diff --git a/.env.example b/.env.example
index 1121ecd9..c2ac88e3 100644
--- a/.env.example
+++ b/.env.example
@@ -37,7 +37,7 @@ TRUSTED_SERVER__REQUEST_SIGNING__ENABLED=false
 
 # Prebid
 TRUSTED_SERVER__INTEGRATIONS__PREBID__ENABLED=false
-# TRUSTED_SERVER__INTEGRATIONS__PREBID__SERVER_URL=https://prebid-server.com/openrtb2/auction
+# TRUSTED_SERVER__INTEGRATIONS__PREBID__SERVER_URL=https://prebid-server.example.com/openrtb2/auction
 # TRUSTED_SERVER__INTEGRATIONS__PREBID__TIMEOUT_MS=1000
 # TRUSTED_SERVER__INTEGRATIONS__PREBID__BIDDERS=kargo,rubicon,appnexus
 # TRUSTED_SERVER__INTEGRATIONS__PREBID__BID_PARAM_OVERRIDES='{"bidder-name":{"param1":12345,"param2":"value"}}'
@@ -45,6 +45,7 @@ TRUSTED_SERVER__INTEGRATIONS__PREBID__ENABLED=false
 # TRUSTED_SERVER__INTEGRATIONS__PREBID__BID_PARAM_ZONE_OVERRIDES='{"kargo":{"header":{"placementId":"_abc"}}}'
 # Preferred canonical env shape for future generic rules
 # TRUSTED_SERVER__INTEGRATIONS__PREBID__BID_PARAM_OVERRIDE_RULES='[{"when":{"bidder":"kargo","zone":"header"},"set":{"placementId":"_abc"}}]'
+# TRUSTED_SERVER__INTEGRATIONS__PREBID__SUPPRESS_NURL_BIDDERS=exampleBidder,anotherBidder
 # TRUSTED_SERVER__INTEGRATIONS__PREBID__AUTO_CONFIGURE=false
 # TRUSTED_SERVER__INTEGRATIONS__PREBID__DEBUG=false
 # TRUSTED_SERVER__INTEGRATIONS__PREBID__TEST_MODE=false
diff --git a/Cargo.lock b/Cargo.lock
index 942d5f64..2d1ad743 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1138,6 +1138,12 @@ dependencies = [
  "wasip3",
 ]
 
+[[package]]
+name = "glob"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
+
 [[package]]
 name = "group"
 version = "0.13.0"
@@ -1576,9 +1582,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.29"
+version = "0.4.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+checksum = "953f07c43838f8e6f9758cab68bf5bed85465e7587ebe0b823f1bcd81978ad3a"
 
 [[package]]
 name = "log-fastly"
@@ -2264,9 +2270,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.149"
+version = "1.0.150"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
 dependencies = [
  "itoa",
  "memchr",
@@ -2683,6 +2689,7 @@ dependencies = [
  "log-fastly",
  "serde",
  "serde_json",
+ "toml",
  "trusted-server-core",
  "urlencoding",
 ]
@@ -2707,6 +2714,7 @@ dependencies = [
  "fastly",
  "flate2",
  "futures",
+ "glob",
  "hex",
  "hmac",
  "http",
diff --git a/Cargo.toml b/Cargo.toml
index 9f2f4c67..141244a4 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -65,6 +65,7 @@ fastly = "0.11.12"
 fern = "0.7.1"
 flate2 = "1.1"
 futures = "0.3"
+glob = "0.3"
 hex = "0.4.3"
 hmac = "0.12.1"
 http = "1.4.0"
diff --git a/crates/integration-tests/Cargo.lock b/crates/integration-tests/Cargo.lock
index 9f80a0ef..40fbe003 100644
--- a/crates/integration-tests/Cargo.lock
+++ b/crates/integration-tests/Cargo.lock
@@ -201,9 +201,9 @@ checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
 [[package]]
 name = "autocfg"
-version = "1.5.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
 name = "axum"
@@ -274,9 +274,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.11.1"
+version = "2.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
+checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
 dependencies = [
  "serde_core",
 ]
@@ -316,7 +316,7 @@ checksum = "87a52479c9237eb04047ddb94788c41ca0d26eaff8b697ecfbb4c32f7fdc3b1b"
 dependencies = [
  "async-stream",
  "base64",
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "bollard-buildkit-proto",
  "bollard-stubs",
  "bytes",
@@ -387,9 +387,9 @@ dependencies = [
 
 [[package]]
 name = "brotli"
-version = "8.0.2"
+version = "8.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bd8b9603c7aa97359dbd97ecf258968c95f3adddd6db2f7e7a5bef101c84560"
+checksum = "8119e4516436f5708bbc474a9d395bf12f1b5395e93a92a56e647ac3388c8610"
 dependencies = [
  "alloc-no-stdlib",
  "alloc-stdlib",
@@ -398,9 +398,9 @@ dependencies = [
 
 [[package]]
 name = "brotli-decompressor"
-version = "5.0.0"
+version = "5.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "874bb8112abecc98cbd6d81ea4fa7e94fb9449648c93cc89aa40c81c24d7de03"
+checksum = "5962523e1b92ce1b5e793d9169b9943eece10d39f62550bc04bb605d75b94924"
 dependencies = [
  "alloc-no-stdlib",
  "alloc-stdlib",
@@ -423,9 +423,9 @@ checksum = "d8e6738dfb11354886f890621b4a34c0b177f75538023f7100b608ab9adbd66b"
 
 [[package]]
 name = "bumpalo"
-version = "3.20.2"
+version = "3.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
 
 [[package]]
 name = "byteorder"
@@ -441,9 +441,9 @@ checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
 
 [[package]]
 name = "cc"
-version = "1.2.62"
+version = "1.2.63"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1dce859f0832a7d088c4f1119888ab94ef4b5d6795d1ce05afb7fe159d79f98"
+checksum = "556e016178bb5662a08681bbe0f00f8e17631781a4dfc8c45e466e4b185ec27f"
 dependencies = [
  "find-msvc-tools",
  "shlex",
@@ -481,9 +481,9 @@ dependencies = [
 
 [[package]]
 name = "chrono"
-version = "0.4.44"
+version = "0.4.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
 dependencies = [
  "iana-time-zone",
  "js-sys",
@@ -530,9 +530,9 @@ checksum = "cc14f565cf027a105f7a44ccf9e5b424348421a1d8952a8fc9d499d313107789"
 
 [[package]]
 name = "config"
-version = "0.15.22"
+version = "0.15.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e68cfe19cd7d23ffde002c24ffa5cda73931913ef394d5eaaa32037dc940c0c"
+checksum = "f316c6237b2d38be61949ecd15268a4c6ca32570079394a2444d9ce2c72a72d8"
 dependencies = [
  "async-trait",
  "convert_case 0.6.0",
@@ -903,9 +903,9 @@ dependencies = [
 
 [[package]]
 name = "displaydoc"
-version = "0.2.5"
+version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -923,9 +923,9 @@ dependencies = [
 
 [[package]]
 name = "docker_credential"
-version = "1.3.3"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4564c274ebf369f501de192b02a0b81a5c4bda375abfe526aa70fc702fa6fa0"
+checksum = "29547a1dc60885a552306986316bc9701ba120c1a8db6769fa68691529ad373d"
 dependencies = [
  "base64",
  "serde",
@@ -1043,9 +1043,9 @@ checksum = "7c6ba7d4eec39eaa9ab24d44a0e73a7949a1095a8b3f3abb11eddf27dbb56a53"
 
 [[package]]
 name = "either"
-version = "1.15.0"
+version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
 
 [[package]]
 name = "elliptic-curve"
@@ -1469,6 +1469,12 @@ dependencies = [
  "wasip3",
 ]
 
+[[package]]
+name = "glob"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
+
 [[package]]
 name = "group"
 version = "0.13.0"
@@ -1520,6 +1526,15 @@ dependencies = [
  "foldhash 0.1.5",
 ]
 
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+dependencies = [
+ "foldhash 0.2.0",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.17.1"
@@ -1533,11 +1548,11 @@ dependencies = [
 
 [[package]]
 name = "hashlink"
-version = "0.10.0"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7382cf6263419f2d8df38c55d7da83da5c18aef87fc7a7fc1fb1e344edfe14c1"
+checksum = "824e001ac4f3012dd16a264bec811403a67ca9deb6c102fc5049b32c4574b35f"
 dependencies = [
- "hashbrown 0.15.5",
+ "hashbrown 0.16.1",
 ]
 
 [[package]]
@@ -1584,9 +1599,9 @@ dependencies = [
 
 [[package]]
 name = "http"
-version = "1.4.0"
+version = "1.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
+checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
 dependencies = [
  "bytes",
  "itoa",
@@ -1629,9 +1644,9 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
 [[package]]
 name = "hyper"
-version = "1.9.0"
+version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6299f016b246a94207e63da54dbe807655bf9e00044f73ded42c3ac5305fbcca"
+checksum = "55281c53a1894c864990125767da440a4e630446785086f52523b20033b74498"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -2005,9 +2020,9 @@ checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "jiff"
-version = "0.2.24"
+version = "0.2.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f00b5dbd620d61dfdcb6007c9c1f6054ebd75319f163d886a9055cec1155073d"
+checksum = "4603d3033e49e2b0e31229fcab20a5d40089c607d975cd9c80551dc69eed9102"
 dependencies = [
  "jiff-static",
  "log",
@@ -2018,9 +2033,9 @@ dependencies = [
 
 [[package]]
 name = "jiff-static"
-version = "0.2.24"
+version = "0.2.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e000de030ff8022ea1da3f466fbb0f3a809f5e51ed31f6dd931c35181ad8e6d7"
+checksum = "782d32378dddf207193ac91cefb848ad41abb58195c95168e1291227a0832b47"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2065,13 +2080,12 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.98"
+version = "0.3.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67df7112613f8bfd9150013a0314e196f4800d3201ae742489d999db2f979f08"
+checksum = "f2025f20d7a4fa7785846e7b63d10a76d3f1cee98ee5cb79ea59703f95e42162"
 dependencies = [
  "cfg-if",
  "futures-util",
- "once_cell",
  "wasm-bindgen",
 ]
 
@@ -2142,9 +2156,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.29"
+version = "0.4.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+checksum = "953f07c43838f8e6f9758cab68bf5bed85465e7587ebe0b823f1bcd81978ad3a"
 
 [[package]]
 name = "lol_html"
@@ -2152,7 +2166,7 @@ version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "00aad58f6ec3990e795943872f13651e7a5fa59dca2c8f31a74faf8a0e0fb652"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "cfg-if",
  "cssparser 0.36.0",
  "encoding_rs",
@@ -2210,9 +2224,9 @@ checksum = "8863b587001c1b9a8a4e36008cebc6b3612cb1226fe2de94858e06092687b608"
 
 [[package]]
 name = "memchr"
-version = "2.8.0"
+version = "2.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
+checksum = "6b947ae49db0d222b1dbc6b113ce7248a3fc3a6ca21b696717bfc000ba4484d8"
 
 [[package]]
 name = "mime"
@@ -2232,9 +2246,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.2.0"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50b7e5b27aa02a74bac8c3f23f448f8d87ff11f92d3aac1a6ed369ee08cc56c1"
+checksum = "02bd0af71c67b473010cbbc60715ee815645a4dc942899111f494b4b737d6fda"
 dependencies = [
  "libc",
  "wasi",
@@ -2324,9 +2338,9 @@ dependencies = [
 
 [[package]]
 name = "num-conv"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6673768db2d862beb9b39a78fdcb1a69439615d5794a1be50caa9bc92c81967"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
 
 [[package]]
 name = "num-derive"
@@ -2400,11 +2414,11 @@ checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
 [[package]]
 name = "openssl"
-version = "0.10.79"
+version = "0.10.80"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf0b434746ee2832f4f0baf10137e1cabb18cbe6912c69e2e33263c45250f542"
+checksum = "a45fa2aa886c42762255da344f0a0d313e254066c46aad76f300c3d3da62d967"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "cfg-if",
  "foreign-types",
  "libc",
@@ -2431,9 +2445,9 @@ checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.115"
+version = "0.9.116"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "158fe5b292746440aa6e7a7e690e55aeb72d41505e2804c23c6973ad0e9c9781"
+checksum = "f28a22dc7140cda5f096e5e7724a6962ca81a7f8bfd2979f9b18c11af56318c4"
 dependencies = [
  "cc",
  "libc",
@@ -2840,9 +2854,9 @@ dependencies = [
 
 [[package]]
 name = "prost"
-version = "0.14.3"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2ea70524a2f82d518bce41317d0fae74151505651af45faf1ffbd6fd33f0568"
+checksum = "528ac67416ff8646872a3c02cad9cc4ee5dc9f9540c9b10771855c95cb2e5ae1"
 dependencies = [
  "bytes",
  "prost-derive",
@@ -2850,9 +2864,9 @@ dependencies = [
 
 [[package]]
 name = "prost-derive"
-version = "0.14.3"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27c6023962132f4b30eb4c172c91ce92d933da334c59c23cddee82358ddafb0b"
+checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -2863,9 +2877,9 @@ dependencies = [
 
 [[package]]
 name = "prost-types"
-version = "0.14.3"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8991c4cbdb8bc5b11f0b074ffe286c30e523de90fee5ba8132f1399f23cb3dd7"
+checksum = "f94967dc7688f3054c7fac87473ffae4cc4c3904800e2d9f5b857246d8963b0a"
 dependencies = [
  "prost",
 ]
@@ -2972,7 +2986,7 @@ version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
 ]
 
