-                        "amznbid": "ewpurk",  // Proprietary Amazon encoding (not decodable)
-                        "amznp": "ewpurk",
-                        "amznsz": "300x250",
-                        "amznactt": "OPEN"
-                    }
-                ],
-                "host": "https://aax-events.amazon-adsystem.com",
-                "status": "ok",
-                "cfe": true,
-                "ev": true,
-                "cb": "6"
-            }
-        });
-
-        let auction_response = provider.parse_aps_response(&aps_response, 150, &HashMap::new());
-
-        // Verify response
-        assert_eq!(auction_response.provider, "aps");
-        assert_eq!(auction_response.status, BidStatus::Success);
-        assert_eq!(auction_response.bids.len(), 2);
-        assert_eq!(auction_response.response_time_ms, 150);
-
-        // Verify first bid - price is None (encoded, to be decoded by mediation)
-        let bid1 = &auction_response.bids[0];
-        assert_eq!(bid1.slot_id, "header-banner");
-        assert_eq!(bid1.price, None); // Price is NOT decoded - it's in metadata for mediation
-        assert_eq!(bid1.width, 728);
-        assert_eq!(bid1.height, 90);
-        assert_eq!(bid1.currency, "USD");
-        assert_eq!(bid1.bidder, "amazon-aps");
-        assert_eq!(bid1.adomain, None);
-        assert!(bid1.metadata.contains_key("amzniid"));
-        assert!(bid1.metadata.contains_key("amznbid")); // Encoded price stored here
-
-        // Verify second bid
-        let bid2 = &auction_response.bids[1];
-        assert_eq!(bid2.slot_id, "sidebar");
-        assert_eq!(bid2.price, None); // Price is NOT decoded
-        assert_eq!(bid2.width, 300);
-        assert_eq!(bid2.height, 250);
-        assert!(bid2.metadata.contains_key("amznbid")); // Encoded price in metadata
+            assert_eq!(
+                ApsAuctionProvider::request_language(&context).as_deref(),
+                expected,
+                "should enforce primary language byte limit for {header_value}"
+            );
+        }
     }
 
     #[test]
-    fn test_aps_response_parsing_no_bid() {
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
-            timeout_ms: 800,
-        };
-
-        let provider = ApsAuctionProvider::new(config);
-
-        // Empty contextual response
-        let aps_response = json!({
-            "contextual": {
-                "slots": [],
-                "status": "ok"
-            }
-        });
-
-        let auction_response = provider.parse_aps_response(&aps_response, 100, &HashMap::new());
-
-        assert_eq!(auction_response.provider, "aps");
-        assert_eq!(auction_response.status, BidStatus::NoBid);
-        assert_eq!(auction_response.bids.len(), 0);
+    fn parses_bid_and_builds_exact_minimized_envelope() {
+        let provider = ApsAuctionProvider::new(config());
+        let response = provider.parse_aps_response(
+            &json!({"cur": "USD", "seatbid": [{"seat": 42, "bid": [bid("fictional-selected-bid-id", 1.23, "iframe")]}], "ext": {"userSyncs": []}}),
+            12,
+            &request(),
+        );
+        assert_eq!(response.bids.len(), 1);
+        let parsed = &response.bids[0];
+        assert_eq!(parsed.bidder, "aps");
+        assert_eq!(parsed.price, Some(1.23));
+        assert!(parsed.creative.is_none());
+        assert!(parsed.nurl.is_none());
+        let renderer = parsed
+            .renderer
+            .as_ref()
+            .expect("should include renderer")
+            .as_aps()
+            .expect("should be APS renderer");
+        let decoded = BASE64_STANDARD
+            .decode(&renderer.aax_response)
+            .expect("should decode renderer response");
+        let decoded: Json =
+            serde_json::from_slice(&decoded).expect("should parse renderer response");
+        let fixture: Json = serde_json::from_str(include_str!(
+            "../../../trusted-server-js/lib/test/fixtures/aps-renderer-v1.json"
+        ))
+        .expect("should parse shared APS renderer fixture");
+        assert_eq!(decoded, fixture);
     }
 
     #[test]
-    fn test_aps_response_parsing_invalid_bids() {
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
-            timeout_ms: 800,
-        };
-
-        let provider = ApsAuctionProvider::new(config);
-
-        // Response with invalid slots (not filled, zero price)
-        let aps_response = json!({
-            "contextual": {
-                "slots": [
-                    {
-                        "slotID": "header-banner",
-                        "size": "728x90",
-                        "fif": "0",  // Not filled
-                        "targeting": [],
-                        "meta": []
-                    },
-                    {
-                        "slotID": "sidebar",
-                        "size": "300x250",
-                        "fif": "1",
-                        "targeting": [],
-                        "meta": []
-                        // Missing price encoding - will decode to 0.0
-                    }
-                ],
-                "status": "ok"
-            }
-        });
-
-        let auction_response = provider.parse_aps_response(&aps_response, 100, &HashMap::new());
+    fn creative_id_enforces_utf8_byte_boundary() {
+        let provider = ApsAuctionProvider::new(config());
+        let mut at_limit = bid("creative-id-limit", 1.23, "iframe");
+        at_limit["crid"] = json!("é".repeat(MAX_CREATIVE_ID_BYTES / 2));
+        let accepted =
+            provider.parse_aps_response(&json!({"seatbid": [{"bid": [at_limit]}]}), 12, &request());
+        assert_eq!(
+            accepted.bids.len(),
+            1,
+            "should accept creative ID at byte limit"
+        );
 
-        // Should return no-bid since all slots are invalid
-        assert_eq!(auction_response.status, BidStatus::NoBid);
-        assert_eq!(auction_response.bids.len(), 0);
+        let mut over_limit = bid("creative-id-over-limit", 1.23, "iframe");
+        over_limit["crid"] = json!(format!("{}x", "é".repeat(MAX_CREATIVE_ID_BYTES / 2)));
+        let rejected = provider.parse_aps_response(
+            &json!({"seatbid": [{"bid": [over_limit]}]}),
+            12,
+            &request(),
+        );
+        assert!(rejected.bids.is_empty());
+        assert_eq!(
+            rejected.metadata["drop_reasons"]["creative_id_too_large"],
+            1
+        );
     }
 
     #[test]
-    fn test_aps_slot_parsing() {
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
-            timeout_ms: 800,
-        };
+    fn empty_creative_id_is_omitted_from_renderer() {
+        let provider = ApsAuctionProvider::new(config());
+        let mut input = bid("bid-with-empty-crid", 1.23, "iframe");
+        input["crid"] = json!("");
+        let response =
+            provider.parse_aps_response(&json!({"seatbid": [{"bid": [input]}]}), 12, &request());
+        let bid = response.bids.first().expect("should accept renderer bid");
+        assert!(bid.creative_id.is_none());
+        assert!(
+            bid.renderer
+                .as_ref()
+                .expect("should retain renderer")
+                .as_aps()
+                .expect("should be APS renderer")
+                .creative_id
+                .is_none()
+        );
+    }
 
-        let provider = ApsAuctionProvider::new(config);
+    #[test]
+    fn rejects_wrong_typed_response_level_fields() {
+        let provider = ApsAuctionProvider::new(config());
+        for value in [
+            json!({"cur": ["USD"], "seatbid": []}),
+            json!({"cur": "USD", "seatbid": "invalid"}),
+            json!({"contextual": {"slots": []}}),
+        ] {
+            let response = provider.parse_aps_response(&value, 12, &request());
+            assert!(response.bids.is_empty());
+            assert_eq!(
+                response.metadata["drop_reasons"]["unexpected_response_shape"],
+                1
+            );
+        }
+    }
 
-        let aps_slot = ApsSlotResponse {
-            slot_id: "test-slot".to_string(),
-            size: "728x90".to_string(),
-            crid: Some("crid-123".to_string()),
-            media_type: Some("d".to_string()),
-            fif: Some("1".to_string()),
-            targeting: vec!["amzniid".to_string(), "amznbid".to_string()],
-            meta: vec!["slotID".to_string()],
-            amzniid: Some("impression-id-123".to_string()),
-            amznbid: Some("1c7d4ow".to_string()), // Encoded price (to be decoded by mediation)
-            amznp: Some("1c7d4ow".to_string()),
-            amznsz: Some("728x90".to_string()),
-            amznactt: Some("OPEN".to_string()),
-        };
+    #[test]
+    fn debug_metadata_matches_pbs_httpcalls_shape() {
+        let mut provider_config = config();
+        provider_config.debug = true;
+        provider_config.endpoint = "https://aps.example/openrtb".to_string();
+        let provider = ApsAuctionProvider::new(provider_config);
+        let response_body = serde_json::to_vec(&json!({
+            "cur": "USD",
+            "seatbid": [{"bid": [bid("fictional-debug-bid", 1.23, "iframe")]}]
+        }))
+        .expect("should serialize APS response fixture");
+        let platform_response = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::OK)
+                .header(header::CONTENT_TYPE, "application/json")
+                .header("x-example-debug", "first")
+                .header("x-example-debug", "second")
+                .body(EdgeBody::from(response_body.clone()))
+                .expect("should build APS response"),
+        );
 
-        let bid = provider
-            .parse_aps_slot(&aps_slot)
-            .expect("should parse slot");
+        let response = parse_with_context(&provider, platform_response);
 
-        assert_eq!(bid.slot_id, "test-slot");
-        assert_eq!(bid.price, None); // Price NOT decoded - stored in metadata for mediation
-        assert_eq!(bid.width, 728);
-        assert_eq!(bid.height, 90);
-        assert_eq!(bid.currency, "USD");
-        assert_eq!(bid.bidder, "amazon-aps");
-        assert_eq!(bid.adomain, None);
-        assert_eq!(bid.nurl, None); // Real APS uses client-side tracking
-        assert_eq!(bid.burl, None);
-        assert!(bid.metadata.contains_key("amzniid"));
-        assert!(bid.metadata.contains_key("amznbid")); // Encoded price here
-        assert!(bid.metadata.contains_key("amznsz"));
+        assert_eq!(response.metadata["accepted_bid_count"], 1);
+        let call = &response.metadata["debug"]["httpcalls"]["aps"][0];
+        let request_body: Json = serde_json::from_str(
+            call["requestbody"]
+                .as_str()
+                .expect("should include request body as a string"),
+        )
+        .expect("should parse captured request body");
+        assert_eq!(request_body["id"], "fictional-auction");
+        assert_eq!(request_body["tmax"], 321);
+        assert_eq!(
+            call["requestheaders"]["content-type"],
+            json!(["application/json"])
+        );
+        assert_eq!(
+            call["responsebody"],
+            String::from_utf8_lossy(&response_body).as_ref()
+        );
+        assert_eq!(
+            call["responseheaders"]["content-type"],
+            json!(["application/json"])
+        );
+        assert_eq!(
+            call["responseheaders"]["x-example-debug"],
+            json!(["first", "second"])
+        );
+        assert_eq!(call["status"], 200);
+        assert_eq!(call["uri"], "https://aps.example/openrtb");
     }
 
     #[test]
-    fn test_provider_metadata() {
-        let config = ApsConfig::default();
-        let provider = ApsAuctionProvider::new(config);
+    fn disabled_debug_omits_httpcall_metadata() {
+        let provider = ApsAuctionProvider::new(config());
+        let platform_response = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::OK)
+                .body(EdgeBody::from(
+                    serde_json::to_vec(&json!({"seatbid": []}))
+                        .expect("should serialize APS no-bid response"),
+                ))
+                .expect("should build APS response"),
+        );
 
-        assert_eq!(provider.provider_name(), "aps");
-        assert!(!provider.is_enabled()); // Default is disabled
-        assert_eq!(provider.timeout_ms(), 800);
-        assert!(provider.supports_media_type(&MediaType::Banner));
-        assert!(provider.supports_media_type(&MediaType::Video));
-        assert!(!provider.supports_media_type(&MediaType::Native));
+        let response = parse_with_context(&provider, platform_response);
+
+        assert!(!response.metadata.contains_key("debug"));
+        assert_eq!(response.metadata["drop_reasons"]["empty_seatbid"], 1);
     }
 
     #[test]
-    fn aps_payload_timeout_uses_effective_auction_budget_not_provider_config() {
-        // Provider config says 1000ms but the auction budget grants only 500ms —
-        // the payload must advertise the tighter effective deadline.
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: default_endpoint(),
-            timeout_ms: 1000,
-        };
-        let provider = ApsAuctionProvider::new(config);
-        let request = create_test_auction_request();
+    fn debug_metadata_preserves_malformed_and_error_responses() {
+        let mut provider_config = config();
+        provider_config.debug = true;
+        let provider = ApsAuctionProvider::new(provider_config);
+        let malformed = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::OK)
+                .body(EdgeBody::from(b"{not-json".to_vec()))
+                .expect("should build malformed APS response"),
+        );
+        let unavailable = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::SERVICE_UNAVAILABLE)
+                .header("retry-after", "5")
+                .body(EdgeBody::from(b"temporarily unavailable".to_vec()))
+                .expect("should build unavailable APS response"),
+        );
+        let oversized = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::BAD_GATEWAY)
+                .body(EdgeBody::from(vec![
+                    b'x';
+                    UPSTREAM_RTB_MAX_RESPONSE_BYTES + 1
+                ]))
+                .expect("should build oversized APS response"),
+        );
 
-        let aps_request = provider.to_aps_request(&request, 500);
+        let malformed = parse_with_context(&provider, malformed);
+        let unavailable = parse_with_context(&provider, unavailable);
+        let oversized = parse_with_context(&provider, oversized);
 
         assert_eq!(
-            aps_request.timeout,
-            Some(500),
-            "should advertise the effective auction budget, not the provider config timeout"
+            malformed.metadata["drop_reasons"]["unexpected_response_shape"],
+            1
+        );
+        assert_eq!(
+            malformed.metadata["debug"]["httpcalls"]["aps"][0]["responsebody"],
+            "{not-json"
+        );
+        let unavailable_call = &unavailable.metadata["debug"]["httpcalls"]["aps"][0];
+        assert_eq!(unavailable.status, BidStatus::Error);
+        assert_eq!(unavailable_call["status"], 503);
+        assert_eq!(unavailable_call["responsebody"], "temporarily unavailable");
+        assert_eq!(
+            unavailable_call["responseheaders"]["retry-after"],
+            json!(["5"])
+        );
+        let oversized_call = oversized.metadata["debug"]["httpcalls"]["aps"][0]
+            .as_object()
+            .expect("should include oversized HTTP call metadata");
+        assert_eq!(oversized.status, BidStatus::Error);
+        assert_eq!(oversized_call["status"], 502);
+        assert!(
+            !oversized_call.contains_key("responsebody"),
+            "should omit response body when bounded capture fails"
         );
     }
 
     #[test]
-    fn test_aps_request_includes_consent_fields() {
-        use crate::consent::ConsentContext;
+    fn debug_metadata_includes_no_content_response() {
+        let mut provider_config = config();
+        provider_config.debug = true;
+        let provider = ApsAuctionProvider::new(provider_config);
+        let platform_response = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::NO_CONTENT)
+                .body(EdgeBody::empty())
+                .expect("should build empty APS response"),
+        );
 
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: default_endpoint(),
-            timeout_ms: 800,
-        };
-        let provider = ApsAuctionProvider::new(config);
+        let response = parse_with_context(&provider, platform_response);
 
-        let mut request = create_test_auction_request();
-        request.user.consent = Some(ConsentContext {
-            raw_tc_string: Some("BOEFEAyOEFEAyAHABDENAI4AAAB9vABAASA".to_string()),
-            gdpr_applies: true,
-            raw_us_privacy: Some("1YNN".to_string()),
-            raw_gpp_string: Some("DBACNYA~CPXxRfAPXxRfA".to_string()),
-            gpp_section_ids: Some(vec![2, 6]),
-            ..Default::default()
-        });
-
-        let aps_request = provider.to_aps_request(&request, 800);
+        assert_eq!(response.status, BidStatus::NoBid);
+        let call = &response.metadata["debug"]["httpcalls"]["aps"][0];
+        assert_eq!(call["status"], 204);
+        assert_eq!(call["responsebody"], "");
+    }
 
-        // Verify GDPR consent
-        let gdpr = aps_request.gdpr.expect("should have gdpr");
-        assert!(gdpr.enabled);
+    #[test]
+    fn malformed_json_is_a_safe_shape_error() {
+        let provider = ApsAuctionProvider::new(config());
+        let platform_response = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::OK)
+                .body(EdgeBody::from(b"{not-json".to_vec()))
+                .expect("should build malformed APS response"),
+        );
+        let auction_request = request();
+        let response = futures::executor::block_on(provider.parse_response_inner(
+            platform_response,
+            12,
+            Some(&auction_request),
+            None,
+        ))
+        .expect("should convert malformed JSON into a safe auction response");
+
+        assert!(response.bids.is_empty());
         assert_eq!(
-            gdpr.consent.as_deref(),
-            Some("BOEFEAyOEFEAyAHABDENAI4AAAB9vABAASA")
+            response.metadata["drop_reasons"]["unexpected_response_shape"],
+            1
         );
-
-        // Verify US Privacy
-        assert_eq!(aps_request.us_privacy.as_deref(), Some("1YNN"));
-
-        // Verify GPP
-        assert_eq!(aps_request.gpp.as_deref(), Some("DBACNYA~CPXxRfAPXxRfA"));
-        assert_eq!(aps_request.gpp_sid.as_deref(), Some("2,6"));
     }
 
     #[test]
-    fn test_aps_request_no_consent() {
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: default_endpoint(),
-            timeout_ms: 800,
-        };
-        let provider = ApsAuctionProvider::new(config);
-        let request = create_test_auction_request(); // consent is None
+    fn context_free_parse_response_reports_missing_request_context() {
+        let provider = ApsAuctionProvider::new(config());
+        let platform_response = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::OK)
+                .body(EdgeBody::from(
+                    serde_json::to_vec(
+                        &json!({"seatbid": [{"bid": [bid("valid", 1.0, "iframe")]}]}),
+                    )
+                    .expect("should serialize APS response"),
+                ))
+                .expect("should build APS response"),
+        );
 
-        let aps_request = provider.to_aps_request(&request, 800);
+        let response = futures::executor::block_on(provider.parse_response(platform_response, 12))
+            .expect("should return an explicit context error response");
 
-        assert!(aps_request.gdpr.is_none());
-        assert!(aps_request.us_privacy.is_none());
-        assert!(aps_request.gpp.is_none());
-        assert!(aps_request.gpp_sid.is_none());
+        assert_eq!(response.status, BidStatus::Error);
+        assert!(response.bids.is_empty());
+        assert_eq!(
+            response.metadata["drop_reasons"]["missing_request_context"],
+            1
+        );
     }
 
     #[test]
-    fn test_aps_request_consent_serialization() {
-        use crate::consent::ConsentContext;
-
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: default_endpoint(),
-            timeout_ms: 800,
-        };
-        let provider = ApsAuctionProvider::new(config);
+    fn no_content_and_empty_responses_are_no_bids() {
+        let provider = ApsAuctionProvider::new(config());
+        let platform_response = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::NO_CONTENT)
+                .body(EdgeBody::empty())
+                .expect("should build empty APS response"),
+        );
+        let auction_request = request();
+        let no_content = futures::executor::block_on(provider.parse_response_inner(
+            platform_response,
+            12,
+            Some(&auction_request),
+            None,
+        ))
+        .expect("should parse 204 as no bid");
+        assert_eq!(no_content.status, BidStatus::NoBid);
+
+        for value in [json!({}), json!({"seatbid": []})] {
+            let empty = provider.parse_aps_response(&value, 12, &auction_request);
+            assert_eq!(empty.status, BidStatus::NoBid);
+            assert_eq!(empty.metadata["drop_reasons"]["empty_seatbid"], 1);
+        }
+    }
 
-        let mut request = create_test_auction_request();
-        request.user.consent = Some(ConsentContext {
-            raw_tc_string: Some("BOE".to_string()),
-            gdpr_applies: true,
-            ..Default::default()
-        });
+    #[test]
+    fn missing_seatbid_bid_array_is_counted_as_a_drop() {
+        let provider = ApsAuctionProvider::new(config());
+        let response =
+            provider.parse_aps_response(&json!({"seatbid": [{"seat": "aps"}]}), 12, &request());
+
+        assert_eq!(response.status, BidStatus::NoBid);
+        assert_eq!(response.metadata["seatbid_count"], 1);
+        assert_eq!(response.metadata["dropped_bid_count"], 1);
+        assert_eq!(response.metadata["drop_reasons"]["empty_seatbid_bids"], 1);
+    }
 
-        let aps_request = provider.to_aps_request(&request, 800);
-        let json = serde_json::to_value(&aps_request).expect("should serialize");
+    #[test]
+    fn unsupported_currency_is_a_no_bid() {
+        let provider = ApsAuctionProvider::new(config());
+        let response = provider.parse_aps_response(
+            &json!({"cur": "EUR", "seatbid": [{"bid": [bid("eur-bid", 1.0, "iframe")]}]}),
+            12,
+            &request(),
+        );
+        assert_eq!(response.status, BidStatus::NoBid);
+        assert_eq!(response.metadata["drop_reasons"]["unsupported_currency"], 1);
+    }
 
-        // GDPR fields present
-        assert_eq!(json["gdpr"]["enabled"], true);
-        assert_eq!(json["gdpr"]["consent"], "BOE");
+    #[test]
+    fn malformed_sibling_does_not_suppress_valid_bid() {
+        let provider = ApsAuctionProvider::new(config());
+        let response = provider.parse_aps_response(
+            &json!({"seatbid": [{"bid": ["malformed", bid("valid", 1.0, "iframe")]}]}),
+            12,
+            &request(),
+        );
+        assert_eq!(response.bids.len(), 1);
+        assert_eq!(response.bids[0].bid_id.as_deref(), Some("valid"));
+        assert_eq!(
+            response.metadata["drop_reasons"]["missing_render_source"],
+            1
+        );
+    }
 
-        // Absent fields should not appear (skip_serializing_if)
-        assert!(json.get("usPrivacy").is_none());
-        assert!(json.get("gpp").is_none());
-        assert!(json.get("gppSid").is_none());
+    #[test]
+    fn enabled_script_bid_keeps_typed_renderer() {
+        let mut enabled = config();
+        enabled.allow_script_creatives = true;
+        let provider = ApsAuctionProvider::new(enabled);
+        let response = provider.parse_aps_response(
+            &json!({"seatbid": [{"bid": [bid("script", 1.0, "script")]}]}),
+            12,
+            &request(),
+        );
+        let renderer = response.bids[0]
+            .renderer
+            .as_ref()
+            .expect("should keep script renderer")
+            .as_aps()
+            .expect("should be APS renderer");
+        assert_eq!(renderer.tag_type, ApsTagType::Script);
     }
 
     #[test]
-    fn test_aps_bids_have_no_creative_and_no_decoded_price() {
-        // APS doesn't provide creative HTML - it only provides targeting keys
-        // APS doesn't decode prices - only mediation layer can decode them
-        // The creative will be generated by the mediation layer (e.g., GAM or ad server)
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
-            timeout_ms: 800,
-        };
+    fn disabled_script_cannot_suppress_lower_iframe_bid() {
+        let provider = ApsAuctionProvider::new(config());
+        let response = provider.parse_aps_response(
+            &json!({"seatbid": [{"bid": [bid("script-high", 4.0, "script"), bid("iframe-low", 1.0, "iframe")]}]}),
+            12,
+            &request(),
+        );
+        assert_eq!(response.bids.len(), 1);
+        assert_eq!(response.bids[0].bid_id.as_deref(), Some("iframe-low"));
+        assert_eq!(
+            response.metadata["drop_reasons"]["script_rendering_disabled"],
+            1
+        );
+    }
 
-        let provider = ApsAuctionProvider::new(config);
+    #[test]
+    fn reduces_candidates_by_price_then_bid_id_and_reconciles_drops() {
+        let provider = ApsAuctionProvider::new(config());
+        let response = provider.parse_aps_response(
+            &json!({"seatbid": [{"bid": [
+                bid("low-incumbent", 1.0, "iframe"),
+                bid("bid-z", 2.0, "iframe"),
+                bid("bid-a", 2.0, "iframe"),
+                bid("lower-candidate", 1.5, "iframe")
+            ]}]}),
+            12,
+            &request(),
+        );
+        assert_eq!(response.bids.len(), 1);
+        assert_eq!(response.bids[0].bid_id.as_deref(), Some("bid-a"));
+        assert_eq!(response.metadata["accepted_bid_count"], 1);
+        assert_eq!(response.metadata["dropped_bid_count"], 3);
+        assert_eq!(response.metadata["drop_reasons"]["lost_to_higher_bid"], 3);
+    }
 
-        let aps_slot = ApsSlotResponse {
-            slot_id: "test-slot".to_string(),
-            size: "300x250".to_string(),
-            crid: Some("test-creative".to_string()),
-            media_type: Some("d".to_string()),
-            fif: Some("1".to_string()),
-            targeting: vec!["amzniid".to_string(), "amznbid".to_string()],
-            meta: vec!["slotID".to_string()],
-            amzniid: Some("imp-123".to_string()),
-            amznbid: Some("encoded-price".to_string()),
-            amznp: Some("encoded-price-alt".to_string()),
-            amznsz: Some("300x250".to_string()),
-            amznactt: Some("OPEN".to_string()),
-        };
+    #[test]
+    fn safe_drops_missing_renderer_and_invalid_dimensions() {
+        let provider = ApsAuctionProvider::new(config());
+        let mut invalid = bid("invalid", 1.0, "iframe");
+        invalid
+            .as_object_mut()
+            .expect("should be object")
+            .remove("w");
+        let response = provider.parse_aps_response(
+            &json!({"seatbid": [{"bid": [
+                {"id": "fixture", "impid": "fictional-slot", "price": 1.0, "w": 300, "h": 250, "ext": {"bidder": "aps"}},
+                invalid
+            ]}]}),
+            12,
+            &request(),
+        );
+        assert!(response.bids.is_empty());
+        assert_eq!(
+            response.metadata["drop_reasons"]["missing_render_source"],
+            1
+        );
+        assert_eq!(response.metadata["drop_reasons"]["invalid_dimensions"], 1);
+    }
 
-        let bid = provider.parse_aps_slot(&aps_slot).expect("should parse");
+    #[test]
+    fn rejects_publisher_origin_and_non_https_creative_urls() {
+        let provider = ApsAuctionProvider::new(config());
+        for creative_url in [
+            "https://publisher.example/render",
+            "http://creative.example/render",
+            "https://user:password@creative.example/render",
+        ] {
+            let mut invalid = bid("invalid-url", 1.0, "iframe");
+            invalid["ext"]["creativeurl"] = json!(creative_url);
+            let response = provider.parse_aps_response(
+                &json!({"seatbid": [{"bid": [invalid]}]}),
+                12,
+                &request(),
+            );
+            assert!(response.bids.is_empty(), "should reject {creative_url}");
+            assert_eq!(response.metadata["drop_reasons"]["invalid_creative_url"], 1);
+        }
 
-        // Key assertions:
-        // 1. creative should be None for APS bids
-        assert_eq!(bid.creative, None, "APS bids should not have creative HTML");
-        // 2. price should be None (encoded price in metadata, decoded by mediation)
-        assert_eq!(bid.price, None, "APS bids should not have decoded price");
+        let mut uppercase_publisher = request();
+        uppercase_publisher.publisher.domain = "Creative.Example".to_string();
+        let response = provider.parse_aps_response(
+            &json!({"seatbid": [{"bid": [bid("same-origin", 1.0, "iframe")]}]}),
+            12,
+            &uppercase_publisher,
+        );
+        assert!(response.bids.is_empty());
+        assert_eq!(response.metadata["drop_reasons"]["invalid_creative_url"], 1);
+    }
 
-        // Verify targeting keys are in metadata (includes encoded price)
-        assert!(bid.metadata.contains_key("amzniid"));
-        assert!(bid.metadata.contains_key("amznbid")); // Encoded price
+    #[test]
+    fn registers_and_serves_only_static_renderer_route() {
+        let integration = ApsRendererIntegration;
+        let routes = integration.routes();
+        assert_eq!(routes.len(), 1, "should register one route");
+        assert_eq!(routes[0].method, Method::GET);
+        assert_eq!(routes[0].path, APS_RENDERER_ROUTE);
+
+        let settings = create_test_settings();
+        let services = noop_services();
+        let request = http::Request::builder()
+            .method(Method::GET)
+            .uri(APS_RENDERER_ROUTE)
+            .body(EdgeBody::empty())
+            .expect("should build renderer request");
+        let response =
+            futures::executor::block_on(integration.handle(&settings, &services, request))
+                .expect("should serve renderer");
+        assert_eq!(response.status(), StatusCode::OK);
         assert_eq!(
-            bid.metadata.get("amzniid").and_then(|v| v.as_str()),
-            Some("imp-123")
+            response.headers()[header::CONTENT_TYPE],
+            "text/html; charset=utf-8"
         );
+        assert_eq!(response.headers()["x-content-type-options"], "nosniff");
+        assert_eq!(response.headers()["referrer-policy"], "no-referrer");
         assert_eq!(
-            bid.metadata.get("amznbid").and_then(|v| v.as_str()),
-            Some("encoded-price")
+            response.headers()[header::CONTENT_SECURITY_POLICY],
+            APS_RENDERER_CSP
         );
-    }
 
-    fn single_slot_request(
-        auction_id: &str,
-        aps_slot_id: &str,
-        creative_id: &str,
-    ) -> AuctionRequest {
-        let mut bidders = HashMap::new();
-        bidders.insert("aps".to_string(), json!({ "slotID": aps_slot_id }));
-        AuctionRequest {
-            id: auction_id.to_string(),
-            slots: vec![AdSlot {
-                id: creative_id.to_string(),
-                formats: vec![AdFormat {
-                    media_type: MediaType::Banner,
-                    width: 300,
-                    height: 250,
-                }],
-                floor_price: None,
-                targeting: HashMap::new(),
-                bidders,
-            }],
-            publisher: PublisherInfo {
-                domain: "example.com".to_string(),
-                page_url: None,
-            },
-            user: UserInfo {
-                id: None,
-                consent: None,
-                eids: None,
-            },
-            device: None,
-            site: None,
-            context: HashMap::new(),
-        }
+        let post = http::Request::builder()
+            .method(Method::POST)
+            .uri(APS_RENDERER_ROUTE)
+            .body(EdgeBody::empty())
+            .expect("should build method rejection request");
+        let response = futures::executor::block_on(integration.handle(&settings, &services, post))
+            .expect("should reject unsupported method");
+        assert_eq!(response.status(), StatusCode::NOT_FOUND);
     }
 
-    fn aps_platform_response(aps_slot_id: &str) -> PlatformResponse {
-        let body = json!({
-            "contextual": {
-                "slots": [{
-                    "slotID": aps_slot_id,
-                    "size": "300x250",
-                    "fif": "1",
-                    "amznbid": "1gtm3q",
-                    "meta": ["slotID"]
-                }]
-            }
-        });
-        let response = http::Response::builder()
-            .status(200)
-            .body(EdgeBody::from(
-                serde_json::to_vec(&body).expect("should serialize APS response body"),
-            ))
-            .expect("should build APS platform response");
-        PlatformResponse::new(response)
+    #[test]
+    fn enabled_config_registers_renderer_proxy() {
+        let mut settings = create_test_settings();
+        settings
+            .integrations
+            .insert_config(
+                APS_INTEGRATION_ID,
+                &json!({"enabled": true, "account_id": "example-account"}),
+            )
+            .expect("should insert APS config");
+
+        let registration = register(&settings)
+            .expect("should register APS")
+            .expect("should return enabled registration");
+
+        assert_eq!(registration.integration_id, APS_INTEGRATION_ID);
+        assert_eq!(registration.proxies.len(), 1);
+        assert!(registration.js_disabled);
     }
 
     #[test]
-    fn concurrent_auctions_parse_out_of_order_with_correct_slot_remapping() {
-        // Regression: the reverse slot map used to live on the shared provider
-        // instance, so a second auction's request_bids overwrote the first
-        // auction's map and out-of-order parses remapped bids to the wrong
-        // creative slot. The map is now derived from each parse's own request.
-        let provider = ApsAuctionProvider::new(ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: default_endpoint(),
-            timeout_ms: 800,
-        });
-
-        let request_a = single_slot_request("auction-a", "aps-slot-a", "creative_a");
-        let request_b = single_slot_request("auction-b", "aps-slot-b", "creative_b");
+    fn enabled_invalid_config_fails_provider_registration() {
+        let mut settings = create_test_settings();
+        settings
+            .integrations
+            .insert_config(
+                APS_INTEGRATION_ID,
+                &json!({
+                    "enabled": true,
+                    "account_id": "example-account",
+                    "endpoint": "http://insecure.example/openrtb"
+                }),
+            )
+            .expect("should insert invalid APS config for startup validation");
+
+        let _error = register_providers(&settings)
+            .err()
+            .expect("should reject invalid enabled APS configuration");
+    }
 
-        let settings = crate::test_support::tests::create_test_settings();
-        let http_request = http::Request::builder()
-            .uri("https://example.com/")
-            .body(EdgeBody::empty())
-            .expect("should build test request");
-        let context = crate::auction::test_support::create_test_auction_context(
-            &settings,
-            &http_request,
-            800,
+    #[test]
+    fn renderer_document_is_static_and_nonce_bound() {
+        assert!(APS_RENDERER_DOCUMENT.contains("^#tsaps="));
+        assert!(APS_RENDERER_DOCUMENT.contains("event.source!==parent"));
+        assert!(APS_RENDERER_DOCUMENT.contains("message.nonce!==expected"));
+        assert!(APS_RENDERER_DOCUMENT.contains("prebid/creative/render"));
+        assert!(APS_RENDERER_DOCUMENT.contains("window._aps instanceof Map"));
+        assert!(APS_RENDERER_DOCUMENT.contains("store:new Map([['listeners',new Map()]])"));
+        assert!(APS_RENDERER_DOCUMENT.contains("account.queue.push(new CustomEvent"));
+        assert!(
+            APS_RENDERER_DOCUMENT.contains("trusted-server/aps/renderer-ready")
+                && APS_RENDERER_DOCUMENT.contains("trusted-server/aps/renderer-failed")
         );
-
-        futures::executor::block_on(async {
-            // Parse auction B's response first, then auction A's — the reverse
-            // of dispatch order — each against its own request.
-            let response_b = provider
-                .parse_response_with_context(
-                    aps_platform_response("aps-slot-b"),
-                    100,
-                    &request_b,
-                    &context,
-                )
-                .await
-                .expect("should parse auction B response");
-            let response_a = provider
-                .parse_response_with_context(
-                    aps_platform_response("aps-slot-a"),
-                    100,
-                    &request_a,
-                    &context,
-                )
-                .await
-                .expect("should parse auction A response");
-
-            assert_eq!(
-                response_b.bids[0].slot_id, "creative_b",
-                "auction B bid should remap to auction B's creative slot"
-            );
-            assert_eq!(
-                response_a.bids[0].slot_id, "creative_a",
-                "auction A bid should remap to auction A's creative slot despite parsing last"
-            );
-        });
+        assert!(!APS_RENDERER_DOCUMENT.contains("window.apstag"));
+        assert!(
+            APS_RENDERER_DOCUMENT
+                .contains("https://client.aps.amazon-adsystem.com/prebid-creative.js")
+        );
+        assert!(!APS_RENDERER_DOCUMENT.contains("<script src="));
+        let queue_index = APS_RENDERER_DOCUMENT
+            .find("account.queue.push(new CustomEvent")
+            .expect("should queue render event");
+        let runner_index = APS_RENDERER_DOCUMENT
+            .find("document.head.appendChild(script)")
+            .expect("should dynamically load the APS runner");
+        assert!(queue_index < runner_index);
+        assert!(!APS_RENDERER_DOCUMENT.contains("allow-same-origin"));
+        assert!(APS_RENDERER_CSP.contains("default-src 'none'"));
+        assert!(APS_RENDERER_CSP.contains("sandbox allow-forms"));
+        assert!(!APS_RENDERER_CSP.contains("allow-same-origin"));
     }
 }
diff --git a/crates/trusted-server-core/src/integrations/mod.rs b/crates/trusted-server-core/src/integrations/mod.rs
index af56c371..e7464f86 100644
--- a/crates/trusted-server-core/src/integrations/mod.rs
+++ b/crates/trusted-server-core/src/integrations/mod.rs
@@ -284,6 +284,10 @@ pub(crate) struct IntegrationBuilder {
 
 pub(crate) fn builders() -> &'static [IntegrationBuilder] {
     &[
+        IntegrationBuilder {
+            id: "aps",
+            build: aps::register,
+        },
         IntegrationBuilder {
             id: "prebid",
             build: prebid::register,
diff --git a/crates/trusted-server-core/src/integrations/prebid.rs b/crates/trusted-server-core/src/integrations/prebid.rs
index a1b40281..dd0ec26b 100644
--- a/crates/trusted-server-core/src/integrations/prebid.rs
+++ b/crates/trusted-server-core/src/integrations/prebid.rs
@@ -201,6 +201,7 @@ fn extract_prebid_error_message(
 const GPC_US_PRIVACY: &str = "1YYN";
 
 #[derive(Debug, Clone, Deserialize, Serialize, Validate)]
+#[validate(schema(function = "validate_prebid_bidder_lists"))]
 pub struct PrebidIntegrationConfig {
     #[serde(default = "default_enabled")]
     pub enabled: bool,
@@ -342,6 +343,29 @@ pub struct PrebidIntegrationConfig {
     pub suppress_nurl_bidders: Vec<String>,
 }
 
+fn validate_prebid_bidder_lists(config: &PrebidIntegrationConfig) -> Result<(), ValidationError> {
+    for (field, bidders) in [
+        ("bidders", &config.bidders),
+        ("client_side_bidders", &config.client_side_bidders),
+    ] {
+        if bidders
+            .iter()
+            .any(|bidder| bidder.eq_ignore_ascii_case("aps"))
+        {
+            let mut error = ValidationError::new("aps_managed_by_dedicated_integration");
+            error.message = Some(
+                format!(
+                    "integrations.prebid.{field} must not include APS; configure APS under [integrations.aps]"
+                )
+                .into(),
+            );
+            return Err(error);
+        }
+    }
+
+    Ok(())
+}
+
 impl IntegrationConfig for PrebidIntegrationConfig {
     fn is_enabled(&self) -> bool {
         self.enabled
@@ -1383,14 +1407,18 @@ fn copy_request_headers(
     to: &mut http::Request<EdgeBody>,
     consent_forwarding: ConsentForwardingMode,
     client_ip: Option<std::net::IpAddr>,
+    sanitized_referer: Option<&str>,
 ) {
-    let headers_to_copy = [header::USER_AGENT, header::REFERER, header::ACCEPT_LANGUAGE];
+    let headers_to_copy = [header::USER_AGENT, header::ACCEPT_LANGUAGE];
 
     for header_name in &headers_to_copy {
         if let Some(value) = from.headers().get(header_name) {
             to.headers_mut().insert(header_name, value.clone());
         }
     }
+    if let Some(value) = sanitized_referer.and_then(|value| HeaderValue::from_str(value).ok()) {
+        to.headers_mut().insert(header::REFERER, value);
+    }
 
     if let Some(ip) = client_ip
         && let Ok(value) = HeaderValue::from_str(&ip.to_string())
@@ -1537,14 +1565,25 @@ impl PrebidAuctionProvider {
                 // Only pass through keys that are known PBS bidders — skip provider-specific
                 // keys like "aps" which belong to their own separate auction provider.
                 let mut bidder: HashMap<String, Json> = HashMap::new();
+                let mut excluded_aps = false;
                 for (name, params) in &slot.bidders {
+                    if name.eq_ignore_ascii_case("aps") {
+                        // Trusted Server APS is a separate OpenRTB provider. Never
+                        // send native APS demand through PBS for the same cohort.
+                        excluded_aps = true;
+                        continue;
+                    }
                     if name == TRUSTED_SERVER_BIDDER {
                         bidder.extend(expand_trusted_server_bidders(&self.config.bidders, params));
+                        bidder.retain(|name, _| {
+                            let keep = !name.eq_ignore_ascii_case("aps");
+                            excluded_aps |= !keep;
+                            keep
+                        });
                     } else if self.config.bidders.iter().any(|b| b == name) {
                         bidder.insert(name.clone(), params.clone());
-                    } else if name != "aps" {
-                        // `aps` is intentionally handled by its own provider. Any
-                        // other unrecognized key is likely a misconfiguration (a
+                    } else {
+                        // Any other unrecognized key is likely a misconfiguration (a
                         // slot bidder absent from `config.bidders`) that silently
                         // yields an empty bidder map and a stored-request no-bid —
                         // log it so the drop is diagnosable.
@@ -1556,23 +1595,20 @@ impl PrebidAuctionProvider {
                     }
                 }
 
+                if excluded_aps && bidder.is_empty() {
+                    log::warn!(
+                        "prebid: dropping imp '{}' because it contains only APS demand; refusing PBS stored-request fallback",
+                        slot.id
+                    );
+                    return None;
+                }
+
                 // When no inline PBS bidder params exist (e.g. creative-opportunity slots
                 // whose PBS params live in stored requests), tell PBS to resolve bidder
                 // config from the stored request keyed by this slot ID.
-                //
-                // This cannot fire for the client /auction path: the JS adapter
-                // injects a `trustedServer` entry into every ad unit, so `bidder`
-                // is only empty for server-side creative-opportunity slots with
-                // no inline provider params (or when `config.bidders` is empty,
-                // where PBS previously received an empty bidder map and returned
-                // no bids — a stored-request miss is the same no-bid outcome).
-                let storedrequest = if bidder.is_empty() {
-                    Some(ImpStoredRequest {
-                        id: slot.id.clone(),
-                    })
-                } else {
-                    None
-                };
+                let storedrequest = bidder.is_empty().then(|| ImpStoredRequest {
+                    id: slot.id.clone(),
+                });
 
                 // Apply canonical and compatibility-derived rules in normalized order.
                 for (name, params) in &mut bidder {
@@ -1764,13 +1800,11 @@ impl PrebidAuctionProvider {
         }
         .to_ext();
 
-        // Extract Referer header for site.ref
-        let referer = context
-            .request
-            .headers()
-            .get(header::REFERER)
-            .and_then(|value| value.to_str().ok())
-            .map(std::string::ToString::to_string);
+        // The browser Referer identifies the current publisher page for the
+        // same-origin `/auction` request, not the page that referred the user to
+        // the publisher. `request.publisher.page_url` is already sanitized and
+        // is carried as `site.page`, so do not duplicate the raw header in
+        // `site.ref`.
 
