From 1610e9daf9370ce979f2b2e990d96d753700c72b Mon Sep 17 00:00:00 2001
From: Christian <christianpavilonis@outlook.com>
Date: Wed, 15 Jul 2026 21:10:41 -0500
Subject: [PATCH 1/5] Add first-class APS OpenRTB integration

---
 CHANGELOG.md                                  |    2 +
 TESTING.md                                    |    5 +-
 .../trusted-server-core/src/auction/README.md |   51 +-
 .../src/auction/formats.rs                    |  185 +-
 .../src/auction/orchestrator.rs               |  179 +-
 .../src/auction/telemetry.rs                  |    3 +
 .../trusted-server-core/src/auction/types.rs  |  138 +-
 .../src/creative_opportunities.rs             |   31 +-
 .../src/integrations/adserver_mock.rs         |  202 +-
 .../src/integrations/aps.rs                   | 2280 +++++++++--------
 .../src/integrations/mod.rs                   |    4 +
 .../src/integrations/prebid.rs                |   57 +-
 crates/trusted-server-core/src/openrtb.rs     |   14 +-
 crates/trusted-server-core/src/publisher.rs   |   86 +-
 .../README.md                                 |    1 +
 .../browser/tests/shared/aps-renderer.spec.ts |  614 +++++
 .../configs/trusted-server.integration.toml   |    7 +-
 .../trusted-server-js/lib/src/core/auction.ts |   99 +-
 .../trusted-server-js/lib/src/core/request.ts |   10 +-
 .../trusted-server-js/lib/src/core/types.ts   |   22 +
 .../lib/src/integrations/aps/render.ts        |  301 +++
 .../lib/src/integrations/gpt/index.ts         |   47 +-
 .../lib/test/core/auction.test.ts             |   94 +
 .../lib/test/core/request.test.ts             |  102 +
 .../lib/test/fixtures/aps-renderer-v1.json    |   18 +
 .../lib/test/integrations/aps/render.test.ts  |  295 +++
 .../lib/test/integrations/gpt/ad_init.test.ts |  189 +-
 docs/guide/auction-orchestration.md           |  150 +-
 docs/guide/configuration.md                   |    5 +-
 docs/guide/integrations/aps.md                |  454 +---
 docs/roadmap.md                               |   12 +-
 ...-15-aps-openrtb-first-class-integration.md |  897 +++++++
 ...03-19-auction-orchestration-flow-design.md |    6 +
 ...-openrtb-first-class-integration-design.md |  839 ++++++
 trusted-server.example.toml                   |    6 +-
 35 files changed, 5651 insertions(+), 1754 deletions(-)
 create mode 100644 crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts
 create mode 100644 crates/trusted-server-js/lib/src/integrations/aps/render.ts
 create mode 100644 crates/trusted-server-js/lib/test/fixtures/aps-renderer-v1.json
 create mode 100644 crates/trusted-server-js/lib/test/integrations/aps/render.test.ts
 create mode 100644 docs/superpowers/plans/2026-07-15-aps-openrtb-first-class-integration.md
 create mode 100644 docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5bc49c80b..28a4e4806 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- **Breaking** — Replaced the legacy APS contextual integration with APS OpenRTB at `/e/pb/bid`. APS configuration now uses canonical `account_id` (`pub_id` remains a compatibility alias), no longer requires APS-specific slot IDs, and defaults script creative eligibility off. Operators must update the endpoint, disable native APS demand for Trusted Server cohorts, and prepare GAM/Universal Creative targeting for `hb_bidder=aps` before rollout.
 - **Breaking** — `bid_param_zone_overrides` inner values must now be JSON objects; previously non-object or empty values (`"header" = "x"`, `"header" = {}`) were accepted and silently produced a dead rule at runtime. They now fail at startup with a configuration error. Operators upgrading should audit their `bid_param_zone_overrides` config for non-object zone entries.
 - **Breaking** — Sourcepoint browser module inclusion now requires explicit `[integrations.sourcepoint].enabled = true`; operators relying on the previous unconditional Sourcepoint module should enable the integration before upgrading.
 