 [[package]]
@@ -3088,7 +3102,7 @@ version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4147b952f3f819eca0e99527022f7d6a8d05f111aeb0a62960c74eb283bec8fc"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "once_cell",
  "serde",
  "serde_derive",
@@ -3147,7 +3161,7 @@ version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "errno",
  "libc",
  "linux-raw-sys",
@@ -3171,9 +3185,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-native-certs"
-version = "0.8.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "612460d5f7bea540c490b2b6395d8e34a953e52b491accd6c86c8164c5932a63"
+checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
 dependencies = [
  "openssl-probe",
  "rustls-pki-types",
@@ -3305,7 +3319,7 @@ version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "core-foundation 0.10.1",
  "core-foundation-sys",
  "libc",
@@ -3328,7 +3342,7 @@ version = "0.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fd568a4c9bb598e291a08244a5c1f5a8a6650bee243b5b0f8dbb3d9cc1d87fe8"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "cssparser 0.34.0",
  "derive_more 0.99.20",
  "fxhash",
@@ -3347,7 +3361,7 @@ version = "0.37.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2cfaaa6035167f0e604e42723c7650d59ee269ef220d7bbe0565602c8a0173b9"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "cssparser 0.36.0",
  "derive_more 2.1.1",
  "log",
@@ -3410,9 +3424,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.149"
+version = "1.0.150"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
 dependencies = [
  "itoa",
  "memchr",
@@ -3455,9 +3469,9 @@ dependencies = [
 
 [[package]]
 name = "serde_with"
-version = "3.20.0"
+version = "3.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e72c1c2cb7b223fafb600a619537a871c2818583d619401b785e7c0b746ccde2"
+checksum = "76a5c54c7310e7b8b9577c286d7e399ddd876c3e12b3ed917a8aabc4b96e9e8c"
 dependencies = [
  "base64",
  "bs58",
@@ -3475,9 +3489,9 @@ dependencies = [
 
 [[package]]
 name = "serde_with_macros"
-version = "3.20.0"
+version = "3.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b90c488738ecb4fb0262f41f43bc40efc5868d9fb744319ddf5f5317f417bfac"
+checksum = "84d57bc0c8b9a17920c178daa6bb924850d54a9c97ab45194bb8c17ad66bb660"
 dependencies = [
  "darling 0.23.0",
  "proc-macro2",
@@ -3520,9 +3534,9 @@ dependencies = [
 
 [[package]]
 name = "shlex"
-version = "1.3.0"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
 [[package]]
 name = "signature"
@@ -3560,9 +3574,9 @@ checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
 
 [[package]]
 name = "socket2"
-version = "0.6.3"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
+checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51"
 dependencies = [
  "libc",
  "windows-sys 0.61.2",
@@ -3710,7 +3724,7 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "core-foundation 0.9.4",
  "system-configuration-sys",
 ]
@@ -4053,11 +4067,11 @@ dependencies = [
 
 [[package]]
 name = "tower-http"
-version = "0.6.10"
+version = "0.6.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68d6fdd9f81c2819c9a8b0e0cd91660e7746a8e6ea2ba7c6b2b057985f6bcb51"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "bytes",
  "futures-util",
  "http",
@@ -4131,6 +4145,7 @@ dependencies = [
  "fastly",
  "flate2",
  "futures",
+ "glob",
  "hex",
  "hmac",
  "http",
@@ -4189,9 +4204,9 @@ checksum = "bc7d623258602320d5c55d1bc22793b57daff0ec7efc270ea7d55ce1d5f5471c"
 
 [[package]]
 name = "typenum"
-version = "1.20.0"
+version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40ce102ab67701b8526c123c1bab5cbe42d7040ccfd0f64af1a385808d2f43de"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 
 [[package]]
 name = "ucd-trie"
@@ -4217,9 +4232,9 @@ checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
 [[package]]
 name = "unicode-segmentation"
-version = "1.13.2"
+version = "1.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9629274872b2bfaf8d66f5f15725007f635594914870f65218920345aa11aa8c"
+checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
 
 [[package]]
 name = "unicode-width"
@@ -4321,9 +4336,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.23.1"
+version = "1.23.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddd74a9687298c6858e9b88ec8935ec45d22e8fd5e6394fa1bd4e99a87789c76"
+checksum = "144d6b123cef80b301b8f72a9e2ca4370ddec21950d0a103dd22c437006d2db7"
 dependencies = [
  "getrandom 0.4.2",
  "js-sys",
@@ -4417,9 +4432,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.121"
+version = "0.2.123"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49ace1d07c165b0864824eee619580c4689389afa9dc9ed3a4c75040d82e6790"
+checksum = "a254a4b10c19a76f09a27640e7ffbf9bc30bf67e16a3bf28aaefa4920fe81563"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -4430,9 +4445,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.71"
+version = "0.4.73"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96492d0d3ffba25305a7dc88720d250b1401d7edca02cc3bcd50633b424673b8"
+checksum = "54568702fabf5d4849ce2b90fadfa64168a097eaf4b351ce9df8b687a0086aaf"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -4440,9 +4455,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.121"
+version = "0.2.123"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e68e6f4afd367a562002c05637acb8578ff2dea1943df76afb9e83d177c8578"
+checksum = "24a40fc75b0ec6f3746ceb10d36f53a93dcd68a93b11b6445983945d79eba0dc"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -4450,9 +4465,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.121"
+version = "0.2.123"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d95a9ec35c64b2a7cb35d3fead40c4238d0940c86d107136999567a4703259f2"
+checksum = "908f34bd9b9ce3d4caf07b72dfab63d61504d156856c6bd3cd87fa350cf3985b"
 dependencies = [
  "bumpalo",
  "proc-macro2",
@@ -4463,9 +4478,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.121"
+version = "0.2.123"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4e0100b01e9f0d03189a92b96772a1fb998639d981193d7dbab487302513441"
+checksum = "7acbf7616c27b194bbb550bf77ed0c2c3e5b7fd1260a93082b95fb7f47959b92"
 dependencies = [
  "unicode-ident",
 ]
@@ -4498,7 +4513,7 @@ version = "0.244.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "hashbrown 0.15.5",
  "indexmap 2.14.0",
  "semver",
@@ -4506,9 +4521,9 @@ dependencies = [
 
 [[package]]
 name = "web-sys"
-version = "0.3.98"
+version = "0.3.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b572dff8bcf38bad0fa19729c89bb5748b2b9b1d8be70cf90df697e3a8f32aa"
+checksum = "6e0871acf327f283dc6da28a1696cdc64fb355ba9f935d052021fa77f35cce69"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -4526,9 +4541,9 @@ dependencies = [
 
 [[package]]
 name = "which"
-version = "8.0.2"
+version = "8.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81995fafaaaf6ae47a7d0cc83c67caf92aeb7e5331650ae6ff856f7c0c60c459"
+checksum = "c789537cf2f7f55be8e6192f92e464174ee55f91af622777f7f1ceb0dbccd03e"
 dependencies = [
  "libc",
 ]
@@ -4740,7 +4755,7 @@ version = "0.46.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
 ]
 
 [[package]]
@@ -4758,7 +4773,7 @@ version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 dependencies = [
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
 ]
 
 [[package]]
@@ -4810,7 +4825,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
 dependencies = [
  "anyhow",
- "bitflags 2.11.1",
+ "bitflags 2.13.0",
  "indexmap 2.14.0",
  "log",
  "serde",
@@ -4858,9 +4873,9 @@ dependencies = [
 
 [[package]]
 name = "yaml-rust2"
-version = "0.10.4"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2462ea039c445496d8793d052e13787f2b90e750b833afee748e601c17621ed9"
+checksum = "631a50d867fafb7093e709d75aaee9e0e0d5deb934021fcea25ac2fe09edc51e"
 dependencies = [
  "arraydeque",
  "encoding_rs",
@@ -4869,9 +4884,9 @@ dependencies = [
 
 [[package]]
 name = "yoke"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abe8c5fda708d9ca3df187cae8bfb9ceda00dd96231bed36e445a1a48e66f9ca"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
 dependencies = [
  "stable_deref_trait",
  "yoke-derive",
@@ -4892,18 +4907,18 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.48"
+version = "0.8.50"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eed437bf9d6692032087e337407a86f04cd8d6a16a37199ed57949d415bd68e9"
+checksum = "3b065d4f0e55f82fae73202e189638116a87c55ab6b8e6c2721e13dd9d854ad1"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.48"
+version = "0.8.50"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70e3cd084b1788766f53af483dd21f93881ff30d7320490ec3ef7526d203bad4"
+checksum = "0b631b19d36a892ab55420c92dbc83ccd79274f25be714855d3074aa71cab639"
 dependencies = [
  "proc-macro2",
  "quote",
diff --git a/crates/js/lib/src/core/types.ts b/crates/js/lib/src/core/types.ts
index 9f726bb9..57a14f3e 100644
--- a/crates/js/lib/src/core/types.ts
+++ b/crates/js/lib/src/core/types.ts
@@ -20,6 +20,49 @@ export interface AdUnit {
   bids?: Bid[];
 }
 