         // Advertise the effective auction budget, not the raw provider config:
         // the orchestrator caps `context.timeout_ms` to the remaining auction
@@ -1785,7 +1819,7 @@ impl PrebidAuctionProvider {
             site: Some(Site {
                 domain: Some(request.publisher.domain.clone()),
                 page: page_url,
-                r#ref: referer,
+                r#ref: None,
                 publisher: Some(Publisher {
                     domain: Some(request.publisher.domain.clone()),
                     ..Default::default()
@@ -2139,10 +2173,15 @@ impl PrebidAuctionProvider {
         // not an ad ID, so it is not used as a fallback: surfacing it as `ad_id`
         // (which is exposed raw in the debug bid) would mislead any consumer that
         // treats `ad_id` as a creative identifier. Absent `adid`, `ad_id` is None.
+        let bid_id = bid_obj.get("id").and_then(|v| v.as_str()).map(String::from);
         let ad_id = bid_obj
             .get("adid")
             .and_then(|v| v.as_str())
             .map(String::from);
+        let creative_id = bid_obj
+            .get("crid")
+            .and_then(|v| v.as_str())
+            .map(String::from);
 
         let adomain = bid_obj
             .get("adomain")
@@ -2207,7 +2246,10 @@ impl PrebidAuctionProvider {
             height,
             nurl,
             burl,
+            bid_id,
             ad_id,
+            creative_id,
+            renderer: None,
             cache_id,
             cache_host,
             cache_path,
@@ -2312,6 +2354,7 @@ impl AuctionProvider for PrebidAuctionProvider {
             &mut pbs_req,
             self.config.consent_forwarding,
             context.services.client_info().client_ip,
+            request.publisher.page_url.as_deref(),
         );
 
         let pbs_body = serde_json::to_vec(&openrtb).change_context(TrustedServerError::Prebid {
@@ -4862,7 +4905,7 @@ external_bundle_sri = "sha384-AAAA"
     }
 
     #[test]
-    fn to_openrtb_sets_site_ref_from_referer_header() {
+    fn to_openrtb_omits_raw_referer_from_site_ref() {
         let provider = PrebidAuctionProvider::new(base_config());
         let auction_request = create_test_auction_request();
 
@@ -4882,10 +4925,14 @@ external_bundle_sri = "sha384-AAAA"
         );
         let site = openrtb.site.as_ref().expect("should have site");
 
+        assert!(
+            site.r#ref.is_none(),
+            "should not forward the raw browser Referer into site.ref"
+        );
         assert_eq!(
-            site.r#ref.as_deref(),
-            Some("https://google.com/search?q=test"),
-            "should set site.ref from Referer header"
+            site.page.as_deref(),
+            auction_request.publisher.page_url.as_deref(),
+            "should retain the sanitized publisher page URL"
         );
     }
 
@@ -6489,26 +6536,23 @@ set = { placementId = "explicit_header" }
     // ========================================================================
 
     #[test]
-    fn to_openrtb_uses_stored_request_when_slot_has_no_pbs_bidder_params() {
-        // Slot only has "aps" provider — not a PBS bidder
-        let slot = make_slot(
-            "atf_sidebar_ad",
-            HashMap::from([("aps".to_string(), json!({"slotID": "aps-slot-atf-sidebar"}))]),
-        );
-        let request = make_auction_request(vec![slot]);
-
-        let ortb = call_to_openrtb(base_config(), &request);
-        let ext = ortb.imp[0].ext.as_ref().expect("should have imp ext");
-        let prebid = ext.get("prebid").expect("should have prebid in ext");
+    fn to_openrtb_drops_aps_only_slots_instead_of_using_stored_requests() {
+        for bidder in ["aps", "APS", "Aps"] {
+            let slot = make_slot(
+                "atf_sidebar_ad",
+                HashMap::from([(
+                    bidder.to_string(),
+                    json!({"slotID": "aps-slot-atf-sidebar"}),
+                )]),
+            );
+            let request = make_auction_request(vec![slot]);
 
-        assert!(
-            prebid.get("bidder").is_none(),
-            "should not send inline bidder params when using stored request"
-        );
-        assert_eq!(
-            prebid["storedrequest"]["id"], "atf_sidebar_ad",
-            "should use slot id as stored request id"
-        );
+            let openrtb = call_to_openrtb(base_config(), &request);
+            assert!(
+                openrtb.imp.is_empty(),
+                "should drop APS-only slot for case variant {bidder}"
+            );
+        }
     }
 
     #[test]
@@ -6553,23 +6597,73 @@ set = { placementId = "explicit_header" }
     }
 
     #[test]
-    fn to_openrtb_skips_aps_key_from_slot_bidders_in_pbs_request() {
-        let slot = make_slot(
+    fn to_openrtb_drops_aps_only_trusted_server_expansion() {
+        let mut config = base_config();
+        config.bidders = vec!["APS".to_string()];
+        let slot = make_ts_slot(
             "atf_sidebar_ad",
-            HashMap::from([("aps".to_string(), json!({"slotID": "aps-slot-atf-sidebar"}))]),
+            &json!({"APS": {"slotID": "aps-slot-atf-sidebar"}}),
+            None,
         );
         let request = make_auction_request(vec![slot]);
 
-        let ortb = call_to_openrtb(base_config(), &request);
-        let ext = ortb.imp[0].ext.as_ref().expect("should have imp ext");
-        let prebid = ext.get("prebid").expect("should have prebid in ext");
+        let openrtb = call_to_openrtb(config, &request);
+        assert!(
+            openrtb.imp.is_empty(),
+            "should not fall back to a stored request after excluding APS expansion"
+        );
+    }
 
+    #[test]
+    fn trusted_server_expansion_never_enables_aps_through_pbs() {
+        let mut config = base_config();
+        config.bidders = vec!["kargo".to_string(), "APS".to_string()];
+        let slot = make_ts_slot(
+            "in_content_ad",
+            &json!({
+                "kargo": {"placementId": "client_123"},
+                "APS": {"slotID": "legacy-aps-slot"}
+            }),
+            None,
+        );
+        let request = make_auction_request(vec![slot]);
+
+        let ortb = call_to_openrtb(config, &request);
+        let bidder = &ortb.imp[0].ext.as_ref().expect("should have imp ext")["prebid"]["bidder"];
+        assert_eq!(bidder["kargo"]["placementId"], "client_123");
         assert!(
-            prebid.get("bidder").is_none(),
-            "should not forward aps key into PBS imp.ext.prebid.bidder"
+            bidder
+                .as_object()
+                .expect("should serialize bidder map")
+                .keys()
+                .all(|name| !name.eq_ignore_ascii_case("aps")),
+            "Trusted Server APS cohorts must not also send APS through PBS"
         );
     }
 
+    #[test]
+    fn config_rejects_aps_in_prebid_bidder_lists_case_insensitively() {
+        for (field, bidder) in [
+            ("bidders", "aps"),
+            ("bidders", "APS"),
+            ("client_side_bidders", "Aps"),
+        ] {
+            let result = parse_prebid_toml_result(&format!(
+                r#"
+[integrations.prebid]
+enabled = true
+server_url = "https://prebid.example"
+{field} = ["{bidder}"]
+"#
+            ));
+            let error = result.expect_err("should reject APS in Prebid bidder lists");
+            assert!(
+                error.to_string().contains("configure APS under"),
+                "should include migration guidance for {field}: {error:?}"
+            );
+        }
+    }
+
     #[test]
     fn register_rejects_invalid_bid_param_override_rule() {
         let toml = format!(
@@ -6818,6 +6912,7 @@ set = { networkId = 42 }
             "id": "bid-impression-id",
             "impid": "atf_sidebar_ad",
             "adid": "bidder-ad-id-abc",
+            "crid": "bidder-creative-id-abc",
             "price": 1.0,
             "w": 300,
             "h": 250,
@@ -6836,11 +6931,21 @@ set = { networkId = 42 }
         let bid = provider
             .parse_bid(&bid_json, "appnexus")
             .expect("should parse bid");
+        assert_eq!(
+            bid.bid_id.as_deref(),
+            Some("bid-impression-id"),
+            "should preserve OpenRTB id separately"
+        );
         assert_eq!(
             bid.ad_id.as_deref(),
             Some("bidder-ad-id-abc"),
             "should keep ad_id from adid field"
         );
+        assert_eq!(
+            bid.creative_id.as_deref(),
+            Some("bidder-creative-id-abc"),
+            "should preserve OpenRTB crid separately"
+        );
         assert_eq!(
             bid.cache_id.as_deref(),
             Some("cache-uuid-xyz"),
@@ -6853,6 +6958,10 @@ set = { networkId = 42 }
         let from = http::Request::builder()
             .uri("https://publisher.example.com/")
             .header("x-forwarded-for", "6.6.6.6")
+            .header(
+                header::REFERER,
+                "https://publisher.example.com/article?email=private#fragment",
+            )
             .header(header::USER_AGENT, "test-agent")
             .body(EdgeBody::empty())
             .expect("should build inbound request");
@@ -6866,6 +6975,7 @@ set = { networkId = 42 }
             &mut to,
             ConsentForwardingMode::Both,
             Some(std::net::IpAddr::from([203, 0, 113, 7])),
+            Some("https://publisher.example.com/article"),
         );
 
         assert_eq!(
@@ -6882,6 +6992,13 @@ set = { networkId = 42 }
             Some("test-agent"),
             "should still copy the browser User-Agent"
         );
+        assert_eq!(
+            to.headers()
+                .get(header::REFERER)
+                .and_then(|value| value.to_str().ok()),
+            Some("https://publisher.example.com/article"),
+            "should replace the raw browser Referer with the sanitized page URL"
+        );
     }
 
     #[test]
@@ -6896,7 +7013,7 @@ set = { networkId = 42 }
             .body(EdgeBody::empty())
             .expect("should build outbound request");
 
-        copy_request_headers(&from, &mut to, ConsentForwardingMode::Both, None);
+        copy_request_headers(&from, &mut to, ConsentForwardingMode::Both, None, None);
 
         assert!(
             !to.headers().contains_key("x-forwarded-for"),
diff --git a/crates/trusted-server-core/src/openrtb.rs b/crates/trusted-server-core/src/openrtb.rs
index 65237ce0..9b753350 100644
--- a/crates/trusted-server-core/src/openrtb.rs
+++ b/crates/trusted-server-core/src/openrtb.rs
@@ -1,7 +1,7 @@
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
 
-use crate::auction::types::OrchestratorExt;
+use crate::auction::types::{BidRenderer, OrchestratorExt};
 
 pub type OpenRtbRequest = trusted_server_openrtb::BidRequest;
 pub type OpenRtbResponse = trusted_server_openrtb::BidResponse;
@@ -171,6 +171,18 @@ pub struct ImpStoredRequest {
     pub id: String,
 }
 
+#[derive(Debug, Serialize)]
+pub struct BidExt<'a> {
+    pub trusted_server: BidTrustedServerExt<'a>,
+}
+
+impl ToExt for BidExt<'_> {}
+
+#[derive(Debug, Serialize)]
+pub struct BidTrustedServerExt<'a> {
+    pub renderer: &'a BidRenderer,
+}
+
 #[derive(Debug, Serialize)]
 pub struct ResponseExt {
     pub orchestrator: OrchestratorExt,
diff --git a/crates/trusted-server-core/src/publisher.rs b/crates/trusted-server-core/src/publisher.rs
index 85abef61..942e014f 100644
--- a/crates/trusted-server-core/src/publisher.rs
+++ b/crates/trusted-server-core/src/publisher.rs
@@ -1537,6 +1537,7 @@ pub async fn handle_publisher_request(
 
     log::debug!("Proxying request to configured publisher backend");
 
+    let request_path_and_query = origin_path_and_query.to_string();
     let request_path = req.uri().path().to_string();
     let is_get = req.method() == http::Method::GET;
 
@@ -1620,7 +1621,7 @@ pub async fn handle_publisher_request(
         if should_run_auction {
             let slots_ctx = MatchedSlotsContext {
                 matched_slots: &matched_slots,
-                request_path: &request_path,
+                request_path_and_query: &request_path_and_query,
             };
             let mut auction_request = build_auction_request(
                 &slots_ctx,
@@ -1930,11 +1931,11 @@ pub async fn handle_publisher_request(
 /// Bundle of the per-request creative-opportunity inputs that travel together.
 ///
 /// Extracted so `build_auction_request` stays under the project's
-/// 7-argument cap (`matched_slots` + `request_path` live for the same
+/// 7-argument cap (`matched_slots` + `request_path_and_query` live for the same
 /// request scope and are passed together everywhere).
 pub(crate) struct MatchedSlotsContext<'a> {
     pub matched_slots: &'a [crate::creative_opportunities::CreativeOpportunitySlot],
-    pub request_path: &'a str,
+    pub request_path_and_query: &'a str,
 }
 
 /// Borrowed inputs for [`apply_auction_eids_and_device`], bundled to keep the
@@ -2016,7 +2017,7 @@ pub(crate) fn build_auction_request(
         .collect();
     let page_url = format!(
         "{}://{}{}",
-        request_info.scheme, request_info.host, slots_ctx.request_path
+        request_info.scheme, request_info.host, slots_ctx.request_path_and_query
     );
     let ec_id = ec_id.filter(|id| !id.is_empty());
     let request_id = ec_id.map_or_else(
@@ -2096,10 +2097,14 @@ pub(crate) fn build_bid_map(
                     "hb_bidder".to_string(),
                     serde_json::Value::String(bid.bidder.clone()),
                 );
-                // hb_adid: use PBS Cache UUID when present — the Prebid Universal Creative uses
-                // this as the cache lookup key, NOT the OpenRTB bid ID (bid.ad_id). Fall back to
-                // bid.ad_id for APS and other non-PBS providers.
-                let hb_adid = bid.cache_id.as_deref().or(bid.ad_id.as_deref());
+                // PBS Cache remains highest priority. Renderer bids use the generic
+                // upstream bid ID; ordinary providers retain the ad-ID fallback.
+                let renderer_bid_id = bid.renderer.as_ref().and(bid.bid_id.as_deref());
+                let hb_adid = bid
+                    .cache_id
+                    .as_deref()
+                    .or(renderer_bid_id)
+                    .or(bid.ad_id.as_deref());
                 if let Some(id) = hb_adid {
                     obj.insert(
                         "hb_adid".to_string(),
@@ -2128,6 +2133,12 @@ pub(crate) fn build_bid_map(
                 if let Some(ref burl) = bid.burl {
                     obj.insert("burl".to_string(), serde_json::Value::String(burl.clone()));
                 }
+                if let Some(ref renderer) = bid.renderer {
+                    obj.insert(
+                        "renderer".to_string(),
+                        serde_json::to_value(renderer).expect("should serialize typed renderer"),
+                    );
+                }
                 // Include raw creative markup only for explicit debug injection.
                 // The pbRender bridge can use it while PBS Cache is unavailable.
                 if include_adm {
@@ -2147,7 +2158,9 @@ pub(crate) fn build_bid_map(
                             "height": bid.height,
                             "nurl": bid.nurl,
                             "burl": bid.burl,
+                            "bid_id": bid.bid_id,
                             "ad_id": bid.ad_id,
+                            "creative_id": bid.creative_id,
                             "cache_id": bid.cache_id,
                             "cache_host": bid.cache_host,
                             "cache_path": bid.cache_path,
@@ -2316,8 +2329,8 @@ pub fn page_bids_preflight_denied() -> Response<EdgeBody> {
 
 /// Normalizes the client-supplied `path` query parameter before glob matching.
 ///
-/// The SPA hook sends `location.pathname`, but the parameter is
-/// client-controlled: strip any query string or fragment and force a leading
+/// The SPA hook sends `location.pathname + location.search`, but the parameter
+/// is client-controlled: strip any query string or fragment and force a leading
 /// `/` so slot `page_patterns` always match against a canonical path shape.
 fn normalize_page_bids_path(raw: &str) -> String {
     let path = raw.split(['?', '#']).next().unwrap_or("");
@@ -2328,6 +2341,20 @@ fn normalize_page_bids_path(raw: &str) -> String {
     }
 }
 
+/// Normalize the page path and query retained in the upstream auction context.
+///
+/// Fragments never reach an HTTP server and are discarded if a client includes
+/// one explicitly. Unlike [`normalize_page_bids_path`], the query is preserved
+/// for the `OpenRTB` `site.page` URL and is not used for slot matching.
+fn normalize_page_bids_path_and_query(raw: &str) -> String {
+    let path_and_query = raw.split('#').next().unwrap_or("");
+    if path_and_query.starts_with('/') {
+        path_and_query.to_string()
+    } else {
+        format!("/{path_and_query}")
+    }
+}
+
 /// Handle `GET /__ts/page-bids?path=<path>` — server-side auction for SPA navigation.
 ///
 /// Matches creative opportunity slots for the given path, runs a server-side
@@ -2368,15 +2395,17 @@ pub async fn handle_page_bids(
         return Ok(page_bids_preflight_denied());
     }
 
-    let path_param = req
+    let requested_page = req
         .uri()
         .query()
         .and_then(|query| {
             url::form_urlencoded::parse(query.as_bytes())
-                .find(|(k, _)| k == "path")
-                .map(|(_, v)| normalize_page_bids_path(&v))
+                .find(|(key, _)| key == "path")
+                .map(|(_, value)| value.into_owned())
         })
         .unwrap_or_else(|| "/".to_string());
+    let path_param = normalize_page_bids_path(&requested_page);
+    let page_path_and_query = normalize_page_bids_path_and_query(&requested_page);
 
     let matched_slots: Vec<_> =
         crate::creative_opportunities::match_slots(auction.slots, &path_param)
@@ -2439,7 +2468,7 @@ pub async fn handle_page_bids(
         if ad_stack_enabled && !is_bot && !is_prefetch {
             let slots_ctx = MatchedSlotsContext {
                 matched_slots: &matched_slots,
-                request_path: &path_param,
+                request_path_and_query: &page_path_and_query,
             };
             let mut auction_request = build_auction_request(
                 &slots_ctx,
@@ -2611,7 +2640,10 @@ mod tests {
             height: 250,
             nurl: None,
             burl: None,
+            bid_id: None,
             ad_id: None,
+            creative_id: None,
+            renderer: None,
             cache_id: None,
             cache_host: None,
             cache_path: None,
@@ -4246,7 +4278,7 @@ mod tests {
             MatchedSlotsContext, build_ad_slots_script, build_auction_request, build_bid_map,
             build_bids_script, html_escape_for_script,
         };
-        use crate::auction::types::{Bid, MediaType};
+        use crate::auction::types::{ApsRendererV1, ApsTagType, Bid, BidRenderer, MediaType};
         use crate::consent::ConsentContext;
         use crate::creative_opportunities::{
             CreativeOpportunitiesConfig, CreativeOpportunityFormat, CreativeOpportunitySlot,
@@ -4303,7 +4335,10 @@ mod tests {
                 height: 250,
                 nurl: Some(nurl.to_string()),
                 burl: Some(burl.to_string()),
+                bid_id: None,
                 ad_id: Some(ad_id.to_string()),
+                creative_id: None,
+                renderer: None,
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
@@ -4388,6 +4423,44 @@ mod tests {
             );
         }
 
+        #[test]
+        fn bid_map_exposes_aps_renderer_and_selected_bid_id_without_debug_adm() {
+            let mut bid = make_bid("atf_sidebar_ad", 1.50, "aps", "fallback-ad", "", "");
+            bid.bid_id = Some("selected-bid".to_string());
+            bid.renderer = Some(BidRenderer::Aps(ApsRendererV1 {
+                version: 1,
+                account_id: "example-account".to_string(),
+                bid_id: "selected-bid".to_string(),
+                creative_id: None,
+                tag_type: ApsTagType::Iframe,
+                creative_url: "https://creative.example/render".to_string(),
+                aax_response: "fictional-base64</script>".to_string(),
+                width: 300,
+                height: 250,
+            }));
+            bid.nurl = None;
+            bid.burl = None;
+            let winning_bids = HashMap::from([("atf_sidebar_ad".to_string(), bid)]);
+
+            let map = build_bid_map(&winning_bids, PriceGranularity::Dense, false);
+            let obj = map["atf_sidebar_ad"]
+                .as_object()
+                .expect("should include APS bid");
+
+            assert_eq!(obj["hb_bidder"], "aps");
+            assert_eq!(obj["hb_adid"], "selected-bid");
+            assert_eq!(obj["renderer"]["type"], "aps");
+            assert_eq!(obj["renderer"]["bidId"], "selected-bid");
+            assert!(obj.get("adm").is_none());
+            assert!(obj.get("nurl").is_none());
+            assert!(obj.get("burl").is_none());
+            assert!(obj.get("metadata").is_none());
+
+            let script = build_bids_script(&map);
+            assert!(!script.contains("</script></script>"));
+            assert!(script.contains("\\u003C/script\\u003E"));
+        }
+
         #[test]
         fn client_bid_map_omits_adm_by_default() {
             let mut winning_bids = HashMap::new();
@@ -4523,7 +4596,10 @@ mod tests {
                     height: 250,
                     nurl: None,
                     burl: None,
+                    bid_id: None,
                     ad_id: Some("bid-impression-id".to_string()),
+                    creative_id: None,
+                    renderer: None,
                     cache_id: Some("f47447a0-b759-4f2f-9887-af458b79b570".to_string()),
                     cache_host: Some("openads.adsrvr.org".to_string()),
                     cache_path: Some("/cache".to_string()),
@@ -4564,12 +4640,15 @@ mod tests {
                     currency: "USD".to_string(),
                     creative: None,
                     adomain: None,
-                    bidder: "amazon-aps".to_string(),
+                    bidder: "ordinary".to_string(),
                     width: 300,
                     height: 250,
                     nurl: None,
                     burl: None,
-                    ad_id: Some("aps-bid-token".to_string()),
+                    bid_id: None,
+                    ad_id: Some("ordinary-ad-id".to_string()),
+                    creative_id: None,
+                    renderer: None,
                     cache_id: None,
                     cache_host: None,
                     cache_path: None,
@@ -4584,7 +4663,7 @@ mod tests {
                 .expect("should be object");
             assert_eq!(
                 obj.get("hb_adid").and_then(|v| v.as_str()),
-                Some("aps-bid-token"),
+                Some("ordinary-ad-id"),
                 "should fall back to ad_id when cache_id absent"
             );
             assert!(
@@ -4608,12 +4687,15 @@ mod tests {
                     currency: "USD".to_string(),
                     creative: None,
                     adomain: None,
-                    bidder: "amazon-aps".to_string(),
+                    bidder: "ordinary".to_string(),
                     width: 300,
                     height: 250,
                     nurl: None,
                     burl: None,
+                    bid_id: None,
                     ad_id: None,
+                    creative_id: None,
+                    renderer: None,
                     cache_id: None,
                     cache_host: None,
                     cache_path: None,
@@ -4648,7 +4730,10 @@ mod tests {
                     height: 250,
                     nurl: None,
                     burl: None,
+                    bid_id: None,
                     ad_id: None,
+                    creative_id: None,
+                    renderer: None,
                     cache_id: None,
                     cache_host: None,
                     cache_path: None,
@@ -4701,7 +4786,7 @@ mod tests {
             let slots = [slot];
             let slots_ctx = MatchedSlotsContext {
                 matched_slots: &slots,
-                request_path: "/2024/01/my-article/",
+                request_path_and_query: "/2024/01/my-article/?edition=fictional",
             };
             let request_info = RequestInfo {
                 host: "publisher.example.com".to_string(),
@@ -4722,6 +4807,11 @@ mod tests {
                 "should use a non-EC request id, got {}",
                 request.id
             );
+            assert_eq!(
+                request.publisher.page_url.as_deref(),
+                Some("https://publisher.example.com/2024/01/my-article/?edition=fictional"),
+                "should preserve the page path and query for auction providers"
+            );
         }
 
         #[test]
@@ -4730,7 +4820,7 @@ mod tests {
             let slots = [slot];
             let slots_ctx = MatchedSlotsContext {
                 matched_slots: &slots,
-                request_path: "/2024/01/my-article/",
+                request_path_and_query: "/2024/01/my-article/",
             };
             let request_info = RequestInfo {
                 host: "publisher.example.com".to_string(),
@@ -5160,6 +5250,20 @@ mod tests {
             );
         }
 
+        #[test]
+        fn normalize_page_bids_path_and_query_preserves_query_but_drops_fragment() {
+            assert_eq!(
+                normalize_page_bids_path_and_query("/2024/01/article/?edition=fictional#section"),
+                "/2024/01/article/?edition=fictional",
+                "query should reach auction providers without a browser-only fragment"
+            );
+            assert_eq!(
+                normalize_page_bids_path_and_query("2024/01/article/?edition=fictional"),
+                "/2024/01/article/?edition=fictional",
+                "missing leading slash should be added"
+            );
+        }
+
         #[tokio::test]
         async fn disabled_auction_returns_no_slots_or_bids() {
             // [auction].enabled = false is a global kill switch: it must disable
diff --git a/crates/trusted-server-integration-tests/README.md b/crates/trusted-server-integration-tests/README.md
index e7263755..1aa43cee 100644
--- a/crates/trusted-server-integration-tests/README.md
+++ b/crates/trusted-server-integration-tests/README.md
@@ -142,6 +142,7 @@ Playwright directly.
 |---|---|
 | `script-injection` | `script#trustedserver-js` present in live DOM, no console errors |
 | `script-bundle` | JS bundle loads with 200, no parse/runtime errors, correct content type |
+| `aps-renderer` | Static route nonce gating, restrictive CSP, replay rejection, and opaque iframe/script isolation |
 