@@ -18,6 +19,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Added typed APS renderer transport for direct auctions and GAM/Prebid Universal Creative, using a minimized one-bid envelope, a fragment-bound nonce, and an opaque sandboxed renderer endpoint.
 - Added Osano consent mirror integration docs and public enablement guidance.
 - Implemented basic authentication for configurable endpoint paths (#73)
 - Added integrations guide with example `testlight` integration
diff --git a/TESTING.md b/TESTING.md
index e1ac1c3a2..c4a8c43ea 100644
--- a/TESTING.md
+++ b/TESTING.md
@@ -131,8 +131,9 @@ INFO: Running 2 bidders in parallel
 INFO: Requesting bids from: prebid
 INFO: Prebid returned 2 bids (time: 120ms)
 INFO: Requesting bids from: aps
-INFO: APS (MOCK): returning 2 bids in 80ms
-INFO: GAM mediation: slot 'header-banner' won by 'amazon-aps' at $2.50 CPM
+INFO: APS requests bids for 2 impressions
+INFO: APS returns 2 accepted bids in 80ms
+INFO: GAM mediation: slot 'header-banner' won by 'aps' at $2.50 CPM
 ```
 
 ### Verify Provider Registration
diff --git a/crates/trusted-server-core/src/auction/README.md b/crates/trusted-server-core/src/auction/README.md
index dcc9e1506..fad3cb4d5 100644
--- a/crates/trusted-server-core/src/auction/README.md
+++ b/crates/trusted-server-core/src/auction/README.md
@@ -117,7 +117,7 @@ When a request arrives at the `/auction` endpoint, it goes through the following
                               ▼
 ┌──────────────────────────────────────────────────────────────────────┐
 │  9. Each Provider Processes Request                                  │
-│     - Transform AuctionRequest → Provider format (e.g., APS TAM)     │
+│     - Transform AuctionRequest → Provider OpenRTB request           │
 │     - Send HTTP request to provider endpoint                         │
 │     - Parse provider response                                        │
 │     - Transform → AuctionResponse with Bid[]                         │
@@ -188,30 +188,21 @@ AdSlot {
 
 #### 3. Provider Execution
 Each registered provider (APS, Prebid, etc.) receives the `AuctionRequest` and:
-- Transforms it to their specific format (e.g., APS TAM, OpenRTB)
+- Transforms it to the provider's OpenRTB request format
 - Makes HTTP request to their endpoint
 - Parses the response
 - Returns `AuctionResponse` with `Bid[]`
 
 For example, APS provider:
 ```rust
-// Transform AuctionRequest → ApsBidRequest
-let aps_request = ApsBidRequest {
-    pub_id: "5128",
-    slots: vec![
-        ApsSlot {
-            slot_id: "header-banner",
-            sizes: vec![[728, 90], [970, 250]],
-            slot_name: Some("header-banner"),
-        }
-    ],
-    page_url: Some("https://example.com"),
-    ua: Some("Mozilla/5.0..."),
-    timeout: Some(800),
-};
-
-// HTTP POST to http://localhost:6767/e/dtb/bid
-// Parse response → AuctionResponse
+// Transform AuctionRequest → APS OpenRTB request
+// - ext.account = configured account_id
+// - ext.sdk = { source: "prebid", version: "2.2.0" }
+// - banner slots become secure impressions with matching formats/floors
+// - existing consent, identity, device, and geo privacy gates apply
+
+// HTTP POST to https://web.ads.aps.amazon-adsystem.com/e/pb/bid
+// Parse decoded-price response → AuctionResponse with a typed renderer
 ```
 
 #### 4. Response Assembly
@@ -222,17 +213,29 @@ The orchestrator collects all bids and creates an OpenRTB response:
   "id": "auction-response",
   "seatbid": [
     {
-      "seat": "amazon-aps",
+      "seat": "aps",
       "bid": [
         {
-          "id": "amazon-aps-header-banner",
+          "id": "fictional-selected-bid-id",
           "impid": "header-banner",
           "price": 2.5,
-          "adm": "<iframe src=\"/first-party/proxy?tsurl=...\">",
           "w": 728,
           "h": 90,
-          "crid": "amazon-aps-creative",
-          "adomain": ["amazon.com"]
+          "ext": {
+            "trusted_server": {
+              "renderer": {
+                "type": "aps",
+                "version": 1,
+                "accountId": "example-account",
+                "bidId": "fictional-selected-bid-id",
+                "tagType": "iframe",
+                "creativeUrl": "https://creative.example/render",
+                "aaxResponse": "<base64 minimized one-bid envelope>",
+                "width": 728,
+                "height": 90
+              }
+            }
+          }
         }
       ]
     }
diff --git a/crates/trusted-server-core/src/auction/formats.rs b/crates/trusted-server-core/src/auction/formats.rs
index 441828a18..63f777a19 100644
--- a/crates/trusted-server-core/src/auction/formats.rs
+++ b/crates/trusted-server-core/src/auction/formats.rs
@@ -10,6 +10,7 @@ use http::{HeaderValue, Request, Response, StatusCode, header};
 use serde::Deserialize;
 use serde_json::Value as JsonValue;
 use std::collections::HashMap;
+use url::Url;
 use uuid::Uuid;
 
 use crate::auction::context::ContextValue;
@@ -19,7 +20,10 @@ use crate::creative;
 use crate::ec::eids::encode_eids_header;
 use crate::error::TrustedServerError;
 use crate::geo::GeoInfo;
-use crate::openrtb::{OpenRtbBid, OpenRtbResponse, ResponseExt, SeatBid, ToExt, to_openrtb_i32};
+use crate::openrtb::{
+    BidExt, BidTrustedServerExt, OpenRtbBid, OpenRtbResponse, ResponseExt, SeatBid, ToExt,
+    to_openrtb_i32,
+};
 use crate::platform::RuntimeServices;
 use crate::settings::Settings;
 
@@ -84,6 +88,33 @@ pub struct BannerUnit {
     pub sizes: Vec<Vec<u32>>,
 }
 
+const MAX_PUBLISHER_PAGE_URL_BYTES: usize = 8192;
+
+fn publisher_page_url(req: &Request<EdgeBody>, publisher_domain: &str) -> String {
+    let fallback = format!("https://{publisher_domain}");
+    let Some(candidate) = req
+        .headers()
+        .get(header::REFERER)
+        .and_then(|value| value.to_str().ok())
+        .filter(|value| value.len() <= MAX_PUBLISHER_PAGE_URL_BYTES)
+    else {
+        return fallback;
+    };
+    let Ok(parsed) = Url::parse(candidate) else {
+        return fallback;
+    };
+    if !matches!(parsed.scheme(), "http" | "https")
+        || !parsed
+            .host_str()
+            .is_some_and(|host| host.eq_ignore_ascii_case(publisher_domain))
+        || !parsed.username().is_empty()
+        || parsed.password().is_some()
+    {
+        return fallback;
+    }
+    parsed.to_string()
+}
+
 /// Convert tsjs/Prebid.js request format to internal [`AuctionRequest`].
 ///
 /// The `consent` parameter carries decoded consent signals extracted from the
@@ -194,12 +225,14 @@ pub fn convert_tsjs_to_auction_request(
         }
     }
 
+    let page_url = publisher_page_url(req, &settings.publisher.domain);
+
     Ok(AuctionRequest {
         id: Uuid::new_v4().to_string(),
         slots,
         publisher: PublisherInfo {
             domain: settings.publisher.domain.clone(),
-            page_url: Some(format!("https://{}", settings.publisher.domain)),
+            page_url: Some(page_url.clone()),
         },
         user: UserInfo {
             id: ec_id,
@@ -209,7 +242,7 @@ pub fn convert_tsjs_to_auction_request(
         device,
         site: Some(SiteInfo {
             domain: settings.publisher.domain.clone(),
-            page: format!("https://{}", settings.publisher.domain),
+            page: page_url,
         }),
         context,
     })
@@ -217,12 +250,12 @@ pub fn convert_tsjs_to_auction_request(
 
 /// Convert `OrchestrationResult` to `OpenRTB` response format.
 ///
-/// Returns rewritten creative HTML directly in the `adm` field for inline delivery.
+/// Returns rewritten ordinary creative HTML in `adm` or a typed renderer extension.
 ///
 /// # Errors
 ///
 /// Returns an error if:
-/// - A winning bid is missing a price
+/// - A winning bid is missing a price or render source
 /// - The response serialization fails
 pub fn convert_to_openrtb_response(
     result: &OrchestrationResult,
@@ -250,8 +283,9 @@ pub fn convert_to_openrtb_response(
         let width = to_openrtb_i32(bid.width, "width", &bid_context);
         let height = to_openrtb_i32(bid.height, "height", &bid_context);
 
-        // Process creative HTML if present - — sanitize dangerous markup first, then rewrite URLs.
-        let creative_html = if let Some(ref raw_creative) = bid.creative {
+        // Ordinary markup remains on the mandatory sanitize/rewrite path. A
+        // typed renderer is serialized separately and never enters the HTML sanitizer.
+        let (adm, ext) = if let Some(ref raw_creative) = bid.creative {
             let sanitized = creative::sanitize_creative_html(raw_creative);
             let rewritten = creative::rewrite_creative_html(settings, &sanitized);
 
@@ -264,26 +298,38 @@ pub fn convert_to_openrtb_response(
                 rewritten.len()
             );
 
-            rewritten
+            (Some(rewritten), None)
+        } else if let Some(renderer) = bid.renderer.as_ref() {
+            (
+                None,
+                BidExt {
+                    trusted_server: BidTrustedServerExt { renderer },
+                }
+                .to_ext(),
+            )
         } else {
-            // No creative provided (e.g., from mediation layer that returns iframe URLs)
-            log::warn!(
-                "No creative HTML for auction {} slot {} - mediation should have provided creative",
-                auction_request.id,
-                slot_id
-            );
-            String::new()
+            return Err(Report::new(TrustedServerError::Auction {
+                message: format!(
+                    "Winning bid for slot '{}' from '{}' has no render source",
+                    slot_id, bid.bidder
+                ),
+            }));
         };
 
         let openrtb_bid = OpenRtbBid {
-            id: Some(format!("{}-{}", bid.bidder, slot_id)),
+            id: bid
+                .bid_id
+                .clone()
+                .or_else(|| Some(format!("{}-{}", bid.bidder, slot_id))),
             impid: Some(slot_id.to_string()),
             price: Some(price),
-            adm: Some(creative_html),
-            crid: Some(format!("{}-creative", bid.bidder)),
+            adm,
+            adid: bid.ad_id.clone(),
+            crid: bid.creative_id.clone(),
             w: width,
             h: height,
             adomain: bid.adomain.clone().unwrap_or_default(),
+            ext,
             ..Default::default()
         };
 
@@ -365,7 +411,9 @@ pub fn convert_to_openrtb_response(
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::auction::types::{AuctionResponse, Bid, BidStatus};
+    use crate::auction::types::{
+        ApsRendererV1, ApsTagType, AuctionResponse, Bid, BidRenderer, BidStatus,
+    };
     use crate::openrtb::{Eid, Uid};
     use crate::platform::test_support::noop_services;
     use crate::test_support::tests::create_test_settings;
@@ -437,7 +485,10 @@ mod tests {
             height: 250,
             nurl: None,
             burl: None,
+            bid_id: Some(format!("{bidder}-{slot_id}")),
             ad_id: None,
+            creative_id: Some(format!("{bidder}-creative")),
+            renderer: None,
             cache_id: None,
             cache_host: None,
             cache_path: None,
@@ -605,6 +656,45 @@ mod tests {
         );
     }
 
+    #[test]
+    fn publisher_page_url_accepts_only_same_publisher_http_urls() {
+        let request = Request::builder()
+            .uri("https://publisher.example.com/auction")
+            .header(
+                header::REFERER,
+                "https://publisher.example.com/article?id=1",
+            )
+            .body(EdgeBody::empty())
+            .expect("should build request");
+        assert_eq!(
+            publisher_page_url(&request, "publisher.example.com"),
+            "https://publisher.example.com/article?id=1"
+        );
+        assert_eq!(
+            publisher_page_url(&request, "Publisher.Example.Com"),
+            "https://publisher.example.com/article?id=1",
+            "DNS host comparison should be case-insensitive"
+        );
+
+        for candidate in [
+            "https://other.example/article",
+            "javascript:alert(1)",
+            "https://user:password@publisher.example.com/article",
+            "not a url",
+        ] {
+            let request = Request::builder()
+                .uri("https://publisher.example.com/auction")
+                .header(header::REFERER, candidate)
+                .body(EdgeBody::empty())
+                .expect("should build request");
+            assert_eq!(
+                publisher_page_url(&request, "publisher.example.com"),
+                "https://publisher.example.com",
+                "should reject {candidate}"
+            );
+        }
+    }
+
     #[test]
     fn convert_tsjs_to_auction_request_maps_banner_sizes_to_formats() {
         let settings = make_settings();
@@ -933,22 +1023,65 @@ mod tests {
     }
 
     #[test]
-    fn convert_to_openrtb_response_serializes_missing_creative_as_empty_adm() {
+    fn convert_to_openrtb_response_rejects_winner_without_render_source() {
         let settings = make_settings();
         let auction_request = make_auction_request();
         let mut bid = make_bid("div-gpt-top", "appnexus", Some(2.75));
         bid.creative = None;
         let result = make_result(bid);
 
-        let response = convert_to_openrtb_response(&result, &settings, &auction_request, false)
-            .expect("should convert bid without creative HTML");
+        let error = convert_to_openrtb_response(&result, &settings, &auction_request, false)
+            .expect_err("should reject bid without a render source");
 
-        assert_eq!(response.status(), StatusCode::OK, "should return OK");
+        assert!(
+            format!("{error:?}").contains("has no render source"),
+            "should explain the missing render source"
+        );
+    }
+
+    #[test]
+    fn convert_to_openrtb_response_emits_typed_aps_renderer_without_adm() {
+        let settings = make_settings();
+        let auction_request = make_auction_request();
+        let mut bid = make_bid("div-gpt-top", "aps", Some(2.75));
+        bid.creative = None;
+        bid.bid_id = Some("fictional-bid".to_string());
+        bid.ad_id = Some("fictional-ad".to_string());
+        bid.creative_id = Some("fictional-creative".to_string());
+        bid.renderer = Some(BidRenderer::Aps(ApsRendererV1 {
+            version: 1,
+            account_id: "example-account".to_string(),
+            bid_id: "fictional-bid".to_string(),
+            creative_id: Some("fictional-creative".to_string()),
+            tag_type: ApsTagType::Iframe,
+            creative_url: "https://creative.example/render".to_string(),
+            aax_response: "fictional-base64".to_string(),
+            width: 300,
+            height: 250,
+        }));
+        let result = make_result(bid);
+
+        let response = convert_to_openrtb_response(&result, &settings, &auction_request, false)
+            .expect("should convert APS renderer bid");
         let json = response_json(response);
+        let bid = json["seatbid"][0]["bid"][0]
+            .as_object()
+            .expect("should serialize bid object");
+
+        assert!(
+            !bid.contains_key("adm"),
+            "should omit adm for renderer bids"
+        );
+        assert_eq!(bid["id"], json!("fictional-bid"));
+        assert_eq!(bid["adid"], json!("fictional-ad"));
+        assert_eq!(bid["crid"], json!("fictional-creative"));
+        assert_eq!(
+            bid["ext"]["trusted_server"]["renderer"]["type"],
+            json!("aps")
+        );
         assert_eq!(
-            json["seatbid"][0]["bid"][0]["adm"],
-            json!(""),
-            "should serialize missing creative as empty adm"
+            bid["ext"]["trusted_server"]["renderer"]["bidId"],
+            json!("fictional-bid")
         );
     }
 
diff --git a/crates/trusted-server-core/src/auction/orchestrator.rs b/crates/trusted-server-core/src/auction/orchestrator.rs
index 4ef73e581..09fadf666 100644
--- a/crates/trusted-server-core/src/auction/orchestrator.rs
+++ b/crates/trusted-server-core/src/auction/orchestrator.rs
@@ -340,16 +340,14 @@ impl AuctionOrchestrator {
                     message: format!("Mediator {} parse failed", mediator.provider_name()),
                 })?;
 
-            // Extract winning bids from mediator response
-            // Filter out bids without decoded prices - mediator should have decoded all prices
+            // Extract only mediator bids with comparable numeric prices.
             let winning = mediator_resp
                 .bids
                 .iter()
                 .filter_map(|bid| {
                     if bid.price.is_none() {
                         log::warn!(
-                            "Mediator '{}' returned bid for slot '{}' without decoded price - skipping. \
-                             Mediator should decode all prices including APS bids.",
+                            "Mediator '{}' returned bid for slot '{}' without a price - skipping",
                             mediator.provider_name(),
                             bid.slot_id
                         );
@@ -693,9 +691,7 @@ impl AuctionOrchestrator {
         Ok(responses)
     }
 
-    /// Select the best bid for each slot from all responses.
-    /// Note: Bids with None price (e.g., APS bids with encoded prices) are skipped
-    /// when no mediator is configured, as we cannot compare them without decoding.
+    /// Select the best decoded-price bid for each slot from all responses.
     fn select_winning_bids(
         &self,
         responses: &[AuctionResponse],
@@ -709,13 +705,11 @@ impl AuctionOrchestrator {
             }
 
             for bid in &response.bids {
-                // Skip bids without decoded prices (e.g., APS bids)
-                // These require mediation layer to decode
                 let bid_price = match bid.price {
                     Some(p) => p,
                     None => {
                         log::debug!(
-                            "Skipping bid for slot '{}' from '{}' - price requires mediation to decode",
+                            "Skipping bid for slot '{}' from '{}' without a comparable price",
                             bid.slot_id,
                             bid.bidder
                         );
@@ -750,30 +744,28 @@ impl AuctionOrchestrator {
         }
 
         let starting_count = winning_bids.len();
-        winning_bids.retain(|slot_id, bid| match (floor_prices.get(slot_id), bid.price) {
-            (Some(floor), Some(price)) if price >= *floor => true,
-            (Some(_), Some(_)) => {
-                log::info!(
-                    "Dropping winning bid below floor price for slot '{}'",
-                    slot_id
-                );
-                false
-            }
-            (_, None) => {
-                // Any caller that needs to keep an undecoded (encoded-price)
-                // bid must decode it *before* invoking this function — both
-                // `select_winning_bids` and the mediator path already do.
-                // Letting `None`-price bids through here would cause
-                // `winning_bids.len()` to overcount what `build_bid_map`
-                // downstream is willing to emit, so they get dropped instead.
-                log::debug!(
-                    "Dropping bid for slot '{}' - no decoded price (caller must decode before apply_floor_prices)",
-                    slot_id
-                );
-                false
-            }
-            (None, Some(_)) => true,
-        });
+        winning_bids.retain(
+            |slot_id, bid| match (floor_prices.get(slot_id), bid.price) {
+                (Some(floor), Some(price)) if price >= *floor => true,
+                (Some(_), Some(_)) => {
+                    log::info!(
+                        "Dropping winning bid below floor price for slot '{}'",
+                        slot_id
+                    );
+                    false
+                }
+                (_, None) => {
+                    // Every downstream response requires a comparable numeric price,
+                    // so bids without one are always dropped before delivery.
+                    log::debug!(
+                        "Dropping bid for slot '{}' without a comparable price",
+                        slot_id
+                    );
+                    false
+                }
+                (None, Some(_)) => true,
+            },
+        );
 
         if winning_bids.len() != starting_count {
             log::info!(
@@ -1325,8 +1317,8 @@ mod tests {
     use crate::auction::provider::AuctionProvider;
     use crate::auction::test_support::create_test_auction_context;
     use crate::auction::types::{
-        AdFormat, AdSlot, AuctionContext, AuctionRequest, AuctionResponse, Bid, BidStatus,
-        MediaType, PublisherInfo, UserInfo,
+        AdFormat, AdSlot, ApsRendererV1, ApsTagType, AuctionContext, AuctionRequest,
+        AuctionResponse, Bid, BidRenderer, BidStatus, MediaType, PublisherInfo, UserInfo,
     };
     use crate::error::TrustedServerError;
     use crate::platform::test_support::{StubHttpClient, build_services_with_http_client};
@@ -1404,6 +1396,44 @@ mod tests {
     /// the synchronous mediation path calls `parse_response_with_context`.
     struct CacheRestoringMediator;
 
+    fn auction_bid(bidder: &str, price: f64) -> Bid {
+        let renderer = (bidder == "aps").then(|| {
+            BidRenderer::Aps(ApsRendererV1 {
+                version: 1,
+                account_id: "example-account".to_string(),
+                bid_id: "aps-selected-bid".to_string(),
+                creative_id: None,
+                tag_type: ApsTagType::Iframe,
+                creative_url: "https://creative.example/render".to_string(),
+                aax_response: "fictional-base64".to_string(),
+                width: 300,
+                height: 250,
+            })
+        });
+        Bid {
+            slot_id: "slot-1".to_string(),
+            price: Some(price),
+            currency: "USD".to_string(),
+            creative: renderer
+                .is_none()
+                .then(|| "<div>ordinary</div>".to_string()),
+            adomain: None,
+            bidder: bidder.to_string(),
+            width: 300,
+            height: 250,
+            nurl: None,
+            burl: None,
+            bid_id: (bidder == "aps").then(|| "aps-selected-bid".to_string()),
+            ad_id: None,
+            creative_id: None,
+            renderer,
+            cache_id: None,
+            cache_host: None,
+            cache_path: None,
+            metadata: HashMap::new(),
+        }
+    }
+
     fn mediated_bid(nurl: Option<String>) -> Bid {
         Bid {
             slot_id: "header-banner".to_string(),
@@ -1416,7 +1446,10 @@ mod tests {
             height: 90,
             nurl: nurl.clone(),
             burl: nurl,
+            bid_id: None,
             ad_id: Some("creative-123".to_string()),
+            creative_id: None,
+            renderer: None,
             cache_id: Some("cache-abc".to_string()),
             cache_host: None,
             cache_path: None,
@@ -1755,7 +1788,10 @@ mod tests {
                 height: 250,
                 nurl: None,
                 burl: None,
+                bid_id: None,
                 ad_id: None,
+                creative_id: None,
+                renderer: None,
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
@@ -1775,7 +1811,10 @@ mod tests {
                 height: 250,
                 nurl: None,
                 burl: None,
+                bid_id: None,
                 ad_id: None,
+                creative_id: None,
+                renderer: None,
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
@@ -2140,14 +2179,42 @@ mod tests {
     }
 
     #[test]
-    fn test_apply_floor_prices_drops_bids_with_undecoded_price() {
-        // Bids that reach apply_floor_prices with `price=None` cannot have a
-        // floor compared against them — and they would not survive downstream
-        // (build_bid_map filters them) — so apply_floor_prices drops them so
-        // the count it reports matches what eventually ships to the client.
-        // Both production paths (select_winning_bids and the mediator filter)
-        // already decode/skip None prices before calling this function; this
-        // test pins the contract.
+    fn decoded_aps_bid_competes_directly_by_cpm() {
+        let orchestrator = AuctionOrchestrator::new(AuctionConfig::default());
+        let floor_prices = HashMap::new();
+        let response = |provider: &str, bid: Bid| AuctionResponse::success(provider, vec![bid], 1);
+
+        let aps_wins = orchestrator.select_winning_bids(
+            &[
+                response("aps", auction_bid("aps", 2.0)),
+                response("ordinary", auction_bid("ordinary", 1.0)),
+            ],
+            &floor_prices,
+        );
+        let winner = aps_wins.get("slot-1").expect("should select APS bid");
+        assert_eq!(winner.bidder, "aps");
+        assert!(winner.renderer.is_some());
+        assert!(winner.creative.is_none());
+
+        let ordinary_wins = orchestrator.select_winning_bids(
+            &[
+                response("aps", auction_bid("aps", 2.0)),
+                response("ordinary", auction_bid("ordinary", 3.0)),
+            ],
+            &floor_prices,
+        );
+        assert_eq!(
+            ordinary_wins
+                .get("slot-1")
+                .expect("should select ordinary bid")
+                .bidder,
+            "ordinary"
+        );
+    }
+
+    #[test]
+    fn test_apply_floor_prices_drops_bids_without_price() {
+        // Price-less bids cannot be compared or delivered and remain fail-closed.
         let orchestrator = AuctionOrchestrator::new(AuctionConfig::default());
         let mut floor_prices = HashMap::new();
         floor_prices.insert("slot-1".to_string(), 1.00);
@@ -2166,18 +2233,14 @@ mod tests {
                 height: 250,
                 nurl: None,
                 burl: None,
+                bid_id: None,
                 ad_id: None,
+                creative_id: None,
+                renderer: None,
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
-                metadata: {
-                    let mut m = HashMap::new();
-                    m.insert(
-                        "amznbid".to_string(),
-                        serde_json::json!("encoded_price_data"),
-                    );
-                    m
-                },
+                metadata: HashMap::new(),
             },
         );
 
@@ -2189,15 +2252,13 @@ mod tests {
         );
         assert!(
             !filtered.contains_key("slot-1"),
-            "slot-1 should not survive when its bid has no decoded price"
+            "slot-1 should not survive when its bid has no price"
         );
     }
 
     #[test]
     fn test_apply_floor_prices_drops_decoded_aps_bid_below_floor() {
-        // After mediation decodes an APS bid, apply_floor_prices must enforce the
-        // slot floor on the resulting price=Some(x) value. This test simulates the
-        // state of a bid after mediator decoding: price is Some, amznbid is gone.
+        // APS supplies decoded price at the provider boundary, so normal floors apply.
         let orchestrator = AuctionOrchestrator::new(AuctionConfig::default());
         let mut floor_prices = HashMap::new();
         floor_prices.insert("atf".to_string(), 0.50);
@@ -2216,7 +2277,10 @@ mod tests {
                 height: 250,
                 nurl: None,
                 burl: None,
+                bid_id: None,
                 ad_id: None,
+                creative_id: None,
+                renderer: None,
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
@@ -2252,7 +2316,10 @@ mod tests {
                 height: 250,
                 nurl: None,
                 burl: None,
+                bid_id: None,
                 ad_id: None,
+                creative_id: None,
+                renderer: None,
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
diff --git a/crates/trusted-server-core/src/auction/telemetry.rs b/crates/trusted-server-core/src/auction/telemetry.rs
index 4819cef6c..30d004e3a 100644
--- a/crates/trusted-server-core/src/auction/telemetry.rs
+++ b/crates/trusted-server-core/src/auction/telemetry.rs
@@ -959,7 +959,10 @@ mod tests {
             height: 250,
             nurl: None,
             burl: None,
+            bid_id: None,
             ad_id: ad_id.map(str::to_owned),
+            creative_id: None,
+            renderer: None,
             cache_id: None,
             cache_host: None,
             cache_path: None,
diff --git a/crates/trusted-server-core/src/auction/types.rs b/crates/trusted-server-core/src/auction/types.rs
index 14c7713f8..a6ad61f3a 100644
--- a/crates/trusted-server-core/src/auction/types.rs
+++ b/crates/trusted-server-core/src/auction/types.rs
@@ -171,18 +171,71 @@ pub struct AuctionResponse {
     pub metadata: HashMap<String, serde_json::Value>,
 }
 
+/// APS creative tag type accepted by the Trusted Server renderer.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum ApsTagType {
+    /// APS loads the creative URL in a nested iframe.
+    Iframe,
+    /// APS fetches creative HTML and executes it in its nested renderer frame.
+    Script,
+}
+
+/// Version 1 APS renderer descriptor shared with browser clients.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ApsRendererV1 {
+    /// Renderer contract version.
+    pub version: u8,
+    /// APS account identifier used to initialize the fixed runner.
+    pub account_id: String,
+    /// Selected `OpenRTB` bid identifier.
+    pub bid_id: String,
+    /// Optional `OpenRTB` creative identifier.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub creative_id: Option<String>,
+    /// APS creative delivery mode.
+    pub tag_type: ApsTagType,
+    /// HTTPS creative URL consumed by the fixed APS runner.
+    pub creative_url: String,
+    /// Base64-encoded exact one-bid APS response envelope.
+    pub aax_response: String,
+    /// Creative width.
+    pub width: u32,
+    /// Creative height.
+    pub height: u32,
+}
+
+/// Typed browser renderer capability carried by a bid.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "type", rename_all = "lowercase")]
+pub enum BidRenderer {
+    /// APS renderer version 1.
+    Aps(ApsRendererV1),
+}
+
+impl BidRenderer {
+    /// Return the APS renderer descriptor.
+    #[must_use]
+    pub fn aps(&self) -> &ApsRendererV1 {
+        match self {
+            Self::Aps(renderer) => renderer,
+        }
+    }
+}
+
 /// Individual bid from a provider.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Bid {
     /// Slot this bid is for
     pub slot_id: String,
-    /// Bid price in CPM
-    /// None for APS bids where price is encoded and must be decoded by mediation layer
+    /// Bid price in CPM.
     pub price: Option<f64>,
     /// Currency code (e.g., "USD")
     pub currency: String,
-    /// Creative markup (HTML/VAST)
-    /// None when the bidder doesn't provide creative HTML (e.g., APS/TAM)
+    /// Creative markup (HTML/VAST).
+    ///
+    /// `None` when the bid uses a typed [`BidRenderer`] instead.
     pub creative: Option<String>,
     /// Advertiser domain
     pub adomain: Option<Vec<String>>,
@@ -196,8 +249,15 @@ pub struct Bid {
     pub nurl: Option<String>,
     /// Billing notification URL
     pub burl: Option<String>,
-    /// Ad ID from the bidder
+    /// `OpenRTB` bid identifier.
+    pub bid_id: Option<String>,
+    /// Ad ID from the bidder.
     pub ad_id: Option<String>,
+    /// Optional `OpenRTB` creative identifier.
+    pub creative_id: Option<String>,
+    /// Typed browser renderer capability.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub renderer: Option<BidRenderer>,
     /// Prebid Cache UUID for this bid.
     ///
     /// Populated from `ext.prebid.cache.bids.cacheId` in the PBS response.
@@ -214,8 +274,7 @@ pub struct Bid {
     /// Populated from the path of `ext.prebid.cache.bids.url`. Used as
     /// `hb_cache_path` targeting value. `None` when cache is absent.
     pub cache_path: Option<String>,
-    /// Provider-specific bid metadata
-    /// For APS bids, contains encoded price in "amznbid" field
+    /// Provider-specific bid metadata.
     pub metadata: HashMap<String, serde_json::Value>,
 }
 
@@ -338,7 +397,10 @@ mod tests {
             height: 250,
             nurl: None,
             burl: None,
+            bid_id: None,
             ad_id: None,
+            creative_id: None,
+            renderer: None,
             cache_id: None,
             cache_host: None,
             cache_path: None,
@@ -467,7 +529,10 @@ mod tests {
             height: 250,
             nurl: None,
             burl: None,
+            bid_id: None,
             ad_id: Some("bid-id".to_string()),
+            creative_id: None,
+            renderer: None,
             cache_id: Some("cache-uuid".to_string()),
             cache_host: Some("cache.example.com".to_string()),
             cache_path: Some("/pbc/v1/cache".to_string()),
@@ -492,6 +557,62 @@ mod tests {
         );
     }
 
+    #[test]
+    fn aps_renderer_serializes_to_versioned_camel_case_contract() {
+        let renderer = BidRenderer::Aps(ApsRendererV1 {
+            version: 1,
+            account_id: "example-account-id".to_string(),
+            bid_id: "fictional-bid-id".to_string(),
+            creative_id: Some("fictional-creative-id".to_string()),
+            tag_type: ApsTagType::Iframe,
+            creative_url: "https://creative.example/render".to_string(),
+            aax_response: "base64-data".to_string(),
+            width: 300,
+            height: 250,
+        });
+
+        let serialized = serde_json::to_value(&renderer).expect("should serialize renderer");
+
+        assert_eq!(
+            serialized,
+            json!({
+                "type": "aps",
+                "version": 1,
+                "accountId": "example-account-id",
+                "bidId": "fictional-bid-id",
+                "creativeId": "fictional-creative-id",
+                "tagType": "iframe",
+                "creativeUrl": "https://creative.example/render",
+                "aaxResponse": "base64-data",
+                "width": 300,
+                "height": 250
+            }),
+            "should match renderer wire contract"
+        );
+    }
+
+    #[test]
+    fn aps_renderer_omits_absent_creative_id() {
+        let renderer = BidRenderer::Aps(ApsRendererV1 {
+            version: 1,
+            account_id: "example-account-id".to_string(),
+            bid_id: "fictional-bid-id".to_string(),
+            creative_id: None,
+            tag_type: ApsTagType::Iframe,
+            creative_url: "https://creative.example/render".to_string(),
+            aax_response: "base64-data".to_string(),
+            width: 300,
+            height: 250,
+        });
+
+        let serialized = serde_json::to_value(&renderer).expect("should serialize renderer");
+
+        assert!(
+            serialized.get("creativeId").is_none(),
+            "should omit absent creative ID"
+        );
+    }
+
     #[test]
     fn media_type_defaults_to_banner() {
         assert_eq!(
@@ -514,7 +635,10 @@ mod tests {
             height: 250,
             nurl: None,
             burl: None,
+            bid_id: None,
             ad_id: Some("prebid-ad-id-abc".to_string()),
+            creative_id: None,
+            renderer: None,
             cache_id: None,
             cache_host: None,
             cache_path: None,
diff --git a/crates/trusted-server-core/src/creative_opportunities.rs b/crates/trusted-server-core/src/creative_opportunities.rs
index 9ce741f3f..d56fa6a45 100644
--- a/crates/trusted-server-core/src/creative_opportunities.rs
+++ b/crates/trusted-server-core/src/creative_opportunities.rs
@@ -275,8 +275,9 @@ impl CreativeOpportunitySlot {
 
     /// Converts this slot into an [`AdSlot`] ready for use in an auction request.
     ///
-    /// Provider-specific params (e.g., APS `slotID`, PBS bidder params) are wired
-    /// into the `bidders` map keyed by provider/bidder name.
+    /// Prebid Server bidder params are wired into the `bidders` map keyed by
+    /// bidder name. Legacy APS slot params are accepted in configuration but
+    /// intentionally ignored by the APS `OpenRTB` provider.
     ///
     /// When [`PrebidSlotParams::bidders`] is empty, a `trustedServer` entry is
     /// injected so [`PrebidAuctionProvider`] expands all `config.bidders`
@@ -285,12 +286,6 @@ impl CreativeOpportunitySlot {
     #[must_use]
     pub fn to_ad_slot(&self) -> AdSlot {
         let mut bidders: HashMap<String, serde_json::Value> = HashMap::new();
-        if let Some(ref aps) = self.providers.aps {
-            bidders.insert(
-                "aps".to_string(),
-                serde_json::json!({ "slotID": aps.slot_id }),
-            );
-        }
         if let Some(ref prebid) = self.providers.prebid {
             if prebid.bidders.is_empty() {
                 // No explicit per-bidder override: let the Prebid provider expand
@@ -364,7 +359,10 @@ impl CreativeOpportunityFormat {
 #[derive(Debug, Clone, Default, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
 pub struct SlotProviders {
-    /// Amazon Publisher Services (APS/TAM) slot parameters.
+    /// Legacy APS slot parameters, retained only for configuration compatibility.
+    ///
+    /// APS `OpenRTB` uses the canonical creative-opportunity slot ID and does not
+    /// forward this value to APS or Prebid Server.
     pub aps: Option<ApsSlotParams>,
     /// Prebid Server inline bidder parameters.
     ///
@@ -374,11 +372,11 @@ pub struct SlotProviders {
     pub prebid: Option<PrebidSlotParams>,
 }
 
-/// APS-specific parameters for a slot.
+/// Legacy APS-specific parameters retained for configuration compatibility.
 #[derive(Debug, Clone, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
 pub struct ApsSlotParams {
-    /// The APS slot ID string used when making TAM bid requests.
+    /// Deprecated legacy slot ID. APS `OpenRTB` ignores this value.
     pub slot_id: String,
 }
 
@@ -617,16 +615,15 @@ mod tests {
     }
 
     #[test]
-    fn to_ad_slot_wires_aps_params_into_bidders() {
+    fn to_ad_slot_ignores_legacy_aps_params() {
         let mut slot = make_slot("atf", vec!["/"]);
         slot.providers.aps = Some(ApsSlotParams {
-            slot_id: "aps-slot-atf".to_string(),
+            slot_id: "legacy-aps-slot-atf".to_string(),
         });
         let ad_slot = slot.to_ad_slot();
-        let aps_params = ad_slot.bidders.get("aps").expect("should have aps bidder");
-        assert_eq!(
-            aps_params.get("slotID").and_then(|v| v.as_str()),
-            Some("aps-slot-atf"),
+        assert!(
+            !ad_slot.bidders.contains_key("aps"),
+            "legacy APS params must not enable APS through Prebid Server"
         );
     }
 
diff --git a/crates/trusted-server-core/src/integrations/adserver_mock.rs b/crates/trusted-server-core/src/integrations/adserver_mock.rs
index 8fd3f9ddb..009ddd6ba 100644
--- a/crates/trusted-server-core/src/integrations/adserver_mock.rs
+++ b/crates/trusted-server-core/src/integrations/adserver_mock.rs
@@ -159,9 +159,7 @@ impl AdServerMockProvider {
 
     /// Build mediation request from auction request and bidder responses.
     ///
-    /// Handles both:
-    /// - Regular bids with decoded prices (price field set)
-    /// - APS-style bids with encoded prices (price=None, encoded price in metadata)
+    /// Only bids with decoded numeric prices are eligible for mediation.
     fn build_mediation_request(
         &self,
         request: &AuctionRequest,
@@ -175,14 +173,15 @@ impl AdServerMockProvider {
                 let bids: Vec<Json> = response
                     .bids
                     .iter()
-                    .map(|bid| {
-                        // Mocktioneer mediator always requires a numeric `price` field.
-                        // APS bids carry price as an opaque encoded string (`amznbid`)
-                        // that cannot be decoded client-side; use `bid.price` when set
-                        // (a real decoded value) or fall back to a mock floor price for
-                        // test/demo purposes.
-                        let price = bid.price.unwrap_or(1.50);
-                        json!({
+                    .filter_map(|bid| {
+                        let Some(price) = bid.price else {
+                            log::debug!(
+                                "adserver_mock: omitting bid for slot '{}' without decoded price",
+                                bid.slot_id
+                            );
+                            return None;
+                        };
+                        Some(json!({
                             "imp_id": bid.slot_id,
                             "price": price,
                             "adm": bid.creative,
@@ -190,7 +189,7 @@ impl AdServerMockProvider {
                             "h": bid.height,
                             "crid": format!("{}-creative", bid.bidder),
                             "adomain": bid.adomain,
-                        })
+                        }))
                     })
                     .collect();
 
@@ -254,7 +253,7 @@ impl AdServerMockProvider {
     }
 
     /// Parse `OpenRTB` response from mediation endpoint.
-    /// Mediation returns decoded prices for all bids (including APS bids that were encoded).
+    /// Mediation returns decoded prices for all selected bids.
     ///
     /// `bid_index` is the SSP-bid lookup built from the auction context's
     /// bidder responses. The mock mediator does not echo render/accounting
@@ -307,7 +306,11 @@ impl AdServerMockProvider {
                     slot_id,
                     price: bid["price"].as_f64(),
                     currency: "USD".to_string(),
-                    creative: bid["adm"].as_str().map(String::from),
+                    creative: if original.is_some_and(|bid| bid.renderer.is_some()) {
+                        None
+                    } else {
+                        bid["adm"].as_str().map(String::from)
+                    },
                     width,
                     height,
                     bidder: restored_bidder,
@@ -318,7 +321,10 @@ impl AdServerMockProvider {
                     }),
                     nurl: original.and_then(|b| b.nurl.clone()),
                     burl: original.and_then(|b| b.burl.clone()),
-                    ad_id: original.and_then(|b| b.ad_id.clone()),
+                    bid_id: original.and_then(|bid| bid.bid_id.clone()),
+                    ad_id: original.and_then(|bid| bid.ad_id.clone()),
+                    creative_id: original.and_then(|bid| bid.creative_id.clone()),
+                    renderer: original.and_then(|bid| bid.renderer.clone()),
                     cache_id: original.and_then(|b| b.cache_id.clone()),
                     cache_host: original.and_then(|b| b.cache_host.clone()),
                     cache_path: original.and_then(|b| b.cache_path.clone()),
@@ -614,6 +620,39 @@ mod tests {
         }
     }
 
+    fn aps_bid(bid_id: &str, price: f64) -> Bid {
+        Bid {
+            slot_id: "header-banner".to_string(),
+            price: Some(price),
+            currency: "USD".to_string(),
+            creative: None,
+            width: 728,
+            height: 90,
+            bidder: "aps".to_string(),
+            adomain: Some(vec!["advertiser.example".to_string()]),
+            nurl: None,
+            burl: None,
+            bid_id: Some(bid_id.to_string()),
+            ad_id: None,
+            creative_id: Some(format!("creative-{bid_id}")),
+            renderer: Some(BidRenderer::Aps(ApsRendererV1 {
+                version: 1,
+                account_id: "example-account".to_string(),
+                bid_id: bid_id.to_string(),
+                creative_id: Some(format!("creative-{bid_id}")),
+                tag_type: ApsTagType::Iframe,
+                creative_url: format!("https://creative.example/{bid_id}"),
+                aax_response: format!("fictional-{bid_id}-base64"),
+                width: 728,
+                height: 90,
+            })),
+            cache_id: None,
+            cache_host: None,
+            cache_path: None,
+            metadata: HashMap::new(),
+        }
+    }
+
     #[test]
     fn test_build_mediation_request() {
         let config = AdServerMockConfig {
@@ -629,7 +668,7 @@ mod tests {
 
         let bidder_responses = vec![
             AuctionResponse {
-                provider: "amazon-aps".to_string(),
+                provider: "aps".to_string(),
                 status: BidStatus::Success,
                 bids: vec![Bid {
                     slot_id: "header-banner".to_string(),
@@ -638,11 +677,14 @@ mod tests {
                     creative: Some("<div>APS Ad</div>".to_string()),
                     width: 728,
                     height: 90,
-                    bidder: "amazon-aps".to_string(),
-                    adomain: Some(vec!["amazon.com".to_string()]),
+                    bidder: "aps".to_string(),
+                    adomain: Some(vec!["advertiser.example".to_string()]),
                     nurl: None,
                     burl: None,
+                    bid_id: None,
                     ad_id: None,
+                    creative_id: None,
+                    renderer: None,
                     cache_id: None,
                     cache_host: None,
                     cache_path: None,
@@ -665,7 +707,10 @@ mod tests {
                     adomain: None,
                     nurl: Some("https://ssp.example/win?id=mock-bid-001".to_string()),
                     burl: Some("https://ssp.example/bill?id=mock-bid-001".to_string()),
+                    bid_id: None,
                     ad_id: Some("mock-bid-001".to_string()),
+                    creative_id: None,
+                    renderer: None,
                     cache_id: None,
                     cache_host: None,
                     cache_path: None,
@@ -784,7 +829,20 @@ mod tests {
                 height: 90,
                 nurl: Some("https://ssp.example/win".to_string()),
                 burl: Some("https://ssp.example/bill".to_string()),
+                bid_id: Some("source-bid-id".to_string()),
                 ad_id: Some("bid-impression-id".to_string()),
+                creative_id: Some("source-creative-id".to_string()),
+                renderer: Some(BidRenderer::Aps(ApsRendererV1 {
+                    version: 1,
+                    account_id: "example-account".to_string(),
+                    bid_id: "source-bid-id".to_string(),
+                    creative_id: Some("source-creative-id".to_string()),
+                    tag_type: ApsTagType::Iframe,
+                    creative_url: "https://creative.example/render".to_string(),
+                    aax_response: "fictional-base64".to_string(),
+                    width: 728,
+                    height: 90,
+                })),
                 cache_id: Some("cache-uuid".to_string()),
                 cache_host: Some("cache.example".to_string()),
                 cache_path: Some("/cache".to_string()),
@@ -812,11 +870,14 @@ mod tests {
             Some("https://ssp.example/bill"),
             "should restore burl"
         );
+        assert_eq!(bid.bid_id.as_deref(), Some("source-bid-id"));
         assert_eq!(
             bid.ad_id.as_deref(),
             Some("bid-impression-id"),
             "should restore ad_id"
         );
+        assert_eq!(bid.creative_id.as_deref(), Some("source-creative-id"));
+        assert!(bid.renderer.is_some(), "should restore typed renderer");
         assert_eq!(
             bid.cache_id.as_deref(),
             Some("cache-uuid"),
@@ -834,6 +895,79 @@ mod tests {
         );
     }
 
+    #[test]
+    fn reduced_aps_bid_avoids_mediation_index_renderer_collision() {
+        let provider = AdServerMockProvider::new(AdServerMockConfig::default());
+
+        // Document why APS must reduce before mediation: the mediator index is
+        // intentionally last-write-wins for identical provider/slot/bidder keys.
+        let unreduced = AuctionResponse::success(
+            "aps",
+            vec![aps_bid("selected", 2.0), aps_bid("losing-last", 1.0)],
+            1,
+        );
+        let collision_index = build_bid_index(&[unreduced]);
+        let key = (
+            "aps".to_string(),
+            "header-banner".to_string(),
+            "aps".to_string(),
+        );
+        assert_eq!(
+            collision_index
+                .get(&key)
+                .and_then(|bid| bid.bid_id.as_deref()),
+            Some("losing-last"),
+            "an unreduced response would restore the last candidate's renderer"
+        );
+
+        let reduced = AuctionResponse::success("aps", vec![aps_bid("selected", 2.0)], 1);
+        let mediation_request = provider
+            .build_mediation_request(
+                &create_test_auction_request(),
+                std::slice::from_ref(&reduced),
+            )
+            .expect("should build mediation request from reduced APS response");
+        assert_eq!(
+            mediation_request["ext"]["bidder_responses"][0]["bids"]
+                .as_array()
+                .map(Vec::len),
+            Some(1)
+        );
+
+        let reduced_index = build_bid_index(&[reduced]);
+        let mediated = provider.parse_mediation_response(
+            &json!({
+                "seatbid": [{
+                    "seat": "aps",
+                    "bid": [{
+                        "impid": "header-banner",
+                        "price": 2.0,
+                        "w": 728,
+                        "h": 90,
+                        "crid": "aps-creative"
+                    }]
+                }]
+            }),
+            2,
+            &reduced_index,
+        );
+        let winner = mediated
+            .bids
+            .first()
+            .expect("should restore mediated APS winner");
+        assert_eq!(winner.bid_id.as_deref(), Some("selected"));
+        assert_eq!(
+            winner
+                .renderer
+                .as_ref()
+                .expect("should restore APS renderer")
+                .aps()
+                .bid_id,
+            "selected"
+        );
+        assert!(winner.creative.is_none());
+    }
+
     #[test]
     fn test_parse_empty_mediation_response() {
         let config = AdServerMockConfig::default();
@@ -853,8 +987,8 @@ mod tests {
     }
 
     #[test]
-    fn test_mediation_request_handles_none_creative() {
-        // Test that bids without creative HTML (e.g., APS) are properly sent to mediation
+    fn test_mediation_request_handles_decoded_bid_without_creative() {
+        // Typed-renderer bids retain their decoded price when sent to mediation.
         let config = AdServerMockConfig::default();
         let provider = AdServerMockProvider::new(config);
 
@@ -885,29 +1019,28 @@ mod tests {
             context: HashMap::new(),
         };
 
-        // APS bid with encoded price (price=None, amznbid in metadata)
-        let mut aps_metadata = HashMap::new();
-        aps_metadata.insert("amznbid".to_string(), json!("encoded-price-value"));
-
         let bidder_responses = vec![AuctionResponse {
             provider: "aps".to_string(),
             status: BidStatus::Success,
             bids: vec![Bid {
                 slot_id: "slot-1".to_string(),
-                price: None, // APS bids have no decoded price
+                price: Some(1.75),
                 currency: "USD".to_string(),
-                creative: None, // APS doesn't provide creative
+                creative: None,
                 width: 300,
                 height: 250,
-                bidder: "amazon-aps".to_string(),
-                adomain: Some(vec!["amazon.com".to_string()]),
+                bidder: "aps".to_string(),
+                adomain: Some(vec!["advertiser.example".to_string()]),
                 nurl: None,
                 burl: None,
+                bid_id: None,
                 ad_id: None,
+                creative_id: None,
+                renderer: None,
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
-                metadata: aps_metadata,
+                metadata: HashMap::new(),
             }],
             response_time_ms: 100,
             metadata: HashMap::new(),
@@ -920,20 +1053,16 @@ mod tests {
         // Verify the mediation request structure
         assert_eq!(mediation_req["id"], "test-auction");
 
-        // Check that the bid was included with encoded_price
         let bidder_resp = &mediation_req["ext"]["bidder_responses"][0];
         assert_eq!(bidder_resp["bidder"], "aps");
 
         let bid = &bidder_resp["bids"][0];
         assert_eq!(bid["imp_id"], "slot-1");
 
-        // APS bids have no decoded price (bid.price == None), so the mock floor
-        // price (1.50) is used.  Mocktioneer requires a numeric price field and
-        // does not accept an opaque encoded_price string.
         assert_eq!(
             bid["price"].as_f64(),
-            Some(1.50),
-            "APS bids with no decoded price should fall back to mock floor price 1.50"
+            Some(1.75),
+            "should preserve the decoded APS price"
         );
         // adm should be null (not a string)
         assert!(
@@ -1010,8 +1139,7 @@ mod tests {
 
     #[test]
     fn test_parse_mediation_response_with_missing_prices() {
-        // Test that mediator response with missing price fields returns None prices
-        // This tests the scenario where mediation failed to decode APS prices
+        // A malformed mediator response can still omit a selected bid price.
         let config = AdServerMockConfig::default();
         let provider = AdServerMockProvider::new(config);
 
diff --git a/crates/trusted-server-core/src/integrations/aps.rs b/crates/trusted-server-core/src/integrations/aps.rs
index 60c22265d..90b6c6db5 100644
--- a/crates/trusted-server-core/src/integrations/aps.rs
+++ b/crates/trusted-server-core/src/integrations/aps.rs
@@ -1,239 +1,162 @@
-//! Amazon Publisher Services (APS/TAM) integration.
-//!
-//! This module provides the APS auction provider for server-side bidding.
+//! Amazon Publisher Services (APS/TAM) `OpenRTB` integration.
+
+use std::collections::{BTreeMap, HashMap};
+use std::sync::Arc;
+use std::time::Duration;
 
 use async_trait::async_trait;
+use base64::{Engine as _, engine::general_purpose::STANDARD as BASE64_STANDARD};
 use edgezero_core::body::Body as EdgeBody;
 use error_stack::{Report, ResultExt};
-use http::{Method, header};
+use http::{Method, StatusCode, header};
+use serde::de::{self, Visitor};
 use serde::{Deserialize, Serialize};
 use serde_json::{Value as Json, json};
-use std::collections::HashMap;
-use std::time::Duration;
-use validator::Validate;
+use url::Url;
+use validator::{Validate, ValidationError};
 
 use crate::auction::provider::AuctionProvider;
-use crate::auction::types::{AuctionContext, AuctionRequest, AuctionResponse, Bid, MediaType};
+use crate::auction::types::{
+    AdSlot, ApsRendererV1, ApsTagType, AuctionContext, AuctionRequest, AuctionResponse, Bid,
+    BidRenderer, MediaType,
+};
 use crate::error::TrustedServerError;
 use crate::integrations::{
+    IntegrationEndpoint, IntegrationProxy, IntegrationRegistration,
     UPSTREAM_RTB_MAX_RESPONSE_BYTES, collect_response_bounded,
     ensure_integration_backend_with_timeout, predict_integration_backend_name,
 };
+use crate::openrtb::{
+    Banner, Device, Format, Geo, Imp, OpenRtbRequest, Publisher, Regs, RegsExt, Site, ToExt, User,
+    UserExt, to_openrtb_i32,
+};
 use crate::platform::{
     PlatformHttpRequest, PlatformPendingRequest, PlatformResponse, RuntimeServices,
 };
-
-use crate::settings::IntegrationConfig;
-
-// ============================================================================
-// APS TAM API Types
-// ============================================================================
-
-/// APS TAM bid request format based on /e/dtb/bid endpoint.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-struct ApsBidRequest {
-    /// Publisher ID
-    #[serde(rename = "pubId")]
-    pub_id: String,
-
-    /// Slot configurations
-    slots: Vec<ApsSlot>,
-
-    /// Page URL
-    #[serde(rename = "pageUrl", skip_serializing_if = "Option::is_none")]
-    page_url: Option<String>,
-
-    /// User agent
-    #[serde(rename = "ua", skip_serializing_if = "Option::is_none")]
-    user_agent: Option<String>,
-
-    /// Timeout in milliseconds
-    #[serde(skip_serializing_if = "Option::is_none")]
-    timeout: Option<u32>,
-
-    /// GDPR consent information.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    gdpr: Option<ApsGdprConsent>,
-
-    /// US Privacy (CCPA) string.
-    #[serde(rename = "usPrivacy", skip_serializing_if = "Option::is_none")]
-    us_privacy: Option<String>,
-
-    /// GPP consent string.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    gpp: Option<String>,
-
-    /// GPP section IDs as comma-separated string.
-    #[serde(rename = "gppSid", skip_serializing_if = "Option::is_none")]
-    gpp_sid: Option<String>,
-}
-
-/// GDPR consent information for APS requests.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-struct ApsGdprConsent {
-    /// Whether GDPR applies to this request.
-    enabled: bool,
-    /// TCF v2 consent string.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    consent: Option<String>,
-}
-
-/// APS slot configuration.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-struct ApsSlot {
-    /// Slot identifier
-    #[serde(rename = "slotID")]
-    slot_id: String,
-
-    /// Ad sizes [[width, height], ...]
-    sizes: Vec<[u32; 2]>,
-
-    /// Slot name (optional)
-    #[serde(rename = "slotName", skip_serializing_if = "Option::is_none")]
-    slot_name: Option<String>,
-}
-
-/// APS TAM bid response format matching real Amazon API.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-struct ApsBidResponse {
-    /// Contextual wrapper containing all response data
-    contextual: ApsContextual,
+use crate::settings::{IntegrationConfig, Settings};
+
+const APS_INTEGRATION_ID: &str = "aps";
+const APS_RENDERER_ROUTE: &str = "/integrations/aps/renderer";
+const DEFAULT_CURRENCY: &str = "USD";
+const APS_SDK_SOURCE: &str = "prebid";
+const APS_SDK_VERSION: &str = "2.2.0";
+const MAX_ACCOUNT_ID_BYTES: usize = 1024;
+const MAX_CREATIVE_URL_BYTES: usize = 4096;
+const MAX_PAGE_URL_BYTES: usize = 8192;
+const MAX_RENDER_ENVELOPE_BYTES: usize = 256 * 1024;
+const APS_RENDERER_CSP: &str = "default-src 'none'; sandbox allow-forms allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-scripts allow-top-navigation-by-user-activation; script-src 'unsafe-inline' https:; connect-src https:; frame-src https:; img-src https: data:; media-src https: blob:; style-src 'unsafe-inline' https:; font-src https: data:;";
+
+const APS_RENDERER_DOCUMENT: &str = r#"<!doctype html>
+<meta charset="utf-8">
+<script>
+(function(){
+'use strict';
+var match=/^#tsaps=([A-Za-z0-9_-]{22,128})$/.exec(location.hash);
+var expected=match&&match[1];
+try{history.replaceState(null,'',location.pathname+location.search);}catch(_error){}
+if(!expected)return;
+function keys(value,expectedKeys){
+ if(!value||typeof value!=='object'||Array.isArray(value))return false;
+ var actual=Object.keys(value).sort();
+ return actual.length===expectedKeys.length&&actual.every(function(key,index){return key===expectedKeys[index];});
 }
-
-/// APS Contextual response containing slots and metadata.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-struct ApsContextual {
-    /// Array of slot responses (one per requested slot)
-    #[serde(default)]
-    slots: Vec<ApsSlotResponse>,
-
-    /// Event tracking host
-    #[serde(skip_serializing_if = "Option::is_none")]
-    host: Option<String>,
-
-    /// Response status ("ok", "error", etc.)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    status: Option<String>,
-
-    /// Client-side feature enablement flag
-    #[serde(skip_serializing_if = "Option::is_none")]
-    cfe: Option<bool>,
-
-    /// Event tracking enabled
-    #[serde(skip_serializing_if = "Option::is_none")]
-    ev: Option<bool>,
-
-    /// Client feature name (CSM script path)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    cfn: Option<String>,
-
-    /// Callback version
-    #[serde(skip_serializing_if = "Option::is_none")]
-    cb: Option<String>,
-
-    /// Campaign tracking URL
-    #[serde(skip_serializing_if = "Option::is_none")]
-    cmp: Option<String>,
+function validRenderer(renderer){
+ if(!keys(renderer,['aaxResponse','accountId','bidId','creativeId','creativeUrl','height','tagType','type','version','width'])&&
+    !keys(renderer,['aaxResponse','accountId','bidId','creativeUrl','height','tagType','type','version','width']))return false;
+ if(renderer.type!=='aps'||renderer.version!==1||typeof renderer.accountId!=='string'||!renderer.accountId||new TextEncoder().encode(renderer.accountId).length>1024)return false;
+ if(typeof renderer.bidId!=='string'||!renderer.bidId||!Number.isInteger(renderer.width)||renderer.width<=0||!Number.isInteger(renderer.height)||renderer.height<=0)return false;
+ if(Object.prototype.hasOwnProperty.call(renderer,'creativeId')&&(typeof renderer.creativeId!=='string'||!renderer.creativeId))return false;
+ if(renderer.tagType!=='iframe'&&renderer.tagType!=='script')return false;
+ if(typeof renderer.creativeUrl!=='string'||new TextEncoder().encode(renderer.creativeUrl).length>4096)return false;
+ if(typeof renderer.aaxResponse!=='string'||!renderer.aaxResponse||renderer.aaxResponse.length>349528)return false;
+ try{
+  var url=new URL(renderer.creativeUrl);
+  if(url.protocol!=='https:'||url.username||url.password||url.origin===location.origin)return false;
+  var binary=atob(renderer.aaxResponse);
+  if(binary.length>262144||btoa(binary)!==renderer.aaxResponse)return false;
+  var bytes=Uint8Array.from(binary,function(character){return character.charCodeAt(0);});
+  var decoded=JSON.parse(new TextDecoder('utf-8',{fatal:true}).decode(bytes));
+  if(!keys(decoded,['seatbid'])||!Array.isArray(decoded.seatbid)||decoded.seatbid.length!==1)return false;
+  var seat=decoded.seatbid[0];
+  if(!keys(seat,['bid'])||!Array.isArray(seat.bid)||seat.bid.length!==1)return false;
+  var bid=seat.bid[0];
+  if(!keys(bid,['ext','h','id','price','w'])||!keys(bid.ext,['creativeurl','tagtype']))return false;
+  return bid.id===renderer.bidId&&bid.w===renderer.width&&bid.h===renderer.height&&
+   bid.ext.creativeurl===renderer.creativeUrl&&bid.ext.tagtype===renderer.tagType&&
+   typeof bid.price==='number'&&Number.isFinite(bid.price)&&bid.price>=0;
+ }catch(_error){return false;}
 }
-
-/// Individual APS slot response matching real Amazon format.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-struct ApsSlotResponse {
-    /// Slot ID this response is for
-    #[serde(rename = "slotID")]
-    slot_id: String,
-
-    /// Creative size (e.g., "300x250")
-    size: String,
-
-    /// Creative ID
-    #[serde(skip_serializing_if = "Option::is_none")]
-    crid: Option<String>,
-
-    /// Media type ("d" for display, "v" for video)
-    #[serde(rename = "mediaType", skip_serializing_if = "Option::is_none")]
-    media_type: Option<String>,
-
-    /// Fill indicator flag ("1" = filled, "0" = no fill)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    fif: Option<String>,
-
-    /// List of targeting key names that are set on this slot
-    #[serde(default)]
-    targeting: Vec<String>,
-
-    /// List of metadata field names
-    #[serde(default)]
-    meta: Vec<String>,
-
-    // Targeting key-value pairs (returned as flat fields)
-    /// Amazon impression ID (unique identifier for this bid)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    amzniid: Option<String>,
-
-    /// Amazon encoded bid price
-    #[serde(skip_serializing_if = "Option::is_none")]
-    amznbid: Option<String>,
-
-    /// Amazon encoded price (alternative encoding)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    amznp: Option<String>,
-
-    /// Amazon size in `WxH` format (e.g., "300x250")
-    #[serde(skip_serializing_if = "Option::is_none")]
-    amznsz: Option<String>,
-
-    /// Amazon auction context type ("OPEN", "PRIVATE", etc.)
-    #[serde(skip_serializing_if = "Option::is_none")]
-    amznactt: Option<String>,
+function receive(event){
+ if(event.source!==parent)return;
+ var message=event.data;
+ if(!keys(message,['nonce','renderer'])||message.nonce!==expected||!validRenderer(message.renderer))return;
+ removeEventListener('message',receive);
+ var acceptedNonce=expected;
+ expected='';
+ var renderer=message.renderer;
+ window._aps=window._aps instanceof Map?window._aps:new Map();
+ var account=window._aps.get(renderer.accountId);
+ if(!account){
+  account={queue:[],store:new Map([['listeners',new Map()]])};
+  window._aps.set(renderer.accountId,account);
+ }
+ account.queue.push(new CustomEvent('prebid/creative/render',{detail:{aaxResponse:renderer.aaxResponse,seatBidId:renderer.bidId}}));
+ var script=document.createElement('script');
+ script.src='https://client.aps.amazon-adsystem.com/prebid-creative.js';
+ script.onload=function(){parent.postMessage({message:'trusted-server/aps/renderer-ready',nonce:acceptedNonce},'*');};
+ script.onerror=function(){parent.postMessage({message:'trusted-server/aps/renderer-failed',nonce:acceptedNonce},'*');};
+ document.head.appendChild(script);
 }
+addEventListener('message',receive);
+})();
+</script>
+"#;
 
-// ============================================================================
-// Real APS Provider
-// ============================================================================
-
-/// Configuration for APS integration.
+/// Configuration for the APS `OpenRTB` integration.
 #[derive(Debug, Clone, Deserialize, Serialize, Validate)]
 pub struct ApsConfig {
-    /// Whether APS integration is enabled
+    /// Whether APS integration is enabled.
     #[serde(default = "default_enabled")]
     pub enabled: bool,
-
-    /// APS publisher ID (accepts both string and integer from config)
-    #[serde(deserialize_with = "deserialize_pub_id")]
-    pub pub_id: String,
-
-    /// APS API endpoint
+    /// APS account ID. `pub_id` remains a deserialization alias only.
+    #[serde(alias = "pub_id", deserialize_with = "deserialize_account_id")]
+    pub account_id: String,
+    /// APS `OpenRTB` endpoint.
     #[serde(default = "default_endpoint")]
-    #[validate(url)]
+    #[validate(custom(function = "validate_aps_endpoint"))]
     pub endpoint: String,
-
-    /// Timeout in milliseconds
+    /// Timeout in milliseconds.
     #[serde(default = "default_timeout_ms")]
     pub timeout_ms: u32,
+    /// Whether APS script creatives are eligible before winner selection.
+    #[serde(default)]
+    pub allow_script_creatives: bool,
 }
 
-/// Custom deserializer for `pub_id` that accepts both string and integer
-fn deserialize_pub_id<'de, D>(deserializer: D) -> Result<String, D::Error>
+fn deserialize_account_id<'de, D>(deserializer: D) -> Result<String, D::Error>
 where
     D: serde::Deserializer<'de>,
 {
-    use serde::de::{self, Visitor};
-    use std::fmt;
-
-    struct PubIdVisitor;
+    struct AccountIdVisitor;
 
-    impl<'de> Visitor<'de> for PubIdVisitor {
+    impl Visitor<'_> for AccountIdVisitor {
         type Value = String;
 
-        fn expecting(&self, formatter: &mut fmt::Formatter) -> fmt::Result {
-            formatter.write_str("a string or integer for pub_id")
+        fn expecting(&self, formatter: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+            formatter.write_str("a non-empty string or integer for account_id")
         }
 
         fn visit_str<E>(self, value: &str) -> Result<String, E>
         where
             E: de::Error,
         {
+            let value = value.trim();
+            if value.is_empty() {
+                return Err(E::custom("account_id must not be empty"));
+            }
+            if value.len() > MAX_ACCOUNT_ID_BYTES {
+                return Err(E::custom("account_id is too large"));
+            }
             Ok(value.to_string())
         }
 
@@ -241,7 +164,7 @@ where
         where
             E: de::Error,
         {
-            Ok(value)
+            self.visit_str(&value)
         }
 
         fn visit_i64<E>(self, value: i64) -> Result<String, E>
@@ -259,7 +182,19 @@ where
         }
     }
 
-    deserializer.deserialize_any(PubIdVisitor)
+    deserializer.deserialize_any(AccountIdVisitor)
+}
+
+fn validate_aps_endpoint(value: &str) -> Result<(), ValidationError> {
+    let parsed = Url::parse(value).map_err(|_| ValidationError::new("invalid_aps_endpoint"))?;
+    if parsed.scheme() != "https"
+        || parsed.host_str().is_none()
+        || !parsed.username().is_empty()
+        || parsed.password().is_some()
+    {
+        return Err(ValidationError::new("invalid_aps_endpoint"));
+    }
+    Ok(())
 }
 
 fn default_enabled() -> bool {
@@ -267,7 +202,7 @@ fn default_enabled() -> bool {
 }
 
 fn default_endpoint() -> String {
-    "https://aax.amazon-adsystem.com/e/dtb/bid".to_string()
+    "https://web.ads.aps.amazon-adsystem.com/e/pb/bid".to_string()
 }
 
 fn default_timeout_ms() -> u32 {
@@ -277,10 +212,11 @@ fn default_timeout_ms() -> u32 {
 impl Default for ApsConfig {
     fn default() -> Self {
         Self {
-            enabled: default_enabled(),
-            pub_id: String::new(),
+            enabled: false,
+            account_id: String::new(),
             endpoint: default_endpoint(),
             timeout_ms: default_timeout_ms(),
+            allow_script_creatives: false,
         }
     }
 }
@@ -291,314 +227,548 @@ impl IntegrationConfig for ApsConfig {
     }
 }
 
-/// Amazon APS auction provider.
+#[derive(Debug, Serialize)]
+struct ApsRequestExt<'a> {
+    account: &'a str,
+    sdk: ApsSdkExt,
+}
+
+impl ToExt for ApsRequestExt<'_> {}
+
+#[derive(Debug, Serialize)]
+struct ApsSdkExt {
+    source: &'static str,
+    version: &'static str,
+}
+
+struct ApsRendererInput<'a> {
+    bid_id: &'a str,
+    creative_id: Option<String>,
+    tag_type: ApsTagType,
+    creative_url: &'a str,
+    price: f64,
+    width: u32,
+    height: u32,
+}
+
+/// APS `OpenRTB` auction provider.
 pub struct ApsAuctionProvider {
     config: ApsConfig,
 }
 
 impl ApsAuctionProvider {
-    /// Create a new APS auction provider.
+    /// Create an APS provider from validated configuration.
     #[must_use]
     pub fn new(config: ApsConfig) -> Self {
         Self { config }
     }
 
-    /// Resolve the APS-specific slot ID for a slot.
-    ///
-    /// Uses the APS slot ID from `[slot.providers.aps]` if configured; falls
-    /// back to the creative-opportunity slot ID otherwise.
-    fn aps_slot_id(slot: &crate::auction::types::AdSlot) -> String {
-        slot.bidders
-            .get("aps")
-            .and_then(|p| p.get("slotID"))
-            .and_then(|v| v.as_str())
-            .unwrap_or(&slot.id)
-            .to_string()
+    fn build_regs(consent: Option<&crate::consent::ConsentContext>) -> Option<Regs> {
+        let consent = consent?;
+        let ext = RegsExt {
+            gdpr: Some(u8::from(consent.gdpr_applies)),
+            us_privacy: consent.raw_us_privacy.clone(),
+            gpp: consent.raw_gpp_string.clone(),
+            gpp_sid: consent.gpp_section_ids.clone(),
+        };
+        Some(Regs {
+            coppa: None,
+            gdpr: Some(consent.gdpr_applies),
+            us_privacy: ext.us_privacy.clone(),
+            gpp: ext.gpp.clone(),
+            gpp_sid: ext
+                .gpp_sid
+                .as_ref()
+                .map(|ids| ids.iter().map(|id| i32::from(*id)).collect())
+                .unwrap_or_default(),
+            ext: ext.to_ext(),
+        })
     }
 
-    /// Build the APS slot ID → creative-opportunity slot ID map for `request`.
-    ///
-    /// Derived from the [`AuctionRequest`] on every call so the mapping stays
-    /// request-scoped: the provider instance is shared across concurrent
-    /// auctions on non-Fastly adapters, and instance state would let
-    /// overlapping auctions overwrite or consume each other's maps.
-    fn build_slot_id_map(request: &AuctionRequest) -> HashMap<String, String> {
-        let mut slot_id_map: HashMap<String, String> = HashMap::new();
-        for slot in &request.slots {
-            let aps_slot_id = Self::aps_slot_id(slot);
-            // Last-write-wins: two slots configuring the same
-            // `[bidders.aps].slotID` would remap one slot's bids to the
-            // wrong creative slot. Log the collision so a misconfiguration
-            // is diagnosable, mirroring the build_bid_index collision log.
-            if let Some(previous_slot_id) = slot_id_map.insert(aps_slot_id.clone(), slot.id.clone())
-            {
-                log::debug!(
-                    "APS slot ID '{aps_slot_id}' maps to multiple creative slots \
-                     ('{previous_slot_id}' overwritten by '{}'); bids for this APS \
-                     slot will resolve to the last one",
-                    slot.id,
-                );
-            }
+    fn request_language(context: &AuctionContext<'_>) -> Option<String> {
+        context
+            .request
+            .headers()
+            .get(header::ACCEPT_LANGUAGE)
+            .and_then(|value| value.to_str().ok())
+            .and_then(|value| value.split(',').next())
+            .and_then(|value| value.split(';').next())
+            .and_then(|value| value.split('-').next())
+            .map(str::trim)
+            .filter(|value| !value.is_empty())
+            .map(str::to_string)
+    }
+
+    fn request_dnt(context: &AuctionContext<'_>) -> Option<bool> {
+        context
+            .request
+            .headers()
+            .get("DNT")
+            .and_then(|value| value.to_str().ok())
+            .is_some_and(|value| value.trim() == "1")
+            .then_some(true)
+    }
+
+    fn valid_http_url(value: &str) -> Option<String> {
+        if value.len() > MAX_PAGE_URL_BYTES {
+            return None;
+        }
+        let parsed = Url::parse(value).ok()?;
+        if !matches!(parsed.scheme(), "http" | "https")
+            || parsed.host_str().is_none()
+            || !parsed.username().is_empty()
+            || parsed.password().is_some()
+        {
+            return None;
         }
-        slot_id_map
+        Some(parsed.to_string())
     }
 
-    /// Convert unified `AuctionRequest` to APS TAM bid request format.
-    ///
-    /// Populates consent fields (GDPR, US Privacy, GPP) from the
-    /// [`ConsentContext`](crate::consent::ConsentContext) attached to the request.
-    ///
-    /// `timeout_ms` is the effective auction budget for this provider (already
-    /// capped by the orchestrator) — advertised to APS so it never expects more
-    /// time than the edge will actually wait.
-    fn to_aps_request(&self, request: &AuctionRequest, timeout_ms: u32) -> ApsBidRequest {
-        let slots: Vec<ApsSlot> = request
+    fn build_openrtb_request(
+        &self,
+        request: &AuctionRequest,
+        context: &AuctionContext<'_>,
+    ) -> OpenRtbRequest {
+        let imp = request
             .slots
             .iter()
-            .map(|slot| {
-                let aps_slot_id = Self::aps_slot_id(slot);
-
-                // Extract sizes from banner formats
-                let sizes: Vec<[u32; 2]> = slot
+            .filter_map(|slot| {
+                let slot_context = format!("slot '{}'", slot.id);
+                let formats: Vec<Format> = slot
                     .formats
                     .iter()
-                    .filter(|f| f.media_type == MediaType::Banner)
-                    .map(|f| [f.width, f.height])
+                    .filter(|format| format.media_type == MediaType::Banner)
+                    .filter_map(|format| {
+                        Some(Format {
+                            w: to_openrtb_i32(format.width, "format.w", &slot_context),
+                            h: to_openrtb_i32(format.height, "format.h", &slot_context),
+                            ..Default::default()
+                        })
+                        .filter(|format| format.w.is_some() && format.h.is_some())
+                    })
                     .collect();
-
-                ApsSlot {
-                    slot_id: aps_slot_id,
-                    sizes,
-                    slot_name: Some(slot.id.clone()),
-                }
+                let first = formats.first()?;
+                Some(Imp {
+                    id: Some(slot.id.clone()),
+                    banner: Some(Banner {
+                        format: formats.clone(),
+                        w: first.w,
+                        h: first.h,
+                        topframe: Some(false),
+                        ..Default::default()
+                    }),
+                    bidfloor: slot.floor_price,
+                    bidfloorcur: slot.floor_price.map(|_| DEFAULT_CURRENCY.to_string()),
+                    secure: Some(true),
+                    ..Default::default()
+                })
             })
             .collect();
 
-        // Build consent fields from ConsentContext
-        let consent_ctx = request.user.consent.as_ref();
-        let gdpr = consent_ctx.map(|ctx| ApsGdprConsent {
-            enabled: ctx.gdpr_applies,
-            consent: ctx.raw_tc_string.clone(),
-        });
-        let us_privacy = consent_ctx.and_then(|ctx| ctx.raw_us_privacy.clone());
-        let gpp = consent_ctx.and_then(|ctx| ctx.raw_gpp_string.clone());
-        let gpp_sid = consent_ctx.and_then(|ctx| {
-            ctx.gpp_section_ids.as_ref().map(|ids| {
-                ids.iter()
-                    .map(std::string::ToString::to_string)
-                    .collect::<Vec<_>>()
-                    .join(",")
-            })
+        let consent = request.user.consent.as_ref();
+        let raw_tc = consent.and_then(|value| value.raw_tc_string.clone());
+        let user = Some(User {
+            id: request.user.id.clone(),
+            consent: raw_tc.clone(),
+            ext: UserExt {
+                consent: raw_tc,
+                consented_providers_settings: None,
+                eids: request.user.eids.clone(),
+            }
+            .to_ext(),
+            ..Default::default()
         });
 
-        ApsBidRequest {
-            pub_id: self.config.pub_id.clone(),
-            slots,
-            page_url: request.publisher.page_url.clone(),
-            user_agent: request.device.as_ref().and_then(|d| d.user_agent.clone()),
-            timeout: Some(timeout_ms),
-            gdpr,
-            us_privacy,
-            gpp,
-            gpp_sid,
+        let language = Self::request_language(context);
+        let dnt = Self::request_dnt(context);
+        let device = request
+            .device
+            .as_ref()
+            .map(|device| Device {
+                ua: device.user_agent.clone(),
+                ip: device.ip.clone(),
+                geo: device.geo.as_ref().map(|geo| Geo {
+                    country: Some(geo.country.clone()),
+                    region: geo.region.clone(),
+                    city: Some(geo.city.clone()),
+                    metro: (geo.metro_code > 0).then(|| geo.metro_code.to_string()),
+                    r#type: Some(2),
+                    ..Default::default()
+                }),
+                dnt,
+                language: language.clone(),
+                ..Default::default()
+            })
+            .or_else(|| {
+                (dnt.is_some() || language.is_some()).then_some(Device {
+                    dnt,
+                    language,
+                    ..Default::default()
+                })
+            });
+
+        let page = request
+            .publisher
+            .page_url
+            .as_deref()
+            .and_then(Self::valid_http_url)
+            .unwrap_or_else(|| format!("https://{}", request.publisher.domain));
+        let referer = context
+            .request
+            .headers()
+            .get(header::REFERER)
+            .and_then(|value| value.to_str().ok())
+            .and_then(Self::valid_http_url)
+            .filter(|value| value != &page);
+
+        OpenRtbRequest {
+            id: Some(request.id.clone()),
+            imp,
+            site: Some(Site {
+                domain: Some(request.publisher.domain.clone()),
+                page: Some(page),
+                r#ref: referer,
+                publisher: Some(Publisher {
+                    domain: Some(request.publisher.domain.clone()),
+                    ..Default::default()
+                }),
+                ..Default::default()
+            }),
+            user,
+            device,
+            regs: Self::build_regs(consent),
+            tmax: to_openrtb_i32(context.timeout_ms, "tmax", "APS request"),
+            cur: vec![DEFAULT_CURRENCY.to_string()],
+            ext: ApsRequestExt {
+                account: &self.config.account_id,
+                sdk: ApsSdkExt {
+                    source: APS_SDK_SOURCE,
+                    version: APS_SDK_VERSION,
+                },
+            }
+            .to_ext(),
+            ..Default::default()
         }
     }
 
-    /// Parse size string (e.g., "300x250") into width and height.
-    fn parse_size(size: &str) -> Option<(u32, u32)> {
-        let parts: Vec<&str> = size.split('x').collect();
-        if parts.len() == 2
-            && let (Ok(w), Ok(h)) = (parts[0].parse::<u32>(), parts[1].parse::<u32>())
-        {
-            return Some((w, h));
-        }
-        None
+    fn compatible_dimensions(slot: &AdSlot, width: u32, height: u32) -> bool {
+        width > 0
+            && height > 0
+            && slot.formats.iter().any(|format| {
+                format.media_type == MediaType::Banner
+                    && format.width == width
+                    && format.height == height
+            })
     }
 
-    /// Parse a single APS slot response into unified Bid format.
-    ///
-    /// Note: Price is NOT decoded here. The encoded price is stored in metadata
-    /// and will be decoded by the mediation layer (mocktioneer). This simulates
-    /// real-world APS where only Amazon/GAM can decode the proprietary price encoding.
-    fn parse_aps_slot(&self, slot: &ApsSlotResponse) -> Result<Bid, ()> {
-        // Only process filled slots (fif == "1")
-        if slot.fif.as_deref() != Some("1") {
-            return Err(());
+    fn valid_creative_url(&self, value: &str, publisher_domain: &str) -> bool {
+        if value.len() > MAX_CREATIVE_URL_BYTES {
+            return false;
         }
+        let Ok(parsed) = Url::parse(value) else {
+            return false;
+        };
+        parsed.scheme() == "https"
+            && parsed
+                .host_str()
+                .is_some_and(|host| !host.eq_ignore_ascii_case(publisher_domain))
+            && parsed.username().is_empty()
+            && parsed.password().is_none()
+    }
 
-        // Verify we have an encoded price field
-        let encoded_price = slot.amznbid.as_ref().or(slot.amznp.as_ref());
-        if encoded_price.is_none() {
-            log::debug!(
-                "APS: slot '{}' has no encoded price, skipping",
-                slot.slot_id
-            );
-            return Err(());
+    fn build_renderer(&self, input: ApsRendererInput<'_>) -> Option<BidRenderer> {
+        let tag_type_value = match input.tag_type {
+            ApsTagType::Iframe => "iframe",
+            ApsTagType::Script => "script",
+        };
+        let envelope = json!({
+            "seatbid": [{
+                "bid": [{
+                    "id": input.bid_id,
+                    "price": input.price,
+                    "w": input.width,
+                    "h": input.height,
+                    "ext": {
+                        "creativeurl": input.creative_url,
+                        "tagtype": tag_type_value
+                    }
+                }]
+            }]
+        });
+        let serialized = serde_json::to_vec(&envelope).ok()?;
+        if serialized.len() > MAX_RENDER_ENVELOPE_BYTES {
+            return None;
         }
+        Some(BidRenderer::Aps(ApsRendererV1 {
+            version: 1,
+            account_id: self.config.account_id.clone(),
+            bid_id: input.bid_id.to_string(),
+            creative_id: input.creative_id,
+            tag_type: input.tag_type,
+            creative_url: input.creative_url.to_string(),
+            aax_response: BASE64_STANDARD.encode(serialized),