+/** Minimal shape of a server-side auction slot injected into `window.tsjs.adSlots`. */
+export interface AuctionSlot {
+  id: string;
+  gam_unit_path: string;
+  div_id: string;
+  formats: Array<[number, number]>;
+  targeting?: Record<string, string>;
+}
+
+/** Debug-only copy of server-side bid fields exposed for pipeline inspection. */
+export interface AuctionDebugBidData {
+  slot_id?: string;
+  price?: number | null;
+  currency?: string;
+  creative?: string | null;
+  adomain?: string[] | null;
+  bidder?: string;
+  width?: number;
+  height?: number;
+  nurl?: string | null;
+  burl?: string | null;
+  ad_id?: string | null;
+  cache_id?: string | null;
+  cache_host?: string | null;
+  cache_path?: string | null;
+  metadata?: Record<string, unknown>;
+}
+
+/** Bid targeting data from the server-side auction, injected into `window.tsjs.bids`. */
+export interface AuctionBidData {
+  hb_pb?: string;
+  hb_bidder?: string;
+  hb_adid?: string;
+  hb_cache_host?: string;
+  hb_cache_path?: string;
+  nurl?: string;
+  burl?: string;
+  /** Raw creative markup. Only present when `[debug] inject_adm_for_testing = true`. */
+  adm?: string;
+  /** Debug-only bid field mirror. Only present when `[debug] inject_adm_for_testing = true`. */
+  debug_bid?: AuctionDebugBidData;
+}
+
 export interface TsjsApi {
   version: string;
   que: Array<() => void>;
@@ -41,4 +84,22 @@ export interface TsjsApi {
     error(...args: unknown[]): void;
     debug(...args: unknown[]): void;
   };
+
+  // ── Server-side auction runtime (populated by TS edge injection) ──────────
+  /** Ad slot definitions injected at <head> open. */
+  adSlots?: AuctionSlot[];
+  /** Winning bid targeting data injected before </body>. */
+  bids?: Record<string, AuctionBidData>;
+  /** Initialises GPT slots with server-side bid targeting and calls refresh(). */
+  adInit?: () => void;
+  /** GPT slot objects TS defined — used to destroy stale slots on SPA navigation. */
+  prevGptSlots?: unknown[];
+  /** Guards one-time-per-page enableSingleRequest/enableServices calls. */
+  servicesEnabled?: boolean;
+  /** Maps actualDivId → slotId for slotRenderEnded billing lookup. */
+  divToSlotId?: Record<string, string>;
+  /** Slot-level GPT targeting keys TS applied on the previous route. */
+  prevSlotTargetingKeys?: Record<string, string[]>;
+  /** Guards SPA pushState hook installation. */
+  spaHookInstalled?: boolean;
 }
diff --git a/crates/js/lib/src/integrations/gpt/index.test.ts b/crates/js/lib/src/integrations/gpt/index.test.ts
new file mode 100644
index 00000000..5573993b
--- /dev/null
+++ b/crates/js/lib/src/integrations/gpt/index.test.ts
@@ -0,0 +1,808 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+// Track every 'message' EventListener added to window across the entire test
+// file.  This lets the installTsRenderBridge suite remove all accumulated
+// handlers (registered by each vi.resetModules() + import('./index') in the
+// installTsAdInit suite) before dispatching its own events.
+const allMessageHandlers: EventListener[] = [];
+const _origWindowAddEventListener = window.addEventListener.bind(window);
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+(window as any).addEventListener = function (
+  type: string,
+  handler: EventListenerOrEventListenerObject,
+  options?: unknown
+) {
+  if (type === 'message') {
+    allMessageHandlers.push(handler as EventListener);
+  }
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  return _origWindowAddEventListener(type, handler as EventListener, options as any);
+};
+
+interface SlotRenderEvent {
+  isEmpty: boolean;
+  slot: {
+    getSlotElementId(): string;
+    getTargeting(key: string): string[];
+  };
+}
+
+type TestWindow = Window & {
+  googletag?: unknown;
+  apstag?: { setDisplayBids?: () => void };
+  // Typed as `any` to avoid the TypeScript intersection with the global
+  // Window.tsjs declaration (TsjsApi from core/types.ts), which would require
+  // every test fixture to satisfy the full TsjsApi shape.
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  tsjs?: any;
+};
+
+describe('installTsAdInit', () => {
+  beforeEach(() => {
+    vi.resetModules();
+    const tw = window as TestWindow;
+    delete tw.tsjs;
+    // jsdom does not implement navigator.sendBeacon; polyfill it for tests
+    if (!('sendBeacon' in navigator)) {
+      Object.defineProperty(navigator, 'sendBeacon', {
+        value: vi.fn().mockReturnValue(true),
+        writable: true,
+        configurable: true,
+      });
+    }
+    // adInit now queries the DOM for div elements by id/prefix — create the
+    // test div so getElementById and querySelector both resolve correctly.
+    if (!document.getElementById('div-atf-sidebar')) {
+      const div = document.createElement('div');
+      div.id = 'div-atf-sidebar';
+      document.body.appendChild(div);
+    }
+  });
+
+  afterEach(() => {
+    document.getElementById('div-atf-sidebar')?.remove();
+    document.getElementById("ad'prefix-real")?.remove();
+  });
+
+  it('reads window.tsjs.bids synchronously and applies bid targeting before refresh', async () => {
+    const mockSlot = {
+      addService: vi.fn().mockReturnThis(),
+      setTargeting: vi.fn().mockReturnThis(),
+      getSlotElementId: vi.fn().mockReturnValue('div-atf-sidebar'),
+      getTargeting: vi.fn().mockReturnValue(['abc']),
+    };
+    const mockPubads = {
+      enableSingleRequest: vi.fn(),
+      getSlots: vi.fn().mockReturnValue([mockSlot]),
+      addEventListener: vi.fn(),
+      refresh: vi.fn(),
+    };
+    (window as TestWindow).googletag = {
+      cmd: { push: vi.fn((fn: () => void) => fn()) },
+      defineSlot: vi.fn().mockReturnValue(mockSlot),
+      pubads: vi.fn().mockReturnValue(mockPubads),
+      enableServices: vi.fn(),
+    };
+    (window as TestWindow).tsjs = {
+      adSlots: [
+        {
+          id: 'atf_sidebar_ad',
+          gam_unit_path: '/123/atf',
+          div_id: 'div-atf-sidebar',
+          formats: [[300, 250]],
+          targeting: { pos: 'atf' },
+        },
+      ],
+      bids: {
+        atf_sidebar_ad: {
+          hb_pb: '1.00',
+          hb_bidder: 'kargo',
+          hb_adid: 'abc-uuid',
+          hb_cache_host: 'cache.example.com',
+          hb_cache_path: '/pbc/v1/cache',
+          nurl: 'https://ssp/win',
+          burl: 'https://ssp/bill',
+        },
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    } as any;
+
+    const fetchSpy = vi.spyOn(global, 'fetch');
+
+    const { installTsAdInit } = await import('./index');
+    installTsAdInit();
+    (window as TestWindow).tsjs!.adInit!();
+
+    expect(fetchSpy).not.toHaveBeenCalled();
+    expect(mockSlot.setTargeting).toHaveBeenCalledWith('hb_pb', '1.00');
+    expect(mockSlot.setTargeting).toHaveBeenCalledWith('hb_bidder', 'kargo');
+    expect(mockSlot.setTargeting).toHaveBeenCalledWith('hb_adid', 'abc-uuid');
+    expect(mockSlot.setTargeting).toHaveBeenCalledWith('hb_cache_host', 'cache.example.com');
+    expect(mockSlot.setTargeting).toHaveBeenCalledWith('hb_cache_path', '/pbc/v1/cache');
+    expect(mockSlot.setTargeting).toHaveBeenCalledWith('ts_initial', '1');
+    expect(mockPubads.refresh).toHaveBeenCalled();
+
+    fetchSpy.mockRestore();
+  });
+
+  it('keeps the GAM path when debug adm is present', async () => {
+    const slotEl = document.getElementById('div-atf-sidebar')!;
+    const mockSlot = {
+      addService: vi.fn().mockReturnThis(),
+      setTargeting: vi.fn().mockReturnThis(),
+      getSlotElementId: vi.fn().mockReturnValue('div-atf-sidebar'),
+      getTargeting: vi.fn().mockReturnValue(['debug-uuid']),
+    };
+    const mockPubads = {
+      enableSingleRequest: vi.fn(),
+      getSlots: vi.fn().mockReturnValue([mockSlot]),
+      addEventListener: vi.fn(),
+      refresh: vi.fn(),
+    };
+    const destroySlots = vi.fn();
+    (window as TestWindow).googletag = {
+      cmd: { push: vi.fn((fn: () => void) => fn()) },
+      defineSlot: vi.fn().mockReturnValue(mockSlot),
+      destroySlots,
+      pubads: vi.fn().mockReturnValue(mockPubads),
+      enableServices: vi.fn(),
+    };
+    (window as TestWindow).tsjs = {
+      adSlots: [
+        {
+          id: 'atf_sidebar_ad',
+          gam_unit_path: '/123/atf',
+          div_id: 'div-atf-sidebar',
+          formats: [[300, 250]],
+          targeting: { pos: 'atf' },
+        },
+      ],
+      bids: {
+        atf_sidebar_ad: {
+          hb_pb: '0.20',
+          hb_bidder: 'mocktioneer',
+          hb_adid: 'debug-uuid',
+          adm: '<div>Debug creative</div>',
+        },
+      },
+    };
+
+    const { installTsAdInit } = await import('./index');
+    installTsAdInit();
+    (window as TestWindow).tsjs!.adInit!();
+
+    expect(slotEl.innerHTML).toBe('');
+    expect(destroySlots).not.toHaveBeenCalledWith([mockSlot]);
+    expect(mockSlot.setTargeting).toHaveBeenCalledWith('hb_pb', '0.20');
+    expect(mockSlot.setTargeting).toHaveBeenCalledWith('hb_bidder', 'mocktioneer');
+    expect(mockSlot.setTargeting).toHaveBeenCalledWith('hb_adid', 'debug-uuid');
+    expect(mockSlot.setTargeting).toHaveBeenCalledWith('ts_initial', '1');
+    expect(mockPubads.refresh).toHaveBeenCalledWith([mockSlot]);
+  });
+
+  it('fires both nurl and burl via sendBeacon on slotRenderEnded when our bid won', async () => {
+    const beaconSpy = vi.spyOn(navigator, 'sendBeacon').mockReturnValue(true);
+    let capturedListener: ((e: SlotRenderEvent) => void) | undefined;
+
+    const mockSlot = {
+      addService: vi.fn().mockReturnThis(),
+      setTargeting: vi.fn().mockReturnThis(),
+      getSlotElementId: vi.fn().mockReturnValue('div-atf-sidebar'),
+      getTargeting: vi.fn().mockReturnValue(['abc']),
+    };
+    const mockPubads = {
+      enableSingleRequest: vi.fn(),
+      getSlots: vi.fn().mockReturnValue([mockSlot]),
+      refresh: vi.fn(),
+      addEventListener: vi.fn((event: string, fn: (e: SlotRenderEvent) => void) => {
+        if (event === 'slotRenderEnded') capturedListener = fn;
+      }),
+    };
+    (window as TestWindow).googletag = {
+      cmd: { push: vi.fn((fn: () => void) => fn()) },
+      defineSlot: vi.fn().mockReturnValue(mockSlot),
+      pubads: vi.fn().mockReturnValue(mockPubads),
+      enableServices: vi.fn(),
+    };
+    (window as TestWindow).tsjs = {
+      adSlots: [
+        {
+          id: 'atf_sidebar_ad',
+          gam_unit_path: '/123/atf',
+          div_id: 'div-atf-sidebar',
+          formats: [[300, 250]],
+          targeting: {},
+        },
+      ],
+      bids: {
+        atf_sidebar_ad: {
+          hb_pb: '1.00',
+          hb_bidder: 'kargo',
+          hb_adid: 'abc',
+          nurl: 'https://ssp/win',
+          burl: 'https://ssp/bill',
+        },
+      },
+    };
+
+    const { installTsAdInit } = await import('./index');
+    installTsAdInit();
+    (window as TestWindow).tsjs!.adInit!();
+
+    expect(capturedListener).toBeDefined();
+    capturedListener!({ isEmpty: false, slot: mockSlot });
+
+    expect(beaconSpy).toHaveBeenCalledWith('https://ssp/win');
+    expect(beaconSpy).toHaveBeenCalledWith('https://ssp/bill');
+    beaconSpy.mockRestore();
+  });
+
+  it('does not fire beacons when a rendered bid has no hb_adid confirmation', async () => {
+    const beaconSpy = vi.spyOn(navigator, 'sendBeacon').mockReturnValue(true);
+    let capturedListener: ((e: SlotRenderEvent) => void) | undefined;
+
+    const mockSlot = {
+      addService: vi.fn().mockReturnThis(),
+      setTargeting: vi.fn().mockReturnThis(),
+      getSlotElementId: vi.fn().mockReturnValue('div-atf-sidebar'),
+      getTargeting: vi.fn().mockReturnValue([]),
+    };
+    const mockPubads = {
+      enableSingleRequest: vi.fn(),
+      getSlots: vi.fn().mockReturnValue([mockSlot]),
+      refresh: vi.fn(),
+      addEventListener: vi.fn((event: string, fn: (e: SlotRenderEvent) => void) => {
+        if (event === 'slotRenderEnded') capturedListener = fn;
+      }),
+    };
+    (window as TestWindow).googletag = {
+      cmd: { push: vi.fn((fn: () => void) => fn()) },
+      defineSlot: vi.fn().mockReturnValue(mockSlot),
+      pubads: vi.fn().mockReturnValue(mockPubads),
+      enableServices: vi.fn(),
+    };
+    (window as TestWindow).tsjs = {
+      adSlots: [
+        {
+          id: 'atf_sidebar_ad',
+          gam_unit_path: '/123/atf',
+          div_id: 'div-atf-sidebar',
+          formats: [[300, 250]],
+          targeting: {},
+        },
+      ],
+      bids: {
+        atf_sidebar_ad: {
+          hb_pb: '1.50',
+          hb_bidder: 'aps',
+          nurl: 'https://aps/win',
+          burl: 'https://aps/bill',
+        },
+      },
+    };
+
+    const { installTsAdInit } = await import('./index');
+    installTsAdInit();
+    (window as TestWindow).tsjs!.adInit!();
+
+    expect(capturedListener).toBeDefined();
+    capturedListener!({ isEmpty: false, slot: mockSlot });
+
+    expect(beaconSpy).not.toHaveBeenCalled();
+
+    capturedListener!({ isEmpty: true, slot: mockSlot });
+    expect(beaconSpy).not.toHaveBeenCalled();
+
+    beaconSpy.mockRestore();
+  });
+
+  it('does not fire nurl/burl when bid did not win GAM line item', async () => {
+    const beaconSpy = vi.spyOn(navigator, 'sendBeacon').mockReturnValue(true);
+    let capturedListener: ((e: SlotRenderEvent) => void) | undefined;
+
+    const mockSlotNoMatch = {
+      addService: vi.fn().mockReturnThis(),
+      setTargeting: vi.fn().mockReturnThis(),
+      getSlotElementId: vi.fn().mockReturnValue('div-atf-sidebar'),
+      getTargeting: vi.fn().mockReturnValue(['OTHER_BID_ID']),
+    };
+    const mockPubads = {
+      enableSingleRequest: vi.fn(),
+      getSlots: vi.fn().mockReturnValue([mockSlotNoMatch]),
+      refresh: vi.fn(),
+      addEventListener: vi.fn((event: string, fn: (e: SlotRenderEvent) => void) => {
+        if (event === 'slotRenderEnded') capturedListener = fn;
+      }),
+    };
+    (window as TestWindow).googletag = {
+      cmd: { push: vi.fn((fn: () => void) => fn()) },
+      defineSlot: vi.fn().mockReturnValue(mockSlotNoMatch),
+      pubads: vi.fn().mockReturnValue(mockPubads),
+      enableServices: vi.fn(),
+    };
+    (window as TestWindow).tsjs = {
+      adSlots: [
+        {
+          id: 'atf_sidebar_ad',
+          gam_unit_path: '/123/atf',
+          div_id: 'div-atf-sidebar',
+          formats: [[300, 250]],
+          targeting: {},
+        },
+      ],
+      bids: {
+        atf_sidebar_ad: {
+          hb_pb: '1.00',
+          hb_bidder: 'kargo',
+          hb_adid: 'abc',
+          nurl: 'https://ssp/win',
+          burl: 'https://ssp/bill',
+        },
+      },
+    };
+
+    const { installTsAdInit } = await import('./index');
+    installTsAdInit();
+    (window as TestWindow).tsjs!.adInit!();
+    capturedListener!({ isEmpty: false, slot: mockSlotNoMatch });
+
+    expect(beaconSpy).not.toHaveBeenCalled();
+    beaconSpy.mockRestore();
+  });
+
+  it('does not fire beacons for slotRenderEnded on slots not owned by TS', async () => {
+    const beaconSpy = vi.spyOn(navigator, 'sendBeacon').mockReturnValue(true);
+    let capturedListener: ((e: SlotRenderEvent) => void) | undefined;
+
+    const mockSlot = {
+      addService: vi.fn().mockReturnThis(),
+      setTargeting: vi.fn().mockReturnThis(),
+      getSlotElementId: vi.fn().mockReturnValue('div-atf-sidebar'),
+      getTargeting: vi.fn().mockReturnValue(['abc']),