 ### Browser-level — Next.js
 
diff --git a/crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts b/crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts
new file mode 100644
index 00000000..5424250c
--- /dev/null
+++ b/crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts
@@ -0,0 +1,937 @@
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { expect, test } from "@playwright/test";
+import { runtimeUrl } from "../../helpers/state.js";
+
+const RUNNER_URL = "https://client.aps.amazon-adsystem.com/prebid-creative.js";
+const IFRAME_CREATIVE_URL = "https://creative.example/iframe";
+const SCRIPT_CREATIVE_URL = "https://creative.example/script.js";
+const SANDBOX =
+    "allow-forms allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-scripts allow-top-navigation-by-user-activation";
+const TSJS_CRATE = resolve(__dirname, "../../../../trusted-server-js");
+
+function clientAuctionBundlePaths() {
+    const manifestPath = resolve(TSJS_CRATE, "dist/prebid/manifest.json");
+    const manifest = JSON.parse(readFileSync(manifestPath, "utf8")) as {
+        filename: string;
+    };
+    return {
+        core: resolve(TSJS_CRATE, "dist/tsjs-core.js"),
+        gpt: resolve(TSJS_CRATE, "dist/tsjs-gpt.js"),
+        prebid: resolve(TSJS_CRATE, "dist/prebid", manifest.filename),
+    };
+}
+
+function descriptor(
+    tagType: "iframe" | "script",
+    creativeUrl = tagType === "iframe"
+        ? IFRAME_CREATIVE_URL
+        : SCRIPT_CREATIVE_URL,
+) {
+    const envelope = {
+        seatbid: [
+            {
+                bid: [
+                    {
+                        id: `fictional-${tagType}-bid`,
+                        price: 1.23,
+                        w: 300,
+                        h: 250,
+                        ext: { creativeurl: creativeUrl, tagtype: tagType },
+                    },
+                ],
+            },
+        ],
+    };
+    return {
+        type: "aps",
+        version: 1,
+        accountId: "example-account-id",
+        bidId: `fictional-${tagType}-bid`,
+        creativeId: `fictional-${tagType}-creative`,
+        tagType,
+        creativeUrl,
+        aaxResponse: Buffer.from(JSON.stringify(envelope), "utf8").toString(
+            "base64",
+        ),
+        width: 300,
+        height: 250,
+    };
+}
+
+function testPage(rendererUrl: string) {
+    return `<!doctype html>
+<meta charset="utf-8">
+<div id="slots"></div>
+<script>
+window.apsMessages = [];
+window.startApsFrame = function(options) {
+  var slot = document.createElement('div');
+  slot.id = options.slotId;
+  slot.innerHTML = '<span class="existing">existing publisher content</span>';
+  document.getElementById('slots').appendChild(slot);
+
+  var frame = document.createElement('iframe');
+  frame.width = '300';
+  frame.height = '250';
+  frame.style.display = 'none';
+  if (!options.omitSandbox) {
+    frame.setAttribute('sandbox', ${JSON.stringify(SANDBOX)});
+  }
+  frame.src = ${JSON.stringify(rendererUrl)} +
+    (options.includeFragment === false ? '' : '#tsaps=' + options.fragmentNonce);
+
+  function receive(event) {
+    if (event.source !== frame.contentWindow || !event.data) return;
+    window.apsMessages.push({ slotId: options.slotId, data: event.data });
+    if (event.data.message === 'trusted-server/aps/renderer-ready' &&
+        event.data.nonce === options.fragmentNonce) {
+      var existing = slot.querySelector('.existing');
+      if (existing) existing.remove();
+      frame.style.display = '';
+    }
+  }
+  window.addEventListener('message', receive);
+  frame.onload = function() {
+    frame.contentWindow.postMessage({
+      nonce: options.messageNonce,
+      renderer: options.renderer
+    }, '*');
+  };
+  slot.appendChild(frame);
+};
+</script>`;
+}
+
+const FAKE_RUNNER = `(function(){
+  var runnerRead = false;
+  var runnerWrite = false;
+  try { void top.document.body; runnerRead = true; } catch (_error) {}
+  try { top.document.body.dataset.apsCompromised = 'runner'; runnerWrite = true; } catch (_error) {}
+  parent.postMessage({
+    message: 'fictional-runner-security',
+    runnerRead: runnerRead,
+    runnerWrite: runnerWrite,
+    accountMap: window._aps instanceof Map
+  }, '*');
+
+  addEventListener('message', function(event) {
+    if (event.data && event.data.message === 'fictional-creative-security') {
+      parent.postMessage(event.data, '*');
+    }
+  });
+
+  window._aps.forEach(function(account) {
+    var events = account.queue.splice(0);
+    events.forEach(function(event) {
+      var response = JSON.parse(atob(event.detail.aaxResponse));
+      var bid = response.seatbid[0].bid[0];
+      if (bid.ext.tagtype === 'iframe') {
+        var frame = document.createElement('iframe');
+        frame.setAttribute('sandbox', 'allow-scripts allow-same-origin');
+        frame.src = bid.ext.creativeurl;
+        document.body.appendChild(frame);
+      } else {
+        var script = document.createElement('script');
+        script.src = bid.ext.creativeurl;
+        document.head.appendChild(script);
+      }
+    });
+  });
+})();`;
+
+const IFRAME_CREATIVE = `<!doctype html><script>
+var creativeRead = false;
+var creativeWrite = false;
+try { void top.document.body; creativeRead = true; } catch (_error) {}
+try { top.document.body.dataset.apsCompromised = 'iframe'; creativeWrite = true; } catch (_error) {}
+parent.postMessage({
+  message: 'fictional-creative-security',
+  tagType: 'iframe',
+  creativeRead: creativeRead,
+  creativeWrite: creativeWrite
+}, '*');
+<\/script>`;
+
+const SCRIPT_CREATIVE = `(function(){
+  var creativeRead = false;
+  var creativeWrite = false;
+  try { void top.document.body; creativeRead = true; } catch (_error) {}
+  try { top.document.body.dataset.apsCompromised = 'script'; creativeWrite = true; } catch (_error) {}
+  parent.postMessage({
+    message: 'fictional-creative-security',
+    tagType: 'script',
+    creativeRead: creativeRead,
+    creativeWrite: creativeWrite
+  }, '*');
+})();`;
+
+test.describe("APS opaque renderer", () => {
+    test("renders a trustedServer adapter bid using Prebid's generated GAM ad ID", async ({
+        page,
+    }) => {
+        const apsRenderer = descriptor("iframe");
+        const responseBody = {
+            id: "fictional-auction",
+            seatbid: [
+                {
+                    seat: "aps",
+                    bid: [
+                        {
+                            id: apsRenderer.bidId,
+                            impid: "div-aps",
+                            price: 1.23,
+                            crid: apsRenderer.creativeId,
+                            w: 300,
+                            h: 250,
+                            ext: {
+                                trusted_server: { renderer: apsRenderer },
+                            },
+                        },
+                    ],
+                },
+            ],
+            ext: {},
+        };
+        let auctionRequests = 0;
+        await page.route(runtimeUrl("/aps-prebid-adapter-test"), (route) =>
+            route.fulfill({
+                status: 200,
+                contentType: "text/html",
+                body: '<!doctype html><div id="div-aps"></div><div id="div-other"></div>',
+            }),
+        );
+        await page.route(runtimeUrl("/auction"), (route) => {
+            auctionRequests += 1;
+            return route.fulfill({
+                status: 200,
+                contentType: "application/json",
+                body: JSON.stringify(responseBody),
+            });
+        });
+
+        await page.goto(runtimeUrl("/aps-prebid-adapter-test"));
+        const bundles = clientAuctionBundlePaths();
+        await page.addScriptTag({ path: bundles.gpt });
+        await page.addScriptTag({ path: bundles.prebid });
+
+        const result = await page.evaluate(async () => {
+            type PrebidBid = {
+                ad?: string;
+                adId: string;
+                bidderCode: string;
+                status?: string;
+            };
+            type PrebidApi = {
+                getAllWinningBids(): PrebidBid[];
+                getBidResponsesForAdUnitCode(code: string): {
+                    bids: PrebidBid[];
+                };
+                onEvent(
+                    name: string,
+                    callback: (value: Record<string, unknown>) => void,
+                ): void;
+                requestBids(options: Record<string, unknown>): void;
+            };
+            const pbjs = (window as unknown as { pbjs: PrebidApi }).pbjs;
+            const bidWon: string[] = [];
+            const renderSucceeded: string[] = [];
+            pbjs.onEvent("bidWon", (bid) => bidWon.push(String(bid.adId)));
+            pbjs.onEvent("adRenderSucceeded", (event) =>
+                renderSucceeded.push(String(event.adId)),
+            );
+
+            const acceptedBid = await new Promise<PrebidBid | undefined>(
+                (resolveBid) => {
+                    pbjs.requestBids({
+                        adUnits: [
+                            {
+                                code: "div-aps",
+                                mediaTypes: { banner: { sizes: [[300, 250]] } },
+                                bids: [],
+                            },
+                        ],
+                        bidsBackHandler: () =>
+                            resolveBid(
+                                pbjs
+                                    .getBidResponsesForAdUnitCode("div-aps")
+                                    .bids.find(
+                                        (bid) => bid.bidderCode === "aps",
+                                    ),
+                            ),
+                        timeout: 1_000,
+                    });
+                },
+            );
+            if (!acceptedBid)
+                throw new Error("APS bid was not accepted by Prebid");
+
+            const foreignUniversalCreativeResponse = await new Promise<
+                Record<string, unknown> | undefined
+            >((resolveResponse) => {
+                const frame = document.createElement("iframe");
+                const adIdJson = JSON.stringify(acceptedBid.adId);
+                frame.srcdoc = `<script>
+const renderChannel = new MessageChannel();
+renderChannel.port1.onmessage = function(event) {
+  parent.postMessage({ type: 'captured-foreign-prebid-response', payload: event.data }, '*');
+};
+parent.postMessage(JSON.stringify({
+  message: 'Prebid Request',
+  adId: ${adIdJson}
+}), '*', [renderChannel.port2]);
+<\/script>`;
+                let timeout = 0;
+                const receive = (event: MessageEvent) => {
+                    if (event.data?.type !== "captured-foreign-prebid-response")
+                        return;
+                    window.removeEventListener("message", receive);
+                    window.clearTimeout(timeout);
+                    resolveResponse(JSON.parse(String(event.data.payload)));
+                };
+                window.addEventListener("message", receive);
+                document.getElementById("div-other")!.appendChild(frame);
+                timeout = window.setTimeout(() => {
+                    window.removeEventListener("message", receive);
+                    resolveResponse(undefined);
+                }, 200);
+            });
+
+            const universalCreativeResponse = await new Promise<
+                Record<string, unknown>
+            >((resolveResponse, rejectResponse) => {
+                const frame = document.createElement("iframe");
+                const adIdJson = JSON.stringify(acceptedBid.adId);
+                frame.srcdoc = `<script>
+const renderChannel = new MessageChannel();
+renderChannel.port1.onmessage = function(event) {
+  parent.postMessage({ type: 'captured-prebid-response', payload: event.data }, '*');
+  const eventChannel = new MessageChannel();
+  parent.postMessage(JSON.stringify({
+    message: 'Prebid Event',
+    adId: ${adIdJson},
+    event: 'adRenderSucceeded'
+  }), '*', [eventChannel.port2]);
+};
+parent.postMessage(JSON.stringify({
+  message: 'Prebid Request',
+  adId: ${adIdJson}
+}), '*', [renderChannel.port2]);
+<\/script>`;
+                const receive = (event: MessageEvent) => {
+                    if (event.data?.type !== "captured-prebid-response") return;
+                    window.removeEventListener("message", receive);
+                    resolveResponse(JSON.parse(String(event.data.payload)));
+                };
+                window.addEventListener("message", receive);
+                document.getElementById("div-aps")!.appendChild(frame);
+                window.setTimeout(
+                    () =>
+                        rejectResponse(
+                            new Error("Universal Creative response timed out"),
+                        ),
+                    3_000,
+                );
+            });
+            await new Promise((resolveTick) =>
+                window.setTimeout(resolveTick, 50),
+            );
+
+            return {
+                acceptedAd: acceptedBid.ad,
+                acceptedAdId: acceptedBid.adId,
+                acceptedStatus: acceptedBid.status,
+                bidWon,
+                foreignUniversalCreativeResponse,
+                renderSucceeded,
+                universalCreativeResponse,
+                winningAdIds: pbjs.getAllWinningBids().map((bid) => bid.adId),
+                registrySize: Object.keys(
+                    (
+                        window as unknown as {
+                            tsjs?: {
+                                apsPrebidRenderers?: Record<string, unknown>;
+                            };
+                        }
+                    ).tsjs?.apsPrebidRenderers ?? {},
+                ).length,
+            };
+        });
+
+        expect(auctionRequests).toBe(1);
+        expect(result.acceptedAd).toBe("");
+        expect(result.acceptedAdId).not.toBe(apsRenderer.bidId);
+        expect(result.foreignUniversalCreativeResponse).not.toEqual(
+            expect.objectContaining({ apsRenderer }),
+        );
+        expect(result.universalCreativeResponse).toEqual(
+            expect.objectContaining({
+                message: "Prebid Response",
+                adId: result.acceptedAdId,
+                rendererVersion: 4,
+                apsRenderer,
+            }),
+        );
+        expect(result.bidWon).toEqual([result.acceptedAdId]);
+        expect(result.renderSucceeded).toEqual([result.acceptedAdId]);
+        expect(result.winningAdIds).toContain(result.acceptedAdId);
+        expect(result.acceptedStatus).toBe("rendered");
+        expect(result.registrySize).toBe(0);
+    });
+
+    test("enforces nonce gating and isolates iframe and script behavior under restrictive CSP", async ({
+        page,
+    }) => {
+        const rendererResponse = await page.request.get(
+            runtimeUrl("/integrations/aps/renderer"),
+        );
+        expect(rendererResponse.status()).toBe(200);
+        expect(rendererResponse.headers()["content-type"]).toContain(
+            "text/html",
+        );
+        const rendererCsp =
+            rendererResponse.headers()["content-security-policy"];
+        expect(rendererCsp).toContain("default-src 'none'");
+        expect(rendererCsp).toContain("sandbox allow-forms");
+        expect(rendererCsp).not.toContain("allow-same-origin");
+        expect(rendererResponse.headers()["referrer-policy"]).toBe(
+            "no-referrer",
+        );
+
+        let runnerRequests = 0;
+        await page.route(RUNNER_URL, async (route) => {
+            runnerRequests += 1;
+            await route.fulfill({
+                status: 200,
+                contentType: "application/javascript",
+                body: FAKE_RUNNER,
+            });
+        });
+        await page.route(IFRAME_CREATIVE_URL, async (route) => {
+            await route.fulfill({
+                status: 200,
+                contentType: "text/html",
+                body: IFRAME_CREATIVE,
+            });
+        });
+        await page.route(SCRIPT_CREATIVE_URL, async (route) => {
+            await route.fulfill({
+                status: 200,
+                contentType: "application/javascript",
+                body: SCRIPT_CREATIVE,
+            });
+        });
+        await page.route(runtimeUrl("/aps-security-test"), async (route) => {
+            await route.fulfill({
+                status: 200,
+                contentType: "text/html",
+                headers: {
+                    "Content-Security-Policy":
+                        "default-src 'none'; script-src 'unsafe-inline'; frame-src 'self'",
+                },
+                body: testPage(runtimeUrl("/integrations/aps/renderer")),
+            });
+        });
+
+        await page.goto(runtimeUrl("/aps-security-test"));
+
+        const validNonce = "ABCDEFGHIJKLMNOPQRSTUV";
+        await page.evaluate(
+            ({ renderer, nonce }) => {
+                (
+                    window as unknown as {
+                        startApsFrame(options: Record<string, unknown>): void;
+                    }
+                ).startApsFrame({
+                    slotId: "iframe-slot",
+                    fragmentNonce: nonce,
+                    messageNonce: nonce,
+                    renderer,
+                });
+            },
+            { renderer: descriptor("iframe"), nonce: validNonce },
+        );
+
+        await expect
+            .poll(async () =>
+                page.evaluate(() =>
+                    (
+                        window as unknown as {
+                            apsMessages: Array<{ data: { message?: string } }>;
+                        }
+                    ).apsMessages.some(
+                        ({ data }) =>
+                            data.message === "fictional-creative-security",
+                    ),
+                ),
+            )
+            .toBe(true);
+        await expect(page.locator("#iframe-slot .existing")).toHaveCount(0);
+
+        const validState = await page.evaluate(() => {
+            const frame = document.querySelector<HTMLIFrameElement>(
+                "#iframe-slot iframe",
+            )!;
+            const messages = (
+                window as unknown as {
+                    apsMessages: Array<{ data: Record<string, unknown> }>;
+                }
+            ).apsMessages.map(({ data }) => data);
+            let publisherCanReadFrame = false;
+            try {
+                publisherCanReadFrame = Boolean(
+                    frame.contentWindow?.document.body,
+                );
+            } catch (_error) {
+                publisherCanReadFrame = false;
+            }
+            return {
+                existing: Boolean(
+                    document.querySelector("#iframe-slot .existing"),
+                ),
+                sandbox: frame.getAttribute("sandbox"),
+                publisherCanReadFrame,
+                compromised: document.body.dataset.apsCompromised,
+                messages,
+            };
+        });
+
+        expect(validState.existing).toBe(false);
+        expect(validState.sandbox).toBe(SANDBOX);
+        expect(validState.sandbox).not.toContain("allow-same-origin");
+        expect(validState.publisherCanReadFrame).toBe(false);
+        expect(validState.compromised).toBeUndefined();
+        expect(validState.messages).toContainEqual(
+            expect.objectContaining({
+                message: "fictional-runner-security",
+                runnerRead: false,
+                runnerWrite: false,
+                accountMap: true,
+            }),
+        );
+        expect(validState.messages).toContainEqual(
+            expect.objectContaining({
+                message: "fictional-creative-security",
+                tagType: "iframe",
+                creativeRead: false,
+                creativeWrite: false,
+            }),
+        );
+
+        const cspNonce = "csp-sandbox-0123456789";
+        await page.evaluate(
+            ({ renderer, nonce }) => {
+                (
+                    window as unknown as {
+                        startApsFrame(options: Record<string, unknown>): void;
+                    }
+                ).startApsFrame({
+                    slotId: "csp-sandbox-slot",
+                    fragmentNonce: nonce,
+                    messageNonce: nonce,
+                    omitSandbox: true,
+                    renderer,
+                });
+            },
+            { renderer: descriptor("script"), nonce: cspNonce },
+        );
+        await expect
+            .poll(async () =>
+                page.evaluate(() =>
+                    (
+                        window as unknown as {
+                            apsMessages: Array<{
+                                slotId: string;
+                                data: Record<string, unknown>;
+                            }>;
+                        }
+                    ).apsMessages.some(
+                        ({ slotId, data }) =>
+                            slotId === "csp-sandbox-slot" &&
+                            data.message === "fictional-creative-security" &&
+                            data.tagType === "script",
+                    ),
+                ),
+            )
+            .toBe(true);
+        await expect(page.locator("#csp-sandbox-slot .existing")).toHaveCount(
+            0,
+        );
+        const cspState = await page.evaluate(() => {
+            const frame = document.querySelector<HTMLIFrameElement>(
+                "#csp-sandbox-slot iframe",
+            )!;
+            let publisherCanReadFrame = false;
+            try {
+                publisherCanReadFrame = Boolean(
+                    frame.contentWindow?.document.body,
+                );
+            } catch (_error) {
+                publisherCanReadFrame = false;
+            }
+            return {
+                sandbox: frame.getAttribute("sandbox"),
+                existing: Boolean(
+                    document.querySelector("#csp-sandbox-slot .existing"),
+                ),
+                publisherCanReadFrame,
+                compromised: document.body.dataset.apsCompromised,
+                messages: (
+                    window as unknown as {
+                        apsMessages: Array<{
+                            slotId: string;
+                            data: Record<string, unknown>;
+                        }>;
+                    }
+                ).apsMessages
+                    .filter(({ slotId }) => slotId === "csp-sandbox-slot")
+                    .map(({ data }) => data),
+            };
+        });
+        expect(cspState.sandbox).toBeNull();
+        expect(cspState.existing).toBe(false);
+        expect(cspState.publisherCanReadFrame).toBe(false);
+        expect(cspState.compromised).toBeUndefined();
+        expect(cspState.messages).toContainEqual(
+            expect.objectContaining({
+                message: "fictional-runner-security",
+                runnerRead: false,
+                runnerWrite: false,
+            }),
+        );
+        expect(cspState.messages).toContainEqual(
+            expect.objectContaining({
+                message: "fictional-creative-security",
+                tagType: "script",
+                creativeRead: false,
+                creativeWrite: false,
+            }),
+        );
+
+        const messagesBeforeReplay = await page.evaluate(
+            () =>
+                (
+                    window as unknown as {
+                        apsMessages: Array<{ data: Record<string, unknown> }>;
+                    }
+                ).apsMessages.length,
+        );
+        await page.evaluate(
+            ({ renderer, nonce }) => {
+                const frame = document.querySelector<HTMLIFrameElement>(
+                    "#iframe-slot iframe",
+                )!;
+                frame.contentWindow!.postMessage({ nonce, renderer }, "*");
+            },
+            { renderer: descriptor("iframe"), nonce: validNonce },
+        );
+        await page.waitForTimeout(100);
+        expect(
+            await page.evaluate(
+                () =>
+                    (
+                        window as unknown as {
+                            apsMessages: Array<{
+                                data: Record<string, unknown>;
+                            }>;
+                        }
+                    ).apsMessages.length,
+            ),
+        ).toBe(messagesBeforeReplay);
+
+        const requestsBeforeInvalid = runnerRequests;
+        const wrongNonce = "ZYXWVUTSRQPONMLKJIHGFE";
+        await page.evaluate(
+            ({ renderer, fragmentNonce, messageNonce }) => {
+                (
+                    window as unknown as {
+                        startApsFrame(options: Record<string, unknown>): void;
+                    }
+                ).startApsFrame({
+                    slotId: "mismatch-slot",
+                    fragmentNonce,
+                    messageNonce,
+                    renderer,
+                });
+            },
+            {
+                renderer: descriptor("iframe"),
+                fragmentNonce: validNonce,
+                messageNonce: wrongNonce,
+            },
+        );
+        await page.waitForTimeout(100);
+        expect(runnerRequests).toBe(requestsBeforeInvalid);
+        await expect(page.locator("#mismatch-slot .existing")).toHaveCount(1);
+
+        await page.evaluate(
+            ({ renderer, nonce }) => {
+                (
+                    window as unknown as {
+                        startApsFrame(options: Record<string, unknown>): void;
+                    }
+                ).startApsFrame({
+                    slotId: "missing-fragment-slot",
+                    fragmentNonce: nonce,
+                    messageNonce: nonce,
+                    includeFragment: false,
+                    renderer,
+                });
+            },
+            { renderer: descriptor("iframe"), nonce: validNonce },
+        );
+        await page.waitForTimeout(100);
+        expect(runnerRequests).toBe(requestsBeforeInvalid);
+        await expect(
+            page.locator("#missing-fragment-slot .existing"),
+        ).toHaveCount(1);
+
+        await page.evaluate(
+            ({ renderer, nonce }) => {
+                (
+                    window as unknown as {
+                        startApsFrame(options: Record<string, unknown>): void;
+                    }
+                ).startApsFrame({
+                    slotId: "malformed-slot",
+                    fragmentNonce: nonce,
+                    messageNonce: nonce,
+                    renderer: { ...renderer, unexpected: true },
+                });
+            },
+            { renderer: descriptor("iframe"), nonce: wrongNonce },
+        );
+        await page.waitForTimeout(100);
+        expect(runnerRequests).toBe(requestsBeforeInvalid);
+        await expect(page.locator("#malformed-slot .existing")).toHaveCount(1);
+
+        const scriptNonce = "0123456789abcdefghijkl";
+        await page.evaluate(
+            ({ renderer, nonce }) => {
+                (
+                    window as unknown as {
+                        startApsFrame(options: Record<string, unknown>): void;
+                    }
+                ).startApsFrame({
+                    slotId: "script-slot",
+                    fragmentNonce: nonce,
+                    messageNonce: nonce,
+                    renderer,
+                });
+            },
+            { renderer: descriptor("script"), nonce: scriptNonce },
+        );
+
+        await expect
+            .poll(async () =>
+                page.evaluate(() =>
+                    (
+                        window as unknown as {
+                            apsMessages: Array<{
+                                data: Record<string, unknown>;
+                            }>;
+                        }
+                    ).apsMessages.some(
+                        ({ data }) =>
+                            data.message === "fictional-creative-security" &&
+                            data.tagType === "script",
+                    ),
+                ),
+            )
+            .toBe(true);
+        await expect(page.locator("#script-slot .existing")).toHaveCount(0);
+
+        const scriptState = await page.evaluate(() => ({
+            existing: Boolean(document.querySelector("#script-slot .existing")),
+            compromised: document.body.dataset.apsCompromised,
+            scriptSecurity: (
+                window as unknown as {
+                    apsMessages: Array<{ data: Record<string, unknown> }>;
+                }
+            ).apsMessages.find(
+                ({ data }) =>
+                    data.message === "fictional-creative-security" &&
+                    data.tagType === "script",
+            )?.data,
+        }));
+        expect(scriptState.existing).toBe(false);
+        expect(scriptState.compromised).toBeUndefined();
+        expect(scriptState.scriptSecurity).toEqual(
+            expect.objectContaining({
+                creativeRead: false,
+                creativeWrite: false,
+            }),
+        );
+    });
+
+    test("rejects same-origin creative URLs through the TSJS rendering path", async ({
+        page,
+    }) => {
+        const publisherOrigin = "https://publisher.example";
+        const rendererUrl = `${publisherOrigin}/integrations/aps/renderer`;
+        const auctionUrl = `${publisherOrigin}/auction`;
+        const testUrl = `${publisherOrigin}/aps-same-origin-test`;
+        const runtimeRenderer = await page.request.get(
+            runtimeUrl("/integrations/aps/renderer"),
+        );
+        const rendererDocument = await runtimeRenderer.text();
+        let creativeUrl = SCRIPT_CREATIVE_URL;
+        let runnerRequests = 0;
+
+        await page.route(RUNNER_URL, async (route) => {
+            runnerRequests += 1;
+            await route.fulfill({
+                status: 200,
+                contentType: "application/javascript",
+                body: FAKE_RUNNER,
+            });
+        });
+        await page.route(rendererUrl, async (route) => {
+            await route.fulfill({
+                status: 200,
+                contentType: "text/html",
+                headers: {
+                    "Content-Security-Policy":
+                        runtimeRenderer.headers()["content-security-policy"],
+                    "Referrer-Policy": "no-referrer",
+                },
+                body: rendererDocument,
+            });
+        });
+        await page.route(auctionUrl, async (route) => {
+            const renderer = descriptor("script", creativeUrl);
+            await route.fulfill({
+                status: 200,
+                contentType: "application/json",
+                body: JSON.stringify({
+                    id: "fictional-auction",
+                    seatbid: [
+                        {
+                            seat: "aps",
+                            bid: [
+                                {
+                                    id: renderer.bidId,
+                                    impid: "same-origin-slot",
+                                    price: 1.23,
+                                    w: 300,
+                                    h: 250,
+                                    ext: {
+                                        trusted_server: { renderer },
+                                    },
+                                },
+                            ],
+                        },
+                    ],
+                    ext: {},
+                }),
+            });
+        });
+        await page.route(testUrl, async (route) => {
+            await route.fulfill({
+                status: 200,
+                contentType: "text/html",
+                headers: {
+                    "Content-Security-Policy":
+                        "default-src 'none'; script-src 'unsafe-inline'; connect-src 'self'; frame-src 'self'",
+                },
+                body: '<!doctype html><div id="same-origin-slot"><span class="existing">existing publisher content</span></div>',
+            });
+        });
+
+        await page.goto(testUrl);
+        await page.addScriptTag({ path: clientAuctionBundlePaths().core });
+        await page.evaluate(() => {
+            const tsjs = (
+                window as unknown as {
+                    tsjs: {
+                        addAdUnits(units: Array<Record<string, unknown>>): void;
+                        log: {
+                            info(message: string, ...args: unknown[]): void;
+                        };
+                        requestAds(): void;
+                    };
+                    auctionRenderCompletions?: number;
+                }
+            ).tsjs;
+            tsjs.addAdUnits([
+                {
+                    code: "same-origin-slot",
+                    mediaTypes: { banner: { sizes: [[300, 250]] } },
+                    bids: [],
+                },
+            ]);
+            const originalInfo = tsjs.log.info.bind(tsjs.log);
+            tsjs.log.info = (message: string, ...args: unknown[]) => {
+                if (
+                    message === "requestAds: rendered creatives from response"
+                ) {
+                    (
+                        window as unknown as {
+                            auctionRenderCompletions: number;
+                        }
+                    ).auctionRenderCompletions += 1;
+                }
+                originalInfo(message, ...args);
+            };
+            (
+                window as unknown as {
+                    auctionRenderCompletions: number;
+                }
+            ).auctionRenderCompletions = 0;
+            tsjs.requestAds();
+        });
+
+        await expect.poll(() => runnerRequests).toBe(1);
+        await expect
+            .poll(() =>
+                page.evaluate(
+                    () =>
+                        (
+                            window as unknown as {
+                                auctionRenderCompletions: number;
+                            }
+                        ).auctionRenderCompletions,
+                ),
+            )
+            .toBe(1);
+        await expect(page.locator("#same-origin-slot .existing")).toHaveCount(
+            0,
+        );
+        const productSandbox = await page
+            .locator("#same-origin-slot > iframe")
+            .getAttribute("sandbox");
+        expect(productSandbox).toBe(SANDBOX);
+        expect(productSandbox).not.toContain("allow-same-origin");
+
+        creativeUrl = `${publisherOrigin}/fictional-same-origin.js`;
+        await page.locator("#same-origin-slot").evaluate((slot) => {
+            slot.innerHTML =
+                '<span class="existing">existing publisher content</span>';
+        });
+        await page.evaluate(() => {
+            (
+                window as unknown as {
+                    tsjs: { requestAds(): void };
+                }
+            ).tsjs.requestAds();
+        });
+
+        await expect
+            .poll(() =>
+                page.evaluate(
+                    () =>
+                        (
+                            window as unknown as {
+                                auctionRenderCompletions: number;
+                            }
+                        ).auctionRenderCompletions,
+                ),
+            )
+            .toBe(2);
+        expect(runnerRequests).toBe(1);
+        await expect(page.locator("#same-origin-slot iframe")).toHaveCount(0);
+        await expect(page.locator("#same-origin-slot .existing")).toHaveCount(
+            1,
+        );
+    });
+});
diff --git a/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml b/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml
index d6b436a9..921bf195 100644
--- a/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml
+++ b/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml
@@ -100,10 +100,11 @@ timeout_ms = 2000
 allowed_context_keys = []
 
 [integrations.aps]
-enabled = false
-pub_id = "example-aps-publisher-id"
-endpoint = "https://aps.example.com/e/dtb/bid"
+enabled = true
+account_id = "example-aps-account-id"
+endpoint = "https://aps.example.com/e/pb/bid"
 timeout_ms = 1000
+allow_script_creatives = false
 
 [integrations.google_tag_manager]
 enabled = false
diff --git a/crates/trusted-server-js/lib/build-prebid-external.mjs b/crates/trusted-server-js/lib/build-prebid-external.mjs
index 4e89723e..a63758c3 100644
--- a/crates/trusted-server-js/lib/build-prebid-external.mjs
+++ b/crates/trusted-server-js/lib/build-prebid-external.mjs
@@ -224,6 +224,13 @@ async function buildExternalBundle(outDir, generatedModules) {
               'node_modules/prebid.js/dist/src/src/adapterManager.js'
             ),
           },
+          {
+            find: 'prebid.js/src/adRendering.js',
+            replacement: path.resolve(
+              __dirname,
+              'node_modules/prebid.js/dist/src/src/adRendering.js'
+            ),
+          },
         ],
       },
       build: {
diff --git a/crates/trusted-server-js/lib/src/core/auction.ts b/crates/trusted-server-js/lib/src/core/auction.ts
index 40f54367..a0268436 100644
--- a/crates/trusted-server-js/lib/src/core/auction.ts
+++ b/crates/trusted-server-js/lib/src/core/auction.ts
@@ -1,8 +1,11 @@
 // Shared auction module: builds AdRequest payloads, sends them to /auction,
-// and parses OpenRTB seatbid responses.  Used by both the core requestAds flow
+// and parses OpenRTB seatbid responses. Used by both the core requestAds flow
 // and the Prebid.js trustedServer adapter.
 
+import { parseApsRendererDescriptor } from '../integrations/aps/render';
+
 import { log } from './log';
+import type { ApsRendererV1 } from './types';
 
 // ---------------------------------------------------------------------------
 // Types
@@ -43,6 +46,8 @@ export interface AuctionBid {
   impid: string;
   /** Creative HTML (already rewritten with proxy URLs by the server). */
   adm: string;
+  /** Typed APS renderer descriptor, when the bid does not carry `adm`. */
+  renderer?: ApsRendererV1;
   /** CPM price. */
   price: number;
   /** Creative width. */
@@ -71,31 +76,31 @@ export interface AuctionBid {
 export function buildAdRequest(units: any[], options?: { eids?: AuctionEid[] }): AdRequest {
   const unitMap = new Map<string, AdRequestUnit>();
 
-  for (const u of units) {
-    const code: string = u.adUnitCode ?? u.code ?? '';
+  for (const unit of units) {
+    const code: string = unit.adUnitCode ?? unit.code ?? '';
     if (!unitMap.has(code)) {
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       const mediaTypes: any = {};
-      if (u.mediaTypes?.banner) {
+      if (unit.mediaTypes?.banner) {
         mediaTypes.banner = {
-          sizes: u.mediaTypes.banner.sizes ?? u.sizes ?? [],
+          sizes: unit.mediaTypes.banner.sizes ?? unit.sizes ?? [],
         };
       }
       unitMap.set(code, { code, mediaTypes, bids: [] });
     }
 
     // If the source object carries a `bidder` field (Prebid BidRequest style),
-    // add it as a bid entry.  Otherwise copy the existing `bids` array.
-    if (u.bidder) {
+    // add it as a bid entry. Otherwise copy the existing `bids` array.
+    if (unit.bidder) {
       unitMap.get(code)!.bids.push({
-        bidder: u.bidder,
-        params: u.params ?? {},
+        bidder: unit.bidder,
+        params: unit.params ?? {},
       });
-    } else if (Array.isArray(u.bids)) {
-      for (const b of u.bids) {
+    } else if (Array.isArray(unit.bids)) {
+      for (const bid of unit.bids) {
         unitMap.get(code)!.bids.push({
-          bidder: b.bidder ?? '',
-          params: b.params ?? {},
+          bidder: bid.bidder ?? '',
+          params: bid.params ?? {},
         });
       }
     }
@@ -115,10 +120,8 @@ export function buildAdRequest(units: any[], options?: { eids?: AuctionEid[] }):
 /**
  * Parse an OpenRTB-style response body into a flat array of {@link AuctionBid}.
  *
- * Expected shape:
- * ```json
- * { "seatbid": [{ "seat": "bidder", "bid": [{ "impid", "price", "adm", ... }] }] }
- * ```
+ * Parsing the renderer here is intentionally structural. The exact decoded
+ * APS envelope is validated immediately before any DOM or message side effect.
  */
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export function parseAuctionResponse(body: any): AuctionBid[] {
@@ -126,26 +129,34 @@ export function parseAuctionResponse(body: any): AuctionBid[] {
   const seatbids = body?.seatbid;
   if (!Array.isArray(seatbids)) return bids;
 
-  for (const sb of seatbids) {
-    const seat: string = sb.seat ?? 'unknown';
-    const sbBids = sb.bid;
-    if (!Array.isArray(sbBids)) continue;
-
-    for (const b of sbBids) {
-      // Coerce missing/null adm to '' so AuctionBid.adm is always a string.
-      // The empty-string case is filtered in renderCreativeInline via the
-      // `if (!bid.adm)` guard. The client-side `typeof !== 'string'` check in
-      // sanitizeCreativeHtml is a second line of defense for callers that bypass
-      // parseAuctionResponse and pass untrusted values directly.
+  for (const seatbid of seatbids) {
+    const seat: string = typeof seatbid?.seat === 'string' ? seatbid.seat : 'unknown';
+    const seatBids = seatbid?.bid;
+    if (!Array.isArray(seatBids)) continue;
+
+    for (const bid of seatBids) {
+      const impid = typeof bid?.impid === 'string' ? bid.impid : '';
+      const renderer = parseApsRendererDescriptor(bid?.ext?.trusted_server?.renderer);
+      const width = typeof bid?.w === 'number' ? bid.w : (renderer?.width ?? 300);
+      const height = typeof bid?.h === 'number' ? bid.h : (renderer?.height ?? 250);
+      const creativeId =
+        typeof bid?.crid === 'string' ? bid.crid : (renderer?.creativeId ?? `${seat}-${impid}`);
+
       bids.push({
-        impid: b.impid ?? '',
-        adm: b.adm ?? '',
-        price: b.price ?? 0,
-        width: b.w ?? 300,
-        height: b.h ?? 250,
+        impid,
+        // Preserve non-string untrusted values so the render-time sanitizer
+        // rejects them explicitly instead of silently converting them to an
+        // empty no-op creative.
+        adm: bid?.adm ?? '',
+        ...(renderer ? { renderer } : {}),
+        price: typeof bid?.price === 'number' ? bid.price : 0,
+        width,
+        height,
         seat,
-        creativeId: b.crid ?? `${seat}-${b.impid ?? ''}`,
-        adomain: Array.isArray(b.adomain) ? b.adomain : [],
+        creativeId,
+        adomain: Array.isArray(bid?.adomain)
+          ? bid.adomain.filter((domain: unknown): domain is string => typeof domain === 'string')
+          : [],
       });
     }
   }
@@ -170,7 +181,7 @@ export async function sendAuction(endpoint: string, request: AdRequest): Promise
   log.info('auction: sending request', { endpoint, units: request.adUnits.length });
 
   try {
-    const res = await fetch(endpoint, {
+    const response = await fetch(endpoint, {
       method: 'POST',
       headers: { 'content-type': 'application/json' },
       credentials: 'same-origin',
@@ -178,18 +189,22 @@ export async function sendAuction(endpoint: string, request: AdRequest): Promise
       keepalive: true,
     });
 
-    const ct = res.headers.get('content-type') || '';
-    if (res.ok && ct.includes('application/json')) {
-      const data: unknown = await res.json();
+    const contentType = response.headers.get('content-type') || '';
+    if (response.ok && contentType.includes('application/json')) {
+      const data: unknown = await response.json();
       const bids = parseAuctionResponse(data);
       log.info('auction: received bids', { count: bids.length });
       return bids;
     }
 
-    log.warn('auction: unexpected response', { ok: res.ok, status: res.status, ct });
+    log.warn('auction: unexpected response', {
+      ok: response.ok,
+      status: response.status,
+      ct: contentType,
+    });
     return [];
-  } catch (err) {
-    log.warn('auction: request failed', err);
+  } catch (error) {
+    log.warn('auction: request failed', error);
     return [];
   }
 }
diff --git a/crates/trusted-server-js/lib/src/core/request.ts b/crates/trusted-server-js/lib/src/core/request.ts
index e39300a1..ae352c58 100644
--- a/crates/trusted-server-js/lib/src/core/request.ts
+++ b/crates/trusted-server-js/lib/src/core/request.ts
@@ -1,9 +1,11 @@
 // Request orchestration for tsjs: unified auction endpoint with iframe-based creative rendering.
-import { log } from './log';
+import { renderApsCreative } from '../integrations/aps/render';
+
+import { buildAdRequest, sendAuction } from './auction';
 import { collectContext } from './context';
+import { log } from './log';
 import { getAllUnits, firstSize } from './registry';
 import { createAdIframe, findSlot, buildCreativeDocument, sanitizeCreativeHtml } from './render';
-import { buildAdRequest, sendAuction } from './auction';
 
 export type RequestAdsCallback = () => void;
 export interface RequestAdsOptions {
@@ -49,6 +51,10 @@ export function requestAds(
         log.info('requestAds: got bids', { count: bids.length });
         for (const bid of bids) {
           if (!bid.impid) continue;
+          if (bid.renderer) {
+            renderApsCreative({ slotId: bid.impid, renderer: bid.renderer });
+            continue;
+          }
           if (!bid.adm) {
             log.debug('requestAds: bid has no adm, skipping', { slotId: bid.impid });
             continue;
diff --git a/crates/trusted-server-js/lib/src/core/types.ts b/crates/trusted-server-js/lib/src/core/types.ts
index 360e2aa4..7cae7039 100644
--- a/crates/trusted-server-js/lib/src/core/types.ts
+++ b/crates/trusted-server-js/lib/src/core/types.ts
@@ -41,13 +41,45 @@ export interface AuctionDebugBidData {
   height?: number;
   nurl?: string | null;
   burl?: string | null;
+  bid_id?: string | null;
   ad_id?: string | null;
+  creative_id?: string | null;
   cache_id?: string | null;
   cache_host?: string | null;
   cache_path?: string | null;
   metadata?: Record<string, unknown>;
 }
 
+export type ApsTagType = 'iframe' | 'script';
+
+/** Version 1 Trusted Server APS renderer descriptor. */
+export interface ApsRendererV1 {
+  type: 'aps';
+  version: 1;
+  accountId: string;
+  bidId: string;
+  creativeId?: string;
+  tagType: ApsTagType;
+  creativeUrl: string;
+  aaxResponse: string;
+  width: number;
+  height: number;
+}
+
+export type AuctionBidRenderer = ApsRendererV1;
+
+/** A client-side Prebid bid's generated ad ID bound to its APS render capability. */
+export interface ApsPrebidRendererEntry {
+  adUnitCode: string;
+  renderer: ApsRendererV1;
+  registeredAt: number;
+  expiresAt: number;
+  /** Notify Prebid that GAM selected this bid before replying to Universal Creative. */
+  markWinner(): void;
+  /** Mark Prebid's bid rendered after the Universal Creative response is posted. */
+  markRendered(): void;
+}
+
 /** Bid targeting data from the server-side auction, injected into `window.tsjs.bids`. */
 export interface AuctionBidData {
   hb_pb?: string;
@@ -57,6 +89,8 @@ export interface AuctionBidData {
   hb_cache_path?: string;
   nurl?: string;
   burl?: string;
+  /** Typed winning-bid renderer capability. */
+  renderer?: AuctionBidRenderer;
   /** Raw creative markup. Only present when `[debug] inject_adm_for_testing = true`. */
   adm?: string;
   /** Debug-only bid field mirror. Only present when `[debug] inject_adm_for_testing = true`. */
@@ -90,6 +124,11 @@ export interface TsjsApi {
   adSlots?: AuctionSlot[];
   /** Winning bid targeting data injected before </body>. */
   bids?: Record<string, AuctionBidData>;
+  /**
+   * Bounded client-side Prebid APS renderer capabilities keyed by Prebid's generated
+   * `hb_adid`. The Universal Creative bridge consumes each entry at most once.
+   */
+  apsPrebidRenderers?: Record<string, ApsPrebidRendererEntry>;
   /** Initialises GPT slots with server-side bid targeting and calls refresh(). */
   adInit?: () => void;
   /** GPT slot objects TS defined — used to destroy stale slots on SPA navigation. */
diff --git a/crates/trusted-server-js/lib/src/integrations/aps/render.ts b/crates/trusted-server-js/lib/src/integrations/aps/render.ts
new file mode 100644
index 00000000..8df617fa
--- /dev/null
+++ b/crates/trusted-server-js/lib/src/integrations/aps/render.ts
@@ -0,0 +1,416 @@
+import { log } from '../../core/log';
+import type { ApsPrebidRendererEntry, ApsRendererV1, TsjsApi } from '../../core/types';
+
+export const APS_RENDERER_PATH = '/integrations/aps/renderer';
+export const APS_RENDERER_SANDBOX =
+  'allow-forms allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-scripts allow-top-navigation-by-user-activation';
+export const APS_UNIVERSAL_CREATIVE_RENDERER_VERSION = 4;
+
+const MAX_ACCOUNT_ID_BYTES = 1024;
+const MAX_CREATIVE_ID_BYTES = 1024;
+const MAX_CREATIVE_URL_BYTES = 4096;
+const MAX_RENDER_ENVELOPE_BYTES = 256 * 1024;
+const MAX_RENDER_ENVELOPE_BASE64_BYTES = 4 * Math.ceil(MAX_RENDER_ENVELOPE_BYTES / 3);
+const DESCRIPTOR_KEYS = [
+  'aaxResponse',
+  'accountId',
+  'bidId',
+  'creativeUrl',
+  'height',
+  'tagType',
+  'type',
+  'version',
+  'width',
+] as const;
+const DESCRIPTOR_KEYS_WITH_CREATIVE_ID = [...DESCRIPTOR_KEYS, 'creativeId'].sort();
+const activeFrames = new WeakMap<HTMLElement, HTMLIFrameElement>();
+const pendingFrameCancels = new WeakMap<HTMLElement, () => void>();
+const RENDERER_READY_MESSAGE = 'trusted-server/aps/renderer-ready';
+const RENDERER_FAILED_MESSAGE = 'trusted-server/aps/renderer-failed';
+const RENDERER_READY_TIMEOUT_MS = 10_000;
+const MAX_PREBID_RENDERER_ENTRIES = 256;
+const DEFAULT_PREBID_RENDERER_TTL_SECONDS = 300;
+const MAX_PREBID_RENDERER_TTL_SECONDS = 3600;
+const MAX_PREBID_ID_BYTES = 1024;
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function hasExactKeys(
+  value: unknown,
+  expected: readonly string[]
+): value is Record<string, unknown> {
+  if (!isRecord(value)) return false;
+  const actual = Object.keys(value).sort();
+  const sortedExpected = [...expected].sort();
+  return (
+    actual.length === sortedExpected.length &&
+    actual.every((key, index) => key === sortedExpected[index])
+  );
+}
+
+/** Parse only the versioned descriptor shape; decoded-envelope trust checks happen separately. */
+export function parseApsRendererDescriptor(value: unknown): ApsRendererV1 | undefined {
+  if (
+    !hasExactKeys(value, DESCRIPTOR_KEYS) &&
+    !hasExactKeys(value, DESCRIPTOR_KEYS_WITH_CREATIVE_ID)
+  ) {
+    return undefined;
+  }
+
+  if (
+    value.type !== 'aps' ||
+    value.version !== 1 ||
+    typeof value.accountId !== 'string' ||
+    value.accountId.length === 0 ||
+    new TextEncoder().encode(value.accountId).length > MAX_ACCOUNT_ID_BYTES ||
+    typeof value.bidId !== 'string' ||
+    value.bidId.length === 0 ||
+    (Object.prototype.hasOwnProperty.call(value, 'creativeId') &&
+      (typeof value.creativeId !== 'string' ||
+        value.creativeId.length === 0 ||
+        new TextEncoder().encode(value.creativeId).length > MAX_CREATIVE_ID_BYTES)) ||
+    (value.tagType !== 'iframe' && value.tagType !== 'script') ||
+    typeof value.creativeUrl !== 'string' ||
+    typeof value.aaxResponse !== 'string' ||
+    value.aaxResponse.length > MAX_RENDER_ENVELOPE_BASE64_BYTES ||
+    !Number.isSafeInteger(value.width) ||
+    (value.width as number) <= 0 ||
+    !Number.isSafeInteger(value.height) ||
+    (value.height as number) <= 0
+  ) {
+    return undefined;
+  }
+
+  return value as unknown as ApsRendererV1;
+}
+
+function decodeStandardBase64(value: string): Uint8Array | undefined {
+  if (
+    value.length === 0 ||
+    value.length % 4 !== 0 ||
+    !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)
+  ) {
+    return undefined;
+  }
+
+  try {
+    const binary = atob(value);
+    if (binary.length > MAX_RENDER_ENVELOPE_BYTES || btoa(binary) !== value) return undefined;
+    return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+  } catch {
+    return undefined;
+  }
+}
+
+function validCreativeUrl(value: string, publisherOrigin: string): boolean {
+  if (new TextEncoder().encode(value).length > MAX_CREATIVE_URL_BYTES) return false;
+
+  try {
+    const url = new URL(value);
+    return (
+      url.protocol === 'https:' &&
+      url.username === '' &&
+      url.password === '' &&
+      url.origin !== publisherOrigin
+    );
+  } catch {
+    return false;
+  }
+}
+
+/** Fully validate the exact APS envelope and cross-check every duplicated descriptor field. */
+export function validateApsRenderer(
+  value: unknown,
+  publisherOrigin = window.location.origin
+): ApsRendererV1 | undefined {
+  const renderer = parseApsRendererDescriptor(value);
+  if (!renderer || !validCreativeUrl(renderer.creativeUrl, publisherOrigin)) return undefined;
+
+  const bytes = decodeStandardBase64(renderer.aaxResponse);
+  if (!bytes) return undefined;
+
+  let decoded: unknown;
+  try {
+    decoded = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+  } catch {
+    return undefined;
+  }
+
+  if (!hasExactKeys(decoded, ['seatbid'])) return undefined;
+  const seatbids = decoded.seatbid;
+  if (!Array.isArray(seatbids) || seatbids.length !== 1) return undefined;
+  const seat = seatbids[0];
+  if (!hasExactKeys(seat, ['bid']) || !Array.isArray(seat.bid) || seat.bid.length !== 1) {
+    return undefined;
+  }
+
+  const bid = seat.bid[0];
+  if (!hasExactKeys(bid, ['ext', 'h', 'id', 'price', 'w'])) return undefined;
+  if (!hasExactKeys(bid.ext, ['creativeurl', 'tagtype'])) return undefined;
+
+  if (
+    bid.id !== renderer.bidId ||
+    bid.w !== renderer.width ||
+    bid.h !== renderer.height ||
+    bid.ext.creativeurl !== renderer.creativeUrl ||
+    bid.ext.tagtype !== renderer.tagType ||
+    typeof bid.price !== 'number' ||
+    !Number.isFinite(bid.price) ||
+    bid.price < 0
+  ) {
+    return undefined;
+  }
+
+  return renderer;
+}
+
+function validPrebidIdentity(value: unknown): value is string {
+  return (
+    typeof value === 'string' &&
+    value.length > 0 &&
+    new TextEncoder().encode(value).length <= MAX_PREBID_ID_BYTES
+  );
+}
+
+function validPrebidAdId(value: unknown): value is string {
+  return validPrebidIdentity(value) && /^[A-Za-z0-9-]+$/.test(value);
+}
+
+function prunePrebidRenderers(registry: Record<string, ApsPrebidRendererEntry>, now: number): void {
+  for (const [adId, entry] of Object.entries(registry)) {
+    if (!Number.isFinite(entry.expiresAt) || entry.expiresAt <= now) delete registry[adId];
+  }
+
+  const entries = Object.entries(registry);
+  if (entries.length <= MAX_PREBID_RENDERER_ENTRIES) return;
+  entries
+    .sort(([, left], [, right]) => left.registeredAt - right.registeredAt)
+    .slice(0, entries.length - MAX_PREBID_RENDERER_ENTRIES)
+    .forEach(([adId]) => delete registry[adId]);
+}
+
+/** Bind Prebid's generated ad ID to a fully validated APS renderer capability. */
+export function registerApsPrebidRenderer(
+  adId: unknown,
+  adUnitCode: unknown,
+  input: unknown,
+  ttlSeconds: unknown = DEFAULT_PREBID_RENDERER_TTL_SECONDS,
+  lifecycle?: { markWinner(): void; markRendered(): void }
+): boolean {
+  if (
+    !validPrebidAdId(adId) ||
+    !validPrebidIdentity(adUnitCode) ||
+    typeof lifecycle?.markWinner !== 'function' ||
+    typeof lifecycle.markRendered !== 'function'
+  ) {
+    return false;
+  }
+  const renderer = validateApsRenderer(input);
+  if (!renderer) return false;
+
+  const now = Date.now();
+  const boundedTtlSeconds =
+    typeof ttlSeconds === 'number' && Number.isFinite(ttlSeconds) && ttlSeconds > 0
+      ? Math.min(ttlSeconds, MAX_PREBID_RENDERER_TTL_SECONDS)
+      : DEFAULT_PREBID_RENDERER_TTL_SECONDS;
+  const tsjs = (window.tsjs ??= {} as TsjsApi);
+  const registry = (tsjs.apsPrebidRenderers ??= Object.create(null) as Record<
+    string,
+    ApsPrebidRendererEntry
+  >);
+  prunePrebidRenderers(registry, now);
+
+  if (!(adId in registry) && Object.keys(registry).length >= MAX_PREBID_RENDERER_ENTRIES) {
+    const oldest = Object.entries(registry).sort(
+      ([, left], [, right]) => left.registeredAt - right.registeredAt
+    )[0];
+    if (oldest) delete registry[oldest[0]];
+  }
+
+  registry[adId] = {
+    adUnitCode,
+    renderer,
+    registeredAt: now,
+    expiresAt: now + boundedTtlSeconds * 1000,
+    markWinner: lifecycle.markWinner,
+    markRendered: lifecycle.markRendered,
+  };
+  return true;
+}
+
+/** Return an unexpired Prebid APS capability without consuming it. */
+export function getApsPrebidRenderer(adId: string): ApsPrebidRendererEntry | undefined {
+  if (!validPrebidAdId(adId)) return undefined;
+  const registry = window.tsjs?.apsPrebidRenderers;
+  const entry = registry?.[adId];
+  if (!entry) return undefined;
+  if (
+    !Number.isFinite(entry.expiresAt) ||
+    entry.expiresAt <= Date.now() ||
+    typeof entry.markWinner !== 'function' ||
+    typeof entry.markRendered !== 'function'
+  ) {
+    delete registry![adId];
+    return undefined;
+  }
+  return entry;
+}
+
+/** Atomically consume the exact capability previously returned by the registry. */
+export function consumeApsPrebidRenderer(adId: string, expected: ApsPrebidRendererEntry): boolean {
+  const registry = window.tsjs?.apsPrebidRenderers;
+  if (!registry || registry[adId] !== expected) return false;
+  delete registry[adId];
+  return true;
+}
+
+function createNonce(): string | undefined {
+  if (typeof crypto === 'undefined' || typeof crypto.getRandomValues !== 'function')
+    return undefined;
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  let binary = '';
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+}
+
+/** Return the absolute, same-publisher URL used by direct and Universal Creative rendering. */
+export function apsRendererUrl(pageOrigin = window.location.origin): string | undefined {
+  try {
+    const origin = new URL(pageOrigin);
+    const url = new URL(APS_RENDERER_PATH, origin);
+    if (
+      url.origin !== origin.origin ||
+      url.pathname !== APS_RENDERER_PATH ||
+      url.search !== '' ||
+      url.hash !== ''
+    ) {
+      return undefined;
+    }
+    return url.href;
+  } catch {
+    return undefined;
+  }
+}
+
+export interface RenderApsCreativeOptions {
+  slotId: string;
+  renderer: unknown;
+}
+
+/** Render APS through the static endpoint under an outer opaque-origin sandbox. */
+export function renderApsCreative({ slotId, renderer: input }: RenderApsCreativeOptions): boolean {
+  const renderer = validateApsRenderer(input);
+  const rendererUrl = apsRendererUrl();
+  const nonce = createNonce();
+  if (!renderer || !rendererUrl || !nonce) {
+    log.warn('APS renderer: rejected descriptor');
+    return false;
+  }
+
+  const container = document.getElementById(slotId);
+  if (!container) {
+    log.warn('APS renderer: slot not found');
+    return false;
+  }
+
+  const iframe = document.createElement('iframe');
+  iframe.title = 'Ad content';
+  iframe.width = String(renderer.width);
+  iframe.height = String(renderer.height);
+  iframe.style.border = '0';
+  iframe.style.display = 'none';
+  iframe.setAttribute('sandbox', APS_RENDERER_SANDBOX);
+  iframe.src = `${rendererUrl}#tsaps=${nonce}`;
+
+  // A replacement must cancel a pending frame, not merely detach it: its
+  // message listener and ready timeout would otherwise remain live until expiry.
+  pendingFrameCancels.get(container)?.();
+  activeFrames.set(container, iframe);
+
+  let settled = false;
+  const cleanup = (): void => {
+    window.removeEventListener('message', receive);
+    window.clearTimeout(timeoutId);
+  };
+  const cancel = (): void => {
+    if (settled) return;
+    settled = true;
+    cleanup();
+    if (pendingFrameCancels.get(container) === cancel) pendingFrameCancels.delete(container);
+    if (activeFrames.get(container) === iframe) activeFrames.delete(container);
+    iframe.remove();
+  };
+  const fail = (): void => {
+    if (settled) return;
+    cancel();
+    log.warn('APS renderer: frame load failed');
+  };
+  const commit = (): void => {
+    if (settled || activeFrames.get(container) !== iframe || !iframe.isConnected) return;
+    settled = true;
+    cleanup();
+    if (pendingFrameCancels.get(container) === cancel) pendingFrameCancels.delete(container);
+    for (const child of Array.from(container.children)) {
+      if (child !== iframe) child.remove();
+    }
+    iframe.style.display = '';
+  };
+  function receive(event: MessageEvent): void {
+    if (event.source !== iframe.contentWindow || !hasExactKeys(event.data, ['message', 'nonce'])) {
+      return;
+    }
+    if (event.data.nonce !== nonce) return;
+    if (event.data.message === RENDERER_READY_MESSAGE) commit();
+    else if (event.data.message === RENDERER_FAILED_MESSAGE) fail();
+  }
+
+  window.addEventListener('message', receive);
+  iframe.addEventListener(
+    'load',
+    () => {
+      if (settled || activeFrames.get(container) !== iframe || !iframe.isConnected) return;
+      try {
+        const target = iframe.contentWindow;
+        if (!target) {
+          fail();
+          return;
+        }
+        target.postMessage({ nonce, renderer }, '*');
+      } catch {
+        fail();
+      }
+    },
+    { once: true }
+  );
+  iframe.addEventListener('error', fail, { once: true });
+
+  const timeoutId = window.setTimeout(fail, RENDERER_READY_TIMEOUT_MS);
+  pendingFrameCancels.set(container, cancel);
+  container.appendChild(iframe);
+  return true;
+}
+
+/**
+ * Static source executed by Prebid Universal Creative's dynamic-renderer frame.
+ * It reads only the validated descriptor and trusted absolute endpoint URL from data.
+ */
+export const APS_UNIVERSAL_CREATIVE_RENDERER = String.raw`(function(){window.render=function(d,_h,w){return new Promise(function(resolve,reject){
+try{var r=d&&d.apsRenderer,u=d&&d.rendererUrl;if(!r||typeof u!=="string")throw new Error("invalid APS renderer data");
+var p=new URL(u);if((p.protocol!=="https:"&&p.protocol!=="http:")||p.username||p.password||p.pathname!=="${APS_RENDERER_PATH}"||p.search||p.hash)throw new Error("invalid APS renderer URL");
+var c=w.crypto;if(!c||typeof c.getRandomValues!=="function")throw new Error("APS renderer randomness unavailable");
+var b=new Uint8Array(16);c.getRandomValues(b);var s="";for(var i=0;i<b.length;i++)s+=String.fromCharCode(b[i]);
+var n=w.btoa(s).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"");
+var f=w.document.createElement("iframe"),done=false,t;
+function clean(){w.removeEventListener("message",receive);if(t)w.clearTimeout(t);}
+function fail(){if(done)return;done=true;clean();f.remove();reject(new Error("APS renderer frame failed"));}
+function receive(e){var m=e.data;if(e.source!==f.contentWindow||!m||m.nonce!==n)return;
+if(m.message==="${RENDERER_READY_MESSAGE}"){done=true;clean();resolve();}
+else if(m.message==="${RENDERER_FAILED_MESSAGE}")fail();}
+f.width=String(r.width);f.height=String(r.height);f.style.border="0";
+f.setAttribute("sandbox","${APS_RENDERER_SANDBOX}");
+f.src=p.href+"#tsaps="+n;f.onload=function(){if(!done&&f.contentWindow)f.contentWindow.postMessage({nonce:n,renderer:r},"*");};
+f.onerror=fail;w.addEventListener("message",receive);t=w.setTimeout(fail,${RENDERER_READY_TIMEOUT_MS});w.document.body.appendChild(f);
+}catch(e){reject(e);}});};})();`;
diff --git a/crates/trusted-server-js/lib/src/integrations/gpt/index.ts b/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
index ca468968..5fb0c6a6 100644
--- a/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
+++ b/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
@@ -1,5 +1,13 @@
 import { log } from '../../core/log';
 import type { AuctionSlot, AuctionBidData, TsjsApi } from '../../core/types';
+import {
+  APS_UNIVERSAL_CREATIVE_RENDERER,
+  APS_UNIVERSAL_CREATIVE_RENDERER_VERSION,
+  apsRendererUrl,
+  consumeApsPrebidRenderer,
+  getApsPrebidRenderer,
+  validateApsRenderer,
+} from '../aps/render';
 
 import { installGptGuard } from './script_guard';
 