+            width: input.width,
+            height: input.height,
+        }))
+    }
 
-        // Parse size from "WxH" format
-        let (width, height) = match Self::parse_size(&slot.size) {
-            Some(dims) => dims,
-            None => {
-                log::debug!(
-                    "APS: slot '{}' has malformed size '{}', skipping",
-                    slot.slot_id,
-                    slot.size
-                );
-                return Err(());
-            }
-        };
+    fn increment_reason(reasons: &mut BTreeMap<String, u64>, reason: &'static str) {
+        *reasons.entry(reason.to_string()).or_default() += 1;
+    }
 
-        // Build metadata from targeting keys - includes encoded price for mediation
-        let mut metadata = HashMap::new();
-        if let Some(ref amzniid) = slot.amzniid {
-            metadata.insert("amzniid".to_string(), json!(amzniid));
-        }
-        if let Some(ref amznbid) = slot.amznbid {
-            metadata.insert("amznbid".to_string(), json!(amznbid));
-        }
-        if let Some(ref amznp) = slot.amznp {
-            metadata.insert("amznp".to_string(), json!(amznp));
+    fn parse_bid(
+        &self,
+        value: &Json,
+        slots: &HashMap<&str, &AdSlot>,
+        publisher_domain: &str,
+    ) -> Result<Bid, &'static str> {
+        let bid_id = value
+            .get("id")
+            .and_then(Json::as_str)
+            .filter(|value| !value.is_empty())
+            .ok_or("missing_render_source")?;
+        let slot_id = value
+            .get("impid")
+            .and_then(Json::as_str)
+            .ok_or("unknown_impid")?;
+        let slot = slots.get(slot_id).ok_or("unknown_impid")?;
+        let price = value
+            .get("price")
+            .and_then(Json::as_f64)
+            .filter(|price| price.is_finite() && *price >= 0.0)
+            .ok_or("invalid_price")?;
+        if value
+            .get("mtype")
+            .is_some_and(|mtype| mtype.as_i64() != Some(1))
+        {
+            return Err("unsupported_media_type");
         }
-        if let Some(ref amznsz) = slot.amznsz {
-            metadata.insert("amznsz".to_string(), json!(amznsz));
+        let width = value
+            .get("w")
+            .and_then(Json::as_u64)
+            .and_then(|value| u32::try_from(value).ok())
+            .ok_or("invalid_dimensions")?;
+        let height = value
+            .get("h")
+            .and_then(Json::as_u64)
+            .and_then(|value| u32::try_from(value).ok())
+            .ok_or("invalid_dimensions")?;
+        if !Self::compatible_dimensions(slot, width, height) {
+            return Err("invalid_dimensions");
         }
-        if let Some(ref amznactt) = slot.amznactt {
-            metadata.insert("amznactt".to_string(), json!(amznactt));
+        let ext = value
+            .get("ext")
+            .and_then(Json::as_object)
+            .ok_or("missing_render_source")?;
+        let creative_url = ext
+            .get("creativeurl")
+            .and_then(Json::as_str)
+            .ok_or("missing_render_source")?;
+        if !self.valid_creative_url(creative_url, publisher_domain) {
+            return Err("invalid_creative_url");
         }
+        let tag_type = match ext.get("tagtype").and_then(Json::as_str) {
+            Some("iframe") => ApsTagType::Iframe,
+            Some("script") if self.config.allow_script_creatives => ApsTagType::Script,
+            Some("script") => return Err("script_rendering_disabled"),
+            _ => return Err("unsupported_tagtype"),
+        };
+        let creative_id = value
+            .get("crid")
+            .and_then(Json::as_str)
+            .filter(|creative_id| !creative_id.is_empty())
+            .map(str::to_string);
+        let renderer = self
+            .build_renderer(ApsRendererInput {
+                bid_id,
+                creative_id: creative_id.clone(),
+                tag_type,
+                creative_url,
+                price,
+                width,
+                height,
+            })
+            .ok_or("render_payload_too_large")?;
+        let adomain = value
+            .get("adomain")
+            .and_then(Json::as_array)
+            .map(|domains| {
+                domains
+                    .iter()
+                    .filter_map(Json::as_str)
+                    .map(str::to_string)
+                    .collect()
+            });
 
-        // APS doesn't return creative HTML - only targeting keys
-        // The creative will be generated by the mediation layer
-        // Price is None - will be decoded by mediation layer from amznbid metadata
         Ok(Bid {
-            slot_id: slot.slot_id.clone(),
-            price: None, // Encoded price in metadata, decoded by mediation
-            currency: "USD".to_string(),
+            slot_id: slot_id.to_string(),
+            price: Some(price),
+            currency: DEFAULT_CURRENCY.to_string(),
             creative: None,
-            adomain: None, // APS doesn't provide adomain in response
-            bidder: "amazon-aps".to_string(),
+            adomain,
+            bidder: APS_INTEGRATION_ID.to_string(),
             width,
             height,
-            nurl: None, // Real APS uses client-side event tracking
+            nurl: None,
             burl: None,
-            ad_id: None,
+            bid_id: Some(bid_id.to_string()),
+            ad_id: value.get("adid").and_then(Json::as_str).map(str::to_string),
+            creative_id,
+            renderer: Some(renderer),
             cache_id: None,
             cache_host: None,
             cache_path: None,
-            metadata,
+            metadata: HashMap::new(),
         })
     }
 
-    /// Parse APS TAM response into unified `AuctionResponse`.
-    ///
-    /// `slot_map` is the request-scoped APS slot ID → creative-opportunity
-    /// slot ID mapping built by [`Self::build_slot_id_map`].
     fn parse_aps_response(
         &self,
-        json: &Json,
+        value: &Json,
         response_time_ms: u64,
-        slot_map: &HashMap<String, String>,
+        request: &AuctionRequest,
     ) -> AuctionResponse {
-        let mut bids = Vec::new();
-
-        // Try to parse as ApsBidResponse with contextual wrapper
-        if let Ok(aps_response) = serde_json::from_value::<ApsBidResponse>(json.clone()) {
-            log::debug!(
-                "APS: parsed contextual response with {} slots",
-                aps_response.contextual.slots.len()
-            );
+        if !value.is_object()
+            || value.get("contextual").is_some()
+            || value
+                .get("cur")
+                .is_some_and(|currency| !currency.is_string())
+            || value
+                .get("seatbid")
+                .is_some_and(|seatbids| !seatbids.is_array())
+        {
+            return AuctionResponse::error(APS_INTEGRATION_ID, response_time_ms)
+                .with_metadata("drop_reasons", json!({"unexpected_response_shape": 1}));
+        }
+        if value
+            .get("cur")
+            .and_then(Json::as_str)
+            .is_some_and(|currency| !currency.eq_ignore_ascii_case(DEFAULT_CURRENCY))
+        {
+            return AuctionResponse::no_bid(APS_INTEGRATION_ID, response_time_ms)
+                .with_metadata("drop_reasons", json!({"unsupported_currency": 1}));
+        }
 
-            for slot in aps_response.contextual.slots {
-                match self.parse_aps_slot(&slot) {
-                    Ok(mut bid) => {
-                        // Remap APS slot ID (e.g. "aps-slot-atf-sidebar") back to the
-                        // creative-opportunity slot ID (e.g. "atf_sidebar_ad") so the
-                        // mediator and bid_map can match by creative slot ID.
-                        if let Some(creative_id) = slot_map.get(&bid.slot_id) {
-                            bid.slot_id = creative_id.clone();
+        let slots: HashMap<&str, &AdSlot> = request
+            .slots
+            .iter()
+            .map(|slot| (slot.id.as_str(), slot))
+            .collect();
+        let seatbids = value.get("seatbid").and_then(Json::as_array);
+        let seatbid_count = seatbids.map_or(0, Vec::len);
+        let mut reasons = BTreeMap::new();
+        let mut selected: HashMap<String, Bid> = HashMap::new();
+        let mut dropped = 0_u64;
+
+        for seatbid in seatbids.into_iter().flatten() {
+            let Some(bids) = seatbid.get("bid").and_then(Json::as_array) else {
+                continue;
+            };
+            for value in bids {
+                match self.parse_bid(value, &slots, &request.publisher.domain) {
+                    Ok(candidate) => {
+                        let replace = selected.get(&candidate.slot_id).is_none_or(|current| {
+                            let candidate_price = candidate.price.unwrap_or_default();
+                            let current_price = current.price.unwrap_or_default();
+                            candidate_price > current_price
+                                || (candidate_price == current_price
+                                    && candidate.bid_id.as_deref().unwrap_or_default()
+                                        < current.bid_id.as_deref().unwrap_or_default())
+                        });
+                        if replace {
+                            if selected
+                                .insert(candidate.slot_id.clone(), candidate)
+                                .is_some()
+                            {
+                                dropped += 1;
+                            }
+                        } else {
+                            dropped += 1;
                         }
-                        let encoded_price = bid
-                            .metadata
-                            .get("amznbid")
-                            .and_then(|v| v.as_str())
-                            .unwrap_or("unknown");
-                        log::debug!(
-                            "APS: parsed bid for slot '{}' with encoded price (to be decoded by mediation)",
-                            bid.slot_id,
-                        );
-                        log::trace!(
-                            "APS: slot '{}' encoded price: {}",
-                            bid.slot_id,
-                            encoded_price
-                        );
-                        bids.push(bid);
                     }
-                    Err(_) => {
-                        log::debug!("APS: skipped slot (no fill or invalid)");
+                    Err(reason) => {
+                        dropped += 1;
+                        Self::increment_reason(&mut reasons, reason);
                     }
                 }
             }
-        } else {
-            log::warn!("APS: failed to parse response as contextual format");
         }
 
-        if bids.is_empty() {
-            AuctionResponse::no_bid("aps", response_time_ms)
-        } else {
-            AuctionResponse::success("aps", bids, response_time_ms)
+        if seatbid_count == 0 {
+            Self::increment_reason(&mut reasons, "empty_seatbid");
         }
+        let accepted = selected.len();
+        let metadata = [
+            ("seatbid_count".to_string(), json!(seatbid_count)),
+            ("accepted_bid_count".to_string(), json!(accepted)),
+            ("dropped_bid_count".to_string(), json!(dropped)),
+            ("drop_reasons".to_string(), json!(reasons)),
+        ];
+        let mut response = if selected.is_empty() {
+            AuctionResponse::no_bid(APS_INTEGRATION_ID, response_time_ms)
+        } else {
+            AuctionResponse::success(
+                APS_INTEGRATION_ID,
+                selected.into_values().collect(),
+                response_time_ms,
+            )
+        };
+        response.metadata.extend(metadata);
+        response
     }
 
-    /// Shared parse path for both trait entry points.
-    ///
-    /// # Errors
-    ///
-    /// Returns an error when the response body cannot be read or is not valid JSON.
     async fn parse_response_inner(
         &self,
         response: PlatformResponse,
         response_time_ms: u64,
-        slot_map: &HashMap<String, String>,
+        request: Option<&AuctionRequest>,
     ) -> Result<AuctionResponse, Report<TrustedServerError>> {
         let response = response.response;
-
-        // Check status code
+        if response.status() == StatusCode::NO_CONTENT {
+            return Ok(AuctionResponse::no_bid(
+                APS_INTEGRATION_ID,
+                response_time_ms,
+            ));
+        }
         if !response.status().is_success() {
-            log::warn!("APS returned non-success status: {}", response.status());
-            return Ok(AuctionResponse::error("aps", response_time_ms));
+            log::warn!("APS returns a non-success status");
+            return Ok(AuctionResponse::error(APS_INTEGRATION_ID, response_time_ms));
         }
-
-        // Parse response body — collect_response_bounded caps memory from misbehaving providers.
-        let body_bytes =
-            collect_response_bounded(response.into_body(), UPSTREAM_RTB_MAX_RESPONSE_BYTES, "aps")
-                .await
-                .change_context(TrustedServerError::Auction {
-                    message: "Failed to read APS response body".to_string(),
-                })?;
-        let response_json: Json =
-            serde_json::from_slice(&body_bytes).change_context(TrustedServerError::Auction {
-                message: "Failed to parse APS response JSON".to_string(),
-            })?;
-
-        log::trace!("APS: received response: {:?}", response_json);
-
-        // Transform to unified format
-        let auction_response = self.parse_aps_response(&response_json, response_time_ms, slot_map);
-
+        let body = collect_response_bounded(
+            response.into_body(),
+            UPSTREAM_RTB_MAX_RESPONSE_BYTES,
+            APS_INTEGRATION_ID,
+        )
+        .await
+        .change_context(TrustedServerError::Auction {
+            message: "Failed to read APS response body".to_string(),
+        })?;
+        log::trace!("APS response body: {}", String::from_utf8_lossy(&body));
+        let value: Json = match serde_json::from_slice(&body) {
+            Ok(value) => value,
+            Err(error) => {
+                log::warn!("Failed to parse APS response JSON: {error}");
+                return Ok(AuctionResponse::error(APS_INTEGRATION_ID, response_time_ms)
+                    .with_metadata("drop_reasons", json!({"unexpected_response_shape": 1})));
+            }
+        };
+        let Some(request) = request else {
+            return Ok(AuctionResponse::error(APS_INTEGRATION_ID, response_time_ms));
+        };
+        let parsed = self.parse_aps_response(&value, response_time_ms, request);
         log::info!(
-            "APS returned {} bids in {}ms",
-            auction_response.bids.len(),
+            "APS returns {} accepted bids in {}ms",
+            parsed.bids.len(),
             response_time_ms
         );
-
-        Ok(auction_response)
+        Ok(parsed)
     }
 }
 
 #[async_trait(?Send)]
 impl AuctionProvider for ApsAuctionProvider {
     fn provider_name(&self) -> &'static str {
-        "aps"
+        APS_INTEGRATION_ID
     }
 
     async fn request_bids(
@@ -606,67 +776,42 @@ impl AuctionProvider for ApsAuctionProvider {
         request: &AuctionRequest,
         context: &AuctionContext<'_>,
     ) -> Result<PlatformPendingRequest, Report<TrustedServerError>> {
-        log::info!(
-            "APS: requesting bids for {} slots (pub_id: {})",
-            request.slots.len(),
-            self.config.pub_id
-        );
-
-        // Transform to APS format. `context.timeout_ms` is the effective budget
-        // the orchestrator granted this provider — the payload must advertise
-        // the same deadline the edge backend enforces below. The APS-slot-ID →
-        // creative-slot-ID remapping is rebuilt from the request in
-        // `parse_response_with_context`, keeping it request-scoped.
-        let aps_request = self.to_aps_request(request, context.timeout_ms);
-
-        // Serialize to JSON
-        let aps_json =
-            serde_json::to_value(&aps_request).change_context(TrustedServerError::Auction {
-                message: "Failed to serialize APS bid request".to_string(),
-            })?;
-
-        log::trace!("APS: sending bid request: {:?}", aps_json);
-
-        // Create HTTP POST request
-        let aps_body =
-            serde_json::to_vec(&aps_json).change_context(TrustedServerError::Auction {
-                message: "Failed to serialize APS request body".to_string(),
-            })?;
-        let aps_req = http::Request::builder()
+        let openrtb = self.build_openrtb_request(request, context);
+        if openrtb.imp.is_empty() {
+            return Err(Report::new(TrustedServerError::Auction {
+                message: "No valid APS impressions after filtering".to_string(),
+            }));
+        }
+        log::info!("APS requests bids for {} impressions", openrtb.imp.len());
+        log::trace!("APS request body: {openrtb:?}");
+        let body = serde_json::to_vec(&openrtb).change_context(TrustedServerError::Auction {
+            message: "Failed to serialize APS OpenRTB request".to_string(),
+        })?;
+        let request = http::Request::builder()
             .method(Method::POST)
             .uri(&self.config.endpoint)
             .header(header::CONTENT_TYPE, "application/json")
-            .body(EdgeBody::from(aps_body))
+            .body(EdgeBody::from(body))
             .change_context(TrustedServerError::Auction {
                 message: "Failed to build APS request".to_string(),
             })?;
-
-        // Uses context.timeout_ms (auction-scoped) rather than the 15 s fixed
-        // timeout in ensure_integration_backend, which is for proxy endpoints.
-        // Send request asynchronously with auction-scoped timeout
-        let backend_name = ensure_integration_backend_with_timeout(
+        let backend = ensure_integration_backend_with_timeout(
             context.services,
             &self.config.endpoint,
-            "aps",
+            APS_INTEGRATION_ID,
             Duration::from_millis(u64::from(context.timeout_ms)),
         )
         .change_context(TrustedServerError::Auction {
-            message: format!(
-                "Failed to resolve backend for APS endpoint: {}",
-                self.config.endpoint
-            ),
+            message: "Failed to resolve APS backend".to_string(),
         })?;
-
-        let pending = context
+        context
             .services
             .http_client()
-            .send_async(PlatformHttpRequest::new(aps_req, backend_name))
+            .send_async(PlatformHttpRequest::new(request, backend))
             .await
             .change_context(TrustedServerError::Auction {
-                message: "Failed to send async request to APS".to_string(),
-            })?;
-
-        Ok(pending)
+                message: "Failed to send APS request".to_string(),
+            })
     }
 
     async fn parse_response(
@@ -674,11 +819,7 @@ impl AuctionProvider for ApsAuctionProvider {
         response: PlatformResponse,
         response_time_ms: u64,
     ) -> Result<AuctionResponse, Report<TrustedServerError>> {
-        // No auction request available — bids keep their raw APS slot IDs. The
-        // orchestrator always calls [`Self::parse_response_with_context`], so
-        // this path only serves callers outside the orchestration flow.
-        log::debug!("APS: parsing without request context — slot ID remapping unavailable");
-        self.parse_response_inner(response, response_time_ms, &HashMap::new())
+        self.parse_response_inner(response, response_time_ms, None)
             .await
     }
 
@@ -689,17 +830,12 @@ impl AuctionProvider for ApsAuctionProvider {
         request: &AuctionRequest,
         _context: &AuctionContext<'_>,
     ) -> Result<AuctionResponse, Report<TrustedServerError>> {
-        // Rebuild the APS-slot-ID → creative-slot-ID map from the auction
-        // request so overlapping auctions on shared provider instances cannot
-        // overwrite or consume each other's mappings.
-        let slot_map = Self::build_slot_id_map(request);
-        self.parse_response_inner(response, response_time_ms, &slot_map)
+        self.parse_response_inner(response, response_time_ms, Some(request))
             .await
     }
 
     fn supports_media_type(&self, media_type: &MediaType) -> bool {
-        // APS supports banner and video formats
-        matches!(media_type, MediaType::Banner | MediaType::Video)
+        matches!(media_type, MediaType::Banner)
     }
 
     fn timeout_ms(&self) -> u32 {
@@ -714,717 +850,671 @@ impl AuctionProvider for ApsAuctionProvider {
         predict_integration_backend_name(
             services,
             &self.config.endpoint,
-            "aps",
+            APS_INTEGRATION_ID,
             Duration::from_millis(u64::from(timeout_ms)),
         )
-        .inspect_err(|e| {
-            log::error!(
-                "Failed to predict backend name for APS endpoint '{}': {e:?}",
-                self.config.endpoint
-            );
-        })
+        .inspect_err(|error| log::error!("Failed to predict APS backend name: {error:?}"))
         .ok()
     }
 }
 
-// ============================================================================
-// Provider Auto-Registration
-// ============================================================================
+#[derive(Debug)]
+struct ApsRendererIntegration;
 
-use crate::settings::Settings;
-use std::sync::Arc;
+#[async_trait(?Send)]
+impl IntegrationProxy for ApsRendererIntegration {
+    fn integration_name(&self) -> &'static str {
+        APS_INTEGRATION_ID
+    }
 
-/// Auto-register APS provider based on settings configuration.
+    fn routes(&self) -> Vec<IntegrationEndpoint> {
+        vec![IntegrationEndpoint::get(APS_RENDERER_ROUTE)]
+    }
+
+    async fn handle(
+        &self,
+        _settings: &Settings,
+        _services: &RuntimeServices,
+        request: http::Request<EdgeBody>,
+    ) -> Result<http::Response<EdgeBody>, Report<TrustedServerError>> {
+        if request.method() != Method::GET || request.uri().path() != APS_RENDERER_ROUTE {
+            return http::Response::builder()
+                .status(StatusCode::NOT_FOUND)
+                .body(EdgeBody::from("Not Found"))
+                .change_context(TrustedServerError::Integration {
+                    integration: APS_INTEGRATION_ID.to_string(),
+                    message: "Failed to build APS not-found response".to_string(),
+                });
+        }
+        http::Response::builder()
+            .status(StatusCode::OK)
+            .header(header::CONTENT_TYPE, "text/html; charset=utf-8")
+            .header("x-content-type-options", "nosniff")
+            .header("referrer-policy", "no-referrer")
+            .header(header::CONTENT_SECURITY_POLICY, APS_RENDERER_CSP)
+            .body(EdgeBody::from(APS_RENDERER_DOCUMENT))
+            .change_context(TrustedServerError::Integration {
+                integration: APS_INTEGRATION_ID.to_string(),
+                message: "Failed to build APS renderer response".to_string(),
+            })
+    }
+}
+
+/// Register the APS static renderer endpoint when APS is enabled.
+///
+/// # Errors
 ///
-/// Returns the APS provider if enabled in settings.
+/// Returns an error when enabled APS configuration is invalid.
+pub fn register(
+    settings: &Settings,
+) -> Result<Option<IntegrationRegistration>, Report<TrustedServerError>> {
+    let Some(_config) = settings.integration_config::<ApsConfig>(APS_INTEGRATION_ID)? else {
+        return Ok(None);
+    };
+    let integration = Arc::new(ApsRendererIntegration);
+    Ok(Some(
+        IntegrationRegistration::builder(APS_INTEGRATION_ID)
+            .with_proxy(integration)
+            .without_js()
+            .build(),
+    ))
+}
+
+/// Register the APS auction provider when enabled.
 ///
 /// # Errors
 ///
-/// Returns an error when the APS provider is enabled with invalid
-/// configuration.
+/// Returns an error when enabled APS configuration is invalid.
 pub fn register_providers(
     settings: &Settings,
 ) -> Result<Vec<Arc<dyn AuctionProvider>>, Report<TrustedServerError>> {
-    let mut providers: Vec<Arc<dyn AuctionProvider>> = Vec::new();
-
-    // Check for real APS provider configuration
-    match settings.integration_config::<ApsConfig>("aps") {
-        Ok(Some(config)) => {
-            log::info!(
-                "Registering real APS provider (pub_id: {}, endpoint: {})",
-                config.pub_id,
-                config.endpoint
-            );
-            providers.push(Arc::new(ApsAuctionProvider::new(config)));
-        }
-        Ok(None) => {
-            log::debug!("APS integration config found but is disabled");
-        }
-        Err(e) => {
-            return Err(e);
-        }
-    }
-
-    Ok(providers)
+    let Some(config) = settings.integration_config::<ApsConfig>(APS_INTEGRATION_ID)? else {
+        return Ok(Vec::new());
+    };
+    log::info!("Registering APS OpenRTB provider");
+    Ok(vec![Arc::new(ApsAuctionProvider::new(config))])
 }
 
-// ============================================================================
-// Tests
-// ============================================================================
-
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::auction::types::*;
+    use crate::auction::types::{
+        AdFormat, AdSlot, AuctionContext, AuctionRequest, BidStatus, DeviceInfo, PublisherInfo,
+        UserInfo,
+    };
+    use crate::consent::ConsentContext;
+    use crate::openrtb::{Eid, Uid};
+    use crate::platform::GeoInfo;
+    use crate::platform::test_support::noop_services;
+    use crate::test_support::tests::create_test_settings;
+    use serde_json::json;
+
+    fn config() -> ApsConfig {
+        ApsConfig {
+            enabled: true,
+            account_id: "example-account-id".to_string(),
+            endpoint: default_endpoint(),
+            timeout_ms: 800,
+            allow_script_creatives: false,
+        }
+    }
 
-    fn create_test_auction_request() -> AuctionRequest {
+    fn request() -> AuctionRequest {
         AuctionRequest {
-            id: "test-auction-123".to_string(),
-            slots: vec![
-                AdSlot {
-                    id: "header-banner".to_string(),
-                    formats: vec![
-                        AdFormat {
-                            media_type: MediaType::Banner,
-                            width: 728,
-                            height: 90,
-                        },
-                        AdFormat {
-                            media_type: MediaType::Banner,
-                            width: 970,
-                            height: 250,
-                        },
-                    ],
-                    floor_price: Some(1.50),
-                    targeting: HashMap::new(),
-                    bidders: HashMap::new(),
-                },
-                AdSlot {
-                    id: "sidebar".to_string(),
-                    formats: vec![AdFormat {
-                        media_type: MediaType::Banner,
-                        width: 300,
-                        height: 250,
-                    }],
-                    floor_price: Some(1.00),
-                    targeting: HashMap::new(),
-                    bidders: HashMap::new(),
-                },
-            ],
+            id: "fictional-auction".to_string(),
+            slots: vec![AdSlot {
+                id: "fictional-slot".to_string(),
+                formats: vec![AdFormat {
+                    media_type: MediaType::Banner,
+                    width: 300,
+                    height: 250,
+                }],
+                floor_price: Some(1.0),
+                targeting: HashMap::new(),
+                bidders: HashMap::new(),
+            }],
             publisher: PublisherInfo {
-                domain: "test.com".to_string(),
-                page_url: Some("https://test.com/article".to_string()),
+                domain: "publisher.example".to_string(),
+                page_url: Some("https://publisher.example/article".to_string()),
             },
             user: UserInfo {
-                id: Some("user-123".to_string()),
+                id: Some("fictional-user".to_string()),
                 consent: None,
                 eids: None,
             },
-            device: Some(DeviceInfo {
-                user_agent: Some("Mozilla/5.0".to_string()),
-                ip: Some("192.168.1.1".to_string()),
-                geo: None,
-            }),
+            device: None,
             site: None,
             context: HashMap::new(),
         }
     }
 
-    #[test]
-    fn test_aps_request_transformation() {
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
-            timeout_ms: 800,
-        };
+    fn bid(id: &str, price: f64, tagtype: &str) -> Json {
+        json!({
+            "id": id,
+            "impid": "fictional-slot",
+            "price": price,
+            "w": 300,
+            "h": 250,
+            "crid": "fictional-creative",
+            "adomain": ["advertiser.example"],
+            "ext": {
+                "creativeurl": "https://creative.example/render",
+                "tagtype": tagtype,
+                "unknown": "discarded"
+            },
+            "adm": "<script>discarded</script>",
+            "nurl": "https://notice.example/win"
+        })
+    }
 
-        let provider = ApsAuctionProvider::new(config);
-        let auction_request = create_test_auction_request();
-        let aps_request = provider.to_aps_request(&auction_request, 800);
+    #[test]
+    fn config_accepts_canonical_alias_and_integer_ids() {
+        let canonical: ApsConfig = serde_json::from_value(json!({
+            "account_id": "  example-account  "
+        }))
+        .expect("should parse canonical account ID");
+        let alias: ApsConfig =
+            serde_json::from_value(json!({"pub_id": 1234})).expect("should parse legacy alias");
+        assert_eq!(canonical.account_id, "example-account");
+        assert_eq!(alias.account_id, "1234");
+        assert!(!canonical.enabled);
+        assert!(!canonical.allow_script_creatives);
+        assert!(canonical.endpoint.ends_with("/e/pb/bid"));
+    }
 
-        // Verify basic fields
-        assert_eq!(aps_request.pub_id, "5128");
-        assert_eq!(aps_request.slots.len(), 2);
-        assert_eq!(
-            aps_request.page_url,
-            Some("https://test.com/article".to_string())
+    #[test]
+    fn config_rejects_blank_duplicate_and_unsafe_endpoint() {
+        assert!(serde_json::from_value::<ApsConfig>(json!({"account_id": "   "})).is_err());
+        assert!(
+            serde_json::from_value::<ApsConfig>(
+                json!({"account_id": "x".repeat(MAX_ACCOUNT_ID_BYTES + 1)})
+            )
+            .is_err()
+        );
+        assert!(
+            serde_json::from_value::<ApsConfig>(json!({
+                "account_id": "one",
+                "pub_id": "two"
+            }))
+            .is_err()
         );
-        assert_eq!(aps_request.user_agent, Some("Mozilla/5.0".to_string()));
-        assert_eq!(aps_request.timeout, Some(800));
-
-        // Verify first slot
-        let slot1 = &aps_request.slots[0];
-        assert_eq!(slot1.slot_id, "header-banner");
-        assert_eq!(slot1.sizes.len(), 2);
-        assert_eq!(slot1.sizes[0], [728, 90]);
-        assert_eq!(slot1.sizes[1], [970, 250]);
-
-        // Verify second slot
-        let slot2 = &aps_request.slots[1];
-        assert_eq!(slot2.slot_id, "sidebar");
-        assert_eq!(slot2.sizes.len(), 1);
-        assert_eq!(slot2.sizes[0], [300, 250]);
+        for endpoint in [
+            "http://aps.example/e/pb/bid",
+            "https://",
+            "https://user:password@aps.example/e/pb/bid",
+        ] {
+            let parsed: ApsConfig = serde_json::from_value(json!({
+                "account_id": "example-account",
+                "endpoint": endpoint
+            }))
+            .expect("should deserialize before validation");
+            assert!(parsed.validate().is_err(), "should reject {endpoint}");
+        }
     }
 
     #[test]
-    fn aps_slot_id_from_bidders_map_used_in_request_and_remapped_in_response() {
-        use serde_json::json;
-
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: default_endpoint(),
-            timeout_ms: 800,
-        };
-        let provider = ApsAuctionProvider::new(config);
-
-        let mut bidders = HashMap::new();
-        bidders.insert(
-            "aps".to_string(),
-            json!({ "slotID": "aps-slot-atf-sidebar" }),
-        );
-        let request = AuctionRequest {
-            id: "test".to_string(),
-            slots: vec![AdSlot {
-                id: "atf_sidebar_ad".to_string(),
-                formats: vec![AdFormat {
-                    media_type: MediaType::Banner,
-                    width: 300,
-                    height: 250,
-                }],
-                floor_price: None,
-                targeting: HashMap::new(),
-                bidders,
+    fn builds_aps_openrtb_request_with_explicit_privacy_policy() {
+        let provider = ApsAuctionProvider::new(config());
+        let mut auction_request = request();
+        auction_request.user.consent = Some(ConsentContext {
+            gdpr_applies: true,
+            raw_tc_string: Some("fictional-tcf".to_string()),
+            raw_us_privacy: Some("1YNN".to_string()),
+            raw_gpp_string: Some("fictional-gpp".to_string()),
+            gpp_section_ids: Some(vec![2, 6]),
+            ..Default::default()
+        });
+        auction_request.user.eids = Some(vec![Eid {
+            source: "identity.example".to_string(),
+            uids: vec![Uid {
+                id: "fictional-uid".to_string(),
+                atype: Some(1),
+                ext: None,
             }],
-            publisher: PublisherInfo {
-                domain: "example.com".to_string(),
-                page_url: None,
+        }]);
+        auction_request.slots[0].formats.extend([
+            AdFormat {
+                media_type: MediaType::Video,
+                width: 640,
+                height: 480,
             },
-            user: UserInfo {
-                id: Some("user-1".to_string()),
-                consent: None,
-                eids: None,
+            AdFormat {
+                media_type: MediaType::Banner,
+                width: u32::MAX,
+                height: 90,
             },
-            device: None,
-            site: None,
-            context: HashMap::new(),
+            AdFormat {
+                media_type: MediaType::Banner,
+                width: 728,
+                height: 90,
+            },
+        ]);
+        auction_request.device = Some(DeviceInfo {
+            user_agent: Some("Fictional Browser".to_string()),
+            ip: Some("192.0.2.10".to_string()),
+            geo: Some(GeoInfo {
+                city: "Example City".to_string(),
+                country: "US".to_string(),
+                continent: "NA".to_string(),
+                latitude: 12.34,
+                longitude: 56.78,
+                metro_code: 501,
+                region: Some("CA".to_string()),
+                asn: None,
+            }),
+        });
+        let settings = create_test_settings();
+        let services = noop_services();
+        let downstream = http::Request::builder()
+            .uri("https://publisher.example/auction")
+            .header("DNT", "1")
+            .header(header::ACCEPT_LANGUAGE, "en-US,en;q=0.9")
+            .header(header::REFERER, "https://referrer.example/article")
+            .body(EdgeBody::empty())
+            .expect("should build downstream request");
+        let context = AuctionContext {
+            settings: &settings,
+            request: &downstream,
+            timeout_ms: 321,
+            provider_responses: None,
+            services: &services,
         };
 
-        let aps_request = provider.to_aps_request(&request, 800);
+        let openrtb = provider.build_openrtb_request(&auction_request, &context);
+        let serialized = serde_json::to_value(openrtb).expect("should serialize request");
+
+        assert_eq!(serialized["id"], "fictional-auction");
+        assert_eq!(serialized["tmax"], 321);
+        assert_eq!(serialized["cur"], json!(["USD"]));
+        assert_eq!(serialized["ext"]["account"], "example-account-id");
         assert_eq!(
-            aps_request.slots[0].slot_id, "aps-slot-atf-sidebar",
-            "should send configured APS slot ID to APS"
+            serialized["ext"]["sdk"],
+            json!({"source": "prebid", "version": "2.2.0"})
         );
-        let slot_id_map = ApsAuctionProvider::build_slot_id_map(&request);
+        assert_eq!(serialized["imp"][0]["id"], "fictional-slot");
+        assert_eq!(serialized["imp"][0]["banner"]["w"], 300);
+        assert_eq!(serialized["imp"][0]["banner"]["h"], 250);
+        assert_eq!(serialized["imp"][0]["banner"]["topframe"], 0);
         assert_eq!(
-            slot_id_map.get("aps-slot-atf-sidebar").map(String::as_str),
-            Some("atf_sidebar_ad"),
-            "should build reverse map from APS slot ID to creative slot ID"
+            serialized["imp"][0]["banner"]["format"]
+                .as_array()
+                .map(Vec::len),
+            Some(2)
+        );
+        assert_eq!(serialized["imp"][0]["banner"]["format"][1]["w"], 728);
+        assert_eq!(serialized["imp"][0]["bidfloor"], 1.0);
+        assert_eq!(serialized["imp"][0]["bidfloorcur"], "USD");
+        assert_eq!(serialized["imp"][0]["secure"], 1);
+        assert_eq!(serialized["site"]["domain"], "publisher.example");
+        assert_eq!(
+            serialized["site"]["page"],
+            "https://publisher.example/article"
         );
-
-        let aps_response = json!({
-            "contextual": {
-                "slots": [{
-                    "slotID": "aps-slot-atf-sidebar",
-                    "size": "300x250",
-                    "fif": "1",
-                    "amznbid": "1gtm3q",
-                    "meta": ["slotID"]
-                }]
-            }
-        });
-
-        let response = provider.parse_aps_response(&aps_response, 100, &slot_id_map);
-        assert_eq!(response.bids.len(), 1, "should parse one bid");
         assert_eq!(
-            response.bids[0].slot_id, "atf_sidebar_ad",
-            "bid slot_id should be remapped to creative slot ID"
+            serialized["site"]["ref"],
+            "https://referrer.example/article"
         );
+        assert_eq!(
+            serialized["site"]["publisher"]["domain"],
+            "publisher.example"
+        );
+        assert_eq!(serialized["device"]["ua"], "Fictional Browser");
+        assert_eq!(serialized["device"]["ip"], "192.0.2.10");
+        assert_eq!(serialized["device"]["dnt"], 1);
+        assert_eq!(serialized["device"]["language"], "en");
+        assert_eq!(serialized["device"]["geo"]["country"], "US");
+        assert!(serialized["device"]["geo"].get("lat").is_none());
+        assert!(serialized["device"]["geo"].get("lon").is_none());
+        assert_eq!(serialized["user"]["id"], "fictional-user");
+        assert_eq!(serialized["user"]["consent"], "fictional-tcf");
+        assert_eq!(serialized["user"]["ext"]["consent"], "fictional-tcf");
+        assert_eq!(
+            serialized["user"]["ext"]["eids"][0]["source"],
+            "identity.example"
+        );
+        assert_eq!(serialized["regs"]["gdpr"], 1);
+        assert_eq!(serialized["regs"]["us_privacy"], "1YNN");
+        assert_eq!(serialized["regs"]["gpp"], "fictional-gpp");
+        assert_eq!(serialized["regs"]["gpp_sid"], json!([2, 6]));
+        assert!(serialized["regs"].get("coppa").is_none());
+        assert!(serialized["ext"].get("prebid").is_none());
+        assert!(serialized["ext"].get("trusted_server").is_none());
+        assert!(serialized["imp"][0].get("ext").is_none());
     }
 
     #[test]
-    fn test_aps_response_parsing_success() {
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
-            timeout_ms: 800,
-        };
-
-        let provider = ApsAuctionProvider::new(config);
-
-        // Test APS response in real contextual format
-        let aps_response = json!({
-            "contextual": {
-                "slots": [
-                    {
-                        "slotID": "header-banner",
-                        "size": "728x90",
-                        "crid": "test-crid-123",
-                        "mediaType": "d",
-                        "fif": "1",
-                        "targeting": ["amzniid", "amznbid", "amznp", "amznsz", "amznactt"],
-                        "meta": ["slotID", "mediaType", "size"],
-                        "amzniid": "test-impression-id",
-                        "amznbid": "1kt0jk0",  // Proprietary Amazon encoding (not decodable)
-                        "amznp": "1kt0jk0",
-                        "amznsz": "728x90",
-                        "amznactt": "OPEN"
-                    },
-                    {
-                        "slotID": "sidebar",
-                        "size": "300x250",
-                        "crid": "test-crid-456",
-                        "mediaType": "d",
-                        "fif": "1",
-                        "targeting": ["amzniid", "amznbid", "amznp", "amznsz", "amznactt"],
-                        "meta": ["slotID", "mediaType", "size"],
-                        "amzniid": "test-impression-id-2",
-                        "amznbid": "ewpurk",  // Proprietary Amazon encoding (not decodable)
-                        "amznp": "ewpurk",
-                        "amznsz": "300x250",
-                        "amznactt": "OPEN"
-                    }
-                ],
-                "host": "https://aax-events.amazon-adsystem.com",
-                "status": "ok",
-                "cfe": true,
-                "ev": true,
-                "cb": "6"
-            }
-        });
-
-        let auction_response = provider.parse_aps_response(&aps_response, 150, &HashMap::new());
-
-        // Verify response
-        assert_eq!(auction_response.provider, "aps");
-        assert_eq!(auction_response.status, BidStatus::Success);
-        assert_eq!(auction_response.bids.len(), 2);
-        assert_eq!(auction_response.response_time_ms, 150);
-
-        // Verify first bid - price is None (encoded, to be decoded by mediation)
-        let bid1 = &auction_response.bids[0];
-        assert_eq!(bid1.slot_id, "header-banner");
-        assert_eq!(bid1.price, None); // Price is NOT decoded - it's in metadata for mediation
-        assert_eq!(bid1.width, 728);
-        assert_eq!(bid1.height, 90);
-        assert_eq!(bid1.currency, "USD");
-        assert_eq!(bid1.bidder, "amazon-aps");
-        assert_eq!(bid1.adomain, None);
-        assert!(bid1.metadata.contains_key("amzniid"));
-        assert!(bid1.metadata.contains_key("amznbid")); // Encoded price stored here
-
-        // Verify second bid
-        let bid2 = &auction_response.bids[1];
-        assert_eq!(bid2.slot_id, "sidebar");
-        assert_eq!(bid2.price, None); // Price is NOT decoded
-        assert_eq!(bid2.width, 300);
-        assert_eq!(bid2.height, 250);
-        assert!(bid2.metadata.contains_key("amznbid")); // Encoded price in metadata
+    fn parses_bid_and_builds_exact_minimized_envelope() {
+        let provider = ApsAuctionProvider::new(config());
+        let response = provider.parse_aps_response(
+            &json!({"cur": "USD", "seatbid": [{"seat": 42, "bid": [bid("fictional-selected-bid-id", 1.23, "iframe")]}], "ext": {"userSyncs": []}}),
+            12,
+            &request(),
+        );
+        assert_eq!(response.bids.len(), 1);
+        let parsed = &response.bids[0];
+        assert_eq!(parsed.bidder, "aps");
+        assert_eq!(parsed.price, Some(1.23));
+        assert!(parsed.creative.is_none());
+        assert!(parsed.nurl.is_none());
+        let renderer = parsed
+            .renderer
+            .as_ref()
+            .expect("should include renderer")
+            .aps();
+        let decoded = BASE64_STANDARD
+            .decode(&renderer.aax_response)
+            .expect("should decode renderer response");
+        let decoded: Json =
+            serde_json::from_slice(&decoded).expect("should parse renderer response");
+        let fixture: Json = serde_json::from_str(include_str!(
+            "../../../trusted-server-js/lib/test/fixtures/aps-renderer-v1.json"
+        ))
+        .expect("should parse shared APS renderer fixture");
+        assert_eq!(decoded, fixture);
     }
 
     #[test]
-    fn test_aps_response_parsing_no_bid() {
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
-            timeout_ms: 800,
-        };
-
-        let provider = ApsAuctionProvider::new(config);
-
-        // Empty contextual response
-        let aps_response = json!({
-            "contextual": {
-                "slots": [],
-                "status": "ok"
-            }
-        });
-
-        let auction_response = provider.parse_aps_response(&aps_response, 100, &HashMap::new());
-
-        assert_eq!(auction_response.provider, "aps");
-        assert_eq!(auction_response.status, BidStatus::NoBid);
-        assert_eq!(auction_response.bids.len(), 0);
+    fn empty_creative_id_is_omitted_from_renderer() {
+        let provider = ApsAuctionProvider::new(config());
+        let mut input = bid("bid-with-empty-crid", 1.23, "iframe");
+        input["crid"] = json!("");
+        let response =
+            provider.parse_aps_response(&json!({"seatbid": [{"bid": [input]}]}), 12, &request());
+        let bid = response.bids.first().expect("should accept renderer bid");
+        assert!(bid.creative_id.is_none());
+        assert!(
+            bid.renderer
+                .as_ref()
+                .expect("should retain renderer")
+                .aps()
+                .creative_id
+                .is_none()
+        );
     }
 
     #[test]
-    fn test_aps_response_parsing_invalid_bids() {
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
-            timeout_ms: 800,
-        };
-
-        let provider = ApsAuctionProvider::new(config);
-
-        // Response with invalid slots (not filled, zero price)
-        let aps_response = json!({
-            "contextual": {
-                "slots": [
-                    {
-                        "slotID": "header-banner",
-                        "size": "728x90",
-                        "fif": "0",  // Not filled
-                        "targeting": [],
-                        "meta": []
-                    },
-                    {
-                        "slotID": "sidebar",
-                        "size": "300x250",
-                        "fif": "1",
-                        "targeting": [],
-                        "meta": []
-                        // Missing price encoding - will decode to 0.0
-                    }
-                ],
-                "status": "ok"
-            }
-        });
-
-        let auction_response = provider.parse_aps_response(&aps_response, 100, &HashMap::new());
-
-        // Should return no-bid since all slots are invalid
-        assert_eq!(auction_response.status, BidStatus::NoBid);
-        assert_eq!(auction_response.bids.len(), 0);
+    fn rejects_wrong_typed_response_level_fields() {
+        let provider = ApsAuctionProvider::new(config());
+        for value in [
+            json!({"cur": ["USD"], "seatbid": []}),
+            json!({"cur": "USD", "seatbid": "invalid"}),
+            json!({"contextual": {"slots": []}}),
+        ] {
+            let response = provider.parse_aps_response(&value, 12, &request());
+            assert!(response.bids.is_empty());
+            assert_eq!(
+                response.metadata["drop_reasons"]["unexpected_response_shape"],
+                1
+            );
+        }
     }
 
     #[test]
-    fn test_aps_slot_parsing() {
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
-            timeout_ms: 800,
-        };
-
-        let provider = ApsAuctionProvider::new(config);
-
-        let aps_slot = ApsSlotResponse {
-            slot_id: "test-slot".to_string(),
-            size: "728x90".to_string(),
-            crid: Some("crid-123".to_string()),
-            media_type: Some("d".to_string()),
-            fif: Some("1".to_string()),
-            targeting: vec!["amzniid".to_string(), "amznbid".to_string()],
-            meta: vec!["slotID".to_string()],
-            amzniid: Some("impression-id-123".to_string()),
-            amznbid: Some("1c7d4ow".to_string()), // Encoded price (to be decoded by mediation)
-            amznp: Some("1c7d4ow".to_string()),
-            amznsz: Some("728x90".to_string()),
-            amznactt: Some("OPEN".to_string()),
-        };
-
-        let bid = provider
-            .parse_aps_slot(&aps_slot)
-            .expect("should parse slot");
-
-        assert_eq!(bid.slot_id, "test-slot");
-        assert_eq!(bid.price, None); // Price NOT decoded - stored in metadata for mediation
-        assert_eq!(bid.width, 728);
-        assert_eq!(bid.height, 90);
-        assert_eq!(bid.currency, "USD");
-        assert_eq!(bid.bidder, "amazon-aps");
-        assert_eq!(bid.adomain, None);
-        assert_eq!(bid.nurl, None); // Real APS uses client-side tracking
-        assert_eq!(bid.burl, None);
-        assert!(bid.metadata.contains_key("amzniid"));
-        assert!(bid.metadata.contains_key("amznbid")); // Encoded price here
-        assert!(bid.metadata.contains_key("amznsz"));
+    fn malformed_json_is_a_safe_shape_error() {
+        let provider = ApsAuctionProvider::new(config());
+        let platform_response = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::OK)
+                .body(EdgeBody::from(b"{not-json".to_vec()))
+                .expect("should build malformed APS response"),
+        );
+        let auction_request = request();
+        let response = futures::executor::block_on(provider.parse_response_inner(
+            platform_response,
+            12,
+            Some(&auction_request),
+        ))
+        .expect("should convert malformed JSON into a safe auction response");
+
+        assert!(response.bids.is_empty());
+        assert_eq!(
+            response.metadata["drop_reasons"]["unexpected_response_shape"],
+            1
+        );
     }
 
     #[test]
-    fn test_provider_metadata() {
-        let config = ApsConfig::default();
-        let provider = ApsAuctionProvider::new(config);
-
-        assert_eq!(provider.provider_name(), "aps");
-        assert!(!provider.is_enabled()); // Default is disabled
-        assert_eq!(provider.timeout_ms(), 800);
-        assert!(provider.supports_media_type(&MediaType::Banner));
-        assert!(provider.supports_media_type(&MediaType::Video));
-        assert!(!provider.supports_media_type(&MediaType::Native));
+    fn no_content_and_empty_responses_are_no_bids() {
+        let provider = ApsAuctionProvider::new(config());
+        let platform_response = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::NO_CONTENT)
+                .body(EdgeBody::empty())
+                .expect("should build empty APS response"),
+        );
+        let auction_request = request();
+        let no_content = futures::executor::block_on(provider.parse_response_inner(
+            platform_response,
+            12,
+            Some(&auction_request),
+        ))
+        .expect("should parse 204 as no bid");
+        assert_eq!(no_content.status, BidStatus::NoBid);
+
+        for value in [json!({}), json!({"seatbid": []})] {
+            let empty = provider.parse_aps_response(&value, 12, &auction_request);
+            assert_eq!(empty.status, BidStatus::NoBid);
+            assert_eq!(empty.metadata["drop_reasons"]["empty_seatbid"], 1);
+        }
     }
 
     #[test]
-    fn aps_payload_timeout_uses_effective_auction_budget_not_provider_config() {
-        // Provider config says 1000ms but the auction budget grants only 500ms —
-        // the payload must advertise the tighter effective deadline.
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: default_endpoint(),
-            timeout_ms: 1000,
-        };
-        let provider = ApsAuctionProvider::new(config);
-        let request = create_test_auction_request();
-
-        let aps_request = provider.to_aps_request(&request, 500);
+    fn unsupported_currency_is_a_no_bid() {
+        let provider = ApsAuctionProvider::new(config());
+        let response = provider.parse_aps_response(
+            &json!({"cur": "EUR", "seatbid": [{"bid": [bid("eur-bid", 1.0, "iframe")]}]}),
+            12,
+            &request(),
+        );
+        assert_eq!(response.status, BidStatus::NoBid);
+        assert_eq!(response.metadata["drop_reasons"]["unsupported_currency"], 1);
+    }
 
+    #[test]
+    fn malformed_sibling_does_not_suppress_valid_bid() {
+        let provider = ApsAuctionProvider::new(config());
+        let response = provider.parse_aps_response(
+            &json!({"seatbid": [{"bid": ["malformed", bid("valid", 1.0, "iframe")]}]}),
+            12,
+            &request(),
+        );
+        assert_eq!(response.bids.len(), 1);
+        assert_eq!(response.bids[0].bid_id.as_deref(), Some("valid"));
         assert_eq!(
-            aps_request.timeout,
-            Some(500),
-            "should advertise the effective auction budget, not the provider config timeout"
+            response.metadata["drop_reasons"]["missing_render_source"],
+            1
         );
     }
 
     #[test]
-    fn test_aps_request_includes_consent_fields() {
-        use crate::consent::ConsentContext;
-
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: default_endpoint(),
-            timeout_ms: 800,
-        };
-        let provider = ApsAuctionProvider::new(config);
-
-        let mut request = create_test_auction_request();
-        request.user.consent = Some(ConsentContext {
-            raw_tc_string: Some("BOEFEAyOEFEAyAHABDENAI4AAAB9vABAASA".to_string()),
-            gdpr_applies: true,
-            raw_us_privacy: Some("1YNN".to_string()),
-            raw_gpp_string: Some("DBACNYA~CPXxRfAPXxRfA".to_string()),
-            gpp_section_ids: Some(vec![2, 6]),
-            ..Default::default()
-        });
-
-        let aps_request = provider.to_aps_request(&request, 800);
+    fn enabled_script_bid_keeps_typed_renderer() {
+        let mut enabled = config();
+        enabled.allow_script_creatives = true;
+        let provider = ApsAuctionProvider::new(enabled);
+        let response = provider.parse_aps_response(
+            &json!({"seatbid": [{"bid": [bid("script", 1.0, "script")]}]}),
+            12,
+            &request(),
+        );
+        let renderer = response.bids[0]
+            .renderer
+            .as_ref()
+            .expect("should keep script renderer")
+            .aps();
+        assert_eq!(renderer.tag_type, ApsTagType::Script);
+    }
 
-        // Verify GDPR consent
-        let gdpr = aps_request.gdpr.expect("should have gdpr");
-        assert!(gdpr.enabled);
+    #[test]
+    fn disabled_script_cannot_suppress_lower_iframe_bid() {
+        let provider = ApsAuctionProvider::new(config());
+        let response = provider.parse_aps_response(
+            &json!({"seatbid": [{"bid": [bid("script-high", 4.0, "script"), bid("iframe-low", 1.0, "iframe")]}]}),
+            12,
+            &request(),
+        );
+        assert_eq!(response.bids.len(), 1);
+        assert_eq!(response.bids[0].bid_id.as_deref(), Some("iframe-low"));
         assert_eq!(
-            gdpr.consent.as_deref(),
-            Some("BOEFEAyOEFEAyAHABDENAI4AAAB9vABAASA")
+            response.metadata["drop_reasons"]["script_rendering_disabled"],
+            1
         );
-
-        // Verify US Privacy
-        assert_eq!(aps_request.us_privacy.as_deref(), Some("1YNN"));
-
-        // Verify GPP
-        assert_eq!(aps_request.gpp.as_deref(), Some("DBACNYA~CPXxRfAPXxRfA"));
-        assert_eq!(aps_request.gpp_sid.as_deref(), Some("2,6"));
     }
 
     #[test]
-    fn test_aps_request_no_consent() {
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: default_endpoint(),
-            timeout_ms: 800,
-        };
-        let provider = ApsAuctionProvider::new(config);
-        let request = create_test_auction_request(); // consent is None
-
-        let aps_request = provider.to_aps_request(&request, 800);
-
-        assert!(aps_request.gdpr.is_none());
-        assert!(aps_request.us_privacy.is_none());
-        assert!(aps_request.gpp.is_none());
-        assert!(aps_request.gpp_sid.is_none());
+    fn reduces_candidates_by_price_then_bid_id() {
+        let provider = ApsAuctionProvider::new(config());
+        let response = provider.parse_aps_response(
+            &json!({"seatbid": [{"bid": [bid("bid-z", 2.0, "iframe"), bid("bid-a", 2.0, "iframe")]}]}),
+            12,
+            &request(),
+        );
+        assert_eq!(response.bids.len(), 1);
+        assert_eq!(response.bids[0].bid_id.as_deref(), Some("bid-a"));
     }
 
     #[test]
-    fn test_aps_request_consent_serialization() {
-        use crate::consent::ConsentContext;
-
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: default_endpoint(),
-            timeout_ms: 800,
-        };
-        let provider = ApsAuctionProvider::new(config);
-
-        let mut request = create_test_auction_request();
-        request.user.consent = Some(ConsentContext {
-            raw_tc_string: Some("BOE".to_string()),
-            gdpr_applies: true,
-            ..Default::default()
-        });
-
-        let aps_request = provider.to_aps_request(&request, 800);
-        let json = serde_json::to_value(&aps_request).expect("should serialize");
-
-        // GDPR fields present
-        assert_eq!(json["gdpr"]["enabled"], true);
-        assert_eq!(json["gdpr"]["consent"], "BOE");
-
-        // Absent fields should not appear (skip_serializing_if)
-        assert!(json.get("usPrivacy").is_none());
-        assert!(json.get("gpp").is_none());
-        assert!(json.get("gppSid").is_none());
+    fn safe_drops_missing_renderer_and_invalid_dimensions() {
+        let provider = ApsAuctionProvider::new(config());
+        let mut invalid = bid("invalid", 1.0, "iframe");
+        invalid
+            .as_object_mut()
+            .expect("should be object")
+            .remove("w");
+        let response = provider.parse_aps_response(
+            &json!({"seatbid": [{"bid": [
+                {"id": "fixture", "impid": "fictional-slot", "price": 1.0, "w": 300, "h": 250, "ext": {"bidder": "aps"}},
+                invalid
+            ]}]}),
+            12,
+            &request(),
+        );
+        assert!(response.bids.is_empty());
+        assert_eq!(
+            response.metadata["drop_reasons"]["missing_render_source"],
+            1
+        );
+        assert_eq!(response.metadata["drop_reasons"]["invalid_dimensions"], 1);
     }
 
     #[test]
-    fn test_aps_bids_have_no_creative_and_no_decoded_price() {
-        // APS doesn't provide creative HTML - it only provides targeting keys
-        // APS doesn't decode prices - only mediation layer can decode them
-        // The creative will be generated by the mediation layer (e.g., GAM or ad server)
-        let config = ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: "https://aax.amazon-adsystem.com/e/dtb/bid".to_string(),
-            timeout_ms: 800,
-        };
-
-        let provider = ApsAuctionProvider::new(config);
-
-        let aps_slot = ApsSlotResponse {
-            slot_id: "test-slot".to_string(),
-            size: "300x250".to_string(),
-            crid: Some("test-creative".to_string()),
-            media_type: Some("d".to_string()),
-            fif: Some("1".to_string()),
-            targeting: vec!["amzniid".to_string(), "amznbid".to_string()],
-            meta: vec!["slotID".to_string()],
-            amzniid: Some("imp-123".to_string()),
-            amznbid: Some("encoded-price".to_string()),
-            amznp: Some("encoded-price-alt".to_string()),
-            amznsz: Some("300x250".to_string()),
-            amznactt: Some("OPEN".to_string()),
-        };
-
-        let bid = provider.parse_aps_slot(&aps_slot).expect("should parse");
+    fn rejects_publisher_origin_and_non_https_creative_urls() {
+        let provider = ApsAuctionProvider::new(config());
+        for creative_url in [
+            "https://publisher.example/render",
+            "http://creative.example/render",
+            "https://user:password@creative.example/render",
+        ] {
+            let mut invalid = bid("invalid-url", 1.0, "iframe");
+            invalid["ext"]["creativeurl"] = json!(creative_url);
+            let response = provider.parse_aps_response(
+                &json!({"seatbid": [{"bid": [invalid]}]}),
+                12,
+                &request(),
+            );
+            assert!(response.bids.is_empty(), "should reject {creative_url}");
+            assert_eq!(response.metadata["drop_reasons"]["invalid_creative_url"], 1);
+        }
 
-        // Key assertions:
-        // 1. creative should be None for APS bids
-        assert_eq!(bid.creative, None, "APS bids should not have creative HTML");
-        // 2. price should be None (encoded price in metadata, decoded by mediation)
-        assert_eq!(bid.price, None, "APS bids should not have decoded price");
+        let mut uppercase_publisher = request();
+        uppercase_publisher.publisher.domain = "Creative.Example".to_string();
+        let response = provider.parse_aps_response(
+            &json!({"seatbid": [{"bid": [bid("same-origin", 1.0, "iframe")]}]}),
+            12,
+            &uppercase_publisher,
+        );
+        assert!(response.bids.is_empty());
+        assert_eq!(response.metadata["drop_reasons"]["invalid_creative_url"], 1);
+    }
 
-        // Verify targeting keys are in metadata (includes encoded price)
-        assert!(bid.metadata.contains_key("amzniid"));
-        assert!(bid.metadata.contains_key("amznbid")); // Encoded price
+    #[test]
+    fn registers_and_serves_only_static_renderer_route() {
+        let integration = ApsRendererIntegration;
+        let routes = integration.routes();
+        assert_eq!(routes.len(), 1, "should register one route");
+        assert_eq!(routes[0].method, Method::GET);
+        assert_eq!(routes[0].path, APS_RENDERER_ROUTE);
+
+        let settings = create_test_settings();
+        let services = noop_services();
+        let request = http::Request::builder()
+            .method(Method::GET)
+            .uri(APS_RENDERER_ROUTE)
+            .body(EdgeBody::empty())
+            .expect("should build renderer request");
+        let response =
+            futures::executor::block_on(integration.handle(&settings, &services, request))
+                .expect("should serve renderer");
+        assert_eq!(response.status(), StatusCode::OK);
         assert_eq!(
-            bid.metadata.get("amzniid").and_then(|v| v.as_str()),
-            Some("imp-123")
+            response.headers()[header::CONTENT_TYPE],
+            "text/html; charset=utf-8"
         );
+        assert_eq!(response.headers()["x-content-type-options"], "nosniff");
+        assert_eq!(response.headers()["referrer-policy"], "no-referrer");
         assert_eq!(
-            bid.metadata.get("amznbid").and_then(|v| v.as_str()),
-            Some("encoded-price")
+            response.headers()[header::CONTENT_SECURITY_POLICY],
+            APS_RENDERER_CSP
         );
-    }
 
-    fn single_slot_request(
-        auction_id: &str,
-        aps_slot_id: &str,
-        creative_id: &str,
-    ) -> AuctionRequest {
-        let mut bidders = HashMap::new();
-        bidders.insert("aps".to_string(), json!({ "slotID": aps_slot_id }));
-        AuctionRequest {
-            id: auction_id.to_string(),
-            slots: vec![AdSlot {
-                id: creative_id.to_string(),
-                formats: vec![AdFormat {
-                    media_type: MediaType::Banner,
-                    width: 300,
-                    height: 250,
-                }],
-                floor_price: None,
-                targeting: HashMap::new(),
-                bidders,
-            }],
-            publisher: PublisherInfo {
-                domain: "example.com".to_string(),
-                page_url: None,
-            },
-            user: UserInfo {
-                id: None,
-                consent: None,
-                eids: None,
-            },
-            device: None,
-            site: None,
-            context: HashMap::new(),
-        }
+        let post = http::Request::builder()
+            .method(Method::POST)
+            .uri(APS_RENDERER_ROUTE)
+            .body(EdgeBody::empty())
+            .expect("should build method rejection request");
+        let response = futures::executor::block_on(integration.handle(&settings, &services, post))
+            .expect("should reject unsupported method");
+        assert_eq!(response.status(), StatusCode::NOT_FOUND);
     }
 
-    fn aps_platform_response(aps_slot_id: &str) -> PlatformResponse {
-        let body = json!({
-            "contextual": {
-                "slots": [{
-                    "slotID": aps_slot_id,
-                    "size": "300x250",
-                    "fif": "1",
-                    "amznbid": "1gtm3q",
-                    "meta": ["slotID"]
-                }]
-            }
-        });
-        let response = http::Response::builder()
-            .status(200)
-            .body(EdgeBody::from(
-                serde_json::to_vec(&body).expect("should serialize APS response body"),
-            ))
-            .expect("should build APS platform response");
-        PlatformResponse::new(response)
+    #[test]
+    fn enabled_config_registers_renderer_proxy() {
+        let mut settings = create_test_settings();
+        settings
+            .integrations
+            .insert_config(
+                APS_INTEGRATION_ID,
+                &json!({"enabled": true, "account_id": "example-account"}),
+            )
+            .expect("should insert APS config");
+
+        let registration = register(&settings)
+            .expect("should register APS")
+            .expect("should return enabled registration");
+
+        assert_eq!(registration.integration_id, APS_INTEGRATION_ID);
+        assert_eq!(registration.proxies.len(), 1);
+        assert!(registration.js_disabled);
     }
 
     #[test]
-    fn concurrent_auctions_parse_out_of_order_with_correct_slot_remapping() {
-        // Regression: the reverse slot map used to live on the shared provider
-        // instance, so a second auction's request_bids overwrote the first
-        // auction's map and out-of-order parses remapped bids to the wrong
-        // creative slot. The map is now derived from each parse's own request.
-        let provider = ApsAuctionProvider::new(ApsConfig {
-            enabled: true,
-            pub_id: "5128".to_string(),
-            endpoint: default_endpoint(),
-            timeout_ms: 800,
-        });
-
-        let request_a = single_slot_request("auction-a", "aps-slot-a", "creative_a");
-        let request_b = single_slot_request("auction-b", "aps-slot-b", "creative_b");
-
-        let settings = crate::test_support::tests::create_test_settings();
-        let http_request = http::Request::builder()
-            .uri("https://example.com/")
-            .body(EdgeBody::empty())
-            .expect("should build test request");
-        let context = crate::auction::test_support::create_test_auction_context(
-            &settings,
-            &http_request,
-            800,
+    fn renderer_document_is_static_and_nonce_bound() {
+        assert!(APS_RENDERER_DOCUMENT.contains("^#tsaps="));
+        assert!(APS_RENDERER_DOCUMENT.contains("event.source!==parent"));
+        assert!(APS_RENDERER_DOCUMENT.contains("message.nonce!==expected"));
+        assert!(APS_RENDERER_DOCUMENT.contains("prebid/creative/render"));
+        assert!(APS_RENDERER_DOCUMENT.contains("window._aps instanceof Map"));
+        assert!(APS_RENDERER_DOCUMENT.contains("store:new Map([['listeners',new Map()]])"));
+        assert!(APS_RENDERER_DOCUMENT.contains("account.queue.push(new CustomEvent"));
+        assert!(
+            APS_RENDERER_DOCUMENT.contains("trusted-server/aps/renderer-ready")
+                && APS_RENDERER_DOCUMENT.contains("trusted-server/aps/renderer-failed")
         );
-
-        futures::executor::block_on(async {
-            // Parse auction B's response first, then auction A's — the reverse
-            // of dispatch order — each against its own request.
-            let response_b = provider
-                .parse_response_with_context(
-                    aps_platform_response("aps-slot-b"),
-                    100,
-                    &request_b,
-                    &context,
-                )
-                .await
-                .expect("should parse auction B response");
-            let response_a = provider
-                .parse_response_with_context(
-                    aps_platform_response("aps-slot-a"),
-                    100,
-                    &request_a,
-                    &context,
-                )
-                .await
-                .expect("should parse auction A response");
-
-            assert_eq!(
-                response_b.bids[0].slot_id, "creative_b",
-                "auction B bid should remap to auction B's creative slot"
-            );
-            assert_eq!(
-                response_a.bids[0].slot_id, "creative_a",
-                "auction A bid should remap to auction A's creative slot despite parsing last"
-            );
-        });
+        assert!(!APS_RENDERER_DOCUMENT.contains("window.apstag"));
+        assert!(
+            APS_RENDERER_DOCUMENT
+                .contains("https://client.aps.amazon-adsystem.com/prebid-creative.js")
+        );
+        assert!(!APS_RENDERER_DOCUMENT.contains("<script src="));
+        let queue_index = APS_RENDERER_DOCUMENT
+            .find("account.queue.push(new CustomEvent")
+            .expect("should queue render event");
+        let runner_index = APS_RENDERER_DOCUMENT
+            .find("document.head.appendChild(script)")
+            .expect("should dynamically load the APS runner");
+        assert!(queue_index < runner_index);
+        assert!(!APS_RENDERER_DOCUMENT.contains("allow-same-origin"));
+        assert!(APS_RENDERER_CSP.contains("default-src 'none'"));
+        assert!(APS_RENDERER_CSP.contains("sandbox allow-forms"));
+        assert!(!APS_RENDERER_CSP.contains("allow-same-origin"));
     }
 }
diff --git a/crates/trusted-server-core/src/integrations/mod.rs b/crates/trusted-server-core/src/integrations/mod.rs
index af56c3713..e7464f866 100644
--- a/crates/trusted-server-core/src/integrations/mod.rs
+++ b/crates/trusted-server-core/src/integrations/mod.rs
@@ -284,6 +284,10 @@ pub(crate) struct IntegrationBuilder {
 
 pub(crate) fn builders() -> &'static [IntegrationBuilder] {
     &[
+        IntegrationBuilder {
+            id: "aps",
+            build: aps::register,
+        },
         IntegrationBuilder {
             id: "prebid",
             build: prebid::register,
diff --git a/crates/trusted-server-core/src/integrations/prebid.rs b/crates/trusted-server-core/src/integrations/prebid.rs
index 09f94737d..033180620 100644
--- a/crates/trusted-server-core/src/integrations/prebid.rs
+++ b/crates/trusted-server-core/src/integrations/prebid.rs
@@ -1424,13 +1424,18 @@ impl PrebidAuctionProvider {
                 // keys like "aps" which belong to their own separate auction provider.
                 let mut bidder: HashMap<String, Json> = HashMap::new();
                 for (name, params) in &slot.bidders {
+                    if name == "aps" {
+                        // Trusted Server APS is a separate OpenRTB provider. Never
+                        // send native APS demand through PBS for the same cohort.
+                        continue;
+                    }
                     if name == TRUSTED_SERVER_BIDDER {
                         bidder.extend(expand_trusted_server_bidders(&self.config.bidders, params));
+                        bidder.remove("aps");
                     } else if self.config.bidders.iter().any(|b| b == name) {
                         bidder.insert(name.clone(), params.clone());
-                    } else if name != "aps" {
-                        // `aps` is intentionally handled by its own provider. Any
-                        // other unrecognized key is likely a misconfiguration (a
+                    } else {
+                        // Any other unrecognized key is likely a misconfiguration (a
                         // slot bidder absent from `config.bidders`) that silently
                         // yields an empty bidder map and a stored-request no-bid —
                         // log it so the drop is diagnosable.
@@ -1905,10 +1910,15 @@ impl PrebidAuctionProvider {
         // not an ad ID, so it is not used as a fallback: surfacing it as `ad_id`
         // (which is exposed raw in the debug bid) would mislead any consumer that
         // treats `ad_id` as a creative identifier. Absent `adid`, `ad_id` is None.
+        let bid_id = bid_obj.get("id").and_then(|v| v.as_str()).map(String::from);
         let ad_id = bid_obj
             .get("adid")
             .and_then(|v| v.as_str())
             .map(String::from);
+        let creative_id = bid_obj
+            .get("crid")
+            .and_then(|v| v.as_str())
+            .map(String::from);
 
         let adomain = bid_obj
             .get("adomain")
@@ -1973,7 +1983,10 @@ impl PrebidAuctionProvider {
             height,
             nurl,
             burl,
+            bid_id,
             ad_id,
+            creative_id,
+            renderer: None,
             cache_id,
             cache_host,
             cache_path,
@@ -5954,13 +5967,15 @@ set = { placementId = "explicit_header" }
 
     #[test]
     fn to_openrtb_skips_aps_key_from_slot_bidders_in_pbs_request() {
+        let mut config = base_config();
+        config.bidders.push("aps".to_string());
         let slot = make_slot(
             "atf_sidebar_ad",
             HashMap::from([("aps".to_string(), json!({"slotID": "aps-slot-atf-sidebar"}))]),
         );
         let request = make_auction_request(vec![slot]);
 
-        let ortb = call_to_openrtb(base_config(), &request);
+        let ortb = call_to_openrtb(config, &request);
         let ext = ortb.imp[0].ext.as_ref().expect("should have imp ext");
         let prebid = ext.get("prebid").expect("should have prebid in ext");
 
@@ -5970,6 +5985,29 @@ set = { placementId = "explicit_header" }
         );
     }
 
+    #[test]
+    fn trusted_server_expansion_never_enables_aps_through_pbs() {
+        let mut config = base_config();
+        config.bidders = vec!["kargo".to_string(), "aps".to_string()];
+        let slot = make_ts_slot(
+            "in_content_ad",
+            &json!({
+                "kargo": {"placementId": "client_123"},
+                "aps": {"slotID": "legacy-aps-slot"}
+            }),
+            None,
+        );
+        let request = make_auction_request(vec![slot]);
+
+        let ortb = call_to_openrtb(config, &request);
+        let bidder = &ortb.imp[0].ext.as_ref().expect("should have imp ext")["prebid"]["bidder"];
+        assert_eq!(bidder["kargo"]["placementId"], "client_123");
+        assert!(
+            bidder.get("aps").is_none(),
+            "Trusted Server APS cohorts must not also send APS through PBS"
+        );
+    }
+
     #[test]
     fn register_rejects_invalid_bid_param_override_rule() {
         let toml = format!(
@@ -6218,6 +6256,7 @@ set = { networkId = 42 }
             "id": "bid-impression-id",
             "impid": "atf_sidebar_ad",
             "adid": "bidder-ad-id-abc",
+            "crid": "bidder-creative-id-abc",
             "price": 1.0,
             "w": 300,
             "h": 250,
@@ -6236,11 +6275,21 @@ set = { networkId = 42 }
         let bid = provider
             .parse_bid(&bid_json, "appnexus")
             .expect("should parse bid");
+        assert_eq!(
+            bid.bid_id.as_deref(),
+            Some("bid-impression-id"),
+            "should preserve OpenRTB id separately"
+        );
         assert_eq!(
             bid.ad_id.as_deref(),
             Some("bidder-ad-id-abc"),
             "should keep ad_id from adid field"
         );
+        assert_eq!(
+            bid.creative_id.as_deref(),
+            Some("bidder-creative-id-abc"),
+            "should preserve OpenRTB crid separately"
+        );
         assert_eq!(
             bid.cache_id.as_deref(),
             Some("cache-uuid-xyz"),
diff --git a/crates/trusted-server-core/src/openrtb.rs b/crates/trusted-server-core/src/openrtb.rs
index df99f5653..aefb42996 100644
--- a/crates/trusted-server-core/src/openrtb.rs
+++ b/crates/trusted-server-core/src/openrtb.rs
@@ -1,7 +1,7 @@
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
 
-use crate::auction::types::OrchestratorExt;
+use crate::auction::types::{BidRenderer, OrchestratorExt};
 
 pub type OpenRtbRequest = trusted_server_openrtb::BidRequest;
 pub type OpenRtbResponse = trusted_server_openrtb::BidResponse;
@@ -171,6 +171,18 @@ pub struct ImpStoredRequest {
     pub id: String,
 }
 
+#[derive(Debug, Serialize)]
+pub struct BidExt<'a> {
+    pub trusted_server: BidTrustedServerExt<'a>,
+}
+
+impl ToExt for BidExt<'_> {}
+
+#[derive(Debug, Serialize)]
+pub struct BidTrustedServerExt<'a> {
+    pub renderer: &'a BidRenderer,
+}
+
 #[derive(Debug, Serialize)]
 pub struct ResponseExt {
     pub orchestrator: OrchestratorExt,
diff --git a/crates/trusted-server-core/src/publisher.rs b/crates/trusted-server-core/src/publisher.rs
index c810bb21b..926d58b5d 100644
--- a/crates/trusted-server-core/src/publisher.rs
+++ b/crates/trusted-server-core/src/publisher.rs
@@ -1951,10 +1951,17 @@ pub(crate) fn build_bid_map(
                     "hb_bidder".to_string(),
                     serde_json::Value::String(bid.bidder.clone()),
                 );
-                // hb_adid: use PBS Cache UUID when present — the Prebid Universal Creative uses
-                // this as the cache lookup key, NOT the OpenRTB bid ID (bid.ad_id). Fall back to
-                // bid.ad_id for APS and other non-PBS providers.
-                let hb_adid = bid.cache_id.as_deref().or(bid.ad_id.as_deref());
+                // PBS Cache remains highest priority. APS uses the selected bid ID
+                // carried by its typed renderer; other providers retain the ad-ID fallback.
+                let renderer_bid_id = bid
+                    .renderer
+                    .as_ref()
+                    .map(|renderer| renderer.aps().bid_id.as_str());
+                let hb_adid = bid
+                    .cache_id
+                    .as_deref()
+                    .or(renderer_bid_id)
+                    .or(bid.ad_id.as_deref());
                 if let Some(id) = hb_adid {
                     obj.insert(
                         "hb_adid".to_string(),
@@ -1983,6 +1990,12 @@ pub(crate) fn build_bid_map(
                 if let Some(ref burl) = bid.burl {
                     obj.insert("burl".to_string(), serde_json::Value::String(burl.clone()));
                 }
+                if let Some(ref renderer) = bid.renderer {
+                    obj.insert(
+                        "renderer".to_string(),
+                        serde_json::to_value(renderer).expect("should serialize typed renderer"),
+                    );
+                }
                 // Include raw creative markup only for explicit debug injection.
                 // The pbRender bridge can use it while PBS Cache is unavailable.
                 if include_adm {
@@ -2002,7 +2015,9 @@ pub(crate) fn build_bid_map(
                             "height": bid.height,
                             "nurl": bid.nurl,
                             "burl": bid.burl,
+                            "bid_id": bid.bid_id,
                             "ad_id": bid.ad_id,
+                            "creative_id": bid.creative_id,
                             "cache_id": bid.cache_id,
                             "cache_host": bid.cache_host,
                             "cache_path": bid.cache_path,
@@ -3933,7 +3948,7 @@ mod tests {
             MatchedSlotsContext, build_ad_slots_script, build_auction_request, build_bid_map,
             build_bids_script, html_escape_for_script,
         };
-        use crate::auction::types::{Bid, MediaType};
+        use crate::auction::types::{ApsRendererV1, ApsTagType, Bid, BidRenderer, MediaType};
         use crate::consent::ConsentContext;
         use crate::creative_opportunities::{
             CreativeOpportunitiesConfig, CreativeOpportunityFormat, CreativeOpportunitySlot,
@@ -3990,7 +4005,10 @@ mod tests {
                 height: 250,
                 nurl: Some(nurl.to_string()),
                 burl: Some(burl.to_string()),
+                bid_id: None,
                 ad_id: Some(ad_id.to_string()),
+                creative_id: None,
+                renderer: None,
                 cache_id: None,
                 cache_host: None,
                 cache_path: None,
@@ -4075,6 +4093,44 @@ mod tests {
             );
         }
 
+        #[test]
+        fn bid_map_exposes_aps_renderer_and_selected_bid_id_without_debug_adm() {
+            let mut bid = make_bid("atf_sidebar_ad", 1.50, "aps", "fallback-ad", "", "");
+            bid.bid_id = Some("selected-bid".to_string());
+            bid.renderer = Some(BidRenderer::Aps(ApsRendererV1 {
+                version: 1,
+                account_id: "example-account".to_string(),
+                bid_id: "selected-bid".to_string(),
+                creative_id: None,
+                tag_type: ApsTagType::Iframe,
+                creative_url: "https://creative.example/render".to_string(),
+                aax_response: "fictional-base64</script>".to_string(),
+                width: 300,
+                height: 250,
+            }));
+            bid.nurl = None;
+            bid.burl = None;
+            let winning_bids = HashMap::from([("atf_sidebar_ad".to_string(), bid)]);
+
+            let map = build_bid_map(&winning_bids, PriceGranularity::Dense, false);
+            let obj = map["atf_sidebar_ad"]
+                .as_object()
+                .expect("should include APS bid");
+
+            assert_eq!(obj["hb_bidder"], "aps");
+            assert_eq!(obj["hb_adid"], "selected-bid");
+            assert_eq!(obj["renderer"]["type"], "aps");
+            assert_eq!(obj["renderer"]["bidId"], "selected-bid");
+            assert!(obj.get("adm").is_none());
+            assert!(obj.get("nurl").is_none());
+            assert!(obj.get("burl").is_none());
+            assert!(obj.get("metadata").is_none());
+
+            let script = build_bids_script(&map);
+            assert!(!script.contains("</script></script>"));
+            assert!(script.contains("\\u003C/script\\u003E"));
+        }
+
         #[test]
         fn client_bid_map_omits_adm_by_default() {
             let mut winning_bids = HashMap::new();
@@ -4210,7 +4266,10 @@ mod tests {
                     height: 250,
                     nurl: None,
                     burl: None,
+                    bid_id: None,
                     ad_id: Some("bid-impression-id".to_string()),
+                    creative_id: None,
+                    renderer: None,
                     cache_id: Some("f47447a0-b759-4f2f-9887-af458b79b570".to_string()),
                     cache_host: Some("openads.adsrvr.org".to_string()),
                     cache_path: Some("/cache".to_string()),
@@ -4251,12 +4310,15 @@ mod tests {
                     currency: "USD".to_string(),
                     creative: None,
                     adomain: None,
-                    bidder: "amazon-aps".to_string(),
+                    bidder: "ordinary".to_string(),
                     width: 300,
                     height: 250,
                     nurl: None,
                     burl: None,
-                    ad_id: Some("aps-bid-token".to_string()),
+                    bid_id: None,
+                    ad_id: Some("ordinary-ad-id".to_string()),
+                    creative_id: None,
+                    renderer: None,
                     cache_id: None,
                     cache_host: None,