+    };
+    const arenaSlot = {
+      getSlotElementId: () => 'arena-owned-div',
+      getTargeting: () => [],
+    };
+    const mockPubads = {
+      enableSingleRequest: vi.fn(),
+      getSlots: vi.fn().mockReturnValue([mockSlot]),
+      refresh: vi.fn(),
+      addEventListener: vi.fn((event: string, fn: (e: SlotRenderEvent) => void) => {
+        if (event === 'slotRenderEnded') capturedListener = fn;
+      }),
+    };
+    (window as TestWindow).googletag = {
+      cmd: { push: vi.fn((fn: () => void) => fn()) },
+      defineSlot: vi.fn().mockReturnValue(mockSlot),
+      pubads: vi.fn().mockReturnValue(mockPubads),
+      enableServices: vi.fn(),
+    };
+    (window as TestWindow).tsjs = {
+      adSlots: [
+        {
+          id: 'atf_sidebar_ad',
+          gam_unit_path: '/123/atf',
+          div_id: 'div-atf-sidebar',
+          formats: [[300, 250]],
+          targeting: {},
+        },
+      ],
+      bids: {
+        atf_sidebar_ad: { hb_pb: '1.00', hb_bidder: 'kargo', hb_adid: 'abc' },
+      },
+    };
+
+    const { installTsAdInit } = await import('./index');
+    installTsAdInit();
+    (window as TestWindow).tsjs!.adInit!();
+
+    capturedListener!({ isEmpty: false, slot: arenaSlot });
+
+    expect(beaconSpy).not.toHaveBeenCalled();
+    beaconSpy.mockRestore();
+  });
+
+  it('calls apstag.setDisplayBids when hb_bidder is aps', async () => {
+    const setDisplayBidsSpy = vi.fn();
+    (window as TestWindow).apstag = { setDisplayBids: setDisplayBidsSpy };
+
+    const mockSlot = {
+      addService: vi.fn().mockReturnThis(),
+      setTargeting: vi.fn().mockReturnThis(),
+      getSlotElementId: vi.fn().mockReturnValue('div-atf-sidebar'),
+      getTargeting: vi.fn().mockReturnValue([]),
+    };
+    const mockPubads = {
+      enableSingleRequest: vi.fn(),
+      getSlots: vi.fn().mockReturnValue([mockSlot]),
+      addEventListener: vi.fn(),
+      refresh: vi.fn(),
+    };
+    (window as TestWindow).googletag = {
+      cmd: { push: vi.fn((fn: () => void) => fn()) },
+      defineSlot: vi.fn().mockReturnValue(mockSlot),
+      pubads: vi.fn().mockReturnValue(mockPubads),
+      enableServices: vi.fn(),
+    };
+    (window as TestWindow).tsjs = {
+      adSlots: [
+        {
+          id: 'atf_sidebar_ad',
+          gam_unit_path: '/123/atf',
+          div_id: 'div-atf-sidebar',
+          formats: [[300, 250]],
+          targeting: {},
+        },
+      ],
+      bids: {
+        atf_sidebar_ad: { hb_pb: '1.50', hb_bidder: 'aps', nurl: '', burl: '' },
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    } as any;
+
+    const { installTsAdInit } = await import('./index');
+    installTsAdInit();
+    (window as TestWindow).tsjs!.adInit!();
+
+    expect(setDisplayBidsSpy).toHaveBeenCalled();
+
+    delete (window as TestWindow).apstag;
+  });
+
+  it('does not call apstag.setDisplayBids when hb_bidder is not aps', async () => {
+    const setDisplayBidsSpy = vi.fn();
+    (window as TestWindow).apstag = { setDisplayBids: setDisplayBidsSpy };
+
+    const mockSlot = {
+      addService: vi.fn().mockReturnThis(),
+      setTargeting: vi.fn().mockReturnThis(),
+      getSlotElementId: vi.fn().mockReturnValue('div-atf-sidebar'),
+      getTargeting: vi.fn().mockReturnValue([]),
+    };
+    const mockPubads = {
+      enableSingleRequest: vi.fn(),
+      getSlots: vi.fn().mockReturnValue([mockSlot]),
+      addEventListener: vi.fn(),
+      refresh: vi.fn(),
+    };
+    (window as TestWindow).googletag = {
+      cmd: { push: vi.fn((fn: () => void) => fn()) },
+      defineSlot: vi.fn().mockReturnValue(mockSlot),
+      pubads: vi.fn().mockReturnValue(mockPubads),
+      enableServices: vi.fn(),
+    };
+    (window as TestWindow).tsjs = {
+      adSlots: [
+        {
+          id: 'atf_sidebar_ad',
+          gam_unit_path: '/123/atf',
+          div_id: 'div-atf-sidebar',
+          formats: [[300, 250]],
+          targeting: {},
+        },
+      ],
+      bids: {
+        atf_sidebar_ad: { hb_pb: '1.00', hb_bidder: 'kargo' },
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    } as any;
+
+    const { installTsAdInit } = await import('./index');
+    installTsAdInit();
+    (window as TestWindow).tsjs!.adInit!();
+
+    expect(setDisplayBidsSpy).not.toHaveBeenCalled();
+
+    delete (window as TestWindow).apstag;
+  });
+
+  it('calls refresh even when tsjs.bids is empty (graceful fallback)', async () => {
+    const emptyTestSlot = {
+      addService: vi.fn().mockReturnThis(),
+      setTargeting: vi.fn().mockReturnThis(),
+      getSlotElementId: vi.fn().mockReturnValue('div-atf-sidebar'),
+      getTargeting: vi.fn().mockReturnValue([]),
+    };
+    const mockPubads = {
+      enableSingleRequest: vi.fn(),
+      getSlots: vi.fn().mockReturnValue([emptyTestSlot]),
+      addEventListener: vi.fn(),
+      refresh: vi.fn(),
+    };
+    (window as TestWindow).googletag = {
+      cmd: { push: vi.fn((fn: () => void) => fn()) },
+      defineSlot: vi.fn().mockReturnValue({
+        addService: vi.fn().mockReturnThis(),
+        setTargeting: vi.fn().mockReturnThis(),
+      }),
+      pubads: vi.fn().mockReturnValue(mockPubads),
+      enableServices: vi.fn(),
+    };
+    (window as TestWindow).tsjs = {
+      adSlots: [
+        {
+          id: 'atf_sidebar_ad',
+          gam_unit_path: '/123/atf',
+          div_id: 'div-atf-sidebar',
+          formats: [[300, 250]],
+          targeting: {},
+        },
+      ],
+      bids: {},
+    };
+
+    const { installTsAdInit } = await import('./index');
+    installTsAdInit();
+    (window as TestWindow).tsjs!.adInit!();
+
+    expect(mockPubads.refresh).toHaveBeenCalled();
+  });
+
+  it('resolves dynamic div prefixes without interpolating div_id into a CSS selector', async () => {
+    const dynamicDiv = document.createElement('div');
+    dynamicDiv.id = "ad'prefix-real";
+    document.body.appendChild(dynamicDiv);
+
+    const dynamicSlot = {
+      addService: vi.fn().mockReturnThis(),
+      setTargeting: vi.fn().mockReturnThis(),
+      getSlotElementId: vi.fn().mockReturnValue("ad'prefix-real"),
+      getTargeting: vi.fn().mockReturnValue([]),
+    };
+    const mockPubads = {
+      enableSingleRequest: vi.fn(),
+      getSlots: vi.fn().mockReturnValue([dynamicSlot]),
+      addEventListener: vi.fn(),
+      refresh: vi.fn(),
+    };
+    (window as TestWindow).googletag = {
+      cmd: { push: vi.fn((fn: () => void) => fn()) },
+      defineSlot: vi.fn().mockReturnValue(dynamicSlot),
+      pubads: vi.fn().mockReturnValue(mockPubads),
+      enableServices: vi.fn(),
+    };
+    (window as TestWindow).tsjs = {
+      adSlots: [
+        {
+          id: 'dynamic_slot',
+          gam_unit_path: '/123/dynamic',
+          div_id: "ad'prefix-",
+          formats: [[300, 250]],
+          targeting: {},
+        },
+      ],
+      bids: {},
+    };
+
+    const { installTsAdInit } = await import('./index');
+    installTsAdInit();
+
+    expect(() => (window as TestWindow).tsjs!.adInit!()).not.toThrow();
+    expect(mockPubads.refresh).toHaveBeenCalledWith([dynamicSlot]);
+  });
+});
+
+describe('installTsRenderBridge', () => {
+  let fetchStub: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    vi.resetModules();
+    // Remove ALL accumulated 'message' handlers from previous test module imports
+    // to prevent stale bridge listeners from intercepting our test event.
+    for (const handler of allMessageHandlers) {
+      window.removeEventListener('message', handler);
+    }
+    allMessageHandlers.length = 0;
+
+    fetchStub = vi.fn();
+    vi.stubGlobal('fetch', fetchStub);
+
+    (window as TestWindow).tsjs = {
+      bids: {
+        homepage_header: {
+          hb_adid: 'test-cache-uuid',
+          hb_bidder: 'kargo',
+          hb_pb: '1.50',
+          hb_cache_host: 'openads.example.com',
+          hb_cache_path: '/cache',
+        },
+      },
+      adSlots: [
+        {
+          id: 'homepage_header',
+          formats: [[728, 90]] as [number, number][],
+          gam_unit_path: '/a/b/c',
+          div_id: 'div-header',
+          targeting: {},
+        },
+      ],
+    };
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    document.getElementById('div-header')?.remove();
+    delete (window as TestWindow).tsjs;
+  });
+
+  function createTrustedSlotIframe(): Window {
+    const slot = document.createElement('div');
+    slot.id = 'div-header';
+    const iframe = document.createElement('iframe');
+    slot.appendChild(iframe);
+    document.body.appendChild(slot);
+    return iframe.contentWindow!;
+  }
+
+  it('calls stopImmediatePropagation and fetches PBS Cache for a TS bid', async () => {
+    const mockAd = '<div>Test Creative</div>';
+    fetchStub.mockResolvedValue({
+      ok: true,
+      text: () => Promise.resolve(mockAd),
+    } as Response);
+
+    // Capture the bridge's 'message' listener at module-init time.
+    let bridgeListener: ((e: MessageEvent) => unknown) | undefined;
+    const origAdd = window.addEventListener.bind(window);
+    const addSpy = vi
+      .spyOn(window, 'addEventListener')
+      .mockImplementation(
+        (type: string, handler: EventListenerOrEventListenerObject, opts?: unknown) => {
+          if (type === 'message') bridgeListener = handler as (e: MessageEvent) => unknown;
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          origAdd(type, handler as EventListener, opts as any);
+        }
+      );
+    await import('./index');
+    addSpy.mockRestore(); // Restore only addEventListener — fetchStub must stay stubbed
+
+    expect(bridgeListener, 'bridge listener should be registered').toBeDefined();
+
+    const stopSpy = vi.fn();
+    const portMessages: string[] = [];
+    const fakePort = { postMessage: (s: string) => portMessages.push(s) };
+    const source = createTrustedSlotIframe();
+
+    // Dispatch the fake event — bridge listener fires synchronously, then runs
+    // fire-and-forget fetch().then() chains asynchronously.
+    bridgeListener!(
+      Object.assign(new Event('message'), {
+        data: JSON.stringify({ message: 'Prebid Request', adId: 'test-cache-uuid' }),
+        ports: [fakePort],
+        source,
+        stopImmediatePropagation: stopSpy,
+      }) as unknown as MessageEvent
+    );
+
+    // Flush microtasks so the fetch mock resolves and .then chains fire.
+    await new Promise<void>((resolve) => setTimeout(resolve, 50));
+
+    expect(fetchStub).toHaveBeenCalledWith(
+      'https://openads.example.com/cache?uuid=test-cache-uuid',
+      { mode: 'cors' }
+    );
+    expect(stopSpy).toHaveBeenCalled();
+    expect(portMessages).toHaveLength(1);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const parsed = JSON.parse(portMessages[0]) as Record<string, any>;
+    expect(parsed.message).toBe('Prebid Response');
+    expect(parsed.adId).toBe('test-cache-uuid');
+    expect(parsed.ad).toBe(mockAd);
+  });
+
+  it('responds with adm without fetching PBS Cache when debug adm is available', async () => {
+    const debugAdm = '<div>Debug Creative</div>';
+    (window as TestWindow).tsjs = {
+      bids: {
+        homepage_header: {
+          hb_adid: 'debug-adid',
+          hb_bidder: 'mocktioneer',
+          hb_pb: '0.20',
+          adm: debugAdm,
+        },
+      },
+      adSlots: [
+        {
+          id: 'homepage_header',
+          formats: [[728, 90]] as [number, number][],
+          gam_unit_path: '/a/b/c',
+          div_id: 'div-header',
+          targeting: {},
+        },
+      ],
+    };
+
+    let bridgeListener: ((e: MessageEvent) => unknown) | undefined;
+    const origAdd = window.addEventListener.bind(window);
+    const addSpy = vi
+      .spyOn(window, 'addEventListener')
+      .mockImplementation(
+        (type: string, handler: EventListenerOrEventListenerObject, opts?: unknown) => {
+          if (type === 'message') bridgeListener = handler as (e: MessageEvent) => unknown;
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          origAdd(type, handler as EventListener, opts as any);
+        }
+      );
+    await import('./index');
+    addSpy.mockRestore();
+
+    expect(bridgeListener, 'bridge listener should be registered').toBeDefined();
+
+    const stopSpy = vi.fn();
+    const portMessages: string[] = [];
+    const fakePort = { postMessage: (s: string) => portMessages.push(s) };
+    const source = createTrustedSlotIframe();
+
+    bridgeListener!(
+      Object.assign(new Event('message'), {
+        data: JSON.stringify({ message: 'Prebid Request', adId: 'debug-adid' }),
+        ports: [fakePort],
+        source,
+        stopImmediatePropagation: stopSpy,
+      }) as unknown as MessageEvent
+    );
+
+    await new Promise<void>((resolve) => setTimeout(resolve, 50));
+
+    expect(fetchStub).not.toHaveBeenCalled();
+    expect(stopSpy).toHaveBeenCalled();
+    expect(portMessages).toHaveLength(1);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const parsed = JSON.parse(portMessages[0]) as Record<string, any>;
+    expect(parsed.message).toBe('Prebid Response');
+    expect(parsed.adId).toBe('debug-adid');
+    expect(parsed.ad).toBe(debugAdm);
+    expect(parsed.width).toBe(728);
+    expect(parsed.height).toBe(90);
+  });
+
+  it('ignores message when adId does not match any TS bid', async () => {
+    await import('./index');
+    fetchStub.mockResolvedValue({ ok: true, text: () => Promise.resolve('') } as Response);
+
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        data: JSON.stringify({ message: 'Prebid Request', adId: 'unknown-id' }),
+        ports: [],
+      })
+    );
+
+    await new Promise<void>((r) => setTimeout(r, 100));
+    expect(fetchStub).not.toHaveBeenCalled();
+  });
+
+  it('ignores matching adId messages from outside configured slot iframes', async () => {
+    await import('./index');
+    fetchStub.mockResolvedValue({ ok: true, text: () => Promise.resolve('') } as Response);
+
+    const foreignIframe = document.createElement('iframe');
+    document.body.appendChild(foreignIframe);
+    const portMessages: string[] = [];
+    const fakePort = { postMessage: (s: string) => portMessages.push(s) };
+    const stopSpy = vi.fn();
+
+    window.dispatchEvent(
+      new MessageEvent('message', {
+        data: JSON.stringify({ message: 'Prebid Request', adId: 'test-cache-uuid' }),
+        ports: [fakePort as MessagePort],
+        source: foreignIframe.contentWindow,
+      })
+    );
+
+    await new Promise<void>((r) => setTimeout(r, 50));
+    expect(fetchStub).not.toHaveBeenCalled();
+    expect(stopSpy).not.toHaveBeenCalled();
+    expect(portMessages).toHaveLength(0);
+    foreignIframe.remove();
+  });
+
+  it('ignores non-Prebid messages', async () => {
+    await import('./index');
+    window.dispatchEvent(
+      new MessageEvent('message', { data: JSON.stringify({ message: 'Other' }) })
+    );
+    await new Promise<void>((r) => setTimeout(r, 50));
+    expect(fetchStub).not.toHaveBeenCalled();
+  });
+});
diff --git a/crates/js/lib/src/integrations/gpt/index.ts b/crates/js/lib/src/integrations/gpt/index.ts
index 0b9e3023..21f1f120 100644
--- a/crates/js/lib/src/integrations/gpt/index.ts
+++ b/crates/js/lib/src/integrations/gpt/index.ts
@@ -1,4 +1,5 @@
 import { log } from '../../core/log';
+import type { AuctionSlot, AuctionBidData, TsjsApi } from '../../core/types';
 