@@ -56,10 +64,22 @@ function findSlotElementByDivId(divId: string): HTMLElement | null {
   const exact = document.getElementById(divId);
   if (exact) return exact;
 
+  const configuredDivIds = (window.tsjs?.adSlots ?? [])
+    .map((slot) => slot.div_id)
+    .filter((configured) => configured.length > 0);
+
   return (
-    Array.from(document.querySelectorAll<HTMLElement>('[id]')).find(
-      (el) => el.id.startsWith(divId) && !el.id.endsWith('-container')
-    ) ?? null
+    Array.from(document.querySelectorAll<HTMLElement>('[id]')).find((element) => {
+      if (!element.id.startsWith(divId) || element.id.endsWith('-container')) return false;
+
+      // Generated slot IDs can extend a configured prefix. When configured
+      // prefixes overlap, assign the element to the longest matching prefix so
+      // `div-header` cannot claim an iframe owned by `div-header-mobile`.
+      const owner = configuredDivIds
+        .filter((configured) => element.id.startsWith(configured))
+        .sort((left, right) => right.length - left.length)[0];
+      return owner === undefined || owner === divId;
+    }) ?? null
   );
 }
 
@@ -91,6 +111,16 @@ function slotIdForMessageSource(source: MessageEventSource | null): string | und
   )?.id;
 }
 
+function messageSourceBelongsToAdUnit(
+  source: MessageEventSource | null,
+  adUnitCode: string
+): boolean {
+  if (!source) return false;
+  return candidateSlotRoots(adUnitCode).some((root) =>
+    Array.from(root.querySelectorAll('iframe')).some((iframe) => iframe.contentWindow === source)
+  );
+}
+
 function clearTargetingKeys(slot: GoogleTagSlot, keys: Iterable<string>): void {
   if (typeof slot.clearTargeting !== 'function') return;
 
@@ -556,13 +586,8 @@ export function installTsAdInit(): void {
           slotsToRefresh.push(gptSlot);
         }
 
-        // APS: signal to apstag that bids are ready so Amazon's GAM creative
-        // can render.  apstag must already be initialised on the page (which it
-        // is on production publisher pages).  Safe no-op if apstag is absent.
-        if (bid.hb_bidder === 'aps' || bid.hb_bidder === 'amazon-aps') {
-          // eslint-disable-next-line @typescript-eslint/no-explicit-any
-          (window as any).apstag?.setDisplayBids?.();
-        }
+        // Trusted Server APS winners carry their own typed renderer and never
+        // enter the publisher-owned native apstag rendering path.
       });
 
       ts.prevGptSlots = newSlots as unknown[];
@@ -708,17 +733,16 @@ export function installSpaAuctionHook(): void {
   ts.spaHookInstalled = true;
 
   let inflight: AbortController | null = null;
-  // Last path an auction was run for. popstate fires for hash-only and
-  // same-pathname back/forward (scroll restoration), and pushState/replaceState
-  // can be called with the current URL, so guard every entry point against
-  // re-requesting impressions for a path we already loaded.
-  let currentPath = location.pathname;
+  // Last path and query an auction was run for. popstate fires for hash-only
+  // changes and pushState/replaceState can be called with the current URL, so
+  // guard every entry point against re-requesting impressions already loaded.
+  let currentPath = `${location.pathname}${location.search}`;
   // Last path whose slots/bids were actually applied — the initial SSR page
   // counts. A failed navigation rolls `currentPath` back to this rather than to
   // the immediately-previous committed value: on rapid A→B where A was aborted
   // mid-flight and B then fails, rolling back to A (never loaded) would strand
   // it behind the no-op guard, so we roll back to the last applied route instead.
-  let lastAppliedPath = location.pathname;
+  let lastAppliedPath = `${location.pathname}${location.search}`;
 
   async function onNavigate(path: string): Promise<void> {
     if (path === currentPath) return;
@@ -778,8 +802,9 @@ export function installSpaAuctionHook(): void {
     const original = history[method].bind(history);
     history[method] = function (state: unknown, unused: string, url?: string | URL | null): void {
       original(state, unused, url);
-      const newPath = url ? new URL(String(url), location.href).pathname : location.pathname;
-      // onNavigate no-ops when newPath equals the last loaded path.
+      const locationUrl = url ? new URL(String(url), location.href) : location;
+      const newPath = `${locationUrl.pathname}${locationUrl.search}`;
+      // onNavigate no-ops when newPath equals the last loaded path and query.
       void onNavigate(newPath);
     };
   }
@@ -788,7 +813,7 @@ export function installSpaAuctionHook(): void {
   patchHistoryMethod('replaceState');
 
   window.addEventListener('popstate', () => {
-    void onNavigate(location.pathname);
+    void onNavigate(`${location.pathname}${location.search}`);
   });
 }
 
@@ -845,6 +870,21 @@ export function installTsRenderBridge(): void {
   // and both fire the nurl/burl beacons. Tracking in-flight adIds prevents the
   // concurrent double-fire; the entry is cleared once the fetch settles.
   const renderingAdIds = new Set<string>();
+  const consumedPrebidApsIds = new Map<string, { adUnitCode: string; expiresAt: number }>();
+  const rememberConsumedPrebidApsId = (
+    adId: string,
+    entry: { adUnitCode: string; expiresAt: number }
+  ): void => {
+    const now = Date.now();
+    for (const [consumedAdId, consumed] of consumedPrebidApsIds) {
+      if (consumed.expiresAt <= now) consumedPrebidApsIds.delete(consumedAdId);
+    }
+    if (!consumedPrebidApsIds.has(adId) && consumedPrebidApsIds.size >= 256) {
+      const oldestAdId = consumedPrebidApsIds.keys().next().value as string | undefined;
+      if (oldestAdId) consumedPrebidApsIds.delete(oldestAdId);
+    }
+    consumedPrebidApsIds.set(adId, entry);
+  };
 
   window.addEventListener('message', (e: MessageEvent) => {
     let data: Record<string, unknown>;
@@ -863,6 +903,71 @@ export function installTsRenderBridge(): void {
 
     const port = e.ports?.[0];
     if (!port) return;
+
+    const consumedPrebidAps = consumedPrebidApsIds.get(adId);
+    if (consumedPrebidAps) {
+      if (consumedPrebidAps.expiresAt <= Date.now()) {
+        consumedPrebidApsIds.delete(adId);
+      } else {
+        if (messageSourceBelongsToAdUnit(e.source, consumedPrebidAps.adUnitCode)) {
+          e.stopImmediatePropagation();
+        }
+        return;
+      }
+    }
+
+    // Client-side trustedServer adapter bids receive a new adId from Prebid. Bind
+    // that ID to the server-validated APS descriptor only after confirming the
+    // requesting Universal Creative frame belongs to the same GPT ad unit.
+    const prebidRendererEntry = getApsPrebidRenderer(adId);
+    if (prebidRendererEntry) {
+      if (!messageSourceBelongsToAdUnit(e.source, prebidRendererEntry.adUnitCode)) return;
+      const renderer = validateApsRenderer(prebidRendererEntry.renderer);
+      const rendererUrl = apsRendererUrl();
+      if (!renderer || !rendererUrl) return;
+      if (!consumeApsPrebidRenderer(adId, prebidRendererEntry)) return;
+      rememberConsumedPrebidApsId(adId, {
+        adUnitCode: prebidRendererEntry.adUnitCode,
+        expiresAt: prebidRendererEntry.expiresAt,
+      });
+
+      e.stopImmediatePropagation();
+      try {
+        prebidRendererEntry.markWinner();
+      } catch (err) {
+        log.warn('[tsjs-gpt] pbRender bridge: Prebid APS winner lifecycle failed', err);
+        return;
+      }
+
+      try {
+        port.postMessage(
+          JSON.stringify({
+            message: 'Prebid Response',
+            adId,
+            renderer: APS_UNIVERSAL_CREATIVE_RENDERER,
+            rendererVersion: APS_UNIVERSAL_CREATIVE_RENDERER_VERSION,
+            rendererUrl,
+            apsRenderer: renderer,
+            width: renderer.width,
+            height: renderer.height,
+          })
+        );
+      } catch (err) {
+        log.warn('[tsjs-gpt] pbRender bridge: Prebid APS response failed', err);
+        return;
+      }
+
+      try {
+        prebidRendererEntry.markRendered();
+      } catch (err) {
+        log.warn('[tsjs-gpt] pbRender bridge: Prebid APS rendered lifecycle failed', err);
+      }
+      log.debug(
+        `[tsjs-gpt] pbRender bridge served Prebid APS bid for '${prebidRendererEntry.adUnitCode}'`
+      );
+      return;
+    }
+
     const sourceSlotId = slotIdForMessageSource(e.source);
     if (!sourceSlotId) return;
 
@@ -889,6 +994,35 @@ export function installTsRenderBridge(): void {
     const slot = window.tsjs?.adSlots?.find((s) => s.id === slotId);
     const [width, height] = slot?.formats?.[0] ?? [728, 90];
 
+    if (matchedBid.renderer !== undefined) {
+      const renderer = validateApsRenderer(matchedBid.renderer);
+      const rendererUrl = apsRendererUrl();
+      if (!renderer || !rendererUrl) return;
+
+      // Ownership and the complete envelope are valid before this handler
+      // claims the message. APS responses are intentionally repeatable: GAM can
+      // request the same server-rendered Universal Creative more than once.
+      e.stopImmediatePropagation();
+      try {
+        port.postMessage(
+          JSON.stringify({
+            message: 'Prebid Response',
+            adId,
+            renderer: APS_UNIVERSAL_CREATIVE_RENDERER,
+            rendererVersion: APS_UNIVERSAL_CREATIVE_RENDERER_VERSION,
+            rendererUrl,
+            apsRenderer: renderer,
+            width: renderer.width,
+            height: renderer.height,
+          })
+        );
+        log.debug(`[tsjs-gpt] pbRender bridge served '${slotId}' through APS renderer`);
+      } catch (err) {
+        log.warn('[tsjs-gpt] pbRender bridge: APS response failed', err);
+      }
+      return;
+    }
+
     if (matchedBid.adm) {
       e.stopImmediatePropagation();
       port.postMessage(
diff --git a/crates/trusted-server-js/lib/src/integrations/prebid/index.ts b/crates/trusted-server-js/lib/src/integrations/prebid/index.ts
index 342e4038..826fec4b 100644
--- a/crates/trusted-server-js/lib/src/integrations/prebid/index.ts
+++ b/crates/trusted-server-js/lib/src/integrations/prebid/index.ts
@@ -13,6 +13,7 @@
 
 import pbjs from 'prebid.js';
 import adapterManager from 'prebid.js/src/adapterManager.js';
+import { markBidAsRendered, markWinner } from 'prebid.js/src/adRendering.js';
 import 'prebid.js/modules/consentManagementTcf.js';
 import 'prebid.js/modules/consentManagementGpp.js';
 import 'prebid.js/modules/consentManagementUsp.js';
@@ -28,6 +29,7 @@ import './_adapters.generated';
 
 import { log } from '../../core/log';
 import { buildAdRequest, parseAuctionResponse } from '../../core/auction';
+import { registerApsPrebidRenderer, validateApsRenderer } from '../aps/render';
 import type { AuctionBid, AuctionEid } from '../../core/auction';
 import type { AuctionSlot } from '../../core/types';
 
@@ -35,6 +37,9 @@ import { INCLUDED_PREBID_USER_ID_MODULES } from './_user_ids.generated';
 import { PREBID_USER_ID_MODULE_REGISTRY } from './user_id_modules';
 
 const ADAPTER_CODE = 'trustedServer';
+const APS_BIDDER_CODE = 'aps';
+const APS_RENDERER_FIELD = 'trustedServerRenderer';
+const APS_BID_RESPONSE_LISTENER_SENTINEL = '__tsApsBidResponseListenerInstalled';
 // OpenRTB permits vendor-specific agent types; PAIR uses 571187.
 // Keep this range aligned with the signed 32-bit Rust/OpenRTB representation.
 const MAX_OPENRTB_ATYPE = 2_147_483_647;
@@ -204,23 +209,35 @@ export function auctionBidsToPrebidBids(auctionBids: AuctionBid[], bidRequests:
     }
   }
 
-  return auctionBids.map((bid) => {
+  return auctionBids.flatMap((bid) => {
+    // Prebid admission is the last point before the descriptor becomes a bid
+    // capability. Drop malformed APS bids rather than letting them participate
+    // in the auction without a render path.
+    const renderer = bid.renderer ? validateApsRenderer(bid.renderer) : undefined;
+    if (bid.renderer && !renderer) {
+      log.warn(`[tsjs-prebid] dropped invalid APS renderer bid for '${bid.impid}'`);
+      return [];
+    }
+
     const origReq = requestsByCode.get(bid.impid);
-    return {
-      requestId: origReq?.bidId ?? bid.impid,
-      cpm: bid.price,
-      width: bid.width,
-      height: bid.height,
-      ad: bid.adm,
-      ttl: 300,
-      creativeId: bid.creativeId,
-      netRevenue: true,
-      currency: 'USD',
-      bidderCode: bid.seat,
-      meta: {
-        advertiserDomains: bid.adomain,
+    return [
+      {
+        requestId: origReq?.bidId ?? bid.impid,
+        cpm: bid.price,
+        width: bid.width,
+        height: bid.height,
+        ad: renderer ? '' : bid.adm,
+        ...(renderer ? { [APS_RENDERER_FIELD]: renderer } : {}),
+        ttl: 300,
+        creativeId: bid.creativeId,
+        netRevenue: true,
+        currency: 'USD',
+        bidderCode: bid.seat,
+        meta: {
+          advertiserDomains: bid.adomain,
+        },
       },
-    };
+    ];
   });
 }
 
@@ -501,6 +518,42 @@ function collectAuctionEids(): AuctionEid[] | undefined {
  * 1. `window.__tsjs_prebid` — injected by the server from trusted-server.toml
  * 2. `config` argument — explicit overrides from the publisher's JS
  */
+function installApsBidResponseRegistry(): void {
+  const prebid = pbjs as typeof pbjs & Record<string, unknown>;
+  if (prebid[APS_BID_RESPONSE_LISTENER_SENTINEL] === true) return;
+
+  pbjs.onEvent('bidResponse', (rawBid) => {
+    const bid = rawBid as unknown as Record<string, unknown>;
+    const renderer = bid[APS_RENDERER_FIELD];
+    if (
+      bid['adapterCode'] !== ADAPTER_CODE ||
+      bid['bidderCode'] !== APS_BIDDER_CODE ||
+      renderer === undefined
+    ) {
+      return;
+    }
+
+    const registered = registerApsPrebidRenderer(
+      bid['adId'],
+      bid['adUnitCode'],
+      renderer,
+      bid['ttl'],
+      {
+        markWinner: () => markWinner(rawBid),
+        markRendered: () => markBidAsRendered(rawBid),
+      }
+    );
+    if (registered) {
+      // Keep the executable capability only in the bounded, one-time registry. Prebid
+      // still owns the generated ad ID and ordinary GAM targeting on this bid object.
+      delete bid[APS_RENDERER_FIELD];
+    } else {
+      log.warn('[tsjs-prebid] rejected APS renderer capability that failed registration');
+    }
+  });
+  prebid[APS_BID_RESPONSE_LISTENER_SENTINEL] = true;
+}
+
 export function installPrebidNpm(config?: Partial<PrebidNpmConfig>): typeof pbjs {
   const injected = getInjectedConfig();
   const merged: PrebidNpmConfig = {
@@ -510,6 +563,7 @@ export function installPrebidNpm(config?: Partial<PrebidNpmConfig>): typeof pbjs
   };
 
   auctionEndpoint = merged.endpoint ?? '/auction';
+  installApsBidResponseRegistry();
 
   // Register the trustedServer adapter using pbjs.registerBidAdapter(null, code, spec)
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
diff --git a/crates/trusted-server-js/lib/src/integrations/prebid/prebid_modules/aliases.d.ts b/crates/trusted-server-js/lib/src/integrations/prebid/prebid_modules/aliases.d.ts
index e725a80f..8280ea21 100644
--- a/crates/trusted-server-js/lib/src/integrations/prebid/prebid_modules/aliases.d.ts
+++ b/crates/trusted-server-js/lib/src/integrations/prebid/prebid_modules/aliases.d.ts
@@ -3,3 +3,8 @@ declare module 'tsjs-prebid/liveIntentIdSystemStandard';
 declare module 'tsjs-prebid/prebidGlobal' {
   export function registerModule(name: string): void;
 }
+
+declare module 'prebid.js/src/adRendering.js' {
+  export function markBidAsRendered(bid: unknown): void;
+  export function markWinner(bid: unknown): void;
+}
diff --git a/crates/trusted-server-js/lib/test/core/auction.test.ts b/crates/trusted-server-js/lib/test/core/auction.test.ts
index 31e020ef..7e9bb294 100644
--- a/crates/trusted-server-js/lib/test/core/auction.test.ts
+++ b/crates/trusted-server-js/lib/test/core/auction.test.ts
@@ -1,5 +1,22 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { buildAdRequest, parseAuctionResponse, sendAuction } from '../../src/core/auction';
+import envelope from '../fixtures/aps-renderer-v1.json';
+
+function apsRenderer(creativeId?: string) {
+  const bid = envelope.seatbid[0].bid[0];
+  return {
+    type: 'aps' as const,
+    version: 1 as const,
+    accountId: 'example-account-id',
+    bidId: bid.id,
+    ...(creativeId ? { creativeId } : {}),
+    tagType: 'iframe' as const,
+    creativeUrl: bid.ext.creativeurl,
+    aaxResponse: btoa(JSON.stringify(envelope)),
+    width: bid.w,
+    height: bid.h,
+  };
+}
 
 describe('auction/buildAdRequest', () => {
   it('builds from tsjs AdUnit objects', () => {
@@ -174,6 +191,83 @@ describe('auction/parseAuctionResponse', () => {
     });
   });
 
+  it('parses an APS typed renderer without requiring adm', () => {
+    const renderer = apsRenderer('fictional-creative-id');
+    const bids = parseAuctionResponse({
+      seatbid: [
+        {
+          seat: 'aps',
+          bid: [
+            {
+              id: renderer.bidId,
+              impid: 'fictional-slot',
+              price: 1.23,
+              crid: renderer.creativeId,
+              w: 300,
+              h: 250,
+              ext: { trusted_server: { renderer } },
+            },
+          ],
+        },
+      ],
+    });
+
+    expect(bids).toHaveLength(1);
+    expect(bids[0]).toEqual(
+      expect.objectContaining({
+        impid: 'fictional-slot',
+        adm: '',
+        renderer,
+        width: 300,
+        height: 250,
+        creativeId: 'fictional-creative-id',
+      })
+    );
+  });
+
+  it('parses an APS renderer with optional creativeId omitted', () => {
+    const renderer = apsRenderer();
+    const bids = parseAuctionResponse({
+      seatbid: [
+        {
+          seat: 'aps',
+          bid: [
+            {
+              impid: 'fictional-slot',
+              price: 1.23,
+              w: 300,
+              h: 250,
+              ext: { trusted_server: { renderer } },
+            },
+          ],
+        },
+      ],
+    });
+
+    expect(bids[0].renderer).toEqual(renderer);
+    expect(bids[0].creativeId).toBe('aps-fictional-slot');
+  });
+
+  it('ignores unrelated or malformed renderer extensions while retaining ordinary adm', () => {
+    const bids = parseAuctionResponse({
+      seatbid: [
+        {
+          seat: 'ordinary',
+          bid: [
+            {
+              impid: 'slot-1',
+              adm: '<div>ordinary</div>',
+              ext: { trusted_server: { renderer: { type: 'aps', version: 99 } } },
+            },
+          ],
+        },
+      ],
+    });
+
+    expect(bids[0].renderer).toBeUndefined();
+    expect(bids[0].adm).toBe('<div>ordinary</div>');
+  });
+
   it('handles multiple seatbids with multiple bids', () => {
     const body = {
       seatbid: [
diff --git a/crates/trusted-server-js/lib/test/core/request.test.ts b/crates/trusted-server-js/lib/test/core/request.test.ts
index 2c56361d..8dffd825 100644
--- a/crates/trusted-server-js/lib/test/core/request.test.ts
+++ b/crates/trusted-server-js/lib/test/core/request.test.ts
@@ -1,4 +1,5 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import envelope from '../fixtures/aps-renderer-v1.json';
 
 async function flushRequestAds(): Promise<void> {
   await new Promise((resolve) => setTimeout(resolve, 0));
@@ -66,6 +67,107 @@ describe('request.requestAds', () => {
     );
   });
 
+  it('dispatches a valid APS descriptor to the opaque static renderer route', async () => {
+    const apsBid = envelope.seatbid[0].bid[0];
+    const renderer = {
+      type: 'aps',
+      version: 1,
+      accountId: 'example-account-id',
+      bidId: apsBid.id,
+      tagType: apsBid.ext.tagtype,
+      creativeUrl: apsBid.ext.creativeurl,
+      aaxResponse: btoa(JSON.stringify(envelope)),
+      width: apsBid.w,
+      height: apsBid.h,
+    };
+    (globalThis as any).fetch = vi.fn().mockResolvedValue({
+      ok: true,
+      status: 200,
+      headers: { get: () => 'application/json' },
+      json: async () => ({
+        seatbid: [
+          {
+            seat: 'aps',
+            bid: [
+              {
+                impid: 'slot1',
+                price: 1.23,
+                w: 300,
+                h: 250,
+                ext: { trusted_server: { renderer } },
+              },
+            ],
+          },
+        ],
+      }),
+    });
+
+    const { addAdUnits } = await import('../../src/core/registry');
+    const { requestAds } = await import('../../src/core/request');
+    document.body.innerHTML = '<div id="slot1"><span>existing</span></div>';
+    addAdUnits({ code: 'slot1', mediaTypes: { banner: { sizes: [[300, 250]] } } } as any);
+
+    requestAds();
+    await flushRequestAds();
+
+    const iframe = document.querySelector('#slot1 iframe') as HTMLIFrameElement | null;
+    expect(iframe).not.toBeNull();
+    expect(iframe!.src).toContain('/integrations/aps/renderer#tsaps=');
+    expect(iframe!.srcdoc).toBe('');
+    expect(iframe!.getAttribute('sandbox')).not.toContain('allow-same-origin');
+    expect(document.querySelector('#slot1 span')).not.toBeNull();
+
+    const postMessage = vi.spyOn(iframe!.contentWindow!, 'postMessage');
+    iframe!.dispatchEvent(new Event('load'));
+    expect(document.querySelector('#slot1 span')).not.toBeNull();
+    expect(postMessage).toHaveBeenCalledWith(expect.objectContaining({ renderer }), '*');
+
+    const message = postMessage.mock.calls[0][0] as { nonce: string };
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        data: { message: 'trusted-server/aps/renderer-ready', nonce: message.nonce },
+        source: iframe!.contentWindow,
+      })
+    );
+    expect(document.querySelector('#slot1 span')).toBeNull();
+  });
+
+  it('does not mutate the slot for an invalid APS descriptor', async () => {
+    (globalThis as any).fetch = vi.fn().mockResolvedValue({
+      ok: true,
+      status: 200,
+      headers: { get: () => 'application/json' },
+      json: async () => ({
+        seatbid: [
+          {
+            seat: 'aps',
+            bid: [
+              {
+                impid: 'slot1',
+                ext: {
+                  trusted_server: {
+                    renderer: { type: 'aps', version: 1, aaxResponse: 'invalid' },
+                  },
+                },
+              },
+            ],
+          },
+        ],
+      }),
+    });
+
+    const { addAdUnits } = await import('../../src/core/registry');
+    const { requestAds } = await import('../../src/core/request');
+    document.body.innerHTML = '<div id="slot1"><span>existing</span></div>';
+    addAdUnits({ code: 'slot1', mediaTypes: { banner: { sizes: [[300, 250]] } } } as any);
+
+    requestAds();
+    await flushRequestAds();
+
+    expect(document.querySelector('#slot1 iframe')).toBeNull();
+    expect(document.querySelector('#slot1 span')).not.toBeNull();
+  });
+
   it('does not render on non-JSON response', async () => {
     (globalThis as any).fetch = vi.fn().mockResolvedValue({
       ok: true,
diff --git a/crates/trusted-server-js/lib/test/fixtures/aps-renderer-v1.json b/crates/trusted-server-js/lib/test/fixtures/aps-renderer-v1.json
new file mode 100644
index 00000000..f970ac68
--- /dev/null
+++ b/crates/trusted-server-js/lib/test/fixtures/aps-renderer-v1.json
@@ -0,0 +1,18 @@
+{
+  "seatbid": [
+    {
+      "bid": [
+        {
+          "id": "fictional-selected-bid-id",
+          "price": 1.23,
+          "w": 300,
+          "h": 250,
+          "ext": {
+            "creativeurl": "https://creative.example/render",
+            "tagtype": "iframe"
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts b/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts
new file mode 100644
index 00000000..f98b6e43
--- /dev/null
+++ b/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts
@@ -0,0 +1,477 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import envelope from '../../fixtures/aps-renderer-v1.json';
+import type { ApsRendererV1 } from '../../../src/core/types';
+import { log } from '../../../src/core/log';
+import {
+  APS_RENDERER_PATH,
+  APS_RENDERER_SANDBOX,
+  APS_UNIVERSAL_CREATIVE_RENDERER,
+  APS_UNIVERSAL_CREATIVE_RENDERER_VERSION,
+  apsRendererUrl,
+  getApsPrebidRenderer,
+  parseApsRendererDescriptor,
+  registerApsPrebidRenderer,
+  renderApsCreative,
+  validateApsRenderer,
+} from '../../../src/integrations/aps/render';
+
+function encodeBytes(bytes: Uint8Array): string {
+  let binary = '';
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}
+
+function encodeEnvelope(value: unknown): string {
+  return encodeBytes(new TextEncoder().encode(JSON.stringify(value)));
+}
+
+function encodeEnvelopeAtSize(size: number): string {
+  const serialized = JSON.stringify(envelope);
+  const padding = size - new TextEncoder().encode(serialized).length;
+  if (padding < 0) throw new Error('requested envelope size is too small');
+  return encodeBytes(new TextEncoder().encode(`${serialized}${' '.repeat(padding)}`));
+}
+
+function descriptor(overrides: Partial<ApsRendererV1> = {}): ApsRendererV1 {
+  const bid = envelope.seatbid[0].bid[0];
+  return {
+    type: 'aps',
+    version: 1,
+    accountId: 'example-account-id',
+    bidId: bid.id,
+    creativeId: 'fictional-creative-id',
+    tagType: bid.ext.tagtype as 'iframe',
+    creativeUrl: bid.ext.creativeurl,
+    aaxResponse: encodeEnvelope(envelope),
+    width: bid.w,
+    height: bid.h,
+    ...overrides,
+  };
+}
+
+describe('APS renderer validation', () => {
+  it('consumes the shared fictional golden envelope and supports an omitted creative ID', () => {
+    const withCreativeId = descriptor();
+    const withoutCreativeId = descriptor();
+    delete withoutCreativeId.creativeId;
+
+    expect(validateApsRenderer(withCreativeId)).toEqual(withCreativeId);
+    expect(validateApsRenderer(withoutCreativeId)).toEqual(withoutCreativeId);
+  });
+
+  it('keeps auction parsing structural and leaves complete trust validation to render time', () => {
+    const renderer = descriptor({ aaxResponse: 'not-base64' });
+
+    expect(parseApsRendererDescriptor(renderer)).toEqual(renderer);
+    expect(validateApsRenderer(renderer)).toBeUndefined();
+  });
+
+  it.each([
+    ['unknown root field', { ...envelope, id: 'forbidden' }],
+    ['sibling seat', { seatbid: [...envelope.seatbid, envelope.seatbid[0]] }],
+    [
+      'sibling bid',
+      { seatbid: [{ bid: [...envelope.seatbid[0].bid, envelope.seatbid[0].bid[0]] }] },
+    ],
+    [
+      'markup',
+      {
+        seatbid: [
+          { bid: [{ ...envelope.seatbid[0].bid[0], adm: '<script>forbidden()</script>' }] },
+        ],
+      },
+    ],
+    [
+      'notification',
+      { seatbid: [{ bid: [{ ...envelope.seatbid[0].bid[0], nurl: 'https://notify.example' }] }] },
+    ],
+    [
+      'unknown extension',
+      {
+        seatbid: [
+          {
+            bid: [
+              {
+                ...envelope.seatbid[0].bid[0],
+                ext: { ...envelope.seatbid[0].bid[0].ext, userSyncs: [] },
+              },
+            ],
+          },
+        ],
+      },
+    ],
+  ])('rejects an envelope containing %s', (_name, invalidEnvelope) => {
+    expect(
+      validateApsRenderer(descriptor({ aaxResponse: encodeEnvelope(invalidEnvelope) }))
+    ).toBeUndefined();
+  });
+
+  it.each([
+    ['bid ID', { bidId: 'another-bid' }],
+    ['width', { width: 728 }],
+    ['height', { height: 90 }],
+    ['creative URL', { creativeUrl: 'https://other.example/render' }],
+    ['tag type', { tagType: 'script' as const }],
+  ])('rejects a descriptor/envelope %s mismatch', (_name, override) => {
+    expect(validateApsRenderer(descriptor(override))).toBeUndefined();
+  });
+
+  it.each([
+    'not-base64',
+    'e30',
+    '====',
+    'Zh==',
+    btoa(String.fromCharCode(0xc3, 0x28)),
+    btoa('{not json}'),
+  ])('rejects invalid base64, UTF-8, JSON, or non-canonical padding', (aaxResponse) => {
+    expect(validateApsRenderer(descriptor({ aaxResponse }))).toBeUndefined();
+  });
+
+  it('rejects non-canonical trailing bits that decode to the valid envelope', () => {
+    const canonical = encodeBytes(new TextEncoder().encode(`${JSON.stringify(envelope)} `));
+    const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+    const finalDataIndex = canonical.length - 3;
+    const canonicalIndex = alphabet.indexOf(canonical[finalDataIndex]);
+    const nonCanonical = `${canonical.slice(0, finalDataIndex)}${alphabet[canonicalIndex + 1]}==`;
+
+    expect(atob(nonCanonical)).toBe(atob(canonical));
+    expect(validateApsRenderer(descriptor({ aaxResponse: canonical }))).toBeDefined();
+    expect(validateApsRenderer(descriptor({ aaxResponse: nonCanonical }))).toBeUndefined();
+  });
+
+  it.each([
+    'http://creative.example/render',
+    'https://user:password@creative.example/render',
+    `${window.location.origin}/creative`,
+  ])('rejects an unsafe creative URL', (creativeUrl) => {
+    const invalidEnvelope = structuredClone(envelope);
+    invalidEnvelope.seatbid[0].bid[0].ext.creativeurl = creativeUrl;
+    expect(
+      validateApsRenderer(descriptor({ creativeUrl, aaxResponse: encodeEnvelope(invalidEnvelope) }))
+    ).toBeUndefined();
+  });
+
+  it('rejects unknown descriptor fields and version mismatches', () => {
+    expect(
+      parseApsRendererDescriptor({ ...descriptor(), adm: '<div>forbidden</div>' })
+    ).toBeUndefined();
+    expect(parseApsRendererDescriptor({ ...descriptor(), version: 2 })).toBeUndefined();
+  });
+
+  it('enforces account and creative ID UTF-8 byte limits', () => {
+    expect(validateApsRenderer(descriptor({ accountId: 'é'.repeat(512) }))).toBeDefined();
+    expect(validateApsRenderer(descriptor({ accountId: `${'é'.repeat(512)}x` }))).toBeUndefined();
+    expect(validateApsRenderer(descriptor({ creativeId: 'é'.repeat(512) }))).toBeDefined();
+    expect(validateApsRenderer(descriptor({ creativeId: `${'é'.repeat(512)}x` }))).toBeUndefined();
+  });
+
+  it('enforces the creative URL UTF-8 byte limit', () => {
+    const prefix = 'https://creative.example/';
+    const atLimit = `${prefix}${'a'.repeat(4096 - prefix.length)}`;
+    const overLimit = `${atLimit}x`;
+    const atLimitEnvelope = structuredClone(envelope);
+    atLimitEnvelope.seatbid[0].bid[0].ext.creativeurl = atLimit;
+    const overLimitEnvelope = structuredClone(envelope);
+    overLimitEnvelope.seatbid[0].bid[0].ext.creativeurl = overLimit;
+
+    expect(
+      validateApsRenderer(
+        descriptor({ creativeUrl: atLimit, aaxResponse: encodeEnvelope(atLimitEnvelope) })
+      )
+    ).toBeDefined();
+    expect(
+      validateApsRenderer(
+        descriptor({ creativeUrl: overLimit, aaxResponse: encodeEnvelope(overLimitEnvelope) })
+      )
+    ).toBeUndefined();
+  });
+
+  it('accepts the maximum decoded envelope and rejects one byte over', () => {
+    const atLimit = encodeEnvelopeAtSize(256 * 1024);
+    const overLimit = encodeEnvelopeAtSize(256 * 1024 + 1);
+
+    expect(atLimit).toHaveLength(349528);
+    expect(overLimit).toHaveLength(349528);
+    expect(validateApsRenderer(descriptor({ aaxResponse: atLimit }))).toBeDefined();
+    expect(validateApsRenderer(descriptor({ aaxResponse: overLimit }))).toBeUndefined();
+    expect(
+      parseApsRendererDescriptor(descriptor({ aaxResponse: `${atLimit}AAAA` }))
+    ).toBeUndefined();
+  });
+});
+
+describe('Prebid APS renderer registry', () => {
+  afterEach(() => {
+    delete window.tsjs;
+  });
+
+  it('bounds entries and evicts the oldest capability', () => {
+    for (let index = 0; index <= 256; index += 1) {
+      expect(
+        registerApsPrebidRenderer(`prebid-${index}`, 'fictional-slot', descriptor(), 300, {
+          markWinner: vi.fn(),
+          markRendered: vi.fn(),
+        })
+      ).toBe(true);
+    }
+
+    expect(Object.keys(window.tsjs?.apsPrebidRenderers ?? {})).toHaveLength(256);
+    expect(getApsPrebidRenderer('prebid-0')).toBeUndefined();
+    expect(getApsPrebidRenderer('prebid-256')).toEqual(
+      expect.objectContaining({ adUnitCode: 'fictional-slot', renderer: descriptor() })
+    );
+  });
+
+  it('rejects unsafe Prebid IDs and invalid descriptors', () => {
+    const lifecycle = { markWinner: vi.fn(), markRendered: vi.fn() };
+    expect(
+      registerApsPrebidRenderer('__proto__', 'fictional-slot', descriptor(), 300, lifecycle)
+    ).toBe(false);
+    expect(
+      registerApsPrebidRenderer(
+        'safe-prebid-id',
+        'fictional-slot',
+        descriptor({ aaxResponse: 'invalid' }),
+        300,
+        lifecycle
+      )
+    ).toBe(false);
+    expect(window.tsjs?.apsPrebidRenderers).toBeUndefined();
+  });
+});
+
+describe('direct APS rendering', () => {
+  beforeEach(() => {
+    document.body.innerHTML = '<div id="fictional-slot"><span>existing</span></div>';
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+    document.body.innerHTML = '';
+  });
+
+  it('loads the static route with a fragment-bound 128-bit nonce and opaque sandbox', () => {
+    expect(renderApsCreative({ slotId: 'fictional-slot', renderer: descriptor() })).toBe(true);
+
+    const slot = document.getElementById('fictional-slot')!;
+    const iframe = slot.querySelector('iframe')!;
+    const existing = slot.querySelector('span');
+    expect(existing).not.toBeNull();
+    expect(iframe.src).toMatch(/\/integrations\/aps\/renderer#tsaps=[A-Za-z0-9_-]{22}$/);
+    expect(iframe.getAttribute('sandbox')).toBe(APS_RENDERER_SANDBOX);
+    expect(iframe.getAttribute('sandbox')).not.toContain('allow-same-origin');
+    expect(iframe.srcdoc).toBe('');
+
+    const postMessage = vi.spyOn(iframe.contentWindow!, 'postMessage');
+    iframe.dispatchEvent(new Event('load'));
+
+    expect(slot.querySelector('span')).not.toBeNull();
+    expect(iframe.style.display).toBe('none');
+    expect(postMessage).toHaveBeenCalledTimes(1);
+    expect(postMessage).toHaveBeenCalledWith(
+      {
+        nonce: expect.stringMatching(/^[A-Za-z0-9_-]{22}$/),
+        renderer: descriptor(),
+      },
+      '*'
+    );
+
+    const message = postMessage.mock.calls[0][0] as { nonce: string };
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        data: {
+          message: 'trusted-server/aps/renderer-ready',
+          nonce: `wrong-${message.nonce}`,
+        },
+        source: iframe.contentWindow,
+      })
+    );
+    expect(slot.querySelector('span')).not.toBeNull();
+
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        data: { message: 'trusted-server/aps/renderer-ready', nonce: message.nonce },
+        source: iframe.contentWindow,
+      })
+    );
+    expect(slot.querySelector('span')).toBeNull();
+    expect(iframe.style.display).toBe('');
+  });
+
+  it('rejects a ready message with the correct nonce from a foreign window', () => {
+    expect(renderApsCreative({ slotId: 'fictional-slot', renderer: descriptor() })).toBe(true);
+
+    const slot = document.getElementById('fictional-slot')!;
+    const rendererFrame = slot.querySelector('iframe')!;
+    const postMessage = vi.spyOn(rendererFrame.contentWindow!, 'postMessage');
+    rendererFrame.dispatchEvent(new Event('load'));
+    const sent = postMessage.mock.calls[0][0] as { nonce: string };
+    const foreignFrame = document.createElement('iframe');
+    document.body.appendChild(foreignFrame);
+
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        data: { message: 'trusted-server/aps/renderer-ready', nonce: sent.nonce },
+        source: foreignFrame.contentWindow,
+      })
+    );
+
+    expect(slot.querySelector('span')).not.toBeNull();
+    expect(rendererFrame.style.display).toBe('none');
+
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        data: { message: 'trusted-server/aps/renderer-ready', nonce: sent.nonce },
+        source: rendererFrame.contentWindow,
+      })
+    );
+
+    expect(slot.querySelector('span')).toBeNull();
+    expect(rendererFrame.style.display).toBe('');
+  });
+
+  it('leaves existing slot content intact when validation or loading fails', () => {
+    expect(
+      renderApsCreative({
+        slotId: 'fictional-slot',
+        renderer: descriptor({ aaxResponse: 'invalid' }),
+      })
+    ).toBe(false);
+    expect(document.querySelector('#fictional-slot span')).not.toBeNull();
+    expect(document.querySelector('#fictional-slot iframe')).toBeNull();
+
+    expect(renderApsCreative({ slotId: 'fictional-slot', renderer: descriptor() })).toBe(true);
+    const iframe = document.querySelector('#fictional-slot iframe')!;
+    iframe.dispatchEvent(new Event('error'));
+    expect(document.querySelector('#fictional-slot span')).not.toBeNull();
+    expect(document.querySelector('#fictional-slot iframe')).toBeNull();
+  });
+
+  it('removes an unacknowledged frame without clearing publisher content', () => {
+    vi.useFakeTimers();
+    try {
+      expect(renderApsCreative({ slotId: 'fictional-slot', renderer: descriptor() })).toBe(true);
+      const iframe = document.querySelector('#fictional-slot iframe')!;
+      iframe.dispatchEvent(new Event('load'));
+
+      vi.advanceTimersByTime(10_000);
+
+      expect(document.querySelector('#fictional-slot span')).not.toBeNull();
+      expect(document.querySelector('#fictional-slot iframe')).toBeNull();
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it('immediately cancels a superseded pending frame and its timeout', () => {
+    vi.useFakeTimers();
+    const warnSpy = vi.spyOn(log, 'warn').mockImplementation(() => {});
+    try {
+      const baselineTimers = vi.getTimerCount();
+      expect(renderApsCreative({ slotId: 'fictional-slot', renderer: descriptor() })).toBe(true);
+      const firstFrame = document.querySelector('#fictional-slot iframe')!;
+      const firstPostMessage = vi.spyOn(firstFrame.contentWindow!, 'postMessage');
+      firstFrame.dispatchEvent(new Event('load'));
+      const firstSent = firstPostMessage.mock.calls[0][0] as { nonce: string };
+      const timersAfterFirst = vi.getTimerCount();
+      expect(timersAfterFirst).toBeGreaterThan(baselineTimers);
+
+      expect(renderApsCreative({ slotId: 'fictional-slot', renderer: descriptor() })).toBe(true);
+      const secondFrame = document.querySelector('#fictional-slot iframe')!;
+      expect(firstFrame.isConnected).toBe(false);
+      expect(vi.getTimerCount()).toBe(timersAfterFirst);
+      const postMessage = vi.spyOn(secondFrame.contentWindow!, 'postMessage');
+      secondFrame.dispatchEvent(new Event('load'));
+      const sent = postMessage.mock.calls[0][0] as { nonce: string };
+
+      window.dispatchEvent(
+        new MessageEvent('message', {
+          data: { message: 'trusted-server/aps/renderer-ready', nonce: firstSent.nonce },
+          source: firstFrame.contentWindow,
+        })
+      );
+      expect(document.querySelector('#fictional-slot span')).not.toBeNull();
+      expect((secondFrame as HTMLIFrameElement).style.display).toBe('none');
+
+      window.dispatchEvent(
+        new MessageEvent('message', {
+          data: { message: 'trusted-server/aps/renderer-ready', nonce: sent.nonce },
+          source: secondFrame.contentWindow,
+        })
+      );
+
+      vi.advanceTimersByTime(10_000);
+      expect(warnSpy).not.toHaveBeenCalled();
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+});
+
+describe('Universal Creative APS source', () => {
+  it('uses the deployed dynamic renderer protocol and only creates the opaque route frame', () => {
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER_VERSION).toBeGreaterThanOrEqual(4);
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).toContain('window.render=function');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).toContain('d&&d.apsRenderer');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).toContain('d&&d.rendererUrl');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).toContain(APS_RENDERER_PATH);
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).toContain(APS_RENDERER_SANDBOX);
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).not.toContain('allow-same-origin');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).not.toContain('srcdoc');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).not.toContain('document.write');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).not.toContain('creativeUrl');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).not.toContain('aaxResponse');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).not.toContain('example-account-id');
+  });
+
+  it('computes an absolute renderer URL from the publisher origin', () => {
+    expect(apsRendererUrl()).toBe(new URL(APS_RENDERER_PATH, window.location.origin).href);
+    expect(apsRendererUrl('not an origin')).toBeUndefined();
+  });
+
+  it('creates the opaque route frame and resolves only after the bound acknowledgement', async () => {
+    const dynamicWindow = window as unknown as {
+      render?: (data: Record<string, unknown>, helper: unknown, target: Window) => Promise<void>;
+    };
+    window.eval(APS_UNIVERSAL_CREATIVE_RENDERER);
+
+    try {
+      const renderer = descriptor();
+      const rendered = dynamicWindow.render!(
+        {
+          apsRenderer: renderer,
+          rendererUrl: apsRendererUrl(),
+        },
+        undefined,
+        window
+      );
+      const iframe = document.body.querySelector('iframe')!;
+      expect(iframe.src).toMatch(/\/integrations\/aps\/renderer#tsaps=[A-Za-z0-9_-]{22}$/);
+      expect(iframe.getAttribute('sandbox')).toBe(APS_RENDERER_SANDBOX);
+      expect(iframe.getAttribute('sandbox')).not.toContain('allow-same-origin');
+
+      const postMessage = vi.spyOn(iframe.contentWindow!, 'postMessage');
+      iframe.dispatchEvent(new Event('load'));
+      const sent = postMessage.mock.calls[0][0] as { nonce: string; renderer: ApsRendererV1 };
+      expect(sent.renderer).toEqual(renderer);
+
+      let settled = false;
+      void rendered.then(() => {
+        settled = true;
+      });
+      await Promise.resolve();
+      expect(settled).toBe(false);
+
+      window.dispatchEvent(
+        new MessageEvent('message', {
+          data: { message: 'trusted-server/aps/renderer-ready', nonce: sent.nonce },
+          source: iframe.contentWindow,
+        })
+      );
+      await expect(rendered).resolves.toBeUndefined();
+    } finally {
+      delete dynamicWindow.render;
+      document.body.innerHTML = '';
+    }
+  });
+});
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts
index 4a636876..52b2ba87 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts
@@ -1,4 +1,21 @@
 import { describe, it, expect, vi, beforeEach, afterEach, afterAll } from 'vitest';
+import envelope from '../../fixtures/aps-renderer-v1.json';
+
+function apsRenderer() {
+  const bid = envelope.seatbid[0].bid[0];
+  return {
+    type: 'aps' as const,
+    version: 1 as const,
+    accountId: 'example-account-id',
+    bidId: bid.id,
+    creativeId: 'fictional-creative-id',
+    tagType: 'iframe' as const,
+    creativeUrl: bid.ext.creativeurl,
+    aaxResponse: btoa(JSON.stringify(envelope)),
+    width: bid.w,
+    height: bid.h,
+  };
+}
 