                     cache_path: None,
@@ -4271,7 +4333,7 @@ mod tests {
                 .expect("should be object");
             assert_eq!(
                 obj.get("hb_adid").and_then(|v| v.as_str()),
-                Some("aps-bid-token"),
+                Some("ordinary-ad-id"),
                 "should fall back to ad_id when cache_id absent"
             );
             assert!(
@@ -4295,12 +4357,15 @@ mod tests {
                     currency: "USD".to_string(),
                     creative: None,
                     adomain: None,
-                    bidder: "amazon-aps".to_string(),
+                    bidder: "ordinary".to_string(),
                     width: 300,
                     height: 250,
                     nurl: None,
                     burl: None,
+                    bid_id: None,
                     ad_id: None,
+                    creative_id: None,
+                    renderer: None,
                     cache_id: None,
                     cache_host: None,
                     cache_path: None,
@@ -4335,7 +4400,10 @@ mod tests {
                     height: 250,
                     nurl: None,
                     burl: None,
+                    bid_id: None,
                     ad_id: None,
+                    creative_id: None,
+                    renderer: None,
                     cache_id: None,
                     cache_host: None,
                     cache_path: None,
diff --git a/crates/trusted-server-integration-tests/README.md b/crates/trusted-server-integration-tests/README.md
index e7263755d..1aa43cee4 100644
--- a/crates/trusted-server-integration-tests/README.md
+++ b/crates/trusted-server-integration-tests/README.md
@@ -142,6 +142,7 @@ Playwright directly.
 |---|---|
 | `script-injection` | `script#trustedserver-js` present in live DOM, no console errors |
 | `script-bundle` | JS bundle loads with 200, no parse/runtime errors, correct content type |
+| `aps-renderer` | Static route nonce gating, restrictive CSP, replay rejection, and opaque iframe/script isolation |
 
 ### Browser-level — Next.js
 
diff --git a/crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts b/crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts
new file mode 100644
index 000000000..bbefc7dfb
--- /dev/null
+++ b/crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts
@@ -0,0 +1,614 @@
+import { expect, test } from "@playwright/test";
+import { runtimeUrl } from "../../helpers/state.js";
+
+const RUNNER_URL = "https://client.aps.amazon-adsystem.com/prebid-creative.js";
+const IFRAME_CREATIVE_URL = "https://creative.example/iframe";
+const SCRIPT_CREATIVE_URL = "https://creative.example/script.js";
+const SANDBOX =
+    "allow-forms allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-scripts allow-top-navigation-by-user-activation";
+
+function descriptor(
+    tagType: "iframe" | "script",
+    creativeUrl =
+        tagType === "iframe" ? IFRAME_CREATIVE_URL : SCRIPT_CREATIVE_URL,
+) {
+    const envelope = {
+        seatbid: [
+            {
+                bid: [
+                    {
+                        id: `fictional-${tagType}-bid`,
+                        price: 1.23,
+                        w: 300,
+                        h: 250,
+                        ext: { creativeurl: creativeUrl, tagtype: tagType },
+                    },
+                ],
+            },
+        ],
+    };
+    return {
+        type: "aps",
+        version: 1,
+        accountId: "example-account-id",
+        bidId: `fictional-${tagType}-bid`,
+        creativeId: `fictional-${tagType}-creative`,
+        tagType,
+        creativeUrl,
+        aaxResponse: Buffer.from(JSON.stringify(envelope), "utf8").toString(
+            "base64",
+        ),
+        width: 300,
+        height: 250,
+    };
+}
+
+function testPage(rendererUrl: string) {
+    return `<!doctype html>
+<meta charset="utf-8">
+<div id="slots"></div>
+<script>
+window.apsMessages = [];
+window.startApsFrame = function(options) {
+  var slot = document.createElement('div');
+  slot.id = options.slotId;
+  slot.innerHTML = '<span class="existing">existing publisher content</span>';
+  document.getElementById('slots').appendChild(slot);
+
+  var frame = document.createElement('iframe');
+  frame.width = '300';
+  frame.height = '250';
+  frame.style.display = 'none';
+  if (!options.omitSandbox) {
+    frame.setAttribute('sandbox', ${JSON.stringify(SANDBOX)});
+  }
+  frame.src = ${JSON.stringify(rendererUrl)} +
+    (options.includeFragment === false ? '' : '#tsaps=' + options.fragmentNonce);
+
+  function receive(event) {
+    if (event.source !== frame.contentWindow || !event.data) return;
+    window.apsMessages.push({ slotId: options.slotId, data: event.data });
+    if (event.data.message === 'trusted-server/aps/renderer-ready' &&
+        event.data.nonce === options.fragmentNonce) {
+      var existing = slot.querySelector('.existing');
+      if (existing) existing.remove();
+      frame.style.display = '';
+    }
+  }
+  window.addEventListener('message', receive);
+  frame.onload = function() {
+    frame.contentWindow.postMessage({
+      nonce: options.messageNonce,
+      renderer: options.renderer
+    }, '*');
+  };
+  slot.appendChild(frame);
+};
+</script>`;
+}
+
+const FAKE_RUNNER = `(function(){
+  var runnerRead = false;
+  var runnerWrite = false;
+  try { void top.document.body; runnerRead = true; } catch (_error) {}
+  try { top.document.body.dataset.apsCompromised = 'runner'; runnerWrite = true; } catch (_error) {}
+  parent.postMessage({
+    message: 'fictional-runner-security',
+    runnerRead: runnerRead,
+    runnerWrite: runnerWrite,
+    accountMap: window._aps instanceof Map
+  }, '*');
+
+  addEventListener('message', function(event) {
+    if (event.data && event.data.message === 'fictional-creative-security') {
+      parent.postMessage(event.data, '*');
+    }
+  });
+
+  window._aps.forEach(function(account) {
+    var events = account.queue.splice(0);
+    events.forEach(function(event) {
+      var response = JSON.parse(atob(event.detail.aaxResponse));
+      var bid = response.seatbid[0].bid[0];
+      if (bid.ext.tagtype === 'iframe') {
+        var frame = document.createElement('iframe');
+        frame.setAttribute('sandbox', 'allow-scripts allow-same-origin');
+        frame.src = bid.ext.creativeurl;
+        document.body.appendChild(frame);
+      } else {
+        var script = document.createElement('script');
+        script.src = bid.ext.creativeurl;
+        document.head.appendChild(script);
+      }
+    });
+  });
+})();`;
+
+const IFRAME_CREATIVE = `<!doctype html><script>
+var creativeRead = false;
+var creativeWrite = false;
+try { void top.document.body; creativeRead = true; } catch (_error) {}
+try { top.document.body.dataset.apsCompromised = 'iframe'; creativeWrite = true; } catch (_error) {}
+parent.postMessage({
+  message: 'fictional-creative-security',
+  tagType: 'iframe',
+  creativeRead: creativeRead,
+  creativeWrite: creativeWrite
+}, '*');
+<\/script>`;
+
+const SCRIPT_CREATIVE = `(function(){
+  var creativeRead = false;
+  var creativeWrite = false;
+  try { void top.document.body; creativeRead = true; } catch (_error) {}
+  try { top.document.body.dataset.apsCompromised = 'script'; creativeWrite = true; } catch (_error) {}
+  parent.postMessage({
+    message: 'fictional-creative-security',
+    tagType: 'script',
+    creativeRead: creativeRead,
+    creativeWrite: creativeWrite
+  }, '*');
+})();`;
+
+test.describe("APS opaque renderer", () => {
+    test("enforces nonce gating and isolates iframe and script behavior under restrictive CSP", async ({
+        page,
+    }) => {
+        const rendererResponse = await page.request.get(
+            runtimeUrl("/integrations/aps/renderer"),
+        );
+        expect(rendererResponse.status()).toBe(200);
+        expect(rendererResponse.headers()["content-type"]).toContain(
+            "text/html",
+        );
+        const rendererCsp =
+            rendererResponse.headers()["content-security-policy"];
+        expect(rendererCsp).toContain("default-src 'none'");
+        expect(rendererCsp).toContain("sandbox allow-forms");
+        expect(rendererCsp).not.toContain("allow-same-origin");
+        expect(rendererResponse.headers()["referrer-policy"]).toBe(
+            "no-referrer",
+        );
+
+        let runnerRequests = 0;
+        await page.route(RUNNER_URL, async (route) => {
+            runnerRequests += 1;
+            await route.fulfill({
+                status: 200,
+                contentType: "application/javascript",
+                body: FAKE_RUNNER,
+            });
+        });
+        await page.route(IFRAME_CREATIVE_URL, async (route) => {
+            await route.fulfill({
+                status: 200,
+                contentType: "text/html",
+                body: IFRAME_CREATIVE,
+            });
+        });
+        await page.route(SCRIPT_CREATIVE_URL, async (route) => {
+            await route.fulfill({
+                status: 200,
+                contentType: "application/javascript",
+                body: SCRIPT_CREATIVE,
+            });
+        });
+        await page.route(runtimeUrl("/aps-security-test"), async (route) => {
+            await route.fulfill({
+                status: 200,
+                contentType: "text/html",
+                headers: {
+                    "Content-Security-Policy":
+                        "default-src 'none'; script-src 'unsafe-inline'; frame-src 'self'",
+                },
+                body: testPage(
+                    runtimeUrl("/integrations/aps/renderer"),
+                ),
+            });
+        });
+
+        await page.goto(runtimeUrl("/aps-security-test"));
+
+        const validNonce = "ABCDEFGHIJKLMNOPQRSTUV";
+        await page.evaluate(
+            ({ renderer, nonce }) => {
+                (
+                    window as unknown as {
+                        startApsFrame(options: Record<string, unknown>): void;
+                    }
+                ).startApsFrame({
+                    slotId: "iframe-slot",
+                    fragmentNonce: nonce,
+                    messageNonce: nonce,
+                    renderer,
+                });
+            },
+            { renderer: descriptor("iframe"), nonce: validNonce },
+        );
+
+        await expect
+            .poll(async () =>
+                page.evaluate(() =>
+                    (
+                        window as unknown as {
+                            apsMessages: Array<{ data: { message?: string } }>;
+                        }
+                    ).apsMessages.some(
+                        ({ data }) =>
+                            data.message === "fictional-creative-security",
+                    ),
+                ),
+            )
+            .toBe(true);
+        await expect(page.locator("#iframe-slot .existing")).toHaveCount(0);
+
+        const validState = await page.evaluate(() => {
+            const frame = document.querySelector<HTMLIFrameElement>(
+                "#iframe-slot iframe",
+            )!;
+            const messages = (
+                window as unknown as {
+                    apsMessages: Array<{ data: Record<string, unknown> }>;
+                }
+            ).apsMessages.map(({ data }) => data);
+            let publisherCanReadFrame = false;
+            try {
+                publisherCanReadFrame = Boolean(
+                    frame.contentWindow?.document.body,
+                );
+            } catch (_error) {
+                publisherCanReadFrame = false;
+            }
+            return {
+                existing: Boolean(
+                    document.querySelector("#iframe-slot .existing"),
+                ),
+                sandbox: frame.getAttribute("sandbox"),
+                publisherCanReadFrame,
+                compromised: document.body.dataset.apsCompromised,
+                messages,
+            };
+        });
+
+        expect(validState.existing).toBe(false);
+        expect(validState.sandbox).toBe(SANDBOX);
+        expect(validState.sandbox).not.toContain("allow-same-origin");
+        expect(validState.publisherCanReadFrame).toBe(false);
+        expect(validState.compromised).toBeUndefined();
+        expect(validState.messages).toContainEqual(
+            expect.objectContaining({
+                message: "fictional-runner-security",
+                runnerRead: false,
+                runnerWrite: false,
+                accountMap: true,
+            }),
+        );
+        expect(validState.messages).toContainEqual(
+            expect.objectContaining({
+                message: "fictional-creative-security",
+                tagType: "iframe",
+                creativeRead: false,
+                creativeWrite: false,
+            }),
+        );
+
+        const cspNonce = "csp-sandbox-0123456789";
+        await page.evaluate(
+            ({ renderer, nonce }) => {
+                (
+                    window as unknown as {
+                        startApsFrame(options: Record<string, unknown>): void;
+                    }
+                ).startApsFrame({
+                    slotId: "csp-sandbox-slot",
+                    fragmentNonce: nonce,
+                    messageNonce: nonce,
+                    omitSandbox: true,
+                    renderer,
+                });
+            },
+            { renderer: descriptor("script"), nonce: cspNonce },
+        );
+        await expect
+            .poll(async () =>
+                page.evaluate(() =>
+                    (
+                        window as unknown as {
+                            apsMessages: Array<{
+                                slotId: string;
+                                data: Record<string, unknown>;
+                            }>;
+                        }
+                    ).apsMessages.some(
+                        ({ slotId, data }) =>
+                            slotId === "csp-sandbox-slot" &&
+                            data.message === "fictional-creative-security" &&
+                            data.tagType === "script",
+                    ),
+                ),
+            )
+            .toBe(true);
+        await expect(page.locator("#csp-sandbox-slot .existing")).toHaveCount(
+            0,
+        );
+        const cspState = await page.evaluate(() => {
+            const frame = document.querySelector<HTMLIFrameElement>(
+                "#csp-sandbox-slot iframe",
+            )!;
+            let publisherCanReadFrame = false;
+            try {
+                publisherCanReadFrame = Boolean(
+                    frame.contentWindow?.document.body,
+                );
+            } catch (_error) {
+                publisherCanReadFrame = false;
+            }
+            return {
+                sandbox: frame.getAttribute("sandbox"),
+                existing: Boolean(
+                    document.querySelector("#csp-sandbox-slot .existing"),
+                ),
+                publisherCanReadFrame,
+                compromised: document.body.dataset.apsCompromised,
+                messages: (
+                    window as unknown as {
+                        apsMessages: Array<{
+                            slotId: string;
+                            data: Record<string, unknown>;
+                        }>;
+                    }
+                ).apsMessages
+                    .filter(({ slotId }) => slotId === "csp-sandbox-slot")
+                    .map(({ data }) => data),
+            };
+        });
+        expect(cspState.sandbox).toBeNull();
+        expect(cspState.existing).toBe(false);
+        expect(cspState.publisherCanReadFrame).toBe(false);
+        expect(cspState.compromised).toBeUndefined();
+        expect(cspState.messages).toContainEqual(
+            expect.objectContaining({
+                message: "fictional-runner-security",
+                runnerRead: false,
+                runnerWrite: false,
+            }),
+        );
+        expect(cspState.messages).toContainEqual(
+            expect.objectContaining({
+                message: "fictional-creative-security",
+                tagType: "script",
+                creativeRead: false,
+                creativeWrite: false,
+            }),
+        );
+
+        const messagesBeforeReplay = await page.evaluate(
+            () =>
+                (
+                    window as unknown as {
+                        apsMessages: Array<{ data: Record<string, unknown> }>;
+                    }
+                ).apsMessages.length,
+        );
+        await page.evaluate(
+            ({ renderer, nonce }) => {
+                const frame = document.querySelector<HTMLIFrameElement>(
+                    "#iframe-slot iframe",
+                )!;
+                frame.contentWindow!.postMessage({ nonce, renderer }, "*");
+            },
+            { renderer: descriptor("iframe"), nonce: validNonce },
+        );
+        await page.waitForTimeout(100);
+        expect(
+            await page.evaluate(
+                () =>
+                    (
+                        window as unknown as {
+                            apsMessages: Array<{
+                                data: Record<string, unknown>;
+                            }>;
+                        }
+                    ).apsMessages.length,
+            ),
+        ).toBe(messagesBeforeReplay);
+
+        const requestsBeforeInvalid = runnerRequests;
+        const wrongNonce = "ZYXWVUTSRQPONMLKJIHGFE";
+        await page.evaluate(
+            ({ renderer, fragmentNonce, messageNonce }) => {
+                (
+                    window as unknown as {
+                        startApsFrame(options: Record<string, unknown>): void;
+                    }
+                ).startApsFrame({
+                    slotId: "mismatch-slot",
+                    fragmentNonce,
+                    messageNonce,
+                    renderer,
+                });
+            },
+            {
+                renderer: descriptor("iframe"),
+                fragmentNonce: validNonce,
+                messageNonce: wrongNonce,
+            },
+        );
+        await page.waitForTimeout(100);
+        expect(runnerRequests).toBe(requestsBeforeInvalid);
+        await expect(page.locator("#mismatch-slot .existing")).toHaveCount(1);
+
+        await page.evaluate(
+            ({ renderer, nonce }) => {
+                (
+                    window as unknown as {
+                        startApsFrame(options: Record<string, unknown>): void;
+                    }
+                ).startApsFrame({
+                    slotId: "missing-fragment-slot",
+                    fragmentNonce: nonce,
+                    messageNonce: nonce,
+                    includeFragment: false,
+                    renderer,
+                });
+            },
+            { renderer: descriptor("iframe"), nonce: validNonce },
+        );
+        await page.waitForTimeout(100);
+        expect(runnerRequests).toBe(requestsBeforeInvalid);
+        await expect(
+            page.locator("#missing-fragment-slot .existing"),
+        ).toHaveCount(1);
+
+        await page.evaluate(
+            ({ renderer, nonce }) => {
+                (
+                    window as unknown as {
+                        startApsFrame(options: Record<string, unknown>): void;
+                    }
+                ).startApsFrame({
+                    slotId: "malformed-slot",
+                    fragmentNonce: nonce,
+                    messageNonce: nonce,
+                    renderer: { ...renderer, unexpected: true },
+                });
+            },
+            { renderer: descriptor("iframe"), nonce: wrongNonce },
+        );
+        await page.waitForTimeout(100);
+        expect(runnerRequests).toBe(requestsBeforeInvalid);
+        await expect(page.locator("#malformed-slot .existing")).toHaveCount(1);
+
+        const scriptNonce = "0123456789abcdefghijkl";
+        await page.evaluate(
+            ({ renderer, nonce }) => {
+                (
+                    window as unknown as {
+                        startApsFrame(options: Record<string, unknown>): void;
+                    }
+                ).startApsFrame({
+                    slotId: "script-slot",
+                    fragmentNonce: nonce,
+                    messageNonce: nonce,
+                    renderer,
+                });
+            },
+            { renderer: descriptor("script"), nonce: scriptNonce },
+        );
+
+        await expect
+            .poll(async () =>
+                page.evaluate(() =>
+                    (
+                        window as unknown as {
+                            apsMessages: Array<{
+                                data: Record<string, unknown>;
+                            }>;
+                        }
+                    ).apsMessages.some(
+                        ({ data }) =>
+                            data.message === "fictional-creative-security" &&
+                            data.tagType === "script",
+                    ),
+                ),
+            )
+            .toBe(true);
+        await expect(page.locator("#script-slot .existing")).toHaveCount(0);
+
+        const scriptState = await page.evaluate(() => ({
+            existing: Boolean(document.querySelector("#script-slot .existing")),
+            compromised: document.body.dataset.apsCompromised,
+            scriptSecurity: (
+                window as unknown as {
+                    apsMessages: Array<{ data: Record<string, unknown> }>;
+                }
+            ).apsMessages.find(
+                ({ data }) =>
+                    data.message === "fictional-creative-security" &&
+                    data.tagType === "script",
+            )?.data,
+        }));
+        expect(scriptState.existing).toBe(false);
+        expect(scriptState.compromised).toBeUndefined();
+        expect(scriptState.scriptSecurity).toEqual(
+            expect.objectContaining({
+                creativeRead: false,
+                creativeWrite: false,
+            }),
+        );
+    });
+
+    test("rejects same-origin creative URLs during static validation", async ({
+        page,
+    }) => {
+        const publisherOrigin = "https://publisher.example";
+        const rendererUrl = `${publisherOrigin}/integrations/aps/renderer`;
+        const testUrl = `${publisherOrigin}/aps-same-origin-test`;
+        const runtimeRenderer = await page.request.get(
+            runtimeUrl("/integrations/aps/renderer"),
+        );
+        const rendererDocument = await runtimeRenderer.text();
+        let runnerRequests = 0;
+
+        await page.route(RUNNER_URL, async (route) => {
+            runnerRequests += 1;
+            await route.fulfill({
+                status: 200,
+                contentType: "application/javascript",
+                body: FAKE_RUNNER,
+            });
+        });
+        await page.route(rendererUrl, async (route) => {
+            await route.fulfill({
+                status: 200,
+                contentType: "text/html",
+                headers: {
+                    "Content-Security-Policy":
+                        runtimeRenderer.headers()["content-security-policy"],
+                    "Referrer-Policy": "no-referrer",
+                },
+                body: rendererDocument,
+            });
+        });
+        await page.route(testUrl, async (route) => {
+            await route.fulfill({
+                status: 200,
+                contentType: "text/html",
+                headers: {
+                    "Content-Security-Policy":
+                        "default-src 'none'; script-src 'unsafe-inline'; frame-src 'self'",
+                },
+                body: testPage(rendererUrl),
+            });
+        });
+
+        await page.goto(testUrl);
+        const nonce = "same-origin-0123456789";
+        await page.evaluate(
+            ({ renderer, nonce }) => {
+                (
+                    window as unknown as {
+                        startApsFrame(options: Record<string, unknown>): void;
+                    }
+                ).startApsFrame({
+                    slotId: "same-origin-slot",
+                    fragmentNonce: nonce,
+                    messageNonce: nonce,
+                    omitSandbox: true,
+                    renderer,
+                });
+            },
+            {
+                renderer: descriptor(
+                    "script",
+                    `${publisherOrigin}/fictional-same-origin.js`,
+                ),
+                nonce,
+            },
+        );
+
+        await page.waitForTimeout(100);
+        expect(runnerRequests).toBe(0);
+        await expect(page.locator("#same-origin-slot .existing")).toHaveCount(1);
+    });
+});
diff --git a/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml b/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml
index d6b436a9f..96616e6f5 100644
--- a/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml
+++ b/crates/trusted-server-integration-tests/fixtures/configs/trusted-server.integration.toml
@@ -100,10 +100,11 @@ timeout_ms = 2000
 allowed_context_keys = []
 
 [integrations.aps]
-enabled = false
-pub_id = "example-aps-publisher-id"
-endpoint = "https://aps.example.com/e/dtb/bid"
+enabled = true
+account_id = "example-aps-account-id"
+endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
 timeout_ms = 1000
+allow_script_creatives = false
 
 [integrations.google_tag_manager]
 enabled = false
diff --git a/crates/trusted-server-js/lib/src/core/auction.ts b/crates/trusted-server-js/lib/src/core/auction.ts
index 40f54367a..a02684362 100644
--- a/crates/trusted-server-js/lib/src/core/auction.ts
+++ b/crates/trusted-server-js/lib/src/core/auction.ts
@@ -1,8 +1,11 @@
 // Shared auction module: builds AdRequest payloads, sends them to /auction,
-// and parses OpenRTB seatbid responses.  Used by both the core requestAds flow
+// and parses OpenRTB seatbid responses. Used by both the core requestAds flow
 // and the Prebid.js trustedServer adapter.
 
+import { parseApsRendererDescriptor } from '../integrations/aps/render';
+
 import { log } from './log';
+import type { ApsRendererV1 } from './types';
 
 // ---------------------------------------------------------------------------
 // Types
@@ -43,6 +46,8 @@ export interface AuctionBid {
   impid: string;
   /** Creative HTML (already rewritten with proxy URLs by the server). */
   adm: string;
+  /** Typed APS renderer descriptor, when the bid does not carry `adm`. */
+  renderer?: ApsRendererV1;
   /** CPM price. */
   price: number;
   /** Creative width. */
@@ -71,31 +76,31 @@ export interface AuctionBid {
 export function buildAdRequest(units: any[], options?: { eids?: AuctionEid[] }): AdRequest {
   const unitMap = new Map<string, AdRequestUnit>();
 
-  for (const u of units) {
-    const code: string = u.adUnitCode ?? u.code ?? '';
+  for (const unit of units) {
+    const code: string = unit.adUnitCode ?? unit.code ?? '';
     if (!unitMap.has(code)) {
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       const mediaTypes: any = {};
-      if (u.mediaTypes?.banner) {
+      if (unit.mediaTypes?.banner) {
         mediaTypes.banner = {
-          sizes: u.mediaTypes.banner.sizes ?? u.sizes ?? [],
+          sizes: unit.mediaTypes.banner.sizes ?? unit.sizes ?? [],
         };
       }
       unitMap.set(code, { code, mediaTypes, bids: [] });
     }
 
     // If the source object carries a `bidder` field (Prebid BidRequest style),
-    // add it as a bid entry.  Otherwise copy the existing `bids` array.
-    if (u.bidder) {
+    // add it as a bid entry. Otherwise copy the existing `bids` array.
+    if (unit.bidder) {
       unitMap.get(code)!.bids.push({
-        bidder: u.bidder,
-        params: u.params ?? {},
+        bidder: unit.bidder,
+        params: unit.params ?? {},
       });
-    } else if (Array.isArray(u.bids)) {
-      for (const b of u.bids) {
+    } else if (Array.isArray(unit.bids)) {
+      for (const bid of unit.bids) {
         unitMap.get(code)!.bids.push({
-          bidder: b.bidder ?? '',
-          params: b.params ?? {},
+          bidder: bid.bidder ?? '',
+          params: bid.params ?? {},
         });
       }
     }
@@ -115,10 +120,8 @@ export function buildAdRequest(units: any[], options?: { eids?: AuctionEid[] }):
 /**
  * Parse an OpenRTB-style response body into a flat array of {@link AuctionBid}.
  *
- * Expected shape:
- * ```json
- * { "seatbid": [{ "seat": "bidder", "bid": [{ "impid", "price", "adm", ... }] }] }
- * ```
+ * Parsing the renderer here is intentionally structural. The exact decoded
+ * APS envelope is validated immediately before any DOM or message side effect.
  */
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export function parseAuctionResponse(body: any): AuctionBid[] {
@@ -126,26 +129,34 @@ export function parseAuctionResponse(body: any): AuctionBid[] {
   const seatbids = body?.seatbid;
   if (!Array.isArray(seatbids)) return bids;
 
-  for (const sb of seatbids) {
-    const seat: string = sb.seat ?? 'unknown';
-    const sbBids = sb.bid;
-    if (!Array.isArray(sbBids)) continue;
-
-    for (const b of sbBids) {
-      // Coerce missing/null adm to '' so AuctionBid.adm is always a string.
-      // The empty-string case is filtered in renderCreativeInline via the
-      // `if (!bid.adm)` guard. The client-side `typeof !== 'string'` check in
-      // sanitizeCreativeHtml is a second line of defense for callers that bypass
-      // parseAuctionResponse and pass untrusted values directly.
+  for (const seatbid of seatbids) {
+    const seat: string = typeof seatbid?.seat === 'string' ? seatbid.seat : 'unknown';
+    const seatBids = seatbid?.bid;
+    if (!Array.isArray(seatBids)) continue;
+
+    for (const bid of seatBids) {
+      const impid = typeof bid?.impid === 'string' ? bid.impid : '';
+      const renderer = parseApsRendererDescriptor(bid?.ext?.trusted_server?.renderer);
+      const width = typeof bid?.w === 'number' ? bid.w : (renderer?.width ?? 300);
+      const height = typeof bid?.h === 'number' ? bid.h : (renderer?.height ?? 250);
+      const creativeId =
+        typeof bid?.crid === 'string' ? bid.crid : (renderer?.creativeId ?? `${seat}-${impid}`);
+
       bids.push({
-        impid: b.impid ?? '',
-        adm: b.adm ?? '',
-        price: b.price ?? 0,
-        width: b.w ?? 300,
-        height: b.h ?? 250,
+        impid,
+        // Preserve non-string untrusted values so the render-time sanitizer
+        // rejects them explicitly instead of silently converting them to an
+        // empty no-op creative.
+        adm: bid?.adm ?? '',
+        ...(renderer ? { renderer } : {}),
+        price: typeof bid?.price === 'number' ? bid.price : 0,
+        width,
+        height,
         seat,
-        creativeId: b.crid ?? `${seat}-${b.impid ?? ''}`,
-        adomain: Array.isArray(b.adomain) ? b.adomain : [],
+        creativeId,
+        adomain: Array.isArray(bid?.adomain)
+          ? bid.adomain.filter((domain: unknown): domain is string => typeof domain === 'string')
+          : [],
       });
     }
   }
@@ -170,7 +181,7 @@ export async function sendAuction(endpoint: string, request: AdRequest): Promise
   log.info('auction: sending request', { endpoint, units: request.adUnits.length });
 
   try {
-    const res = await fetch(endpoint, {
+    const response = await fetch(endpoint, {
       method: 'POST',
       headers: { 'content-type': 'application/json' },
       credentials: 'same-origin',
@@ -178,18 +189,22 @@ export async function sendAuction(endpoint: string, request: AdRequest): Promise
       keepalive: true,
     });
 
-    const ct = res.headers.get('content-type') || '';
-    if (res.ok && ct.includes('application/json')) {
-      const data: unknown = await res.json();
+    const contentType = response.headers.get('content-type') || '';
+    if (response.ok && contentType.includes('application/json')) {
+      const data: unknown = await response.json();
       const bids = parseAuctionResponse(data);
       log.info('auction: received bids', { count: bids.length });
       return bids;
     }
 
-    log.warn('auction: unexpected response', { ok: res.ok, status: res.status, ct });
+    log.warn('auction: unexpected response', {
+      ok: response.ok,
+      status: response.status,
+      ct: contentType,
+    });
     return [];
-  } catch (err) {
-    log.warn('auction: request failed', err);
+  } catch (error) {
+    log.warn('auction: request failed', error);
     return [];
   }
 }
diff --git a/crates/trusted-server-js/lib/src/core/request.ts b/crates/trusted-server-js/lib/src/core/request.ts
index e39300a14..ae352c58a 100644
--- a/crates/trusted-server-js/lib/src/core/request.ts
+++ b/crates/trusted-server-js/lib/src/core/request.ts
@@ -1,9 +1,11 @@
 // Request orchestration for tsjs: unified auction endpoint with iframe-based creative rendering.
-import { log } from './log';
+import { renderApsCreative } from '../integrations/aps/render';
+
+import { buildAdRequest, sendAuction } from './auction';
 import { collectContext } from './context';
+import { log } from './log';
 import { getAllUnits, firstSize } from './registry';
 import { createAdIframe, findSlot, buildCreativeDocument, sanitizeCreativeHtml } from './render';
-import { buildAdRequest, sendAuction } from './auction';
 
 export type RequestAdsCallback = () => void;
 export interface RequestAdsOptions {
@@ -49,6 +51,10 @@ export function requestAds(
         log.info('requestAds: got bids', { count: bids.length });
         for (const bid of bids) {
           if (!bid.impid) continue;
+          if (bid.renderer) {
+            renderApsCreative({ slotId: bid.impid, renderer: bid.renderer });
+            continue;
+          }
           if (!bid.adm) {
             log.debug('requestAds: bid has no adm, skipping', { slotId: bid.impid });
             continue;
diff --git a/crates/trusted-server-js/lib/src/core/types.ts b/crates/trusted-server-js/lib/src/core/types.ts
index 360e2aa49..ffa5c1ed3 100644
--- a/crates/trusted-server-js/lib/src/core/types.ts
+++ b/crates/trusted-server-js/lib/src/core/types.ts
@@ -41,13 +41,33 @@ export interface AuctionDebugBidData {
   height?: number;
   nurl?: string | null;
   burl?: string | null;
+  bid_id?: string | null;
   ad_id?: string | null;
+  creative_id?: string | null;
   cache_id?: string | null;
   cache_host?: string | null;
   cache_path?: string | null;
   metadata?: Record<string, unknown>;
 }
 
+export type ApsTagType = 'iframe' | 'script';
+
+/** Version 1 Trusted Server APS renderer descriptor. */
+export interface ApsRendererV1 {
+  type: 'aps';
+  version: 1;
+  accountId: string;
+  bidId: string;
+  creativeId?: string;
+  tagType: ApsTagType;
+  creativeUrl: string;
+  aaxResponse: string;
+  width: number;
+  height: number;
+}
+
+export type AuctionBidRenderer = ApsRendererV1;
+
 /** Bid targeting data from the server-side auction, injected into `window.tsjs.bids`. */
 export interface AuctionBidData {
   hb_pb?: string;
@@ -57,6 +77,8 @@ export interface AuctionBidData {
   hb_cache_path?: string;
   nurl?: string;
   burl?: string;
+  /** Typed winning-bid renderer capability. */
+  renderer?: AuctionBidRenderer;
   /** Raw creative markup. Only present when `[debug] inject_adm_for_testing = true`. */
   adm?: string;
   /** Debug-only bid field mirror. Only present when `[debug] inject_adm_for_testing = true`. */
diff --git a/crates/trusted-server-js/lib/src/integrations/aps/render.ts b/crates/trusted-server-js/lib/src/integrations/aps/render.ts
new file mode 100644
index 000000000..f9e6b03b9
--- /dev/null
+++ b/crates/trusted-server-js/lib/src/integrations/aps/render.ts
@@ -0,0 +1,301 @@
+import { log } from '../../core/log';
+import type { ApsRendererV1 } from '../../core/types';
+
+export const APS_RENDERER_PATH = '/integrations/aps/renderer';
+export const APS_RENDERER_SANDBOX =
+  'allow-forms allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-scripts allow-top-navigation-by-user-activation';
+export const APS_UNIVERSAL_CREATIVE_RENDERER_VERSION = 4;
+
+const MAX_ACCOUNT_ID_BYTES = 1024;
+const MAX_CREATIVE_URL_BYTES = 4096;
+const MAX_RENDER_ENVELOPE_BYTES = 256 * 1024;
+const MAX_RENDER_ENVELOPE_BASE64_BYTES = 4 * Math.ceil(MAX_RENDER_ENVELOPE_BYTES / 3);
+const DESCRIPTOR_KEYS = [
+  'aaxResponse',
+  'accountId',
+  'bidId',
+  'creativeUrl',
+  'height',
+  'tagType',
+  'type',
+  'version',
+  'width',
+] as const;
+const DESCRIPTOR_KEYS_WITH_CREATIVE_ID = [...DESCRIPTOR_KEYS, 'creativeId'].sort();
+const activeFrames = new WeakMap<HTMLElement, HTMLIFrameElement>();
+const RENDERER_READY_MESSAGE = 'trusted-server/aps/renderer-ready';
+const RENDERER_FAILED_MESSAGE = 'trusted-server/aps/renderer-failed';
+const RENDERER_READY_TIMEOUT_MS = 10_000;
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function hasExactKeys(
+  value: unknown,
+  expected: readonly string[]
+): value is Record<string, unknown> {
+  if (!isRecord(value)) return false;
+  const actual = Object.keys(value).sort();
+  const sortedExpected = [...expected].sort();
+  return (
+    actual.length === sortedExpected.length &&
+    actual.every((key, index) => key === sortedExpected[index])
+  );
+}
+
+/** Parse only the versioned descriptor shape; decoded-envelope trust checks happen separately. */
+export function parseApsRendererDescriptor(value: unknown): ApsRendererV1 | undefined {
+  if (
+    !hasExactKeys(value, DESCRIPTOR_KEYS) &&
+    !hasExactKeys(value, DESCRIPTOR_KEYS_WITH_CREATIVE_ID)
+  ) {
+    return undefined;
+  }
+
+  if (
+    value.type !== 'aps' ||
+    value.version !== 1 ||
+    typeof value.accountId !== 'string' ||
+    value.accountId.length === 0 ||
+    new TextEncoder().encode(value.accountId).length > MAX_ACCOUNT_ID_BYTES ||
+    typeof value.bidId !== 'string' ||
+    value.bidId.length === 0 ||
+    (Object.prototype.hasOwnProperty.call(value, 'creativeId') &&
+      (typeof value.creativeId !== 'string' || value.creativeId.length === 0)) ||
+    (value.tagType !== 'iframe' && value.tagType !== 'script') ||
+    typeof value.creativeUrl !== 'string' ||
+    typeof value.aaxResponse !== 'string' ||
+    value.aaxResponse.length > MAX_RENDER_ENVELOPE_BASE64_BYTES ||
+    !Number.isSafeInteger(value.width) ||
+    (value.width as number) <= 0 ||
+    !Number.isSafeInteger(value.height) ||
+    (value.height as number) <= 0
+  ) {
+    return undefined;
+  }
+
+  return value as unknown as ApsRendererV1;
+}
+
+function decodeStandardBase64(value: string): Uint8Array | undefined {
+  if (
+    value.length === 0 ||
+    value.length % 4 !== 0 ||
+    !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)
+  ) {
+    return undefined;
+  }
+
+  try {
+    const binary = atob(value);
+    if (binary.length > MAX_RENDER_ENVELOPE_BYTES) return undefined;
+    return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+  } catch {
+    return undefined;
+  }
+}
+
+function validCreativeUrl(value: string, publisherOrigin: string): boolean {
+  if (new TextEncoder().encode(value).length > MAX_CREATIVE_URL_BYTES) return false;
+
+  try {
+    const url = new URL(value);
+    return (
+      url.protocol === 'https:' &&
+      url.username === '' &&
+      url.password === '' &&
+      url.origin !== publisherOrigin
+    );
+  } catch {
+    return false;
+  }
+}
+
+/** Fully validate the exact APS envelope and cross-check every duplicated descriptor field. */
+export function validateApsRenderer(
+  value: unknown,
+  publisherOrigin = window.location.origin
+): ApsRendererV1 | undefined {
+  const renderer = parseApsRendererDescriptor(value);
+  if (!renderer || !validCreativeUrl(renderer.creativeUrl, publisherOrigin)) return undefined;
+
+  const bytes = decodeStandardBase64(renderer.aaxResponse);
+  if (!bytes) return undefined;
+
+  let decoded: unknown;
+  try {
+    decoded = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+  } catch {
+    return undefined;
+  }
+
+  if (!hasExactKeys(decoded, ['seatbid'])) return undefined;
+  const seatbids = decoded.seatbid;
+  if (!Array.isArray(seatbids) || seatbids.length !== 1) return undefined;
+  const seat = seatbids[0];
+  if (!hasExactKeys(seat, ['bid']) || !Array.isArray(seat.bid) || seat.bid.length !== 1) {
+    return undefined;
+  }
+
+  const bid = seat.bid[0];
+  if (!hasExactKeys(bid, ['ext', 'h', 'id', 'price', 'w'])) return undefined;
+  if (!hasExactKeys(bid.ext, ['creativeurl', 'tagtype'])) return undefined;
+
+  if (
+    bid.id !== renderer.bidId ||
+    bid.w !== renderer.width ||
+    bid.h !== renderer.height ||
+    bid.ext.creativeurl !== renderer.creativeUrl ||
+    bid.ext.tagtype !== renderer.tagType ||
+    typeof bid.price !== 'number' ||
+    !Number.isFinite(bid.price) ||
+    bid.price < 0
+  ) {
+    return undefined;
+  }
+
+  return renderer;
+}
+
+function createNonce(): string | undefined {
+  if (typeof crypto === 'undefined' || typeof crypto.getRandomValues !== 'function')
+    return undefined;
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  let binary = '';
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+}
+
+/** Return the absolute, same-publisher URL used by direct and Universal Creative rendering. */
+export function apsRendererUrl(pageOrigin = window.location.origin): string | undefined {
+  try {
+    const origin = new URL(pageOrigin);
+    const url = new URL(APS_RENDERER_PATH, origin);
+    if (
+      url.origin !== origin.origin ||
+      url.pathname !== APS_RENDERER_PATH ||
+      url.search !== '' ||
+      url.hash !== ''
+    ) {
+      return undefined;
+    }
+    return url.href;
+  } catch {
+    return undefined;
+  }
+}
+
+export interface RenderApsCreativeOptions {
+  slotId: string;
+  renderer: unknown;
+}
+
+/** Render APS through the static endpoint under an outer opaque-origin sandbox. */
+export function renderApsCreative({ slotId, renderer: input }: RenderApsCreativeOptions): boolean {
+  const renderer = validateApsRenderer(input);
+  const rendererUrl = apsRendererUrl();
+  const nonce = createNonce();
+  if (!renderer || !rendererUrl || !nonce) {
+    log.warn('APS renderer: rejected descriptor');
+    return false;
+  }
+
+  const container = document.getElementById(slotId);
+  if (!container) {
+    log.warn('APS renderer: slot not found');
+    return false;
+  }
+
+  const iframe = document.createElement('iframe');
+  iframe.title = 'Ad content';
+  iframe.width = String(renderer.width);
+  iframe.height = String(renderer.height);
+  iframe.style.border = '0';
+  iframe.style.display = 'none';
+  iframe.setAttribute('sandbox', APS_RENDERER_SANDBOX);
+  iframe.src = `${rendererUrl}#tsaps=${nonce}`;
+
+  const priorFrame = activeFrames.get(container);
+  if (priorFrame?.style.display === 'none') priorFrame.remove();
+  activeFrames.set(container, iframe);
+
+  let settled = false;
+  const cleanup = (): void => {
+    window.removeEventListener('message', receive);
+    window.clearTimeout(timeoutId);
+  };
+  const fail = (): void => {
+    if (settled) return;
+    settled = true;
+    cleanup();
+    if (activeFrames.get(container) === iframe) activeFrames.delete(container);
+    iframe.remove();
+    log.warn('APS renderer: frame load failed');
+  };
+  const commit = (): void => {
+    if (settled || activeFrames.get(container) !== iframe || !iframe.isConnected) return;
+    settled = true;
+    cleanup();
+    for (const child of Array.from(container.children)) {
+      if (child !== iframe) child.remove();
+    }
+    iframe.style.display = '';
+  };
+  function receive(event: MessageEvent): void {
+    if (event.source !== iframe.contentWindow || !hasExactKeys(event.data, ['message', 'nonce'])) {
+      return;
+    }
+    if (event.data.nonce !== nonce) return;
+    if (event.data.message === RENDERER_READY_MESSAGE) commit();
+    else if (event.data.message === RENDERER_FAILED_MESSAGE) fail();
+  }
+
+  window.addEventListener('message', receive);
+  iframe.addEventListener(
+    'load',
+    () => {
+      if (settled || activeFrames.get(container) !== iframe || !iframe.isConnected) return;
+      try {
+        const target = iframe.contentWindow;
+        if (!target) {
+          fail();
+          return;
+        }
+        target.postMessage({ nonce, renderer }, '*');
+      } catch {
+        fail();
+      }
+    },
+    { once: true }
+  );
+  iframe.addEventListener('error', fail, { once: true });
+
+  const timeoutId = window.setTimeout(fail, RENDERER_READY_TIMEOUT_MS);
+  container.appendChild(iframe);
+  return true;
+}
+
+/**
+ * Static source executed by Prebid Universal Creative's dynamic-renderer frame.
+ * It reads only the validated descriptor and trusted absolute endpoint URL from data.
+ */
+export const APS_UNIVERSAL_CREATIVE_RENDERER =
+  '(function(){window.render=function(d,_h,w){return new Promise(function(resolve,reject){' +
+  'try{var r=d&&d.apsRenderer,u=d&&d.rendererUrl;if(!r||typeof u!=="string")throw new Error("invalid APS renderer data");' +
+  'var p=new URL(u);if((p.protocol!=="https:"&&p.protocol!=="http:")||p.username||p.password||p.pathname!=="/integrations/aps/renderer"||p.search||p.hash)throw new Error("invalid APS renderer URL");' +
+  'var c=w.crypto;if(!c||typeof c.getRandomValues!=="function")throw new Error("APS renderer randomness unavailable");' +
+  'var b=new Uint8Array(16);c.getRandomValues(b);var s="";for(var i=0;i<b.length;i++)s+=String.fromCharCode(b[i]);' +
+  'var n=w.btoa(s).replace(/\\+/g,"-").replace(/\\//g,"_").replace(/=+$/g,"");' +
+  'var f=w.document.createElement("iframe"),done=false,t;' +
+  'function clean(){w.removeEventListener("message",receive);if(t)w.clearTimeout(t);}' +
+  'function fail(){if(done)return;done=true;clean();f.remove();reject(new Error("APS renderer frame failed"));}' +
+  'function receive(e){var m=e.data;if(e.source!==f.contentWindow||!m||m.nonce!==n)return;' +
+  'if(m.message==="trusted-server/aps/renderer-ready"){done=true;clean();resolve();}' +
+  'else if(m.message==="trusted-server/aps/renderer-failed")fail();}' +
+  'f.width=String(r.width);f.height=String(r.height);f.style.border="0";' +
+  'f.setAttribute("sandbox","allow-forms allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-scripts allow-top-navigation-by-user-activation");' +
+  'f.src=p.href+"#tsaps="+n;f.onload=function(){if(!done&&f.contentWindow)f.contentWindow.postMessage({nonce:n,renderer:r},"*");};' +
+  'f.onerror=fail;w.addEventListener("message",receive);t=w.setTimeout(fail,10000);w.document.body.appendChild(f);' +
+  '}catch(e){reject(e);}});};})();';
diff --git a/crates/trusted-server-js/lib/src/integrations/gpt/index.ts b/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
index ca4689684..1d39422ec 100644
--- a/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
+++ b/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
@@ -1,5 +1,11 @@
 import { log } from '../../core/log';
 import type { AuctionSlot, AuctionBidData, TsjsApi } from '../../core/types';
+import {
+  APS_UNIVERSAL_CREATIVE_RENDERER,
+  APS_UNIVERSAL_CREATIVE_RENDERER_VERSION,
+  apsRendererUrl,
+  validateApsRenderer,
+} from '../aps/render';
 
 import { installGptGuard } from './script_guard';
 
@@ -556,13 +562,8 @@ export function installTsAdInit(): void {
           slotsToRefresh.push(gptSlot);
         }
 
-        // APS: signal to apstag that bids are ready so Amazon's GAM creative
-        // can render.  apstag must already be initialised on the page (which it
-        // is on production publisher pages).  Safe no-op if apstag is absent.
-        if (bid.hb_bidder === 'aps' || bid.hb_bidder === 'amazon-aps') {
-          // eslint-disable-next-line @typescript-eslint/no-explicit-any
-          (window as any).apstag?.setDisplayBids?.();
-        }
+        // Trusted Server APS winners carry their own typed renderer and never
+        // enter the publisher-owned native apstag rendering path.
       });
 
       ts.prevGptSlots = newSlots as unknown[];
@@ -889,6 +890,38 @@ export function installTsRenderBridge(): void {
     const slot = window.tsjs?.adSlots?.find((s) => s.id === slotId);
     const [width, height] = slot?.formats?.[0] ?? [728, 90];
 
+    if (matchedBid.renderer !== undefined) {
+      const renderer = validateApsRenderer(matchedBid.renderer);
+      const rendererUrl = apsRendererUrl();
+      if (!renderer || !rendererUrl) return;
+
+      // Ownership and the complete consumed envelope are valid before this
+      // handler claims the message or suppresses another legitimate handler.
+      e.stopImmediatePropagation();
+      if (renderingAdIds.has(adId)) return;
+      renderingAdIds.add(adId);
+
+      try {
+        port.postMessage(
+          JSON.stringify({
+            message: 'Prebid Response',
+            adId,
+            renderer: APS_UNIVERSAL_CREATIVE_RENDERER,
+            rendererVersion: APS_UNIVERSAL_CREATIVE_RENDERER_VERSION,
+            rendererUrl,
+            apsRenderer: renderer,
+            width: renderer.width,
+            height: renderer.height,
+          })
+        );
+        log.debug(`[tsjs-gpt] pbRender bridge served '${slotId}' through APS renderer`);
+      } catch (err) {
+        renderingAdIds.delete(adId);
+        log.warn('[tsjs-gpt] pbRender bridge: APS response failed', err);
+      }
+      return;
+    }
+
     if (matchedBid.adm) {
       e.stopImmediatePropagation();
       port.postMessage(
diff --git a/crates/trusted-server-js/lib/test/core/auction.test.ts b/crates/trusted-server-js/lib/test/core/auction.test.ts
index 31e020eff..7e9bb2947 100644
--- a/crates/trusted-server-js/lib/test/core/auction.test.ts
+++ b/crates/trusted-server-js/lib/test/core/auction.test.ts
@@ -1,5 +1,22 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { buildAdRequest, parseAuctionResponse, sendAuction } from '../../src/core/auction';
+import envelope from '../fixtures/aps-renderer-v1.json';
+
+function apsRenderer(creativeId?: string) {
+  const bid = envelope.seatbid[0].bid[0];
+  return {
+    type: 'aps' as const,
+    version: 1 as const,
+    accountId: 'example-account-id',
+    bidId: bid.id,
+    ...(creativeId ? { creativeId } : {}),
+    tagType: 'iframe' as const,
+    creativeUrl: bid.ext.creativeurl,
+    aaxResponse: btoa(JSON.stringify(envelope)),
+    width: bid.w,
+    height: bid.h,
+  };
+}
 
 describe('auction/buildAdRequest', () => {
   it('builds from tsjs AdUnit objects', () => {
@@ -174,6 +191,83 @@ describe('auction/parseAuctionResponse', () => {
     });
   });
 
+  it('parses an APS typed renderer without requiring adm', () => {
+    const renderer = apsRenderer('fictional-creative-id');
+    const bids = parseAuctionResponse({
+      seatbid: [
+        {
+          seat: 'aps',
+          bid: [
+            {
+              id: renderer.bidId,
+              impid: 'fictional-slot',
+              price: 1.23,
+              crid: renderer.creativeId,
+              w: 300,
+              h: 250,
+              ext: { trusted_server: { renderer } },
+            },
+          ],
+        },
+      ],
+    });
+
+    expect(bids).toHaveLength(1);
+    expect(bids[0]).toEqual(
+      expect.objectContaining({
+        impid: 'fictional-slot',
+        adm: '',
+        renderer,
+        width: 300,
+        height: 250,
+        creativeId: 'fictional-creative-id',
+      })
+    );
+  });
+
+  it('parses an APS renderer with optional creativeId omitted', () => {
+    const renderer = apsRenderer();
+    const bids = parseAuctionResponse({
+      seatbid: [
+        {
+          seat: 'aps',
+          bid: [
+            {
+              impid: 'fictional-slot',
+              price: 1.23,
+              w: 300,
+              h: 250,
+              ext: { trusted_server: { renderer } },
+            },
+          ],
+        },
+      ],
+    });
+
+    expect(bids[0].renderer).toEqual(renderer);
+    expect(bids[0].creativeId).toBe('aps-fictional-slot');
+  });
+
+  it('ignores unrelated or malformed renderer extensions while retaining ordinary adm', () => {
+    const bids = parseAuctionResponse({
+      seatbid: [
+        {
+          seat: 'ordinary',
+          bid: [
+            {
+              impid: 'slot-1',
+              adm: '<div>ordinary</div>',
+              ext: { trusted_server: { renderer: { type: 'aps', version: 99 } } },
+            },
+          ],
+        },
+      ],
+    });
+
+    expect(bids[0].renderer).toBeUndefined();
+    expect(bids[0].adm).toBe('<div>ordinary</div>');
+  });
+
   it('handles multiple seatbids with multiple bids', () => {
     const body = {
       seatbid: [
diff --git a/crates/trusted-server-js/lib/test/core/request.test.ts b/crates/trusted-server-js/lib/test/core/request.test.ts
index 2c56361dc..8dffd825b 100644
--- a/crates/trusted-server-js/lib/test/core/request.test.ts
+++ b/crates/trusted-server-js/lib/test/core/request.test.ts
@@ -1,4 +1,5 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import envelope from '../fixtures/aps-renderer-v1.json';
 
 async function flushRequestAds(): Promise<void> {
   await new Promise((resolve) => setTimeout(resolve, 0));
@@ -66,6 +67,107 @@ describe('request.requestAds', () => {
     );
   });
 
+  it('dispatches a valid APS descriptor to the opaque static renderer route', async () => {
+    const apsBid = envelope.seatbid[0].bid[0];
+    const renderer = {
+      type: 'aps',
+      version: 1,
+      accountId: 'example-account-id',
+      bidId: apsBid.id,
+      tagType: apsBid.ext.tagtype,
+      creativeUrl: apsBid.ext.creativeurl,
+      aaxResponse: btoa(JSON.stringify(envelope)),
+      width: apsBid.w,
+      height: apsBid.h,
+    };
+    (globalThis as any).fetch = vi.fn().mockResolvedValue({
+      ok: true,
+      status: 200,
+      headers: { get: () => 'application/json' },
+      json: async () => ({
+        seatbid: [
+          {
+            seat: 'aps',
+            bid: [
+              {
+                impid: 'slot1',
+                price: 1.23,
+                w: 300,
+                h: 250,
+                ext: { trusted_server: { renderer } },
+              },
+            ],
+          },
+        ],
+      }),
+    });
+
+    const { addAdUnits } = await import('../../src/core/registry');
+    const { requestAds } = await import('../../src/core/request');
+    document.body.innerHTML = '<div id="slot1"><span>existing</span></div>';
+    addAdUnits({ code: 'slot1', mediaTypes: { banner: { sizes: [[300, 250]] } } } as any);
+
+    requestAds();
+    await flushRequestAds();
+
+    const iframe = document.querySelector('#slot1 iframe') as HTMLIFrameElement | null;
+    expect(iframe).not.toBeNull();
+    expect(iframe!.src).toContain('/integrations/aps/renderer#tsaps=');
+    expect(iframe!.srcdoc).toBe('');
+    expect(iframe!.getAttribute('sandbox')).not.toContain('allow-same-origin');
+    expect(document.querySelector('#slot1 span')).not.toBeNull();
+
+    const postMessage = vi.spyOn(iframe!.contentWindow!, 'postMessage');
+    iframe!.dispatchEvent(new Event('load'));
+    expect(document.querySelector('#slot1 span')).not.toBeNull();
+    expect(postMessage).toHaveBeenCalledWith(expect.objectContaining({ renderer }), '*');
+
+    const message = postMessage.mock.calls[0][0] as { nonce: string };
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        data: { message: 'trusted-server/aps/renderer-ready', nonce: message.nonce },
+        source: iframe!.contentWindow,
+      })
+    );
+    expect(document.querySelector('#slot1 span')).toBeNull();
+  });
+
+  it('does not mutate the slot for an invalid APS descriptor', async () => {
+    (globalThis as any).fetch = vi.fn().mockResolvedValue({
+      ok: true,
+      status: 200,
+      headers: { get: () => 'application/json' },
+      json: async () => ({
+        seatbid: [
+          {
+            seat: 'aps',
+            bid: [
+              {
+                impid: 'slot1',
+                ext: {
+                  trusted_server: {
+                    renderer: { type: 'aps', version: 1, aaxResponse: 'invalid' },
+                  },
+                },
+              },
+            ],
+          },
+        ],
+      }),
+    });
+
+    const { addAdUnits } = await import('../../src/core/registry');
+    const { requestAds } = await import('../../src/core/request');
+    document.body.innerHTML = '<div id="slot1"><span>existing</span></div>';
+    addAdUnits({ code: 'slot1', mediaTypes: { banner: { sizes: [[300, 250]] } } } as any);
+
+    requestAds();
+    await flushRequestAds();
+
+    expect(document.querySelector('#slot1 iframe')).toBeNull();
+    expect(document.querySelector('#slot1 span')).not.toBeNull();
+  });
+
   it('does not render on non-JSON response', async () => {
     (globalThis as any).fetch = vi.fn().mockResolvedValue({
       ok: true,
diff --git a/crates/trusted-server-js/lib/test/fixtures/aps-renderer-v1.json b/crates/trusted-server-js/lib/test/fixtures/aps-renderer-v1.json
new file mode 100644
index 000000000..f970ac68c
--- /dev/null
+++ b/crates/trusted-server-js/lib/test/fixtures/aps-renderer-v1.json
@@ -0,0 +1,18 @@
+{
+  "seatbid": [
+    {
+      "bid": [
+        {
+          "id": "fictional-selected-bid-id",
+          "price": 1.23,
+          "w": 300,
+          "h": 250,
+          "ext": {
+            "creativeurl": "https://creative.example/render",
+            "tagtype": "iframe"
+          }
+        }
+      ]
+    }
+  ]
+}
diff --git a/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts b/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts
new file mode 100644
index 000000000..78d459c7d
--- /dev/null
+++ b/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts
@@ -0,0 +1,295 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import envelope from '../../fixtures/aps-renderer-v1.json';
+import type { ApsRendererV1 } from '../../../src/core/types';
+import {
+  APS_RENDERER_PATH,
+  APS_RENDERER_SANDBOX,
+  APS_UNIVERSAL_CREATIVE_RENDERER,
+  APS_UNIVERSAL_CREATIVE_RENDERER_VERSION,
+  apsRendererUrl,
+  parseApsRendererDescriptor,
+  renderApsCreative,
+  validateApsRenderer,
+} from '../../../src/integrations/aps/render';
+
+function encodeEnvelope(value: unknown): string {
+  const bytes = new TextEncoder().encode(JSON.stringify(value));
+  let binary = '';
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}
+
+function descriptor(overrides: Partial<ApsRendererV1> = {}): ApsRendererV1 {
+  const bid = envelope.seatbid[0].bid[0];
+  return {
+    type: 'aps',
+    version: 1,
+    accountId: 'example-account-id',
+    bidId: bid.id,
+    creativeId: 'fictional-creative-id',
+    tagType: bid.ext.tagtype as 'iframe',
+    creativeUrl: bid.ext.creativeurl,
+    aaxResponse: encodeEnvelope(envelope),
+    width: bid.w,
+    height: bid.h,
+    ...overrides,
+  };
+}
+
+describe('APS renderer validation', () => {
+  it('consumes the shared fictional golden envelope and supports an omitted creative ID', () => {
+    const withCreativeId = descriptor();
+    const withoutCreativeId = descriptor();
+    delete withoutCreativeId.creativeId;
+
+    expect(validateApsRenderer(withCreativeId)).toEqual(withCreativeId);
+    expect(validateApsRenderer(withoutCreativeId)).toEqual(withoutCreativeId);
+  });
+
+  it('keeps auction parsing structural and leaves complete trust validation to render time', () => {
+    const renderer = descriptor({ aaxResponse: 'not-base64' });
+
+    expect(parseApsRendererDescriptor(renderer)).toEqual(renderer);
+    expect(validateApsRenderer(renderer)).toBeUndefined();
+  });
+
+  it.each([
+    ['unknown root field', { ...envelope, id: 'forbidden' }],
+    ['sibling seat', { seatbid: [...envelope.seatbid, envelope.seatbid[0]] }],
+    [
+      'sibling bid',
+      { seatbid: [{ bid: [...envelope.seatbid[0].bid, envelope.seatbid[0].bid[0]] }] },
+    ],
+    [
+      'markup',
+      {
+        seatbid: [
+          { bid: [{ ...envelope.seatbid[0].bid[0], adm: '<script>forbidden()</script>' }] },
+        ],
+      },
+    ],
+    [
+      'notification',
+      { seatbid: [{ bid: [{ ...envelope.seatbid[0].bid[0], nurl: 'https://notify.example' }] }] },
+    ],
+    [
+      'unknown extension',
+      {
+        seatbid: [
+          {
+            bid: [
+              {
+                ...envelope.seatbid[0].bid[0],
+                ext: { ...envelope.seatbid[0].bid[0].ext, userSyncs: [] },
+              },
+            ],
+          },
+        ],
+      },
+    ],
+  ])('rejects an envelope containing %s', (_name, invalidEnvelope) => {
+    expect(
+      validateApsRenderer(descriptor({ aaxResponse: encodeEnvelope(invalidEnvelope) }))
+    ).toBeUndefined();
+  });
+
+  it.each([
+    ['bid ID', { bidId: 'another-bid' }],
+    ['width', { width: 728 }],
+    ['height', { height: 90 }],
+    ['creative URL', { creativeUrl: 'https://other.example/render' }],
+    ['tag type', { tagType: 'script' as const }],
+  ])('rejects a descriptor/envelope %s mismatch', (_name, override) => {
+    expect(validateApsRenderer(descriptor(override))).toBeUndefined();
+  });
+
+  it.each(['not-base64', 'e30', '====', btoa(String.fromCharCode(0xc3, 0x28)), btoa('{not json}')])(
+    'rejects invalid base64, UTF-8, or JSON',
+    (aaxResponse) => {
+      expect(validateApsRenderer(descriptor({ aaxResponse }))).toBeUndefined();
+    }
+  );
+
+  it.each([
+    'http://creative.example/render',
+    'https://user:password@creative.example/render',
+    `${window.location.origin}/creative`,
+  ])('rejects an unsafe creative URL', (creativeUrl) => {
+    const invalidEnvelope = structuredClone(envelope);
+    invalidEnvelope.seatbid[0].bid[0].ext.creativeurl = creativeUrl;
+    expect(
+      validateApsRenderer(descriptor({ creativeUrl, aaxResponse: encodeEnvelope(invalidEnvelope) }))
+    ).toBeUndefined();
+  });
+
+  it('rejects unknown descriptor fields and version mismatches', () => {
+    expect(
+      parseApsRendererDescriptor({ ...descriptor(), adm: '<div>forbidden</div>' })
+    ).toBeUndefined();
+    expect(parseApsRendererDescriptor({ ...descriptor(), version: 2 })).toBeUndefined();
+  });
+});
+
+describe('direct APS rendering', () => {
+  beforeEach(() => {
+    document.body.innerHTML = '<div id="fictional-slot"><span>existing</span></div>';
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+    document.body.innerHTML = '';
+  });
+
+  it('loads the static route with a fragment-bound 128-bit nonce and opaque sandbox', () => {
+    expect(renderApsCreative({ slotId: 'fictional-slot', renderer: descriptor() })).toBe(true);
+
+    const slot = document.getElementById('fictional-slot')!;
+    const iframe = slot.querySelector('iframe')!;
+    const existing = slot.querySelector('span');
+    expect(existing).not.toBeNull();
+    expect(iframe.src).toMatch(
+      new RegExp(`${APS_RENDERER_PATH.replace(/\//g, '\\/')}#tsaps=[A-Za-z0-9_-]{22}$`)
+    );
+    expect(iframe.getAttribute('sandbox')).toBe(APS_RENDERER_SANDBOX);
+    expect(iframe.getAttribute('sandbox')).not.toContain('allow-same-origin');
+    expect(iframe.srcdoc).toBe('');
+
+    const postMessage = vi.spyOn(iframe.contentWindow!, 'postMessage');
+    iframe.dispatchEvent(new Event('load'));
+
+    expect(slot.querySelector('span')).not.toBeNull();
+    expect(iframe.style.display).toBe('none');
+    expect(postMessage).toHaveBeenCalledTimes(1);
+    expect(postMessage).toHaveBeenCalledWith(
+      {
+        nonce: expect.stringMatching(/^[A-Za-z0-9_-]{22}$/),
+        renderer: descriptor(),
+      },
+      '*'
+    );
+
+    const message = postMessage.mock.calls[0][0] as { nonce: string };
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        data: {
+          message: 'trusted-server/aps/renderer-ready',
+          nonce: `wrong-${message.nonce}`,
+        },
+        source: iframe.contentWindow,
+      })
+    );
+    expect(slot.querySelector('span')).not.toBeNull();
+
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        data: { message: 'trusted-server/aps/renderer-ready', nonce: message.nonce },
+        source: iframe.contentWindow,
+      })
+    );
+    expect(slot.querySelector('span')).toBeNull();
+    expect(iframe.style.display).toBe('');
+  });
+
+  it('leaves existing slot content intact when validation or loading fails', () => {
+    expect(
+      renderApsCreative({
+        slotId: 'fictional-slot',
+        renderer: descriptor({ aaxResponse: 'invalid' }),
+      })
+    ).toBe(false);
+    expect(document.querySelector('#fictional-slot span')).not.toBeNull();
+    expect(document.querySelector('#fictional-slot iframe')).toBeNull();
+
+    expect(renderApsCreative({ slotId: 'fictional-slot', renderer: descriptor() })).toBe(true);
+    const iframe = document.querySelector('#fictional-slot iframe')!;
+    iframe.dispatchEvent(new Event('error'));
+    expect(document.querySelector('#fictional-slot span')).not.toBeNull();
+    expect(document.querySelector('#fictional-slot iframe')).toBeNull();
+  });
+
+  it('removes an unacknowledged frame without clearing publisher content', () => {
+    vi.useFakeTimers();
+    try {
+      expect(renderApsCreative({ slotId: 'fictional-slot', renderer: descriptor() })).toBe(true);
+      const iframe = document.querySelector('#fictional-slot iframe')!;
+      iframe.dispatchEvent(new Event('load'));
+
+      vi.advanceTimersByTime(10_000);
+
+      expect(document.querySelector('#fictional-slot span')).not.toBeNull();
+      expect(document.querySelector('#fictional-slot iframe')).toBeNull();
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+});
+
+describe('Universal Creative APS source', () => {
+  it('uses the deployed dynamic renderer protocol and only creates the opaque route frame', () => {
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER_VERSION).toBeGreaterThanOrEqual(4);
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).toContain('window.render=function');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).toContain('d&&d.apsRenderer');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).toContain('d&&d.rendererUrl');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).toContain(APS_RENDERER_PATH);
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).toContain(APS_RENDERER_SANDBOX);
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).not.toContain('allow-same-origin');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).not.toContain('srcdoc');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).not.toContain('document.write');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).not.toContain('creativeUrl');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).not.toContain('aaxResponse');
+    expect(APS_UNIVERSAL_CREATIVE_RENDERER).not.toContain('example-account-id');
+  });
+
+  it('computes an absolute renderer URL from the publisher origin', () => {
+    expect(apsRendererUrl()).toBe(new URL(APS_RENDERER_PATH, window.location.origin).href);
+    expect(apsRendererUrl('not an origin')).toBeUndefined();
+  });
+
+  it('creates the opaque route frame and resolves only after the bound acknowledgement', async () => {
+    const dynamicWindow = window as unknown as {
+      render?: (data: Record<string, unknown>, helper: unknown, target: Window) => Promise<void>;
+    };
+    window.eval(APS_UNIVERSAL_CREATIVE_RENDERER);
+
+    try {
+      const renderer = descriptor();
+      const rendered = dynamicWindow.render!(
+        {
+          apsRenderer: renderer,
+          rendererUrl: apsRendererUrl(),
+        },
+        undefined,
+        window
+      );
+      const iframe = document.body.querySelector('iframe')!;
+      expect(iframe.src).toMatch(
+        new RegExp(`${APS_RENDERER_PATH.replace(/\//g, '\\/')}#tsaps=[A-Za-z0-9_-]{22}$`)
+      );
+      expect(iframe.getAttribute('sandbox')).toBe(APS_RENDERER_SANDBOX);
+      expect(iframe.getAttribute('sandbox')).not.toContain('allow-same-origin');
+
+      const postMessage = vi.spyOn(iframe.contentWindow!, 'postMessage');
+      iframe.dispatchEvent(new Event('load'));
+      const sent = postMessage.mock.calls[0][0] as { nonce: string; renderer: ApsRendererV1 };
+      expect(sent.renderer).toEqual(renderer);
+
+      let settled = false;
+      void rendered.then(() => {
+        settled = true;
+      });
+      await Promise.resolve();
+      expect(settled).toBe(false);
+
+      window.dispatchEvent(
+        new MessageEvent('message', {
+          data: { message: 'trusted-server/aps/renderer-ready', nonce: sent.nonce },
+          source: iframe.contentWindow,
+        })
+      );
+      await expect(rendered).resolves.toBeUndefined();
+    } finally {
+      delete dynamicWindow.render;
+      document.body.innerHTML = '';
+    }
+  });
+});
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts
index 4a6368768..38a7fbce7 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts
@@ -1,4 +1,21 @@
 import { describe, it, expect, vi, beforeEach, afterEach, afterAll } from 'vitest';
+import envelope from '../../fixtures/aps-renderer-v1.json';
+
+function apsRenderer() {
+  const bid = envelope.seatbid[0].bid[0];
+  return {
+    type: 'aps' as const,
+    version: 1 as const,
+    accountId: 'example-account-id',
+    bidId: bid.id,
+    creativeId: 'fictional-creative-id',
+    tagType: 'iframe' as const,
+    creativeUrl: bid.ext.creativeurl,
+    aaxResponse: btoa(JSON.stringify(envelope)),
+    width: bid.w,
+    height: bid.h,
+  };
+}
 
 // Track every 'message' EventListener added to window across the entire test
 // file.  This lets the installTsRenderBridge suite remove all accumulated
@@ -654,7 +671,7 @@ describe('installTsAdInit', () => {
     beaconSpy.mockRestore();
   });
 
-  it('calls apstag.setDisplayBids when hb_bidder is aps', async () => {
+  it('does not call native apstag for a Trusted Server APS renderer winner', async () => {
     const setDisplayBidsSpy = vi.fn();
     (window as TestWindow).apstag = { setDisplayBids: setDisplayBidsSpy };
 
@@ -687,7 +704,12 @@ describe('installTsAdInit', () => {
         },
       ],
       bids: {
-        atf_sidebar_ad: { hb_pb: '1.50', hb_bidder: 'aps', nurl: '', burl: '' },
+        atf_sidebar_ad: {
+          hb_pb: '1.50',
+          hb_bidder: 'aps',
+          hb_adid: envelope.seatbid[0].bid[0].id,
+          renderer: apsRenderer(),
+        },
       },
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
     } as any;
@@ -696,7 +718,8 @@ describe('installTsAdInit', () => {
     installTsAdInit();
     (window as TestWindow).tsjs!.adInit!();
 
-    expect(setDisplayBidsSpy).toHaveBeenCalled();
+    expect(setDisplayBidsSpy).not.toHaveBeenCalled();
+    expect((window as TestWindow).apstag).toEqual({ setDisplayBids: setDisplayBidsSpy });
 
     delete (window as TestWindow).apstag;
   });
@@ -914,6 +937,162 @@ describe('installTsRenderBridge', () => {
     return bridgeListener!;
   }
 
+  it('serves one exact APS dynamic-renderer response without cache fetches or beacons', async () => {
+    const renderer = apsRenderer();
+    (window as TestWindow).tsjs.bids.homepage_header = {
+      hb_adid: renderer.bidId,
+      hb_bidder: 'aps',
+      hb_pb: '1.23',
+      renderer,
+      // These must not be used even if unexpected legacy fields coexist.
+      nurl: 'https://notify.example/win',
+      burl: 'https://notify.example/bill',
+      hb_cache_host: 'cache.example.com',
+      hb_cache_path: '/cache',
+    };
+
+    const beaconSpy = vi.spyOn(navigator, 'sendBeacon').mockReturnValue(true);
+    const bridgeListener = await captureBridgeListener();
+    const source = createTrustedSlotIframe();
+    const stopSpy = vi.fn();
+    const portMessages: string[] = [];
+    const fakePort = { postMessage: (message: string) => portMessages.push(message) };
+    const event = Object.assign(new Event('message'), {
+      data: JSON.stringify({ message: 'Prebid Request', adId: renderer.bidId }),
+      ports: [fakePort],
+      source,
+      stopImmediatePropagation: stopSpy,
+    }) as unknown as MessageEvent;
+
+    bridgeListener(event);
+    bridgeListener(event);
+
+    expect(stopSpy).toHaveBeenCalledTimes(2);
+    expect(fetchStub).not.toHaveBeenCalled();
+    expect(beaconSpy).not.toHaveBeenCalled();
+    expect(portMessages).toHaveLength(1);
+    const response = JSON.parse(portMessages[0]) as Record<string, unknown>;
+    expect(Object.keys(response).sort()).toEqual(
+      [
+        'adId',
+        'apsRenderer',
+        'height',
+        'message',
+        'renderer',
+        'rendererUrl',
+        'rendererVersion',
+        'width',
+      ].sort()
+    );
+    expect(response).toEqual({
+      message: 'Prebid Response',
+      adId: renderer.bidId,
+      renderer: expect.stringContaining('window.render=function'),
+      rendererVersion: 4,
+      rendererUrl: new URL('/integrations/aps/renderer', window.location.origin).href,
+      apsRenderer: renderer,
+      width: 300,
+      height: 250,
+    });
+    expect(String(response.renderer)).not.toContain(renderer.accountId);
+    expect(String(response.renderer)).not.toContain(renderer.aaxResponse);
+
+    // Universal Creative's dynamic-renderer path evaluates the returned static
+    // source and calls window.render(response, helper, targetWindow). Consume
+    // the exact bridge response through that deployed protocol shape.
+    const dynamicWindow = window as unknown as {
+      render?: (data: Record<string, unknown>, helper: unknown, target: Window) => Promise<void>;
+    };
+    window.eval(String(response.renderer));
+    try {
+      const rendered = dynamicWindow.render!(response, undefined, window);
+      const outerFrame = document.querySelector<HTMLIFrameElement>(
+        'iframe[src*="/integrations/aps/renderer#tsaps="]'
+      )!;
+      expect(outerFrame).not.toBeNull();
+      expect(outerFrame.getAttribute('sandbox')).not.toContain('allow-same-origin');
+
+      const rendererPost = vi.spyOn(outerFrame.contentWindow!, 'postMessage');
+      outerFrame.dispatchEvent(new Event('load'));
+      const sent = rendererPost.mock.calls[0][0] as { nonce: string };
+      window.dispatchEvent(
+        new MessageEvent('message', {
+          data: { message: 'trusted-server/aps/renderer-ready', nonce: sent.nonce },
+          source: outerFrame.contentWindow,
+        })
+      );
+      await expect(rendered).resolves.toBeUndefined();
+      outerFrame.remove();
+    } finally {
+      delete dynamicWindow.render;
+    }
+    beaconSpy.mockRestore();
+  });
+
+  it('validates APS data before claiming the Prebid request', async () => {
+    const renderer = { ...apsRenderer(), aaxResponse: 'invalid' };
+    (window as TestWindow).tsjs.bids.homepage_header = {
+      hb_adid: renderer.bidId,
+      hb_bidder: 'aps',
+      renderer,
+    };
+
+    const bridgeListener = await captureBridgeListener();
+    const source = createTrustedSlotIframe();
+    const stopSpy = vi.fn();
+    const portMessages: string[] = [];
+    bridgeListener(
+      Object.assign(new Event('message'), {
+        data: JSON.stringify({ message: 'Prebid Request', adId: renderer.bidId }),
+        ports: [{ postMessage: (message: string) => portMessages.push(message) }],
+        source,
+        stopImmediatePropagation: stopSpy,
+      }) as unknown as MessageEvent
+    );
+
+    expect(stopSpy).not.toHaveBeenCalled();
+    expect(portMessages).toEqual([]);
+    expect(fetchStub).not.toHaveBeenCalled();
+  });
+
+  it('ignores an APS ad ID requested by another configured slot', async () => {
+    const renderer = apsRenderer();
+    (window as TestWindow).tsjs.bids.homepage_header = {
+      hb_adid: renderer.bidId,
+      hb_bidder: 'aps',
+      renderer,
+    };
+    (window as TestWindow).tsjs.adSlots.push({
+      id: 'homepage_footer',
+      formats: [[300, 250]],
+      gam_unit_path: '/a/b/footer',
+      div_id: 'div-footer',
+      targeting: {},
+    });
+    const footer = document.createElement('div');
+    footer.id = 'div-footer';
+    const foreignIframe = document.createElement('iframe');
+    footer.appendChild(foreignIframe);
+    document.body.appendChild(footer);
+
+    const bridgeListener = await captureBridgeListener();
+    const stopSpy = vi.fn();
+    const portMessages: string[] = [];
+    bridgeListener(
+      Object.assign(new Event('message'), {
+        data: JSON.stringify({ message: 'Prebid Request', adId: renderer.bidId }),
+        ports: [{ postMessage: (message: string) => portMessages.push(message) }],
+        source: foreignIframe.contentWindow,
+        stopImmediatePropagation: stopSpy,
+      }) as unknown as MessageEvent
+    );
+
+    expect(stopSpy).not.toHaveBeenCalled();
+    expect(portMessages).toEqual([]);
+    expect(fetchStub).not.toHaveBeenCalled();
+    footer.remove();
+  });
+
   it('calls stopImmediatePropagation and fetches PBS Cache for a TS bid', async () => {
     const beaconSpy = vi.spyOn(navigator, 'sendBeacon').mockReturnValue(true);
     const mockAd = '<div>Test Creative</div>';
@@ -1235,7 +1414,7 @@ describe('installTsRenderBridge', () => {
     window.dispatchEvent(
       new MessageEvent('message', {
         data: JSON.stringify({ message: 'Prebid Request', adId: 'test-cache-uuid' }),
-        ports: [fakePort as MessagePort],
+        ports: [fakePort as unknown as MessagePort],
         source: foreignIframe.contentWindow,
       })
     );
@@ -1280,7 +1459,7 @@ describe('installTsRenderBridge', () => {
       new MessageEvent('message', {
         // adId belongs to slot B (homepage_footer), not slot A's iframe.
         data: JSON.stringify({ message: 'Prebid Request', adId: 'footer-uuid' }),
-        ports: [fakePort as MessagePort],
+        ports: [fakePort as unknown as MessagePort],
         source,
       })
     );
diff --git a/docs/guide/auction-orchestration.md b/docs/guide/auction-orchestration.md
index d75958812..818c17d99 100644
--- a/docs/guide/auction-orchestration.md
+++ b/docs/guide/auction-orchestration.md
@@ -10,7 +10,7 @@ Key capabilities:
 
 - **Parallel execution** — Bid requests to all providers launch concurrently using Fastly's `select()` API
 - **Strategy-based winner selection** — Automatic strategy detection based on configuration
-- **Mediator support** — Optional external mediator for decoding encoded prices (e.g., APS) and applying unified floor pricing
+- **Mediator support** — Optional external mediator for final winner selection and unified floor pricing
 - **Provider abstraction** — Pluggable provider interface for adding new demand sources
 - **Creative rewriting** — Winning creatives automatically rewritten with first-party proxy URLs
 
@@ -92,26 +92,26 @@ sequenceDiagram
     activate Mock
 
     par Parallel Provider Calls
-      Orch->>APS: POST /e/dtb/bid<br/>APS TAM format
-      Note right of Orch: { "pubId": "5128",<br/>  "slots": [{ "slotID": "header-banner",<br/>    "sizes": [[728,90]] }] }
+      Orch->>APS: POST /e/pb/bid<br/>APS OpenRTB
+      Note right of Orch: { "id": "request",<br/>  "imp": [{ "id": "header-banner",<br/>    "banner": { "w": 728, "h": 90 } }],<br/>  "ext": { "account": "example-account" } }
 
-      APS->>Mock: APS TAM request
-      Mock-->>APS: APS bid response<br/>(encoded prices, no creative)
-      Note right of Mock: { "contextual": { "slots": [{<br/>  "slotID": "header-banner",<br/>  "amznbid": "Mi41MA==", // "2.50"<br/>  "fif": "1" }] } }
+      APS->>Mock: APS OpenRTB request
+      Mock-->>APS: OpenRTB bid response<br/>(decoded price and renderer URL)
+      Note right of Mock: { "seatbid": [{ "bid": [{<br/>  "impid": "header-banner", "price": 2.50,<br/>  "ext": { "creativeurl": "https://creative.example/render",<br/>    "tagtype": "iframe" } }] }] }
 
-      APS-->>Orch: AuctionResponse<br/>(APS bids)
+      APS-->>Orch: AuctionResponse<br/>(decoded price and typed renderer)
     and
       Orch->>Prebid: POST /openrtb2/auction<br/>OpenRTB 2.x format
       Note right of Orch: { "id": "request",<br/>  "imp": [{ "id": "header-banner",<br/>    "banner": { "w": 728, "h": 90 } }] }
 
       Prebid->>Mock: OpenRTB request
-      Mock-->>Prebid: OpenRTB response<br/>(clear prices, with creative)
+      Mock-->>Prebid: OpenRTB response<br/>(decoded price with creative)
       Note right of Mock: { "seatbid": [{ "seat": "prebid",<br/>  "bid": [{ "price": 2.00, "adm": "<html>..." }] }] }
 
       Prebid-->>Orch: AuctionResponse<br/>(Prebid bids)
     end
 
-    Note over Orch: Collected bids from all providers<br/>APS: encoded prices, no creative<br/>Prebid: clear prices, with creative
+    Note over Orch: Collected decoded-price bids<br/>APS: typed renderer, no adm<br/>Prebid: sanitized creative or cache source
     deactivate Mock
     deactivate APS
     deactivate Prebid
@@ -122,23 +122,19 @@ sequenceDiagram
     rect rgb(236,253,245)
       Note over Client,Mock: Mediation Flow
       activate Med
-      Orch->>Med: POST /adserver/mediate<br/>All bids for final selection
-      Note right of Orch: { "id": "auction-123",<br/>  "imp": [...],<br/>  "ext": { "bidder_responses": [<br/>    { "bidder": "amazon-aps",<br/>      "bids": [{ "encoded_price": "Mi41MA==" }] },<br/>    { "bidder": "prebid",<br/>      "bids": [{ "price": 2.00 }] }] } }
-
-      Med->>Med: Decode APS encoded prices<br/>Apply floor prices<br/>Select highest CPM per slot
-      Note right of Med: Base64 decode: "Mi41MA==" → "2.50"<br/>Winner: APS at $2.50 vs Prebid at $2.00
+      Orch->>Med: POST /adserver/mediate<br/>Decoded-price bids for final selection
+      Note right of Orch: APS price: 2.50<br/>Prebid price: 2.00
 
+      Med->>Med: Apply mediation policy and floors<br/>Select highest CPM per slot
       Med-->>Orch: OpenRTB response with winners
-      Note right of Med: { "seatbid": [{ "seat": "amazon-aps",<br/>  "bid": [{ "price": 2.50, "impid": "header-banner" }] }] }
+      Note right of Med: APS renderer state is restored from<br/>the reduced source bid after mediation
       deactivate Med
     end
   else No Mediator (parallel_only)
     rect rgb(253,243,235)
       Note over Client,Mock: Direct Winner Selection
-      Orch->>Orch: Compare clear prices only<br/>Skip APS (encoded prices)<br/>Select highest CPM
-      Note right of Orch: APS bids skipped (encoded prices)<br/>Winner: Prebid at $2.00 (only clear price)
-
-      Note over Orch: Results: Limited winner selection<br/>Cannot compare encoded APS prices<br/>Prebid wins by default
+      Orch->>Orch: Compare decoded prices<br/>Apply slot floor<br/>Select highest CPM
+      Note right of Orch: Winner: APS at $2.50 vs Prebid at $2.00
     end
   end
 
@@ -147,12 +143,12 @@ sequenceDiagram
     Note over Client,Mock: Response Assembly
     activate TS
     activate Client
-    Orch->>Orch: Transform to OpenRTB response<br/>Generate iframe creatives<br/>Rewrite creative URLs<br/>Add orchestrator metadata
+    Orch->>Orch: Transform to OpenRTB response<br/>Preserve typed render source<br/>Rewrite ordinary creatives<br/>Add orchestrator metadata
 
     Orch-->>TS: OpenRTB BidResponse
-    Note right of Orch: { "id": "auction-response",<br/>  "seatbid": [{ "seat": "amazon-aps",<br/>    "bid": [{ "price": 2.50,<br/>      "adm": "<iframe src=\"/first-party/proxy?tsurl=...\">",<br/>      "w": 728, "h": 90 }] }] }<br/>  "ext": { "orchestrator": {<br/>    "strategy": "parallel_mediation",<br/>    "bidders": 2, "time_ms": 150 } }
+    Note right of Orch: APS winner carries ext.trusted_server.renderer<br/>with no adm; ordinary winners retain sanitized adm/cache data
 
-    TS-->>Client: 200 OpenRTB response<br/>with winning creative
+    TS-->>Client: 200 OpenRTB response<br/>with winning render capability
     deactivate Orch
     deactivate TS
   end
@@ -160,8 +156,8 @@ sequenceDiagram
   %% === Creative Rendering ===
   rect rgb(239,246,255)
     Note over Client,Mock: Creative Rendering
-    Client->>Client: Inject winning creative<br/>Render iframe<br/>Load creative through proxy
-    Note right of Client: iframe src="/first-party/proxy?tsurl=...&tstoken=sig"<br/>Ensures first-party serving<br/>Maintains privacy & security
+    Client->>Client: Validate renderer descriptor<br/>Create opaque sandbox iframe<br/>Load /integrations/aps/renderer
+    Note right of Client: Fragment-bound nonce and one-time acknowledgement<br/>No allow-same-origin on the outer frame
     deactivate Client
   end
 ```
@@ -187,8 +183,8 @@ AuctionOrchestrator.run_auction()
   ├─ Launch all providers in parallel via select()
   ├─ Collect responses as they complete
   │
-  ├─[parallel_only]─── Select highest CPM per slot (clear prices only)
-  └─[parallel_mediation]─── Forward all bids to mediator for final selection
+  ├─[parallel_only]─── Select highest decoded CPM per slot
+  └─[parallel_mediation]─── Forward decoded-price bids to mediator for final selection
   │
   ▼
 Convert OrchestrationResult → OpenRTB 2.x Response
@@ -246,21 +242,17 @@ timeout_ms = 2000
 