 import { installGptGuard } from './script_guard';
 
@@ -23,6 +24,16 @@ import { installGptGuard } from './script_guard';
  *   - Rewrite ad-unit paths for A/B testing.
  */
 
+const TS_INITIAL_TARGETING_KEY = 'ts_initial' as const;
+const TS_BID_TARGETING_KEYS = [
+  'hb_pb',
+  'hb_bidder',
+  'hb_adid',
+  'hb_cache_host',
+  'hb_cache_path',
+] as const;
+const TS_BASE_TARGETING_KEYS = [...TS_BID_TARGETING_KEYS, TS_INITIAL_TARGETING_KEY] as const;
+
 // ------------------------------------------------------------------
 // googletag type stubs (minimal surface needed by the shim)
 // ------------------------------------------------------------------
@@ -31,12 +42,70 @@ interface GoogleTagSlot {
   getAdUnitPath(): string;
   getSlotElementId(): string;
   setTargeting(key: string, value: string | string[]): GoogleTagSlot;
+  clearTargeting?(key?: string): GoogleTagSlot;
+  addService(service: GoogleTagPubAdsService): GoogleTagSlot;
+  getTargeting?(key: string): string[];
+}
+
+interface SlotRenderEndedEvent {
+  isEmpty: boolean;
+  slot: GoogleTagSlot;
+}
+
+function findSlotElementByDivId(divId: string): HTMLElement | null {
+  const exact = document.getElementById(divId);
+  if (exact) return exact;
+
+  return (
+    Array.from(document.querySelectorAll<HTMLElement>('[id]')).find(
+      (el) => el.id.startsWith(divId) && !el.id.endsWith('-container')
+    ) ?? null
+  );
+}
+
+function candidateSlotRoots(divId: string): HTMLElement[] {
+  const roots: HTMLElement[] = [];
+  const slotEl = findSlotElementByDivId(divId);
+  if (slotEl) {
+    roots.push(slotEl);
+    const container = document.getElementById(`${slotEl.id}-container`);
+    if (container) roots.push(container);
+  }
+
+  const configuredContainer = document.getElementById(`${divId}-container`);
+  if (configuredContainer && !roots.includes(configuredContainer)) {
+    roots.push(configuredContainer);
+  }
+
+  return roots;
+}
+
+function messageSourceBelongsToConfiguredSlot(source: MessageEventSource | null): boolean {
+  if (!source) return false;
+
+  const slots = window.tsjs?.adSlots ?? [];
+  return slots.some((slot) =>
+    candidateSlotRoots(slot.div_id).some((root) =>
+      Array.from(root.querySelectorAll('iframe')).some((iframe) => iframe.contentWindow === source)
+    )
+  );
+}
+
+function clearTargetingKeys(slot: GoogleTagSlot, keys: Iterable<string>): void {
+  if (typeof slot.clearTargeting !== 'function') return;
+
+  for (const key of new Set(keys)) {
+    slot.clearTargeting(key);
+  }
 }
 
 interface GoogleTagPubAdsService {
   setTargeting(key: string, value: string | string[]): GoogleTagPubAdsService;
   getTargeting(key: string): string[];
   enableSingleRequest(): void;
+  addEventListener(event: string, fn: (e: SlotRenderEndedEvent) => void): void;
+  refresh(slots?: GoogleTagSlot[]): void;
+  getSlots?(): GoogleTagSlot[];
 }
 
 interface GoogleTag {
@@ -47,6 +116,7 @@ interface GoogleTag {
     size: Array<number | number[]>,
     elementId: string
   ): GoogleTagSlot | null;
+  destroySlots(slots?: GoogleTagSlot[]): boolean;
   enableServices(): void;
   display(elementId: string): void;
   _loaded_?: boolean;
@@ -54,6 +124,7 @@ interface GoogleTag {
 
 type GptWindow = Window & {
   googletag?: Partial<GoogleTag>;
+  __tsjs_slim_prebid_url?: string;
 };
 
 // ------------------------------------------------------------------
@@ -105,7 +176,8 @@ function wrapCommand(fn: () => void): () => void {
  */
 function patchCommandQueue(tag: Partial<GoogleTag>): void {
   // Ensure the queue exists.
-  if (!Array.isArray(tag.cmd)) {
+  if (!tag.cmd) {
+    // Cast through unknown so an array satisfies the { push } type.
     tag.cmd = [];
   }
 
@@ -121,7 +193,9 @@ function patchCommandQueue(tag: Partial<GoogleTag>): void {
 
   // Override push on the *existing* array — preserves object identity so
   // GPT (if already loaded) keeps its reference.
-  queue.push = function (...callbacks: Array<() => void>): number {
+  (queue as { push: (...cbs: Array<() => void>) => unknown }).push = function (
+    ...callbacks: Array<() => void>
+  ): unknown {
     const wrapped = callbacks.map(wrapCommand);
     return originalPush(...wrapped);
   };
@@ -130,11 +204,15 @@ function patchCommandQueue(tag: Partial<GoogleTag>): void {
   (queue as { __tsPushed?: boolean }).__tsPushed = true;
 
   // Re-wrap any callbacks that were queued before we patched.
-  for (let i = 0; i < queue.length; i++) {
-    queue[i] = wrapCommand(queue[i]);
+  // Only applicable when cmd is an array (pre-GPT-load case).
+  if (Array.isArray(queue)) {
+    for (let i = 0; i < queue.length; i++) {
+      queue[i] = wrapCommand(queue[i]);
+    }
+    log.debug('GPT shim: command queue patched', { pendingCommands: queue.length });
+  } else {
+    log.debug('GPT shim: command queue patched');
   }
-
-  log.debug('GPT shim: command queue patched', { pendingCommands: queue.length });
 }
 
 /**
@@ -161,6 +239,417 @@ export function installGptShim(): boolean {
   return true;
 }
 