 // Track every 'message' EventListener added to window across the entire test
 // file.  This lets the installTsRenderBridge suite remove all accumulated
@@ -654,7 +671,7 @@ describe('installTsAdInit', () => {
     beaconSpy.mockRestore();
   });
 
-  it('calls apstag.setDisplayBids when hb_bidder is aps', async () => {
+  it('does not call native apstag for a Trusted Server APS renderer winner', async () => {
     const setDisplayBidsSpy = vi.fn();
     (window as TestWindow).apstag = { setDisplayBids: setDisplayBidsSpy };
 
@@ -687,7 +704,12 @@ describe('installTsAdInit', () => {
         },
       ],
       bids: {
-        atf_sidebar_ad: { hb_pb: '1.50', hb_bidder: 'aps', nurl: '', burl: '' },
+        atf_sidebar_ad: {
+          hb_pb: '1.50',
+          hb_bidder: 'aps',
+          hb_adid: envelope.seatbid[0].bid[0].id,
+          renderer: apsRenderer(),
+        },
       },
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
     } as any;
@@ -696,7 +718,8 @@ describe('installTsAdInit', () => {
     installTsAdInit();
     (window as TestWindow).tsjs!.adInit!();
 
-    expect(setDisplayBidsSpy).toHaveBeenCalled();
+    expect(setDisplayBidsSpy).not.toHaveBeenCalled();
+    expect((window as TestWindow).apstag).toEqual({ setDisplayBids: setDisplayBidsSpy });
 
     delete (window as TestWindow).apstag;
   });
@@ -886,9 +909,9 @@ describe('installTsRenderBridge', () => {
     delete (window as TestWindow).tsjs;
   });
 
-  function createTrustedSlotIframe(): Window {
+  function createTrustedSlotIframe(divId = 'div-header'): Window {
     const slot = document.createElement('div');
-    slot.id = 'div-header';
+    slot.id = divId;
     const iframe = document.createElement('iframe');
     slot.appendChild(iframe);
     document.body.appendChild(slot);
@@ -914,6 +937,339 @@ describe('installTsRenderBridge', () => {
     return bridgeListener!;
   }
 
+  it('serves one exact APS dynamic-renderer response without cache fetches or beacons', async () => {
+    const renderer = apsRenderer();
+    (window as TestWindow).tsjs.bids.homepage_header = {
+      hb_adid: renderer.bidId,
+      hb_bidder: 'aps',
+      hb_pb: '1.23',
+      renderer,
+      // These must not be used even if unexpected legacy fields coexist.
+      nurl: 'https://notify.example/win',
+      burl: 'https://notify.example/bill',
+      hb_cache_host: 'cache.example.com',
+      hb_cache_path: '/cache',
+    };
+
+    const beaconSpy = vi.spyOn(navigator, 'sendBeacon').mockReturnValue(true);
+    const bridgeListener = await captureBridgeListener();
+    const source = createTrustedSlotIframe();
+    const stopSpy = vi.fn();
+    const portMessages: string[] = [];
+    const fakePort = { postMessage: (message: string) => portMessages.push(message) };
+    const event = Object.assign(new Event('message'), {
+      data: JSON.stringify({ message: 'Prebid Request', adId: renderer.bidId }),
+      ports: [fakePort],
+      source,
+      stopImmediatePropagation: stopSpy,
+    }) as unknown as MessageEvent;
+
+    bridgeListener(event);
+    bridgeListener(event);
+
+    expect(stopSpy).toHaveBeenCalledTimes(2);
+    expect(fetchStub).not.toHaveBeenCalled();
+    expect(beaconSpy).not.toHaveBeenCalled();
+    // Server-rendered APS descriptors are reusable: GAM can issue repeated
+    // Universal Creative requests for the same winning ad ID.
+    expect(portMessages).toHaveLength(2);
+    const response = JSON.parse(portMessages[0]) as Record<string, unknown>;
+    expect(Object.keys(response).sort()).toEqual(
+      [
+        'adId',
+        'apsRenderer',
+        'height',
+        'message',
+        'renderer',
+        'rendererUrl',
+        'rendererVersion',
+        'width',
+      ].sort()
+    );
+    expect(response).toEqual({
+      message: 'Prebid Response',
+      adId: renderer.bidId,
+      renderer: expect.stringContaining('window.render=function'),
+      rendererVersion: 4,
+      rendererUrl: new URL('/integrations/aps/renderer', window.location.origin).href,
+      apsRenderer: renderer,
+      width: 300,
+      height: 250,
+    });
+    expect(String(response.renderer)).not.toContain(renderer.accountId);
+    expect(String(response.renderer)).not.toContain(renderer.aaxResponse);
+
+    // Universal Creative's dynamic-renderer path evaluates the returned static
+    // source and calls window.render(response, helper, targetWindow). Consume
+    // the exact bridge response through that deployed protocol shape.
+    const dynamicWindow = window as unknown as {
+      render?: (data: Record<string, unknown>, helper: unknown, target: Window) => Promise<void>;
+    };
+    window.eval(String(response.renderer));
+    try {
+      const rendered = dynamicWindow.render!(response, undefined, window);
+      const outerFrame = document.querySelector<HTMLIFrameElement>(
+        'iframe[src*="/integrations/aps/renderer#tsaps="]'
+      )!;
+      expect(outerFrame).not.toBeNull();
+      expect(outerFrame.getAttribute('sandbox')).not.toContain('allow-same-origin');
+
+      const rendererPost = vi.spyOn(outerFrame.contentWindow!, 'postMessage');
+      outerFrame.dispatchEvent(new Event('load'));
+      const sent = rendererPost.mock.calls[0][0] as { nonce: string };
+      window.dispatchEvent(
+        new MessageEvent('message', {
+          data: { message: 'trusted-server/aps/renderer-ready', nonce: sent.nonce },
+          source: outerFrame.contentWindow,
+        })
+      );
+      await expect(rendered).resolves.toBeUndefined();
+      outerFrame.remove();
+    } finally {
+      delete dynamicWindow.render;
+    }
+    beaconSpy.mockRestore();
+  });
+
+  it('serves a registered Prebid APS renderer when its generated ad ID differs from the APS bid ID', async () => {
+    const renderer = apsRenderer();
+    const prebidAdId = 'prebid-generated-ad-id';
+    const markWinner = vi.fn();
+    const markRendered = vi.fn();
+    (window as TestWindow).tsjs.apsPrebidRenderers = {
+      [prebidAdId]: {
+        adUnitCode: 'div-header',
+        renderer,
+        registeredAt: Date.now(),
+        expiresAt: Date.now() + 60_000,
+        markWinner,
+        markRendered,
+      },
+    };
+
+    const bridgeListener = await captureBridgeListener();
+    const source = createTrustedSlotIframe();
+    const stopSpy = vi.fn();
+    const portMessages: string[] = [];
+    const event = Object.assign(new Event('message'), {
+      data: JSON.stringify({ message: 'Prebid Request', adId: prebidAdId }),
+      ports: [{ postMessage: (message: string) => portMessages.push(message) }],
+      source,
+      stopImmediatePropagation: stopSpy,
+    }) as unknown as MessageEvent;
+
+    bridgeListener(event);
+    bridgeListener(event);
+
+    expect(stopSpy).toHaveBeenCalledTimes(2);
+    expect(portMessages).toHaveLength(1);
+    expect(markWinner).toHaveBeenCalledTimes(1);
+    expect(markRendered).toHaveBeenCalledTimes(1);
+    expect(JSON.parse(portMessages[0])).toEqual(
+      expect.objectContaining({
+        message: 'Prebid Response',
+        adId: prebidAdId,
+        apsRenderer: renderer,
+        width: renderer.width,
+        height: renderer.height,
+      })
+    );
+    expect(renderer.bidId).not.toBe(prebidAdId);
+    expect((window as TestWindow).tsjs.apsPrebidRenderers[prebidAdId]).toBeUndefined();
+    expect(fetchStub).not.toHaveBeenCalled();
+  });
+
+  it('does not expose a registered Prebid APS renderer to another slot iframe', async () => {
+    const renderer = apsRenderer();
+    const prebidAdId = 'prebid-generated-ad-id';
+    (window as TestWindow).tsjs.apsPrebidRenderers = {
+      [prebidAdId]: {
+        adUnitCode: 'div-header',
+        renderer,
+        registeredAt: Date.now(),
+        expiresAt: Date.now() + 60_000,
+        markWinner: vi.fn(),
+        markRendered: vi.fn(),
+      },
+    };
+
+    const footer = document.createElement('div');
+    footer.id = 'div-footer';
+    const foreignIframe = document.createElement('iframe');
+    footer.appendChild(foreignIframe);
+    document.body.appendChild(footer);
+
+    const bridgeListener = await captureBridgeListener();
+    const stopSpy = vi.fn();
+    const portMessages: string[] = [];
+    bridgeListener(
+      Object.assign(new Event('message'), {
+        data: JSON.stringify({ message: 'Prebid Request', adId: prebidAdId }),
+        ports: [{ postMessage: (message: string) => portMessages.push(message) }],
+        source: foreignIframe.contentWindow,
+        stopImmediatePropagation: stopSpy,
+      }) as unknown as MessageEvent
+    );
+
+    expect(stopSpy).not.toHaveBeenCalled();
+    expect(portMessages).toEqual([]);
+    expect((window as TestWindow).tsjs.apsPrebidRenderers[prebidAdId]).toBeDefined();
+    footer.remove();
+  });
+
+  it('drops an expired Prebid APS renderer without claiming the creative request', async () => {
+    const prebidAdId = 'expired-prebid-ad-id';
+    (window as TestWindow).tsjs.apsPrebidRenderers = {
+      [prebidAdId]: {
+        adUnitCode: 'div-header',
+        renderer: apsRenderer(),
+        registeredAt: Date.now() - 61_000,
+        expiresAt: Date.now() - 1_000,
+        markWinner: vi.fn(),
+        markRendered: vi.fn(),
+      },
+    };
+
+    const bridgeListener = await captureBridgeListener();
+    const source = createTrustedSlotIframe();
+    const stopSpy = vi.fn();
+    const portMessages: string[] = [];
+    bridgeListener(
+      Object.assign(new Event('message'), {
+        data: JSON.stringify({ message: 'Prebid Request', adId: prebidAdId }),
+        ports: [{ postMessage: (message: string) => portMessages.push(message) }],
+        source,
+        stopImmediatePropagation: stopSpy,
+      }) as unknown as MessageEvent
+    );
+
+    expect(stopSpy).not.toHaveBeenCalled();
+    expect(portMessages).toEqual([]);
+    expect((window as TestWindow).tsjs.apsPrebidRenderers[prebidAdId]).toBeUndefined();
+  });
+
+  it('validates APS data before claiming the Prebid request', async () => {
+    const renderer = { ...apsRenderer(), aaxResponse: 'invalid' };
+    (window as TestWindow).tsjs.bids.homepage_header = {
+      hb_adid: renderer.bidId,
+      hb_bidder: 'aps',
+      renderer,
+    };
+
+    const bridgeListener = await captureBridgeListener();
+    const source = createTrustedSlotIframe();
+    const stopSpy = vi.fn();
+    const portMessages: string[] = [];
+    bridgeListener(
+      Object.assign(new Event('message'), {
+        data: JSON.stringify({ message: 'Prebid Request', adId: renderer.bidId }),
+        ports: [{ postMessage: (message: string) => portMessages.push(message) }],
+        source,
+        stopImmediatePropagation: stopSpy,
+      }) as unknown as MessageEvent
+    );
+
+    expect(stopSpy).not.toHaveBeenCalled();
+    expect(portMessages).toEqual([]);
+    expect(fetchStub).not.toHaveBeenCalled();
+  });
+
+  it('accepts an APS request from a dynamic slot root resolved from its configured prefix', async () => {
+    const renderer = apsRenderer();
+    (window as TestWindow).tsjs.bids.homepage_header = {
+      hb_adid: renderer.bidId,
+      hb_bidder: 'aps',
+      renderer,
+    };
+    (window as TestWindow).tsjs.adSlots[0].div_id = 'div-header-';
+
+    const bridgeListener = await captureBridgeListener();
+    const source = createTrustedSlotIframe('div-header-dynamic');
+    const portMessages: string[] = [];
+    bridgeListener(
+      Object.assign(new Event('message'), {
+        data: JSON.stringify({ message: 'Prebid Request', adId: renderer.bidId }),
+        ports: [{ postMessage: (message: string) => portMessages.push(message) }],
+        source,
+        stopImmediatePropagation: vi.fn(),
+      }) as unknown as MessageEvent
+    );
+
+    expect(portMessages).toHaveLength(1);
+    document.getElementById('div-header-dynamic')?.remove();
+  });
+
+  it('does not let an overlapping slot prefix claim another slot iframe', async () => {
+    const renderer = apsRenderer();
+    (window as TestWindow).tsjs.bids.homepage_header = {
+      hb_adid: renderer.bidId,
+      hb_bidder: 'aps',
+      renderer,
+    };
+    (window as TestWindow).tsjs.adSlots.push({
+      id: 'homepage_header_mobile',
+      formats: [[320, 50]],
+      gam_unit_path: '/a/b/mobile',
+      div_id: 'div-header-mobile',
+      targeting: {},
+    });
+
+    const bridgeListener = await captureBridgeListener();
+    const source = createTrustedSlotIframe('div-header-mobile');
+    const portMessages: string[] = [];
+    const stopSpy = vi.fn();
+    bridgeListener(
+      Object.assign(new Event('message'), {
+        data: JSON.stringify({ message: 'Prebid Request', adId: renderer.bidId }),
+        ports: [{ postMessage: (message: string) => portMessages.push(message) }],
+        source,
+        stopImmediatePropagation: stopSpy,
+      }) as unknown as MessageEvent
+    );
+
+    expect(stopSpy).not.toHaveBeenCalled();
+    expect(portMessages).toEqual([]);
+    document.getElementById('div-header-mobile')?.remove();
+  });
+
+  it('ignores an APS ad ID requested by another configured slot', async () => {
+    const renderer = apsRenderer();
+    (window as TestWindow).tsjs.bids.homepage_header = {
+      hb_adid: renderer.bidId,
+      hb_bidder: 'aps',
+      renderer,
+    };
+    (window as TestWindow).tsjs.adSlots.push({
+      id: 'homepage_footer',
+      formats: [[300, 250]],
+      gam_unit_path: '/a/b/footer',
+      div_id: 'div-footer',
+      targeting: {},
+    });
+    const footer = document.createElement('div');
+    footer.id = 'div-footer';
+    const foreignIframe = document.createElement('iframe');
+    footer.appendChild(foreignIframe);
+    document.body.appendChild(footer);
+
+    const bridgeListener = await captureBridgeListener();
+    const stopSpy = vi.fn();
+    const portMessages: string[] = [];
+    bridgeListener(
+      Object.assign(new Event('message'), {
+        data: JSON.stringify({ message: 'Prebid Request', adId: renderer.bidId }),
+        ports: [{ postMessage: (message: string) => portMessages.push(message) }],
+        source: foreignIframe.contentWindow,
+        stopImmediatePropagation: stopSpy,
+      }) as unknown as MessageEvent
+    );
+
+    expect(stopSpy).not.toHaveBeenCalled();
+    expect(portMessages).toEqual([]);
+    expect(fetchStub).not.toHaveBeenCalled();
+    footer.remove();
+  });
+
   it('calls stopImmediatePropagation and fetches PBS Cache for a TS bid', async () => {
     const beaconSpy = vi.spyOn(navigator, 'sendBeacon').mockReturnValue(true);
     const mockAd = '<div>Test Creative</div>';
@@ -1235,7 +1591,7 @@ describe('installTsRenderBridge', () => {
     window.dispatchEvent(
       new MessageEvent('message', {
         data: JSON.stringify({ message: 'Prebid Request', adId: 'test-cache-uuid' }),
-        ports: [fakePort as MessagePort],
+        ports: [fakePort as unknown as MessagePort],
         source: foreignIframe.contentWindow,
       })
     );
@@ -1280,7 +1636,7 @@ describe('installTsRenderBridge', () => {
       new MessageEvent('message', {
         // adId belongs to slot B (homepage_footer), not slot A's iframe.
         data: JSON.stringify({ message: 'Prebid Request', adId: 'footer-uuid' }),
-        ports: [fakePort as MessagePort],
+        ports: [fakePort as unknown as MessagePort],
         source,
       })
     );
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts
index 9a08defc..761fa8b3 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts
@@ -74,11 +74,11 @@ describe('installSpaAuctionHook', () => {
     const adInit = vi.fn();
     ts.adInit = adInit;
 
-    history.pushState({}, '', '/next-page');
+    history.pushState({}, '', '/next-page?edition=fictional#section');
     await flushAsync();
 
     expect(fetchStub).toHaveBeenCalledWith(
-      '/__ts/page-bids?path=%2Fnext-page',
+      '/__ts/page-bids?path=%2Fnext-page%3Fedition%3Dfictional',
       expect.objectContaining({
         credentials: 'include',
         headers: { 'X-TSJS-Page-Bids': '1' },
diff --git a/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts b/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts
index 726f40b4..68928785 100644
--- a/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts
@@ -1,4 +1,21 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import envelope from '../../fixtures/aps-renderer-v1.json';
+
+function apsRenderer() {
+  const bid = envelope.seatbid[0].bid[0];
+  return {
+    type: 'aps' as const,
+    version: 1 as const,
+    accountId: 'example-account-id',
+    bidId: bid.id,
+    creativeId: 'fictional-creative-id',
+    tagType: 'iframe' as const,
+    creativeUrl: bid.ext.creativeurl,
+    aaxResponse: btoa(JSON.stringify(envelope)),
+    width: bid.w,
+    height: bid.h,
+  };
+}
 
 // Define mocks using vi.hoisted so they're available inside vi.mock factories
 const {
@@ -8,6 +25,9 @@ const {
   mockRegisterBidAdapter,
   mockGetUserIdsAsEids,
   mockGetConfig,
+  mockMarkBidAsRendered,
+  mockMarkWinner,
+  mockOnEvent,
   mockPbjs,
   mockGetBidAdapter,
   mockAdapterManager,
@@ -17,6 +37,9 @@ const {
   const mockRequestBids = vi.fn();
   const mockRegisterBidAdapter = vi.fn();
   const mockGetBidAdapter = vi.fn();
+  const mockMarkBidAsRendered = vi.fn();
+  const mockMarkWinner = vi.fn();
+  const mockOnEvent = vi.fn();
   const mockGetUserIdsAsEids = vi.fn(
     () => [] as Array<{ source: string; uids?: Array<{ id: string; atype?: number }> }>
   );
@@ -28,6 +51,7 @@ const {
     registerBidAdapter: mockRegisterBidAdapter,
     getUserIdsAsEids: mockGetUserIdsAsEids,
     getConfig: mockGetConfig,
+    onEvent: mockOnEvent,
     adUnits: [] as any[],
   };
   const mockAdapterManager = {
@@ -40,6 +64,9 @@ const {
     mockRegisterBidAdapter,
     mockGetUserIdsAsEids,
     mockGetConfig,
+    mockMarkBidAsRendered,
+    mockMarkWinner,
+    mockOnEvent,
     mockPbjs,
     mockGetBidAdapter,
     mockAdapterManager,
@@ -50,6 +77,10 @@ const {
 // The real prebid.js cannot run in jsdom, so we provide a minimal stub.
 vi.mock('prebid.js', () => ({ default: mockPbjs }));
 vi.mock('prebid.js/src/adapterManager.js', () => ({ default: mockAdapterManager }));
+vi.mock('prebid.js/src/adRendering.js', () => ({
+  markBidAsRendered: mockMarkBidAsRendered,
+  markWinner: mockMarkWinner,
+}));
 
 // Side-effect imports are no-ops in tests
 vi.mock('prebid.js/modules/consentManagementTcf.js', () => ({}));
@@ -149,6 +180,58 @@ describe('prebid/auctionBidsToPrebidBids', () => {
     });
   });
 
+  it('preserves an APS renderer without converting it to executable markup', () => {
+    const renderer = apsRenderer();
+    const auctionBids: AuctionBid[] = [
+      {
+        impid: 'div-aps',
+        adm: '<script>must not become Prebid ad markup</script>',
+        renderer,
+        price: 1.23,
+        width: 300,
+        height: 250,
+        seat: 'aps',
+        creativeId: 'fictional-creative-id',
+        adomain: ['advertiser.example'],
+      },
+    ];
+
+    const result = auctionBidsToPrebidBids(auctionBids, [
+      { adUnitCode: 'div-aps', bidId: 'prebid-request-id' },
+    ]);
+
+    expect(result).toHaveLength(1);
+    expect(result[0]).toEqual(
+      expect.objectContaining({
+        requestId: 'prebid-request-id',
+        bidderCode: 'aps',
+        ad: '',
+        trustedServerRenderer: renderer,
+      })
+    );
+  });
+
+  it('drops an APS bid whose renderer fails admission validation', () => {
+    const result = auctionBidsToPrebidBids(
+      [
+        {
+          impid: 'div-aps',
+          adm: '',
+          renderer: { ...apsRenderer(), aaxResponse: 'invalid' },
+          price: 1.23,
+          width: 300,
+          height: 250,
+          seat: 'aps',
+          creativeId: 'fictional-creative-id',
+          adomain: [],
+        },
+      ],
+      [{ adUnitCode: 'div-aps', bidId: 'prebid-request-id' }]
+    );
+
+    expect(result).toEqual([]);
+  });
+
   it('falls back to impid when no matching bidRequest found', () => {
     const auctionBids: AuctionBid[] = [
       {
@@ -218,6 +301,8 @@ describe('prebid/installPrebidNpm', () => {
     document.cookie = 'ts-eids=; Path=/; Max-Age=0';
     delete (window as any).__tsjs_prebid;
     delete (window as any).__tsjs_prebid_diagnostics;
+    delete (window as any).tsjs;
+    delete (mockPbjs as any).__tsApsBidResponseListenerInstalled;
   });
 
   afterEach(() => {
@@ -241,6 +326,77 @@ describe('prebid/installPrebidNpm', () => {
     );
   });
 
+  it('registers accepted APS descriptors under Prebid generated ad IDs', () => {
+    installPrebidNpm();
+
+    const bidResponseListener = mockOnEvent.mock.calls.find(
+      ([eventName]) => eventName === 'bidResponse'
+    )?.[1] as ((bid: Record<string, unknown>) => void) | undefined;
+    expect(bidResponseListener).toBeTypeOf('function');
+
+    const renderer = apsRenderer();
+    bidResponseListener!({
+      adapterCode: 'trustedServer',
+      bidderCode: 'aps',
+      adId: 'prebid-generated-ad-id',
+      adUnitCode: 'div-aps',
+      ttl: 300,
+      trustedServerRenderer: renderer,
+    });
+
+    const entry = (window as any).tsjs.apsPrebidRenderers['prebid-generated-ad-id'];
+    expect(entry).toEqual(
+      expect.objectContaining({
+        adUnitCode: 'div-aps',
+        renderer,
+        expiresAt: expect.any(Number),
+        markRendered: expect.any(Function),
+        markWinner: expect.any(Function),
+      })
+    );
+
+    entry.markWinner();
+    entry.markRendered();
+    expect(mockMarkWinner).toHaveBeenCalledWith(
+      expect.objectContaining({ adId: 'prebid-generated-ad-id' })
+    );
+    expect(mockMarkBidAsRendered).toHaveBeenCalledWith(
+      expect.objectContaining({ adId: 'prebid-generated-ad-id' })
+    );
+  });
+
+  it('does not register malformed or non-trusted APS renderer capabilities', () => {
+    const warnSpy = vi.spyOn(log, 'warn').mockImplementation(() => {});
+    installPrebidNpm();
+
+    const bidResponseListener = mockOnEvent.mock.calls.find(
+      ([eventName]) => eventName === 'bidResponse'
+    )?.[1] as ((bid: Record<string, unknown>) => void) | undefined;
+    const malformedBid: Record<string, unknown> = {
+      adapterCode: 'trustedServer',
+      bidderCode: 'aps',
+      adId: 'malformed-ad-id',
+      adUnitCode: 'div-aps',
+      ttl: 300,
+      trustedServerRenderer: { ...apsRenderer(), aaxResponse: 'invalid' },
+    };
+    bidResponseListener!(malformedBid);
+    bidResponseListener!({
+      adapterCode: 'publisherAdapter',
+      bidderCode: 'aps',
+      adId: 'foreign-ad-id',
+      adUnitCode: 'div-aps',
+      trustedServerRenderer: apsRenderer(),
+    });
+
+    expect((window as any).tsjs?.apsPrebidRenderers?.['malformed-ad-id']).toBeUndefined();
+    expect((window as any).tsjs?.apsPrebidRenderers?.['foreign-ad-id']).toBeUndefined();
+    expect(malformedBid).toHaveProperty('trustedServerRenderer');
+    expect(warnSpy).toHaveBeenCalledWith(
+      '[tsjs-prebid] rejected APS renderer capability that failed registration'
+    );
+  });
+
   it('calls setConfig with debug=false by default', () => {
     installPrebidNpm();
 
diff --git a/crates/trusted-server-js/lib/vitest.config.ts b/crates/trusted-server-js/lib/vitest.config.ts
index 97d9d84c..ad945289 100644
--- a/crates/trusted-server-js/lib/vitest.config.ts
+++ b/crates/trusted-server-js/lib/vitest.config.ts
@@ -11,6 +11,10 @@ export default defineConfig({
         __dirname,
         'node_modules/prebid.js/dist/src/src/adapterManager.js'
       ),
+      'prebid.js/src/adRendering.js': path.resolve(
+        __dirname,
+        'node_modules/prebid.js/dist/src/src/adRendering.js'
+      ),
     },
   },
   test: {
diff --git a/docs/guide/auction-orchestration.md b/docs/guide/auction-orchestration.md
index d7595881..e237bb2e 100644
--- a/docs/guide/auction-orchestration.md
+++ b/docs/guide/auction-orchestration.md
@@ -10,7 +10,7 @@ Key capabilities:
 
 - **Parallel execution** — Bid requests to all providers launch concurrently using Fastly's `select()` API
 - **Strategy-based winner selection** — Automatic strategy detection based on configuration
-- **Mediator support** — Optional external mediator for decoding encoded prices (e.g., APS) and applying unified floor pricing
+- **Mediator support** — Optional external mediator for final winner selection and unified floor pricing
 - **Provider abstraction** — Pluggable provider interface for adding new demand sources
 - **Creative rewriting** — Winning creatives automatically rewritten with first-party proxy URLs
 
@@ -92,26 +92,26 @@ sequenceDiagram
     activate Mock
 
     par Parallel Provider Calls
-      Orch->>APS: POST /e/dtb/bid<br/>APS TAM format
-      Note right of Orch: { "pubId": "5128",<br/>  "slots": [{ "slotID": "header-banner",<br/>    "sizes": [[728,90]] }] }
+      Orch->>APS: POST /e/pb/bid<br/>APS OpenRTB
+      Note right of Orch: { "id": "request",<br/>  "imp": [{ "id": "header-banner",<br/>    "banner": { "w": 728, "h": 90 } }],<br/>  "ext": { "account": "example-account" } }
 
-      APS->>Mock: APS TAM request
-      Mock-->>APS: APS bid response<br/>(encoded prices, no creative)
-      Note right of Mock: { "contextual": { "slots": [{<br/>  "slotID": "header-banner",<br/>  "amznbid": "Mi41MA==", // "2.50"<br/>  "fif": "1" }] } }
+      APS->>Mock: APS OpenRTB request
+      Mock-->>APS: OpenRTB bid response<br/>(decoded price and renderer URL)
+      Note right of Mock: { "seatbid": [{ "bid": [{<br/>  "impid": "header-banner", "price": 2.50,<br/>  "ext": { "creativeurl": "https://creative.example/render",<br/>    "tagtype": "iframe" } }] }] }
 
-      APS-->>Orch: AuctionResponse<br/>(APS bids)
+      APS-->>Orch: AuctionResponse<br/>(decoded price and typed renderer)
     and
       Orch->>Prebid: POST /openrtb2/auction<br/>OpenRTB 2.x format
       Note right of Orch: { "id": "request",<br/>  "imp": [{ "id": "header-banner",<br/>    "banner": { "w": 728, "h": 90 } }] }
 
       Prebid->>Mock: OpenRTB request
-      Mock-->>Prebid: OpenRTB response<br/>(clear prices, with creative)
+      Mock-->>Prebid: OpenRTB response<br/>(decoded price with creative)
       Note right of Mock: { "seatbid": [{ "seat": "prebid",<br/>  "bid": [{ "price": 2.00, "adm": "<html>..." }] }] }
 
       Prebid-->>Orch: AuctionResponse<br/>(Prebid bids)
     end
 
-    Note over Orch: Collected bids from all providers<br/>APS: encoded prices, no creative<br/>Prebid: clear prices, with creative
+    Note over Orch: Collected decoded-price bids<br/>APS: typed renderer, no adm<br/>Prebid: sanitized creative or cache source
     deactivate Mock
     deactivate APS
     deactivate Prebid
@@ -122,23 +122,19 @@ sequenceDiagram
     rect rgb(236,253,245)
       Note over Client,Mock: Mediation Flow
       activate Med
-      Orch->>Med: POST /adserver/mediate<br/>All bids for final selection
-      Note right of Orch: { "id": "auction-123",<br/>  "imp": [...],<br/>  "ext": { "bidder_responses": [<br/>    { "bidder": "amazon-aps",<br/>      "bids": [{ "encoded_price": "Mi41MA==" }] },<br/>    { "bidder": "prebid",<br/>      "bids": [{ "price": 2.00 }] }] } }
-
-      Med->>Med: Decode APS encoded prices<br/>Apply floor prices<br/>Select highest CPM per slot
-      Note right of Med: Base64 decode: "Mi41MA==" → "2.50"<br/>Winner: APS at $2.50 vs Prebid at $2.00
+      Orch->>Med: POST /adserver/mediate<br/>Decoded-price bids for final selection
+      Note right of Orch: APS price: 2.50<br/>Prebid price: 2.00
 
+      Med->>Med: Apply mediation policy and floors<br/>Select highest CPM per slot
       Med-->>Orch: OpenRTB response with winners
-      Note right of Med: { "seatbid": [{ "seat": "amazon-aps",<br/>  "bid": [{ "price": 2.50, "impid": "header-banner" }] }] }
+      Note right of Med: APS renderer state is restored from<br/>the reduced source bid after mediation
       deactivate Med
     end
   else No Mediator (parallel_only)
     rect rgb(253,243,235)
       Note over Client,Mock: Direct Winner Selection
-      Orch->>Orch: Compare clear prices only<br/>Skip APS (encoded prices)<br/>Select highest CPM
-      Note right of Orch: APS bids skipped (encoded prices)<br/>Winner: Prebid at $2.00 (only clear price)
-
-      Note over Orch: Results: Limited winner selection<br/>Cannot compare encoded APS prices<br/>Prebid wins by default
+      Orch->>Orch: Compare decoded prices<br/>Apply slot floor<br/>Select highest CPM
+      Note right of Orch: Winner: APS at $2.50 vs Prebid at $2.00
     end
   end
 
@@ -147,12 +143,12 @@ sequenceDiagram
     Note over Client,Mock: Response Assembly
     activate TS
     activate Client
-    Orch->>Orch: Transform to OpenRTB response<br/>Generate iframe creatives<br/>Rewrite creative URLs<br/>Add orchestrator metadata
+    Orch->>Orch: Transform to OpenRTB response<br/>Preserve typed render source<br/>Rewrite ordinary creatives<br/>Add orchestrator metadata
 
     Orch-->>TS: OpenRTB BidResponse
-    Note right of Orch: { "id": "auction-response",<br/>  "seatbid": [{ "seat": "amazon-aps",<br/>    "bid": [{ "price": 2.50,<br/>      "adm": "<iframe src=\"/first-party/proxy?tsurl=...\">",<br/>      "w": 728, "h": 90 }] }] }<br/>  "ext": { "orchestrator": {<br/>    "strategy": "parallel_mediation",<br/>    "bidders": 2, "time_ms": 150 } }
+    Note right of Orch: APS winner carries ext.trusted_server.renderer<br/>with no adm; ordinary winners retain sanitized adm/cache data
 
-    TS-->>Client: 200 OpenRTB response<br/>with winning creative
+    TS-->>Client: 200 OpenRTB response<br/>with winning render capability
     deactivate Orch
     deactivate TS
   end
@@ -160,8 +156,8 @@ sequenceDiagram
   %% === Creative Rendering ===
   rect rgb(239,246,255)
     Note over Client,Mock: Creative Rendering
-    Client->>Client: Inject winning creative<br/>Render iframe<br/>Load creative through proxy
-    Note right of Client: iframe src="/first-party/proxy?tsurl=...&tstoken=sig"<br/>Ensures first-party serving<br/>Maintains privacy & security
+    Client->>Client: Validate renderer descriptor<br/>Create opaque sandbox iframe<br/>Load /integrations/aps/renderer
+    Note right of Client: Fragment-bound nonce and one-time acknowledgement<br/>No allow-same-origin on the outer frame
     deactivate Client
   end
 ```
@@ -187,8 +183,8 @@ AuctionOrchestrator.run_auction()
   ├─ Launch all providers in parallel via select()
   ├─ Collect responses as they complete
   │
-  ├─[parallel_only]─── Select highest CPM per slot (clear prices only)
-  └─[parallel_mediation]─── Forward all bids to mediator for final selection
+  ├─[parallel_only]─── Select highest decoded CPM per slot
+  └─[parallel_mediation]─── Forward decoded-price bids to mediator for final selection
   │
   ▼
 Convert OrchestrationResult → OpenRTB 2.x Response
@@ -246,21 +242,17 @@ timeout_ms = 2000
 
 **How winner selection works:**
 
-1. Collect bids from all providers
-2. Group bids by slot ID
-3. For each slot, select the bid with the highest CPM
-4. Bids with `price: None` (e.g., APS encoded prices) are **skipped** — they cannot be compared without decoding
-5. Apply floor prices — drop winners below the slot's floor
+1. Collect bids from all providers.
+2. Group bids by slot ID.
+3. Skip bids without a decoded numeric price.
+4. Select the highest CPM for each slot.
+5. Apply floor prices and drop winners below the slot's floor.
 
-**Limitations:**
-
-- APS bids are effectively ignored since their prices are encoded
-- Only bidders returning clear decimal prices can compete
-- May result in lower revenue when APS would have won
+APS OpenRTB supplies decoded prices, so eligible APS bids participate directly without requiring a mediator.
 
 ### Parallel Mediation
 
-When a `mediator` is configured, all provider responses are forwarded to the mediator service for final winner selection. The mediator can decode proprietary price formats (like APS encoded bids) and apply unified floor pricing.
+When a `mediator` is configured, provider responses are forwarded to the mediator service for final winner selection and unified floor pricing.
 