 **How winner selection works:**
 
-1. Collect bids from all providers
-2. Group bids by slot ID
-3. For each slot, select the bid with the highest CPM
-4. Bids with `price: None` (e.g., APS encoded prices) are **skipped** — they cannot be compared without decoding
-5. Apply floor prices — drop winners below the slot's floor
-
-**Limitations:**
+1. Collect bids from all providers.
+2. Group bids by slot ID.
+3. Skip bids without a decoded numeric price.
+4. Select the highest CPM for each slot.
+5. Apply floor prices and drop winners below the slot's floor.
 
-- APS bids are effectively ignored since their prices are encoded
-- Only bidders returning clear decimal prices can compete
-- May result in lower revenue when APS would have won
+APS OpenRTB supplies decoded prices, so eligible APS bids participate directly without requiring a mediator.
 
 ### Parallel Mediation
 
-When a `mediator` is configured, all provider responses are forwarded to the mediator service for final winner selection. The mediator can decode proprietary price formats (like APS encoded bids) and apply unified floor pricing.
+When a `mediator` is configured, provider responses are forwarded to the mediator service for final winner selection and unified floor pricing.
 
 ```toml
 [auction]
@@ -272,21 +264,14 @@ timeout_ms = 2000
 
 **How mediation works:**
 
-1. Run all providers in parallel (same as parallel_only)
-2. Collect all responses
-3. Forward all bids to the mediator as a single request, including:
-   - Regular bids with clear `price` fields
-   - APS bids with `encoded_price` fields (from `amznbid` metadata)
-4. Mediator decodes APS prices, applies floor pricing, and selects the highest CPM per slot
-5. Mediator returns an OpenRTB response with winning bids at decoded prices
-6. Orchestrator filters any bids the mediator returned without a decoded price
+1. Run all providers in parallel (same as parallel_only).
+2. Collect all responses.
+3. Forward bids with decoded numeric prices to the mediator.
+4. Let the mediator apply policy and choose a winner.
+5. Restore render/accounting state from the selected source bid.
+6. Filter any mediator winner without a decoded price.
 
-**Advantages over parallel_only:**
-
-- All bidders compete on equal footing, including those with encoded prices
-- Centralized floor pricing enforcement
-- Proper APS integration — encoded bids are decoded and compared fairly
-- Higher potential revenue from broader competition
+Mediation is optional for APS. APS reduces to one candidate per impression before mediation so the selected renderer can be restored without same-slot ambiguity.
 
 ## Providers
 
@@ -354,33 +339,37 @@ bidders = ["appnexus", "rubicon"]
 
 ### APS Provider
 
-Transforms auction requests into Amazon's TAM (Transparent Ad Marketplace) format.
+Builds an independent banner OpenRTB request for Amazon Publisher Services.
 
 **Request transformation:**
 
-- `AdSlot` → `ApsSlot` with `slot_id`, `slot_name`, and `sizes` array
-- Publisher ID, page URL, user agent, and timeout included
+- banner `AdSlot` formats become secure OpenRTB impressions;
+- `ext.account` uses canonical `account_id`;
+- `ext.sdk` identifies the compatible Prebid contract; and
+- existing page, device, consent, identity, and geo privacy gates are preserved.
 
 **Response parsing:**
 
-- Bids have `price: None` — APS uses proprietary encoding (`amznbid` field is base64-encoded)
-- Bids have `creative: None` — APS does not return HTML creatives
-- Encoded price metadata (`amznbid`, `amznp`) preserved in bid metadata for the mediator
-- Only slots with `fif: "1"` (filled) are processed
-
-This is why mediation is important when using APS: without a mediator, APS bids cannot participate in winner selection.
+- decoded USD prices compete directly with other providers;
+- positive compatible dimensions and an HTTPS `creativeurl` are required;
+- script creatives are rejected before winner selection unless explicitly enabled;
+- one candidate per impression is retained deterministically; and
+- a minimized typed renderer is preserved instead of creative markup or APS notifications.
 
 ```toml
 [integrations.aps]
 enabled = true
-pub_id = "example-publisher"
-endpoint = "https://aps.example.com/e/dtb/bid"
+account_id = "example-account"
+endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
 timeout_ms = 800
+allow_script_creatives = false
 ```
 
+See [APS OpenRTB Integration](/guide/integrations/aps) for rollout and rendering requirements.
+
 ### AdServer Mock Mediator
 
-An external mediation service that receives all bidder responses and performs unified winner selection. The mock implementation uses base64 decoding for APS prices; a production mediator would use Amazon's proprietary decoding.
+An external mediation service that receives decoded-price bidder responses and performs final winner selection. APS prices are already decoded at the provider boundary.
 
 **Mediation request format:**
 
@@ -393,8 +382,8 @@ An external mediation service that receives all bidder responses and performs un
   "ext": {
     "bidder_responses": [
       {
-        "bidder": "amazon-aps",
-        "bids": [{ "imp_id": "header-banner", "encoded_price": "Mi41MA==" }]
+        "bidder": "aps",
+        "bids": [{ "imp_id": "header-banner", "price": 2.5, "adm": null }]
       },
       {
         "bidder": "prebid",
@@ -457,20 +446,21 @@ The unified bid format used across all providers:
 ```rust
 pub struct Bid {
     pub slot_id: String,
-    pub price: Option<f64>,           // None for APS (encoded)
+    pub price: Option<f64>,           // Missing prices fail closed
     pub currency: String,
-    pub creative: Option<String>,     // None for APS (no HTML from TAM)
+    pub creative: Option<String>,     // APS uses renderer instead of markup
     pub adomain: Option<Vec<String>>,
     pub bidder: String,
     pub width: u32,
     pub height: u32,
     pub nurl: Option<String>,         // Win notification URL
     pub burl: Option<String>,         // Billing URL
+    pub renderer: Option<BidRenderer>,
     pub metadata: HashMap<String, serde_json::Value>,
 }
 ```
 
-The `price` and `creative` fields are `Option` types specifically to handle APS, which returns encoded prices and no creative HTML. This is a key design decision — it lets the type system enforce awareness of encoded vs. decoded bids throughout the auction pipeline.
+The `price` field remains optional so missing-price bids fail closed. APS supplies a decoded price and a typed renderer instead of creative HTML; the renderer is retained through direct winner selection and mediation.
 
 ### OrchestrationResult
 
@@ -593,9 +583,10 @@ debug = false
 
 [integrations.aps]
 enabled = true
-pub_id = "example-publisher"
-endpoint = "https://aps.example.com/e/dtb/bid"
+account_id = "example-account"
+endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
 timeout_ms = 800
+allow_script_creatives = false
 
 [integrations.adserver_mock]
 enabled = true
@@ -629,12 +620,13 @@ price_floor = 0.50
 
 #### `[integrations.aps]`
 
-| Field        | Type   | Default                             | Description                 |
-| ------------ | ------ | ----------------------------------- | --------------------------- |
-| `enabled`    | bool   | `false`                             | Enable APS provider         |
-| `pub_id`     | string | —                                   | APS publisher ID (required) |
-| `endpoint`   | string | `https://aps.example.com/e/dtb/bid` | APS TAM endpoint            |
-| `timeout_ms` | u32    | `800`                               | Request timeout             |
+| Field                    | Type   | Default                                            | Description                                      |
+| ------------------------ | ------ | -------------------------------------------------- | ------------------------------------------------ |
+| `enabled`                | bool   | `false`                                            | Enable APS provider                              |
+| `account_id`             | string | —                                                  | APS account ID (required; `pub_id` is an alias)  |
+| `endpoint`               | string | `https://web.ads.aps.amazon-adsystem.com/e/pb/bid` | APS OpenRTB endpoint                             |
+| `timeout_ms`             | u32    | `800`                                              | Request timeout                                  |
+| `allow_script_creatives` | bool   | `false`                                            | Admit script bids before APS candidate reduction |
 
 #### `[integrations.adserver_mock]`
 
@@ -673,7 +665,7 @@ TRUSTED_SERVER__AUCTION__PROVIDERS=prebid,aps
 TRUSTED_SERVER__AUCTION__MEDIATOR=adserver_mock
 TRUSTED_SERVER__AUCTION__TIMEOUT_MS=2000
 TRUSTED_SERVER__INTEGRATIONS__PREBID__SERVER_URL=https://pbs.example.com
-TRUSTED_SERVER__INTEGRATIONS__APS__PUB_ID=5128
+TRUSTED_SERVER__INTEGRATIONS__APS__ACCOUNT_ID=example-account
 ```
 
 ## Floor Prices
@@ -682,7 +674,7 @@ Floor prices can be set per-slot in the auction request. The orchestrator enforc
 
 - In **parallel_only** mode: bids below the floor are dropped after selection
 - In **parallel_mediation** mode: the floor is sent to the mediator in `ext.config.price_floor`, and also enforced locally as a safety net
-- Bids with `price: None` (encoded prices) **pass through** floor checks — the floor is deferred to the mediator
+- Bids without a decoded numeric price are dropped before delivery in both strategies
 
 ## Error Handling
 
@@ -703,7 +695,7 @@ The auction system logs at multiple levels throughout execution:
 | Level   | Examples                                                                              |
 | ------- | ------------------------------------------------------------------------------------- |
 | `info`  | Auction request received, provider launch, bid counts, winner selection, total timing |
-| `debug` | Skipped bids (encoded prices), creative rewrite sizes                                 |
+| `debug` | Bid-drop reasons, mediation restoration notes, creative rewrite sizes                 |
 | `warn`  | Provider launch failures, parse failures, mediator bids without decoded prices        |
 
 ### Response Metadata
diff --git a/docs/guide/configuration.md b/docs/guide/configuration.md
index b975590c6..91b30a143 100644
--- a/docs/guide/configuration.md
+++ b/docs/guide/configuration.md
@@ -1209,8 +1209,9 @@ timeout_ms = 2000
 
 [integrations.aps]
 enabled = true
-pub_id = "example-publisher"
-endpoint = "https://aps.example.com/e/dtb/bid"
+account_id = "example-account"
+endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
+allow_script_creatives = false
 
 [integrations.prebid]
 enabled = true
diff --git a/docs/guide/integrations/aps.md b/docs/guide/integrations/aps.md
index 878761769..ff4220070 100644
--- a/docs/guide/integrations/aps.md
+++ b/docs/guide/integrations/aps.md
@@ -1,412 +1,210 @@
-# Amazon Publisher Services (APS) Integration
+# Amazon Publisher Services (APS) OpenRTB Integration
 
-Server-side bidding integration for Amazon's Transparent Ad Marketplace (TAM).
+Trusted Server can request banner bids from Amazon Publisher Services (APS) through the APS OpenRTB endpoint and let their decoded USD CPMs compete with other auction providers.
 
-## Overview
+> [!IMPORTANT]
+> APS's public adapter metadata describes Prebid Server support as unavailable. Confirm edge/server-originated traffic with your APS account team before a broad production rollout. Start with an isolated cohort and disable publisher-native APS demand for that cohort to avoid duplicate demand.
 
-The APS integration enables publishers to request bids from Amazon's demand sources server-side, providing:
+## Scope
 
-- **Privacy-first bidding**: No client-side ID tracking or third-party cookies required
-- **Reduced latency**: Server-side auction reduces page load impact
-- **Unified auction**: Integrates seamlessly with other bidders (Prebid, GAM)
-- **Performance**: Async bidding with configurable timeouts
+The integration supports:
 
-## Quick Start
+- banner impressions;
+- APS OpenRTB requests to `https://web.ads.aps.amazon-adsystem.com/e/pb/bid`;
+- decoded-CPM winner selection with or without a mediator;
+- direct `/auction` rendering; and
+- initial-navigation and page-bids rendering through GAM/Prebid Universal Creative.
 
-Get started with server-side APS bidding in 5 minutes.
+The integration does not implement:
 
-### Prerequisites
+- video or native impressions;
+- APS user sync;
+- Trusted Server delivery of APS `nurl` or `burl`; or
+- native `apstag.setDisplayBids()` handling for Trusted Server APS winners.
 
-- Fastly Compute service configured
-- APS publisher account with valid `pub_id`
-- Rust toolchain installed (see main README)
-
-### Step 1: Configure Fastly Backend
-
-Add APS backend to your Fastly service:
-
-**Option A: Via Fastly UI**
-
-1. Go to your service → Origins
-2. Click "Create a Backend"
-3. Configure:
-   - Name: `aax.amazon-adsystem.com`
-   - Address: `aax.amazon-adsystem.com`
-   - Port: `443`
-   - Enable TLS: ✓
-
-**Option B: Via `fastly.toml`**
-
-Add to your `fastly.toml`:
-
-```toml
-[[backends]]
-name = "aax.amazon-adsystem.com"
-address = "aax.amazon-adsystem.com"
-port = 443
-use_ssl = true
-ssl_cert_hostname = "aax.amazon-adsystem.com"
-ssl_sni_hostname = "aax.amazon-adsystem.com"
-```
-
-### Step 2: Enable APS in Configuration
-
-Edit `trusted-server.toml`:
+## Configuration
 
 ```toml
-# Enable APS bidding
 [integrations.aps]
 enabled = true
-pub_id = "5128"  # Replace with your APS publisher ID
-endpoint = "https://aax.amazon-adsystem.com/e/dtb/bid"
+account_id = "example-aps-account-id"
+endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
 timeout_ms = 800
+allow_script_creatives = false
 
-# Configure auction to use APS
 [auction]
 enabled = true
-strategy = "parallel_only"  # Run APS alongside other bidders
-bidders = ["aps"]  # Add other bidders like ["aps", "prebid"]
+providers = ["aps", "prebid"]
 timeout_ms = 2000
 ```
 
-### Step 3: Deploy or Test Locally
-
-**Deploy to Fastly:**
-
-```bash
-cargo build --release --target wasm32-wasip1
-fastly compute publish
-```
-
-**Test Locally:**
-
-```bash
-fastly compute serve
-```
-
-### Step 4: Verify It's Working
-
-Check the logs for APS activity:
-
-```bash
-# You should see:
-INFO APS: requesting bids for 2 slots (pub_id: 5128)
-DEBUG APS: sending bid request: {...}
-DEBUG APS: received response: {...}
-INFO APS returned 2 bids in 150ms
-```
-
-## Architecture
-
-```
-Publisher Page Request
-        ↓
-Auction Orchestrator
-        ↓
-APS Provider (async)
-        ↓
-https://aax.amazon-adsystem.com/e/dtb/bid
-        ↓
-Parse APS Response → Unified Bid Format
-        ↓
-Auction Winner Selection
-```
-
-## Configuration
-
-### Basic Setup
+`account_id` is the canonical field. `pub_id` remains a compatibility alias for migration, including integer values, but new configuration should not use it. Supplying both names is an error.
 
-Add to `trusted-server.toml`:
-
-```toml
-[integrations.aps]
-enabled = true
-pub_id = "5128"  # Your APS publisher ID
-endpoint = "https://aax.amazon-adsystem.com/e/dtb/bid"
-timeout_ms = 800
-```
-
-### Environment Variables
-
-Override settings via environment variables:
-
-```bash
-TRUSTED_SERVER__INTEGRATIONS__APS__ENABLED=true
-TRUSTED_SERVER__INTEGRATIONS__APS__PUB_ID=5128
-TRUSTED_SERVER__INTEGRATIONS__APS__TIMEOUT_MS=800
-```
+`allow_script_creatives` defaults to `false`. While disabled, APS script bids are rejected before per-impression reduction, floors, mediation, and winner selection. Enable it only for a controlled cohort after the browser-security checks in [Rollout](#rollout) pass.
 
-## Auction Strategies
+APS uses ordinary auction slot IDs and banner formats. Legacy creative-opportunity APS `slot_id` configuration is accepted for compatibility but ignored, and `bidders.aps.slotID` is not required. Remove both during migration.
 
-### APS Only
-
-```toml
-[auction]
-enabled = true
-bidders = ["aps"]
-# No mediator = parallel only (highest CPM wins)
-```
-
-### APS + Prebid (Parallel)
-
-Best for maximum revenue:
+The APS provider may also participate through a configured mediator:
 
 ```toml
 [auction]
 enabled = true
 providers = ["aps", "prebid"]
+mediator = "adserver_mock"
 timeout_ms = 2000
-# No mediator = all providers compete, highest CPM wins
+```
 
-[integrations.aps]
-enabled = true
-pub_id = "5128"
-timeout_ms = 800
+## OpenRTB request
 
-[integrations.prebid]
-enabled = true
-server_url = "https://prebid-server.example.com"
-timeout_ms = 1000
-```
+Trusted Server builds the APS request independently from its Prebid Server request. The request includes:
 
-**Benefits:**
+- `ext.account` from `account_id`;
+- `ext.sdk = { "source": "prebid", "version": "2.2.0" }`;
+- secure banner impressions and configured floors;
+- page, site, device, and consent fields allowed by the existing privacy gates; and
+- eligible EIDs only when consent policy permits them.
 
-- Maximum fill rate
-- Best CPM selection
-- All bidders compete equally
+Precise latitude/longitude, disallowed identifiers, unsupported media types, and Trusted Server/Prebid-only extensions are not forwarded. Unsafe or oversized page URLs are omitted or replaced by the validated publisher fallback.
 
-### APS + Prebid + Mediation
+Raw outbound and inbound payloads are logged only at TRACE level. Normal logs and auction metadata contain aggregate counts and drop reasons.
 
-Let a mediator decide winners:
+## Bid eligibility and selection
 
-```toml
-[auction]
-enabled = true
-providers = ["aps", "prebid"]
-mediator = "adserver_mock"  # Enables parallel mediation (mediator decides winner)
-timeout_ms = 2000
-```
+APS responses must use USD when a response currency is present. Each eligible bid must have:
 
-## Request Format
+- a known `impid`;
+- a finite decoded price;
+- positive `w` and `h` that match a configured banner format;
+- an HTTPS, credential-free `ext.creativeurl` on an origin other than the publisher; and
+- `ext.tagtype` equal to `iframe`, or `script` when the script gate is enabled.
 
-The integration transforms unified `AuctionRequest` to APS TAM format:
+Trusted Server rejects legacy contextual response shapes and bids with markup-only render sources. It deterministically keeps one eligible APS candidate per impression by highest price, then lexicographically smallest bid ID. This reduction prevents same-slot renderer ambiguity in mediation.
 
-```json
-{
-  "pubId": "5128",
-  "slots": [
-    {
-      "slotID": "header-banner",
-      "slotName": "header-banner",
-      "sizes": [
-        [728, 90],
-        [970, 250]
-      ]
-    }
-  ],
-  "pageUrl": "https://example.com/article",
-  "ua": "Mozilla/5.0...",
-  "timeout": 800
-}
-```
+APS bids use `aps` as both the bidder identity and `hb_bidder`, regardless of an upstream seat value. The selected APS bid ID is used for `hb_adid`. APS then competes directly against other decoded-price bids and ordinary slot floors.
 
-## Response Format
+## Rendering security model
 
-APS returns bids in this format:
+Trusted Server does not insert APS creative markup into the publisher document. It serializes only the selected bid into a versioned renderer descriptor. The base64 OpenRTB envelope has exactly this shape:
 
 ```json
 {
-  "bids": [
+  "seatbid": [
     {
-      "slotID": "header-banner",
-      "price": 2.5,
-      "adm": "<div>Creative HTML</div>",
-      "w": 728,
-      "h": 90,
-      "adomain": ["amazon.com"],
-      "bidId": "bid-123",
-      "nurl": "https://win-notification.com",
-      "targeting": {
-        "amzniid": "user-id",
-        "amznbid": "2.50"
-      }
+      "bid": [
+        {
+          "id": "fictional-selected-bid-id",
+          "price": 1.23,
+          "w": 300,
+          "h": 250,
+          "ext": {
+            "creativeurl": "https://creative.example/render",
+            "tagtype": "iframe"
+          }
+        }
+      ]
     }
   ]
 }
 ```
 
-The integration automatically transforms this to unified `Bid` format.
+Seats, `impid`, markup, notifications, user-sync data, sibling bids, losing seats, and unknown fields are not exposed. The browser decodes this envelope and cross-checks the ID, dimensions, URL, and tag type before any DOM mutation or message suppression.
 
-## Testing
+Both rendering paths use `GET /integrations/aps/renderer`, a static Trusted Server document with its own restrictive CSP. The document initializes the account-keyed APS queue and then loads only the fixed runner at `https://client.aps.amazon-adsystem.com/prebid-creative.js`.
 
-### Unit Tests
+The outer iframe uses these sandbox permissions:
 
-```bash
-cargo test -p trusted-server-core aps::tests
+```text
+allow-forms
+allow-pointer-lock
+allow-popups
+allow-popups-to-escape-sandbox
+allow-scripts
+allow-top-navigation-by-user-activation
 ```
 
-### Local Testing
+It deliberately omits `allow-same-origin`, so APS and bidder execution remains below an opaque-origin boundary. The renderer response repeats these restrictions with a CSP `sandbox` directive, preventing another embedding path from restoring publisher-origin execution by omitting the iframe attribute. Trusted Server generates a fresh 128-bit nonce, binds it in the iframe URL fragment before navigation, and requires the same one-time nonce in the parent message and renderer acknowledgement. Existing slot content is retained until the static renderer has accepted the descriptor and loaded the fixed runner.
 
-1. Configure APS in `trusted-server.toml`
-2. Set up Fastly backend
-3. Run locally:
-   ```bash
-   fastly compute serve
-   ```
-4. Inspect logs for bid requests/responses
+### Direct `/auction`
 
-### Testing
+The TSJS auction client validates the typed renderer descriptor, creates the opaque renderer iframe, and sends the minimized envelope after the frame loads. Ordinary non-APS `adm` continues through the existing sanitizer and generic creative iframe.
 
-For local testing without live APS credentials, configure the integration with test values:
+### GAM and Universal Creative
 
-```toml
-[integrations.aps]
-enabled = true
-pub_id = "test-publisher-123"
-endpoint = "https://aax.amazon-adsystem.com/e/dtb/bid"
-timeout_ms = 800
-```
-
-Run unit tests:
-
-```bash
-cargo test -p trusted-server-core aps
-```
-
-## Monitoring
+For initial navigation and page-bids, Trusted Server publishes the same descriptor in `window.tsjs.bids`. The source-checked Prebid Universal Creative bridge accepts requests only from the iframe that owns the matching `hb_adid`, validates the complete envelope, and returns a static dynamic-renderer program that creates the same opaque renderer iframe.
 
-The integration logs detailed information at different levels:
+This path does not fetch PBS Cache, fire generic APS win/billing beacons, or call `apstag.setDisplayBids()` for the Trusted Server winner. Publisher-owned native APS objects are otherwise left untouched.
 
-```rust
-// Info: Auction lifecycle
-log::info!("APS: requesting bids for 2 slots (pub_id: 5128)");
-log::info!("APS returned 2 bids in 150ms");
+## Publisher CSP
 
-// Debug: Request/response payloads
-log::debug!("APS: sending bid request: {...}");
-log::debug!("APS: received response: {...}");
+The publisher policy must permit the same-origin renderer route, for example:
 
-// Warn: Non-success responses
-log::warn!("APS returned non-success status: 400");
+```text
+frame-src 'self'
 ```
 
-## Troubleshooting
-
-### Problem: No bids returned
-
-**Check:**
-
-1. Verify `pub_id` is correct
-2. Check backend is configured: `fastly backend list`
-3. Increase timeout: `timeout_ms = 1200`
-4. View logs with `fastly compute serve`
-
-**Possible causes:**
+Do not add `allow-same-origin` to the outer renderer sandbox. The renderer endpoint supplies its own CSP for the fixed runner and HTTPS creative resources.
 
-- Invalid `pub_id` configuration
-- Timeout too short (increase `timeout_ms`)
-- Backend not configured correctly
-- APS account not active
+Before enabling script creatives, verify under the publisher's actual CSP that both iframe and script-tag creatives:
 
-### Problem: "Backend not found" error
+- render and size correctly;
+- cannot read or modify `top.document`;
+- cannot restore publisher-origin execution;
+- reject malformed descriptors, nonce mismatches, and replay; and
+- work through both direct and GAM/Universal Creative paths.
 
-**Solution:**
-Add backend to Fastly (see Step 1)
+If script rendering requires weakening the outer sandbox, leave `allow_script_creatives = false` and consult APS instead.
 
-### Problem: Parse errors
+## Migration from the legacy APS integration
 
-**Check:**
+This release is a direct protocol cutover:
 
-- Enable debug logging
-- Verify endpoint URL is correct
-- Check APS API for changes
+1. Replace the legacy `/e/dtb/bid` endpoint with `/e/pb/bid`.
+2. Rename `pub_id` to `account_id`.
+3. Remove APS-specific slot ID configuration and remove `aps` from Prebid Server bidder lists. Trusted Server also filters APS from PBS requests for this path.
+4. Prepare GAM line items and Universal Creative for `hb_bidder=aps` and the selected APS `hb_adid`.
+5. Disable publisher-native APS demand for the Trusted Server test cohort.
 
-**Solutions:**
+There is no legacy runtime switch. Roll back by disabling `[integrations.aps]`, restoring native APS for the cohort, or deploying the prior binary.
 
-- Enable debug logging to inspect response
-- Verify APS endpoint is correct
-- Check for API changes (update structs if needed)
+## Rollout
 
-### Timeout Errors
+Use fictional values in source-controlled configuration and fixtures. Supply controlled account details out of band.
 
-**Symptoms:**
+1. Obtain APS account-team confirmation for edge-originated OpenRTB traffic.
+2. Enable Trusted Server APS only for an isolated cohort and disable native APS demand there.
+3. Keep `allow_script_creatives = false` and observe iframe bids through direct and GAM paths.
+4. Confirm outbound privacy fields, aggregate diagnostics, decoded-price competition, line-item targeting, dimensions, click-throughs, and opaque-origin isolation.
+5. Run the restrictive-CSP browser proof for script behavior.
+6. Only then enable script creatives for the isolated cohort and validate them in a real browser.
+7. Expand traffic only after APS confirmation and successful controlled validation.
 
-```
-APS request failed: Timeout
-```
-
-**Solutions:**
-
-- Increase `timeout_ms` in config
-- Check backend connectivity
-- Verify DNS resolution for `aax.amazon-adsystem.com`
+## Troubleshooting
 
-## Performance Tuning
+### No APS bids
 
-### Timeout Configuration
+- Confirm `account_id` and account eligibility with APS.
+- Confirm the endpoint is `/e/pb/bid` and uses HTTPS without credentials.
+- Ensure `aps` appears in `auction.providers`.
+- Check aggregate APS drop reasons for currency, dimensions, render source, URL, tag type, or script-gate rejection.
+- Confirm the provider timeout fits inside the auction timeout.
 
-- **Default**: 800ms (matches APS client-side behavior)
-- **Aggressive**: 500ms (reduce latency, may miss some bids)
-- **Conservative**: 1200ms (maximize fill rate)
+### Winner targets but does not render
 
-```toml
-[integrations.aps]
-timeout_ms = 800  # Balance latency vs fill rate
-```
+- Confirm `GET /integrations/aps/renderer` returns HTML with its CSP and `Referrer-Policy: no-referrer`.
+- Confirm publisher CSP permits `frame-src 'self'`.
+- Confirm the GAM creative uses the supported Prebid Universal Creative bridge and the winning `hb_adid`.
+- Ensure no native APS path is trying to handle the same cohort.
+- Keep script creatives disabled while diagnosing iframe rendering.
 
-### Orchestrator Timeout
+## Verification
 
-Ensure orchestrator timeout exceeds provider timeout:
-
-```toml
-[auction]
-timeout_ms = 2000  # > sum of all provider timeouts
-
-[integrations.aps]
-timeout_ms = 800
+```bash
+cargo test-fastly integrations::aps
+cargo test-fastly auction::orchestrator
+cargo test-fastly integrations::adserver_mock
 
-[integrations.prebid]
-timeout_ms = 1000
+cd crates/trusted-server-js/lib
+npx vitest run test/integrations/aps/render.test.ts test/core/auction.test.ts
 ```
 
-## Integration with Client-Side
-
-While this implementation focuses on server-side bidding, you can optionally add client-side components later:
-
-1. **ID Resolution**: Integrate third-party ID vendors client-side
-2. **Analytics**: Load `aps_csm.js` for viewability tracking
-3. **Config Loading**: Fetch `/configs/{pub_id}` for advanced settings
-
-See the original network flow documentation for client-side patterns.
-
-## Future Enhancements
-
-Potential additions for complete APS TAM parity:
-
-1. **Video Support**: Add video slot formats
-2. **ID Enrichment**: Server-side ID resolution (LiveRamp, ID5, etc.)
-3. **Advanced Targeting**: Pass user segments, geo data
-4. **Config API**: Fetch APS configuration from `/configs/{pub_id}`
-5. **Analytics**: Integrate with APS measurement endpoints
-
-## Reference
-
-- **APS TAM Docs**: https://aps.amazon.com/aps/transparent-ad-marketplace-api/
-- **Integration Code**: `crates/trusted-server-core/src/integrations/aps.rs`
-- **Tests**: `crates/trusted-server-core/src/integrations/aps.rs#tests`
-- **Example Config**: `trusted-server.toml`
-
-## Support
-
-Questions? Issues?
-
-1. Check logs: `fastly compute serve`
-2. Run tests: `cargo test aps`
-3. Verify configuration in `trusted-server.toml`
-4. Review this documentation
-
----
-
-**Status**: ✅ Production Ready (Server-Side Bidding)
-
-**Last Updated**: 2025-12-23
+See `crates/trusted-server-core/src/integrations/aps.rs` for the request/parser implementation and `crates/trusted-server-js/lib/src/integrations/aps/render.ts` for the browser renderer contract.
diff --git a/docs/roadmap.md b/docs/roadmap.md
index d76c14b96..e0b16e336 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -75,6 +75,12 @@ Our development is focused on three key areas:
 - Real-time cohort updates
 - Secure Signals integration
 
+**Amazon Publisher Services (APS) OpenRTB Integration**
+
+- Banner OpenRTB bidding with decoded-price competition
+- Opaque sandboxed rendering for direct and GAM/Universal Creative paths
+- Controlled rollout pending APS account-team confirmation for edge-originated traffic
+
 ### Planned for 2026
 
 **Full Google Ad Manager (GAM) Support**
@@ -84,12 +90,6 @@ Our development is focused on three key areas:
 - Programmatic guaranteed support
 - First-party GAM reporting
 
-**Amazon Publisher Services (APS) Integration**
-
-- Transparent Ad Marketplace (TAM) support
-- A9 bidding integration
-- First-party APS header bidding
-
 **Kargo SSP Integration**
 
 - Native Kargo bid adapter
diff --git a/docs/superpowers/plans/2026-07-15-aps-openrtb-first-class-integration.md b/docs/superpowers/plans/2026-07-15-aps-openrtb-first-class-integration.md
new file mode 100644
index 000000000..0f89e6f9f
--- /dev/null
+++ b/docs/superpowers/plans/2026-07-15-aps-openrtb-first-class-integration.md
@@ -0,0 +1,897 @@
+# Amazon APS OpenRTB First-Class Integration Implementation Plan
+
+> **For agentic workers:** Implement task-by-task with tests first. Do not use bare
+> `cargo test --workspace`; use the adapter-aware aliases from `.cargo/config.toml`.
+> Commit or push only when the supervising user explicitly requests it.
+
+**Goal:** Replace the legacy APS `/e/dtb/bid` integration with APS OpenRTB,
+participate with decoded prices without mediation, and render APS banner creatives in
+the direct-auction and GPT/page-bids browser paths.
+
+**Architecture:** Keep APS request/response policy in an APS-specific OpenRTB adapter.
+Map the response into the shared `Bid` plus a typed, versioned APS renderer descriptor.
+Carry that descriptor through `/auction` and the publisher bid map. TSJS builds a
+Trusted Server-owned bootstrap for the fixed APS `prebid-creative.js` runner and
+executes it in the approved sandbox. Ordinary `adm` remains on the existing mandatory
+sanitize/rewrite path.
+
+**Tech stack:** Rust 2024, generated OpenRTB types, serde/serde_json, base64 0.22,
+error-stack, URL validation, TypeScript, Vitest, Prebid Universal Creative messaging.
+
+**Spec:**
+`docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md`
+
+**Branch:** `issue-764-aps-openrtb`
+
+---
+
+## Context and guardrails for every task
+
+- APS may be implemented and tested before production edge support is confirmed.
+  Broad production rollout remains blocked until the APS account team confirms the
+  Fastly/edge contract.
+- Send APS SDK identity `{ "source": "prebid", "version": "2.2.0" }`.
+- Build the exact renderer allowlist: one bid with only `id`, `price`, `w`, `h`,
+  `ext.creativeurl`, and `ext.tagtype`. Do not preserve unknown fields or silently
+  expose the complete APS response.
+- The outer renderer sandbox must omit `allow-same-origin`.
+  `allow_script_creatives` is a server-side capability gate that defaults false;
+  disabled script bids must be dropped before candidate reduction/winner selection.
+  Enable it only under the staged opaque-origin and controlled-account test policy.
+- APS user sync and APS `nurl`/`burl` delivery are out of scope. Do not add either
+  browser path.
+- Cut over directly. Keep `pub_id` as an alias only; do not add a legacy protocol
+  switch.
+- When a Trusted Server APS renderer is present, do not call
+  `apstag.setDisplayBids()`.
+- Banner only. Do not advertise APS video support in this issue.
+- Do not weaken `sanitize_creative_html` or its tests.
+- Raw APS requests/responses remain TRACE-only. Never log real account IDs, EIDs,
+  consent strings, creative URLs, bid tokens, or response bodies at normal levels.
+- All committed fixtures/docs use fictional `example` values. Controlled test-account
+  values stay out of the repository and terminal transcripts intended for review.
+- Use `error-stack`; no anyhow/eyre/thiserror in core code.
+- Use `log::` macros, not `println!`; use descriptive `expect("should ...")`, not
+  `unwrap()`.
+- Run the focused test immediately after each production-code change.
+
+---
+
+## File map
+
+### Rust core
+
+- `crates/trusted-server-core/src/auction/types.rs`: bid identifiers and typed
+  renderer contract.
+- `crates/trusted-server-core/src/openrtb.rs`: narrowly scoped request/bid extension
+  serialization types if they are shared outside APS.
+- `crates/trusted-server-core/src/integrations/aps.rs`: configuration, OpenRTB request,
+  response parser, exact renderer envelope, candidate reduction, static renderer route,
+  diagnostics and provider dispatch.
+- `crates/trusted-server-core/src/integrations/mod.rs`: register the APS proxy route as
+  well as the separate auction provider.
+- `crates/trusted-server-core/src/auction/formats.rs`: page derivation and `/auction`
+  renderer extension.
+- `crates/trusted-server-core/src/auction/orchestrator.rs`: decoded-price direct-winner
+  coverage and stale-comment removal.
+- `crates/trusted-server-core/src/integrations/adserver_mock.rs`: preserve renderer and
+  IDs through mediation.
+- `crates/trusted-server-core/src/publisher.rs`: normal bid-map renderer transport and
+  APS `hb_adid`.
+
+### Browser
+
+- `crates/trusted-server-js/lib/src/core/types.ts`: APS renderer wire type.
+- `crates/trusted-server-js/lib/src/core/auction.ts`: parse `/auction` renderer ext.
+- `crates/trusted-server-js/lib/src/core/request.ts`: direct APS render dispatch.
+- New `crates/trusted-server-js/lib/src/integrations/aps/render.ts`: exact envelope
+  decoding/cross-checking, opaque renderer frame creation and postMessage dispatch.
+- `crates/trusted-server-js/lib/src/integrations/gpt/index.ts`: exact APS Universal
+  Creative bridge, APS beacon suppression and native-APS hook removal.
+- New `crates/trusted-server-js/lib/test/fixtures/aps-renderer-v1.json`: shared Rust/TS
+  golden wire fixture.
+- New `crates/trusted-server-js/lib/test/integrations/aps/render.test.ts` plus existing
+  core/GPT tests.
+- `crates/trusted-server-integration-tests/browser/`: restrictive-CSP and opaque-origin
+  Playwright coverage.
+
+### Configuration and docs
+
+- `trusted-server.example.toml`
+- `docs/guide/integrations/aps.md`
+- `CHANGELOG.md`
+
+---
+
+## Task 1: Add typed bid identifiers and renderer state
+
+**What:** Give the shared auction model enough typed state to distinguish OpenRTB bid,
+ad, and creative IDs and carry a validated APS renderer without using arbitrary
+metadata.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/auction/types.rs`
+- Modify: every production/test `Bid { ... }` construction found by
+  `rg -n 'Bid \{' crates/trusted-server-core`
+- Test: `crates/trusted-server-core/src/auction/types.rs`
+
+- [ ] Add failing serde tests for a bid with:
+  - separate `bid_id`, `ad_id`, and `creative_id`;
+  - an APS renderer version, account ID, selected bid ID, tag type, creative URL,
+    encoded response, and dimensions; and
+  - `renderer = None` omission for ordinary bids.
+- [ ] Define a strict `ApsTagType` enum with only `Iframe` and `Script`.
+- [ ] Define a versioned, typed renderer enum/descriptor. The serialized renderer must
+      use camelCase and a discriminator equivalent to:
+
+  ```json
+  {
+    "type": "aps",
+    "version": 1,
+    "accountId": "example-account-id",
+    "bidId": "fictional-bid-id",
+    "creativeId": "fictional-creative-id",
+    "tagType": "iframe",
+    "creativeUrl": "https://creative.example/render",
+    "aaxResponse": "base64-data",
+    "width": 300,
+    "height": 250
+  }
+  ```
+
+- [ ] Add to `Bid`:
+  - `bid_id: Option<String>`;
+  - `creative_id: Option<String>`; and
+  - `renderer: Option<...>`.
+- [ ] Make descriptor `creativeId` optional and omit it when APS does not return
+      `crid`; add a serde test for the absent-`crid` case.
+- [ ] Correct stale comments saying APS prices are encoded or that APS has no creative
+      delivery mechanism.
+- [ ] Update every `Bid` literal. Use `None` outside production parser paths; do not use
+      serde defaults to hide missed production mappings.
+- [ ] Update Prebid's `parse_bid` to preserve OpenRTB `id` as `bid_id` and `crid` as
+      `creative_id`, while retaining the existing strict `adid -> ad_id` semantics.
+- [ ] Run the focused tests:
+
+  ```bash
+  cargo test-fastly auction::types
+  cargo test-fastly integrations::prebid::tests::parse_bid
+  ```
+
+- [ ] Run `cargo fmt --all` and `cargo check-fastly` before proceeding.
+
+**Expected result:** Shared bids can represent APS renderer state without overloading
+`ad_id` or leaking renderer data through general metadata.
+
+---
+
+## Task 2: Cut APS configuration over to the OpenRTB contract
+
+**What:** Replace the public APS configuration terminology and default endpoint before
+replacing request/response behavior.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/integrations/aps.rs`
+- Test: existing APS test module in the same file
+
+- [ ] Add failing configuration tests proving:
+  - `account_id = "example-account-id"` deserializes;
+  - legacy `pub_id` deserializes to the same field;
+  - string and integer compatibility is retained;
+  - empty and whitespace-only strings fail validation;
+  - surrounding whitespace is trimmed deterministically;
+  - supplying both names fails as a duplicate field;
+  - the default endpoint is `/e/pb/bid`;
+  - HTTP, missing-host, and credential-bearing endpoint overrides fail validation; and
+  - APS remains disabled by default; and
+  - `allow_script_creatives` defaults false.
+- [ ] Rename `ApsConfig.pub_id` to `account_id`, using `pub_id` only as a serde alias.
+      Trim string values, reject empty-after-trim, normalize integers to strings, and
+      rename the custom deserializer/error text accordingly.
+- [ ] Add `allow_script_creatives: bool` with a serde default of `false`. Treat it as a
+      server-side bid-eligibility capability, not a browser-only rendering preference.
+- [ ] Change `default_endpoint()` to:
+
+  ```text
+  https://web.ads.aps.amazon-adsystem.com/e/pb/bid
+  ```
+
+- [ ] Replace generic URL-only endpoint validation with a custom check requiring HTTPS,
+      a non-empty host, and no username/password. Do not add a plaintext test exception:
+      the endpoint response is trusted to select executable renderer data.
+- [ ] Remove account IDs from registration and request INFO logs. Log only that APS was
+      registered and the endpoint/provider-safe state needed operationally.
+- [ ] Change `supports_media_type` to banner only.
+- [ ] Run:
+
+  ```bash
+  cargo test-fastly integrations::aps::tests
+  ```
+
+- [ ] Run `cargo fmt --all -- --check`.
+
+**Expected result:** Existing configs continue through `pub_id`, new configs use
+`account_id`, and no runtime protocol switch is introduced.
+
+---
+
+## Task 3: Replace the legacy request builder with APS OpenRTB
+
+**What:** Delete the private `/e/dtb/bid` request types and build the request described
+by the design spec from trusted auction context.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/integrations/aps.rs`
+- Modify only if useful: `crates/trusted-server-core/src/openrtb.rs`
+- Modify: `crates/trusted-server-core/src/auction/formats.rs`
+- Test: APS and auction-format test modules
+
+### 3.1 Request fixture tests
+
+- [ ] Add a failing complete-request test with fictional values. Assert exact JSON for:
+  - request `id`, `tmax`, and `cur = ["USD"]`;
+  - `ext.account`;
+  - `ext.sdk.source = "prebid"` and `version = "2.2.0"`;
+  - one impression per eligible slot with direct `imp.id` mapping;
+  - banner `format`, first `w`/`h`, `topframe = 0`, floor, floor currency, and
+    unconditional `secure = 1`;
+  - site page/domain/publisher fields;
+  - consent-allowed user ID and EIDs;
+  - UA/IP/language/DNT and coarse geo;
+  - TCF/USP/GPP registrations with COPPA omitted because no trusted signal exists; and
+  - absence of all PBS-only request and impression extensions.
+- [ ] Add focused privacy/validation tests:
+  - latitude/longitude are omitted while permitted coarse geo remains;
+  - gated-out user/EID values stay absent;
+  - no user data, keywords, gender, YOB, customdata, cookies, or arbitrary headers;
+  - non-banner slots are omitted;
+  - dimensions above `i32::MAX` are omitted safely;
+  - empty/invalid formats cannot create a malformed impression;
+  - configured and effective timeout use the orchestrator-granted budget.
+
+### 3.2 `/auction` page derivation
+
+- [ ] Add failing tests to `auction/formats.rs` proving:
+  - a valid same-publisher HTTP(S) `Referer` becomes the `/auction` current page;
+  - userinfo, wrong-host, non-HTTP(S), malformed, and oversized URLs are rejected;
+  - rejection falls back to the configured publisher origin; and
+  - no unrestricted browser body field is accepted as page context.
+- [ ] Implement a small private URL-validation helper. Reuse it in APS referrer
+      handling if practical, but do not make it a broad URL-policy refactor.
+
+### 3.3 Implementation
+
+- [ ] Remove `ApsBidRequest`, `ApsSlot`, legacy consent wrappers, slot-ID fallback, and
+      `to_aps_request`.
+- [ ] Add APS request extension types locally in `aps.rs` unless another module must
+      serialize them. Implement `ToExt` consistently with existing OpenRTB extension
+      types.
+- [ ] Implement `build_openrtb_request(&AuctionRequest, &AuctionContext)` using generated
+      OpenRTB types and `to_openrtb_i32`.
+- [ ] Build registrations from the existing `ConsentContext` placements. Copy only the
+      small field mapping needed by APS; do not expose/refactor the PBS builder in this
+      task.
+- [ ] Derive `site.ref` only from a valid HTTP(S) downstream `Referer` that differs from
+      the normalized current page.
+- [ ] Change `request_bids` to serialize/send the OpenRTB body with
+      `Content-Type: application/json`, the existing bounded auction timeout, and no
+      forwarded cookies.
+- [ ] Keep serialized request logging at TRACE.
+- [ ] Run:
+
+  ```bash
+  cargo test-fastly integrations::aps::tests
+  cargo test-fastly auction::formats
+  cargo check-fastly
+  ```
+
+- [ ] Review serialized request fixtures against the immutable upstream request code;
+      explicitly confirm no `ext.prebid` or Trusted Server signing extension appears.
+
+**Expected result:** Every eligible APS banner slot produces a standards-based OpenRTB
+impression with explicit APS and privacy policy.
+
+---
+
+## Task 4: Parse APS OpenRTB and build the minimized renderer envelope
+
+**What:** Replace `contextual.slots` parsing with strict `seatbid` parsing, decoded CPM,
+one APS candidate per impression, and the exact renderer envelope.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/integrations/aps.rs`
+- Test: APS test module
+
+### 4.1 Add failing response tests
+
+- [ ] A runner-compatible banner bid maps:
+  - `id -> bid_id`;
+  - optional `adid -> ad_id` and `crid -> creative_id`;
+  - `impid -> slot_id`;
+  - decoded price/USD, dimensions and domains;
+  - `Bid.bidder = "aps"` regardless of upstream seat; and
+  - `ext.creativeurl`/`ext.tagtype` into the typed renderer.
+- [ ] Missing, string, numeric, and unexpected seat values never become `Bid.bidder` or
+      `hb_bidder` and do not invalidate an otherwise valid bid.
+- [ ] A valid runner-compatible bid without `crid` remains renderable with no
+      `creativeId` in the descriptor.
+- [ ] The immutable official adapter fixture (`ext.bidder` only) is an expected safe
+      drop because the live runner requires `creativeurl`/`tagtype`.
+- [ ] `iframe` and `script` parse into strict enum variants. With
+      `allow_script_creatives = false`, every script bid is safe-dropped before
+      per-impression reduction and winner selection; iframe bids remain eligible.
+- [ ] With one higher-priced script bid and one lower-priced iframe bid for the same
+      impression, the disabled script cannot win and the iframe candidate survives.
+      With only disabled script bids, APS returns no bid.
+- [ ] An APS bid with `adm` but no valid URL/tag type is dropped. When valid renderer
+      metadata coexists with `adm`, all markup is excluded from the browser envelope
+      and `Bid.creative`.
+- [ ] HTTP 204, empty/missing `seatbid`, and seat bids with no bids are normal no-bids.
+- [ ] Legacy `{ "contextual": ... }` is `Error`/`unexpected_response_shape`.
+- [ ] Drop individual bids with unknown/missing `impid`, invalid price/currency/media,
+      missing/zero/out-of-range/incompatible `w` or `h`, missing bid ID, invalid tag
+      type, disabled script capability, or invalid creative URL.
+- [ ] Creative URLs using HTTP, credentials, excessive length, malformed syntax, or the
+      configured publisher origin are rejected.
+- [ ] One structurally malformed bid does not discard another valid bid. Invalid JSON or
+      non-representable numeric literals fail the complete response.
+- [ ] APS `nurl`/`burl` are intentionally discarded, and top-level `ext.userSyncs`
+      reaches neither `Bid`, diagnostics, nor renderer data.
+- [ ] Diagnostics contain only fixed reason/count keys and never IDs, URLs, payloads,
+      account values, seats, or raw extension data.
+
+### 4.2 Exact envelope and collision tests
+
+- [ ] Add `test/fixtures/aps-renderer-v1.json` containing exactly:
+  - root `seatbid`;
+  - one seat object containing only `bid`;
+  - one bid containing only `id`, `price`, `w`, `h`, and `ext`; and
+  - `ext` containing only `creativeurl` and `tagtype`.
+- [ ] Assert Rust serialization equals that golden JSON semantically and that decoded
+      `aaxResponse` has no top-level ID/currency, seat, impid, ad/crid/domain,
+      notifications, markup, syncs, sibling bids, or unknown extensions.
+- [ ] Remove unknown fields after transient parsing; do not copy an upstream extension
+      map wholesale into the renderer envelope.
+- [ ] Add a response over the 256 KiB pre-base64 cap and assert
+      `render_payload_too_large`.
+- [ ] Add two valid APS bids with the same impression/seat. Assert the parser returns
+      only the highest price; for a tie, lexicographically lowest bid ID wins with its
+      own matching renderer payload.
+
+### 4.3 Implementation
+
+- [ ] Remove all legacy request/response types, slot maps and tests.
+- [ ] Special-case HTTP 204 before body collection/JSON parsing.
+- [ ] Parse the response as `serde_json::Value`, validate response-level fields, then
+      validate each bid independently so a wrong-typed bid cannot discard valid
+      siblings.
+- [ ] Set `Bid.bidder = "aps"`; discard upstream seat/network ID unless a bounded typed
+      internal consumer is introduced. Set APS `nurl = None` and `burl = None`.
+- [ ] Require present, positive, compatible `w` and `h`. Apply
+      `allow_script_creatives` before adding a candidate to the per-impression group so
+      a disabled script cannot reach floors, mediation, or winner selection.
+- [ ] Validate creative URL against the configured publisher origin and build the exact
+      allowlisted envelope from new values rather than cloning upstream objects.
+- [ ] Group accepted candidates by `impid`, reduce deterministically to one, then build
+      the final `AuctionResponse` and aggregate diagnostics.
+- [ ] Preserve `collect_response_bounded(..., UPSTREAM_RTB_MAX_RESPONSE_BYTES, "aps")`,
+      TRACE-only raw body logging, and safe aggregate normal logs.
+- [ ] Run:
+
+  ```bash
+  cargo test-fastly integrations::aps::tests
+  cargo fmt --all -- --check
+  cargo clippy-fastly
+  ```
+
+**Expected result:** APS returns at most one priced, renderer-compatible candidate per
+impression, with an exact browser envelope and stable `bidder = "aps"`.
+
+---
+
+## Task 5: Emit APS winners through `/auction` and prove direct selection
+
+**What:** Use the new identifiers and renderer in the OpenRTB response without
+manufacturing an empty creative, then replace the old mediation assumptions.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/auction/formats.rs`
+- Modify: `crates/trusted-server-core/src/openrtb.rs` if a typed bid extension helper is
+  useful
+- Modify: `crates/trusted-server-core/src/auction/orchestrator.rs`
+- Test: format and orchestrator test modules
+
+### 5.1 Failing tests
+
+- [ ] `/auction` maps `Bid.bid_id`, `ad_id`, and optional `creative_id` to OpenRTB
+      `id`, `adid`, and optional `crid` instead of fabricating APS identifiers.
+- [ ] An APS renderer winner has no `adm` key and has
+      `ext.trusted_server.renderer` with the complete versioned descriptor—not a
+      `{type,version}` abbreviation.
+- [ ] A normal `Bid.creative` is still sanitized and rewritten before becoming `adm`.
+- [ ] A winning bid with neither creative nor renderer fails explicitly; it does not
+      serialize `adm: ""`.
+- [ ] A renderer descriptor does not enter the HTML sanitizer.
+- [ ] APS decoded price wins with no mediator when it is highest.
+- [ ] APS loses to a higher clear-price bid.
+- [ ] APS is removed below a slot floor.
+- [ ] Optional mediator presence does not make decoded APS pricing special.
+
+### 5.2 Implementation
+
+- [ ] Add a typed bid-extension serializer for `trusted_server.renderer`.
+- [ ] In `convert_to_openrtb_response`:
+  - preserve real bid/ad/creative IDs;
+  - process `creative` only through the existing sanitize/rewrite branch;
+  - emit renderer ext only for a typed renderer; and
+  - return an auction error for a winner with no render source.
+- [ ] Remove stale “mediation should have provided creative” APS assumptions and encoded
+      price comments.
+- [ ] Replace old orchestrator APS tests with decoded-price/floor tests. Do not change the
+      winner algorithm itself.
+- [ ] Run:
+
+  ```bash
+  cargo test-fastly auction::formats
+  cargo test-fastly auction::orchestrator
+  cargo fmt --all -- --check
+  ```
+
+**Expected result:** Direct clients receive a priced APS winner with an explicit render
+capability and never mistake an empty `adm` for a creative.
+
+---
+
+## Task 6: Preserve APS renderer state through mediation and publisher bid maps
+
+**What:** Ensure both publisher paths expose the same APS descriptor and a mediator
+cannot accidentally strip it.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/integrations/adserver_mock.rs`
+- Modify: `crates/trusted-server-core/src/publisher.rs`
+- Test: tests in both files
+
+### 6.1 Mediation tests
+
+- [ ] Add a regression test documenting the current collision: two unreduced APS bids
+      with the same provider/slot/bidder overwrite the `(provider, slot, bidder)` index
+      and can restore the wrong renderer.
+- [ ] Feed the parser's reduced APS response into mediation and prove only the selected
+      source bid reaches the index/request and its bid ID/renderer survive reconstruction.
+- [ ] Keep the broader mediator index unchanged in this issue; APS avoids its existing
+      ambiguity by returning one candidate per impression. Extend restoration only for
+      `bid_id`, optional `creative_id`, and renderer while preserving existing non-APS
+      notification/cache behavior.
+- [ ] Run:
+
+  ```bash
+  cargo test-fastly integrations::adserver_mock
+  ```
+
+### 6.2 Bid-map tests
+
+- [ ] Add failing `build_bid_map` tests proving:
+  - APS renderer is present when `include_adm = false`;
+  - renderer data is identical for initial-page and page-bids serialization;
+  - `hb_bidder` is always `aps`, never upstream seat/network ID;
+  - `hb_adid` uses APS selected `bid_id` ahead of OpenRTB `adid`;
+  - PBS Cache UUID remains highest priority for PBS bids;
+  - APS `nurl`/`burl` are absent while existing non-APS notifications are unchanged;
+  - no general metadata is exposed in normal mode;
+  - `aaxResponse` and account data survive `build_bids_script` escaping without
+    breaking out of the script; and
+  - a non-APS bid has no renderer property.
+- [ ] Update `build_bid_map` to serialize typed renderer data normally while retaining
+      `adm`/`debug_bid` only under the existing debug flag.
+- [ ] Set APS `hb_adid` from the descriptor's selected bid ID. Preserve current cache and
+      ad-ID fallbacks.
+- [ ] Update `debug_bid` deliberately: IDs may be shown under existing debug behavior,
+      but do not duplicate the potentially large encoded renderer envelope there.
+- [ ] Run:
+
+  ```bash
+  cargo test-fastly publisher
+  cargo fmt --all -- --check
+  ```
+
+**Expected result:** Direct, mediated, initial-navigation, and SPA auction paths retain
+one typed APS render contract without exposing losing bids or arbitrary metadata.
+
+---
+
+## Task 7: Add the opaque APS renderer endpoint and direct-auction integration
+
+**What:** Serve a static renderer document with its own CSP, validate the exact data the
+vendor consumes, and keep all APS/bidder execution below an outer opaque-origin
+sandbox.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/integrations/aps.rs`
+- Modify: `crates/trusted-server-core/src/integrations/mod.rs`
+- New: `crates/trusted-server-js/lib/src/integrations/aps/render.ts`
+- New: `crates/trusted-server-js/lib/test/integrations/aps/render.test.ts`
+- New: `crates/trusted-server-js/lib/test/fixtures/aps-renderer-v1.json`
+- Modify: `crates/trusted-server-js/lib/src/core/types.ts`
+- Modify: `crates/trusted-server-js/lib/src/core/auction.ts`
+- Modify: `crates/trusted-server-js/lib/src/core/request.ts`
+- Modify: `crates/trusted-server-js/lib/test/core/auction.test.ts`
+- Modify/add: `crates/trusted-server-integration-tests/browser/`
+
+### 7.1 Shared wire contract
+
+- [ ] Add TypeScript discriminated types matching the Rust descriptor, with optional
+      `creativeId`.
+- [ ] Make the shared fictional JSON fixture the source of truth: Rust serialization
+      equals it and TS tests import it.
+- [ ] Add `/auction` parser tests for valid renderer ext, absent APS `adm`, optional
+      creative ID, ordinary non-APS `adm`, unrelated ext, and malformed descriptors.
+- [ ] Keep parsing structural; complete trust validation happens before DOM/message
+      side effects.
+
+### 7.2 Static renderer endpoint
+
+- [ ] Add APS to `integrations::builders()` as a proxy registration using the same
+      validated `ApsConfig`, `.with_proxy(...)`, and `.without_js()`.
+- [ ] Register only `GET /integrations/aps/renderer` and return a static document—no
+      account, bid, URL, or response data in HTML.
+- [ ] Add Rust tests for exact route registration, method rejection, content type,
+      `nosniff`, `Referrer-Policy: no-referrer`, and the explicit renderer CSP. The CSP
+      must repeat the approved sandbox tokens without `allow-same-origin` so direct
+      embedding cannot bypass the opaque boundary.
+- [ ] Before loading the vendor runner, the static initializer reads and strictly
+      validates the expected nonce from the iframe URL fragment, stores it, removes the
+      fragment from visible history, and installs its one-message listener.
+- [ ] The static script accepts one parent message, verifies `event.source`, version,
+      exact structure, and equality with the independently fragment-bound nonce, then
+      removes its listener, initializes the official account queue, dispatches
+      `prebid/creative/render`, and dynamically loads the fixed runner. Reply with the
+      accepted nonce only after runner load (or report runner failure). Because the
+      sandbox origin is opaque, use `"*"` as the target origin in both directions but
+      require the exact child/source window and one-time nonce.
+- [ ] Load only the fixed Amazon runner URL; do not interpolate renderer data into
+      script text, HTML, `srcdoc`, `document.write`, or another executable sink.
+- [ ] Run:
+
+  ```bash
+  cargo test-fastly integrations::aps
+  cargo test-fastly integrations::tests
+  ```
+
+### 7.3 Decode and cross-check consumed data
+
+- [ ] `validateApsRenderer` must base64-decode UTF-8 JSON and require the exact allowlist:
+      one seat, one bid, exact bid/ext keys, finite price, dimensions, URL, and tag type.
+- [ ] Cross-check decoded ID/dimensions/URL/tag type against descriptor fields.
+- [ ] Reject unknown keys, markup, notifications, syncs, invalid base64/UTF-8/JSON,
+      non-HTTPS or credential-bearing URLs, and URLs matching `location.origin`.
+- [ ] Validate before slot clearing, `stopImmediatePropagation`, iframe creation, or
+      `postMessage`.
+- [ ] Repeat message/envelope validation inside the static renderer document.
+
+### 7.4 Opaque direct renderer
+
+- [ ] `renderApsCreative` creates a sized iframe with `src` set to
+      `/integrations/aps/renderer`; it never uses outer `srcdoc`.
+- [ ] Apply exactly these tokens and assert `allow-same-origin` is absent:
+
+  ```text
+  allow-forms
+  allow-pointer-lock
+  allow-popups
+  allow-popups-to-escape-sandbox
+  allow-scripts
+  allow-top-navigation-by-user-activation
+  ```
+
+- [ ] Generate at least 128 random bits per frame with `crypto.getRandomValues`, encode
+      them as strict base64url, and set `iframe.src` to the trusted renderer URL with
+      that nonce in the fragment before insertion/navigation. After load, post the
+      validated descriptor with the same nonce. Clear existing content and reveal the
+      frame only after an exact source- and nonce-bound runner-ready acknowledgement;
+      remove an unacknowledged or failed hidden frame after a bounded timeout.
+- [ ] Reject a missing/malformed fragment, nonce mismatch, repeat, or stale message; a
+      nonce carried only in the posted message is not sufficient.
+- [ ] Leave existing slot content intact on validation/load failure and log no payload,
+      account, URL or bid ID.
+- [ ] Dispatch valid APS renderer bids before ordinary non-APS `adm`; do not change the
+      generic sanitizer/renderer.
+
+### 7.5 Restrictive-CSP and origin proof
+
+- [ ] Add Playwright coverage using a restrictive publisher CSP that permits only
+      `frame-src 'self'` for the renderer route.
+- [ ] Use a local fictional runner/creative implementation matching observed APS
+      iframe/script behavior; CI must not depend on the live Amazon script.
+- [ ] Prove iframe and fetched-HTML script creatives cannot read or modify
+      `top.document`, even though the nested vendor frame requests
+      `allow-same-origin`. Also embed the renderer without an iframe sandbox attribute
+      and prove the response-level CSP sandbox still keeps it opaque.
+- [ ] Prove the renderer route's CSP permits required HTTPS ad resources, the outer
+      frame stays opaque, malformed/mismatched envelopes or fragment/message nonce
+      mismatches do not clear slots, replay is rejected, and the runner can size/render
+      without parent-origin `frameElement` access.
+- [ ] Keep `allow_script_creatives = false` for normal traffic during local browser
+      proof. If script rendering/resizing fails, keep the server gate false and stop for
+      an APS-supported isolated renderer contract. Never add `allow-same-origin` to the
+      outer frame.
+- [ ] Run:
+
+  ```bash
+  cd crates/trusted-server-js/lib
+  npx vitest run test/integrations/aps/render.test.ts test/core/auction.test.ts
+  node build-all.mjs
+  npm run format
+
+  cd ../../../crates/trusted-server-integration-tests/browser
+  npx playwright test
+  ```
+
+**Expected result:** Direct APS rendering uses a separately served document below an
+opaque outer sandbox with a pre-bound, one-time nonce; script bids cannot win while the
+default-off server capability is disabled.
+
+---
+
+## Task 8: Integrate APS with the GPT/Prebid Universal Creative bridge
+
+**What:** Serve APS descriptors through the existing source-checked `Prebid Request`
+message path and stop signaling the native APS SDK for TS winners.
+
+**Files:**
+
+- Modify: `crates/trusted-server-js/lib/src/integrations/gpt/index.ts`
+- Modify: `crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts`
+- Modify if needed: `crates/trusted-server-js/lib/test/integrations/gpt/index.test.ts`
+- Reuse: `src/integrations/aps/render.ts`
+
+### 8.1 Add failing bridge tests
+
+- [ ] A matching APS `hb_adid` and renderer:
+  - is accepted only from the owning slot's message source;
+  - is fully decoded/cross-checked before `stopImmediatePropagation()`;
+  - does not fetch PBS Cache or fire generic nurl/burl beacons;
+  - posts one exact serializable `Prebid Response` using the deployed Universal
+    Creative renderer version; and
+  - creates only the opaque renderer-route iframe before posting the descriptor.
+- [ ] Two concurrent requests for the same APS ad ID do not double-render.
+- [ ] An APS descriptor requested from another slot is ignored.
+- [ ] Invalid renderer data does not stop another legitimate handler and does not clear
+      a slot.
+- [ ] Existing debug-ADM and PBS Cache tests remain green.
+- [ ] `adInit()` does not call `apstag.setDisplayBids()` for a bid with a Trusted Server
+      APS renderer, even if `window.apstag` exists.
+- [ ] A publisher-owned native APS SDK remains otherwise untouched; TS does not delete,
+      reinitialize, or monkey-patch it.
+
+### 8.2 Implement bridge support
+
+- [ ] Import the shared envelope validator/opaque-frame helper without importing the
+      full Prebid bundle.
+- [ ] Add the APS branch after source-slot ownership and full renderer validation, before
+      debug ADM/PBS Cache branches.
+- [ ] Define and fixture-test the exact Universal Creative message object, including
+      `rendererVersion`; do not describe or send a non-cloneable function.
+- [ ] Compute an absolute `/integrations/aps/renderer` URL from the trusted publisher
+      page origin before crossing into GAM; a relative URL in the creative frame would
+      resolve against GAM. Validate that URL separately from APS data.
+- [ ] Keep renderer source static and limited to creating the sandboxed iframe with that
+      absolute renderer URL plus a fresh nonce fragment, then post validated data and
+      the matching nonce after load and resolve only after the source- and nonce-bound
+      renderer-ready acknowledgement.
+- [ ] Preserve `renderingAdIds` and live `window.tsjs.bids`. Do not call
+      `fireWinBillingBeacons` for APS; existing non-APS beacon deduplication is unchanged.
+- [ ] Remove the `apstag?.setDisplayBids?.()` block that treats every APS targeting bid
+      as a native SDK bid. Update comments accordingly.
+- [ ] Run:
+
+  ```bash
+  cd crates/trusted-server-js/lib
+  npx vitest run \
+    test/integrations/aps/render.test.ts \
+    test/integrations/gpt/ad_init.test.ts \
+    test/integrations/gpt/index.test.ts \
+    test/integrations/gpt/spa_hook.test.ts
+  npm run format
+  ```
+
+**Expected result:** Initial navigation and SPA page-bids render the selected APS bid
+through the same typed bootstrap, without relying on native `apstag` state.
+
+---
+
+## Task 9: Update operator configuration, migration docs, and changelog
+
+**What:** Replace all legacy public guidance and document test/rollout dependencies.
+
+**Files:**
+
+- Modify: `trusted-server.example.toml`
+- Rewrite: `docs/guide/integrations/aps.md`
+- Modify: `CHANGELOG.md`
+- Review references found by:
+
+  ```bash
+  rg -n 'e/dtb/bid|pub_id|amznbid|amznp|setDisplayBids|APS.*mediat' \
+    --glob '!target/**' .
+  ```
+
+- [ ] Change the example to `account_id` and `/e/pb/bid`, with fictional values.
+- [ ] Document `pub_id` as a compatibility alias and duplicate-name failure.
+- [ ] Remove any claim that `slot_id`/`bidders.aps.slotID` is required for the OpenRTB
+      provider.
+- [ ] Document banner-only scope, USD comparison, decoded-price direct winners, and
+      aggregate diagnostics.
+- [ ] Document both rendering paths, static renderer endpoint, fixed APS runner URL,
+      exact envelope allowlist, fragment-bound nonce, outer sandbox without
+      `allow-same-origin`, renderer endpoint/publisher CSP requirements, and the
+      default-off `allow_script_creatives` server gate.
+- [ ] State that user sync and Trusted Server firing of APS `nurl`/`burl` are not
+      implemented.
+- [ ] State that public APS metadata says PBS unsupported and production edge traffic
+      still requires account-team confirmation.
+- [ ] Add a cohort rollout checklist:
+  - TS APS enabled;
+  - native APS demand disabled for that cohort;
+  - GAM line item/Universal Creative prepared for `hb_bidder=aps` and selected
+    `hb_adid`;
+  - iframe rendering observed first while `allow_script_creatives = false`;
+  - script enabled only for the isolated cohort after local browser proof, then observed
+    in a real browser; and
+  - no real IDs/tokens captured in docs or fixtures.
+- [ ] Document rollback as disabling APS, restoring native APS for the cohort, or binary
+      rollback—not a legacy config switch.
+- [ ] Add a breaking/migration changelog entry for endpoint and canonical field changes.
+- [ ] Run:
+
+  ```bash
+  cd docs
+  npx prettier --write \
+    superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md \
+    superpowers/plans/2026-07-15-aps-openrtb-first-class-integration.md \
+    guide/integrations/aps.md
+  npm run format
+  ```
+
+**Expected result:** Operators cannot accidentally configure the old protocol or assume
+user sync/video/native SDK behavior that no longer exists.
+
+---
+
+## Task 10: Controlled APS and browser verification
+
+**What:** Validate the uncertain external contract without putting account-specific
+material into source control.
+
+**Prerequisites:** Controlled APS account/config supplied out of band; native APS demand
+disabled for the test cohort; representative GAM line items and publisher CSP; local
+restrictive-CSP/opaque-origin script proof already passing.
+
+- [ ] Deploy with APS enabled only in the controlled cohort and
+      `allow_script_creatives = false` initially.
+- [ ] Prove with parser/orchestrator telemetry and tests that disabled script bids are
+      removed before candidate reduction/winner selection and cannot leave a winning
+      slot without a renderer.
+- [ ] Confirm the outbound body has:
+  - `/e/pb/bid` endpoint;
+  - `ext.account` from operator config;
+  - `ext.sdk = { source: "prebid", version: "2.2.0" }`;
+  - expected impressions, floors, page/device/privacy fields; and
+  - no latitude/longitude or disallowed identity fields.
+- [ ] Confirm a bid returns a decoded price and can beat another provider with no
+      mediator.
+- [ ] Confirm the browser receives the exact one-bid allowlist in `aaxResponse`, with no
+      seat, impid, IDs beyond selected bid ID, domains, notifications, markup, syncs,
+      unknown extensions, sibling bids, or losing seats.
+- [ ] Confirm the immutable official no-renderer fixture safe-drops and separately
+      observe real `creativeurl`/`tagtype` responses.
+- [ ] Exercise a real `tagtype=iframe` response through direct `/auction` and
+      navigation/page-bids/GAM while the script gate remains false.
+- [ ] Only after the local browser proof, set `allow_script_creatives = true` for this
+      isolated cohort and exercise a real `tagtype=script` response through both paths.
+      Do not enable it for other traffic yet.
+- [ ] Verify the exact envelope works with the current APS runner. If it does not, record
+      only missing field names/shape, stop rollout, consult APS, and update spec/tests;
+      never preserve unknown fields or fall back to the full response.
+- [ ] Verify the outer frame has an opaque origin, restrictive publisher CSP succeeds,
+      click-through/dimensions work, and bidder content cannot access parent DOM.
+- [ ] If the fixed runner cannot render/resize script creatives without outer
+      `allow-same-origin`, restore `allow_script_creatives = false` and stop; do not
+      weaken the boundary.
+- [ ] Verify `apstag.setDisplayBids()` is not called for the TS winner and APS is not
+      participating twice.
+- [ ] Verify INFO/WARN logs and auction summaries contain no raw response or sensitive
+      values.
+- [ ] Obtain APS account-team confirmation before enabling broad production traffic.
+
+**Expected result:** Iframe creatives render under the default policy; script creatives
+become winner-eligible only for the staged cohort after both browser proof phases pass,
+or the server gate returns to false and rollout stops with a bounded contract gap.
+
+---
+
+## Task 11: Final regression and repository verification
+
+Run the complete required matrix from the repository root.
+
+### Rust formatting, tests, and lint
+
+- [ ] Run:
+
+  ```bash
+  cargo fmt --all -- --check
+  cargo test-fastly
+  cargo test-axum
+  cargo test-cloudflare
+  cargo test-spin
+  cargo clippy-fastly
+  cargo clippy-axum
+  cargo clippy-cloudflare
+  cargo clippy-cloudflare-wasm
+  cargo clippy-spin-native
+  cargo clippy-spin-wasm
+  ```
+
+### Cross-adapter parity
+
+- [ ] Run:
+
+  ```bash
+  cargo test \
+    --manifest-path crates/trusted-server-integration-tests/Cargo.toml \
+    --test parity
+  ```
+
+### JS and docs
+
+- [ ] Run:
+
+  ```bash
+  (cd crates/trusted-server-js/lib && node build-all.mjs)
+  (cd crates/trusted-server-js/lib && npx vitest run)
+  (cd crates/trusted-server-js/lib && npm run format)
+  (cd crates/trusted-server-integration-tests/browser && npx playwright test)
+  (cd docs && npm run format)
+  ```
+
+### Final review
+
+- [ ] Run:
+
+  ```bash
+  git diff --check
+  git status --short
+  ```
+
+- [ ] Review every `Bid` construction and mediator conversion for the new identifiers
+      and renderer field.
+- [ ] Review every `adm` assignment and prove it still passes through server
+      sanitization.
+- [ ] Review every renderer serialization boundary and prove only winning APS data is
+      exposed.
+- [ ] Review logs for account IDs, URLs, bid IDs, payloads, and consent/EID leakage.
+- [ ] Verify no real controlled-account data entered source, tests, docs, comments, or
+      snapshots.
+- [ ] Compare the final behavior against all acceptance criteria in the design spec.
+
+---
+
+## Suggested implementation checkpoints
+
+If commits are requested, keep reviewable checkpoints aligned with the tasks:
+
+1. `Add typed APS renderer state to auction bids`
+2. `Build APS OpenRTB requests`
+3. `Parse APS OpenRTB responses`
+4. `Carry APS renderer metadata to clients`
+5. `Render APS creatives in TSJS and GPT`
+6. `Document APS OpenRTB migration`
+
+Do not combine unrelated refactors with these checkpoints.
diff --git a/docs/superpowers/specs/2026-03-19-auction-orchestration-flow-design.md b/docs/superpowers/specs/2026-03-19-auction-orchestration-flow-design.md
index 02a86d629..4ecfa9e75 100644
--- a/docs/superpowers/specs/2026-03-19-auction-orchestration-flow-design.md
+++ b/docs/superpowers/specs/2026-03-19-auction-orchestration-flow-design.md
@@ -1,5 +1,11 @@
 # 🎯 Auction Orchestration Flow
 