+// ------------------------------------------------------------------
+// GAM interceptor (testing only)
+// ------------------------------------------------------------------
+
+/**
+ * Replace the GAM-rendered creative with the server-side auction adm.
+ *
+ * Adapted from PR #241 (github.com/IABTechLab/trusted-server/pull/241).
+ * Instead of reading from pbjs, reads adm directly from window.tsjs.bids.
+ * Only active when inject_adm_for_testing injects adm server-side.
+ *
+ * Strategy:
+ * 1. If adm contains an <iframe src="...">, set that src on the GAM iframe
+ *    directly — avoids cross-origin document access.
+ * 2. Otherwise replace the slot element's content with a srcdoc iframe.
+ */
+function injectAdmIntoSlot(divId: string, adm: string): void {
+  try {
+    // divId may be the container div (used by GPT slot) or the inner div.
+    // Search both so we can find the GAM iframe wherever it was rendered.
+    const slotEl = document.getElementById(divId);
+    if (!slotEl) return;
+
+    // Extract the first iframe src from the adm (e.g. mocktioneer creative
+    // wraps a first-party proxy iframe in a div).
+    const srcMatch = adm.match(/<iframe[^>]+\bsrc=["']([^"']+)["']/i);
+    const innerSrc = srcMatch?.[1];
+    const gamIframe = slotEl.querySelector('iframe') as HTMLIFrameElement | null;
+
+    if (innerSrc && gamIframe) {
+      // Set the GAM iframe src — works even cross-origin (no document access needed).
+      gamIframe.src = innerSrc.startsWith('//') ? `https:${innerSrc}` : innerSrc;
+      log.debug(`[tsjs-gpt] gam-intercept: set iframe src for '${divId}'`);
+    } else if (innerSrc) {
+      // GAM iframe not yet in DOM (APS renders async after slotRenderEnded).
+      // Retry on next animation frame so APS has a tick to insert its iframe;
+      // if it still isn't there, replace slot content directly.
+      requestAnimationFrame(() => {
+        const retryIframe = slotEl!.querySelector('iframe') as HTMLIFrameElement | null;
+        if (retryIframe) {
+          retryIframe.src = innerSrc.startsWith('//') ? `https:${innerSrc}` : innerSrc;
+          log.debug(`[tsjs-gpt] gam-intercept: set iframe src (retry) for '${divId}'`);
+        } else {
+          slotEl!.innerHTML = '';
+          const f = document.createElement('iframe');
+          f.style.cssText = 'border:none';
+          f.width = String(slotEl!.offsetWidth || 728);
+          f.height = String(slotEl!.offsetHeight || 90);
+          f.setAttribute('sandbox', 'allow-scripts allow-popups allow-forms allow-same-origin');
+          f.src = innerSrc.startsWith('//') ? `https:${innerSrc}` : innerSrc;
+          slotEl!.appendChild(f);
+          log.debug(`[tsjs-gpt] gam-intercept: inserted src iframe for '${divId}'`);
+        }
+      });
+    } else {
+      // No extractable src — replace slot content with a sandboxed srcdoc iframe.
+      slotEl.innerHTML = '';
+      const f = document.createElement('iframe');
+      f.style.border = 'none';
+      f.width = String(slotEl.offsetWidth || 728);
+      f.height = String(slotEl.offsetHeight || 90);
+      f.setAttribute('sandbox', 'allow-scripts allow-popups allow-forms allow-same-origin');
+      f.srcdoc = adm;
+      slotEl.appendChild(f);
+      log.debug(`[tsjs-gpt] gam-intercept: replaced slot content for '${divId}'`);
+    }
+  } catch (err) {
+    log.warn('[tsjs-gpt] gam-intercept: error injecting adm', err);
+  }
+}
+
+// ------------------------------------------------------------------
+// Trusted Server ad-init
+// ------------------------------------------------------------------
+
+/**
+ * Install `window.tsjs.adInit`.
+ *
+ * Reads `window.tsjs.adSlots` (injected at head-open) and `window.tsjs.bids`
+ * (injected before </body>) synchronously — no fetch, no Promise. Applies bid
+ * targeting to GPT slots, sets the `ts_initial` sentinel, registers
+ * `slotRenderEnded` to fire both nurl and burl via sendBeacon when our
+ * specific Prebid bid wins the GAM line item match, then calls refresh().
+ *
+ * Idempotent: destroys previously created TS-managed slots before redefining them,
+ * so it is safe to call again after SPA navigation updates `tsjs.adSlots`/`tsjs.bids`.
+ */
+export function installTsAdInit(): void {
+  const ts = (window.tsjs ??= {} as TsjsApi);
+  ts.adInit = function () {
+    const slots = ts.adSlots ?? [];
+    // Snapshot bids at adInit() call time — correct for targeting setup.
+    // The slotRenderEnded listener below reads ts.bids live so SPA navigation
+    // updates (new ts.bids injected before </body>) are picked up at render time.
+    const bids = ts.bids ?? {};
+    const g = (window as GptWindow).googletag;
+    if (!g) return;
+
+    g.cmd?.push(() => {
+      // Destroy previously defined TS slots before redefining for the new page.
+      if (ts.prevGptSlots && ts.prevGptSlots.length > 0) {
+        g.destroySlots?.(ts.prevGptSlots as GoogleTagSlot[]);
+        ts.prevGptSlots = [];
+      }
+
+      // Slots TS defined itself — tracked for SPA destroy. Publisher-owned
+      // slots are reused but never destroyed by TS on navigation.
+      const newSlots: GoogleTagSlot[] = [];
+      // All slots to refresh (TS-defined + publisher-owned reused).
+      const slotsToRefresh: GoogleTagSlot[] = [];
+      const divToSlotId: Record<string, string> = {};
+      const prevSlotTargetingKeys = ts.prevSlotTargetingKeys ?? {};
+      const nextSlotTargetingKeys: Record<string, string[]> = {};
+
+      slots.forEach((slot) => {
+        // Resolve actual div ID: exact match first, then prefix query.
+        // div_id in config may be a stable prefix (e.g. "ad-header-0-") when
+        // the suffix is dynamically generated by the framework at render time.
+        const el = findSlotElementByDivId(slot.div_id);
+        if (!el) return;
+        const actualDivId = el.id;
+        const bid = bids[slot.id] ?? {};
+
+        const existingSlot = g.pubads!()
+          .getSlots?.()
+          ?.find?.((s: GoogleTagSlot) => s.getSlotElementId() === actualDivId);
+        let gptSlot: GoogleTagSlot;
+        let tsOwned = false;
+        if (existingSlot) {
+          gptSlot = existingSlot;
+        } else {
+          // Use outer container div for TS's slot when publisher hasn't defined
+          // theirs yet — keeps both slots on separate divs so publisher's
+          // later defineSlot on the inner div doesn't conflict.
+          const containerEl = document.getElementById(`${actualDivId}-container`);
+          const slotDivId = containerEl?.id ?? actualDivId;
+          const defined = g.defineSlot?.(slot.gam_unit_path, slot.formats, slotDivId);
+          if (!defined) return;
+          defined.addService(g.pubads!());
+          gptSlot = defined;
+          tsOwned = true;
+        }
+
+        const slotDivId2 = gptSlot.getSlotElementId?.() ?? actualDivId;
+        clearTargetingKeys(gptSlot, [
+          ...TS_BASE_TARGETING_KEYS,
+          ...(prevSlotTargetingKeys[actualDivId] ?? []),
+          ...(prevSlotTargetingKeys[slotDivId2] ?? []),
+        ]);
+
+        Object.entries(slot.targeting ?? {}).forEach(([k, v]) => gptSlot.setTargeting(k, v));
+        TS_BID_TARGETING_KEYS.forEach((key) => {
+          if (bid[key]) gptSlot.setTargeting(key, String(bid[key]!));
+        });
+        gptSlot.setTargeting(TS_INITIAL_TARGETING_KEY, '1');
+        // Map both inner div and container div → slot ID so slotRenderEnded
+        // (which reports the GPT slot's div, i.e. slotDivId/container) can look up
+        // the slot, while adm injection (which targets the inner div) also works.
+        divToSlotId[actualDivId] = slot.id;
+        if (slotDivId2 !== actualDivId) divToSlotId[slotDivId2] = slot.id;
+        const slotTargetingKeys = Object.keys(slot.targeting ?? {});
+        nextSlotTargetingKeys[actualDivId] = slotTargetingKeys;
+        if (slotDivId2 !== actualDivId) nextSlotTargetingKeys[slotDivId2] = slotTargetingKeys;
+        if (tsOwned) newSlots.push(gptSlot);
+        slotsToRefresh.push(gptSlot);
+
+        // APS: signal to apstag that bids are ready so Amazon's GAM creative
+        // can render.  apstag must already be initialised on the page (which it
+        // is on production publisher pages).  Safe no-op if apstag is absent.
+        if (bid.hb_bidder === 'aps' || bid.hb_bidder === 'amazon-aps') {
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          (window as any).apstag?.setDisplayBids?.();
+        }
+      });
+
+      ts.prevGptSlots = newSlots as unknown[];
+      // Replace (not merge) so destroyed slots from previous navigation don't linger.
+      ts.divToSlotId = divToSlotId;
+      ts.prevSlotTargetingKeys = nextSlotTargetingKeys;
+
+      // enableSingleRequest and enableServices must only be called once per page load.
+      if (!ts.servicesEnabled) {
+        g.pubads!().enableSingleRequest();
+        g.enableServices?.();
+        ts.servicesEnabled = true;
+
+        g.pubads!().addEventListener?.('slotRenderEnded', (event: SlotRenderEndedEvent) => {
+          const divId: string = event.slot?.getSlotElementId?.() ?? '';
+          const slotId = (ts.divToSlotId ?? {})[divId];
+          if (!slotId) return;
+          // Read ts.bids live (not the snapshot above) so post-navigation bid data is used.
+          const bid = (ts.bids ?? {})[slotId] ?? {};
+          // Compare hb_adid targeting to verify the specific creative won.
+          const ourBidWon =
+            !event.isEmpty &&
+            !!bid.hb_adid &&
+            event.slot?.getTargeting?.('hb_adid')?.[0] === bid.hb_adid;
+          if (ourBidWon) {
+            if (bid.nurl) navigator.sendBeacon(bid.nurl);
+            if (bid.burl) navigator.sendBeacon(bid.burl);
+          }
+
+          // GAM interceptor (testing): when adm is present, replace the GAM creative.
+          // Adapted from PR #241 — uses window.tsjs.bids[slotId].adm instead of pbjs.
+          // Only active when inject_adm_for_testing injects adm into bids server-side.
+          if (bid.adm) {
+            injectAdmIntoSlot(divId, bid.adm);
+          }
+        });
+      }
+
+      if (slotsToRefresh.length > 0) {
+        g.pubads!().refresh(slotsToRefresh);
+      }
+    });
+  };
+}
+
+interface PageBidsResponse {
+  slots: AuctionSlot[];
+  bids: Record<string, AuctionBidData>;
+}
+
+/**
+ * Install SPA navigation hook.
+ *
+ * Patches `history.pushState` and `history.replaceState`, and listens to
+ * `popstate`, so that after each client-side route change the trusted server
+ * fetches fresh slots + bids from `/__ts/page-bids?path=<new_path>`, updates
+ * `window.tsjs.adSlots` / `window.tsjs.bids`, and calls `window.tsjs.adInit()`.
+ *
+ * Idempotent: guarded by `window.tsjs.spaHookInstalled` so multiple calls are safe.
+ */
+export function installSpaAuctionHook(): void {
+  if (typeof window === 'undefined') return;
+  const ts = (window.tsjs ??= {} as TsjsApi);
+  if (ts.spaHookInstalled) return;
+  ts.spaHookInstalled = true;
+
+  let inflight: AbortController | null = null;
+
+  async function onNavigate(path: string): Promise<void> {
+    inflight?.abort();
+    const controller = new AbortController();
+    inflight = controller;
+
+    try {
+      const res = await fetch(`/__ts/page-bids?path=${encodeURIComponent(path)}`, {
+        credentials: 'include',
+        signal: controller.signal,
+      });
+      if (!res.ok) return;
+      const data = (await res.json()) as PageBidsResponse;
+      if (inflight !== controller) return;
+      ts.adSlots = data.slots;
+      ts.bids = data.bids;
+      ts.adInit?.();
+    } catch (err) {
+      if (err instanceof DOMException && err.name === 'AbortError') return;
+      log.warn('SPA auction hook: fetch failed', err);
+    }
+  }
+
+  function patchHistoryMethod(method: 'pushState' | 'replaceState'): void {
+    const original = history[method].bind(history);
+    history[method] = function (state: unknown, unused: string, url?: string | URL | null): void {
+      const prevPath = location.pathname;
+      original(state, unused, url);
+      const newPath = url ? new URL(String(url), location.href).pathname : location.pathname;
+      if (newPath !== prevPath) {
+        void onNavigate(newPath);
+      }
+    };
+  }
+
+  patchHistoryMethod('pushState');
+  patchHistoryMethod('replaceState');
+
+  window.addEventListener('popstate', () => {
+    void onNavigate(location.pathname);
+  });
+}
+
+/**
+ * Register the slim-Prebid lazy loader. Fires after window.load — off the
+ * critical path. Slim-Prebid handles scroll/refresh auctions and userID
+ * module warm-up (ID5, sharedID, LiveRamp ATS, Lockr).
+ *
+ * Phase 1: no-op unless `window.__tsjs_slim_prebid_url` is set (the slim
+ * bundle build target ships in a later phase).
+ */
+export function installSlimPrebidLoader(): void {
+  const url = (window as GptWindow).__tsjs_slim_prebid_url;
+  if (!url) return;
+  window.addEventListener('load', () => {
+    const script = document.createElement('script');
+    script.src = url;
+    script.defer = true;
+    document.head.appendChild(script);
+  });
+}
+
+/** Minimal display renderer injected into the ad iframe by pbRender. */
+const TS_DISPLAY_RENDERER =
+  '(function(){window.render=function(d,h,w){' +
+  'var f=h.mkFrame(w.document,{width:d.width||"100%",height:d.height||"100%"});' +
+  'if(d.adUrl&&!d.ad){f.src=d.adUrl;}else{f.srcdoc=d.ad;}' +
+  'w.document.body.appendChild(f);};})();';
+
+/**
+ * Install the TS → pbRender bridge.
+ *
+ * Must be installed synchronously at module init — before `adInit()` fires
+ * `refresh()`, which triggers GAM to serve the Prebid creative. Installing
+ * post-load would miss first-impression `"Prebid Request"` messages.
+ *
+ * When `adId` matches a TS server-side bid in `window.tsjs.bids` AND the bid
+ * has renderable markup, the bridge:
+ *   1. Uses debug `adm` directly when present, otherwise fetches from PBS Cache.
+ *   2. Replies via the MessageChannel port with a `"Prebid Response"`.
+ *   3. Calls `stopImmediatePropagation()` so Prebid.js does not also process
+ *      the message and log spurious failures.
+ *
+ * Lives in gpt/index.ts (not prebid/index.ts) to avoid pulling the full
+ * Prebid bundle into tsjs-gpt.js via inlineDynamicImports.
+ */
+export function installTsRenderBridge(): void {
+  if (typeof window === 'undefined') return;
+
+  window.addEventListener('message', (e: MessageEvent) => {
+    let data: Record<string, unknown>;
+    try {
+      data =
+        typeof e.data === 'object'
+          ? (e.data as Record<string, unknown>)
+          : (JSON.parse(e.data as string) as Record<string, unknown>);
+    } catch {
+      return;
+    }
+
+    if (data['message'] !== 'Prebid Request') return;
+    const adId = data['adId'] as string | undefined;
+    if (!adId) return;
+
+    const port = e.ports?.[0];
+    if (!port) return;
+    if (!messageSourceBelongsToConfiguredSlot(e.source)) return;
+
+    // Build reverse map adId → slotId from live window.tsjs.bids.
+    const bids = window.tsjs?.bids ?? {};
+    let slotId: string | undefined;
+    let matchedBid: (typeof bids)[string] | undefined;
+    for (const [sid, bid] of Object.entries(bids)) {
+      if (bid.hb_adid === adId) {
+        slotId = sid;
+        matchedBid = bid;
+        break;
+      }
+    }
+
+    // Not a TS bid — let Prebid.js handle it.
+    if (!slotId || !matchedBid) return;
+
+    const slot = window.tsjs?.adSlots?.find((s) => s.id === slotId);
+    const [width, height] = slot?.formats?.[0] ?? [728, 90];
+
+    if (matchedBid.adm) {
+      e.stopImmediatePropagation();
+      port.postMessage(
+        JSON.stringify({
+          message: 'Prebid Response',
+          adId,
+          ad: matchedBid.adm,
+          renderer: TS_DISPLAY_RENDERER,
+          width,
+          height,
+        })
+      );
+      log.debug(`[tsjs-gpt] pbRender bridge served '${slotId}' from debug adm`);
+      return;
+    }
+
+    // No TS render source — let Prebid.js handle it.
+    if (!matchedBid.hb_cache_host || !matchedBid.hb_cache_path) return;
+
+    // TS owns this adId — stop Prebid from also processing it.
+    e.stopImmediatePropagation();
+
+    const cacheUrl = `https://${matchedBid.hb_cache_host}${matchedBid.hb_cache_path}?uuid=${encodeURIComponent(adId)}`;
+
+    fetch(cacheUrl, { mode: 'cors' })
+      .then((res) => (res.ok ? res.text() : Promise.reject(res.status)))
+      .then((ad) => {
+        port.postMessage(
+          JSON.stringify({
+            message: 'Prebid Response',
+            adId,
+            ad,
+            renderer: TS_DISPLAY_RENDERER,
+            width,
+            height,
+          })
+        );
+        log.debug(`[tsjs-gpt] pbRender bridge served '${slotId}' from PBS Cache`);
+      })
+      .catch((err) => {
+        log.warn(`[tsjs-gpt] pbRender bridge: PBS Cache fetch failed for '${slotId}'`, err);
+      });
+  });
+}
+
 // Register the activation function on `window` so the server-injected inline
 // script can call it explicitly. The server emits:
 //   <script>window.__tsjs_gpt_enabled=true;
@@ -170,11 +659,16 @@ export function installGptShim(): boolean {
 // regardless of script order, the module also checks for a pre-set enable flag
 // immediately after registering the function.
 if (typeof window !== 'undefined') {
-  const win = window as Record<string, unknown>;
+  const win = window as unknown as Record<string, unknown>;
 
   win.__tsjs_installGptShim = installGptShim;
 
   if (win.__tsjs_gpt_enabled === true) {
     installGptShim();
   }
+
+  installTsAdInit();
+  installSpaAuctionHook();
+  installSlimPrebidLoader();
+  installTsRenderBridge();
 }
diff --git a/crates/js/lib/src/integrations/prebid/index.ts b/crates/js/lib/src/integrations/prebid/index.ts
index 6038f42a..faa6ec04 100644
--- a/crates/js/lib/src/integrations/prebid/index.ts
+++ b/crates/js/lib/src/integrations/prebid/index.ts
@@ -32,12 +32,21 @@ import './_user_ids.generated';
 import { log } from '../../core/log';
 import { buildAdRequest, parseAuctionResponse } from '../../core/auction';
 import type { AuctionBid, AuctionEid } from '../../core/auction';
+import type { AuctionSlot } from '../../core/types';
 
 import { DEFAULT_PREBID_USER_ID_MODULES, PREBID_USER_ID_MODULE_REGISTRY } from './user_id_modules';
 
 const ADAPTER_CODE = 'trustedServer';
 const BIDDER_PARAMS_KEY = 'bidderParams';
 const ZONE_KEY = 'zone';
+const TS_REFRESH_TARGETING_KEYS = [
+  'ts_initial',
+  'hb_pb',
+  'hb_bidder',
+  'hb_adid',
+  'hb_cache_host',
+  'hb_cache_path',
+] as const;
 