 ```toml
 [auction]
@@ -272,21 +264,14 @@ timeout_ms = 2000
 
 **How mediation works:**
 
-1. Run all providers in parallel (same as parallel_only)
-2. Collect all responses
-3. Forward all bids to the mediator as a single request, including:
-   - Regular bids with clear `price` fields
-   - APS bids with `encoded_price` fields (from `amznbid` metadata)
-4. Mediator decodes APS prices, applies floor pricing, and selects the highest CPM per slot
-5. Mediator returns an OpenRTB response with winning bids at decoded prices
-6. Orchestrator filters any bids the mediator returned without a decoded price
-
-**Advantages over parallel_only:**
+1. Run all providers in parallel (same as parallel_only).
+2. Collect all responses.
+3. Forward bids with decoded numeric prices to the mediator.
+4. Let the mediator apply policy and choose a winner.
+5. Restore render/accounting state from the selected source bid.
+6. Filter any mediator winner without a decoded price.
 
-- All bidders compete on equal footing, including those with encoded prices
-- Centralized floor pricing enforcement
-- Proper APS integration — encoded bids are decoded and compared fairly
-- Higher potential revenue from broader competition
+Mediation is optional for APS. APS reduces to one candidate per impression before mediation so the selected renderer can be restored without same-slot ambiguity.
 
 ## Providers
 
@@ -354,33 +339,37 @@ bidders = ["appnexus", "rubicon"]
 
 ### APS Provider
 
-Transforms auction requests into Amazon's TAM (Transparent Ad Marketplace) format.
+Builds an independent banner OpenRTB request for Amazon Publisher Services.
 
 **Request transformation:**
 
-- `AdSlot` → `ApsSlot` with `slot_id`, `slot_name`, and `sizes` array
-- Publisher ID, page URL, user agent, and timeout included
+- banner `AdSlot` formats become secure OpenRTB impressions;
+- `ext.account` uses canonical `account_id`;
+- `ext.sdk` identifies the compatible Prebid contract; and
+- existing page, device, consent, identity, and geo privacy gates are preserved.
 
 **Response parsing:**
 
-- Bids have `price: None` — APS uses proprietary encoding (`amznbid` field is base64-encoded)
-- Bids have `creative: None` — APS does not return HTML creatives
-- Encoded price metadata (`amznbid`, `amznp`) preserved in bid metadata for the mediator
-- Only slots with `fif: "1"` (filled) are processed
-
-This is why mediation is important when using APS: without a mediator, APS bids cannot participate in winner selection.
+- decoded USD prices compete directly with other providers;
+- positive compatible dimensions and an HTTPS `creativeurl` are required;
+- script creatives are rejected before winner selection unless explicitly enabled;
+- one candidate per impression is retained deterministically; and
+- a minimized typed renderer is preserved instead of creative markup or APS notifications.
 
 ```toml
 [integrations.aps]
 enabled = true
-pub_id = "example-publisher"
-endpoint = "https://aps.example.com/e/dtb/bid"
+account_id = "example-account"
 timeout_ms = 800
+debug = false
+allow_script_creatives = false
 ```
 
+See [APS OpenRTB Integration](/guide/integrations/aps) for rollout and rendering requirements.
+
 ### AdServer Mock Mediator
 
-An external mediation service that receives all bidder responses and performs unified winner selection. The mock implementation uses base64 decoding for APS prices; a production mediator would use Amazon's proprietary decoding.
+An external mediation service that receives decoded-price bidder responses and performs final winner selection. APS prices are already decoded at the provider boundary.
 
 **Mediation request format:**
 
@@ -393,8 +382,8 @@ An external mediation service that receives all bidder responses and performs un
   "ext": {
     "bidder_responses": [
       {
-        "bidder": "amazon-aps",
-        "bids": [{ "imp_id": "header-banner", "encoded_price": "Mi41MA==" }]
+        "bidder": "aps",
+        "bids": [{ "imp_id": "header-banner", "price": 2.5, "adm": null }]
       },
       {
         "bidder": "prebid",
@@ -457,20 +446,21 @@ The unified bid format used across all providers:
 ```rust
 pub struct Bid {
     pub slot_id: String,
-    pub price: Option<f64>,           // None for APS (encoded)
+    pub price: Option<f64>,           // Missing prices fail closed
     pub currency: String,
-    pub creative: Option<String>,     // None for APS (no HTML from TAM)
+    pub creative: Option<String>,     // APS uses renderer instead of markup
     pub adomain: Option<Vec<String>>,
     pub bidder: String,
     pub width: u32,
     pub height: u32,
     pub nurl: Option<String>,         // Win notification URL
     pub burl: Option<String>,         // Billing URL
+    pub renderer: Option<BidRenderer>,
     pub metadata: HashMap<String, serde_json::Value>,
 }
 ```
 
-The `price` and `creative` fields are `Option` types specifically to handle APS, which returns encoded prices and no creative HTML. This is a key design decision — it lets the type system enforce awareness of encoded vs. decoded bids throughout the auction pipeline.
+The `price` field remains optional so missing-price bids fail closed. APS supplies a decoded price and a typed renderer instead of creative HTML; the renderer is retained through direct winner selection and mediation.
 
 ### OrchestrationResult
 
@@ -549,6 +539,45 @@ Auction results are returned in standard OpenRTB format with an `ext.orchestrato
 }
 ```
 
+APS renderer winners use the same OpenRTB response with a typed renderer extension instead of `adm`:
+
+```json
+{
+  "id": "auction-abc123",
+  "seatbid": [
+    {
+      "seat": "aps",
+      "bid": [
+        {
+          "id": "upstream-aps-bid-id",
+          "impid": "header-banner",
+          "price": 2.5,
+          "w": 728,
+          "h": 90,
+          "ext": {
+            "trusted_server": {
+              "renderer": {
+                "type": "aps",
+                "version": 1,
+                "accountId": "example-account",
+                "bidId": "upstream-aps-bid-id",
+                "tagType": "iframe",
+                "creativeUrl": "https://creative.example/render",
+                "aaxResponse": "fictional-base64-envelope",
+                "width": 728,
+                "height": 90
+              }
+            }
+          }
+        }
+      ]
+    }
+  ]
+}
+```
+
+For these bids, `id` preserves APS's upstream bid ID, `crid` is present only when APS supplies one, and `adm` is absent. TSJS understands this contract; other `/auction` consumers must render `ext.trusted_server.renderer` explicitly.
+
 EC identity is maintained with the `ts-ec` cookie; auction responses do not emit EC ID headers.
 
 ## Creative Processing
@@ -593,9 +622,10 @@ debug = false
 
 [integrations.aps]
 enabled = true
-pub_id = "example-publisher"
-endpoint = "https://aps.example.com/e/dtb/bid"
+account_id = "example-account"
 timeout_ms = 800
+debug = false
+allow_script_creatives = false
 
 [integrations.adserver_mock]
 enabled = true
@@ -629,12 +659,16 @@ price_floor = 0.50
 
 #### `[integrations.aps]`
 
-| Field        | Type   | Default                             | Description                 |
-| ------------ | ------ | ----------------------------------- | --------------------------- |
-| `enabled`    | bool   | `false`                             | Enable APS provider         |
-| `pub_id`     | string | —                                   | APS publisher ID (required) |
-| `endpoint`   | string | `https://aps.example.com/e/dtb/bid` | APS TAM endpoint            |
-| `timeout_ms` | u32    | `800`                               | Request timeout             |
+| Field                    | Type   | Default                       | Description                                                       |
+| ------------------------ | ------ | ----------------------------- | ----------------------------------------------------------------- |
+| `enabled`                | bool   | `false`                       | Enable APS provider                                               |
+| `account_id`             | string | —                             | APS account ID (required; `pub_id` is an alias)                   |
+| `endpoint`               | string | Built-in APS OpenRTB endpoint | Optional APS OpenRTB endpoint override                            |
+| `timeout_ms`             | u32    | `800`                         | Request timeout                                                   |
+| `debug`                  | bool   | `false`                       | Include the raw APS HTTP exchange in `/auction` provider metadata |
+| `inventory_domain`       | string | —                             | Override `site.domain` for APS-authorized inventory               |
+| `inventory_page_origin`  | string | —                             | HTTPS origin paired with `inventory_domain` for `site.page`       |
+| `allow_script_creatives` | bool   | `false`                       | Admit script bids before APS candidate reduction                  |
 
 #### `[integrations.adserver_mock]`
 
@@ -673,7 +707,8 @@ TRUSTED_SERVER__AUCTION__PROVIDERS=prebid,aps
 TRUSTED_SERVER__AUCTION__MEDIATOR=adserver_mock
 TRUSTED_SERVER__AUCTION__TIMEOUT_MS=2000
 TRUSTED_SERVER__INTEGRATIONS__PREBID__SERVER_URL=https://pbs.example.com
-TRUSTED_SERVER__INTEGRATIONS__APS__PUB_ID=5128
+TRUSTED_SERVER__INTEGRATIONS__APS__ACCOUNT_ID=example-account
+TRUSTED_SERVER__INTEGRATIONS__APS__DEBUG=false
 ```
 
 ## Floor Prices
@@ -682,7 +717,7 @@ Floor prices can be set per-slot in the auction request. The orchestrator enforc
 
 - In **parallel_only** mode: bids below the floor are dropped after selection
 - In **parallel_mediation** mode: the floor is sent to the mediator in `ext.config.price_floor`, and also enforced locally as a safety net
-- Bids with `price: None` (encoded prices) **pass through** floor checks — the floor is deferred to the mediator
+- Bids without a decoded numeric price are dropped before delivery in both strategies
 
 ## Error Handling
 
@@ -703,7 +738,7 @@ The auction system logs at multiple levels throughout execution:
 | Level   | Examples                                                                              |
 | ------- | ------------------------------------------------------------------------------------- |
 | `info`  | Auction request received, provider launch, bid counts, winner selection, total timing |
-| `debug` | Skipped bids (encoded prices), creative rewrite sizes                                 |
+| `debug` | Bid-drop reasons, mediation restoration notes, creative rewrite sizes                 |
 | `warn`  | Provider launch failures, parse failures, mediator bids without decoded prices        |
 
 ### Response Metadata
diff --git a/docs/guide/configuration.md b/docs/guide/configuration.md
index b975590c..53ccb8a9 100644
--- a/docs/guide/configuration.md
+++ b/docs/guide/configuration.md
@@ -1209,8 +1209,12 @@ timeout_ms = 2000
 
 [integrations.aps]
 enabled = true
-pub_id = "example-publisher"
-endpoint = "https://aps.example.com/e/dtb/bid"
+account_id = "example-account"
+debug = false
+# Optional pair for deployments hosted away from APS-authorized inventory.
+# inventory_domain = "publisher.example"
+# inventory_page_origin = "https://www.publisher.example"
+allow_script_creatives = false
 
 [integrations.prebid]
 enabled = true
@@ -1227,6 +1231,7 @@ TRUSTED_SERVER__AUCTION__PROVIDERS__1=prebid
 TRUSTED_SERVER__AUCTION__MEDIATOR=adserver_mock
 TRUSTED_SERVER__AUCTION__TIMEOUT_MS=2000
 TRUSTED_SERVER__AUCTION__CREATIVE_STORE=creative_store
+TRUSTED_SERVER__INTEGRATIONS__APS__DEBUG=false
 ```
 
 ## Fastly Runtime Config Store
diff --git a/docs/guide/integrations/aps.md b/docs/guide/integrations/aps.md
index 87876176..24c381cc 100644
--- a/docs/guide/integrations/aps.md
+++ b/docs/guide/integrations/aps.md
@@ -1,412 +1,256 @@
-# Amazon Publisher Services (APS) Integration
+# Amazon Publisher Services (APS) OpenRTB Integration
 
-Server-side bidding integration for Amazon's Transparent Ad Marketplace (TAM).
+Trusted Server can request banner bids from Amazon Publisher Services (APS) through the APS OpenRTB endpoint and let their decoded USD CPMs compete with other auction providers.
 
-## Overview
+> [!IMPORTANT]
+> APS's public adapter metadata describes Prebid Server support as unavailable. Confirm edge/server-originated traffic with your APS account team before a broad production rollout. Start with an isolated cohort and disable publisher-native APS demand for that cohort to avoid duplicate demand.
 
-The APS integration enables publishers to request bids from Amazon's demand sources server-side, providing:
+## Scope
 
-- **Privacy-first bidding**: No client-side ID tracking or third-party cookies required
-- **Reduced latency**: Server-side auction reduces page load impact
-- **Unified auction**: Integrates seamlessly with other bidders (Prebid, GAM)
-- **Performance**: Async bidding with configurable timeouts
+The integration supports:
 
-## Quick Start
+- banner impressions;
+- APS OpenRTB requests to the integration's built-in production endpoint;
+- decoded-CPM winner selection with or without a mediator;
+- direct `/auction` rendering;
+- client-side `trustedServer` Prebid adapter auctions through GAM; and
+- initial-navigation and page-bids rendering through GAM/Prebid Universal Creative.
 
-Get started with server-side APS bidding in 5 minutes.
+The integration does not implement:
 
-### Prerequisites
+- video or native impressions;
+- APS user sync;
+- Trusted Server delivery of APS `nurl` or `burl`; or
+- native `apstag.setDisplayBids()` handling for Trusted Server APS winners.
 
-- Fastly Compute service configured
-- APS publisher account with valid `pub_id`
-- Rust toolchain installed (see main README)
-
-### Step 1: Configure Fastly Backend
-
-Add APS backend to your Fastly service:
-
-**Option A: Via Fastly UI**
-
-1. Go to your service → Origins
-2. Click "Create a Backend"
-3. Configure:
-   - Name: `aax.amazon-adsystem.com`
-   - Address: `aax.amazon-adsystem.com`
-   - Port: `443`
-   - Enable TLS: ✓
-
-**Option B: Via `fastly.toml`**
-
-Add to your `fastly.toml`:
-
-```toml
-[[backends]]
-name = "aax.amazon-adsystem.com"
-address = "aax.amazon-adsystem.com"
-port = 443
-use_ssl = true
-ssl_cert_hostname = "aax.amazon-adsystem.com"
-ssl_sni_hostname = "aax.amazon-adsystem.com"
-```
-
-### Step 2: Enable APS in Configuration
-
-Edit `trusted-server.toml`:
+## Configuration
 
 ```toml
-# Enable APS bidding
 [integrations.aps]
 enabled = true
-pub_id = "5128"  # Replace with your APS publisher ID
-endpoint = "https://aax.amazon-adsystem.com/e/dtb/bid"
+account_id = "example-aps-account-id"
 timeout_ms = 800
+# Include raw APS request/response data in /auction metadata on test sites only.
+debug = false
+# Set both when the deployment hostname differs from APS-authorized inventory.
+# inventory_domain = "publisher.example"
+# inventory_page_origin = "https://www.publisher.example"
+allow_script_creatives = false
 
-# Configure auction to use APS
 [auction]
 enabled = true
-strategy = "parallel_only"  # Run APS alongside other bidders
-bidders = ["aps"]  # Add other bidders like ["aps", "prebid"]
+providers = ["aps", "prebid"]
 timeout_ms = 2000
 ```
 
-### Step 3: Deploy or Test Locally
+`account_id` is the canonical field. `pub_id` remains a compatibility alias for migration, including integer values, but new configuration should not use it. Supplying both names is an error.
 
-**Deploy to Fastly:**
+`debug` defaults to `false`. Enable it only on controlled test sites because it includes the raw APS request and response, including identity, consent, device, page, account, bid, and creative data, in the client-visible `/auction` response.
 
-```bash
-cargo build --release --target wasm32-wasip1
-fastly compute publish
-```
+`allow_script_creatives` defaults to `false`. While disabled, APS script bids are rejected before per-impression reduction, floors, mediation, and winner selection. Enable it only for a controlled cohort after the browser-security checks in [Rollout](#rollout) pass.
 
-**Test Locally:**
-
-```bash
-fastly compute serve
-```
-
-### Step 4: Verify It's Working
-
-Check the logs for APS activity:
-
-```bash
-# You should see:
-INFO APS: requesting bids for 2 slots (pub_id: 5128)
-DEBUG APS: sending bid request: {...}
-DEBUG APS: received response: {...}
-INFO APS returned 2 bids in 150ms
-```
-
-## Architecture
-
-```
-Publisher Page Request
-        ↓
-Auction Orchestrator
-        ↓
-APS Provider (async)
-        ↓
-https://aax.amazon-adsystem.com/e/dtb/bid
-        ↓
-Parse APS Response → Unified Bid Format
-        ↓
-Auction Winner Selection
-```
-
-## Configuration
+Set `inventory_domain` and `inventory_page_origin` together only when the public deployment hostname differs from the inventory identity authorized by APS. The domain becomes `site.domain`. The HTTPS page origin replaces the current page's scheme and host while preserving its path and query. The origin must be the inventory domain or one of its subdomains and cannot include credentials, a port, path, query, or fragment. These values come only from operator configuration; Trusted Server never accepts APS inventory identity from the client auction payload.
 
-### Basic Setup
+APS uses ordinary auction slot IDs and banner formats. Legacy creative-opportunity APS `slot_id` configuration is accepted for compatibility but ignored, and `bidders.aps.slotID` is not required. Remove both during migration.
 
-Add to `trusted-server.toml`:
-
-```toml
-[integrations.aps]
-enabled = true
-pub_id = "5128"  # Your APS publisher ID
-endpoint = "https://aax.amazon-adsystem.com/e/dtb/bid"
-timeout_ms = 800
-```
-
-### Environment Variables
-
-Override settings via environment variables:
-
-```bash
-TRUSTED_SERVER__INTEGRATIONS__APS__ENABLED=true
-TRUSTED_SERVER__INTEGRATIONS__APS__PUB_ID=5128
-TRUSTED_SERVER__INTEGRATIONS__APS__TIMEOUT_MS=800
-```
-
-## Auction Strategies
-
-### APS Only
-
-```toml
-[auction]
-enabled = true
-bidders = ["aps"]
-# No mediator = parallel only (highest CPM wins)
-```
-
-### APS + Prebid (Parallel)
-
-Best for maximum revenue:
+The APS provider may also participate through a configured mediator:
 
 ```toml
 [auction]
 enabled = true
 providers = ["aps", "prebid"]
+mediator = "adserver_mock"
 timeout_ms = 2000
-# No mediator = all providers compete, highest CPM wins
-
-[integrations.aps]
-enabled = true
-pub_id = "5128"
-timeout_ms = 800
-
-[integrations.prebid]
-enabled = true
-server_url = "https://prebid-server.example.com"
-timeout_ms = 1000
 ```
 
-**Benefits:**
-
-- Maximum fill rate
-- Best CPM selection
-- All bidders compete equally
-
-### APS + Prebid + Mediation
+## OpenRTB request
 
-Let a mediator decide winners:
+Trusted Server builds the APS request independently from its Prebid Server request. The request includes:
 
-```toml
-[auction]
-enabled = true
-providers = ["aps", "prebid"]
-mediator = "adserver_mock"  # Enables parallel mediation (mediator decides winner)
-timeout_ms = 2000
-```
+- `ext.account` from `account_id`;
+- `ext.sdk = { "source": "prebid", "version": "2.2.0" }`;
+- secure banner impressions and configured floors;
+- page, site, device, and consent fields allowed by the existing privacy gates; and
+- eligible EIDs only when consent policy permits them.
 
-## Request Format
+Precise latitude/longitude, disallowed identifiers, unsupported media types, and Trusted Server/Prebid-only extensions are not forwarded. Unsafe or oversized page URLs are omitted or replaced by the validated publisher fallback.
 
-The integration transforms unified `AuctionRequest` to APS TAM format:
+Raw outbound and inbound payloads are logged only at TRACE level. With debug disabled, auction metadata contains only aggregate counts and drop reasons.
 
-```json
-{
-  "pubId": "5128",
-  "slots": [
-    {
-      "slotID": "header-banner",
-      "slotName": "header-banner",
-      "sizes": [
-        [728, 90],
-        [970, 250]
-      ]
-    }
-  ],
-  "pageUrl": "https://example.com/article",
-  "ua": "Mozilla/5.0...",
-  "timeout": 800
-}
-```
-
-## Response Format
+## Debug mode
 
-APS returns bids in this format:
+Set `debug = true` under `[integrations.aps]` to include the direct APS HTTP exchange in the APS provider summary returned by `POST /auction`:
 
 ```json
 {
-  "bids": [
-    {
-      "slotID": "header-banner",
-      "price": 2.5,
-      "adm": "<div>Creative HTML</div>",
-      "w": 728,
-      "h": 90,
-      "adomain": ["amazon.com"],
-      "bidId": "bid-123",
-      "nurl": "https://win-notification.com",
-      "targeting": {
-        "amzniid": "user-id",
-        "amznbid": "2.50"
+  "metadata": {
+    "debug": {
+      "httpcalls": {
+        "aps": [
+          {
+            "requestbody": "{...}",
+            "requestheaders": { "content-type": ["application/json"] },
+            "responsebody": "{...}",
+            "responseheaders": { "content-type": ["application/json"] },
+            "status": 200,
+            "uri": "https://aps.example.com/e/pb/bid"
+          }
+        ]
       }
     }
-  ]
+  }
 }
 ```
 
-The integration automatically transforms this to unified `Bid` format.
+This follows the Prebid Server `metadata.debug.httpcalls` representation. APS makes one direct HTTP call per auction, so the map uses the provider key `aps` with one entry. Request and captured response bodies are strings, and header values are arrays so repeated headers are preserved. If a non-success response body cannot be read within the existing 2 MiB upstream limit, `responsebody` is omitted rather than reported as an empty body. APS does not add PBS-only `resolvedrequest` or `bidstatus` fields.
 
-## Testing
+The debug exchange is emitted for successful responses, `204 No Content`, malformed response bodies, and non-success HTTP statuses. Transport failures and auction timeouts happen before an HTTP response reaches the parser and continue to use the orchestrator's normal error metadata.
 
-### Unit Tests
+> [!WARNING]
+> APS debug metadata is unredacted and client-visible. Use it only on controlled test sites, and disable it before production rollout.
 
-```bash
-cargo test -p trusted-server-core aps::tests
-```
+## Bid eligibility and selection
 
-### Local Testing
+APS responses must use USD when a response currency is present. Each eligible bid must have:
 
-1. Configure APS in `trusted-server.toml`
-2. Set up Fastly backend
-3. Run locally:
-   ```bash
-   fastly compute serve
-   ```
-4. Inspect logs for bid requests/responses
+- a known `impid`;
+- a finite decoded price;
+- positive `w` and `h` that match a configured banner format;
+- an HTTPS, credential-free `ext.creativeurl` on an origin other than the publisher; and
+- `ext.tagtype` equal to `iframe`, or `script` when the script gate is enabled.
 
-### Testing
+Trusted Server rejects legacy contextual response shapes and bids with markup-only render sources. It deterministically keeps one eligible APS candidate per impression by highest price, then lexicographically smallest bid ID. This reduction prevents same-slot renderer ambiguity in mediation.
 
-For local testing without live APS credentials, configure the integration with test values:
+APS bids use `aps` as both the bidder identity and `hb_bidder`, regardless of an upstream seat value. The selected APS bid ID is used for `hb_adid`. APS then competes directly against other decoded-price bids and ordinary slot floors.
 
-```toml
-[integrations.aps]
-enabled = true
-pub_id = "test-publisher-123"
-endpoint = "https://aax.amazon-adsystem.com/e/dtb/bid"
-timeout_ms = 800
-```
+## Rendering security model
 
-Run unit tests:
+Trusted Server does not insert APS creative markup into the publisher document. It serializes only the selected bid into a versioned renderer descriptor. The base64 OpenRTB envelope has exactly this shape:
 
-```bash
-cargo test -p trusted-server-core aps
+```json
+{
+  "seatbid": [
+    {
+      "bid": [
+        {
+          "id": "fictional-selected-bid-id",
+          "price": 1.23,
+          "w": 300,
+          "h": 250,
+          "ext": {
+            "creativeurl": "https://creative.example/render",
+            "tagtype": "iframe"
+          }
+        }
+      ]
+    }
+  ]
+}
 ```
 
-## Monitoring
+Seats, `impid`, markup, notifications, user-sync data, sibling bids, losing seats, and unknown fields are not exposed. The browser decodes this envelope and cross-checks the ID, dimensions, URL, and tag type before any DOM mutation or message suppression.
 
-The integration logs detailed information at different levels:
+Both rendering paths use `GET /integrations/aps/renderer`, a static Trusted Server document with its own restrictive CSP. The document initializes the account-keyed APS queue and then loads only the fixed runner at `https://client.aps.amazon-adsystem.com/prebid-creative.js`.
 
-```rust
-// Info: Auction lifecycle
-log::info!("APS: requesting bids for 2 slots (pub_id: 5128)");
-log::info!("APS returned 2 bids in 150ms");
+The outer iframe uses these sandbox permissions:
 
-// Debug: Request/response payloads
-log::debug!("APS: sending bid request: {...}");
-log::debug!("APS: received response: {...}");
-
-// Warn: Non-success responses
-log::warn!("APS returned non-success status: 400");
+```text
+allow-forms
+allow-pointer-lock
+allow-popups
+allow-popups-to-escape-sandbox
+allow-scripts
+allow-top-navigation-by-user-activation
 ```
 
-## Troubleshooting
-
-### Problem: No bids returned
-
-**Check:**
-
-1. Verify `pub_id` is correct
-2. Check backend is configured: `fastly backend list`
-3. Increase timeout: `timeout_ms = 1200`
-4. View logs with `fastly compute serve`
-
-**Possible causes:**
-
-- Invalid `pub_id` configuration
-- Timeout too short (increase `timeout_ms`)
-- Backend not configured correctly
-- APS account not active
-
-### Problem: "Backend not found" error
-
-**Solution:**
-Add backend to Fastly (see Step 1)
-
-### Problem: Parse errors
-
-**Check:**
-
-- Enable debug logging
-- Verify endpoint URL is correct
-- Check APS API for changes
+It deliberately omits `allow-same-origin`, so APS and bidder execution remains below an opaque-origin boundary. The renderer response repeats these restrictions with a CSP `sandbox` directive, preventing another embedding path from restoring publisher-origin execution by omitting the iframe attribute. Trusted Server generates a fresh 128-bit nonce, binds it in the iframe URL fragment before navigation, and requires the same one-time nonce in the parent message and renderer acknowledgement. Existing slot content is retained until the static renderer has accepted the descriptor and loaded the fixed runner.
 
-**Solutions:**
+### Direct `/auction`
 
-- Enable debug logging to inspect response
-- Verify APS endpoint is correct
-- Check for API changes (update structs if needed)
+The TSJS auction client validates the typed renderer descriptor, creates the opaque renderer iframe, and sends the minimized envelope after the frame loads. Ordinary non-APS `adm` continues through the existing sanitizer and generic creative iframe.
 
-### Timeout Errors
+### GAM and Universal Creative
 
-**Symptoms:**
+For initial navigation and page-bids, Trusted Server publishes the same descriptor in `window.tsjs.bids`. The source-checked Prebid Universal Creative bridge accepts requests only from the iframe that owns the matching `hb_adid`, validates the complete envelope, and returns a static dynamic-renderer program that creates the same opaque renderer iframe.
 
-```
-APS request failed: Timeout
-```
-
-**Solutions:**
-
-- Increase `timeout_ms` in config
-- Check backend connectivity
-- Verify DNS resolution for `aax.amazon-adsystem.com`
+For client-side `trustedServer` adapter auctions, Prebid generates its own `hb_adid`. Trusted Server binds that generated ID to the validated APS descriptor in a bounded, expiring browser registry before GAM refresh. The bridge verifies that the requesting Universal Creative iframe belongs to the same ad unit, consumes the capability once, and passes the APS bid ID separately to the Amazon runner.
 
-## Performance Tuning
+These paths do not fetch PBS Cache, fire generic APS win/billing beacons, or call `apstag.setDisplayBids()` for the Trusted Server winner. Publisher-owned native APS objects are otherwise left untouched.
 
-### Timeout Configuration
+## Publisher CSP
 
-- **Default**: 800ms (matches APS client-side behavior)
-- **Aggressive**: 500ms (reduce latency, may miss some bids)
-- **Conservative**: 1200ms (maximize fill rate)
+The publisher policy must permit the same-origin renderer route, for example:
 
-```toml
-[integrations.aps]
-timeout_ms = 800  # Balance latency vs fill rate
+```text
+frame-src 'self'
 ```
 
-### Orchestrator Timeout
+Do not add `allow-same-origin` to the outer renderer sandbox. The renderer endpoint supplies its own CSP for the fixed runner and HTTPS creative resources.
 
-Ensure orchestrator timeout exceeds provider timeout:
+Before enabling script creatives, verify under the publisher's actual CSP that both iframe and script-tag creatives:
 
-```toml
-[auction]
-timeout_ms = 2000  # > sum of all provider timeouts
+- render and size correctly;
+- cannot read or modify `top.document`;
+- cannot restore publisher-origin execution;
+- reject malformed descriptors, nonce mismatches, and replay; and
+- work through both direct and GAM/Universal Creative paths.
 
-[integrations.aps]
-timeout_ms = 800
+If script rendering requires weakening the outer sandbox, leave `allow_script_creatives = false` and consult APS instead.
 
-[integrations.prebid]
-timeout_ms = 1000
-```
+## Migration from the legacy APS integration
 
-## Integration with Client-Side
+This release is a direct protocol cutover:
 
-While this implementation focuses on server-side bidding, you can optionally add client-side components later:
+1. Replace the legacy `/e/dtb/bid` endpoint with `/e/pb/bid`.
+2. Rename `pub_id` to `account_id`.
+3. Remove APS-specific slot ID configuration and remove `aps` from Prebid Server bidder lists. Trusted Server also filters APS from PBS requests for this path.
+4. Prepare GAM line items and Universal Creative for `hb_bidder=aps` and the selected APS `hb_adid`.
+5. Disable publisher-native APS demand for the Trusted Server test cohort.
 
-1. **ID Resolution**: Integrate third-party ID vendors client-side
-2. **Analytics**: Load `aps_csm.js` for viewability tracking
-3. **Config Loading**: Fetch `/configs/{pub_id}` for advanced settings
+There is no legacy runtime switch. Roll back by disabling `[integrations.aps]`, restoring native APS for the cohort, or deploying the prior binary.
 
-See the original network flow documentation for client-side patterns.
+## Rollout
 
-## Future Enhancements
+Use fictional values in source-controlled configuration and fixtures. Supply controlled account details out of band.
 
-Potential additions for complete APS TAM parity:
+1. Obtain APS account-team confirmation for edge-originated OpenRTB traffic.
+2. Enable Trusted Server APS only for an isolated cohort and disable native APS demand there.
+3. Keep `allow_script_creatives = false` and observe iframe bids through direct and GAM paths.
+4. Confirm outbound privacy fields, aggregate diagnostics, decoded-price competition, line-item targeting, dimensions, click-throughs, and opaque-origin isolation.
+5. Run the restrictive-CSP browser proof for script behavior.
+6. Only then enable script creatives for the isolated cohort and validate them in a real browser.
+7. Expand traffic only after APS confirmation and successful controlled validation.
 
-1. **Video Support**: Add video slot formats
-2. **ID Enrichment**: Server-side ID resolution (LiveRamp, ID5, etc.)
-3. **Advanced Targeting**: Pass user segments, geo data
-4. **Config API**: Fetch APS configuration from `/configs/{pub_id}`
-5. **Analytics**: Integrate with APS measurement endpoints
+## Troubleshooting
 
-## Reference
+### No APS bids
 
-- **APS TAM Docs**: https://aps.amazon.com/aps/transparent-ad-marketplace-api/
-- **Integration Code**: `crates/trusted-server-core/src/integrations/aps.rs`
-- **Tests**: `crates/trusted-server-core/src/integrations/aps.rs#tests`
-- **Example Config**: `trusted-server.toml`
+- Confirm `account_id` and account eligibility with APS.
+- Confirm the endpoint is `/e/pb/bid` and uses HTTPS without credentials.
+- If the deployment hostname differs from APS-authorized inventory, configure both `inventory_domain` and `inventory_page_origin` with the APS-approved identity.
+- Ensure `aps` appears in `auction.providers`.
+- Check aggregate APS drop reasons for currency, dimensions, render source, URL, tag type, or script-gate rejection.
+- Confirm the provider timeout fits inside the auction timeout.
+- On a controlled test site, set `debug = true` and inspect `ext.orchestrator.provider_details[].metadata.debug.httpcalls.aps` in the `/auction` response.
 
-## Support
+### Winner targets but does not render
 
-Questions? Issues?
+- Confirm `GET /integrations/aps/renderer` returns HTML with its CSP and `Referrer-Policy: no-referrer`.
+- Confirm publisher CSP permits `frame-src 'self'`.
+- Confirm the GAM creative uses the supported Prebid Universal Creative bridge and the winning `hb_adid`.
+- For client-side `trustedServer` adapter auctions, confirm Prebid's `bidResponse` contains a generated `adId` and that the corresponding capability appears briefly in `window.tsjs.apsPrebidRenderers` before rendering.
+- Ensure no native APS path is trying to handle the same cohort.
+- Keep script creatives disabled while diagnosing iframe rendering.
 