+> [!WARNING]
+> The APS portions of this historical design are superseded by
+> [APS OpenRTB First-Class Integration](./2026-07-15-aps-openrtb-first-class-integration-design.md).
+> The legacy `/e/dtb/bid` contextual flow and encoded-price mediation described below
+> are not current runtime behavior.
+
 ## 🔄 System Flow Diagram
 
 ```mermaid
diff --git a/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md b/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md
new file mode 100644
index 000000000..0a9c84fd1
--- /dev/null
+++ b/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md
@@ -0,0 +1,839 @@
+# Amazon APS OpenRTB First-Class Integration Design
+
+**Date:** 2026-07-15  
+**Status:** Approved for implementation and test; production rollout remains subject to APS account-team validation  
+**Issue:** [#764 — Add the Amazon APS Prebid Adapter as first class integration](https://github.com/IABTechLab/trusted-server/issues/764)
+
+---
+
+## 1. Goal
+
+Replace Trusted Server's legacy Amazon Publisher Services (APS/TAM) wire contract
+with the OpenRTB contract used by the official APS Prebid.js adapter, so APS can:
+
+1. receive a valid OpenRTB request for each eligible banner slot;
+2. return a decoded CPM that competes directly without a mediator;
+3. render winning `iframe` and `script` creatives through a deliberate APS browser
+   renderer; and
+4. preserve Trusted Server's existing privacy, sanitization, bounded-I/O, and
+   observability invariants.
+
+The new default endpoint is:
+
+```text
+https://web.ads.aps.amazon-adsystem.com/e/pb/bid
+```
+
+The implementation may proceed against fictional fixtures and a controlled APS test
+account before APS confirms Fastly/edge-originated production support. Lack of that
+confirmation is a rollout gate, not an implementation blocker.
+
+---
+
+## 2. Approved decisions
+
+| Decision                  | Resolution                                                                                                                                                                                                                                                                               |
+| ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Edge/server support       | Implement and test now; do not claim production support until APS confirms it for the account.                                                                                                                                                                                           |
+| APS SDK identity          | Send `ext.sdk.source = "prebid"`, which APS has approved as the starting identity. Match the current adapter version with `ext.sdk.version = "2.2.0"`.                                                                                                                                   |
+| Creative response payload | Send an exact allowlisted envelope containing one bid with only `id`, `price`, `w`, `h`, `ext.creativeurl`, and `ext.tagtype`. Do not preserve unknown fields or silently fall back to the full response.                                                                                |
+| Sandbox compatibility     | APS confirmed `allow-same-origin` compatibility, but Trusted Server must not grant it on the outer security boundary. The outer renderer iframe has an opaque origin; descendant APS frames cannot relax an ancestor sandbox restriction. `script` remains disabled until browser proof. |
+| APS notifications         | Do not expose or fire APS `nurl`/`burl` in this issue. The fixed APS runner owns creative tracking until APS approves a separate notification contract.                                                                                                                                  |
+| APS user sync             | Out of scope. Do not expose or execute `ext.userSyncs`.                                                                                                                                                                                                                                  |
+| Migration                 | Cut over directly. Keep `pub_id` only as a configuration alias; do not retain a legacy/OpenRTB protocol switch.                                                                                                                                                                          |
+| Native APS coexistence    | When a Trusted Server APS renderer descriptor is present, Trusted Server must not call `apstag.setDisplayBids()`. The test cohort must disable native APS demand to avoid duplicate participation.                                                                                       |
+
+---
+
+## 3. Primary upstream evidence
+
+The design follows immutable official APS/Prebid sources:
+
+- [APS endpoint and adapter version](https://github.com/prebid/Prebid.js/blob/cf8537da6b54223aea1bb29c6f939ba3b615a273/modules/apsBidAdapter.js#L16-L21)
+- [OpenRTB request enrichment and privacy filtering](https://github.com/prebid/Prebid.js/blob/cf8537da6b54223aea1bb29c6f939ba3b615a273/modules/apsBidAdapter.js#L118-L187)
+- [Request dispatch](https://github.com/prebid/Prebid.js/blob/cf8537da6b54223aea1bb29c6f939ba3b615a273/modules/apsBidAdapter.js#L247-L265)
+- [Creative construction](https://github.com/prebid/Prebid.js/blob/cf8537da6b54223aea1bb29c6f939ba3b615a273/modules/apsBidAdapter.js#L279-L313)
+- [Purpose-1-gated user sync behavior](https://github.com/prebid/Prebid.js/blob/cf8537da6b54223aea1bb29c6f939ba3b615a273/modules/apsBidAdapter.js#L322-L345)
+- [Official APS adapter documentation and capability metadata](https://github.com/prebid/prebid.github.io/blob/adc4af1425c3433c81ee85560519cab0f7d17887/dev-docs/aps.md)
+
+The capability metadata says `pbjs: true` and `pbs: false`. The public source proves
+browser Prebid behavior; it does not by itself establish an approved production
+server-to-server contract for Fastly or another edge runtime.
+
+The immutable adapter test fixture is not a renderer contract: it accepts a banner bid
+whose extension contains only `bidder`, then verifies that the adapter builds the
+script wrapper. The unversioned live `prebid-creative.js` observed on 2026-07-15
+(SHA-256 `ac99774f4d0f6b34aed7584952661007125345b7433970edd832e8451f9a6aef`)
+requires `bid.id`, `price`, `w`, `h`, `ext.creativeurl`, and `ext.tagtype`. This
+live-runner observation is intentionally treated as unverified behavior: the official
+fixture must safe-drop in Trusted Server, while controlled-account responses provide
+the separate renderer-compatible test path.
+
+---
+
+## 4. Current-state problems
+
+`crates/trusted-server-core/src/integrations/aps.rs` currently:
+
+- POSTs a private `pubId`/`slots`/`pageUrl` payload to `/e/dtb/bid`;
+- requires per-slot `bidders.aps.slotID` or falls back to the incoming slot ID;
+- parses `contextual.slots` rather than OpenRTB `seatbid`;
+- stores encoded `amznbid`/`amznp` values in metadata;
+- sets `Bid.price = None` and `Bid.creative = None`; and
+- therefore cannot produce a direct no-mediator winner or a normal creative.
+
+The generic winner selector intentionally ignores price-less bids. The publisher bid
+map also starts from `bid.price`, so the current behavior is internally consistent but
+cannot satisfy #764.
+
+The existing Prebid provider has a mature OpenRTB builder, but that builder also owns
+PBS-specific bidder params, stored requests, request signing, debug behavior,
+`ext.prebid`, and consent-forwarding policy. Reusing it wholesale would couple APS to
+PBS and increase regression risk.
+
+---
+
+## 5. Scope and non-goals
+
+### 5.1 In scope
+
+- APS banner OpenRTB request construction.
+- APS OpenRTB response/no-bid parsing.
+- Decoded-price direct winner selection.
+- A typed APS renderer descriptor.
+- APS creative rendering in both:
+  - direct `POST /auction` TSJS rendering; and
+  - publisher navigation/page-bids through the GPT/Prebid Universal Creative bridge.
+- Safe aggregate diagnostics.
+- Configuration and documentation migration.
+- Controlled APS account/browser testing for `iframe` and `script` tag types.
+
+### 5.2 Out of scope
+
+- APS video/VAST support. Although the upstream adapter advertises video, this issue
+  enables banner only until Trusted Server has a designed video delivery path.
+- APS `ext.userSyncs` execution or exposure.
+- A generic third-party renderer framework for arbitrary providers.
+- Refactoring the entire Prebid OpenRTB builder.
+- Retaining the legacy `/e/dtb/bid` request/parser behind a runtime switch.
+- Server-side creative URL fetching or caching.
+- Changes to the global HTML sanitizer's allowed elements or attributes.
+- Production support claims before APS account-team confirmation.
+
+---
+
+## 6. Configuration contract and cutover
+
+The canonical configuration becomes:
+
+```toml
+[integrations.aps]
+enabled = false
+account_id = "example-account-id"
+endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
+timeout_ms = 800
+allow_script_creatives = false
+```
+
+### 6.1 Compatibility
+
+- Rename `pub_id` to `account_id` in the Rust type, example configuration, and docs.
+- Accept `pub_id` as a serde alias for `account_id` for existing operator configs.
+- Continue accepting a string or integer value during migration. Trim strings, reject
+  empty-after-trim values, and normalize integers to strings.
+- If both names are supplied, deserialization must fail as a duplicate field rather
+  than silently selecting one.
+- Keep `endpoint` as an operator-owned test/override setting, but require HTTPS with a
+  non-empty host and no URL credentials. Its configured endpoint must implement this
+  OpenRTB contract; it is not a legacy-protocol switch. There is no plaintext test
+  exception because the APS response is trusted to select an executable renderer.
+- APS remains disabled by default.
+- `allow_script_creatives` is a separate server-side capability gate and defaults to
+  `false`. It may be set to `true` only for an isolated test cohort after the
+  restrictive-CSP/opaque-origin Playwright proof passes, and may remain enabled for
+  production only after controlled-account `tagtype=script` validation.
+
+### 6.2 Slot configuration
+
+The OpenRTB impression ID is the Trusted Server slot ID. APS's official adapter has no
+per-impression bidder parameters, so the provider no longer reads
+`bidders.aps.slotID`. Existing generic creative-opportunity configuration may continue
+to deserialize that value during migration, but APS documentation must mark it unused
+and remove it from new examples.
+
+---
+
+## 7. APS OpenRTB request design
+
+### 7.1 Builder boundary
+
+Implement an APS-specific builder in `integrations/aps.rs` using the generated types
+re-exported by `openrtb.rs`.
+
+Do not make `PrebidAuctionProvider::to_openrtb` public. Initially duplicate the small
+common mappings so APS policy remains explicit. A provider-neutral helper may be
+extracted later only when tests prove byte-for-byte parity for the fields it owns.
+
+### 7.2 Request shape
+
+For each eligible slot, emit one `imp`:
+
+- `imp.id = slot.id`;
+- banner-only `banner.format` entries for valid dimensions;
+- first valid format in `banner.w`/`banner.h` for APS compatibility;
+- `bidfloor` and `bidfloorcur = "USD"` when a floor exists;
+- `banner.topframe = 0`, matching the official framed-delivery fixture;
+- `secure = 1` unconditionally because APS creative delivery is HTTPS-only; and
+- no `imp.ext.prebid`, stored request, or bidder-parameter extension.
+
+At request level emit:
+
+- `id = AuctionRequest.id`;
+- `tmax = context.timeout_ms`, the same effective budget enforced by the backend;
+- `cur = ["USD"]`;
+- `site.domain`, `site.page`, publisher data, and a valid referrer when known;
+- consent-allowed `user.id` and already-gated EIDs;
+- trusted device UA and client IP;
+- coarse device geo with latitude and longitude explicitly omitted;
+- valid `Accept-Language` and DNT signals from the downstream request;
+- TCF, USP, GPP, and GPP SID signals in their existing Trusted Server OpenRTB
+  placements. COPPA remains omitted because Trusted Server has no trusted COPPA signal
+  source in this issue; and
+- APS request extension:
+
+```json
+{
+  "ext": {
+    "account": "example-account-id",
+    "sdk": {
+      "source": "prebid",
+      "version": "2.2.0"
+    }
+  }
+}
+```
+
+### 7.3 Page and referrer provenance
+
+- Publisher navigation and page-bids continue using the server-derived scheme, host,
+  and matched request path.
+- `POST /auction` should use a valid same-publisher `Referer` URL as the current page
+  instead of always reducing the page to `https://<configured-domain>`; otherwise it
+  falls back to the configured publisher origin.
+- A candidate URL must use HTTP(S), have no userinfo, be length-bounded, and match the
+  configured publisher host before it can become `site.page`.
+- `site.ref` is emitted only when a valid HTTP(S) downstream `Referer` differs from the
+  normalized current page. If the endpoint request's `Referer` is simply the current
+  page, omit `site.ref` rather than mislabeling it as the document's prior referrer.
+- Do not add an unrestricted client-provided URL or copy arbitrary headers.
+
+### 7.4 Privacy rules
+
+The provider consumes the privacy-filtered `AuctionRequest`; it does not independently
+weaken endpoint decisions.
+
+- Existing auction consent denial still returns before contacting APS.
+- APS only receives `request.user.eids`, which endpoint code has already gated.
+- Do not serialize `user.data`, `user.keywords`, `user.gender`, `yob`, `customdata`, or
+  arbitrary context into APS.
+- Remove precise `device.geo.lat` and `device.geo.lon` even if available.
+- Do not forward browser cookies or arbitrary X-\* headers to APS.
+- Request and response payloads may be logged only at TRACE.
+
+---
+
+## 8. Response validation and unified bid mapping
+
+Parse the response envelope as `serde_json::Value`, validate response-level fields,
+and deserialize or validate each `seatbid[].bid[]` independently. This preserves valid
+siblings when one bid has a wrong field type while retaining extension maps needed for
+APS creative metadata. Syntactically invalid JSON still fails the whole response.
+
+### 8.1 Response-level validation
+
+- HTTP `204 No Content` is a normal APS no-bid and returns before body collection or
+  JSON parsing.
+- Other non-success HTTP statuses produce provider `Error` without reflecting the body.
+- Body collection remains capped by `UPSTREAM_RTB_MAX_RESPONSE_BYTES`.
+- Invalid JSON, including a non-representable numeric literal such as an overflowing
+  exponent under the repository's default `serde_json` configuration, or a legacy
+  `contextual` envelope is an error with safe reason `unexpected_response_shape`.
+- Empty/missing `seatbid`, or seat bids containing no bids, is a normal no-bid.
+- Currency must be absent or case-insensitive USD. A non-USD response is dropped
+  because Trusted Server has no currency conversion before winner comparison.
+- Top-level `ext.userSyncs` is ignored and must not enter diagnostics or renderer data.
+
+### 8.2 Bid-level validation
+
+A bid is eligible only when:
+
+- `impid` matches a slot in the request;
+- `price` is finite and non-negative;
+- `mtype` is absent or banner-compatible;
+- `w` and `h` are both present, non-zero, safely convert to `u32`, and are compatible
+  with the requested slot; and
+- it has APS `ext.creativeurl` plus a usable bid ID and an eligible `ext.tagtype`:
+  `iframe` is eligible, while `script` is eligible only when the server-side
+  `allow_script_creatives` capability is enabled. This check happens before candidate
+  reduction and winner selection, so a disabled or otherwise unrenderable script bid
+  cannot win and blank the slot.
+
+An APS `adm` without a valid renderer descriptor is not independently renderable in the
+normal publisher flow and must therefore be dropped. If APS supplies `adm` alongside a
+valid descriptor, remove all markup from the minimized envelope and do not copy it into
+`Bid.creative`. If controlled testing proves markup is required, stop for a separate
+security review rather than forwarding it unsanitized.
+
+`creativeurl` must be an HTTPS URL without userinfo, must not match the configured
+publisher origin, and must stay within a bounded serialized length. Validate the same
+rules again in the browser. It comes only from the HTTPS APS endpoint response, never
+from the client. Unknown tag types and recognized-but-disabled `script` bids are dropped rather than
+passed through.
+
+The pinned official adapter response fixture lacks `creativeurl` and `tagtype`; Trusted
+Server must include that fixture as an expected safe-drop test. A separate fictional
+fixture models the live runner's required extension fields. Controlled APS-account
+validation of both observed tag types remains a rollout prerequisite.
+
+### 8.3 Unified fields and APS candidate reduction
+
+Extend `Bid` with generic identifiers and a typed optional renderer:
+
+```text
+bid_id       <- OpenRTB bid.id
+ad_id        <- OpenRTB bid.adid
+creative_id  <- optional OpenRTB bid.crid
+renderer     <- typed APS renderer descriptor for every accepted APS bid
+```
+
+Set `Bid.bidder = "aps"` unconditionally. Upstream `seat` and `ext.bidder` are APS
+network metadata, not the adapter identity; normalize them only into bounded internal
+fields if an operational consumer is identified, otherwise discard them. Missing,
+numeric, or unexpected seat values do not invalidate an otherwise valid bid and never
+become `hb_bidder`.
+
+Map decoded price, currency, `impid`, dimensions, and `adomain`. Do not map APS `nurl`
+or `burl` in this issue; the vendor runner owns APS creative tracking until a separate
+notification policy is approved.
+
+Before returning `AuctionResponse`, collapse multiple valid APS candidates for the same
+impression to one candidate: highest decoded price wins, with lexicographically lowest
+bid ID as a deterministic tie-break. This produces the same APS result as direct
+winner selection and prevents the current mediator's `(provider, slot, bidder)`
+last-write-wins index from attaching another APS bid's renderer. The mediator still
+restores `bid_id`, optional `creative_id`, and `renderer` for that single APS candidate.
+A two-bids/same-slot/same-seat test is mandatory.
+
+### 8.4 Diagnostics
+
+`AuctionResponse.metadata` may contain only bounded aggregate fields, for example:
+
+```json
+{
+  "seatbid_count": 1,
+  "accepted_bid_count": 1,
+  "dropped_bid_count": 0,
+  "drop_reasons": {}
+}
+```
+
+Allowed reason keys are fixed enums such as:
+
+- `empty_seatbid`;
+- `unknown_impid`;
+- `invalid_price`;
+- `unsupported_currency`;
+- `unsupported_media_type`;
+- `invalid_dimensions`;
+- `missing_render_source`;
+- `unsupported_tagtype`;
+- `script_rendering_disabled`;
+- `invalid_creative_url`;
+- `render_payload_too_large`; and
+- `unexpected_response_shape`.
+
+Do not include account IDs, bid IDs, URLs, tokens, consent strings, raw extensions, or
+raw bodies in INFO/WARN diagnostics or client-facing provider summaries.
+
+---
+
+## 9. Exact APS renderer response envelope
+
+The official adapter gives `prebid-creative.js` the base64-encoded complete response
+and selected bid ID. Trusted Server instead sends an exact allowlisted envelope based
+on the fields required by the live runner observed on 2026-07-15:
+
+```json
+{
+  "seatbid": [
+    {
+      "bid": [
+        {
+          "id": "fictional-selected-bid-id",
+          "price": 1.23,
+          "w": 300,
+          "h": 250,
+          "ext": {
+            "creativeurl": "https://creative.example/render",
+            "tagtype": "iframe"
+          }
+        }
+      ]
+    }
+  ]
+}
+```
+
+The allowlist is exact:
+
+- root: `seatbid` only;
+- selected seat object: `bid` only;
+- selected bid: `id`, `price`, `w`, `h`, and `ext` only; and
+- selected bid extension: `creativeurl` and `tagtype` only.
+
+Do not include top-level ID/currency/extensions, upstream seat, `impid`, `adid`, `crid`,
+`adomain`, notifications, markup, native data, user syncs, unknown extensions, sibling
+bids, or losing seats. Unknown fields may exist transiently while the server validates
+an upstream bid, but they are discarded before renderer construction.
+
+Serialize the allowlisted object once, enforce a 256 KiB pre-base64 maximum, then
+base64 encode with the standard alphabet. Store it in the typed renderer descriptor,
+not general metadata. If the envelope exceeds the cap, drop the bid as non-renderable.
+If controlled APS testing proves the exact envelope insufficient, stop and review the
+specific missing field with APS; do not widen it or fall back to the full response
+automatically.
+
+A single fictional golden fixture under the TSJS test fixtures is the source of truth:
+Rust serialization must equal it, and TypeScript parsing/validation/render-dispatch
+tests must consume that same file.
+
+---
+
+## 10. Renderer descriptor and browser wire formats
+
+### 10.1 Typed descriptor
+
+The Rust and TypeScript contracts represent the same versioned data:
+
+```json
+{
+  "type": "aps",
+  "version": 1,
+  "accountId": "example-account-id",
+  "bidId": "fictional-selected-bid-id",
+  "creativeId": "fictional-creative-id",
+  "tagType": "iframe",
+  "creativeUrl": "https://creative.example/render",
+  "aaxResponse": "base64-data",
+  "width": 300,
+  "height": 250
+}
+```
+
+Only `iframe` and `script` are valid tag-type values. `creativeId` is optional and is
+omitted when APS does not return `crid`; the live runner does not consume it. Version
+mismatch is fail-closed. The APS account identifier is not a secret, but it must still
+be safely serialized and must never be hardcoded from a real account in repository
+fixtures.
+
+### 10.2 `POST /auction`
+
+For APS renderer bids, the OpenRTB response bid contains the complete descriptor:
+
+```json
+{
+  "id": "fictional-selected-bid-id",
+  "impid": "fictional-slot",
+  "price": 1.23,
+  "crid": "fictional-creative-id",
+  "w": 300,
+  "h": 250,
+  "ext": {
+    "trusted_server": {
+      "renderer": {
+        "type": "aps",
+        "version": 1,
+        "accountId": "example-account-id",
+        "bidId": "fictional-selected-bid-id",
+        "creativeId": "fictional-creative-id",
+        "tagType": "iframe",
+        "creativeUrl": "https://creative.example/render",
+        "aaxResponse": "eyJzZWF0YmlkIjpbeyJiaWQiOltdfV19",
+        "width": 300,
+        "height": 250
+      }
+    }
+  }
+}
+```
+
+`creativeId`/`crid` are omitted together when APS does not return `crid`. `adm` is
+omitted, not serialized as an empty string. Ordinary non-APS `adm` behavior is
+unchanged.
+
+### 10.3 Publisher navigation and page-bids
+
+`build_bid_map` adds the same complete descriptor as a normal, non-debug `renderer`
+property for APS winners:
+
+```json
+{
+  "fictional-slot": {
+    "hb_pb": "1.23",
+    "hb_bidder": "aps",
+    "hb_adid": "fictional-selected-bid-id",
+    "renderer": {
+      "type": "aps",
+      "version": 1,
+      "accountId": "example-account-id",
+      "bidId": "fictional-selected-bid-id",
+      "creativeId": "fictional-creative-id",
+      "tagType": "iframe",
+      "creativeUrl": "https://creative.example/render",
+      "aaxResponse": "eyJzZWF0YmlkIjpbeyJiaWQiOltdfV19",
+      "width": 300,
+      "height": 250
+    }
+  }
+}
+```
+
+`hb_adid` priority becomes:
+
+1. PBS Cache UUID for cached Prebid bids;
+2. APS renderer selected bid ID;
+3. existing OpenRTB `adid` fallback.
+
+The complete renderer object is emitted only for the winning bid. It is not gated by
+`debug.inject_adm_for_testing`, and general bid metadata remains debug-only.
+
+---
+
+## 11. Browser rendering design
+
+### 11.1 Static renderer endpoint
+
+Do not put the APS initializer and runner into publisher-origin `srcdoc`. Register APS
+as a proxy-capable integration (without an automatic JS bundle) and serve a static
+renderer document at:
+
+```text
+GET /integrations/aps/renderer
+```
+
+The document contains only static Trusted Server initialization code and the fixed
+`https://client.aps.amazon-adsystem.com/prebid-creative.js` script. Before loading the
+vendor runner, the static initializer reads a strictly encoded, cryptographically
+random per-frame nonce from the iframe URL fragment, stores it as the expected nonce,
+and removes the fragment from visible history. The fragment is not sent in the HTTP
+request. It then receives one versioned renderer descriptor from its embedding parent
+through `postMessage`, verifies `event.source === parent`, and requires the message
+nonce to equal the independently established expected nonce. After the first accepted
+message it removes the listener, initializes the account-keyed APS queue, dispatches
+`CustomEvent("prebid/creative/render", { detail: { aaxResponse, seatBidId } })`, and only
+then dynamically inserts the fixed runner script. On runner load or failure it sends a
+source-bound response carrying the accepted nonce. Because the sandboxed document has
+an opaque origin, both directions use `"*"` as the `postMessage` target origin and rely
+on the exact child/parent window, source checks, one-time fragment-bound nonce, and full
+descriptor validation.
+
+The descriptor is data, never generated script text. No APS-provided HTML, script text,
+URL, account value, or decoded JSON is concatenated into an executable context. The
+vendor runner URL is a compile-time constant. The response carries
+`Content-Type: text/html`, `X-Content-Type-Options: nosniff`,
+`Referrer-Policy: no-referrer`, and a CSP `sandbox` directive containing the
+approved tokens without `allow-same-origin`. The response-level sandbox preserves the
+opaque boundary even if another embedding path omits its iframe sandbox attribute.
+
+### 11.2 Opaque outer sandbox
+
+Both direct and GPT flows load the static endpoint through `iframe.src`, not `srcdoc`,
+with this outer sandbox:
+
+```text
+allow-forms
+allow-pointer-lock
+allow-popups
+allow-popups-to-escape-sandbox
+allow-scripts
+allow-top-navigation-by-user-activation
+```
+
+The outer boundary deliberately omits `allow-same-origin`. The live APS runner grants
+`allow-same-origin` to the nested frame it creates, but a descendant cannot relax an
+ancestor sandbox's origin restriction. Therefore both `iframe` and fetched-HTML
+`script` creatives remain under the outer opaque-origin boundary rather than inheriting
+the publisher origin.
+
+This is a compatibility hypothesis, not an assumption: the current runner also touches
+`frameElement` while resizing. `tagtype=script` is rejected server-side before winner
+selection while `allow_script_creatives` is false. The capability may be enabled for an
+isolated test cohort only after a real-browser test proves that the fixed runner renders
+and resizes correctly without publisher-origin access, and may be enabled beyond that
+cohort only after controlled-account validation. If either test fails, keep the gate
+off and obtain an APS-supported isolated renderer page/origin; do not add
+`allow-same-origin` back to the outer boundary.
+
+### 11.3 Browser validation of consumed data
+
+Before creating or messaging the renderer iframe, TSJS must decode `aaxResponse` and
+validate the exact envelope consumed by the vendor runner:
+
+- root contains only one `seatbid` entry;
+- that entry contains only one `bid`;
+- the bid has exactly `id`, `price`, `w`, `h`, and `ext`;
+- `ext` has exactly `creativeurl` and `tagtype`;
+- bid ID, dimensions, creative URL, and tag type equal the duplicated descriptor fields;
+- price is finite and non-negative;
+- tag type is `iframe`, or `script` from a response the server emitted only after its
+  default-off `allow_script_creatives` eligibility gate;
+- creative URL is bounded HTTPS without credentials and does not match the publisher
+  origin; and
+- no markup, notifications, syncs, or unknown fields are present.
+
+Validation happens before slot clearing, `stopImmediatePropagation()`, iframe creation,
+or message dispatch. The static renderer document repeats the structural/message
+validation as defense in depth.
+
+### 11.4 Direct `/auction` flow
+
+`parseAuctionResponse` accepts either ordinary sanitized `adm` or a structurally typed
+renderer. The request loop performs the full decoded-envelope validation, dispatches a
+valid APS descriptor to `renderApsCreative`, and sends ordinary markup to
+`renderCreativeInline`.
+
+`renderApsCreative` generates at least 128 bits of randomness with
+`crypto.getRandomValues`, base64url-encodes it, and binds it to the static renderer URL
+as a fragment before assigning `iframe.src`. After load, it posts the validated
+descriptor with the same nonce, then waits for an exact source- and nonce-bound runner
+ready acknowledgement before clearing existing content or showing the frame. A runner
+failure or bounded acknowledgement timeout removes the hidden frame. A malformed
+descriptor, malformed fragment, nonce mismatch, replay, stale message, or runner load
+failure leaves existing slot content intact and emits a safe warning.
+
+### 11.5 GPT/page-bids flow
+
+Extend `installTsRenderBridge` while retaining the existing `Prebid Request` parsing and
+source-slot ownership validation. For a valid APS winner, return the exact serializable
+Prebid Universal Creative dynamic-renderer shape, including the supported renderer
+version. The static Trusted Server renderer source may only create the opaque outer
+iframe, load `/integrations/aps/renderer`, post the already validated descriptor, and
+resolve only after the source- and nonce-bound ready acknowledgement; APS or bidder code
+never executes in the Universal Creative renderer frame itself.
+Fixture-test this message against the deployed Universal Creative protocol rather than
+assuming a function can be structured-cloned. Include a trusted absolute
+`rendererUrl`, computed from the publisher page origin by TSJS, because a relative URL
+inside the GAM creative would resolve against the GAM origin. The dynamic renderer
+must accept only that data field and the validated APS descriptor.
+
+Call `stopImmediatePropagation()` only after ownership and complete envelope validation
+succeed. Preserve in-flight render deduplication, but do not invoke the generic
+win/billing beacon path for APS. Existing debug-ADM and PBS Cache branches remain
+unchanged.
+
+When the winning bid has a Trusted Server APS renderer, do not call
+`apstag.setDisplayBids()`. The native APS SDK may remain installed by the CMS for other
+cohorts, but it is not the renderer or bid source for that TS winner.
+
+### 11.6 CSP and real-browser gate
+
+Because the outer frame navigates to a real response, it uses that response's CSP
+instead of inheriting publisher `srcdoc` CSP. The renderer endpoint starts from this
+explicit ad-compatible policy, tightened if controlled testing permits:
+
+```text
+default-src 'none';
+script-src 'unsafe-inline' https:;
+connect-src https:;
+frame-src https:;
+img-src https: data:;
+media-src https: blob:;
+style-src 'unsafe-inline' https:;
+font-src https: data:;
+```
+
+The publisher must permit `frame-src 'self'` for the direct renderer endpoint. The GAM
+Universal Creative context must also permit framing the absolute publisher renderer
+URL. The broad HTTPS resource allowances apply only inside the opaque sandbox and are
+required because the APS runner and bidder HTML may load arbitrary HTTPS ad resources.
+
+Add a Playwright test under `crates/trusted-server-integration-tests/browser` with a
+restrictive publisher CSP. It must prove the renderer endpoint loads, APS initializes,
+both tag types obey the outer opaque-origin boundary, a fictional script creative
+cannot access `top.document`, and malformed descriptors do not clear the slot. The server-side `allow_script_creatives` gate stays false during normal winner
+selection until this test passes. It may then be enabled only for the controlled test
+cohort needed to validate real rendering and remains false elsewhere until that
+validation also passes.
+
+---
+
+## 12. Sanitization and security invariants
+
+- `sanitize_creative_html` remains mandatory for every ordinary
+  `Bid.creative`/`adm` value.
+- Its element, attribute, URI, size, and fail-closed rules do not change.
+- APS executable rendering is a separate typed capability; it is never disguised as
+  sanitized `adm`.
+- Only a server-validated APS descriptor with an exact browser-validated envelope can
+  select that capability.
+- Unknown providers cannot request the APS renderer through arbitrary metadata.
+- The server never fetches `creativeurl`, avoiding an SSRF/redirect/content-type
+  service in the auction path.
+- Server and browser both require a bounded HTTPS creative URL without credentials and
+  reject the publisher origin.
+- APS/bidder execution occurs only below an outer opaque-origin sandbox. No test may
+  treat absence of `innerHTML` alone as proof; cover `srcdoc`, script text,
+  `document.write`, and message-driven sinks.
+- Existing same-origin/no-CORS-preflight protection for page-bids remains unchanged.
+- Per-user injected HTML stays private/non-shared, and page-bids stays no-store.
+- Existing upstream body caps and auction deadlines remain in force.
+
+---
+
+## 13. APS notification policy
+
+Do not map APS `nurl` or `burl` into the shared browser bid map in this issue. The live
+APS runner owns creative tracking, the official fixture does not establish that Trusted
+Server should fire OpenRTB notifications, and the direct `/auction` path has no matching
+notification lifecycle.
+
+This also prevents an APS-controlled URL from causing a credentialed same-origin POST
+through the current generic `sendBeacon`/fetch helper. If APS later requires Trusted
+Server notification delivery, design it separately with one explicit owner, bounded
+HTTPS URLs, publisher-origin rejection, omitted credentials, no referrer, macro policy,
+and equivalent direct/GPT tests. Existing non-APS notification behavior is unchanged by
+#764.
+
+---
+
+## 14. User sync policy
+
+APS user sync is explicitly out of scope:
+
+- ignore `BidResponse.ext.userSyncs`;
+- do not put sync URLs into `AuctionResponse.metadata`;
+- do not include them in the minimized renderer envelope;
+- do not fetch them at the edge; and
+- do not add image/iframe sync behavior to TSJS.
+
+A future implementation requires a separate spec covering Purpose 1, regional policy,
+URL allowlisting, deduplication, browser timing, and observability.
+
+---
+
+## 15. Logging and telemetry
+
+- Request/response bodies: TRACE only.
+- Routine request log: provider and eligible slot count, without account ID.
+- Routine response log: status, elapsed time, accepted count, and bounded dropped
+  count.
+- WARN: static condition plus slot/request-safe context; never include response body,
+  creative URL, bid token, EID, consent string, or account ID.
+- Client-facing provider summaries: aggregate reason keys/counts only.
+- Existing auction telemetry receives decoded price, currency, ad domain, and ad ID.
+  It must not receive the encoded renderer envelope.
+
+---
+
+## 16. Rollout and rollback
+
+### 16.1 Controlled rollout
+
+1. Implement server parsing and exact fictional fixtures with APS disabled and
+   `allow_script_creatives = false` by default.
+2. Prove disabled script bids are dropped before candidate reduction/winner selection.
+3. Pass the restrictive-CSP Playwright and opaque-origin access tests using the local
+   fictional script runner while the server gate remains false for normal traffic.
+4. Configure a controlled APS test account out of band.
+5. Enable Trusted Server APS only for a test cohort, disable native APS demand there,
+   and temporarily set `allow_script_creatives = true` only for that isolated cohort.
+6. Verify the official fixture safe-drops and a real account returns the unverified
+   `creativeurl`/`tagtype` contract.
+7. Verify both observed tag types through direct and GPT paths. If script cannot operate
+   below the opaque outer sandbox, set the gate false again and stop.
+8. Confirm the exact allowlisted envelope works with `prebid-creative.js`.
+9. Confirm GAM line items and the Universal Creative route request `hb_bidder=aps` and
+   the selected `hb_adid`.
+10. Obtain APS confirmation for Fastly/edge-originated production traffic before broad
+    rollout.
+
+### 16.2 Rollback
+
+- Immediate traffic rollback: set `[integrations.aps].enabled = false`.
+- Restore native APS participation for the affected cohort if required.
+- Binary rollback remains available if the old provider must temporarily be restored.
+- The new code does not retain a dormant legacy parser or protocol switch.
+
+---
+
+## 17. Required code areas
+
+| File                                                              | Change                                                                                                                                                       |
+| ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `crates/trusted-server-core/src/integrations/aps.rs`              | Replace legacy wire types, build/parse OpenRTB, reduce one APS candidate per imp, build the exact envelope, and serve the static renderer endpoint with CSP. |
+| `crates/trusted-server-core/src/integrations/mod.rs`              | Register the APS proxy integration in addition to the auction provider.                                                                                      |
+| `crates/trusted-server-core/src/openrtb.rs`                       | Add only narrowly scoped APS/request/response extension types if needed.                                                                                     |
+| `crates/trusted-server-core/src/auction/types.rs`                 | Add generic bid/creative identifiers and typed optional renderer. Remove stale encoded-price comments.                                                       |
+| `crates/trusted-server-core/src/auction/formats.rs`               | Preserve IDs; sanitize ordinary `adm`; emit the full APS renderer extension and omit empty `adm`.                                                            |
+| `crates/trusted-server-core/src/auction/orchestrator.rs`          | Replace encoded-price assumptions/tests with decoded APS direct-winner coverage.                                                                             |
+| `crates/trusted-server-core/src/integrations/adserver_mock.rs`    | Preserve renderer/identifiers for the single reduced APS candidate and test the prior two-bid collision case.                                                |
+| `crates/trusted-server-core/src/publisher.rs`                     | Emit APS renderer in the normal bid map, force `hb_bidder=aps`, and use selected bid ID for `hb_adid` without APS notifications.                             |
+| `crates/trusted-server-js/lib/test/fixtures/aps-renderer-v1.json` | Shared fictional golden wire fixture consumed by Rust and TypeScript tests.                                                                                  |
+| `crates/trusted-server-js/lib/src/core/auction.ts`                | Parse the typed renderer extension.                                                                                                                          |
+| `crates/trusted-server-js/lib/src/core/request.ts`                | Validate and dispatch APS descriptors to the opaque renderer endpoint.                                                                                       |
+| `crates/trusted-server-js/lib/src/core/types.ts`                  | Define shared APS renderer wire types with optional creative ID.                                                                                             |
+| `crates/trusted-server-js/lib/src/integrations/aps/render.ts`     | Decode/cross-check the exact envelope, create the opaque outer iframe, and message the static endpoint.                                                      |
+| `crates/trusted-server-js/lib/src/integrations/gpt/index.ts`      | Serve APS through the exact Universal Creative wire shape; skip generic beacons and native `apstag` for TS APS winners.                                      |
+| `crates/trusted-server-integration-tests/browser/`                | Add restrictive-CSP, opaque-origin, script/iframe, and parent-DOM isolation coverage.                                                                        |
+| `trusted-server.example.toml`                                     | Document canonical OpenRTB APS configuration with fictional values.                                                                                          |
+| `docs/guide/integrations/aps.md`                                  | Replace legacy setup, request, response, rendering, privacy, and rollout documentation.                                                                      |
+| `CHANGELOG.md`                                                    | Record the APS wire/config migration and support caveat.                                                                                                     |
+
+---
+
+## 18. Acceptance criteria
+
+1. APS receives the specified OpenRTB request for each eligible banner slot with
+   `topframe=0` and `secure=1`.
+2. Request fixtures prove trimmed account/SDK/USD, floors, trusted page/device context,
+   consent/EIDs, existing privacy registrations, and omission of precise coordinates
+   and unsupported COPPA claims.
+3. HTTP 204 and empty `seatbid` are no-bids; malformed/legacy responses are safely
+   diagnosed.
+4. The official no-renderer fixture safe-drops; every accepted APS bid has present,
+   valid `w`/`h` and the unverified-but-validated URL/tag-type renderer contract.
+5. `Bid.bidder`/`hb_bidder` are always `aps`, independent of upstream seat.
+6. Multiple APS bids for one impression reduce deterministically to one candidate, and
+   mediation cannot restore another candidate's renderer.
+7. APS can win without a mediator and is rejected normally below the floor.
+8. The browser envelope contains exactly the allowlisted fields and matches the full
+   descriptor; Rust and TypeScript share one golden fixture.
+9. The outer renderer iframe has no `allow-same-origin`; descendant iframe/script
+   creatives cannot access publisher DOM in the restrictive-CSP Playwright test.
+10. `allow_script_creatives` defaults false; while false, script bids are dropped before
+    candidate reduction and cannot win. It is enabled only under the staged browser and
+    controlled-account policy; otherwise script remains fail-closed.
+11. The renderer binds a one-time nonce through the iframe URL fragment before
+    messaging and rejects malformed, mismatched, replayed, or stale messages before
+    clearing content or stopping another renderer handler.
+12. Ordinary non-APS `adm` sanitization and PBS Cache rendering remain unchanged.
+13. APS user sync and APS `nurl`/`burl` browser delivery remain absent.
+14. Native `apstag.setDisplayBids()` is not called for a TS APS renderer winner.
+15. Raw request/response bodies remain TRACE-only.
+16. All repository CI, adapter, JS, browser, parity, and docs-format gates pass.
+
+---
+
+## 19. Known risks and follow-ups
+
+| Risk                                                                   | Handling                                                                                                                                                                    |
+| ---------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| APS has not confirmed production Fastly/edge traffic                   | Continue implementation/testing; block broad rollout pending confirmation.                                                                                                  |
+| Official fixture and live runner disagree on creative extension fields | Safe-drop the official fixture, pin the observed runner hash/date as evidence only, and require controlled-account validation.                                              |
+| Exact envelope may omit a field used by a future runner                | Stop and review with APS; never preserve unknown fields or fall back to the full response automatically.                                                                    |
+| Fixed unversioned vendor script can change independently               | Monitor the real-browser contract and require review before changing URL, envelope, CSP, or sandbox behavior.                                                               |
+| Runner may fail without outer `allow-same-origin`                      | Keep the server-side `allow_script_creatives` gate false unless the opaque-boundary Playwright and controlled-account tests pass; never restore publisher-origin execution. |
+| Broad ad-compatible CSP permits arbitrary HTTPS resources              | Scope it to the opaque renderer document; publisher CSP only needs to frame the same-origin renderer endpoint.                                                              |
+| Existing native APS and TS APS can duplicate demand                    | Cohort-gate and disable native APS participation wherever TS APS is enabled.                                                                                                |
+| APS notifications may be required for billing                          | Do not guess; vendor runner owns tracking until APS approves a separately secured notification contract.                                                                    |
+| APS video responses could appear                                       | Advertise banner-only support and drop non-banner `mtype` until a separate video design exists.                                                                             |
diff --git a/trusted-server.example.toml b/trusted-server.example.toml
index 0951b781e..b12de29ec 100644
--- a/trusted-server.example.toml
+++ b/trusted-server.example.toml
@@ -117,9 +117,11 @@ allowed_context_keys = []
 
 [integrations.aps]
 enabled = false
-pub_id = "your-aps-publisher-id"
-endpoint = "https://aps.example.com/e/dtb/bid"
+account_id = "example-aps-account-id"
+endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
 timeout_ms = 1000
+# Script creatives require separate security validation before opt-in.
+allow_script_creatives = false
 
 [integrations.google_tag_manager]
 enabled = false

From eb8f37c1f8df544468863e0482caf7963a37ea50 Mon Sep 17 00:00:00 2001
From: Christian <christianpavilonis@outlook.com>
Date: Wed, 15 Jul 2026 21:25:02 -0500
Subject: [PATCH 2/5] Resolve APS test scanning alerts

---
 .../lib/test/integrations/aps/render.test.ts              | 8 ++------
 ...26-07-15-aps-openrtb-first-class-integration-design.md | 4 ++--
 2 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts b/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts
index 78d459c7d..4b1925014 100644
--- a/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts
@@ -147,9 +147,7 @@ describe('direct APS rendering', () => {
     const iframe = slot.querySelector('iframe')!;
     const existing = slot.querySelector('span');
     expect(existing).not.toBeNull();
-    expect(iframe.src).toMatch(
-      new RegExp(`${APS_RENDERER_PATH.replace(/\//g, '\\/')}#tsaps=[A-Za-z0-9_-]{22}$`)
-    );
+    expect(iframe.src).toMatch(/\/integrations\/aps\/renderer#tsaps=[A-Za-z0-9_-]{22}$/);
     expect(iframe.getAttribute('sandbox')).toBe(APS_RENDERER_SANDBOX);
     expect(iframe.getAttribute('sandbox')).not.toContain('allow-same-origin');
     expect(iframe.srcdoc).toBe('');
@@ -262,9 +260,7 @@ describe('Universal Creative APS source', () => {
         window
       );
       const iframe = document.body.querySelector('iframe')!;
-      expect(iframe.src).toMatch(
-        new RegExp(`${APS_RENDERER_PATH.replace(/\//g, '\\/')}#tsaps=[A-Za-z0-9_-]{22}$`)
-      );
+      expect(iframe.src).toMatch(/\/integrations\/aps\/renderer#tsaps=[A-Za-z0-9_-]{22}$/);
       expect(iframe.getAttribute('sandbox')).toBe(APS_RENDERER_SANDBOX);
       expect(iframe.getAttribute('sandbox')).not.toContain('allow-same-origin');
 
diff --git a/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md b/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md
index 0a9c84fd1..c2da08179 100644
--- a/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md
+++ b/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md
@@ -1,7 +1,7 @@
 # Amazon APS OpenRTB First-Class Integration Design
 
-**Date:** 2026-07-15  
-**Status:** Approved for implementation and test; production rollout remains subject to APS account-team validation  
+**Date:** 2026-07-15<br>
+**Status:** Approved for implementation and test; production rollout remains subject to APS account-team validation<br>
 **Issue:** [#764 — Add the Amazon APS Prebid Adapter as first class integration](https://github.com/IABTechLab/trusted-server/issues/764)
 
 ---

From b3f5b1119bbd3768fa271f12b387838b562f4378 Mon Sep 17 00:00:00 2001
From: Christian <christianpavilonis@outlook.com>
Date: Thu, 16 Jul 2026 10:54:23 -0500
Subject: [PATCH 3/5] Add APS inventory identity overrides

---
 CHANGELOG.md                                  |   1 +
 .../src/integrations/aps.rs                   | 197 +++++++++++++++++-
 crates/trusted-server-core/src/publisher.rs   |  60 ++++--
 .../lib/src/integrations/gpt/index.ts         |  18 +-
 .../test/integrations/gpt/spa_hook.test.ts    |   4 +-
 docs/guide/configuration.md                   |   3 +
 docs/guide/integrations/aps.md                |   6 +
 trusted-server.example.toml                   |   3 +
 8 files changed, 268 insertions(+), 24 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 28a4e4806..aa3bed697 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Breaking** — Replaced the legacy APS contextual integration with APS OpenRTB at `/e/pb/bid`. APS configuration now uses canonical `account_id` (`pub_id` remains a compatibility alias), no longer requires APS-specific slot IDs, and defaults script creative eligibility off. Operators must update the endpoint, disable native APS demand for Trusted Server cohorts, and prepare GAM/Universal Creative targeting for `hb_bidder=aps` before rollout.
 - **Breaking** — `bid_param_zone_overrides` inner values must now be JSON objects; previously non-object or empty values (`"header" = "x"`, `"header" = {}`) were accepted and silently produced a dead rule at runtime. They now fail at startup with a configuration error. Operators upgrading should audit their `bid_param_zone_overrides` config for non-object zone entries.
 - **Breaking** — Sourcepoint browser module inclusion now requires explicit `[integrations.sourcepoint].enabled = true`; operators relying on the previous unconditional Sourcepoint module should enable the integration before upgrading.
+- Added optional APS `inventory_domain` and `inventory_page_origin` overrides for deployments whose edge hostname differs from the APS-authorized inventory identity.
 
 ### Security
 
diff --git a/crates/trusted-server-core/src/integrations/aps.rs b/crates/trusted-server-core/src/integrations/aps.rs
index 90b6c6db5..f32fa9012 100644
--- a/crates/trusted-server-core/src/integrations/aps.rs
+++ b/crates/trusted-server-core/src/integrations/aps.rs
@@ -114,6 +114,7 @@ addEventListener('message',receive);
 
 /// Configuration for the APS `OpenRTB` integration.
 #[derive(Debug, Clone, Deserialize, Serialize, Validate)]
+#[validate(schema(function = "validate_inventory_identity_override"))]
 pub struct ApsConfig {
     /// Whether APS integration is enabled.
     #[serde(default = "default_enabled")]
@@ -131,6 +132,14 @@ pub struct ApsConfig {
     /// Whether APS script creatives are eligible before winner selection.
     #[serde(default)]
     pub allow_script_creatives: bool,
+    /// APS-authorized inventory domain used instead of the deployment hostname.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[validate(custom(function = "validate_inventory_domain"))]
+    pub inventory_domain: Option<String>,
+    /// Canonical HTTPS origin used for APS `site.page` while preserving path and query.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[validate(custom(function = "validate_inventory_page_origin"))]
+    pub inventory_page_origin: Option<String>,
 }
 
 fn deserialize_account_id<'de, D>(deserializer: D) -> Result<String, D::Error>
@@ -197,6 +206,78 @@ fn validate_aps_endpoint(value: &str) -> Result<(), ValidationError> {
     Ok(())
 }
 
+fn validate_inventory_domain(value: &str) -> Result<(), ValidationError> {
+    if value.trim() != value
+        || value.is_empty()
+        || value.len() > 253
+        || value.starts_with('.')
+        || value.ends_with('.')
+        || value.contains(['/', ':'])
+    {
+        return Err(ValidationError::new("invalid_aps_inventory_domain"));
+    }
+    for label in value.split('.') {
+        let bytes = label.as_bytes();
+        if label.is_empty()
+            || label.len() > 63
+            || bytes.first() == Some(&b'-')
+            || bytes.last() == Some(&b'-')
+            || !bytes
+                .iter()
+                .all(|byte| byte.is_ascii_alphanumeric() || *byte == b'-')
+        {
+            return Err(ValidationError::new("invalid_aps_inventory_domain"));
+        }
+    }
+    Ok(())
+}
+
+fn validate_inventory_page_origin(value: &str) -> Result<(), ValidationError> {
+    let parsed =
+        Url::parse(value).map_err(|_| ValidationError::new("invalid_aps_inventory_page_origin"))?;
+    if parsed.scheme() != "https"
+        || parsed.host_str().is_none()
+        || !parsed.username().is_empty()
+        || parsed.password().is_some()
+        || parsed.port().is_some()
+        || parsed.path() != "/"
+        || parsed.query().is_some()
+        || parsed.fragment().is_some()
+    {
+        return Err(ValidationError::new("invalid_aps_inventory_page_origin"));
+    }
+    Ok(())
+}
+
+fn validate_inventory_identity_override(config: &ApsConfig) -> Result<(), ValidationError> {
+    let (Some(domain), Some(origin)) = (
+        config.inventory_domain.as_deref(),
+        config.inventory_page_origin.as_deref(),
+    ) else {
+        if config.inventory_domain.is_none() && config.inventory_page_origin.is_none() {
+            return Ok(());
+        }
+        return Err(ValidationError::new(
+            "incomplete_aps_inventory_identity_override",
+        ));
+    };
+    let parsed = Url::parse(origin)
+        .map_err(|_| ValidationError::new("invalid_aps_inventory_page_origin"))?;
+    let host = parsed
+        .host_str()
+        .ok_or_else(|| ValidationError::new("invalid_aps_inventory_page_origin"))?
+        .to_ascii_lowercase();
+    let domain = domain.to_ascii_lowercase();
+    if host != domain
+        && !host
+            .strip_suffix(&domain)
+            .is_some_and(|prefix| prefix.ends_with('.'))
+    {
+        return Err(ValidationError::new("aps_inventory_origin_domain_mismatch"));
+    }
+    Ok(())
+}
+
 fn default_enabled() -> bool {
     false
 }
@@ -217,6 +298,8 @@ impl Default for ApsConfig {
             endpoint: default_endpoint(),
             timeout_ms: default_timeout_ms(),
             allow_script_creatives: false,
+            inventory_domain: None,
+            inventory_page_origin: None,
         }
     }
 }
@@ -324,6 +407,28 @@ impl ApsAuctionProvider {
         Some(parsed.to_string())
     }
 
+    fn inventory_site_identity(
+        &self,
+        fallback_domain: &str,
+        fallback_page: String,
+    ) -> (String, String) {
+        let (Some(domain), Some(origin)) = (
+            self.config.inventory_domain.as_ref(),
+            self.config.inventory_page_origin.as_deref(),
+        ) else {
+            return (fallback_domain.to_string(), fallback_page);
+        };
+        let (Ok(mut canonical_page), Ok(current_page)) =
+            (Url::parse(origin), Url::parse(&fallback_page))
+        else {
+            return (fallback_domain.to_string(), fallback_page);
+        };
+        canonical_page.set_path(current_page.path());
+        canonical_page.set_query(current_page.query());
+        canonical_page.set_fragment(None);
+        (domain.clone(), canonical_page.to_string())
+    }
+
     fn build_openrtb_request(
         &self,
         request: &AuctionRequest,
@@ -420,12 +525,13 @@ impl ApsAuctionProvider {
             .and_then(|value| value.to_str().ok())
             .and_then(Self::valid_http_url)
             .filter(|value| value != &page);
+        let (site_domain, page) = self.inventory_site_identity(&request.publisher.domain, page);
 
         OpenRtbRequest {
             id: Some(request.id.clone()),
             imp,
             site: Some(Site {
-                domain: Some(request.publisher.domain.clone()),
+                domain: Some(site_domain.clone()),
                 page: Some(page),
                 r#ref: referer,
                 publisher: Some(Publisher {
@@ -956,6 +1062,8 @@ mod tests {
             endpoint: default_endpoint(),
             timeout_ms: 800,
             allow_script_creatives: false,
+            inventory_domain: None,
+            inventory_page_origin: None,
         }
     }
 
@@ -1052,6 +1160,93 @@ mod tests {
         }
     }
 
+    #[test]
+    fn config_requires_safe_inventory_identity_override_pair() {
+        for value in [
+            json!({
+                "account_id": "example-account",
+                "inventory_domain": "publisher.example"
+            }),
+            json!({
+                "account_id": "example-account",
+                "inventory_page_origin": "https://www.publisher.example"
+            }),
+            json!({
+                "account_id": "example-account",
+                "inventory_domain": "publisher.example",
+                "inventory_page_origin": "http://www.publisher.example"
+            }),
+            json!({
+                "account_id": "example-account",
+                "inventory_domain": "publisher.example",
+                "inventory_page_origin": "https://www.publisher.example/path"
+            }),
+            json!({
+                "account_id": "example-account",
+                "inventory_domain": "publisher.example/path",
+                "inventory_page_origin": "https://www.publisher.example"
+            }),
+            json!({
+                "account_id": "example-account",
+                "inventory_domain": "publisher.example",
+                "inventory_page_origin": "https://unrelated.example"
+            }),
+        ] {
+            let parsed: ApsConfig =
+                serde_json::from_value(value).expect("should deserialize before validation");
+            assert!(
+                parsed.validate().is_err(),
+                "should reject unsafe or incomplete inventory identity override"
+            );
+        }
+    }
+
+    #[test]
+    fn inventory_identity_override_rewrites_site_and_preserves_page_path() {
+        let config: ApsConfig = serde_json::from_value(json!({
+            "enabled": true,
+            "account_id": "example-account",
+            "inventory_domain": "publisher.example",
+            "inventory_page_origin": "https://www.publisher.example"
+        }))
+        .expect("should deserialize APS inventory identity override");
+        config
+            .validate()
+            .expect("should validate APS inventory identity override");
+        let provider = ApsAuctionProvider::new(config);
+        let mut auction_request = request();
+        auction_request.publisher.domain = "deployment.example".to_string();
+        auction_request.publisher.page_url =
+            Some("https://deployment.example/news/story?edition=fictional#section".to_string());
+        let settings = create_test_settings();
+        let services = noop_services();
+        let downstream = http::Request::builder()
+            .uri("https://deployment.example/auction")
+            .body(EdgeBody::empty())
+            .expect("should build downstream request");
+        let context = AuctionContext {
+            settings: &settings,
+            request: &downstream,
+            timeout_ms: 321,
+            provider_responses: None,
+            services: &services,
+        };
+
+        let serialized =
+            serde_json::to_value(provider.build_openrtb_request(&auction_request, &context))
+                .expect("should serialize APS request");
+
+        assert_eq!(serialized["site"]["domain"], "publisher.example");
+        assert_eq!(
+            serialized["site"]["page"],
+            "https://www.publisher.example/news/story?edition=fictional"
+        );
+        assert_eq!(
+            serialized["site"]["publisher"]["domain"],
+            "deployment.example"
+        );
+    }
+
     #[test]
     fn builds_aps_openrtb_request_with_explicit_privacy_policy() {
         let provider = ApsAuctionProvider::new(config());
diff --git a/crates/trusted-server-core/src/publisher.rs b/crates/trusted-server-core/src/publisher.rs
index 926d58b5d..66f65ba10 100644
--- a/crates/trusted-server-core/src/publisher.rs
+++ b/crates/trusted-server-core/src/publisher.rs
@@ -1392,6 +1392,7 @@ pub async fn handle_publisher_request(
 
     log::debug!("Proxying request to configured publisher backend");
 
+    let request_path_and_query = origin_path_and_query.to_string();
     let request_path = req.uri().path().to_string();
     let is_get = req.method() == http::Method::GET;
 
@@ -1475,7 +1476,7 @@ pub async fn handle_publisher_request(
         if should_run_auction {
             let slots_ctx = MatchedSlotsContext {
                 matched_slots: &matched_slots,
-                request_path: &request_path,
+                request_path_and_query: &request_path_and_query,
             };
             let mut auction_request = build_auction_request(
                 &slots_ctx,
@@ -1785,11 +1786,11 @@ pub async fn handle_publisher_request(
 /// Bundle of the per-request creative-opportunity inputs that travel together.
 ///
 /// Extracted so `build_auction_request` stays under the project's
-/// 7-argument cap (`matched_slots` + `request_path` live for the same
+/// 7-argument cap (`matched_slots` + `request_path_and_query` live for the same
 /// request scope and are passed together everywhere).
 pub(crate) struct MatchedSlotsContext<'a> {
     pub matched_slots: &'a [crate::creative_opportunities::CreativeOpportunitySlot],
-    pub request_path: &'a str,
+    pub request_path_and_query: &'a str,
 }
 
 /// Borrowed inputs for [`apply_auction_eids_and_device`], bundled to keep the
@@ -1871,7 +1872,7 @@ pub(crate) fn build_auction_request(
         .collect();
     let page_url = format!(
         "{}://{}{}",
-        request_info.scheme, request_info.host, slots_ctx.request_path
+        request_info.scheme, request_info.host, slots_ctx.request_path_and_query
     );
     let ec_id = ec_id.filter(|id| !id.is_empty());
     let request_id = ec_id.map_or_else(
@@ -2186,8 +2187,8 @@ pub fn page_bids_preflight_denied() -> Response<EdgeBody> {
 
 /// Normalizes the client-supplied `path` query parameter before glob matching.
 ///
-/// The SPA hook sends `location.pathname`, but the parameter is
-/// client-controlled: strip any query string or fragment and force a leading
+/// The SPA hook sends `location.pathname + location.search`, but the parameter
+/// is client-controlled: strip any query string or fragment and force a leading
 /// `/` so slot `page_patterns` always match against a canonical path shape.
 fn normalize_page_bids_path(raw: &str) -> String {
     let path = raw.split(['?', '#']).next().unwrap_or("");
@@ -2198,6 +2199,20 @@ fn normalize_page_bids_path(raw: &str) -> String {
     }
 }
 
+/// Normalize the page path and query retained in the upstream auction context.
+///
+/// Fragments never reach an HTTP server and are discarded if a client includes
+/// one explicitly. Unlike [`normalize_page_bids_path`], the query is preserved
+/// for the `OpenRTB` `site.page` URL and is not used for slot matching.
+fn normalize_page_bids_path_and_query(raw: &str) -> String {
+    let path_and_query = raw.split('#').next().unwrap_or("");
+    if path_and_query.starts_with('/') {
+        path_and_query.to_string()
+    } else {
+        format!("/{path_and_query}")
+    }
+}
+
 /// Handle `GET /__ts/page-bids?path=<path>` — server-side auction for SPA navigation.
 ///
 /// Matches creative opportunity slots for the given path, runs a server-side
@@ -2238,15 +2253,17 @@ pub async fn handle_page_bids(
         return Ok(page_bids_preflight_denied());
     }
 
-    let path_param = req
+    let requested_page = req
         .uri()
         .query()
         .and_then(|query| {
             url::form_urlencoded::parse(query.as_bytes())
-                .find(|(k, _)| k == "path")
-                .map(|(_, v)| normalize_page_bids_path(&v))
+                .find(|(key, _)| key == "path")
+                .map(|(_, value)| value.into_owned())
         })
         .unwrap_or_else(|| "/".to_string());
+    let path_param = normalize_page_bids_path(&requested_page);
+    let page_path_and_query = normalize_page_bids_path_and_query(&requested_page);
 
     let matched_slots: Vec<_> =
         crate::creative_opportunities::match_slots(auction.slots, &path_param)
@@ -2309,7 +2326,7 @@ pub async fn handle_page_bids(
         if ad_stack_enabled && !is_bot && !is_prefetch {
             let slots_ctx = MatchedSlotsContext {
                 matched_slots: &matched_slots,
-                request_path: &path_param,
+                request_path_and_query: &page_path_and_query,
             };
             let mut auction_request = build_auction_request(
                 &slots_ctx,
@@ -4456,7 +4473,7 @@ mod tests {
             let slots = [slot];
             let slots_ctx = MatchedSlotsContext {
                 matched_slots: &slots,
-                request_path: "/2024/01/my-article/",
+                request_path_and_query: "/2024/01/my-article/?edition=fictional",
             };
             let request_info = RequestInfo {
                 host: "publisher.example.com".to_string(),
@@ -4477,6 +4494,11 @@ mod tests {
                 "should use a non-EC request id, got {}",
                 request.id
             );
+            assert_eq!(
+                request.publisher.page_url.as_deref(),
+                Some("https://publisher.example.com/2024/01/my-article/?edition=fictional"),
+                "should preserve the page path and query for auction providers"
+            );
         }
 
         #[test]
@@ -4485,7 +4507,7 @@ mod tests {
             let slots = [slot];
             let slots_ctx = MatchedSlotsContext {
                 matched_slots: &slots,
-                request_path: "/2024/01/my-article/",
+                request_path_and_query: "/2024/01/my-article/",
             };
             let request_info = RequestInfo {
                 host: "publisher.example.com".to_string(),
@@ -4915,6 +4937,20 @@ mod tests {
             );
         }
 
+        #[test]
+        fn normalize_page_bids_path_and_query_preserves_query_but_drops_fragment() {
+            assert_eq!(
+                normalize_page_bids_path_and_query("/2024/01/article/?edition=fictional#section"),
+                "/2024/01/article/?edition=fictional",
+                "query should reach auction providers without a browser-only fragment"
+            );
+            assert_eq!(
+                normalize_page_bids_path_and_query("2024/01/article/?edition=fictional"),
+                "/2024/01/article/?edition=fictional",
+                "missing leading slash should be added"
+            );
+        }
+
         #[tokio::test]
         async fn disabled_auction_returns_no_slots_or_bids() {
             // [auction].enabled = false is a global kill switch: it must disable
diff --git a/crates/trusted-server-js/lib/src/integrations/gpt/index.ts b/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
index 1d39422ec..b410463c6 100644
--- a/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
+++ b/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
@@ -709,17 +709,16 @@ export function installSpaAuctionHook(): void {
   ts.spaHookInstalled = true;
 
   let inflight: AbortController | null = null;
-  // Last path an auction was run for. popstate fires for hash-only and
-  // same-pathname back/forward (scroll restoration), and pushState/replaceState
-  // can be called with the current URL, so guard every entry point against
-  // re-requesting impressions for a path we already loaded.
-  let currentPath = location.pathname;
+  // Last path and query an auction was run for. popstate fires for hash-only
+  // changes and pushState/replaceState can be called with the current URL, so
+  // guard every entry point against re-requesting impressions already loaded.
+  let currentPath = `${location.pathname}${location.search}`;
   // Last path whose slots/bids were actually applied — the initial SSR page
   // counts. A failed navigation rolls `currentPath` back to this rather than to
   // the immediately-previous committed value: on rapid A→B where A was aborted
   // mid-flight and B then fails, rolling back to A (never loaded) would strand
   // it behind the no-op guard, so we roll back to the last applied route instead.
-  let lastAppliedPath = location.pathname;
+  let lastAppliedPath = `${location.pathname}${location.search}`;
 
   async function onNavigate(path: string): Promise<void> {
     if (path === currentPath) return;
@@ -779,8 +778,9 @@ export function installSpaAuctionHook(): void {
     const original = history[method].bind(history);
     history[method] = function (state: unknown, unused: string, url?: string | URL | null): void {
       original(state, unused, url);
-      const newPath = url ? new URL(String(url), location.href).pathname : location.pathname;
-      // onNavigate no-ops when newPath equals the last loaded path.
+      const locationUrl = url ? new URL(String(url), location.href) : location;
+      const newPath = `${locationUrl.pathname}${locationUrl.search}`;
+      // onNavigate no-ops when newPath equals the last loaded path and query.
       void onNavigate(newPath);
     };
   }
@@ -789,7 +789,7 @@ export function installSpaAuctionHook(): void {
   patchHistoryMethod('replaceState');
 
   window.addEventListener('popstate', () => {
-    void onNavigate(location.pathname);
+    void onNavigate(`${location.pathname}${location.search}`);
   });
 }
 
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts
index 9a08defcb..761fa8b3b 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt/spa_hook.test.ts
@@ -74,11 +74,11 @@ describe('installSpaAuctionHook', () => {
     const adInit = vi.fn();
     ts.adInit = adInit;
 
-    history.pushState({}, '', '/next-page');
+    history.pushState({}, '', '/next-page?edition=fictional#section');
     await flushAsync();
 
     expect(fetchStub).toHaveBeenCalledWith(
-      '/__ts/page-bids?path=%2Fnext-page',
+      '/__ts/page-bids?path=%2Fnext-page%3Fedition%3Dfictional',
       expect.objectContaining({
         credentials: 'include',
         headers: { 'X-TSJS-Page-Bids': '1' },
diff --git a/docs/guide/configuration.md b/docs/guide/configuration.md
index 91b30a143..6e404a1f0 100644
--- a/docs/guide/configuration.md
+++ b/docs/guide/configuration.md
@@ -1211,6 +1211,9 @@ timeout_ms = 2000
 enabled = true
 account_id = "example-account"
 endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
+# Optional pair for deployments hosted away from APS-authorized inventory.
+# inventory_domain = "publisher.example"
+# inventory_page_origin = "https://www.publisher.example"
 allow_script_creatives = false
 
 [integrations.prebid]
diff --git a/docs/guide/integrations/aps.md b/docs/guide/integrations/aps.md
index ff4220070..2b36cb253 100644
--- a/docs/guide/integrations/aps.md
+++ b/docs/guide/integrations/aps.md
@@ -30,6 +30,9 @@ enabled = true
 account_id = "example-aps-account-id"
 endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
 timeout_ms = 800
+# Set both when the deployment hostname differs from APS-authorized inventory.
+# inventory_domain = "publisher.example"
+# inventory_page_origin = "https://www.publisher.example"
 allow_script_creatives = false
 
 [auction]
@@ -42,6 +45,8 @@ timeout_ms = 2000
 
 `allow_script_creatives` defaults to `false`. While disabled, APS script bids are rejected before per-impression reduction, floors, mediation, and winner selection. Enable it only for a controlled cohort after the browser-security checks in [Rollout](#rollout) pass.
 
+Set `inventory_domain` and `inventory_page_origin` together only when the public deployment hostname differs from the inventory identity authorized by APS. The domain becomes `site.domain`. The HTTPS page origin replaces the current page's scheme and host while preserving its path and query. The origin must be the inventory domain or one of its subdomains and cannot include credentials, a port, path, query, or fragment. These values come only from operator configuration; Trusted Server never accepts APS inventory identity from the client auction payload.
+
 APS uses ordinary auction slot IDs and banner formats. Legacy creative-opportunity APS `slot_id` configuration is accepted for compatibility but ignored, and `bidders.aps.slotID` is not required. Remove both during migration.
 
 The APS provider may also participate through a configured mediator:
@@ -184,6 +189,7 @@ Use fictional values in source-controlled configuration and fixtures. Supply con
 
 - Confirm `account_id` and account eligibility with APS.
 - Confirm the endpoint is `/e/pb/bid` and uses HTTPS without credentials.
+- If the deployment hostname differs from APS-authorized inventory, configure both `inventory_domain` and `inventory_page_origin` with the APS-approved identity.
 - Ensure `aps` appears in `auction.providers`.
 - Check aggregate APS drop reasons for currency, dimensions, render source, URL, tag type, or script-gate rejection.
 - Confirm the provider timeout fits inside the auction timeout.
diff --git a/trusted-server.example.toml b/trusted-server.example.toml
index b12de29ec..a133301a4 100644
--- a/trusted-server.example.toml
+++ b/trusted-server.example.toml
@@ -120,6 +120,9 @@ enabled = false
 account_id = "example-aps-account-id"
 endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
 timeout_ms = 1000
+# Set both when the deployment hostname differs from APS-authorized inventory.
+# inventory_domain = "publisher.example"
+# inventory_page_origin = "https://www.publisher.example"
 # Script creatives require separate security validation before opt-in.
 allow_script_creatives = false
 

From 9f898e2a7db4232fb45ebcf70abbced2d80cc895 Mon Sep 17 00:00:00 2001
From: Christian <christianpavilonis@outlook.com>
Date: Thu, 16 Jul 2026 16:56:13 -0500
Subject: [PATCH 4/5] Render APS bids from the trustedServer Prebid adapter

---
 .github/workflows/integration-tests.yml       |  11 +-
 CHANGELOG.md                                  |   1 +
 .../browser/tests/shared/aps-renderer.spec.ts | 204 +++++++++++++++++-
 .../lib/build-prebid-external.mjs             |   7 +
 .../trusted-server-js/lib/src/core/types.ts   |  17 ++
 .../lib/src/integrations/aps/render.ts        | 106 ++++++++-
 .../lib/src/integrations/gpt/index.ts         |  97 +++++++++
 .../lib/src/integrations/prebid/index.ts      |  35 ++-
 .../prebid/prebid_modules/aliases.d.ts        |   5 +
 .../lib/test/integrations/aps/render.test.ts  |  42 ++++
 .../lib/test/integrations/gpt/ad_init.test.ts | 117 ++++++++++
 .../test/integrations/prebid/index.test.ts    | 131 +++++++++++
 crates/trusted-server-js/lib/vitest.config.ts |   4 +
 docs/guide/integrations/aps.md                |   8 +-
 scripts/integration-tests-browser.sh          |   9 +
 15 files changed, 783 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index ec85b96ac..4973afe44 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -183,7 +183,16 @@ jobs:
         with:
           node-version: ${{ steps.shared-setup.outputs.node-version }}
           cache: npm
-          cache-dependency-path: crates/trusted-server-integration-tests/browser/package-lock.json
+          cache-dependency-path: |
+            crates/trusted-server-integration-tests/browser/package-lock.json
+            crates/trusted-server-js/lib/package-lock.json
+
+      - name: Build TSJS browser fixtures
+        working-directory: crates/trusted-server-js/lib
+        run: |
+          npm ci
+          npm run build
+          npm run build:prebid-external
 
       - name: Install Playwright
         working-directory: crates/trusted-server-integration-tests/browser
diff --git a/CHANGELOG.md b/CHANGELOG.md
index aa3bed697..6ab91d4f3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Breaking** — `bid_param_zone_overrides` inner values must now be JSON objects; previously non-object or empty values (`"header" = "x"`, `"header" = {}`) were accepted and silently produced a dead rule at runtime. They now fail at startup with a configuration error. Operators upgrading should audit their `bid_param_zone_overrides` config for non-object zone entries.
 - **Breaking** — Sourcepoint browser module inclusion now requires explicit `[integrations.sourcepoint].enabled = true`; operators relying on the previous unconditional Sourcepoint module should enable the integration before upgrading.
 - Added optional APS `inventory_domain` and `inventory_page_origin` overrides for deployments whose edge hostname differs from the APS-authorized inventory identity.
+- Preserved APS renderer capabilities through the client-side `trustedServer` Prebid adapter, allowing its generated `hb_adid` to render through GAM and Prebid Universal Creative instead of producing an empty creative.
 
 ### Security
 
diff --git a/crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts b/crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts
index bbefc7dfb..7a2078625 100644
--- a/crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts
+++ b/crates/trusted-server-integration-tests/browser/tests/shared/aps-renderer.spec.ts
@@ -1,3 +1,5 @@
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
 import { expect, test } from "@playwright/test";
 import { runtimeUrl } from "../../helpers/state.js";
 
@@ -6,11 +8,24 @@ const IFRAME_CREATIVE_URL = "https://creative.example/iframe";
 const SCRIPT_CREATIVE_URL = "https://creative.example/script.js";
 const SANDBOX =
     "allow-forms allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-scripts allow-top-navigation-by-user-activation";
+const TSJS_CRATE = resolve(__dirname, "../../../../trusted-server-js");
+
+function clientAuctionBundlePaths() {
+    const manifestPath = resolve(TSJS_CRATE, "dist/prebid/manifest.json");
+    const manifest = JSON.parse(readFileSync(manifestPath, "utf8")) as {
+        filename: string;
+    };
+    return {
+        gpt: resolve(TSJS_CRATE, "dist/tsjs-gpt.js"),
+        prebid: resolve(TSJS_CRATE, "dist/prebid", manifest.filename),
+    };
+}
 
 function descriptor(