 /** Configuration options for the Prebid integration. */
 export interface PrebidNpmConfig {
@@ -212,7 +221,13 @@ export function auctionBidsToPrebidBids(auctionBids: AuctionBid[], bidRequests:
 type PbjsConfig = Parameters<typeof pbjs.setConfig>[0];
 
 type TrustedServerBid = { bidder?: string; params?: Record<string, unknown> };
-type TrustedServerAdUnit = { code?: string; bids?: TrustedServerBid[] };
+type BannerSize = [number, number];
+type TrustedServerBanner = { sizes: BannerSize[]; name?: string };
+type TrustedServerAdUnit = {
+  code?: string;
+  mediaTypes?: { banner?: TrustedServerBanner };
+  bids?: TrustedServerBid[];
+};
 type TrustedServerBidRequest = {
   adUnitCode?: string;
   code?: string;
@@ -232,6 +247,18 @@ type PrebidUserIdEid = {
   uids?: Array<{ id?: unknown; atype?: unknown; ext?: unknown }>;
 };
 
+type RefreshGptSlot = {
+  getSlotElementId?: () => string;
+  getTargeting?: (key: string) => string[];
+  clearTargeting?: (key?: string) => RefreshGptSlot;
+  getSizes?: () => unknown[];
+};
+
+const DEFAULT_REFRESH_SIZES: BannerSize[] = [
+  [728, 90],
+  [300, 250],
+];
+
 function sanitizeAuctionUid(uid: {
   id?: unknown;
   atype?: unknown;
@@ -258,6 +285,71 @@ function isDefined<T>(value: T | undefined): value is T {
   return value !== undefined;
 }
 
+function isPositiveFiniteNumber(value: unknown): value is number {
+  return typeof value === 'number' && Number.isFinite(value) && value > 0;
+}
+
+function parseBannerSize(size: unknown): BannerSize | undefined {
+  if (Array.isArray(size) && isPositiveFiniteNumber(size[0]) && isPositiveFiniteNumber(size[1])) {
+    return [size[0], size[1]];
+  }
+
+  const gptSize = size as { getWidth?: () => unknown; getHeight?: () => unknown };
+  const width = gptSize?.getWidth?.();
+  const height = gptSize?.getHeight?.();
+  if (isPositiveFiniteNumber(width) && isPositiveFiniteNumber(height)) {
+    return [width, height];
+  }
+
+  return undefined;
+}
+
+function bannerSizesFromGptSlot(slot: RefreshGptSlot): BannerSize[] | undefined {
+  const sizes = slot.getSizes?.();
+  if (!Array.isArray(sizes)) {
+    return undefined;
+  }
+
+  const parsedSizes = sizes.map(parseBannerSize).filter(isDefined);
+  return parsedSizes.length > 0 ? parsedSizes : undefined;
+}
+
+function bannerSizesFromInjectedSlot(slot: AuctionSlot | undefined): BannerSize[] | undefined {
+  const parsedSizes = slot?.formats?.map(parseBannerSize).filter(isDefined) ?? [];
+  return parsedSizes.length > 0 ? parsedSizes : undefined;
+}
+
+function refreshSlotElementId(slot: RefreshGptSlot): string | undefined {
+  const elementId = slot.getSlotElementId?.();
+  return elementId && elementId.length > 0 ? elementId : undefined;
+}
+
+function findInjectedSlotForRefresh(slot: RefreshGptSlot): AuctionSlot | undefined {
+  const elementId = refreshSlotElementId(slot);
+  if (!elementId) {
+    return undefined;
+  }
+
+  return window.tsjs?.adSlots?.find(
+    (adSlot) =>
+      elementId === adSlot.div_id ||
+      elementId === `${adSlot.div_id}-container` ||
+      elementId.startsWith(adSlot.div_id)
+  );
+}
+
+function firstTargetingValue(values: string[] | undefined): string | undefined {
+  return values?.find((value) => value.length > 0);
+}
+
+function clearRefreshTargeting(slot: RefreshGptSlot): void {
+  if (typeof slot.clearTargeting !== 'function') return;
+
+  for (const key of TS_REFRESH_TARGETING_KEYS) {
+    slot.clearTargeting(key);
+  }
+}
+
 function collectAuctionEids(): AuctionEid[] | undefined {
   if (typeof pbjs.getUserIdsAsEids !== 'function') {
     return undefined;
@@ -486,6 +578,128 @@ export function installPrebidNpm(config?: Partial<PrebidNpmConfig>): typeof pbjs
   return pbjs;
 }
 
+// ─── Phase B: GPT scroll/refresh auction handler ──────────────────────────
+
+/**
+ * Install the scroll/refresh auction handler.
+ *
+ * Wraps `googletag.pubads().refresh()` so that when the publisher's GPT
+ * refresh policy fires (sticky anchor, viewability dwell, infinite scroll),
+ * Prebid runs a fresh client-side auction for the refreshing slots before
+ * the GAM call. TS-owned first-impression slots (`ts_initial=1`) are included
+ * on later publisher refreshes, but stale TS server-side targeting is cleared
+ * before fresh Prebid targeting is applied.
+ *
+ * Must be called after `installPrebidNpm()` and after GPT is loaded.
+ * Idempotent: safe to call multiple times — wraps only once via a sentinel.
+ */
+export function installRefreshHandler(timeoutMs = 1500): void {
+  if (typeof window === 'undefined') return;
+  const g = (
+    window as unknown as {
+      googletag?: {
+        cmd?: { push(fn: () => void): void };
+        pubads?(): {
+          refresh(slots?: unknown[], opts?: unknown): void;
+          getTargeting?(key: string): string[];
+        };
+      };
+    }
+  ).googletag;
+  if (!g?.cmd) return;
+
+  g.cmd.push(() => {
+    const pubads = g.pubads?.();
+    if (!pubads || (pubads as { __tsRefreshWrapped?: boolean }).__tsRefreshWrapped) return;
+    (pubads as { __tsRefreshWrapped?: boolean }).__tsRefreshWrapped = true;
+
+    const originalRefresh = pubads.refresh.bind(pubads);
+    pubads.refresh = function (slots?: unknown[], opts?: unknown) {
+      // For bare refresh() calls (no slots arg), get all registered slots from GPT
+      // so we can auction the same concrete slot list and avoid stale targeting.
+      const targetSlots = (
+        slots ??
+        (pubads as { getSlots?: () => unknown[] }).getSlots?.() ??
+        []
+      ).filter((slot): slot is RefreshGptSlot => typeof slot === 'object' && slot !== null);
+
+      if (!targetSlots.length) {
+        return originalRefresh(slots, opts);
+      }
+
+      targetSlots.forEach(clearRefreshTargeting);
+
+      const adUnits = targetSlots.map((slot) => {
+        const injectedSlot = findInjectedSlotForRefresh(slot);
+        const zone =
+          injectedSlot?.targeting?.[ZONE_KEY] ?? firstTargetingValue(slot.getTargeting?.(ZONE_KEY));
+        const banner: TrustedServerBanner = {
+          sizes:
+            bannerSizesFromInjectedSlot(injectedSlot) ??
+            bannerSizesFromGptSlot(slot) ??
+            DEFAULT_REFRESH_SIZES,
+          ...(zone ? { name: zone } : {}),
+        };
+
+        return {
+          code: refreshSlotElementId(slot) ?? 'refresh-slot',
+          mediaTypes: { banner },
+          bids: [{ bidder: ADAPTER_CODE, params: zone ? { [ZONE_KEY]: zone } : {} }],
+        };
+      });
+
+      pbjs.requestBids({
+        adUnits,
+        bidsBackHandler: () => {
+          pbjs.setTargetingForGPTAsync?.();
+          originalRefresh(targetSlots, opts);
+        },
+        timeout: timeoutMs,
+      });
+    };
+
+    log.info('[tsjs-prebid] GPT refresh handler installed');
+  });
+}
+
+/**
+ * Configure Prebid.js userID modules for identity warm-up.
+ *
+ * Runs post-window.load (called from installPrebidNpm after setup).
+ * Writes identity tokens to 1P cookies so the next server-side request
+ * can harvest them for EC graph enrichment.
+ *
+ * **Current state:** This function only configures `pbjs.userSync` settings.
+ * It does NOT import or register any userID modules. Actual module imports
+ * (ID5, sharedID, LiveRamp ATS, Lockr) must be added to this bundle explicitly
+ * — there is currently no `_userIdModules.generated.ts` build step.
+ * Track as Phase B follow-up: add `TSJS_PREBID_USER_ID_MODULES` handling to
+ * `build-all.mjs` (similar to `TSJS_PREBID_ADAPTERS`) and import generated file.
+ */
+export function installUserIdModules(): void {
+  // NOTE: No userID module imports exist yet. `_userIdModules.generated.ts` and
+  // `TSJS_PREBID_USER_ID_MODULES` handling in `build-all.mjs` are not implemented.
+  // This function only configures pbjs.userSync settings; actual module registration
+  // requires the Phase B follow-up described in the docblock above.
+  // Configure sync behavior so modules will run post-window.load when added.
+  try {
+    pbjs.setConfig({
+      userSync: {
+        syncEnabled: true,
+        filterSettings: {
+          all: { bidders: '*', filter: 'include' },
+        },
+        auctionDelay: 0,
+        syncsPerBidder: 5,
+        syncDelay: 3000,
+      },
+    });
+    log.info('[tsjs-prebid] userID modules configured');
+  } catch {
+    // pbjs not ready — userID modules will use defaults
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Prebid EID cookie sync
 // ---------------------------------------------------------------------------
@@ -562,6 +776,10 @@ function syncPrebidEidsCookie(): void {
 // Self-initialize when loaded in a browser (same pattern as other integrations).
 if (typeof window !== 'undefined') {
   installPrebidNpm();
+  installRefreshHandler();
+  window.addEventListener('load', () => {
+    installUserIdModules();
+  });
 }
 
 export { pbjs };
diff --git a/crates/js/lib/test/integrations/gpt/index.test.ts b/crates/js/lib/test/integrations/gpt/index.test.ts
index 57c4015d..08cedfc3 100644
--- a/crates/js/lib/test/integrations/gpt/index.test.ts
+++ b/crates/js/lib/test/integrations/gpt/index.test.ts
@@ -165,6 +165,154 @@ describe('GPT shim – patchCommandQueue', () => {
   });
 });
 