-1. Check logs: `fastly compute serve`
-2. Run tests: `cargo test aps`
-3. Verify configuration in `trusted-server.toml`
-4. Review this documentation
+## Verification
 
----
+```bash
+cargo test-fastly integrations::aps
+cargo test-fastly auction::orchestrator
+cargo test-fastly integrations::adserver_mock
 
-**Status**: ✅ Production Ready (Server-Side Bidding)
+cd crates/trusted-server-js/lib
+npx vitest run test/integrations/aps/render.test.ts test/core/auction.test.ts
+```
 
-**Last Updated**: 2025-12-23
+See `crates/trusted-server-core/src/integrations/aps.rs` for the request/parser implementation and `crates/trusted-server-js/lib/src/integrations/aps/render.ts` for the browser renderer contract.
diff --git a/docs/roadmap.md b/docs/roadmap.md
index d76c14b9..e0b16e33 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -75,6 +75,12 @@ Our development is focused on three key areas:
 - Real-time cohort updates
 - Secure Signals integration
 
+**Amazon Publisher Services (APS) OpenRTB Integration**
+
+- Banner OpenRTB bidding with decoded-price competition
+- Opaque sandboxed rendering for direct and GAM/Universal Creative paths
+- Controlled rollout pending APS account-team confirmation for edge-originated traffic
+
 ### Planned for 2026
 
 **Full Google Ad Manager (GAM) Support**
@@ -84,12 +90,6 @@ Our development is focused on three key areas:
 - Programmatic guaranteed support
 - First-party GAM reporting
 
-**Amazon Publisher Services (APS) Integration**
-
-- Transparent Ad Marketplace (TAM) support
-- A9 bidding integration
-- First-party APS header bidding
-
 **Kargo SSP Integration**
 
 - Native Kargo bid adapter
diff --git a/docs/superpowers/plans/2026-07-15-aps-openrtb-first-class-integration.md b/docs/superpowers/plans/2026-07-15-aps-openrtb-first-class-integration.md
new file mode 100644
index 00000000..b90fe5fe
--- /dev/null
+++ b/docs/superpowers/plans/2026-07-15-aps-openrtb-first-class-integration.md
@@ -0,0 +1,893 @@
+# Amazon APS OpenRTB First-Class Integration Implementation Plan
+
+> **For agentic workers:** Implement task-by-task with tests first. Do not use bare
+> `cargo test --workspace`; use the adapter-aware aliases from `.cargo/config.toml`.
+> Commit or push only when the supervising user explicitly requests it.
+
+**Goal:** Replace the legacy APS `/e/dtb/bid` integration with APS OpenRTB,
+participate with decoded prices without mediation, and render APS banner creatives in
+the direct-auction and GPT/page-bids browser paths.
+
+**Architecture:** Keep APS request/response policy in an APS-specific OpenRTB adapter.
+Map the response into the shared `Bid` plus a typed, versioned APS renderer descriptor.
+Carry that descriptor through `/auction` and the publisher bid map. TSJS builds a
+Trusted Server-owned bootstrap for the fixed APS `prebid-creative.js` runner and
+executes it in the approved sandbox. Ordinary `adm` remains on the existing mandatory
+sanitize/rewrite path.
+
+**Tech stack:** Rust 2024, generated OpenRTB types, serde/serde_json, base64 0.22,
+error-stack, URL validation, TypeScript, Vitest, Prebid Universal Creative messaging.
+
+**Spec:**
+`docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md`
+
+**Branch:** `issue-764-aps-openrtb`
+
+---
+
+## Context and guardrails for every task
+
+- APS may be implemented and tested before production edge support is confirmed.
+  Broad production rollout remains blocked until the APS account team confirms the
+  Fastly/edge contract.
+- Send APS SDK identity `{ "source": "prebid", "version": "2.2.0" }`.
+- Build the exact renderer allowlist: one bid with only `id`, `price`, `w`, `h`,
+  `ext.creativeurl`, and `ext.tagtype`. Do not preserve unknown fields or silently
+  expose the complete APS response.
+- The outer renderer sandbox must omit `allow-same-origin`.
+  `allow_script_creatives` is a server-side capability gate that defaults false;
+  disabled script bids must be dropped before candidate reduction/winner selection.
+  Enable it only under the staged opaque-origin and controlled-account test policy.
+- APS user sync and APS `nurl`/`burl` delivery are out of scope. Do not add either
+  browser path.
+- Cut over directly. Keep `pub_id` as an alias only; do not add a legacy protocol
+  switch.
+- When a Trusted Server APS renderer is present, do not call
+  `apstag.setDisplayBids()`.
+- Banner only. Do not advertise APS video support in this issue.
+- Do not weaken `sanitize_creative_html` or its tests.
+- Raw APS requests/responses remain TRACE-only. Never log real account IDs, EIDs,
+  consent strings, creative URLs, bid tokens, or response bodies at normal levels.
+- All committed fixtures/docs use fictional `example` values. Controlled test-account
+  values stay out of the repository and terminal transcripts intended for review.
+- Use `error-stack`; no anyhow/eyre/thiserror in core code.
+- Use `log::` macros, not `println!`; use descriptive `expect("should ...")`, not
+  `unwrap()`.
+- Run the focused test immediately after each production-code change.
+
+---
+
+## File map
+
+### Rust core
+
+- `crates/trusted-server-core/src/auction/types.rs`: bid identifiers and typed
+  renderer contract.
+- `crates/trusted-server-core/src/openrtb.rs`: narrowly scoped request/bid extension
+  serialization types if they are shared outside APS.
+- `crates/trusted-server-core/src/integrations/aps.rs`: configuration, OpenRTB request,
+  response parser, exact renderer envelope, candidate reduction, static renderer route,
+  diagnostics and provider dispatch.
+- `crates/trusted-server-core/src/integrations/mod.rs`: register the APS proxy route as
+  well as the separate auction provider.
+- `crates/trusted-server-core/src/auction/formats.rs`: page derivation and `/auction`
+  renderer extension.
+- `crates/trusted-server-core/src/auction/orchestrator.rs`: decoded-price direct-winner
+  coverage and stale-comment removal.
+- `crates/trusted-server-core/src/integrations/adserver_mock.rs`: preserve renderer and
+  IDs through mediation.
+- `crates/trusted-server-core/src/publisher.rs`: normal bid-map renderer transport and
+  APS `hb_adid`.
+
+### Browser
+
+- `crates/trusted-server-js/lib/src/core/types.ts`: APS renderer wire type.
+- `crates/trusted-server-js/lib/src/core/auction.ts`: parse `/auction` renderer ext.
+- `crates/trusted-server-js/lib/src/core/request.ts`: direct APS render dispatch.
+- New `crates/trusted-server-js/lib/src/integrations/aps/render.ts`: exact envelope
+  decoding/cross-checking, opaque renderer frame creation and postMessage dispatch.
+- `crates/trusted-server-js/lib/src/integrations/gpt/index.ts`: exact APS Universal
+  Creative bridge, APS beacon suppression and native-APS hook removal.
+- New `crates/trusted-server-js/lib/test/fixtures/aps-renderer-v1.json`: shared Rust/TS
+  golden wire fixture.
+- New `crates/trusted-server-js/lib/test/integrations/aps/render.test.ts` plus existing
+  core/GPT tests.
+- `crates/trusted-server-integration-tests/browser/`: restrictive-CSP and opaque-origin
+  Playwright coverage.
+
+### Configuration and docs
+
+- `trusted-server.example.toml`
+- `docs/guide/integrations/aps.md`
+- `CHANGELOG.md`
+
+---
+
+## Task 1: Add typed bid identifiers and renderer state
+
+**What:** Give the shared auction model enough typed state to distinguish OpenRTB bid,
+ad, and creative IDs and carry a validated APS renderer without using arbitrary
+metadata.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/auction/types.rs`
+- Modify: every production/test `Bid { ... }` construction found by
+  `rg -n 'Bid \{' crates/trusted-server-core`
+- Test: `crates/trusted-server-core/src/auction/types.rs`
+
+- [ ] Add failing serde tests for a bid with:
+  - separate `bid_id`, `ad_id`, and `creative_id`;
+  - an APS renderer version, account ID, selected bid ID, tag type, creative URL,
+    encoded response, and dimensions; and
+  - `renderer = None` omission for ordinary bids.
+- [ ] Define a strict `ApsTagType` enum with only `Iframe` and `Script`.
+- [ ] Define a versioned, typed renderer enum/descriptor. The serialized renderer must
+      use camelCase and a discriminator equivalent to:
+
+  ```json
+  {
+    "type": "aps",
+    "version": 1,
+    "accountId": "example-account-id",
+    "bidId": "fictional-bid-id",
+    "creativeId": "fictional-creative-id",
+    "tagType": "iframe",
+    "creativeUrl": "https://creative.example/render",
+    "aaxResponse": "base64-data",
+    "width": 300,
+    "height": 250
+  }
+  ```
+
+- [ ] Add to `Bid`:
+  - `bid_id: Option<String>`;
+  - `creative_id: Option<String>`; and
+  - `renderer: Option<...>`.
+- [ ] Make descriptor `creativeId` optional and omit it when APS does not return
+      `crid`; add a serde test for the absent-`crid` case.
+- [ ] Correct stale comments saying APS prices are encoded or that APS has no creative
+      delivery mechanism.
+- [ ] Update every `Bid` literal. Use `None` outside production parser paths; do not use
+      serde defaults to hide missed production mappings.
+- [ ] Update Prebid's `parse_bid` to preserve OpenRTB `id` as `bid_id` and `crid` as
+      `creative_id`, while retaining the existing strict `adid -> ad_id` semantics.
+- [ ] Run the focused tests:
+
+  ```bash
+  cargo test-fastly auction::types
+  cargo test-fastly integrations::prebid::tests::parse_bid
+  ```
+
+- [ ] Run `cargo fmt --all` and `cargo check-fastly` before proceeding.
+
+**Expected result:** Shared bids can represent APS renderer state without overloading
+`ad_id` or leaking renderer data through general metadata.
+
+---
+
+## Task 2: Cut APS configuration over to the OpenRTB contract
+
+**What:** Replace the public APS configuration terminology and default endpoint before
+replacing request/response behavior.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/integrations/aps.rs`
+- Test: existing APS test module in the same file
+
+- [ ] Add failing configuration tests proving:
+  - `account_id = "example-account-id"` deserializes;
+  - legacy `pub_id` deserializes to the same field;
+  - string and integer compatibility is retained;
+  - empty and whitespace-only strings fail validation;
+  - surrounding whitespace is trimmed deterministically;
+  - supplying both names fails as a duplicate field;
+  - the default endpoint is `/e/pb/bid`;
+  - HTTP, missing-host, and credential-bearing endpoint overrides fail validation; and
+  - APS remains disabled by default; and
+  - `allow_script_creatives` defaults false.
+- [ ] Rename `ApsConfig.pub_id` to `account_id`, using `pub_id` only as a serde alias.
+      Trim string values, reject empty-after-trim, normalize integers to strings, and
+      rename the custom deserializer/error text accordingly.
+- [ ] Add `allow_script_creatives: bool` with a serde default of `false`. Treat it as a
+      server-side bid-eligibility capability, not a browser-only rendering preference.
+- [ ] Change `default_endpoint()` to the built-in production APS `/e/pb/bid` endpoint. Use `https://aps.example.com/e/pb/bid` only for documentation and test overrides.
+
+- [ ] Replace generic URL-only endpoint validation with a custom check requiring HTTPS,
+      a non-empty host, and no username/password. Do not add a plaintext test exception:
+      the endpoint response is trusted to select executable renderer data.
+- [ ] Remove account IDs from registration and request INFO logs. Log only that APS was
+      registered and the endpoint/provider-safe state needed operationally.
+- [ ] Change `supports_media_type` to banner only.
+- [ ] Run:
+
+  ```bash
+  cargo test-fastly integrations::aps::tests
+  ```
+
+- [ ] Run `cargo fmt --all -- --check`.
+
+**Expected result:** Existing configs continue through `pub_id`, new configs use
+`account_id`, and no runtime protocol switch is introduced.
+
+---
+
+## Task 3: Replace the legacy request builder with APS OpenRTB
+
+**What:** Delete the private `/e/dtb/bid` request types and build the request described
+by the design spec from trusted auction context.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/integrations/aps.rs`
+- Modify only if useful: `crates/trusted-server-core/src/openrtb.rs`
+- Modify: `crates/trusted-server-core/src/auction/formats.rs`
+- Test: APS and auction-format test modules
+
+### 3.1 Request fixture tests
+
+- [ ] Add a failing complete-request test with fictional values. Assert exact JSON for:
+  - request `id`, `tmax`, and `cur = ["USD"]`;
+  - `ext.account`;
+  - `ext.sdk.source = "prebid"` and `version = "2.2.0"`;
+  - one impression per eligible slot with direct `imp.id` mapping;
+  - banner `format`, first `w`/`h`, `topframe = 0`, floor, floor currency, and
+    unconditional `secure = 1`;
+  - site page/domain/publisher fields;
+  - consent-allowed user ID and EIDs;
+  - UA/IP/language/DNT and coarse geo;
+  - TCF/USP/GPP registrations with COPPA omitted because no trusted signal exists; and
+  - absence of all PBS-only request and impression extensions.
+- [ ] Add focused privacy/validation tests:
+  - latitude/longitude are omitted while permitted coarse geo remains;
+  - gated-out user/EID values stay absent;
+  - no user data, keywords, gender, YOB, customdata, cookies, or arbitrary headers;
+  - non-banner slots are omitted;
+  - dimensions above `i32::MAX` are omitted safely;
+  - empty/invalid formats cannot create a malformed impression;
+  - configured and effective timeout use the orchestrator-granted budget.
+
+### 3.2 `/auction` page derivation
+
+- [ ] Add failing tests to `auction/formats.rs` proving:
+  - a valid same-publisher HTTP(S) `Referer` becomes the `/auction` current page;
+  - userinfo, wrong-host, non-HTTP(S), malformed, and oversized URLs are rejected;
+  - rejection falls back to the configured publisher origin; and
+  - no unrestricted browser body field is accepted as page context.
+- [ ] Implement a small private URL-validation helper. Reuse it in APS referrer
+      handling if practical, but do not make it a broad URL-policy refactor.
+
+### 3.3 Implementation
+
+- [ ] Remove `ApsBidRequest`, `ApsSlot`, legacy consent wrappers, slot-ID fallback, and
+      `to_aps_request`.
+- [ ] Add APS request extension types locally in `aps.rs` unless another module must
+      serialize them. Implement `ToExt` consistently with existing OpenRTB extension
+      types.
+- [ ] Implement `build_openrtb_request(&AuctionRequest, &AuctionContext)` using generated
+      OpenRTB types and `to_openrtb_i32`.
+- [ ] Build registrations from the existing `ConsentContext` placements. Copy only the
+      small field mapping needed by APS; do not expose/refactor the PBS builder in this
+      task.
+- [ ] Derive `site.ref` only from a valid HTTP(S) downstream `Referer` that differs from
+      the normalized current page.
+- [ ] Change `request_bids` to serialize/send the OpenRTB body with
+      `Content-Type: application/json`, the existing bounded auction timeout, and no
+      forwarded cookies.
+- [ ] Keep serialized request logging at TRACE.
+- [ ] Run:
+
+  ```bash
+  cargo test-fastly integrations::aps::tests
+  cargo test-fastly auction::formats
+  cargo check-fastly
+  ```
+
+- [ ] Review serialized request fixtures against the immutable upstream request code;
+      explicitly confirm no `ext.prebid` or Trusted Server signing extension appears.
+
+**Expected result:** Every eligible APS banner slot produces a standards-based OpenRTB
+impression with explicit APS and privacy policy.
+
+---
+
+## Task 4: Parse APS OpenRTB and build the minimized renderer envelope
+
+**What:** Replace `contextual.slots` parsing with strict `seatbid` parsing, decoded CPM,
+one APS candidate per impression, and the exact renderer envelope.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/integrations/aps.rs`
+- Test: APS test module
+
+### 4.1 Add failing response tests
+
+- [ ] A runner-compatible banner bid maps:
+  - `id -> bid_id`;
+  - optional `adid -> ad_id` and `crid -> creative_id`;
+  - `impid -> slot_id`;
+  - decoded price/USD, dimensions and domains;
+  - `Bid.bidder = "aps"` regardless of upstream seat; and
+  - `ext.creativeurl`/`ext.tagtype` into the typed renderer.
+- [ ] Missing, string, numeric, and unexpected seat values never become `Bid.bidder` or
+      `hb_bidder` and do not invalidate an otherwise valid bid.
+- [ ] A valid runner-compatible bid without `crid` remains renderable with no
+      `creativeId` in the descriptor.
+- [ ] The immutable official adapter fixture (`ext.bidder` only) is an expected safe
+      drop because the live runner requires `creativeurl`/`tagtype`.
+- [ ] `iframe` and `script` parse into strict enum variants. With
+      `allow_script_creatives = false`, every script bid is safe-dropped before
+      per-impression reduction and winner selection; iframe bids remain eligible.
+- [ ] With one higher-priced script bid and one lower-priced iframe bid for the same
+      impression, the disabled script cannot win and the iframe candidate survives.
+      With only disabled script bids, APS returns no bid.
+- [ ] An APS bid with `adm` but no valid URL/tag type is dropped. When valid renderer
+      metadata coexists with `adm`, all markup is excluded from the browser envelope
+      and `Bid.creative`.
+- [ ] HTTP 204, empty/missing `seatbid`, and seat bids with no bids are normal no-bids.
+- [ ] Legacy `{ "contextual": ... }` is `Error`/`unexpected_response_shape`.
+- [ ] Drop individual bids with unknown/missing `impid`, invalid price/currency/media,
+      missing/zero/out-of-range/incompatible `w` or `h`, missing bid ID, invalid tag
+      type, disabled script capability, or invalid creative URL.
+- [ ] Creative URLs using HTTP, credentials, excessive length, malformed syntax, or the
+      configured publisher origin are rejected.
+- [ ] One structurally malformed bid does not discard another valid bid. Invalid JSON or
+      non-representable numeric literals fail the complete response.
+- [ ] APS `nurl`/`burl` are intentionally discarded, and top-level `ext.userSyncs`
+      reaches neither `Bid`, diagnostics, nor renderer data.
+- [ ] Diagnostics contain only fixed reason/count keys and never IDs, URLs, payloads,
+      account values, seats, or raw extension data.
+
+### 4.2 Exact envelope and collision tests
+
+- [ ] Add `test/fixtures/aps-renderer-v1.json` containing exactly:
+  - root `seatbid`;
+  - one seat object containing only `bid`;
+  - one bid containing only `id`, `price`, `w`, `h`, and `ext`; and
+  - `ext` containing only `creativeurl` and `tagtype`.
+- [ ] Assert Rust serialization equals that golden JSON semantically and that decoded
+      `aaxResponse` has no top-level ID/currency, seat, impid, ad/crid/domain,
+      notifications, markup, syncs, sibling bids, or unknown extensions.
+- [ ] Remove unknown fields after transient parsing; do not copy an upstream extension
+      map wholesale into the renderer envelope.
+- [ ] Add a response over the 256 KiB pre-base64 cap and assert
+      `render_payload_too_large`.
+- [ ] Add two valid APS bids with the same impression/seat. Assert the parser returns
+      only the highest price; for a tie, lexicographically lowest bid ID wins with its
+      own matching renderer payload.
+
+### 4.3 Implementation
+
+- [ ] Remove all legacy request/response types, slot maps and tests.
+- [ ] Special-case HTTP 204 before body collection/JSON parsing.
+- [ ] Parse the response as `serde_json::Value`, validate response-level fields, then
+      validate each bid independently so a wrong-typed bid cannot discard valid
+      siblings.
+- [ ] Set `Bid.bidder = "aps"`; discard upstream seat/network ID unless a bounded typed
+      internal consumer is introduced. Set APS `nurl = None` and `burl = None`.
+- [ ] Require present, positive, compatible `w` and `h`. Apply
+      `allow_script_creatives` before adding a candidate to the per-impression group so
+      a disabled script cannot reach floors, mediation, or winner selection.
+- [ ] Validate creative URL against the configured publisher origin and build the exact
+      allowlisted envelope from new values rather than cloning upstream objects.
+- [ ] Group accepted candidates by `impid`, reduce deterministically to one, then build
+      the final `AuctionResponse` and aggregate diagnostics.
+- [ ] Preserve `collect_response_bounded(..., UPSTREAM_RTB_MAX_RESPONSE_BYTES, "aps")`,
+      TRACE-only raw body logging, and safe aggregate normal logs.
+- [ ] Run:
+
+  ```bash
+  cargo test-fastly integrations::aps::tests
+  cargo fmt --all -- --check
+  cargo clippy-fastly
+  ```
+
+**Expected result:** APS returns at most one priced, renderer-compatible candidate per
+impression, with an exact browser envelope and stable `bidder = "aps"`.
+
+---
+
+## Task 5: Emit APS winners through `/auction` and prove direct selection
+
+**What:** Use the new identifiers and renderer in the OpenRTB response without
+manufacturing an empty creative, then replace the old mediation assumptions.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/auction/formats.rs`
+- Modify: `crates/trusted-server-core/src/openrtb.rs` if a typed bid extension helper is
+  useful
+- Modify: `crates/trusted-server-core/src/auction/orchestrator.rs`
+- Test: format and orchestrator test modules
+
+### 5.1 Failing tests
+
+- [ ] `/auction` maps `Bid.bid_id`, `ad_id`, and optional `creative_id` to OpenRTB
+      `id`, `adid`, and optional `crid` instead of fabricating APS identifiers.
+- [ ] An APS renderer winner has no `adm` key and has
+      `ext.trusted_server.renderer` with the complete versioned descriptor—not a
+      `{type,version}` abbreviation.
+- [ ] A normal `Bid.creative` is still sanitized and rewritten before becoming `adm`.
+- [ ] A winning bid with neither creative nor renderer fails explicitly; it does not
+      serialize `adm: ""`.
+- [ ] A renderer descriptor does not enter the HTML sanitizer.
+- [ ] APS decoded price wins with no mediator when it is highest.
+- [ ] APS loses to a higher clear-price bid.
+- [ ] APS is removed below a slot floor.
+- [ ] Optional mediator presence does not make decoded APS pricing special.
+
+### 5.2 Implementation
+
+- [ ] Add a typed bid-extension serializer for `trusted_server.renderer`.
+- [ ] In `convert_to_openrtb_response`:
+  - preserve real bid/ad/creative IDs;
+  - process `creative` only through the existing sanitize/rewrite branch;
+  - emit renderer ext only for a typed renderer; and
+  - return an auction error for a winner with no render source.
+- [ ] Remove stale “mediation should have provided creative” APS assumptions and encoded
+      price comments.
+- [ ] Replace old orchestrator APS tests with decoded-price/floor tests. Do not change the
+      winner algorithm itself.
+- [ ] Run:
+
+  ```bash
+  cargo test-fastly auction::formats
+  cargo test-fastly auction::orchestrator
+  cargo fmt --all -- --check
+  ```
+
+**Expected result:** Direct clients receive a priced APS winner with an explicit render
+capability and never mistake an empty `adm` for a creative.
+
+---
+
+## Task 6: Preserve APS renderer state through mediation and publisher bid maps
+
+**What:** Ensure both publisher paths expose the same APS descriptor and a mediator
+cannot accidentally strip it.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/integrations/adserver_mock.rs`
+- Modify: `crates/trusted-server-core/src/publisher.rs`
+- Test: tests in both files
+
+### 6.1 Mediation tests
+
+- [ ] Add a regression test documenting the current collision: two unreduced APS bids
+      with the same provider/slot/bidder overwrite the `(provider, slot, bidder)` index
+      and can restore the wrong renderer.
+- [ ] Feed the parser's reduced APS response into mediation and prove only the selected
+      source bid reaches the index/request and its bid ID/renderer survive reconstruction.
+- [ ] Keep the broader mediator index unchanged in this issue; APS avoids its existing
+      ambiguity by returning one candidate per impression. Extend restoration only for
+      `bid_id`, optional `creative_id`, and renderer while preserving existing non-APS
+      notification/cache behavior.
+- [ ] Run:
+
+  ```bash
+  cargo test-fastly integrations::adserver_mock
+  ```
+
+### 6.2 Bid-map tests
+
+- [ ] Add failing `build_bid_map` tests proving:
+  - APS renderer is present when `include_adm = false`;
+  - renderer data is identical for initial-page and page-bids serialization;
+  - `hb_bidder` is always `aps`, never upstream seat/network ID;
+  - `hb_adid` uses APS selected `bid_id` ahead of OpenRTB `adid`;
+  - PBS Cache UUID remains highest priority for PBS bids;
+  - APS `nurl`/`burl` are absent while existing non-APS notifications are unchanged;
+  - no general metadata is exposed in normal mode;
+  - `aaxResponse` and account data survive `build_bids_script` escaping without
+    breaking out of the script; and
+  - a non-APS bid has no renderer property.
+- [ ] Update `build_bid_map` to serialize typed renderer data normally while retaining
+      `adm`/`debug_bid` only under the existing debug flag.
+- [ ] Set APS `hb_adid` from the descriptor's selected bid ID. Preserve current cache and
+      ad-ID fallbacks.
+- [ ] Update `debug_bid` deliberately: IDs may be shown under existing debug behavior,
+      but do not duplicate the potentially large encoded renderer envelope there.
+- [ ] Run:
+
+  ```bash
+  cargo test-fastly publisher
+  cargo fmt --all -- --check
+  ```
+
+**Expected result:** Direct, mediated, initial-navigation, and SPA auction paths retain
+one typed APS render contract without exposing losing bids or arbitrary metadata.
+
+---
+
+## Task 7: Add the opaque APS renderer endpoint and direct-auction integration
+
+**What:** Serve a static renderer document with its own CSP, validate the exact data the
+vendor consumes, and keep all APS/bidder execution below an outer opaque-origin
+sandbox.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/integrations/aps.rs`
+- Modify: `crates/trusted-server-core/src/integrations/mod.rs`
+- New: `crates/trusted-server-js/lib/src/integrations/aps/render.ts`
+- New: `crates/trusted-server-js/lib/test/integrations/aps/render.test.ts`
+- New: `crates/trusted-server-js/lib/test/fixtures/aps-renderer-v1.json`
+- Modify: `crates/trusted-server-js/lib/src/core/types.ts`
+- Modify: `crates/trusted-server-js/lib/src/core/auction.ts`
+- Modify: `crates/trusted-server-js/lib/src/core/request.ts`
+- Modify: `crates/trusted-server-js/lib/test/core/auction.test.ts`
+- Modify/add: `crates/trusted-server-integration-tests/browser/`
+
+### 7.1 Shared wire contract
+
+- [ ] Add TypeScript discriminated types matching the Rust descriptor, with optional
+      `creativeId`.
+- [ ] Make the shared fictional JSON fixture the source of truth: Rust serialization
+      equals it and TS tests import it.
+- [ ] Add `/auction` parser tests for valid renderer ext, absent APS `adm`, optional
+      creative ID, ordinary non-APS `adm`, unrelated ext, and malformed descriptors.
+- [ ] Keep parsing structural; complete trust validation happens before DOM/message
+      side effects.
+
+### 7.2 Static renderer endpoint
+
+- [ ] Add APS to `integrations::builders()` as a proxy registration using the same
+      validated `ApsConfig`, `.with_proxy(...)`, and `.without_js()`.
+- [ ] Register only `GET /integrations/aps/renderer` and return a static document—no
+      account, bid, URL, or response data in HTML.
+- [ ] Add Rust tests for exact route registration, method rejection, content type,
+      `nosniff`, `Referrer-Policy: no-referrer`, and the explicit renderer CSP. The CSP
+      must repeat the approved sandbox tokens without `allow-same-origin` so direct
+      embedding cannot bypass the opaque boundary.
+- [ ] Before loading the vendor runner, the static initializer reads and strictly
+      validates the expected nonce from the iframe URL fragment, stores it, removes the
+      fragment from visible history, and installs its one-message listener.
+- [ ] The static script accepts one parent message, verifies `event.source`, version,
+      exact structure, and equality with the independently fragment-bound nonce, then
+      removes its listener, initializes the official account queue, dispatches
+      `prebid/creative/render`, and dynamically loads the fixed runner. Reply with the
+      accepted nonce only after runner load (or report runner failure). Because the
+      sandbox origin is opaque, use `"*"` as the target origin in both directions but
+      require the exact child/source window and one-time nonce.
+- [ ] Load only the fixed Amazon runner URL; do not interpolate renderer data into
+      script text, HTML, `srcdoc`, `document.write`, or another executable sink.
+- [ ] Run:
+
+  ```bash
+  cargo test-fastly integrations::aps
+  cargo test-fastly integrations::tests
+  ```
+
+### 7.3 Decode and cross-check consumed data
+
+- [ ] `validateApsRenderer` must base64-decode UTF-8 JSON and require the exact allowlist:
+      one seat, one bid, exact bid/ext keys, finite price, dimensions, URL, and tag type.
+- [ ] Cross-check decoded ID/dimensions/URL/tag type against descriptor fields.
+- [ ] Reject unknown keys, markup, notifications, syncs, invalid base64/UTF-8/JSON,
+      non-HTTPS or credential-bearing URLs, and URLs matching `location.origin`.
+- [ ] Validate before slot clearing, `stopImmediatePropagation`, iframe creation, or
+      `postMessage`.
+- [ ] Repeat message/envelope validation inside the static renderer document.
+
+### 7.4 Opaque direct renderer
+
+- [ ] `renderApsCreative` creates a sized iframe with `src` set to
+      `/integrations/aps/renderer`; it never uses outer `srcdoc`.
+- [ ] Apply exactly these tokens and assert `allow-same-origin` is absent:
+
+  ```text
+  allow-forms
+  allow-pointer-lock
+  allow-popups
+  allow-popups-to-escape-sandbox
+  allow-scripts
+  allow-top-navigation-by-user-activation
+  ```
+
+- [ ] Generate at least 128 random bits per frame with `crypto.getRandomValues`, encode
+      them as strict base64url, and set `iframe.src` to the trusted renderer URL with
+      that nonce in the fragment before insertion/navigation. After load, post the
+      validated descriptor with the same nonce. Clear existing content and reveal the
+      frame only after an exact source- and nonce-bound runner-ready acknowledgement;
+      remove an unacknowledged or failed hidden frame after a bounded timeout.
+- [ ] Reject a missing/malformed fragment, nonce mismatch, repeat, or stale message; a
+      nonce carried only in the posted message is not sufficient.
+- [ ] Leave existing slot content intact on validation/load failure and log no payload,
+      account, URL or bid ID.
+- [ ] Dispatch valid APS renderer bids before ordinary non-APS `adm`; do not change the
+      generic sanitizer/renderer.
+
+### 7.5 Restrictive-CSP and origin proof
+
+- [ ] Add Playwright coverage using a restrictive publisher CSP that permits only
+      `frame-src 'self'` for the renderer route.
+- [ ] Use a local fictional runner/creative implementation matching observed APS
+      iframe/script behavior; CI must not depend on the live Amazon script.
+- [ ] Prove iframe and fetched-HTML script creatives cannot read or modify
+      `top.document`, even though the nested vendor frame requests
+      `allow-same-origin`. Also embed the renderer without an iframe sandbox attribute
+      and prove the response-level CSP sandbox still keeps it opaque.
+- [ ] Prove the renderer route's CSP permits required HTTPS ad resources, the outer
+      frame stays opaque, malformed/mismatched envelopes or fragment/message nonce
+      mismatches do not clear slots, replay is rejected, and the runner can size/render
+      without parent-origin `frameElement` access.
+- [ ] Keep `allow_script_creatives = false` for normal traffic during local browser
+      proof. If script rendering/resizing fails, keep the server gate false and stop for
+      an APS-supported isolated renderer contract. Never add `allow-same-origin` to the
+      outer frame.
+- [ ] Run:
+
+  ```bash
+  cd crates/trusted-server-js/lib
+  npx vitest run test/integrations/aps/render.test.ts test/core/auction.test.ts
+  node build-all.mjs
+  npm run format
+
+  cd ../../../crates/trusted-server-integration-tests/browser
+  npx playwright test
+  ```
+
+**Expected result:** Direct APS rendering uses a separately served document below an
+opaque outer sandbox with a pre-bound, one-time nonce; script bids cannot win while the
+default-off server capability is disabled.
+
+---
+
+## Task 8: Integrate APS with the GPT/Prebid Universal Creative bridge
+
+**What:** Serve APS descriptors through the existing source-checked `Prebid Request`
+message path and stop signaling the native APS SDK for TS winners.
+
+**Files:**
+
+- Modify: `crates/trusted-server-js/lib/src/integrations/gpt/index.ts`
+- Modify: `crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts`
+- Modify if needed: `crates/trusted-server-js/lib/test/integrations/gpt/index.test.ts`
+- Reuse: `src/integrations/aps/render.ts`
+
+### 8.1 Add failing bridge tests
+
+- [ ] A matching APS `hb_adid` and renderer:
+  - is accepted only from the owning slot's message source;
+  - is fully decoded/cross-checked before `stopImmediatePropagation()`;
+  - does not fetch PBS Cache or fire generic nurl/burl beacons;
+  - posts one exact serializable `Prebid Response` using the deployed Universal
+    Creative renderer version; and
+  - creates only the opaque renderer-route iframe before posting the descriptor.
+- [ ] Two concurrent requests for the same APS ad ID do not double-render.
+- [ ] An APS descriptor requested from another slot is ignored.
+- [ ] Invalid renderer data does not stop another legitimate handler and does not clear
+      a slot.
+- [ ] Existing debug-ADM and PBS Cache tests remain green.
+- [ ] `adInit()` does not call `apstag.setDisplayBids()` for a bid with a Trusted Server
+      APS renderer, even if `window.apstag` exists.
+- [ ] A publisher-owned native APS SDK remains otherwise untouched; TS does not delete,
+      reinitialize, or monkey-patch it.
+
+### 8.2 Implement bridge support
+
+- [ ] Import the shared envelope validator/opaque-frame helper without importing the
+      full Prebid bundle.
+- [ ] Add the APS branch after source-slot ownership and full renderer validation, before
+      debug ADM/PBS Cache branches.
+- [ ] Define and fixture-test the exact Universal Creative message object, including
+      `rendererVersion`; do not describe or send a non-cloneable function.
+- [ ] Compute an absolute `/integrations/aps/renderer` URL from the trusted publisher
+      page origin before crossing into GAM; a relative URL in the creative frame would
+      resolve against GAM. Validate that URL separately from APS data.
+- [ ] Keep renderer source static and limited to creating the sandboxed iframe with that
+      absolute renderer URL plus a fresh nonce fragment, then post validated data and
+      the matching nonce after load and resolve only after the source- and nonce-bound
+      renderer-ready acknowledgement.
+- [ ] Preserve `renderingAdIds` and live `window.tsjs.bids`. Do not call
+      `fireWinBillingBeacons` for APS; existing non-APS beacon deduplication is unchanged.
+- [ ] Remove the `apstag?.setDisplayBids?.()` block that treats every APS targeting bid
+      as a native SDK bid. Update comments accordingly.
+- [ ] Run:
+
+  ```bash
+  cd crates/trusted-server-js/lib
+  npx vitest run \
+    test/integrations/aps/render.test.ts \
+    test/integrations/gpt/ad_init.test.ts \
+    test/integrations/gpt/index.test.ts \
+    test/integrations/gpt/spa_hook.test.ts
+  npm run format
+  ```
+
+**Expected result:** Initial navigation and SPA page-bids render the selected APS bid
+through the same typed bootstrap, without relying on native `apstag` state.
+
+---
+
+## Task 9: Update operator configuration, migration docs, and changelog
+
+**What:** Replace all legacy public guidance and document test/rollout dependencies.
+
+**Files:**
+
+- Modify: `trusted-server.example.toml`
+- Rewrite: `docs/guide/integrations/aps.md`
+- Modify: `CHANGELOG.md`
+- Review references found by:
+
+  ```bash
+  rg -n 'e/dtb/bid|pub_id|amznbid|amznp|setDisplayBids|APS.*mediat' \
+    --glob '!target/**' .
+  ```
+
+- [ ] Change the example to `account_id` and `/e/pb/bid`, with fictional values.
+- [ ] Document `pub_id` as a compatibility alias and duplicate-name failure.
+- [ ] Remove any claim that `slot_id`/`bidders.aps.slotID` is required for the OpenRTB
+      provider.
+- [ ] Document banner-only scope, USD comparison, decoded-price direct winners, and
+      aggregate diagnostics.
+- [ ] Document both rendering paths, static renderer endpoint, fixed APS runner URL,
+      exact envelope allowlist, fragment-bound nonce, outer sandbox without
+      `allow-same-origin`, renderer endpoint/publisher CSP requirements, and the
+      default-off `allow_script_creatives` server gate.
+- [ ] State that user sync and Trusted Server firing of APS `nurl`/`burl` are not
+      implemented.
+- [ ] State that public APS metadata says PBS unsupported and production edge traffic
+      still requires account-team confirmation.
+- [ ] Add a cohort rollout checklist:
+  - TS APS enabled;
+  - native APS demand disabled for that cohort;
+  - GAM line item/Universal Creative prepared for `hb_bidder=aps` and selected
+    `hb_adid`;
+  - iframe rendering observed first while `allow_script_creatives = false`;
+  - script enabled only for the isolated cohort after local browser proof, then observed
+    in a real browser; and
+  - no real IDs/tokens captured in docs or fixtures.
+- [ ] Document rollback as disabling APS, restoring native APS for the cohort, or binary
+      rollback—not a legacy config switch.
+- [ ] Add a breaking/migration changelog entry for endpoint and canonical field changes.
+- [ ] Run:
+
+  ```bash
+  cd docs
+  npx prettier --write \
+    superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md \
+    superpowers/plans/2026-07-15-aps-openrtb-first-class-integration.md \
+    guide/integrations/aps.md
+  npm run format
+  ```
+
+**Expected result:** Operators cannot accidentally configure the old protocol or assume
+user sync/video/native SDK behavior that no longer exists.
+
+---
+
+## Task 10: Controlled APS and browser verification
+
+**What:** Validate the uncertain external contract without putting account-specific
+material into source control.
+
+**Prerequisites:** Controlled APS account/config supplied out of band; native APS demand
+disabled for the test cohort; representative GAM line items and publisher CSP; local
+restrictive-CSP/opaque-origin script proof already passing.
+
+- [ ] Deploy with APS enabled only in the controlled cohort and
+      `allow_script_creatives = false` initially.
+- [ ] Prove with parser/orchestrator telemetry and tests that disabled script bids are
+      removed before candidate reduction/winner selection and cannot leave a winning
+      slot without a renderer.
+- [ ] Confirm the outbound body has:
+  - `/e/pb/bid` endpoint;
+  - `ext.account` from operator config;
+  - `ext.sdk = { source: "prebid", version: "2.2.0" }`;
+  - expected impressions, floors, page/device/privacy fields; and
+  - no latitude/longitude or disallowed identity fields.
+- [ ] Confirm a bid returns a decoded price and can beat another provider with no
+      mediator.
+- [ ] Confirm the browser receives the exact one-bid allowlist in `aaxResponse`, with no
+      seat, impid, IDs beyond selected bid ID, domains, notifications, markup, syncs,
+      unknown extensions, sibling bids, or losing seats.
+- [ ] Confirm the immutable official no-renderer fixture safe-drops and separately
+      observe real `creativeurl`/`tagtype` responses.
+- [ ] Exercise a real `tagtype=iframe` response through direct `/auction` and
+      navigation/page-bids/GAM while the script gate remains false.
+- [ ] Only after the local browser proof, set `allow_script_creatives = true` for this
+      isolated cohort and exercise a real `tagtype=script` response through both paths.
+      Do not enable it for other traffic yet.
+- [ ] Verify the exact envelope works with the current APS runner. If it does not, record
+      only missing field names/shape, stop rollout, consult APS, and update spec/tests;
+      never preserve unknown fields or fall back to the full response.
+- [ ] Verify the outer frame has an opaque origin, restrictive publisher CSP succeeds,
+      click-through/dimensions work, and bidder content cannot access parent DOM.
+- [ ] If the fixed runner cannot render/resize script creatives without outer
+      `allow-same-origin`, restore `allow_script_creatives = false` and stop; do not
+      weaken the boundary.
+- [ ] Verify `apstag.setDisplayBids()` is not called for the TS winner and APS is not
+      participating twice.
+- [ ] Verify INFO/WARN logs and auction summaries contain no raw response or sensitive
+      values.
+- [ ] Obtain APS account-team confirmation before enabling broad production traffic.
+
+**Expected result:** Iframe creatives render under the default policy; script creatives
+become winner-eligible only for the staged cohort after both browser proof phases pass,
+or the server gate returns to false and rollout stops with a bounded contract gap.
+
+---
+
+## Task 11: Final regression and repository verification
+
+Run the complete required matrix from the repository root.
+
+### Rust formatting, tests, and lint
+
+- [ ] Run:
+
+  ```bash
+  cargo fmt --all -- --check
+  cargo test-fastly
+  cargo test-axum
+  cargo test-cloudflare
+  cargo test-spin
+  cargo clippy-fastly
+  cargo clippy-axum
+  cargo clippy-cloudflare
+  cargo clippy-cloudflare-wasm
+  cargo clippy-spin-native
+  cargo clippy-spin-wasm
+  ```
+
+### Cross-adapter parity
+
+- [ ] Run:
+
+  ```bash
+  cargo test \
+    --manifest-path crates/trusted-server-integration-tests/Cargo.toml \
+    --test parity
+  ```
+
+### JS and docs
+
+- [ ] Run:
+
+  ```bash
+  (cd crates/trusted-server-js/lib && node build-all.mjs)
+  (cd crates/trusted-server-js/lib && npx vitest run)
+  (cd crates/trusted-server-js/lib && npm run format)
+  (cd crates/trusted-server-integration-tests/browser && npx playwright test)
+  (cd docs && npm run format)
+  ```
+
+### Final review
+
+- [ ] Run:
+
+  ```bash
+  git diff --check
+  git status --short
+  ```
+
+- [ ] Review every `Bid` construction and mediator conversion for the new identifiers
+      and renderer field.
+- [ ] Review every `adm` assignment and prove it still passes through server
+      sanitization.
+- [ ] Review every renderer serialization boundary and prove only winning APS data is
+      exposed.
+- [ ] Review logs for account IDs, URLs, bid IDs, payloads, and consent/EID leakage.
+- [ ] Verify no real controlled-account data entered source, tests, docs, comments, or
+      snapshots.
+- [ ] Compare the final behavior against all acceptance criteria in the design spec.
+
+---
+
+## Suggested implementation checkpoints
+
+If commits are requested, keep reviewable checkpoints aligned with the tasks:
+
+1. `Add typed APS renderer state to auction bids`
+2. `Build APS OpenRTB requests`
+3. `Parse APS OpenRTB responses`
+4. `Carry APS renderer metadata to clients`
+5. `Render APS creatives in TSJS and GPT`
+6. `Document APS OpenRTB migration`
+
+Do not combine unrelated refactors with these checkpoints.
diff --git a/docs/superpowers/specs/2026-03-19-auction-orchestration-flow-design.md b/docs/superpowers/specs/2026-03-19-auction-orchestration-flow-design.md
index 02a86d62..4ecfa9e7 100644
--- a/docs/superpowers/specs/2026-03-19-auction-orchestration-flow-design.md
+++ b/docs/superpowers/specs/2026-03-19-auction-orchestration-flow-design.md
@@ -1,5 +1,11 @@
 # 🎯 Auction Orchestration Flow
 