     tagType: "iframe" | "script",
-    creativeUrl =
-        tagType === "iframe" ? IFRAME_CREATIVE_URL : SCRIPT_CREATIVE_URL,
+    creativeUrl = tagType === "iframe"
+        ? IFRAME_CREATIVE_URL
+        : SCRIPT_CREATIVE_URL,
 ) {
     const envelope = {
         seatbid: [
@@ -151,6 +166,183 @@ const SCRIPT_CREATIVE = `(function(){
 })();`;
 
 test.describe("APS opaque renderer", () => {
+    test("renders a trustedServer adapter bid using Prebid's generated GAM ad ID", async ({
+        page,
+    }) => {
+        const apsRenderer = descriptor("iframe");
+        const responseBody = {
+            id: "fictional-auction",
+            seatbid: [
+                {
+                    seat: "aps",
+                    bid: [
+                        {
+                            id: apsRenderer.bidId,
+                            impid: "div-aps",
+                            price: 1.23,
+                            crid: apsRenderer.creativeId,
+                            w: 300,
+                            h: 250,
+                            ext: {
+                                trusted_server: { renderer: apsRenderer },
+                            },
+                        },
+                    ],
+                },
+            ],
+            ext: {},
+        };
+        let auctionRequests = 0;
+        await page.route(runtimeUrl("/aps-prebid-adapter-test"), (route) =>
+            route.fulfill({
+                status: 200,
+                contentType: "text/html",
+                body: '<!doctype html><div id="div-aps"></div>',
+            }),
+        );
+        await page.route(runtimeUrl("/auction"), (route) => {
+            auctionRequests += 1;
+            return route.fulfill({
+                status: 200,
+                contentType: "application/json",
+                body: JSON.stringify(responseBody),
+            });
+        });
+
+        await page.goto(runtimeUrl("/aps-prebid-adapter-test"));
+        const bundles = clientAuctionBundlePaths();
+        await page.addScriptTag({ path: bundles.gpt });
+        await page.addScriptTag({ path: bundles.prebid });
+
+        const result = await page.evaluate(async () => {
+            type PrebidBid = {
+                ad?: string;
+                adId: string;
+                bidderCode: string;
+                status?: string;
+            };
+            type PrebidApi = {
+                getAllWinningBids(): PrebidBid[];
+                getBidResponsesForAdUnitCode(code: string): {
+                    bids: PrebidBid[];
+                };
+                onEvent(
+                    name: string,
+                    callback: (value: Record<string, unknown>) => void,
+                ): void;
+                requestBids(options: Record<string, unknown>): void;
+            };
+            const pbjs = (window as unknown as { pbjs: PrebidApi }).pbjs;
+            const bidWon: string[] = [];
+            const renderSucceeded: string[] = [];
+            pbjs.onEvent("bidWon", (bid) => bidWon.push(String(bid.adId)));
+            pbjs.onEvent("adRenderSucceeded", (event) =>
+                renderSucceeded.push(String(event.adId)),
+            );
+
+            const acceptedBid = await new Promise<PrebidBid | undefined>(
+                (resolveBid) => {
+                    pbjs.requestBids({
+                        adUnits: [
+                            {
+                                code: "div-aps",
+                                mediaTypes: { banner: { sizes: [[300, 250]] } },
+                                bids: [],
+                            },
+                        ],
+                        bidsBackHandler: () =>
+                            resolveBid(
+                                pbjs
+                                    .getBidResponsesForAdUnitCode("div-aps")
+                                    .bids.find(
+                                        (bid) => bid.bidderCode === "aps",
+                                    ),
+                            ),
+                        timeout: 1_000,
+                    });
+                },
+            );
+            if (!acceptedBid)
+                throw new Error("APS bid was not accepted by Prebid");
+
+            const universalCreativeResponse = await new Promise<
+                Record<string, unknown>
+            >((resolveResponse, rejectResponse) => {
+                const frame = document.createElement("iframe");
+                const adIdJson = JSON.stringify(acceptedBid.adId);
+                frame.srcdoc = `<script>
+const renderChannel = new MessageChannel();
+renderChannel.port1.onmessage = function(event) {
+  parent.postMessage({ type: 'captured-prebid-response', payload: event.data }, '*');
+  const eventChannel = new MessageChannel();
+  parent.postMessage(JSON.stringify({
+    message: 'Prebid Event',
+    adId: ${adIdJson},
+    event: 'adRenderSucceeded'
+  }), '*', [eventChannel.port2]);
+};
+parent.postMessage(JSON.stringify({
+  message: 'Prebid Request',
+  adId: ${adIdJson}
+}), '*', [renderChannel.port2]);
+<\/script>`;
+                const receive = (event: MessageEvent) => {
+                    if (event.data?.type !== "captured-prebid-response") return;
+                    window.removeEventListener("message", receive);
+                    resolveResponse(JSON.parse(String(event.data.payload)));
+                };
+                window.addEventListener("message", receive);
+                document.getElementById("div-aps")!.appendChild(frame);
+                window.setTimeout(
+                    () =>
+                        rejectResponse(
+                            new Error("Universal Creative response timed out"),
+                        ),
+                    3_000,
+                );
+            });
+            await new Promise((resolveTick) =>
+                window.setTimeout(resolveTick, 50),
+            );
+
+            return {
+                acceptedAd: acceptedBid.ad,
+                acceptedAdId: acceptedBid.adId,
+                acceptedStatus: acceptedBid.status,
+                bidWon,
+                renderSucceeded,
+                universalCreativeResponse,
+                winningAdIds: pbjs.getAllWinningBids().map((bid) => bid.adId),
+                registrySize: Object.keys(
+                    (
+                        window as unknown as {
+                            tsjs?: {
+                                apsPrebidRenderers?: Record<string, unknown>;
+                            };
+                        }
+                    ).tsjs?.apsPrebidRenderers ?? {},
+                ).length,
+            };
+        });
+
+        expect(auctionRequests).toBe(1);
+        expect(result.acceptedAd).toBe("");
+        expect(result.acceptedAdId).not.toBe(apsRenderer.bidId);
+        expect(result.universalCreativeResponse).toEqual(
+            expect.objectContaining({
+                message: "Prebid Response",
+                adId: result.acceptedAdId,
+                rendererVersion: 4,
+                apsRenderer,
+            }),
+        );
+        expect(result.bidWon).toEqual([result.acceptedAdId]);
+        expect(result.renderSucceeded).toEqual([result.acceptedAdId]);
+        expect(result.winningAdIds).toContain(result.acceptedAdId);
+        expect(result.acceptedStatus).toBe("rendered");
+        expect(result.registrySize).toBe(0);
+    });
+
     test("enforces nonce gating and isolates iframe and script behavior under restrictive CSP", async ({
         page,
     }) => {
@@ -201,9 +393,7 @@ test.describe("APS opaque renderer", () => {
                     "Content-Security-Policy":
                         "default-src 'none'; script-src 'unsafe-inline'; frame-src 'self'",
                 },
-                body: testPage(
-                    runtimeUrl("/integrations/aps/renderer"),
-                ),
+                body: testPage(runtimeUrl("/integrations/aps/renderer")),
             });
         });
 
@@ -609,6 +799,8 @@ test.describe("APS opaque renderer", () => {
 
         await page.waitForTimeout(100);
         expect(runnerRequests).toBe(0);
-        await expect(page.locator("#same-origin-slot .existing")).toHaveCount(1);
+        await expect(page.locator("#same-origin-slot .existing")).toHaveCount(
+            1,
+        );
     });
 });
diff --git a/crates/trusted-server-js/lib/build-prebid-external.mjs b/crates/trusted-server-js/lib/build-prebid-external.mjs
index e3bb5ab3c..bedca5d80 100644
--- a/crates/trusted-server-js/lib/build-prebid-external.mjs
+++ b/crates/trusted-server-js/lib/build-prebid-external.mjs
@@ -218,6 +218,13 @@ async function buildExternalBundle(outDir, generatedModules) {
               'node_modules/prebid.js/dist/src/src/adapterManager.js'
             ),
           },
+          {
+            find: 'prebid.js/src/adRendering.js',
+            replacement: path.resolve(
+              __dirname,
+              'node_modules/prebid.js/dist/src/src/adRendering.js'
+            ),
+          },
         ],
       },
       build: {
diff --git a/crates/trusted-server-js/lib/src/core/types.ts b/crates/trusted-server-js/lib/src/core/types.ts
index ffa5c1ed3..7cae70396 100644
--- a/crates/trusted-server-js/lib/src/core/types.ts
+++ b/crates/trusted-server-js/lib/src/core/types.ts
@@ -68,6 +68,18 @@ export interface ApsRendererV1 {
 
 export type AuctionBidRenderer = ApsRendererV1;
 
+/** A client-side Prebid bid's generated ad ID bound to its APS render capability. */
+export interface ApsPrebidRendererEntry {
+  adUnitCode: string;
+  renderer: ApsRendererV1;
+  registeredAt: number;
+  expiresAt: number;
+  /** Notify Prebid that GAM selected this bid before replying to Universal Creative. */
+  markWinner(): void;
+  /** Mark Prebid's bid rendered after the Universal Creative response is posted. */
+  markRendered(): void;
+}
+
 /** Bid targeting data from the server-side auction, injected into `window.tsjs.bids`. */
 export interface AuctionBidData {
   hb_pb?: string;
@@ -112,6 +124,11 @@ export interface TsjsApi {
   adSlots?: AuctionSlot[];
   /** Winning bid targeting data injected before </body>. */
   bids?: Record<string, AuctionBidData>;
+  /**
+   * Bounded client-side Prebid APS renderer capabilities keyed by Prebid's generated
+   * `hb_adid`. The Universal Creative bridge consumes each entry at most once.
+   */
+  apsPrebidRenderers?: Record<string, ApsPrebidRendererEntry>;
   /** Initialises GPT slots with server-side bid targeting and calls refresh(). */
   adInit?: () => void;
   /** GPT slot objects TS defined — used to destroy stale slots on SPA navigation. */
diff --git a/crates/trusted-server-js/lib/src/integrations/aps/render.ts b/crates/trusted-server-js/lib/src/integrations/aps/render.ts
index f9e6b03b9..ff37e2cb4 100644
--- a/crates/trusted-server-js/lib/src/integrations/aps/render.ts
+++ b/crates/trusted-server-js/lib/src/integrations/aps/render.ts
@@ -1,5 +1,5 @@
 import { log } from '../../core/log';
-import type { ApsRendererV1 } from '../../core/types';
+import type { ApsPrebidRendererEntry, ApsRendererV1, TsjsApi } from '../../core/types';
 
 export const APS_RENDERER_PATH = '/integrations/aps/renderer';
 export const APS_RENDERER_SANDBOX =
@@ -26,6 +26,10 @@ const activeFrames = new WeakMap<HTMLElement, HTMLIFrameElement>();
 const RENDERER_READY_MESSAGE = 'trusted-server/aps/renderer-ready';
 const RENDERER_FAILED_MESSAGE = 'trusted-server/aps/renderer-failed';
 const RENDERER_READY_TIMEOUT_MS = 10_000;
+const MAX_PREBID_RENDERER_ENTRIES = 256;
+const DEFAULT_PREBID_RENDERER_TTL_SECONDS = 300;
+const MAX_PREBID_RENDERER_TTL_SECONDS = 3600;
+const MAX_PREBID_ID_BYTES = 1024;
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === 'object' && value !== null && !Array.isArray(value);
@@ -158,6 +162,106 @@ export function validateApsRenderer(
   return renderer;
 }
 
+function validPrebidIdentity(value: unknown): value is string {
+  return (
+    typeof value === 'string' &&
+    value.length > 0 &&
+    new TextEncoder().encode(value).length <= MAX_PREBID_ID_BYTES
+  );
+}
+
+function validPrebidAdId(value: unknown): value is string {
+  return validPrebidIdentity(value) && /^[A-Za-z0-9-]+$/.test(value);
+}
+
+function prunePrebidRenderers(registry: Record<string, ApsPrebidRendererEntry>, now: number): void {
+  for (const [adId, entry] of Object.entries(registry)) {
+    if (!Number.isFinite(entry.expiresAt) || entry.expiresAt <= now) delete registry[adId];
+  }
+
+  const entries = Object.entries(registry);
+  if (entries.length <= MAX_PREBID_RENDERER_ENTRIES) return;
+  entries
+    .sort(([, left], [, right]) => left.registeredAt - right.registeredAt)
+    .slice(0, entries.length - MAX_PREBID_RENDERER_ENTRIES)
+    .forEach(([adId]) => delete registry[adId]);
+}
+
+/** Bind Prebid's generated ad ID to a fully validated APS renderer capability. */
+export function registerApsPrebidRenderer(
+  adId: unknown,
+  adUnitCode: unknown,
+  input: unknown,
+  ttlSeconds: unknown = DEFAULT_PREBID_RENDERER_TTL_SECONDS,
+  lifecycle?: { markWinner(): void; markRendered(): void }
+): boolean {
+  if (
+    !validPrebidAdId(adId) ||
+    !validPrebidIdentity(adUnitCode) ||
+    typeof lifecycle?.markWinner !== 'function' ||
+    typeof lifecycle.markRendered !== 'function'
+  ) {
+    return false;
+  }
+  const renderer = validateApsRenderer(input);
+  if (!renderer) return false;
+
+  const now = Date.now();
+  const boundedTtlSeconds =
+    typeof ttlSeconds === 'number' && Number.isFinite(ttlSeconds) && ttlSeconds > 0
+      ? Math.min(ttlSeconds, MAX_PREBID_RENDERER_TTL_SECONDS)
+      : DEFAULT_PREBID_RENDERER_TTL_SECONDS;
+  const tsjs = (window.tsjs ??= {} as TsjsApi);
+  const registry = (tsjs.apsPrebidRenderers ??= Object.create(null) as Record<
+    string,
+    ApsPrebidRendererEntry
+  >);
+  prunePrebidRenderers(registry, now);
+
+  if (!(adId in registry) && Object.keys(registry).length >= MAX_PREBID_RENDERER_ENTRIES) {
+    const oldest = Object.entries(registry).sort(
+      ([, left], [, right]) => left.registeredAt - right.registeredAt
+    )[0];
+    if (oldest) delete registry[oldest[0]];
+  }
+
+  registry[adId] = {
+    adUnitCode,
+    renderer,
+    registeredAt: now,
+    expiresAt: now + boundedTtlSeconds * 1000,
+    markWinner: lifecycle.markWinner,
+    markRendered: lifecycle.markRendered,
+  };
+  return true;
+}
+
+/** Return an unexpired Prebid APS capability without consuming it. */
+export function getApsPrebidRenderer(adId: string): ApsPrebidRendererEntry | undefined {
+  if (!validPrebidAdId(adId)) return undefined;
+  const registry = window.tsjs?.apsPrebidRenderers;
+  const entry = registry?.[adId];
+  if (!entry) return undefined;
+  if (
+    !Number.isFinite(entry.expiresAt) ||
+    entry.expiresAt <= Date.now() ||
+    typeof entry.markWinner !== 'function' ||
+    typeof entry.markRendered !== 'function'
+  ) {
+    delete registry![adId];
+    return undefined;
+  }
+  return entry;
+}
+
+/** Atomically consume the exact capability previously returned by the registry. */
+export function consumeApsPrebidRenderer(adId: string, expected: ApsPrebidRendererEntry): boolean {
+  const registry = window.tsjs?.apsPrebidRenderers;
+  if (!registry || registry[adId] !== expected) return false;
+  delete registry[adId];
+  return true;
+}
+
 function createNonce(): string | undefined {
   if (typeof crypto === 'undefined' || typeof crypto.getRandomValues !== 'function')
     return undefined;
diff --git a/crates/trusted-server-js/lib/src/integrations/gpt/index.ts b/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
index b410463c6..aab9e3094 100644
--- a/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
+++ b/crates/trusted-server-js/lib/src/integrations/gpt/index.ts
@@ -4,6 +4,8 @@ import {
   APS_UNIVERSAL_CREATIVE_RENDERER,
   APS_UNIVERSAL_CREATIVE_RENDERER_VERSION,
   apsRendererUrl,
+  consumeApsPrebidRenderer,
+  getApsPrebidRenderer,
   validateApsRenderer,
 } from '../aps/render';
 
@@ -97,6 +99,21 @@ function slotIdForMessageSource(source: MessageEventSource | null): string | und
   )?.id;
 }
 
+function messageSourceBelongsToAdUnit(
+  source: MessageEventSource | null,
+  adUnitCode: string
+): boolean {
+  if (!source) return false;
+  const roots = [
+    document.getElementById(adUnitCode),
+    document.getElementById(`${adUnitCode}-container`),
+  ].filter((root): root is HTMLElement => root !== null);
+
+  return roots.some((root) =>
+    Array.from(root.querySelectorAll('iframe')).some((iframe) => iframe.contentWindow === source)
+  );
+}
+
 function clearTargetingKeys(slot: GoogleTagSlot, keys: Iterable<string>): void {
   if (typeof slot.clearTargeting !== 'function') return;
 
@@ -846,6 +863,21 @@ export function installTsRenderBridge(): void {
   // and both fire the nurl/burl beacons. Tracking in-flight adIds prevents the
   // concurrent double-fire; the entry is cleared once the fetch settles.
   const renderingAdIds = new Set<string>();
+  const consumedPrebidApsIds = new Map<string, { adUnitCode: string; expiresAt: number }>();
+  const rememberConsumedPrebidApsId = (
+    adId: string,
+    entry: { adUnitCode: string; expiresAt: number }
+  ): void => {
+    const now = Date.now();
+    for (const [consumedAdId, consumed] of consumedPrebidApsIds) {
+      if (consumed.expiresAt <= now) consumedPrebidApsIds.delete(consumedAdId);
+    }
+    if (!consumedPrebidApsIds.has(adId) && consumedPrebidApsIds.size >= 256) {
+      const oldestAdId = consumedPrebidApsIds.keys().next().value as string | undefined;
+      if (oldestAdId) consumedPrebidApsIds.delete(oldestAdId);
+    }
+    consumedPrebidApsIds.set(adId, entry);
+  };
 
   window.addEventListener('message', (e: MessageEvent) => {
     let data: Record<string, unknown>;
@@ -864,6 +896,71 @@ export function installTsRenderBridge(): void {
 
     const port = e.ports?.[0];
     if (!port) return;
+
+    const consumedPrebidAps = consumedPrebidApsIds.get(adId);
+    if (consumedPrebidAps) {
+      if (consumedPrebidAps.expiresAt <= Date.now()) {
+        consumedPrebidApsIds.delete(adId);
+      } else {
+        if (messageSourceBelongsToAdUnit(e.source, consumedPrebidAps.adUnitCode)) {
+          e.stopImmediatePropagation();
+        }
+        return;
+      }
+    }
+
+    // Client-side trustedServer adapter bids receive a new adId from Prebid. Bind
+    // that ID to the server-validated APS descriptor only after confirming the
+    // requesting Universal Creative frame belongs to the same GPT ad unit.
+    const prebidRendererEntry = getApsPrebidRenderer(adId);
+    if (prebidRendererEntry) {
+      if (!messageSourceBelongsToAdUnit(e.source, prebidRendererEntry.adUnitCode)) return;
+      const renderer = validateApsRenderer(prebidRendererEntry.renderer);
+      const rendererUrl = apsRendererUrl();
+      if (!renderer || !rendererUrl) return;
+      if (!consumeApsPrebidRenderer(adId, prebidRendererEntry)) return;
+      rememberConsumedPrebidApsId(adId, {
+        adUnitCode: prebidRendererEntry.adUnitCode,
+        expiresAt: prebidRendererEntry.expiresAt,
+      });
+
+      e.stopImmediatePropagation();
+      try {
+        prebidRendererEntry.markWinner();
+      } catch (err) {
+        log.warn('[tsjs-gpt] pbRender bridge: Prebid APS winner lifecycle failed', err);
+        return;
+      }
+
+      try {
+        port.postMessage(
+          JSON.stringify({
+            message: 'Prebid Response',
+            adId,
+            renderer: APS_UNIVERSAL_CREATIVE_RENDERER,
+            rendererVersion: APS_UNIVERSAL_CREATIVE_RENDERER_VERSION,
+            rendererUrl,
+            apsRenderer: renderer,
+            width: renderer.width,
+            height: renderer.height,
+          })
+        );
+      } catch (err) {
+        log.warn('[tsjs-gpt] pbRender bridge: Prebid APS response failed', err);
+        return;
+      }
+
+      try {
+        prebidRendererEntry.markRendered();
+      } catch (err) {
+        log.warn('[tsjs-gpt] pbRender bridge: Prebid APS rendered lifecycle failed', err);
+      }
+      log.debug(
+        `[tsjs-gpt] pbRender bridge served Prebid APS bid for '${prebidRendererEntry.adUnitCode}'`
+      );
+      return;
+    }
+
     const sourceSlotId = slotIdForMessageSource(e.source);
     if (!sourceSlotId) return;
 
diff --git a/crates/trusted-server-js/lib/src/integrations/prebid/index.ts b/crates/trusted-server-js/lib/src/integrations/prebid/index.ts
index be839d8fc..f5071ba46 100644
--- a/crates/trusted-server-js/lib/src/integrations/prebid/index.ts
+++ b/crates/trusted-server-js/lib/src/integrations/prebid/index.ts
@@ -13,6 +13,7 @@
 
 import pbjs from 'prebid.js';
 import adapterManager from 'prebid.js/src/adapterManager.js';
+import { markBidAsRendered, markWinner } from 'prebid.js/src/adRendering.js';
 import 'prebid.js/modules/consentManagementTcf.js';
 import 'prebid.js/modules/consentManagementGpp.js';
 import 'prebid.js/modules/consentManagementUsp.js';
@@ -29,12 +30,16 @@ import './_user_ids.generated';
 
 import { log } from '../../core/log';
 import { buildAdRequest, parseAuctionResponse } from '../../core/auction';
+import { registerApsPrebidRenderer } from '../aps/render';
 import type { AuctionBid, AuctionEid } from '../../core/auction';
 import type { AuctionSlot } from '../../core/types';
 
 import { DEFAULT_PREBID_USER_ID_MODULES, PREBID_USER_ID_MODULE_REGISTRY } from './user_id_modules';
 
 const ADAPTER_CODE = 'trustedServer';
+const APS_BIDDER_CODE = 'aps';
+const APS_RENDERER_FIELD = 'trustedServerRenderer';
+const APS_BID_RESPONSE_LISTENER_SENTINEL = '__tsApsBidResponseListenerInstalled';
 const BIDDER_PARAMS_KEY = 'bidderParams';
 const ZONE_KEY = 'zone';
 const TS_REFRESH_TARGETING_KEYS = [
@@ -201,7 +206,8 @@ export function auctionBidsToPrebidBids(auctionBids: AuctionBid[], bidRequests:
       cpm: bid.price,
       width: bid.width,
       height: bid.height,
-      ad: bid.adm,
+      ad: bid.renderer ? '' : bid.adm,
+      ...(bid.renderer ? { [APS_RENDERER_FIELD]: bid.renderer } : {}),
       ttl: 300,
       creativeId: bid.creativeId,
       netRevenue: true,
@@ -491,6 +497,32 @@ function collectAuctionEids(): AuctionEid[] | undefined {
  * 1. `window.__tsjs_prebid` — injected by the server from trusted-server.toml
  * 2. `config` argument — explicit overrides from the publisher's JS
  */
+function installApsBidResponseRegistry(): void {
+  const prebid = pbjs as typeof pbjs & Record<string, unknown>;
+  if (prebid[APS_BID_RESPONSE_LISTENER_SENTINEL] === true) return;
+
+  pbjs.onEvent('bidResponse', (rawBid) => {
+    const bid = rawBid as unknown as Record<string, unknown>;
+    const renderer = bid[APS_RENDERER_FIELD];
+    if (
+      bid['adapterCode'] !== ADAPTER_CODE ||
+      bid['bidderCode'] !== APS_BIDDER_CODE ||
+      renderer === undefined
+    ) {
+      return;
+    }
+
+    registerApsPrebidRenderer(bid['adId'], bid['adUnitCode'], renderer, bid['ttl'], {
+      markWinner: () => markWinner(rawBid),
+      markRendered: () => markBidAsRendered(rawBid),
+    });
+    // Keep the executable capability only in the bounded, one-time registry. Prebid
+    // still owns the generated ad ID and ordinary GAM targeting on this bid object.
+    delete bid[APS_RENDERER_FIELD];
+  });
+  prebid[APS_BID_RESPONSE_LISTENER_SENTINEL] = true;
+}
+
 export function installPrebidNpm(config?: Partial<PrebidNpmConfig>): typeof pbjs {
   const injected = getInjectedConfig();
   const merged: PrebidNpmConfig = {
@@ -500,6 +532,7 @@ export function installPrebidNpm(config?: Partial<PrebidNpmConfig>): typeof pbjs
   };
 
   auctionEndpoint = merged.endpoint ?? '/auction';
+  installApsBidResponseRegistry();
 
   // Register the trustedServer adapter using pbjs.registerBidAdapter(null, code, spec)
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
diff --git a/crates/trusted-server-js/lib/src/integrations/prebid/prebid_modules/aliases.d.ts b/crates/trusted-server-js/lib/src/integrations/prebid/prebid_modules/aliases.d.ts
index e725a80f8..8280ea216 100644
--- a/crates/trusted-server-js/lib/src/integrations/prebid/prebid_modules/aliases.d.ts
+++ b/crates/trusted-server-js/lib/src/integrations/prebid/prebid_modules/aliases.d.ts
@@ -3,3 +3,8 @@ declare module 'tsjs-prebid/liveIntentIdSystemStandard';
 declare module 'tsjs-prebid/prebidGlobal' {
   export function registerModule(name: string): void;
 }
+
+declare module 'prebid.js/src/adRendering.js' {
+  export function markBidAsRendered(bid: unknown): void;
+  export function markWinner(bid: unknown): void;
+}
diff --git a/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts b/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts
index 4b1925014..e7978e1cb 100644
--- a/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/aps/render.test.ts
@@ -7,7 +7,9 @@ import {
   APS_UNIVERSAL_CREATIVE_RENDERER,
   APS_UNIVERSAL_CREATIVE_RENDERER_VERSION,
   apsRendererUrl,
+  getApsPrebidRenderer,
   parseApsRendererDescriptor,
+  registerApsPrebidRenderer,
   renderApsCreative,
   validateApsRenderer,
 } from '../../../src/integrations/aps/render';
@@ -130,6 +132,46 @@ describe('APS renderer validation', () => {
   });
 });
 
+describe('Prebid APS renderer registry', () => {
+  afterEach(() => {
+    delete window.tsjs;
+  });
+
+  it('bounds entries and evicts the oldest capability', () => {
+    for (let index = 0; index <= 256; index += 1) {
+      expect(
+        registerApsPrebidRenderer(`prebid-${index}`, 'fictional-slot', descriptor(), 300, {
+          markWinner: vi.fn(),
+          markRendered: vi.fn(),
+        })
+      ).toBe(true);
+    }
+
+    expect(Object.keys(window.tsjs?.apsPrebidRenderers ?? {})).toHaveLength(256);
+    expect(getApsPrebidRenderer('prebid-0')).toBeUndefined();
+    expect(getApsPrebidRenderer('prebid-256')).toEqual(
+      expect.objectContaining({ adUnitCode: 'fictional-slot', renderer: descriptor() })
+    );
+  });
+
+  it('rejects unsafe Prebid IDs and invalid descriptors', () => {
+    const lifecycle = { markWinner: vi.fn(), markRendered: vi.fn() };
+    expect(
+      registerApsPrebidRenderer('__proto__', 'fictional-slot', descriptor(), 300, lifecycle)
+    ).toBe(false);
+    expect(
+      registerApsPrebidRenderer(
+        'safe-prebid-id',
+        'fictional-slot',
+        descriptor({ aaxResponse: 'invalid' }),
+        300,
+        lifecycle
+      )
+    ).toBe(false);
+    expect(window.tsjs?.apsPrebidRenderers).toBeUndefined();
+  });
+});
+
 describe('direct APS rendering', () => {
   beforeEach(() => {
     document.body.innerHTML = '<div id="fictional-slot"><span>existing</span></div>';
diff --git a/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts b/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts
index 38a7fbce7..4e525ad50 100644
--- a/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/gpt/ad_init.test.ts
@@ -1029,6 +1029,123 @@ describe('installTsRenderBridge', () => {
     beaconSpy.mockRestore();
   });
 
+  it('serves a registered Prebid APS renderer when its generated ad ID differs from the APS bid ID', async () => {
+    const renderer = apsRenderer();
+    const prebidAdId = 'prebid-generated-ad-id';
+    const markWinner = vi.fn();
+    const markRendered = vi.fn();
+    (window as TestWindow).tsjs.apsPrebidRenderers = {
+      [prebidAdId]: {
+        adUnitCode: 'div-header',
+        renderer,
+        registeredAt: Date.now(),
+        expiresAt: Date.now() + 60_000,
+        markWinner,
+        markRendered,
+      },
+    };
+
+    const bridgeListener = await captureBridgeListener();
+    const source = createTrustedSlotIframe();
+    const stopSpy = vi.fn();
+    const portMessages: string[] = [];
+    const event = Object.assign(new Event('message'), {
+      data: JSON.stringify({ message: 'Prebid Request', adId: prebidAdId }),
+      ports: [{ postMessage: (message: string) => portMessages.push(message) }],
+      source,
+      stopImmediatePropagation: stopSpy,
+    }) as unknown as MessageEvent;
+
+    bridgeListener(event);
+    bridgeListener(event);
+
+    expect(stopSpy).toHaveBeenCalledTimes(2);
+    expect(portMessages).toHaveLength(1);
+    expect(markWinner).toHaveBeenCalledTimes(1);
+    expect(markRendered).toHaveBeenCalledTimes(1);
+    expect(JSON.parse(portMessages[0])).toEqual(
+      expect.objectContaining({
+        message: 'Prebid Response',
+        adId: prebidAdId,
+        apsRenderer: renderer,
+        width: renderer.width,
+        height: renderer.height,
+      })
+    );
+    expect(renderer.bidId).not.toBe(prebidAdId);
+    expect((window as TestWindow).tsjs.apsPrebidRenderers[prebidAdId]).toBeUndefined();
+    expect(fetchStub).not.toHaveBeenCalled();
+  });
+
+  it('does not expose a registered Prebid APS renderer to another slot iframe', async () => {
+    const renderer = apsRenderer();
+    const prebidAdId = 'prebid-generated-ad-id';
+    (window as TestWindow).tsjs.apsPrebidRenderers = {
+      [prebidAdId]: {
+        adUnitCode: 'div-header',
+        renderer,
+        registeredAt: Date.now(),
+        expiresAt: Date.now() + 60_000,
+        markWinner: vi.fn(),
+        markRendered: vi.fn(),
+      },
+    };
+
+    const footer = document.createElement('div');
+    footer.id = 'div-footer';
+    const foreignIframe = document.createElement('iframe');
+    footer.appendChild(foreignIframe);
+    document.body.appendChild(footer);
+
+    const bridgeListener = await captureBridgeListener();
+    const stopSpy = vi.fn();
+    const portMessages: string[] = [];
+    bridgeListener(
+      Object.assign(new Event('message'), {
+        data: JSON.stringify({ message: 'Prebid Request', adId: prebidAdId }),
+        ports: [{ postMessage: (message: string) => portMessages.push(message) }],
+        source: foreignIframe.contentWindow,
+        stopImmediatePropagation: stopSpy,
+      }) as unknown as MessageEvent
+    );
+
+    expect(stopSpy).not.toHaveBeenCalled();
+    expect(portMessages).toEqual([]);
+    expect((window as TestWindow).tsjs.apsPrebidRenderers[prebidAdId]).toBeDefined();
+    footer.remove();
+  });
+
+  it('drops an expired Prebid APS renderer without claiming the creative request', async () => {
+    const prebidAdId = 'expired-prebid-ad-id';
+    (window as TestWindow).tsjs.apsPrebidRenderers = {
+      [prebidAdId]: {
+        adUnitCode: 'div-header',
+        renderer: apsRenderer(),
+        registeredAt: Date.now() - 61_000,
+        expiresAt: Date.now() - 1_000,
+        markWinner: vi.fn(),
+        markRendered: vi.fn(),
+      },
+    };
+
+    const bridgeListener = await captureBridgeListener();
+    const source = createTrustedSlotIframe();
+    const stopSpy = vi.fn();
+    const portMessages: string[] = [];
+    bridgeListener(
+      Object.assign(new Event('message'), {
+        data: JSON.stringify({ message: 'Prebid Request', adId: prebidAdId }),
+        ports: [{ postMessage: (message: string) => portMessages.push(message) }],
+        source,
+        stopImmediatePropagation: stopSpy,
+      }) as unknown as MessageEvent
+    );
+
+    expect(stopSpy).not.toHaveBeenCalled();
+    expect(portMessages).toEqual([]);
+    expect((window as TestWindow).tsjs.apsPrebidRenderers[prebidAdId]).toBeUndefined();
+  });
+
   it('validates APS data before claiming the Prebid request', async () => {
     const renderer = { ...apsRenderer(), aaxResponse: 'invalid' };
     (window as TestWindow).tsjs.bids.homepage_header = {
diff --git a/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts b/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts
index 9ad7945c4..5a65312ae 100644
--- a/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/prebid/index.test.ts
@@ -1,4 +1,21 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import envelope from '../../fixtures/aps-renderer-v1.json';
+
+function apsRenderer() {
+  const bid = envelope.seatbid[0].bid[0];
+  return {
+    type: 'aps' as const,
+    version: 1 as const,
+    accountId: 'example-account-id',
+    bidId: bid.id,
+    creativeId: 'fictional-creative-id',
+    tagType: 'iframe' as const,
+    creativeUrl: bid.ext.creativeurl,
+    aaxResponse: btoa(JSON.stringify(envelope)),
+    width: bid.w,
+    height: bid.h,
+  };
+}
 
 // Define mocks using vi.hoisted so they're available inside vi.mock factories
 const {
@@ -7,6 +24,9 @@ const {
   mockRequestBids,
   mockRegisterBidAdapter,
   mockGetUserIdsAsEids,
+  mockMarkBidAsRendered,
+  mockMarkWinner,
+  mockOnEvent,
   mockPbjs,
   mockGetBidAdapter,
   mockAdapterManager,
@@ -16,6 +36,9 @@ const {
   const mockRequestBids = vi.fn();
   const mockRegisterBidAdapter = vi.fn();
   const mockGetBidAdapter = vi.fn();
+  const mockMarkBidAsRendered = vi.fn();
+  const mockMarkWinner = vi.fn();
+  const mockOnEvent = vi.fn();
   const mockGetUserIdsAsEids = vi.fn(
     () => [] as Array<{ source: string; uids?: Array<{ id: string; atype?: number }> }>
   );
@@ -25,6 +48,7 @@ const {
     requestBids: mockRequestBids,
     registerBidAdapter: mockRegisterBidAdapter,
     getUserIdsAsEids: mockGetUserIdsAsEids,
+    onEvent: mockOnEvent,
     adUnits: [] as any[],
   };
   const mockAdapterManager = {
@@ -36,6 +60,9 @@ const {
     mockRequestBids,
     mockRegisterBidAdapter,
     mockGetUserIdsAsEids,
+    mockMarkBidAsRendered,
+    mockMarkWinner,
+    mockOnEvent,
     mockPbjs,
     mockGetBidAdapter,
     mockAdapterManager,
@@ -46,6 +73,10 @@ const {
 // The real prebid.js cannot run in jsdom, so we provide a minimal stub.
 vi.mock('prebid.js', () => ({ default: mockPbjs }));
 vi.mock('prebid.js/src/adapterManager.js', () => ({ default: mockAdapterManager }));
+vi.mock('prebid.js/src/adRendering.js', () => ({
+  markBidAsRendered: mockMarkBidAsRendered,
+  markWinner: mockMarkWinner,
+}));
 
 // Side-effect imports are no-ops in tests
 vi.mock('prebid.js/modules/consentManagementTcf.js', () => ({}));
@@ -142,6 +173,37 @@ describe('prebid/auctionBidsToPrebidBids', () => {
     });
   });
 
+  it('preserves an APS renderer without converting it to executable markup', () => {
+    const renderer = apsRenderer();
+    const auctionBids: AuctionBid[] = [
+      {
+        impid: 'div-aps',
+        adm: '<script>must not become Prebid ad markup</script>',
+        renderer,
+        price: 1.23,
+        width: 300,
+        height: 250,
+        seat: 'aps',
+        creativeId: 'fictional-creative-id',
+        adomain: ['advertiser.example'],
+      },
+    ];
+
+    const result = auctionBidsToPrebidBids(auctionBids, [
+      { adUnitCode: 'div-aps', bidId: 'prebid-request-id' },
+    ]);
+
+    expect(result).toHaveLength(1);
+    expect(result[0]).toEqual(
+      expect.objectContaining({
+        requestId: 'prebid-request-id',
+        bidderCode: 'aps',
+        ad: '',
+        trustedServerRenderer: renderer,
+      })
+    );
+  });
+
   it('falls back to impid when no matching bidRequest found', () => {
     const auctionBids: AuctionBid[] = [
       {
@@ -209,6 +271,8 @@ describe('prebid/installPrebidNpm', () => {
     mockGetUserIdsAsEids.mockReturnValue([]);
     document.cookie = 'ts-eids=; Path=/; Max-Age=0';
     delete (window as any).__tsjs_prebid;
+    delete (window as any).tsjs;
+    delete (mockPbjs as any).__tsApsBidResponseListenerInstalled;
   });
 
   it('registers the trustedServer bid adapter', () => {
@@ -228,6 +292,73 @@ describe('prebid/installPrebidNpm', () => {
     );
   });
 
+  it('registers accepted APS descriptors under Prebid generated ad IDs', () => {
+    installPrebidNpm();
+
+    const bidResponseListener = mockOnEvent.mock.calls.find(
+      ([eventName]) => eventName === 'bidResponse'
+    )?.[1] as ((bid: Record<string, unknown>) => void) | undefined;
+    expect(bidResponseListener).toBeTypeOf('function');
+
+    const renderer = apsRenderer();
+    bidResponseListener!({
+      adapterCode: 'trustedServer',
+      bidderCode: 'aps',
+      adId: 'prebid-generated-ad-id',
+      adUnitCode: 'div-aps',
+      ttl: 300,
+      trustedServerRenderer: renderer,
+    });
+
+    const entry = (window as any).tsjs.apsPrebidRenderers['prebid-generated-ad-id'];
+    expect(entry).toEqual(
+      expect.objectContaining({
+        adUnitCode: 'div-aps',
+        renderer,
+        expiresAt: expect.any(Number),
+        markRendered: expect.any(Function),
+        markWinner: expect.any(Function),
+      })
+    );
+
+    entry.markWinner();
+    entry.markRendered();
+    expect(mockMarkWinner).toHaveBeenCalledWith(
+      expect.objectContaining({ adId: 'prebid-generated-ad-id' })
+    );
+    expect(mockMarkBidAsRendered).toHaveBeenCalledWith(
+      expect.objectContaining({ adId: 'prebid-generated-ad-id' })
+    );
+  });
+
+  it('does not register malformed or non-trusted APS renderer capabilities', () => {
+    installPrebidNpm();
+
+    const bidResponseListener = mockOnEvent.mock.calls.find(
+      ([eventName]) => eventName === 'bidResponse'
+    )?.[1] as ((bid: Record<string, unknown>) => void) | undefined;
+    const malformedBid: Record<string, unknown> = {
+      adapterCode: 'trustedServer',
+      bidderCode: 'aps',
+      adId: 'malformed-ad-id',
+      adUnitCode: 'div-aps',
+      ttl: 300,
+      trustedServerRenderer: { ...apsRenderer(), aaxResponse: 'invalid' },
+    };
+    bidResponseListener!(malformedBid);
+    bidResponseListener!({
+      adapterCode: 'publisherAdapter',
+      bidderCode: 'aps',
+      adId: 'foreign-ad-id',
+      adUnitCode: 'div-aps',
+      trustedServerRenderer: apsRenderer(),
+    });
+
+    expect((window as any).tsjs?.apsPrebidRenderers?.['malformed-ad-id']).toBeUndefined();
+    expect((window as any).tsjs?.apsPrebidRenderers?.['foreign-ad-id']).toBeUndefined();
+    expect(malformedBid).not.toHaveProperty('trustedServerRenderer');
+  });
+
   it('calls setConfig with debug=false by default', () => {
     installPrebidNpm();
 
diff --git a/crates/trusted-server-js/lib/vitest.config.ts b/crates/trusted-server-js/lib/vitest.config.ts
index 97d9d84c8..ad9452899 100644
--- a/crates/trusted-server-js/lib/vitest.config.ts
+++ b/crates/trusted-server-js/lib/vitest.config.ts
@@ -11,6 +11,10 @@ export default defineConfig({
         __dirname,
         'node_modules/prebid.js/dist/src/src/adapterManager.js'
       ),
+      'prebid.js/src/adRendering.js': path.resolve(
+        __dirname,
+        'node_modules/prebid.js/dist/src/src/adRendering.js'
+      ),
     },
   },
   test: {
diff --git a/docs/guide/integrations/aps.md b/docs/guide/integrations/aps.md
index 2b36cb253..fecde3323 100644
--- a/docs/guide/integrations/aps.md
+++ b/docs/guide/integrations/aps.md
@@ -12,7 +12,8 @@ The integration supports:
 - banner impressions;
 - APS OpenRTB requests to `https://web.ads.aps.amazon-adsystem.com/e/pb/bid`;
 - decoded-CPM winner selection with or without a mediator;
-- direct `/auction` rendering; and
+- direct `/auction` rendering;
+- client-side `trustedServer` Prebid adapter auctions through GAM; and
 - initial-navigation and page-bids rendering through GAM/Prebid Universal Creative.
 
 The integration does not implement:
@@ -137,7 +138,9 @@ The TSJS auction client validates the typed renderer descriptor, creates the opa
 
 For initial navigation and page-bids, Trusted Server publishes the same descriptor in `window.tsjs.bids`. The source-checked Prebid Universal Creative bridge accepts requests only from the iframe that owns the matching `hb_adid`, validates the complete envelope, and returns a static dynamic-renderer program that creates the same opaque renderer iframe.
 
-This path does not fetch PBS Cache, fire generic APS win/billing beacons, or call `apstag.setDisplayBids()` for the Trusted Server winner. Publisher-owned native APS objects are otherwise left untouched.
+For client-side `trustedServer` adapter auctions, Prebid generates its own `hb_adid`. Trusted Server binds that generated ID to the validated APS descriptor in a bounded, expiring browser registry before GAM refresh. The bridge verifies that the requesting Universal Creative iframe belongs to the same ad unit, consumes the capability once, and passes the APS bid ID separately to the Amazon runner.
+
+These paths do not fetch PBS Cache, fire generic APS win/billing beacons, or call `apstag.setDisplayBids()` for the Trusted Server winner. Publisher-owned native APS objects are otherwise left untouched.
 
 ## Publisher CSP
 
@@ -199,6 +202,7 @@ Use fictional values in source-controlled configuration and fixtures. Supply con
 - Confirm `GET /integrations/aps/renderer` returns HTML with its CSP and `Referrer-Policy: no-referrer`.
 - Confirm publisher CSP permits `frame-src 'self'`.
 - Confirm the GAM creative uses the supported Prebid Universal Creative bridge and the winning `hb_adid`.
+- For client-side `trustedServer` adapter auctions, confirm Prebid's `bidResponse` contains a generated `adId` and that the corresponding capability appears briefly in `window.tsjs.apsPrebidRenderers` before rendering.
 - Ensure no native APS path is trying to handle the same cohort.
 - Keep script creatives disabled while diagnosing iframe rendering.
 
diff --git a/scripts/integration-tests-browser.sh b/scripts/integration-tests-browser.sh
index ce5e64387..714de510b 100755
--- a/scripts/integration-tests-browser.sh
+++ b/scripts/integration-tests-browser.sh
@@ -18,6 +18,7 @@ cd "$REPO_ROOT"
 
 ORIGIN_PORT="${INTEGRATION_ORIGIN_PORT:-8888}"
 BROWSER_DIR="crates/trusted-server-integration-tests/browser"
+TSJS_LIB_DIR="crates/trusted-server-js/lib"
 NODE_VERSION="$(grep '^nodejs ' .tool-versions | awk '{print $2}')"
 
 if [ -z "$NODE_VERSION" ]; then
@@ -55,6 +56,14 @@ cd "$REPO_ROOT/$BROWSER_DIR"
 npm ci
 npx playwright install chromium
 
+# --- Build browser-side Trusted Server and external Prebid fixtures ---
+echo "==> Building TSJS browser fixtures..."
+cd "$REPO_ROOT/$TSJS_LIB_DIR"
+npm ci
+npm run build
+npm run build:prebid-external
+cd "$REPO_ROOT/$BROWSER_DIR"
+
 # --- Export env vars for global-setup.ts ---
 export WASM_BINARY_PATH="$REPO_ROOT/target/wasm32-wasip1/release/trusted-server-adapter-fastly.wasm"
 export INTEGRATION_ORIGIN_PORT="$ORIGIN_PORT"

From 7f448bceb7b5382250cb16474a0b983131c5cfc8 Mon Sep 17 00:00:00 2001
From: Christian <christianpavilonis@outlook.com>
Date: Fri, 17 Jul 2026 12:26:58 -0500
Subject: [PATCH 5/5] Add APS auction debug metadata

---
 CHANGELOG.md                                  |   1 +
 .../src/auction/formats.rs                    |  41 ++
 .../src/auction/orchestrator.rs               | 158 +++++++-
 .../src/integrations/aps.rs                   | 354 +++++++++++++++++-
 docs/guide/auction-orchestration.md           |  18 +-
 docs/guide/configuration.md                   |   2 +
 docs/guide/integrations/aps.md                |  39 +-
 ...-openrtb-first-class-integration-design.md |  13 +-
 trusted-server.example.toml                   |   2 +
 9 files changed, 586 insertions(+), 42 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6ab91d4f3..7b4537704 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,6 +21,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Added opt-in APS HTTP debug metadata for controlled test sites, exposing the direct request and response under `/auction` provider metadata using the Prebid Server `debug.httpcalls` shape.
 - Added typed APS renderer transport for direct auctions and GAM/Prebid Universal Creative, using a minimized one-bid envelope, a fragment-bound nonce, and an opaque sandboxed renderer endpoint.
 - Added Osano consent mirror integration docs and public enablement guidance.
 - Implemented basic authentication for configurable endpoint paths (#73)
diff --git a/crates/trusted-server-core/src/auction/formats.rs b/crates/trusted-server-core/src/auction/formats.rs
index 63f777a19..b1f9f4b35 100644
--- a/crates/trusted-server-core/src/auction/formats.rs
+++ b/crates/trusted-server-core/src/auction/formats.rs
@@ -1022,6 +1022,47 @@ mod tests {
         );
     }
 
+    #[test]
+    fn convert_to_openrtb_response_preserves_aps_debug_metadata() {
+        let settings = make_settings();
+        let auction_request = make_auction_request();
+        let bid = make_bid("div-gpt-top", "aps", Some(2.75));
+        let debug = json!({
+            "httpcalls": {
+                "aps": [{
+                    "requestbody": "{\"id\":\"fictional-auction\"}",
+                    "requestheaders": {"content-type": ["application/json"]},
+                    "responsebody": "{\"seatbid\":[]}",
+                    "responseheaders": {"content-type": ["application/json"]},
+                    "status": 200,
+                    "uri": "https://aps.example/openrtb"
+                }]
+            }
+        });
+        let result = OrchestrationResult {
+            provider_responses: vec![AuctionResponse {
+                provider: "aps".to_string(),
+                bids: vec![bid.clone()],
+                status: BidStatus::Success,
+                response_time_ms: 42,
+                metadata: HashMap::from([("debug".to_string(), debug.clone())]),
+            }],
+            mediator_response: None,
+            winning_bids: HashMap::from([(bid.slot_id.clone(), bid)]),
+            total_time_ms: 50,
+            metadata: HashMap::new(),
+        };
+
+        let response = convert_to_openrtb_response(&result, &settings, &auction_request, false)
+            .expect("should convert APS response with debug metadata");
+        let json = response_json(response);
+
+        assert_eq!(
+            json["ext"]["orchestrator"]["provider_details"][0]["metadata"]["debug"], debug,
+            "should preserve APS debug metadata in the auction response"
+        );
+    }
+
     #[test]
     fn convert_to_openrtb_response_rejects_winner_without_render_source() {
         let settings = make_settings();
diff --git a/crates/trusted-server-core/src/auction/orchestrator.rs b/crates/trusted-server-core/src/auction/orchestrator.rs
index 09fadf666..9ff68e328 100644
--- a/crates/trusted-server-core/src/auction/orchestrator.rs
+++ b/crates/trusted-server-core/src/auction/orchestrator.rs
@@ -1,6 +1,8 @@
 //! Auction orchestrator for managing multi-provider auctions.
 
+use edgezero_core::body::Body as EdgeBody;
 use error_stack::{Report, ResultExt};
+use http::Request;
 use std::collections::HashMap;
 use std::sync::Arc;
 use std::time::Duration;
@@ -23,11 +25,12 @@ use super::types::{AuctionContext, AuctionRequest, AuctionResponse, Bid, BidStat
 /// TTFB ≈ auction timeout.
 pub struct DispatchedAuction {
     pending_requests: Vec<PlatformPendingRequest>,
-    backend_to_provider: HashMap<String, (String, Instant, Arc<dyn AuctionProvider>)>,
+    backend_to_provider: HashMap<String, (String, Instant, Arc<dyn AuctionProvider>, u32)>,
     launch_responses: Vec<AuctionResponse>,
     auction_start: Instant,
     timeout_ms: u32,
     floor_prices: HashMap<String, f64>,
+    provider_request_context: Box<Request<EdgeBody>>,
     /// Carried so the mediator call in collect can pass it as the auction request.
     request: AuctionRequest,
 }
@@ -64,7 +67,7 @@ impl DispatchedAuction {
         let abandoned = self
             .backend_to_provider
             .into_values()
-            .map(|(provider_name, start_time, _)| {
+            .map(|(provider_name, start_time, _, _)| {
                 AbandonedProviderCall::bidder(
                     provider_name,
                     Some(u32::try_from(start_time.elapsed().as_millis()).unwrap_or(u32::MAX)),
@@ -85,6 +88,7 @@ impl DispatchedAuction {
             auction_start: Instant::now(),
             timeout_ms,
             floor_prices: HashMap::new(),
+            provider_request_context: Box::new(Request::new(EdgeBody::empty())),
             request,
         }
     }
@@ -157,6 +161,15 @@ fn remaining_budget_ms(start: Instant, timeout_ms: u32) -> u32 {
     timeout_ms.saturating_sub(elapsed)
 }
 
+fn snapshot_context_request(request: &Request<EdgeBody>) -> Request<EdgeBody> {
+    let mut snapshot = Request::new(EdgeBody::empty());
+    *snapshot.method_mut() = request.method().clone();
+    *snapshot.uri_mut() = request.uri().clone();
+    *snapshot.version_mut() = request.version();
+    *snapshot.headers_mut() = request.headers().clone();
+    snapshot
+}
+
 /// Manages auction execution across multiple providers.
 pub struct AuctionOrchestrator {
     config: AuctionConfig,
@@ -438,8 +451,8 @@ impl AuctionOrchestrator {
         let auction_start = Instant::now();
 
         // Phase 1: Launch all requests concurrently and build mapping
-        // Maps backend_name -> (provider_name, start_time, provider)
-        let mut backend_to_provider: HashMap<String, (&str, Instant, &dyn AuctionProvider)> =
+        // Maps backend_name to provider state retained for response parsing.
+        let mut backend_to_provider: HashMap<String, (&str, Instant, &dyn AuctionProvider, u32)> =
             HashMap::new();
         let mut pending_requests: Vec<crate::platform::PlatformPendingRequest> = Vec::new();
         let mut responses = Vec::new();
@@ -519,7 +532,12 @@ impl AuctionOrchestrator {
                         });
                     backend_to_provider.insert(
                         request_backend_name.clone(),
-                        (provider.provider_name(), start_time, provider.as_ref()),
+                        (
+                            provider.provider_name(),
+                            start_time,
+                            provider.as_ref(),
+                            effective_timeout,
+                        ),
                     );
                     pending_requests.push(pending);
                     log::debug!(
@@ -592,10 +610,17 @@ impl AuctionOrchestrator {
                         .unwrap_or_default()
                         .to_string();
 
-                    if let Some((provider_name, start_time, provider)) =
+                    if let Some((provider_name, start_time, provider, effective_timeout)) =
                         backend_to_provider.remove(&backend_name)
                     {
                         let response_time_ms = start_time.elapsed().as_millis() as u64;
+                        let provider_context = AuctionContext {
+                            settings: context.settings,
+                            request: context.request,
+                            timeout_ms: effective_timeout,
+                            provider_responses: context.provider_responses,
+                            services: context.services,
+                        };
 
                         // Use the context-aware parse so a provider overriding
                         // `parse_response_with_context` behaves identically on the
@@ -606,7 +631,7 @@ impl AuctionOrchestrator {
                                 response,
                                 response_time_ms,
                                 request,
-                                context,
+                                &provider_context,
                             )
                             .await
                         {
@@ -645,7 +670,7 @@ impl AuctionOrchestrator {
                 }
                 Err(e) => {
                     if let Some(ref backend_name) = failed_backend_name {
-                        if let Some((provider_name, start_time, _)) =
+                        if let Some((provider_name, start_time, _, _)) =
                             backend_to_provider.remove(backend_name)
                         {
                             let response_time_ms = start_time.elapsed().as_millis() as u64;
@@ -682,7 +707,7 @@ impl AuctionOrchestrator {
             }
         }
 
-        for (provider_name, start_time, _) in backend_to_provider.into_values() {
+        for (provider_name, start_time, _, _) in backend_to_provider.into_values() {
             let response_time_ms = start_time.elapsed().as_millis() as u64;
             log::warn!("Provider '{provider_name}' timed out before auction collection completed");
             responses.push(provider_timeout_response(provider_name, response_time_ms));
@@ -844,8 +869,10 @@ impl AuctionOrchestrator {
         }
 
         let auction_start = Instant::now();
-        let mut backend_to_provider: HashMap<String, (String, Instant, Arc<dyn AuctionProvider>)> =
-            HashMap::new();
+        let mut backend_to_provider: HashMap<
+            String,
+            (String, Instant, Arc<dyn AuctionProvider>, u32),
+        > = HashMap::new();
         let mut pending_requests: Vec<PlatformPendingRequest> = Vec::new();
         let mut launch_responses: Vec<AuctionResponse> = Vec::new();
 
@@ -914,6 +941,7 @@ impl AuctionOrchestrator {
                             provider.provider_name().to_string(),
                             start_time,
                             Arc::clone(provider),
+                            effective_timeout,
                         ),
                     );
                     pending_requests.push(pending.with_backend_name(backend_name));
@@ -958,6 +986,7 @@ impl AuctionOrchestrator {
             auction_start,
             timeout_ms: context.timeout_ms,
             floor_prices: self.floor_prices_by_slot(request),
+            provider_request_context: Box::new(snapshot_context_request(context.request)),
             request: request.clone(),
         })
     }
@@ -985,6 +1014,7 @@ impl AuctionOrchestrator {
             auction_start,
             timeout_ms,
             floor_prices,
+            provider_request_context,
             request,
         } = dispatched;
 
@@ -1024,10 +1054,17 @@ impl AuctionOrchestrator {
             match ready {
                 Ok(platform_response) => {
                     let backend_name = platform_response.backend_name.clone().unwrap_or_default();
-                    if let Some((provider_name, start_time, provider)) =
+                    if let Some((provider_name, start_time, provider, effective_timeout)) =
                         backend_to_provider.remove(&backend_name)
                     {
                         let response_time_ms = start_time.elapsed().as_millis() as u64;
+                        let provider_context = AuctionContext {
+                            settings: context.settings,
+                            request: &provider_request_context,
+                            timeout_ms: effective_timeout,
+                            provider_responses: context.provider_responses,
+                            services: context.services,
+                        };
                         // Mirror run_providers_parallel: use the context-aware
                         // parse so providers behave identically on both paths.
                         match provider
@@ -1035,7 +1072,7 @@ impl AuctionOrchestrator {
                                 platform_response,
                                 response_time_ms,
                                 &request,
-                                context,
+                                &provider_context,
                             )
                             .await
                         {
@@ -1072,7 +1109,7 @@ impl AuctionOrchestrator {
                     // the provider behind `failed_backend_name` so it appears in
                     // provider_details instead of vanishing.
                     if let Some(ref backend_name) = failed_backend_name {
-                        if let Some((provider_name, start_time, _)) =
+                        if let Some((provider_name, start_time, _, _)) =
                             backend_to_provider.remove(backend_name)
                         {
                             let response_time_ms = start_time.elapsed().as_millis() as u64;
@@ -1106,7 +1143,7 @@ impl AuctionOrchestrator {
             // `remaining_budget_ms`.
         }
 
-        for (provider_name, start_time, _) in backend_to_provider.values() {
+        for (provider_name, start_time, _, _) in backend_to_provider.values() {
             let response_time_ms = start_time.elapsed().as_millis() as u64;
             log::warn!(
                 "Provider '{provider_name}' timed out before dispatched auction collection completed"
@@ -1382,8 +1419,27 @@ mod tests {
             ))
         }
 
+        async fn parse_response_with_context(
+            &self,
+            response: PlatformResponse,
+            response_time_ms: u64,
+            _request: &AuctionRequest,
+            context: &AuctionContext<'_>,
+        ) -> Result<AuctionResponse, Report<TrustedServerError>> {
+            let referer = context
+                .request
+                .headers()
+                .get(http::header::REFERER)
+                .and_then(|value| value.to_str().ok());
+            Ok(self
+                .parse_response(response, response_time_ms)
+                .await?
+                .with_metadata("context_referer", serde_json::json!(referer))
+                .with_metadata("context_timeout_ms", serde_json::json!(context.timeout_ms)))
+        }
+
         fn timeout_ms(&self) -> u32 {
-            2000
+            125
         }
 
         fn backend_name(&self, _services: &RuntimeServices, _timeout_ms: u32) -> Option<String> {
@@ -2052,6 +2108,76 @@ mod tests {
         });
     }
 
+    #[test]
+    fn dispatched_collection_reuses_provider_launch_context() {
+        futures::executor::block_on(async {
+            let stub = Arc::new(StubHttpClient::new());
+            stub.push_response(200, b"{}".to_vec());
+            let services = build_services_with_http_client(stub);
+            let config = AuctionConfig {
+                enabled: true,
+                providers: vec!["provider-a".to_string()],
+                timeout_ms: 750,
+                mediator: None,
+                ..Default::default()
+            };
+            let mut orchestrator = AuctionOrchestrator::new(config);
+            orchestrator.register_provider(Arc::new(StubAuctionProvider {
+                name: "provider-a",
+                backend: "backend-a",
+            }));
+            let request = create_test_auction_request();
+            let settings = create_test_settings();
+            let downstream = http::Request::builder()
+                .uri("https://publisher.example/article")
+                .header(http::header::REFERER, "https://referrer.example/source")
+                .body(edgezero_core::body::Body::empty())
+                .expect("should build downstream request");
+            let dispatch_context = AuctionContext {
+                settings: &settings,
+                request: &downstream,
+                timeout_ms: 750,
+                provider_responses: None,
+                services: &services,
+            };
+            let dispatched = match orchestrator
+                .dispatch_auction(&request, &dispatch_context)
+                .await
+            {
+                DispatchAuctionOutcome::Dispatched(dispatched) => dispatched,
+                _ => panic!("should dispatch provider request"),
+            };
+            let placeholder = http::Request::builder()
+                .uri("https://placeholder.invalid/")
+                .body(edgezero_core::body::Body::empty())
+                .expect("should build placeholder request");
+            let collect_context = AuctionContext {
+                settings: &settings,
+                request: &placeholder,
+                timeout_ms: 750,
+                provider_responses: None,
+                services: &services,
+            };
+
+            let result = orchestrator
+                .collect_dispatched_auction(dispatched, &services, &collect_context)
+                .await;
+
+            let response = result
+                .provider_responses
+                .first()
+                .expect("should collect provider response");
+            assert_eq!(
+                response.metadata["context_referer"], "https://referrer.example/source",
+                "should parse with the downstream request used at launch"
+            );
+            assert_eq!(
+                response.metadata["context_timeout_ms"], 125,
+                "should parse with the provider-capped launch timeout"
+            );
+        });
+    }
+
     #[test]
     fn rejects_multi_provider_fanout_before_launch_on_sequential_platform() {
         futures::executor::block_on(async {
diff --git a/crates/trusted-server-core/src/integrations/aps.rs b/crates/trusted-server-core/src/integrations/aps.rs
index f32fa9012..4e2facef4 100644
--- a/crates/trusted-server-core/src/integrations/aps.rs
+++ b/crates/trusted-server-core/src/integrations/aps.rs
@@ -8,7 +8,7 @@ use async_trait::async_trait;
 use base64::{Engine as _, engine::general_purpose::STANDARD as BASE64_STANDARD};
 use edgezero_core::body::Body as EdgeBody;
 use error_stack::{Report, ResultExt};
-use http::{Method, StatusCode, header};
+use http::{HeaderMap, Method, StatusCode, header};
 use serde::de::{self, Visitor};
 use serde::{Deserialize, Serialize};
 use serde_json::{Value as Json, json};
@@ -129,6 +129,9 @@ pub struct ApsConfig {
     /// Timeout in milliseconds.
     #[serde(default = "default_timeout_ms")]
     pub timeout_ms: u32,
+    /// Whether to include the APS HTTP exchange in auction response metadata.
+    #[serde(default)]
+    pub debug: bool,
     /// Whether APS script creatives are eligible before winner selection.
     #[serde(default)]
     pub allow_script_creatives: bool,
@@ -297,6 +300,7 @@ impl Default for ApsConfig {
             account_id: String::new(),
             endpoint: default_endpoint(),
             timeout_ms: default_timeout_ms(),
+            debug: false,
             allow_script_creatives: false,
             inventory_domain: None,
             inventory_page_origin: None,
@@ -334,6 +338,11 @@ struct ApsRendererInput<'a> {
     height: u32,
 }
 
+struct ApsDebugRequest {
+    body: String,
+    headers: BTreeMap<String, Vec<String>>,
+}
+
 /// APS `OpenRTB` auction provider.
 pub struct ApsAuctionProvider {
     config: ApsConfig,
@@ -557,6 +566,78 @@ impl ApsAuctionProvider {
         }
     }
 
+    fn serialize_openrtb_request(
+        request: &OpenRtbRequest,
+    ) -> Result<Vec<u8>, Report<TrustedServerError>> {
+        serde_json::to_vec(request).change_context(TrustedServerError::Auction {
+            message: "Failed to serialize APS OpenRTB request".to_string(),
+        })
+    }
+
+    fn debug_headers(headers: &HeaderMap) -> BTreeMap<String, Vec<String>> {
+        let mut values = BTreeMap::<String, Vec<String>>::new();
+        for (name, value) in headers {
+            let Ok(value) = value.to_str() else {
+                continue;
+            };
+            values
+                .entry(name.as_str().to_string())
+                .or_default()
+                .push(value.to_string());
+        }
+        values
+    }
+
+    fn debug_request(
+        &self,
+        request: &AuctionRequest,
+        context: &AuctionContext<'_>,
+    ) -> Result<ApsDebugRequest, Report<TrustedServerError>> {
+        let openrtb = self.build_openrtb_request(request, context);
+        let body = Self::serialize_openrtb_request(&openrtb)?;
+        Ok(ApsDebugRequest {
+            body: String::from_utf8_lossy(&body).into_owned(),
+            headers: BTreeMap::from([(
+                header::CONTENT_TYPE.as_str().to_string(),
+                vec!["application/json".to_string()],
+            )]),
+        })
+    }
+
+    fn attach_debug_metadata(
+        &self,
+        response: AuctionResponse,
+        request: Option<ApsDebugRequest>,
+        response_body: Option<&[u8]>,
+        response_headers: &BTreeMap<String, Vec<String>>,
+        status: StatusCode,
+    ) -> AuctionResponse {
+        let Some(request) = request else {
+            return response;
+        };
+        let mut http_call = json!({
+            "requestbody": request.body,
+            "requestheaders": request.headers,
+            "responseheaders": response_headers,
+            "status": status.as_u16(),
+            "uri": self.config.endpoint.clone(),
+        });
+        if let (Some(response_body), Some(http_call)) = (response_body, http_call.as_object_mut()) {
+            http_call.insert(
+                "responsebody".to_string(),
+                json!(String::from_utf8_lossy(response_body)),
+            );
+        }
+        response.with_metadata(
+            "debug",
+            json!({
+                "httpcalls": {
+                    (APS_INTEGRATION_ID): [http_call]
+                }
+            }),
+        )
+    }
+
     fn compatible_dimensions(slot: &AdSlot, width: u32, height: u32) -> bool {
         width > 0
             && height > 0
@@ -828,17 +909,49 @@ impl ApsAuctionProvider {
         response: PlatformResponse,
         response_time_ms: u64,
         request: Option<&AuctionRequest>,
+        debug_request: Option<ApsDebugRequest>,
     ) -> Result<AuctionResponse, Report<TrustedServerError>> {
         let response = response.response;
-        if response.status() == StatusCode::NO_CONTENT {
-            return Ok(AuctionResponse::no_bid(
-                APS_INTEGRATION_ID,
-                response_time_ms,
+        let status = response.status();
+        let response_headers = debug_request
+            .as_ref()
+            .map_or_else(BTreeMap::new, |_| Self::debug_headers(response.headers()));
+
+        if status == StatusCode::NO_CONTENT {
+            return Ok(self.attach_debug_metadata(
+                AuctionResponse::no_bid(APS_INTEGRATION_ID, response_time_ms),
+                debug_request,
+                Some(&[]),
+                &response_headers,
+                status,
             ));
         }
-        if !response.status().is_success() {
+        if !status.is_success() {
             log::warn!("APS returns a non-success status");
-            return Ok(AuctionResponse::error(APS_INTEGRATION_ID, response_time_ms));
+            let body = if debug_request.is_some() {
+                match collect_response_bounded(
+                    response.into_body(),
+                    UPSTREAM_RTB_MAX_RESPONSE_BYTES,
+                    APS_INTEGRATION_ID,
+                )
+                .await
+                {
+                    Ok(body) => Some(body),
+                    Err(error) => {
+                        log::warn!("Failed to read APS debug response body: {error:?}");
+                        None
+                    }
+                }
+            } else {
+                None
+            };
+            return Ok(self.attach_debug_metadata(
+                AuctionResponse::error(APS_INTEGRATION_ID, response_time_ms),
+                debug_request,
+                body.as_deref(),
+                &response_headers,
+                status,
+            ));
         }
         let body = collect_response_bounded(
             response.into_body(),
@@ -854,8 +967,15 @@ impl ApsAuctionProvider {
             Ok(value) => value,
             Err(error) => {
                 log::warn!("Failed to parse APS response JSON: {error}");
-                return Ok(AuctionResponse::error(APS_INTEGRATION_ID, response_time_ms)
-                    .with_metadata("drop_reasons", json!({"unexpected_response_shape": 1})));
+                let parsed = AuctionResponse::error(APS_INTEGRATION_ID, response_time_ms)
+                    .with_metadata("drop_reasons", json!({"unexpected_response_shape": 1}));
+                return Ok(self.attach_debug_metadata(
+                    parsed,
+                    debug_request,
+                    Some(&body),
+                    &response_headers,
+                    status,
+                ));
             }
         };
         let Some(request) = request else {
@@ -867,7 +987,13 @@ impl ApsAuctionProvider {
             parsed.bids.len(),
             response_time_ms
         );
-        Ok(parsed)
+        Ok(self.attach_debug_metadata(
+            parsed,
+            debug_request,
+            Some(&body),
+            &response_headers,
+            status,
+        ))
     }
 }
 
@@ -890,9 +1016,7 @@ impl AuctionProvider for ApsAuctionProvider {
         }
         log::info!("APS requests bids for {} impressions", openrtb.imp.len());
         log::trace!("APS request body: {openrtb:?}");
-        let body = serde_json::to_vec(&openrtb).change_context(TrustedServerError::Auction {
-            message: "Failed to serialize APS OpenRTB request".to_string(),
-        })?;
+        let body = Self::serialize_openrtb_request(&openrtb)?;
         let request = http::Request::builder()
             .method(Method::POST)
             .uri(&self.config.endpoint)
@@ -925,7 +1049,7 @@ impl AuctionProvider for ApsAuctionProvider {
         response: PlatformResponse,
         response_time_ms: u64,
     ) -> Result<AuctionResponse, Report<TrustedServerError>> {
-        self.parse_response_inner(response, response_time_ms, None)
+        self.parse_response_inner(response, response_time_ms, None, None)
             .await
     }
 
@@ -934,9 +1058,20 @@ impl AuctionProvider for ApsAuctionProvider {
         response: PlatformResponse,
         response_time_ms: u64,
         request: &AuctionRequest,
-        _context: &AuctionContext<'_>,
+        context: &AuctionContext<'_>,
     ) -> Result<AuctionResponse, Report<TrustedServerError>> {
-        self.parse_response_inner(response, response_time_ms, Some(request))
+        let debug_request = if self.config.debug {
+            match self.debug_request(request, context) {
+                Ok(debug_request) => Some(debug_request),
+                Err(error) => {
+                    log::warn!("Failed to build APS debug request metadata: {error:?}");
+                    None
+                }
+            }
+        } else {
+            None
+        };
+        self.parse_response_inner(response, response_time_ms, Some(request), debug_request)
             .await
     }
 
@@ -1061,6 +1196,7 @@ mod tests {
             account_id: "example-account-id".to_string(),
             endpoint: default_endpoint(),
             timeout_ms: 800,
+            debug: false,
             allow_script_creatives: false,
             inventory_domain: None,
             inventory_page_origin: None,
@@ -1115,6 +1251,32 @@ mod tests {
         })
     }
 
+    fn parse_with_context(
+        provider: &ApsAuctionProvider,
+        response: PlatformResponse,
+    ) -> AuctionResponse {
+        let settings = create_test_settings();
+        let services = noop_services();
+        let downstream = http::Request::builder()
+            .uri("https://publisher.example/auction")
+            .body(EdgeBody::empty())
+            .expect("should build downstream request");
+        let context = AuctionContext {
+            settings: &settings,
+            request: &downstream,
+            timeout_ms: 321,
+            provider_responses: None,
+            services: &services,
+        };
+        futures::executor::block_on(provider.parse_response_with_context(
+            response,
+            12,
+            &request(),
+            &context,
+        ))
+        .expect("should parse APS response with context")
+    }
+
     #[test]
     fn config_accepts_canonical_alias_and_integer_ids() {
         let canonical: ApsConfig = serde_json::from_value(json!({
@@ -1123,9 +1285,16 @@ mod tests {
         .expect("should parse canonical account ID");
         let alias: ApsConfig =
             serde_json::from_value(json!({"pub_id": 1234})).expect("should parse legacy alias");
+        let debug: ApsConfig = serde_json::from_value(json!({
+            "account_id": "example-account",
+            "debug": true
+        }))
+        .expect("should parse debug flag");
         assert_eq!(canonical.account_id, "example-account");
         assert_eq!(alias.account_id, "1234");
         assert!(!canonical.enabled);
+        assert!(!canonical.debug);
+        assert!(debug.debug);
         assert!(!canonical.allow_script_creatives);
         assert!(canonical.endpoint.ends_with("/e/pb/bid"));
     }
@@ -1444,6 +1613,157 @@ mod tests {
         }
     }
 
+    #[test]
+    fn debug_metadata_matches_pbs_httpcalls_shape() {
+        let mut provider_config = config();
+        provider_config.debug = true;
+        provider_config.endpoint = "https://aps.example/openrtb".to_string();
+        let provider = ApsAuctionProvider::new(provider_config);
+        let response_body = serde_json::to_vec(&json!({
+            "cur": "USD",
+            "seatbid": [{"bid": [bid("fictional-debug-bid", 1.23, "iframe")]}]
+        }))
+        .expect("should serialize APS response fixture");
+        let platform_response = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::OK)
+                .header(header::CONTENT_TYPE, "application/json")
+                .header("x-example-debug", "first")
+                .header("x-example-debug", "second")
+                .body(EdgeBody::from(response_body.clone()))
+                .expect("should build APS response"),
+        );
+
+        let response = parse_with_context(&provider, platform_response);
+
+        assert_eq!(response.metadata["accepted_bid_count"], 1);
+        let call = &response.metadata["debug"]["httpcalls"]["aps"][0];
+        let request_body: Json = serde_json::from_str(
+            call["requestbody"]
+                .as_str()
+                .expect("should include request body as a string"),
+        )
+        .expect("should parse captured request body");
+        assert_eq!(request_body["id"], "fictional-auction");
+        assert_eq!(request_body["tmax"], 321);
+        assert_eq!(
+            call["requestheaders"]["content-type"],
+            json!(["application/json"])
+        );
+        assert_eq!(
+            call["responsebody"],
+            String::from_utf8_lossy(&response_body).as_ref()
+        );
+        assert_eq!(
+            call["responseheaders"]["content-type"],
+            json!(["application/json"])
+        );
+        assert_eq!(
+            call["responseheaders"]["x-example-debug"],
+            json!(["first", "second"])
+        );
+        assert_eq!(call["status"], 200);
+        assert_eq!(call["uri"], "https://aps.example/openrtb");
+    }
+
+    #[test]
+    fn disabled_debug_omits_httpcall_metadata() {
+        let provider = ApsAuctionProvider::new(config());
+        let platform_response = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::OK)
+                .body(EdgeBody::from(
+                    serde_json::to_vec(&json!({"seatbid": []}))
+                        .expect("should serialize APS no-bid response"),
+                ))
+                .expect("should build APS response"),
+        );
+
+        let response = parse_with_context(&provider, platform_response);
+
+        assert!(!response.metadata.contains_key("debug"));
+        assert_eq!(response.metadata["drop_reasons"]["empty_seatbid"], 1);
+    }
+
+    #[test]
+    fn debug_metadata_preserves_malformed_and_error_responses() {
+        let mut provider_config = config();
+        provider_config.debug = true;
+        let provider = ApsAuctionProvider::new(provider_config);
+        let malformed = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::OK)
+                .body(EdgeBody::from(b"{not-json".to_vec()))
+                .expect("should build malformed APS response"),
+        );
+        let unavailable = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::SERVICE_UNAVAILABLE)
+                .header("retry-after", "5")
+                .body(EdgeBody::from(b"temporarily unavailable".to_vec()))
+                .expect("should build unavailable APS response"),
+        );
+        let oversized = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::BAD_GATEWAY)
+                .body(EdgeBody::from(vec![
+                    b'x';
+                    UPSTREAM_RTB_MAX_RESPONSE_BYTES + 1
+                ]))
+                .expect("should build oversized APS response"),
+        );
+
+        let malformed = parse_with_context(&provider, malformed);
+        let unavailable = parse_with_context(&provider, unavailable);
+        let oversized = parse_with_context(&provider, oversized);
+
+        assert_eq!(
+            malformed.metadata["drop_reasons"]["unexpected_response_shape"],
+            1
+        );
+        assert_eq!(
+            malformed.metadata["debug"]["httpcalls"]["aps"][0]["responsebody"],
+            "{not-json"
+        );
+        let unavailable_call = &unavailable.metadata["debug"]["httpcalls"]["aps"][0];
+        assert_eq!(unavailable.status, BidStatus::Error);
+        assert_eq!(unavailable_call["status"], 503);
+        assert_eq!(unavailable_call["responsebody"], "temporarily unavailable");
+        assert_eq!(
+            unavailable_call["responseheaders"]["retry-after"],
+            json!(["5"])
+        );
+        let oversized_call = oversized.metadata["debug"]["httpcalls"]["aps"][0]
+            .as_object()
+            .expect("should include oversized HTTP call metadata");
+        assert_eq!(oversized.status, BidStatus::Error);
+        assert_eq!(oversized_call["status"], 502);
+        assert!(
+            !oversized_call.contains_key("responsebody"),
+            "should omit response body when bounded capture fails"
+        );
+    }
+
+    #[test]
+    fn debug_metadata_includes_no_content_response() {
+        let mut provider_config = config();
+        provider_config.debug = true;
+        let provider = ApsAuctionProvider::new(provider_config);
+        let platform_response = PlatformResponse::new(
+            edgezero_core::http::response_builder()
+                .status(StatusCode::NO_CONTENT)
+                .body(EdgeBody::empty())
+                .expect("should build empty APS response"),
+        );
+
+        let response = parse_with_context(&provider, platform_response);
+
+        assert_eq!(response.status, BidStatus::NoBid);
+        let call = &response.metadata["debug"]["httpcalls"]["aps"][0];
+        assert_eq!(call["status"], 204);
+        assert_eq!(call["responsebody"], "");
+    }
+
     #[test]
     fn malformed_json_is_a_safe_shape_error() {
         let provider = ApsAuctionProvider::new(config());
@@ -1458,6 +1778,7 @@ mod tests {
             platform_response,
             12,
             Some(&auction_request),
+            None,
         ))
         .expect("should convert malformed JSON into a safe auction response");
 
@@ -1482,6 +1803,7 @@ mod tests {
             platform_response,
             12,
             Some(&auction_request),
+            None,
         ))
         .expect("should parse 204 as no bid");
         assert_eq!(no_content.status, BidStatus::NoBid);
diff --git a/docs/guide/auction-orchestration.md b/docs/guide/auction-orchestration.md
index 818c17d99..0641e73ca 100644
--- a/docs/guide/auction-orchestration.md
+++ b/docs/guide/auction-orchestration.md
@@ -362,6 +362,7 @@ enabled = true
 account_id = "example-account"
 endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
 timeout_ms = 800
+debug = false
 allow_script_creatives = false
 ```
 