+> [!WARNING]
+> The APS portions of this historical design are superseded by
+> [APS OpenRTB First-Class Integration](./2026-07-15-aps-openrtb-first-class-integration-design.md).
+> The legacy `/e/dtb/bid` contextual flow and encoded-price mediation described below
+> are not current runtime behavior.
+
 ## 🔄 System Flow Diagram
 
 ```mermaid
diff --git a/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md b/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md
new file mode 100644
index 00000000..2f79577e
--- /dev/null
+++ b/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md
@@ -0,0 +1,843 @@
+# Amazon APS OpenRTB First-Class Integration Design
+
+**Date:** 2026-07-15<br>
+**Status:** Approved for implementation and test; production rollout remains subject to APS account-team validation<br>
+**Issue:** [#764 — Add the Amazon APS Prebid Adapter as first class integration](https://github.com/IABTechLab/trusted-server/issues/764)
+
+---
+
+## 1. Goal
+
+Replace Trusted Server's legacy Amazon Publisher Services (APS/TAM) wire contract
+with the OpenRTB contract used by the official APS Prebid.js adapter, so APS can:
+
+1. receive a valid OpenRTB request for each eligible banner slot;
+2. return a decoded CPM that competes directly without a mediator;
+3. render winning `iframe` and `script` creatives through a deliberate APS browser
+   renderer; and
+4. preserve Trusted Server's existing privacy, sanitization, bounded-I/O, and
+   observability invariants.
+
+The integration uses its built-in production OpenRTB endpoint by default. Examples use a fictional override endpoint.
+
+The implementation may proceed against fictional fixtures and a controlled APS test
+account before APS confirms Fastly/edge-originated production support. Lack of that
+confirmation is a rollout gate, not an implementation blocker.
+
+---
+
+## 2. Approved decisions
+
+| Decision                  | Resolution                                                                                                                                                                                                                                                                               |
+| ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Edge/server support       | Implement and test now; do not claim production support until APS confirms it for the account.                                                                                                                                                                                           |
+| APS SDK identity          | Send `ext.sdk.source = "prebid"`, which APS has approved as the starting identity. Match the current adapter version with `ext.sdk.version = "2.2.0"`.                                                                                                                                   |
+| Creative response payload | Send an exact allowlisted envelope containing one bid with only `id`, `price`, `w`, `h`, `ext.creativeurl`, and `ext.tagtype`. Do not preserve unknown fields or silently fall back to the full response.                                                                                |
+| Sandbox compatibility     | APS confirmed `allow-same-origin` compatibility, but Trusted Server must not grant it on the outer security boundary. The outer renderer iframe has an opaque origin; descendant APS frames cannot relax an ancestor sandbox restriction. `script` remains disabled until browser proof. |
+| APS notifications         | Do not expose or fire APS `nurl`/`burl` in this issue. The fixed APS runner owns creative tracking until APS approves a separate notification contract.                                                                                                                                  |
+| APS user sync             | Out of scope. Do not expose or execute `ext.userSyncs`.                                                                                                                                                                                                                                  |
+| Migration                 | Cut over directly. Keep `pub_id` only as a configuration alias; do not retain a legacy/OpenRTB protocol switch.                                                                                                                                                                          |
+| Native APS coexistence    | When a Trusted Server APS renderer descriptor is present, Trusted Server must not call `apstag.setDisplayBids()`. The test cohort must disable native APS demand to avoid duplicate participation.                                                                                       |
+
+---
+
+## 3. Primary upstream evidence
+
+The design follows immutable official APS/Prebid sources:
+
+- [APS endpoint and adapter version](https://github.com/prebid/Prebid.js/blob/cf8537da6b54223aea1bb29c6f939ba3b615a273/modules/apsBidAdapter.js#L16-L21)
+- [OpenRTB request enrichment and privacy filtering](https://github.com/prebid/Prebid.js/blob/cf8537da6b54223aea1bb29c6f939ba3b615a273/modules/apsBidAdapter.js#L118-L187)
+- [Request dispatch](https://github.com/prebid/Prebid.js/blob/cf8537da6b54223aea1bb29c6f939ba3b615a273/modules/apsBidAdapter.js#L247-L265)
+- [Creative construction](https://github.com/prebid/Prebid.js/blob/cf8537da6b54223aea1bb29c6f939ba3b615a273/modules/apsBidAdapter.js#L279-L313)
+- [Purpose-1-gated user sync behavior](https://github.com/prebid/Prebid.js/blob/cf8537da6b54223aea1bb29c6f939ba3b615a273/modules/apsBidAdapter.js#L322-L345)
+- [Official APS adapter documentation and capability metadata](https://github.com/prebid/prebid.github.io/blob/adc4af1425c3433c81ee85560519cab0f7d17887/dev-docs/aps.md)
+
+The capability metadata says `pbjs: true` and `pbs: false`. The public source proves
+browser Prebid behavior; it does not by itself establish an approved production
+server-to-server contract for Fastly or another edge runtime.
+
+The immutable adapter test fixture is not a renderer contract: it accepts a banner bid
+whose extension contains only `bidder`, then verifies that the adapter builds the
+script wrapper. The unversioned live `prebid-creative.js` observed on 2026-07-15
+(SHA-256 `ac99774f4d0f6b34aed7584952661007125345b7433970edd832e8451f9a6aef`)
+requires `bid.id`, `price`, `w`, `h`, `ext.creativeurl`, and `ext.tagtype`. This
+live-runner observation is intentionally treated as unverified behavior: the official
+fixture must safe-drop in Trusted Server, while controlled-account responses provide
+the separate renderer-compatible test path.
+
+---
+
+## 4. Current-state problems
+
+`crates/trusted-server-core/src/integrations/aps.rs` currently:
+
+- POSTs a private `pubId`/`slots`/`pageUrl` payload to `/e/dtb/bid`;
+- requires per-slot `bidders.aps.slotID` or falls back to the incoming slot ID;
+- parses `contextual.slots` rather than OpenRTB `seatbid`;
+- stores encoded `amznbid`/`amznp` values in metadata;
+- sets `Bid.price = None` and `Bid.creative = None`; and
+- therefore cannot produce a direct no-mediator winner or a normal creative.
+
+The generic winner selector intentionally ignores price-less bids. The publisher bid
+map also starts from `bid.price`, so the current behavior is internally consistent but
+cannot satisfy #764.
+
+The existing Prebid provider has a mature OpenRTB builder, but that builder also owns
+PBS-specific bidder params, stored requests, request signing, debug behavior,
+`ext.prebid`, and consent-forwarding policy. Reusing it wholesale would couple APS to
+PBS and increase regression risk.
+
+---
+
+## 5. Scope and non-goals
+
+### 5.1 In scope
+
+- APS banner OpenRTB request construction.
+- APS OpenRTB response/no-bid parsing.
+- Decoded-price direct winner selection.
+- A typed APS renderer descriptor.
+- APS creative rendering in both:
+  - direct `POST /auction` TSJS rendering; and
+  - publisher navigation/page-bids through the GPT/Prebid Universal Creative bridge.
+- Safe aggregate diagnostics.
+- Configuration and documentation migration.
+- Controlled APS account/browser testing for `iframe` and `script` tag types.
+
+### 5.2 Out of scope
+
+- APS video/VAST support. Although the upstream adapter advertises video, this issue
+  enables banner only until Trusted Server has a designed video delivery path.
+- APS `ext.userSyncs` execution or exposure.
+- A generic third-party renderer framework for arbitrary providers.
+- Refactoring the entire Prebid OpenRTB builder.
+- Retaining the legacy `/e/dtb/bid` request/parser behind a runtime switch.
+- Server-side creative URL fetching or caching.
+- Changes to the global HTML sanitizer's allowed elements or attributes.
+- Production support claims before APS account-team confirmation.
+
+---
+
+## 6. Configuration contract and cutover
+
+The canonical configuration becomes:
+
+```toml
+[integrations.aps]
+enabled = false
+account_id = "example-account-id"
+timeout_ms = 800
+allow_script_creatives = false
+```
+
+### 6.1 Compatibility
+
+- Rename `pub_id` to `account_id` in the Rust type, example configuration, and docs.
+- Accept `pub_id` as a serde alias for `account_id` for existing operator configs.
+- Continue accepting a string or integer value during migration. Trim strings, reject
+  empty-after-trim values, and normalize integers to strings.
+- If both names are supplied, deserialization must fail as a duplicate field rather
+  than silently selecting one.
+- Keep `endpoint` as an operator-owned test/override setting, but require HTTPS with a
+  non-empty host and no URL credentials. Its configured endpoint must implement this
+  OpenRTB contract; it is not a legacy-protocol switch. There is no plaintext test
+  exception because the APS response is trusted to select an executable renderer.
+- APS remains disabled by default.
+- `allow_script_creatives` is a separate server-side capability gate and defaults to
+  `false`. It may be set to `true` only for an isolated test cohort after the
+  restrictive-CSP/opaque-origin Playwright proof passes, and may remain enabled for
+  production only after controlled-account `tagtype=script` validation.
+
+### 6.2 Slot configuration
+
+The OpenRTB impression ID is the Trusted Server slot ID. APS's official adapter has no
+per-impression bidder parameters, so the provider no longer reads
+`bidders.aps.slotID`. Existing generic creative-opportunity configuration may continue
+to deserialize that value during migration, but APS documentation must mark it unused
+and remove it from new examples.
+
+---
+
+## 7. APS OpenRTB request design
+
+### 7.1 Builder boundary
+
+Implement an APS-specific builder in `integrations/aps.rs` using the generated types
+re-exported by `openrtb.rs`.
+
+Do not make `PrebidAuctionProvider::to_openrtb` public. Initially duplicate the small
+common mappings so APS policy remains explicit. A provider-neutral helper may be
+extracted later only when tests prove byte-for-byte parity for the fields it owns.
+
+### 7.2 Request shape
+
+For each eligible slot, emit one `imp`:
+
+- `imp.id = slot.id`;
+- banner-only `banner.format` entries for valid dimensions;
+- first valid format in `banner.w`/`banner.h` for APS compatibility;
+- `bidfloor` and `bidfloorcur = "USD"` when a floor exists;
+- `banner.topframe = 0`, matching the official framed-delivery fixture;
+- `secure = 1` unconditionally because APS creative delivery is HTTPS-only; and
+- no `imp.ext.prebid`, stored request, or bidder-parameter extension.
+
+At request level emit:
+
+- `id = AuctionRequest.id`;
+- `tmax = context.timeout_ms`, the same effective budget enforced by the backend;
+- `cur = ["USD"]`;
+- `site.domain`, `site.page`, publisher data, and a valid referrer when known;
+- consent-allowed `user.id` and already-gated EIDs;
+- trusted device UA and client IP;
+- coarse device geo with latitude and longitude explicitly omitted;
+- valid `Accept-Language` and DNT signals from the downstream request;
+- TCF, USP, GPP, and GPP SID signals in their existing Trusted Server OpenRTB
+  placements. COPPA remains omitted because Trusted Server has no trusted COPPA signal
+  source in this issue; and
+- APS request extension:
+
+```json
+{
+  "ext": {
+    "account": "example-account-id",
+    "sdk": {
+      "source": "prebid",
+      "version": "2.2.0"
+    }
+  }
+}
+```
+
+### 7.3 Page and referrer provenance
+
+- Publisher navigation and page-bids continue using the server-derived scheme, host,
+  and matched request path.
+- `POST /auction` should use a valid same-publisher `Referer` URL as the current page
+  instead of always reducing the page to `https://<configured-domain>`; otherwise it
+  falls back to the configured publisher origin.
+- A candidate URL must use HTTP(S), have no userinfo, be length-bounded, and match the
+  configured publisher host before it can become `site.page`.
+- `site.ref` is emitted only when a valid HTTP(S) downstream `Referer` differs from the
+  normalized current page. If the endpoint request's `Referer` is simply the current
+  page, omit `site.ref` rather than mislabeling it as the document's prior referrer.
+- Do not add an unrestricted client-provided URL or copy arbitrary headers.
+
+### 7.4 Privacy rules
+
+The provider consumes the privacy-filtered `AuctionRequest`; it does not independently
+weaken endpoint decisions.
+
+- Existing auction consent denial still returns before contacting APS.
+- APS only receives `request.user.eids`, which endpoint code has already gated.
+- Do not serialize `user.data`, `user.keywords`, `user.gender`, `yob`, `customdata`, or
+  arbitrary context into APS.
+- Remove precise `device.geo.lat` and `device.geo.lon` even if available.
+- Do not forward browser cookies or arbitrary X-\* headers to APS.
+- Request and response payloads may be logged only at TRACE.
+
+---
+
+## 8. Response validation and unified bid mapping
+
+Parse the response envelope as `serde_json::Value`, validate response-level fields,
+and deserialize or validate each `seatbid[].bid[]` independently. This preserves valid
+siblings when one bid has a wrong field type while retaining extension maps needed for
+APS creative metadata. Syntactically invalid JSON still fails the whole response.
+
+### 8.1 Response-level validation
+
+- HTTP `204 No Content` is a normal APS no-bid and returns before body collection or
+  JSON parsing.
+- Other non-success HTTP statuses produce provider `Error` without reflecting the body.
+- Body collection remains capped by `UPSTREAM_RTB_MAX_RESPONSE_BYTES`.
+- Invalid JSON, including a non-representable numeric literal such as an overflowing
+  exponent under the repository's default `serde_json` configuration, or a legacy
+  `contextual` envelope is an error with safe reason `unexpected_response_shape`.
+- Empty/missing `seatbid`, or seat bids containing no bids, is a normal no-bid.
+- Currency must be absent or case-insensitive USD. A non-USD response is dropped
+  because Trusted Server has no currency conversion before winner comparison.
+- Top-level `ext.userSyncs` is ignored and must not enter diagnostics or renderer data.
+
+### 8.2 Bid-level validation
+
+A bid is eligible only when:
+
+- `impid` matches a slot in the request;
+- `price` is finite and non-negative;
+- `mtype` is absent or banner-compatible;
+- `w` and `h` are both present, non-zero, safely convert to `u32`, and are compatible
+  with the requested slot; and
+- it has APS `ext.creativeurl` plus a usable bid ID and an eligible `ext.tagtype`:
+  `iframe` is eligible, while `script` is eligible only when the server-side
+  `allow_script_creatives` capability is enabled. This check happens before candidate
+  reduction and winner selection, so a disabled or otherwise unrenderable script bid
+  cannot win and blank the slot.
+
+An APS `adm` without a valid renderer descriptor is not independently renderable in the
+normal publisher flow and must therefore be dropped. If APS supplies `adm` alongside a
+valid descriptor, remove all markup from the minimized envelope and do not copy it into
+`Bid.creative`. If controlled testing proves markup is required, stop for a separate
+security review rather than forwarding it unsanitized.
+
+`creativeurl` must be an HTTPS URL without userinfo, must not match the configured
+publisher origin, and must stay within a bounded serialized length. Validate the same
+rules again in the browser. It comes only from the HTTPS APS endpoint response, never
+from the client. Unknown tag types and recognized-but-disabled `script` bids are dropped rather than
+passed through.
+
+The pinned official adapter response fixture lacks `creativeurl` and `tagtype`; Trusted
+Server must include that fixture as an expected safe-drop test. A separate fictional
+fixture models the live runner's required extension fields. Controlled APS-account
+validation of both observed tag types remains a rollout prerequisite.
+
+### 8.3 Unified fields and APS candidate reduction
+
+Extend `Bid` with generic identifiers and a typed optional renderer:
+
+```text
+bid_id       <- OpenRTB bid.id
+ad_id        <- OpenRTB bid.adid
+creative_id  <- optional OpenRTB bid.crid
+renderer     <- typed APS renderer descriptor for every accepted APS bid
+```
+
+Set `Bid.bidder = "aps"` unconditionally. Upstream `seat` and `ext.bidder` are APS
+network metadata, not the adapter identity; normalize them only into bounded internal
+fields if an operational consumer is identified, otherwise discard them. Missing,
+numeric, or unexpected seat values do not invalidate an otherwise valid bid and never
+become `hb_bidder`.
+
+Map decoded price, currency, `impid`, dimensions, and `adomain`. Do not map APS `nurl`
+or `burl` in this issue; the vendor runner owns APS creative tracking until a separate
+notification policy is approved.
+
+Before returning `AuctionResponse`, collapse multiple valid APS candidates for the same
+impression to one candidate: highest decoded price wins, with lexicographically lowest
+bid ID as a deterministic tie-break. This produces the same APS result as direct
+winner selection and prevents the current mediator's `(provider, slot, bidder)`
+last-write-wins index from attaching another APS bid's renderer. The mediator still
+restores `bid_id`, optional `creative_id`, and `renderer` for that single APS candidate.
+A two-bids/same-slot/same-seat test is mandatory.
+
+### 8.4 Diagnostics
+
+With APS debug mode disabled, `AuctionResponse.metadata` may contain only bounded aggregate fields, for example:
+
+```json
+{
+  "seatbid_count": 1,
+  "accepted_bid_count": 1,
+  "dropped_bid_count": 0,
+  "drop_reasons": {}
+}
+```
+
+Allowed reason keys are fixed enums such as:
+
+- `empty_seatbid`;
+- `unknown_impid`;
+- `invalid_price`;
+- `unsupported_currency`;
+- `unsupported_media_type`;
+- `invalid_dimensions`;
+- `missing_render_source`;
+- `unsupported_tagtype`;
+- `script_rendering_disabled`;
+- `invalid_creative_url`;
+- `render_payload_too_large`; and
+- `unexpected_response_shape`.
+
+Do not include account IDs, bid IDs, URLs, tokens, consent strings, raw extensions, or
+raw bodies in INFO/WARN diagnostics. Client-facing provider summaries follow the same
+rule by default.
+
+An explicit `[integrations.aps].debug = true` exception is available for controlled test
+sites. It includes the unredacted direct APS request and response under
+`metadata.debug.httpcalls.aps`, using the same request body, request headers, response
+body, response headers, status, and URI fields exposed by Prebid Server debug output.
+If a non-success response body cannot be captured within the existing 2 MiB upstream
+limit, omit `responsebody` rather than misreporting it as empty. The flag defaults to
+`false` and must not change parsing, eligibility, or selection.
+
+---
+
+## 9. Exact APS renderer response envelope
+
+The official adapter gives `prebid-creative.js` the base64-encoded complete response
+and selected bid ID. Trusted Server instead sends an exact allowlisted envelope based
+on the fields required by the live runner observed on 2026-07-15:
+
+```json
+{
+  "seatbid": [
+    {
+      "bid": [
+        {
+          "id": "fictional-selected-bid-id",
+          "price": 1.23,
+          "w": 300,
+          "h": 250,
+          "ext": {
+            "creativeurl": "https://creative.example/render",
+            "tagtype": "iframe"
+          }
+        }
+      ]
+    }
+  ]
+}
+```
+
+The allowlist is exact:
+
+- root: `seatbid` only;
+- selected seat object: `bid` only;
+- selected bid: `id`, `price`, `w`, `h`, and `ext` only; and
+- selected bid extension: `creativeurl` and `tagtype` only.
+
+Do not include top-level ID/currency/extensions, upstream seat, `impid`, `adid`, `crid`,
+`adomain`, notifications, markup, native data, user syncs, unknown extensions, sibling
+bids, or losing seats. Unknown fields may exist transiently while the server validates
+an upstream bid, but they are discarded before renderer construction.
+
+Serialize the allowlisted object once, enforce a 256 KiB pre-base64 maximum, then
+base64 encode with the standard alphabet. Store it in the typed renderer descriptor,
+not general metadata. If the envelope exceeds the cap, drop the bid as non-renderable.
+If controlled APS testing proves the exact envelope insufficient, stop and review the
+specific missing field with APS; do not widen it or fall back to the full response
+automatically.
+
+A single fictional golden fixture under the TSJS test fixtures is the source of truth:
+Rust serialization must equal it, and TypeScript parsing/validation/render-dispatch
+tests must consume that same file.
+
+---
+
+## 10. Renderer descriptor and browser wire formats
+
+### 10.1 Typed descriptor
+
+The Rust and TypeScript contracts represent the same versioned data:
+
+```json
+{
+  "type": "aps",
+  "version": 1,
+  "accountId": "example-account-id",
+  "bidId": "fictional-selected-bid-id",
+  "creativeId": "fictional-creative-id",
+  "tagType": "iframe",
+  "creativeUrl": "https://creative.example/render",
+  "aaxResponse": "base64-data",
+  "width": 300,
+  "height": 250
+}
+```
+
+Only `iframe` and `script` are valid tag-type values. `creativeId` is optional and is
+omitted when APS does not return `crid`; the live runner does not consume it. Version
+mismatch is fail-closed. The APS account identifier is not a secret, but it must still
+be safely serialized and must never be hardcoded from a real account in repository
+fixtures.
+
+### 10.2 `POST /auction`
+
+For APS renderer bids, the OpenRTB response bid contains the complete descriptor:
+
+```json
+{
+  "id": "fictional-selected-bid-id",
+  "impid": "fictional-slot",
+  "price": 1.23,
+  "crid": "fictional-creative-id",
+  "w": 300,
+  "h": 250,
+  "ext": {
+    "trusted_server": {
+      "renderer": {
+        "type": "aps",
+        "version": 1,
+        "accountId": "example-account-id",
+        "bidId": "fictional-selected-bid-id",
+        "creativeId": "fictional-creative-id",
+        "tagType": "iframe",
+        "creativeUrl": "https://creative.example/render",
+        "aaxResponse": "eyJzZWF0YmlkIjpbeyJiaWQiOltdfV19",
+        "width": 300,
+        "height": 250
+      }
+    }
+  }
+}
+```
+
+`creativeId`/`crid` are omitted together when APS does not return `crid`. `adm` is
+omitted, not serialized as an empty string. Ordinary non-APS `adm` behavior is
+unchanged.
+
+### 10.3 Publisher navigation and page-bids
+
+`build_bid_map` adds the same complete descriptor as a normal, non-debug `renderer`
+property for APS winners:
+
+```json
+{
+  "fictional-slot": {
+    "hb_pb": "1.23",
+    "hb_bidder": "aps",
+    "hb_adid": "fictional-selected-bid-id",
+    "renderer": {
+      "type": "aps",
+      "version": 1,
+      "accountId": "example-account-id",
+      "bidId": "fictional-selected-bid-id",
+      "creativeId": "fictional-creative-id",
+      "tagType": "iframe",
+      "creativeUrl": "https://creative.example/render",
+      "aaxResponse": "eyJzZWF0YmlkIjpbeyJiaWQiOltdfV19",
+      "width": 300,
+      "height": 250
+    }
+  }
+}
+```
+
+`hb_adid` priority becomes:
+
+1. PBS Cache UUID for cached Prebid bids;
+2. APS renderer selected bid ID;
+3. existing OpenRTB `adid` fallback.
+
+The complete renderer object is emitted only for the winning bid. It is not gated by
+`debug.inject_adm_for_testing`, and general bid metadata remains debug-only.
+
+---
+
+## 11. Browser rendering design
+
+### 11.1 Static renderer endpoint
+
+Do not put the APS initializer and runner into publisher-origin `srcdoc`. Register APS
+as a proxy-capable integration (without an automatic JS bundle) and serve a static
+renderer document at:
+
+```text
+GET /integrations/aps/renderer
+```
+
+The document contains only static Trusted Server initialization code and the fixed
+`https://client.aps.amazon-adsystem.com/prebid-creative.js` script. Before loading the
+vendor runner, the static initializer reads a strictly encoded, cryptographically
+random per-frame nonce from the iframe URL fragment, stores it as the expected nonce,
+and removes the fragment from visible history. The fragment is not sent in the HTTP
+request. It then receives one versioned renderer descriptor from its embedding parent
+through `postMessage`, verifies `event.source === parent`, and requires the message
+nonce to equal the independently established expected nonce. After the first accepted
+message it removes the listener, initializes the account-keyed APS queue, dispatches
+`CustomEvent("prebid/creative/render", { detail: { aaxResponse, seatBidId } })`, and only
+then dynamically inserts the fixed runner script. On runner load or failure it sends a
+source-bound response carrying the accepted nonce. Because the sandboxed document has
+an opaque origin, both directions use `"*"` as the `postMessage` target origin and rely
+on the exact child/parent window, source checks, one-time fragment-bound nonce, and full
+descriptor validation.
+
+The descriptor is data, never generated script text. No APS-provided HTML, script text,
+URL, account value, or decoded JSON is concatenated into an executable context. The
+vendor runner URL is a compile-time constant. The response carries
+`Content-Type: text/html`, `X-Content-Type-Options: nosniff`,
+`Referrer-Policy: no-referrer`, and a CSP `sandbox` directive containing the
+approved tokens without `allow-same-origin`. The response-level sandbox preserves the
+opaque boundary even if another embedding path omits its iframe sandbox attribute.
+
+### 11.2 Opaque outer sandbox
+
+Both direct and GPT flows load the static endpoint through `iframe.src`, not `srcdoc`,
+with this outer sandbox:
+
+```text
+allow-forms
+allow-pointer-lock
+allow-popups
+allow-popups-to-escape-sandbox
+allow-scripts
+allow-top-navigation-by-user-activation
+```
+
+The outer boundary deliberately omits `allow-same-origin`. The live APS runner grants
+`allow-same-origin` to the nested frame it creates, but a descendant cannot relax an
+ancestor sandbox's origin restriction. Therefore both `iframe` and fetched-HTML
+`script` creatives remain under the outer opaque-origin boundary rather than inheriting
+the publisher origin.
+
+This is a compatibility hypothesis, not an assumption: the current runner also touches
+`frameElement` while resizing. `tagtype=script` is rejected server-side before winner
+selection while `allow_script_creatives` is false. The capability may be enabled for an
+isolated test cohort only after a real-browser test proves that the fixed runner renders
+and resizes correctly without publisher-origin access, and may be enabled beyond that
+cohort only after controlled-account validation. If either test fails, keep the gate
+off and obtain an APS-supported isolated renderer page/origin; do not add
+`allow-same-origin` back to the outer boundary.
+
+### 11.3 Browser validation of consumed data
+
+Before creating or messaging the renderer iframe, TSJS must decode `aaxResponse` and
+validate the exact envelope consumed by the vendor runner:
+
+- root contains only one `seatbid` entry;
+- that entry contains only one `bid`;
+- the bid has exactly `id`, `price`, `w`, `h`, and `ext`;
+- `ext` has exactly `creativeurl` and `tagtype`;
+- bid ID, dimensions, creative URL, and tag type equal the duplicated descriptor fields;
+- price is finite and non-negative;
+- tag type is `iframe`, or `script` from a response the server emitted only after its
+  default-off `allow_script_creatives` eligibility gate;
+- creative URL is bounded HTTPS without credentials and does not match the publisher
+  origin; and
+- no markup, notifications, syncs, or unknown fields are present.
+
+Validation happens before slot clearing, `stopImmediatePropagation()`, iframe creation,
+or message dispatch. The static renderer document repeats the structural/message
+validation as defense in depth.
+
+### 11.4 Direct `/auction` flow
+
+`parseAuctionResponse` accepts either ordinary sanitized `adm` or a structurally typed
+renderer. The request loop performs the full decoded-envelope validation, dispatches a
+valid APS descriptor to `renderApsCreative`, and sends ordinary markup to
+`renderCreativeInline`.
+
+`renderApsCreative` generates at least 128 bits of randomness with
+`crypto.getRandomValues`, base64url-encodes it, and binds it to the static renderer URL
+as a fragment before assigning `iframe.src`. After load, it posts the validated
+descriptor with the same nonce, then waits for an exact source- and nonce-bound runner
+ready acknowledgement before clearing existing content or showing the frame. A runner
+failure or bounded acknowledgement timeout removes the hidden frame. A malformed
+descriptor, malformed fragment, nonce mismatch, replay, stale message, or runner load
+failure leaves existing slot content intact and emits a safe warning.
+
+### 11.5 GPT/page-bids flow
+
+Extend `installTsRenderBridge` while retaining the existing `Prebid Request` parsing and
+source-slot ownership validation. For a valid APS winner, return the exact serializable
+Prebid Universal Creative dynamic-renderer shape, including the supported renderer
+version. The static Trusted Server renderer source may only create the opaque outer
+iframe, load `/integrations/aps/renderer`, post the already validated descriptor, and
+resolve only after the source- and nonce-bound ready acknowledgement; APS or bidder code
+never executes in the Universal Creative renderer frame itself.
+Fixture-test this message against the deployed Universal Creative protocol rather than
+assuming a function can be structured-cloned. Include a trusted absolute
+`rendererUrl`, computed from the publisher page origin by TSJS, because a relative URL
+inside the GAM creative would resolve against the GAM origin. The dynamic renderer
+must accept only that data field and the validated APS descriptor.
+
+Call `stopImmediatePropagation()` only after ownership and complete envelope validation
+succeed. Preserve in-flight render deduplication, but do not invoke the generic
+win/billing beacon path for APS. Existing debug-ADM and PBS Cache branches remain
+unchanged.
+
+When the winning bid has a Trusted Server APS renderer, do not call
+`apstag.setDisplayBids()`. The native APS SDK may remain installed by the CMS for other
+cohorts, but it is not the renderer or bid source for that TS winner.
+
+### 11.6 CSP and real-browser gate
+
+Because the outer frame navigates to a real response, it uses that response's CSP
+instead of inheriting publisher `srcdoc` CSP. The renderer endpoint starts from this
+explicit ad-compatible policy, tightened if controlled testing permits:
+
+```text
+default-src 'none';
+script-src 'unsafe-inline' https:;
+connect-src https:;
+frame-src https:;
+img-src https: data:;
+media-src https: blob:;
+style-src 'unsafe-inline' https:;
+font-src https: data:;
+```
+
+The publisher must permit `frame-src 'self'` for the direct renderer endpoint. The GAM
+Universal Creative context must also permit framing the absolute publisher renderer
+URL. The broad HTTPS resource allowances apply only inside the opaque sandbox and are
+required because the APS runner and bidder HTML may load arbitrary HTTPS ad resources.
+
+Add a Playwright test under `crates/trusted-server-integration-tests/browser` with a
+restrictive publisher CSP. It must prove the renderer endpoint loads, APS initializes,
+both tag types obey the outer opaque-origin boundary, a fictional script creative
+cannot access `top.document`, and malformed descriptors do not clear the slot. The server-side `allow_script_creatives` gate stays false during normal winner
+selection until this test passes. It may then be enabled only for the controlled test
+cohort needed to validate real rendering and remains false elsewhere until that
+validation also passes.
+
+---
+
+## 12. Sanitization and security invariants
+
+- `sanitize_creative_html` remains mandatory for every ordinary
+  `Bid.creative`/`adm` value.
+- Its element, attribute, URI, size, and fail-closed rules do not change.
+- APS executable rendering is a separate typed capability; it is never disguised as
+  sanitized `adm`.
+- Only a server-validated APS descriptor with an exact browser-validated envelope can
+  select that capability.
+- Unknown providers cannot request the APS renderer through arbitrary metadata.
+- The server never fetches `creativeurl`, avoiding an SSRF/redirect/content-type
+  service in the auction path.
+- Server and browser both require a bounded HTTPS creative URL without credentials and
+  reject the publisher origin.
+- APS/bidder execution occurs only below an outer opaque-origin sandbox. No test may
+  treat absence of `innerHTML` alone as proof; cover `srcdoc`, script text,
+  `document.write`, and message-driven sinks.
+- Existing same-origin/no-CORS-preflight protection for page-bids remains unchanged.
+- Per-user injected HTML stays private/non-shared, and page-bids stays no-store.
+- Existing upstream body caps and auction deadlines remain in force.
+
+---
+
+## 13. APS notification policy
+
+Do not map APS `nurl` or `burl` into the shared browser bid map in this issue. The live
+APS runner owns creative tracking, the official fixture does not establish that Trusted
+Server should fire OpenRTB notifications, and the direct `/auction` path has no matching
+notification lifecycle.
+
+This also prevents an APS-controlled URL from causing a credentialed same-origin POST
+through the current generic `sendBeacon`/fetch helper. If APS later requires Trusted
+Server notification delivery, design it separately with one explicit owner, bounded
+HTTPS URLs, publisher-origin rejection, omitted credentials, no referrer, macro policy,
+and equivalent direct/GPT tests. Existing non-APS notification behavior is unchanged by
+#764.
+
+---
+
+## 14. User sync policy
+
+APS user sync is explicitly out of scope:
+
+- ignore `BidResponse.ext.userSyncs`;
+- do not put sync URLs into `AuctionResponse.metadata`;
+- do not include them in the minimized renderer envelope;
+- do not fetch them at the edge; and
+- do not add image/iframe sync behavior to TSJS.
+
+A future implementation requires a separate spec covering Purpose 1, regional policy,
+URL allowlisting, deduplication, browser timing, and observability.
+
+---
+
+## 15. Logging and telemetry
+
+- Request/response bodies: TRACE only.
+- Routine request log: provider and eligible slot count, without account ID.
+- Routine response log: status, elapsed time, accepted count, and bounded dropped
+  count.
+- WARN: static condition plus slot/request-safe context; never include response body,
+  creative URL, bid token, EID, consent string, or account ID.
+- Client-facing provider summaries: aggregate reason keys/counts only.
+- Existing auction telemetry receives decoded price, currency, ad domain, and ad ID.
+  It must not receive the encoded renderer envelope.
+
+---
+
+## 16. Rollout and rollback
+
+### 16.1 Controlled rollout
+
+1. Implement server parsing and exact fictional fixtures with APS disabled and
+   `allow_script_creatives = false` by default.
+2. Prove disabled script bids are dropped before candidate reduction/winner selection.
+3. Pass the restrictive-CSP Playwright and opaque-origin access tests using the local
+   fictional script runner while the server gate remains false for normal traffic.
+4. Configure a controlled APS test account out of band.
+5. Enable Trusted Server APS only for a test cohort, disable native APS demand there,
+   and temporarily set `allow_script_creatives = true` only for that isolated cohort.
+6. Verify the official fixture safe-drops and a real account returns the unverified
+   `creativeurl`/`tagtype` contract.
+7. Verify both observed tag types through direct and GPT paths. If script cannot operate
+   below the opaque outer sandbox, set the gate false again and stop.
+8. Confirm the exact allowlisted envelope works with `prebid-creative.js`.
+9. Confirm GAM line items and the Universal Creative route request `hb_bidder=aps` and
+   the selected `hb_adid`.
+10. Obtain APS confirmation for Fastly/edge-originated production traffic before broad
+    rollout.
+
+### 16.2 Rollback
+
+- Immediate traffic rollback: set `[integrations.aps].enabled = false`.
+- Restore native APS participation for the affected cohort if required.
+- Binary rollback remains available if the old provider must temporarily be restored.
+- The new code does not retain a dormant legacy parser or protocol switch.
+
+---
+
+## 17. Required code areas
+
+| File                                                              | Change                                                                                                                                                       |
+| ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `crates/trusted-server-core/src/integrations/aps.rs`              | Replace legacy wire types, build/parse OpenRTB, reduce one APS candidate per imp, build the exact envelope, and serve the static renderer endpoint with CSP. |
+| `crates/trusted-server-core/src/integrations/mod.rs`              | Register the APS proxy integration in addition to the auction provider.                                                                                      |
+| `crates/trusted-server-core/src/openrtb.rs`                       | Add only narrowly scoped APS/request/response extension types if needed.                                                                                     |
+| `crates/trusted-server-core/src/auction/types.rs`                 | Add generic bid/creative identifiers and typed optional renderer. Remove stale encoded-price comments.                                                       |
+| `crates/trusted-server-core/src/auction/formats.rs`               | Preserve IDs; sanitize ordinary `adm`; emit the full APS renderer extension and omit empty `adm`.                                                            |
+| `crates/trusted-server-core/src/auction/orchestrator.rs`          | Replace encoded-price assumptions/tests with decoded APS direct-winner coverage.                                                                             |
+| `crates/trusted-server-core/src/integrations/adserver_mock.rs`    | Preserve renderer/identifiers for the single reduced APS candidate and test the prior two-bid collision case.                                                |
+| `crates/trusted-server-core/src/publisher.rs`                     | Emit APS renderer in the normal bid map, force `hb_bidder=aps`, and use selected bid ID for `hb_adid` without APS notifications.                             |
+| `crates/trusted-server-js/lib/test/fixtures/aps-renderer-v1.json` | Shared fictional golden wire fixture consumed by Rust and TypeScript tests.                                                                                  |
+| `crates/trusted-server-js/lib/src/core/auction.ts`                | Parse the typed renderer extension.                                                                                                                          |
+| `crates/trusted-server-js/lib/src/core/request.ts`                | Validate and dispatch APS descriptors to the opaque renderer endpoint.                                                                                       |
+| `crates/trusted-server-js/lib/src/core/types.ts`                  | Define shared APS renderer wire types with optional creative ID.                                                                                             |
+| `crates/trusted-server-js/lib/src/integrations/aps/render.ts`     | Decode/cross-check the exact envelope, create the opaque outer iframe, and message the static endpoint.                                                      |
+| `crates/trusted-server-js/lib/src/integrations/gpt/index.ts`      | Serve APS through the exact Universal Creative wire shape; skip generic beacons and native `apstag` for TS APS winners.                                      |
+| `crates/trusted-server-integration-tests/browser/`                | Add restrictive-CSP, opaque-origin, script/iframe, and parent-DOM isolation coverage.                                                                        |
+| `trusted-server.example.toml`                                     | Document canonical OpenRTB APS configuration with fictional values.                                                                                          |
+| `docs/guide/integrations/aps.md`                                  | Replace legacy setup, request, response, rendering, privacy, and rollout documentation.                                                                      |
+| `CHANGELOG.md`                                                    | Record the APS wire/config migration and support caveat.                                                                                                     |
+
+---
+
+## 18. Acceptance criteria
+
+1. APS receives the specified OpenRTB request for each eligible banner slot with
+   `topframe=0` and `secure=1`.
+2. Request fixtures prove trimmed account/SDK/USD, floors, trusted page/device context,
+   consent/EIDs, existing privacy registrations, and omission of precise coordinates
+   and unsupported COPPA claims.
+3. HTTP 204 and empty `seatbid` are no-bids; malformed/legacy responses are safely
+   diagnosed.
+4. The official no-renderer fixture safe-drops; every accepted APS bid has present,
+   valid `w`/`h` and the unverified-but-validated URL/tag-type renderer contract.
+5. `Bid.bidder`/`hb_bidder` are always `aps`, independent of upstream seat.
+6. Multiple APS bids for one impression reduce deterministically to one candidate, and
+   mediation cannot restore another candidate's renderer.
+7. APS can win without a mediator and is rejected normally below the floor.
+8. The browser envelope contains exactly the allowlisted fields and matches the full
+   descriptor; Rust and TypeScript share one golden fixture.
+9. The outer renderer iframe has no `allow-same-origin`; descendant iframe/script
+   creatives cannot access publisher DOM in the restrictive-CSP Playwright test.
+10. `allow_script_creatives` defaults false; while false, script bids are dropped before
+    candidate reduction and cannot win. It is enabled only under the staged browser and
+    controlled-account policy; otherwise script remains fail-closed.
+11. The renderer binds a one-time nonce through the iframe URL fragment before
+    messaging and rejects malformed, mismatched, replayed, or stale messages before
+    clearing content or stopping another renderer handler.
+12. Ordinary non-APS `adm` sanitization and PBS Cache rendering remain unchanged.
+13. APS user sync and APS `nurl`/`burl` browser delivery remain absent.
+14. Native `apstag.setDisplayBids()` is not called for a TS APS renderer winner.
+15. Raw request/response bodies remain TRACE-only.
+16. All repository CI, adapter, JS, browser, parity, and docs-format gates pass.
+
+---
+
+## 19. Known risks and follow-ups
+
+| Risk                                                                   | Handling                                                                                                                                                                    |
+| ---------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| APS has not confirmed production Fastly/edge traffic                   | Continue implementation/testing; block broad rollout pending confirmation.                                                                                                  |
+| Official fixture and live runner disagree on creative extension fields | Safe-drop the official fixture, pin the observed runner hash/date as evidence only, and require controlled-account validation.                                              |
+| Exact envelope may omit a field used by a future runner                | Stop and review with APS; never preserve unknown fields or fall back to the full response automatically.                                                                    |
+| Fixed unversioned vendor script can change independently               | Monitor the real-browser contract and require review before changing URL, envelope, CSP, or sandbox behavior.                                                               |
+| Runner may fail without outer `allow-same-origin`                      | Keep the server-side `allow_script_creatives` gate false unless the opaque-boundary Playwright and controlled-account tests pass; never restore publisher-origin execution. |
+| Broad ad-compatible CSP permits arbitrary HTTPS resources              | Scope it to the opaque renderer document; publisher CSP only needs to frame the same-origin renderer endpoint.                                                              |
+| Existing native APS and TS APS can duplicate demand                    | Cohort-gate and disable native APS participation wherever TS APS is enabled.                                                                                                |
+| APS notifications may be required for billing                          | Do not guess; vendor runner owns tracking until APS approves a separately secured notification contract.                                                                    |
+| APS video responses could appear                                       | Advertise banner-only support and drop non-banner `mtype` until a separate video design exists.                                                                             |
diff --git a/scripts/integration-tests-browser.sh b/scripts/integration-tests-browser.sh
index ce5e6438..714de510 100755
--- a/scripts/integration-tests-browser.sh
+++ b/scripts/integration-tests-browser.sh
@@ -18,6 +18,7 @@ cd "$REPO_ROOT"
 
 ORIGIN_PORT="${INTEGRATION_ORIGIN_PORT:-8888}"
 BROWSER_DIR="crates/trusted-server-integration-tests/browser"
+TSJS_LIB_DIR="crates/trusted-server-js/lib"
 NODE_VERSION="$(grep '^nodejs ' .tool-versions | awk '{print $2}')"
 
 if [ -z "$NODE_VERSION" ]; then
@@ -55,6 +56,14 @@ cd "$REPO_ROOT/$BROWSER_DIR"
 npm ci
 npx playwright install chromium
 
+# --- Build browser-side Trusted Server and external Prebid fixtures ---
+echo "==> Building TSJS browser fixtures..."
+cd "$REPO_ROOT/$TSJS_LIB_DIR"
+npm ci
+npm run build
+npm run build:prebid-external
+cd "$REPO_ROOT/$BROWSER_DIR"
+
 # --- Export env vars for global-setup.ts ---
 export WASM_BINARY_PATH="$REPO_ROOT/target/wasm32-wasip1/release/trusted-server-adapter-fastly.wasm"
 export INTEGRATION_ORIGIN_PORT="$ORIGIN_PORT"
diff --git a/trusted-server.example.toml b/trusted-server.example.toml
index 26d95d68..7fc41271 100644
--- a/trusted-server.example.toml
+++ b/trusted-server.example.toml
@@ -118,9 +118,15 @@ allowed_context_keys = []
 
 [integrations.aps]
 enabled = false
-pub_id = "your-aps-publisher-id"
-endpoint = "https://aps.example.com/e/dtb/bid"
+account_id = "example-aps-account-id"
 timeout_ms = 1000
+# Include raw APS request/response data in /auction metadata on test sites only.
+debug = false
+# Set both when the deployment hostname differs from APS-authorized inventory.
+# inventory_domain = "publisher.example"
+# inventory_page_origin = "https://www.publisher.example"
+# Script creatives require separate security validation before opt-in.
+allow_script_creatives = false
 
 [integrations.google_tag_manager]
 enabled = false