@@ -586,6 +587,7 @@ enabled = true
 account_id = "example-account"
 endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
 timeout_ms = 800
+debug = false
 allow_script_creatives = false
 
 [integrations.adserver_mock]
@@ -620,13 +622,14 @@ price_floor = 0.50
 
 #### `[integrations.aps]`
 
-| Field                    | Type   | Default                                            | Description                                      |
-| ------------------------ | ------ | -------------------------------------------------- | ------------------------------------------------ |
-| `enabled`                | bool   | `false`                                            | Enable APS provider                              |
-| `account_id`             | string | —                                                  | APS account ID (required; `pub_id` is an alias)  |
-| `endpoint`               | string | `https://web.ads.aps.amazon-adsystem.com/e/pb/bid` | APS OpenRTB endpoint                             |
-| `timeout_ms`             | u32    | `800`                                              | Request timeout                                  |
-| `allow_script_creatives` | bool   | `false`                                            | Admit script bids before APS candidate reduction |
+| Field                    | Type   | Default                                            | Description                                                       |
+| ------------------------ | ------ | -------------------------------------------------- | ----------------------------------------------------------------- |
+| `enabled`                | bool   | `false`                                            | Enable APS provider                                               |
+| `account_id`             | string | —                                                  | APS account ID (required; `pub_id` is an alias)                   |
+| `endpoint`               | string | `https://web.ads.aps.amazon-adsystem.com/e/pb/bid` | APS OpenRTB endpoint                                              |
+| `timeout_ms`             | u32    | `800`                                              | Request timeout                                                   |
+| `debug`                  | bool   | `false`                                            | Include the raw APS HTTP exchange in `/auction` provider metadata |
+| `allow_script_creatives` | bool   | `false`                                            | Admit script bids before APS candidate reduction                  |
 
 #### `[integrations.adserver_mock]`
 
@@ -666,6 +669,7 @@ TRUSTED_SERVER__AUCTION__MEDIATOR=adserver_mock
 TRUSTED_SERVER__AUCTION__TIMEOUT_MS=2000
 TRUSTED_SERVER__INTEGRATIONS__PREBID__SERVER_URL=https://pbs.example.com
 TRUSTED_SERVER__INTEGRATIONS__APS__ACCOUNT_ID=example-account
+TRUSTED_SERVER__INTEGRATIONS__APS__DEBUG=false
 ```
 
 ## Floor Prices
diff --git a/docs/guide/configuration.md b/docs/guide/configuration.md
index 6e404a1f0..6becc6052 100644
--- a/docs/guide/configuration.md
+++ b/docs/guide/configuration.md
@@ -1211,6 +1211,7 @@ timeout_ms = 2000
 enabled = true
 account_id = "example-account"
 endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
+debug = false
 # Optional pair for deployments hosted away from APS-authorized inventory.
 # inventory_domain = "publisher.example"
 # inventory_page_origin = "https://www.publisher.example"
@@ -1231,6 +1232,7 @@ TRUSTED_SERVER__AUCTION__PROVIDERS__1=prebid
 TRUSTED_SERVER__AUCTION__MEDIATOR=adserver_mock
 TRUSTED_SERVER__AUCTION__TIMEOUT_MS=2000
 TRUSTED_SERVER__AUCTION__CREATIVE_STORE=creative_store
+TRUSTED_SERVER__INTEGRATIONS__APS__DEBUG=false
 ```
 
 ## Fastly Runtime Config Store
diff --git a/docs/guide/integrations/aps.md b/docs/guide/integrations/aps.md
index fecde3323..4a3479870 100644
--- a/docs/guide/integrations/aps.md
+++ b/docs/guide/integrations/aps.md
@@ -31,6 +31,8 @@ enabled = true
 account_id = "example-aps-account-id"
 endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
 timeout_ms = 800
+# Include raw APS request/response data in /auction metadata on test sites only.
+debug = false
 # Set both when the deployment hostname differs from APS-authorized inventory.
 # inventory_domain = "publisher.example"
 # inventory_page_origin = "https://www.publisher.example"
@@ -44,6 +46,8 @@ timeout_ms = 2000
 
 `account_id` is the canonical field. `pub_id` remains a compatibility alias for migration, including integer values, but new configuration should not use it. Supplying both names is an error.
 
+`debug` defaults to `false`. Enable it only on controlled test sites because it includes the raw APS request and response, including identity, consent, device, page, account, bid, and creative data, in the client-visible `/auction` response.
+
 `allow_script_creatives` defaults to `false`. While disabled, APS script bids are rejected before per-impression reduction, floors, mediation, and winner selection. Enable it only for a controlled cohort after the browser-security checks in [Rollout](#rollout) pass.
 
 Set `inventory_domain` and `inventory_page_origin` together only when the public deployment hostname differs from the inventory identity authorized by APS. The domain becomes `site.domain`. The HTTPS page origin replaces the current page's scheme and host while preserving its path and query. The origin must be the inventory domain or one of its subdomains and cannot include credentials, a port, path, query, or fragment. These values come only from operator configuration; Trusted Server never accepts APS inventory identity from the client auction payload.
@@ -72,7 +76,39 @@ Trusted Server builds the APS request independently from its Prebid Server reque
 
 Precise latitude/longitude, disallowed identifiers, unsupported media types, and Trusted Server/Prebid-only extensions are not forwarded. Unsafe or oversized page URLs are omitted or replaced by the validated publisher fallback.
 
-Raw outbound and inbound payloads are logged only at TRACE level. Normal logs and auction metadata contain aggregate counts and drop reasons.
+Raw outbound and inbound payloads are logged only at TRACE level. With debug disabled, auction metadata contains only aggregate counts and drop reasons.
+
+## Debug mode
+
+Set `debug = true` under `[integrations.aps]` to include the direct APS HTTP exchange in the APS provider summary returned by `POST /auction`:
+
+```json
+{
+  "metadata": {
+    "debug": {
+      "httpcalls": {
+        "aps": [
+          {
+            "requestbody": "{...}",
+            "requestheaders": { "content-type": ["application/json"] },
+            "responsebody": "{...}",
+            "responseheaders": { "content-type": ["application/json"] },
+            "status": 200,
+            "uri": "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
+          }
+        ]
+      }
+    }
+  }
+}
+```
+
+This follows the Prebid Server `metadata.debug.httpcalls` representation. APS makes one direct HTTP call per auction, so the map uses the provider key `aps` with one entry. Request and captured response bodies are strings, and header values are arrays so repeated headers are preserved. If a non-success response body cannot be read within the existing 2 MiB upstream limit, `responsebody` is omitted rather than reported as an empty body. APS does not add PBS-only `resolvedrequest` or `bidstatus` fields.
+
+The debug exchange is emitted for successful responses, `204 No Content`, malformed response bodies, and non-success HTTP statuses. Transport failures and auction timeouts happen before an HTTP response reaches the parser and continue to use the orchestrator's normal error metadata.
+
+> [!WARNING]
+> APS debug metadata is unredacted and client-visible. Use it only on controlled test sites, and disable it before production rollout.
 
 ## Bid eligibility and selection
 
@@ -196,6 +232,7 @@ Use fictional values in source-controlled configuration and fixtures. Supply con
 - Ensure `aps` appears in `auction.providers`.
 - Check aggregate APS drop reasons for currency, dimensions, render source, URL, tag type, or script-gate rejection.
 - Confirm the provider timeout fits inside the auction timeout.
+- On a controlled test site, set `debug = true` and inspect `ext.orchestrator.provider_details[].metadata.debug.httpcalls.aps` in the `/auction` response.
 
 ### Winner targets but does not render
 
diff --git a/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md b/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md
index c2da08179..82802970c 100644
--- a/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md
+++ b/docs/superpowers/specs/2026-07-15-aps-openrtb-first-class-integration-design.md
@@ -326,7 +326,7 @@ A two-bids/same-slot/same-seat test is mandatory.
 
 ### 8.4 Diagnostics
 
-`AuctionResponse.metadata` may contain only bounded aggregate fields, for example:
+With APS debug mode disabled, `AuctionResponse.metadata` may contain only bounded aggregate fields, for example:
 
 ```json
 {
@@ -353,7 +353,16 @@ Allowed reason keys are fixed enums such as:
 - `unexpected_response_shape`.
 
 Do not include account IDs, bid IDs, URLs, tokens, consent strings, raw extensions, or
-raw bodies in INFO/WARN diagnostics or client-facing provider summaries.
+raw bodies in INFO/WARN diagnostics. Client-facing provider summaries follow the same
+rule by default.
+
+An explicit `[integrations.aps].debug = true` exception is available for controlled test
+sites. It includes the unredacted direct APS request and response under
+`metadata.debug.httpcalls.aps`, using the same request body, request headers, response
+body, response headers, status, and URI fields exposed by Prebid Server debug output.
+If a non-success response body cannot be captured within the existing 2 MiB upstream
+limit, omit `responsebody` rather than misreporting it as empty. The flag defaults to
+`false` and must not change parsing, eligibility, or selection.
 
 ---
 
diff --git a/trusted-server.example.toml b/trusted-server.example.toml
index a133301a4..4772e02dc 100644
--- a/trusted-server.example.toml
+++ b/trusted-server.example.toml
@@ -120,6 +120,8 @@ enabled = false
 account_id = "example-aps-account-id"
 endpoint = "https://web.ads.aps.amazon-adsystem.com/e/pb/bid"
 timeout_ms = 1000
+# Include raw APS request/response data in /auction metadata on test sites only.
+debug = false
 # Set both when the deployment hostname differs from APS-authorized inventory.
 # inventory_domain = "publisher.example"
 # inventory_page_origin = "https://www.publisher.example"