+describe('GPT – installSlimPrebidLoader', () => {
+  type SlimWindow = Window & { __tsjs_slim_prebid_url?: string };
+
+  afterEach(() => {
+    delete (window as SlimWindow).__tsjs_slim_prebid_url;
+  });
+
+  it('is a no-op when __tsjs_slim_prebid_url is not set', async () => {
+    const { installSlimPrebidLoader } = await import('../../../src/integrations/gpt/index');
+    const addEventListenerSpy = vi.spyOn(window, 'addEventListener');
+    installSlimPrebidLoader();
+    expect(addEventListenerSpy).not.toHaveBeenCalledWith('load', expect.any(Function));
+    addEventListenerSpy.mockRestore();
+  });
+
+  it('appends a deferred script tag when __tsjs_slim_prebid_url is set and load fires', async () => {
+    (window as SlimWindow).__tsjs_slim_prebid_url = 'https://cdn.example.com/slim-prebid.js';
+    const { installSlimPrebidLoader } = await import('../../../src/integrations/gpt/index');
+
+    installSlimPrebidLoader();
+
+    // Simulate the window load event.
+    window.dispatchEvent(new Event('load'));
+
+    const scripts = Array.from(document.querySelectorAll('script[defer]'));
+    const injected = scripts.find(
+      (s) => (s as HTMLScriptElement).src === 'https://cdn.example.com/slim-prebid.js'
+    );
+    expect(injected).toBeDefined();
+
+    // Clean up
+    injected?.parentNode?.removeChild(injected);
+  });
+
+  it('module init calls installSlimPrebidLoader — script injected when URL is preset', async () => {
+    vi.resetModules();
+    (window as SlimWindow).__tsjs_slim_prebid_url = 'https://cdn.example.com/slim-prebid-init.js';
+
+    await import('../../../src/integrations/gpt/index');
+    window.dispatchEvent(new Event('load'));
+
+    const scripts = Array.from(document.querySelectorAll('script[defer]'));
+    const injected = scripts.find(
+      (s) => (s as HTMLScriptElement).src === 'https://cdn.example.com/slim-prebid-init.js'
+    );
+    expect(injected).toBeDefined();
+
+    injected?.parentNode?.removeChild(injected);
+  });
+});
+
+describe('GPT – installTsAdInit', () => {
+  beforeEach(() => {
+    document.body.innerHTML = '';
+    delete (window as any).tsjs;
+    delete (window as any).googletag;
+  });
+
+  afterEach(() => {
+    document.body.innerHTML = '';
+    delete (window as any).tsjs;
+    delete (window as any).googletag;
+  });
+
+  it('clears stale TS-managed targeting before applying a new route to a reused GPT slot', async () => {
+    const { installTsAdInit } = await import('../../../src/integrations/gpt/index');
+    const slotTargeting = new Map<string, string[]>([
+      ['hb_pb', ['1.20']],
+      ['hb_bidder', ['kargo']],
+      ['hb_adid', ['old-ad']],
+      ['hb_cache_host', ['cache.example.com']],
+      ['hb_cache_path', ['/cache']],
+      ['ts_initial', ['1']],
+      ['pos', ['old-pos']],
+    ]);
+    const gptSlot: any = {
+      getSlotElementId: vi.fn(() => 'div-ad-homepage-header'),
+      getTargeting: vi.fn((key: string) => slotTargeting.get(key) ?? []),
+      setTargeting: vi.fn((key: string, value: string | string[]) => {
+        slotTargeting.set(key, Array.isArray(value) ? value : [value]);
+        return gptSlot;
+      }),
+      clearTargeting: vi.fn((key?: string) => {
+        if (key) {
+          slotTargeting.delete(key);
+        } else {
+          slotTargeting.clear();
+        }
+        return gptSlot;
+      }),
+    };
+    const pubads = {
+      getSlots: vi.fn(() => [gptSlot]),
+      enableSingleRequest: vi.fn(),
+      addEventListener: vi.fn(),
+      refresh: vi.fn(),
+    };
+    const cmd: Array<() => void> = [];
+    cmd.push = (...callbacks: Array<() => void>) => {
+      callbacks.forEach((callback) => callback());
+      return cmd.length;
+    };
+
+    document.body.innerHTML = '<div id="div-ad-homepage-header"></div>';
+    (window as any).googletag = {
+      cmd,
+      pubads: () => pubads,
+      defineSlot: vi.fn(),
+      destroySlots: vi.fn(),
+      enableServices: vi.fn(),
+    };
+    (window as any).tsjs = {
+      prevSlotTargetingKeys: {
+        'div-ad-homepage-header': ['pos'],
+      },
+      adSlots: [
+        {
+          id: 'homepage_header_ad',
+          gam_unit_path: '/123/homepage',
+          div_id: 'div-ad-homepage-header',
+          formats: [[728, 90]],
+          targeting: { zone: 'homepage' },
+        },
+      ],
+      bids: {},
+    };
+
+    installTsAdInit();
+    (window as any).tsjs.adInit();
+
+    expect(gptSlot.clearTargeting).toHaveBeenCalledWith('hb_pb');
+    expect(gptSlot.clearTargeting).toHaveBeenCalledWith('hb_bidder');
+    expect(gptSlot.clearTargeting).toHaveBeenCalledWith('hb_adid');
+    expect(gptSlot.clearTargeting).toHaveBeenCalledWith('hb_cache_host');
+    expect(gptSlot.clearTargeting).toHaveBeenCalledWith('hb_cache_path');
+    expect(gptSlot.clearTargeting).toHaveBeenCalledWith('ts_initial');
+    expect(gptSlot.clearTargeting).toHaveBeenCalledWith('pos');
+    expect(slotTargeting.get('hb_pb')).toBeUndefined();
+    expect(slotTargeting.get('hb_bidder')).toBeUndefined();
+    expect(slotTargeting.get('hb_adid')).toBeUndefined();
+    expect(slotTargeting.get('hb_cache_host')).toBeUndefined();
+    expect(slotTargeting.get('hb_cache_path')).toBeUndefined();
+    expect(slotTargeting.get('pos')).toBeUndefined();
+    expect(slotTargeting.get('zone')).toEqual(['homepage']);
+    expect(slotTargeting.get('ts_initial')).toEqual(['1']);
+  });
+});
+
 describe('GPT shim – runtime gating', () => {
   type GatedWindow = Window & {
     __tsjs_gpt_enabled?: boolean;
diff --git a/crates/js/lib/test/integrations/prebid/index.test.ts b/crates/js/lib/test/integrations/prebid/index.test.ts
index f12345d2..18f8dd8c 100644
--- a/crates/js/lib/test/integrations/prebid/index.test.ts
+++ b/crates/js/lib/test/integrations/prebid/index.test.ts
@@ -62,6 +62,7 @@ import {
   getInjectedConfig,
   auctionBidsToPrebidBids,
   installPrebidNpm,
+  installRefreshHandler,
 } from '../../../src/integrations/prebid/index';
 import type { AuctionBid } from '../../../src/core/auction';
 
@@ -765,6 +766,155 @@ describe('prebid/installPrebidNpm with server-injected config', () => {
   });
 });
 
+describe('prebid/installRefreshHandler', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockRequestBids.mockReset();
+    mockPbjs.requestBids = mockRequestBids;
+    mockPbjs.adUnits = [];
+    (window as any).tsjs = undefined;
+    delete (window as any).googletag;
+  });
+
+  afterEach(() => {
+    (window as any).tsjs = undefined;
+    delete (window as any).googletag;
+  });
+
+  it('builds refresh ad units from injected slot metadata', () => {
+    const originalRefresh = vi.fn();
+    const gptSlot = {
+      getSlotElementId: vi.fn(() => 'div-ad-homepage-header'),
+      getTargeting: vi.fn(() => []),
+    };
+    const pubads = {
+      refresh: originalRefresh,
+      getSlots: vi.fn(() => [gptSlot]),
+    };
+    (window as any).googletag = {
+      cmd: { push: (fn: () => void) => fn() },
+      pubads: () => pubads,
+    };
+    (window as any).tsjs = {
+      adSlots: [
+        {
+          id: 'homepage_header_ad',
+          gam_unit_path: '/123/homepage',
+          div_id: 'div-ad-homepage-header',
+          formats: [
+            [970, 250],
+            [728, 90],
+          ],
+          targeting: { zone: 'homepage', pos: 'atf' },
+        },
+      ],
+    };
+
+    installRefreshHandler(750);
+    pubads.refresh();
+
+    expect(mockRequestBids).toHaveBeenCalledWith(
+      expect.objectContaining({
+        timeout: 750,
+        adUnits: [
+          expect.objectContaining({
+            code: 'div-ad-homepage-header',
+            mediaTypes: {
+              banner: {
+                name: 'homepage',
+                sizes: [
+                  [970, 250],
+                  [728, 90],
+                ],
+              },
+            },
+            bids: [{ bidder: 'trustedServer', params: { zone: 'homepage' } }],
+          }),
+        ],
+      })
+    );
+  });
+
+  it('auctions refreshed TS initial slots and clears stale TS targeting before refresh', () => {
+    const originalRefresh = vi.fn();
+    const clearTargeting = vi.fn();
+    const gptSlot = {
+      getSlotElementId: vi.fn(() => 'div-ad-homepage-header'),
+      getTargeting: vi.fn((key: string) => {
+        if (key === 'ts_initial') return ['1'];
+        if (key === 'zone') return ['homepage'];
+        return [];
+      }),
+      getSizes: vi.fn(() => [
+        { getWidth: () => 970, getHeight: () => 250 },
+        { getWidth: () => 728, getHeight: () => 90 },
+      ]),
+      clearTargeting,
+    };
+    const pubads = {
+      refresh: originalRefresh,
+      getSlots: vi.fn(() => [gptSlot]),
+    };
+    const setTargetingForGPTAsync = vi.fn();
+    (mockPbjs as any).setTargetingForGPTAsync = setTargetingForGPTAsync;
+    (window as any).googletag = {
+      cmd: { push: (fn: () => void) => fn() },
+      pubads: () => pubads,
+    };
+    (window as any).tsjs = {
+      adSlots: [
+        {
+          id: 'homepage_header_ad',
+          gam_unit_path: '/123/homepage',
+          div_id: 'div-ad-homepage-header',
+          formats: [
+            [970, 250],
+            [728, 90],
+          ],
+          targeting: { zone: 'homepage' },
+        },
+      ],
+    };
+
+    installRefreshHandler(750);
+    pubads.refresh([gptSlot]);
+
+    expect(mockRequestBids).toHaveBeenCalledWith(
+      expect.objectContaining({
+        timeout: 750,
+        adUnits: [
+          expect.objectContaining({
+            code: 'div-ad-homepage-header',
+            mediaTypes: {
+              banner: {
+                name: 'homepage',
+                sizes: [
+                  [970, 250],
+                  [728, 90],
+                ],
+              },
+            },
+            bids: [{ bidder: 'trustedServer', params: { zone: 'homepage' } }],
+          }),
+        ],
+      })
+    );
+    expect(clearTargeting).toHaveBeenCalledWith('ts_initial');
+    expect(clearTargeting).toHaveBeenCalledWith('hb_pb');
+    expect(clearTargeting).toHaveBeenCalledWith('hb_bidder');
+    expect(clearTargeting).toHaveBeenCalledWith('hb_adid');
+    expect(clearTargeting).toHaveBeenCalledWith('hb_cache_host');
+    expect(clearTargeting).toHaveBeenCalledWith('hb_cache_path');
+    expect(originalRefresh).not.toHaveBeenCalled();
+
+    const bidsBackHandler = mockRequestBids.mock.calls[0][0].bidsBackHandler;
+    bidsBackHandler();
+
+    expect(setTargetingForGPTAsync).toHaveBeenCalled();
+    expect(originalRefresh).toHaveBeenCalledWith([gptSlot], undefined);
+  });
+});
+
 describe('prebid/client-side bidders', () => {
   beforeEach(() => {
     vi.clearAllMocks();
diff --git a/crates/trusted-server-adapter-fastly/Cargo.toml b/crates/trusted-server-adapter-fastly/Cargo.toml
index e483ea62..a730efcd 100644
--- a/crates/trusted-server-adapter-fastly/Cargo.toml
+++ b/crates/trusted-server-adapter-fastly/Cargo.toml
@@ -20,6 +20,7 @@ log = { workspace = true }
 log-fastly = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
+toml = { workspace = true }
 trusted-server-core = { workspace = true }
 urlencoding = { workspace = true }
 
diff --git a/crates/trusted-server-adapter-fastly/src/main.rs b/crates/trusted-server-adapter-fastly/src/main.rs
index 7f97cada..884f2c15 100644
--- a/crates/trusted-server-adapter-fastly/src/main.rs
+++ b/crates/trusted-server-adapter-fastly/src/main.rs
@@ -31,7 +31,8 @@ use trusted_server_core::proxy::{
     handle_first_party_proxy_sign,
 };
 use trusted_server_core::publisher::{
-    handle_publisher_request, handle_tsjs_dynamic, stream_publisher_body, PublisherResponse,
+    handle_page_bids, handle_publisher_request, handle_tsjs_dynamic, stream_publisher_body_async,
+    PublisherResponse,
 };
 use trusted_server_core::request_signing::{
     handle_deactivate_key, handle_rotate_key, handle_trusted_server_discovery,
@@ -129,6 +130,7 @@ fn main() -> Result<(), Error> {
         &integration_registry,
         &partner_registry,
         &runtime_services,
+        settings.creative_opportunity_slots(),
         req,
     ))?;
 
@@ -202,6 +204,7 @@ async fn route_request(
     integration_registry: &IntegrationRegistry,
     partner_registry: &PartnerRegistry,
     runtime_services: &RuntimeServices,
+    slots: &[trusted_server_core::creative_opportunities::CreativeOpportunitySlot],
     mut req: Request,
 ) -> Result<RouteOutcome, Error> {
     // Strip client-spoofable forwarded headers at the edge.
@@ -325,6 +328,12 @@ async fn route_request(
     let path = req.get_path().to_string();
     let method = req.get_method().clone();
 
+    let registry_ref = if partner_registry.is_empty() {
+        None
+    } else {
+        Some(partner_registry)
+    };
+
     // Match known routes and handle them
     let (result, organic_route) = match (method, path.as_str()) {
         // Serve the tsjs library
@@ -365,26 +374,34 @@ async fn route_request(
         }
 
         // Unified auction endpoint (returns creative HTML inline)
-        (Method::POST, "/auction") => {
-            let registry_ref = if partner_registry.is_empty() {
-                None
-            } else {
-                Some(partner_registry)
-            };
-            (
-                handle_auction(
-                    settings,
-                    orchestrator,
-                    kv_graph.as_ref(),
-                    registry_ref,
-                    &ec_context,
-                    runtime_services,
-                    req,
-                )
-                .await,
-                false,
+        (Method::POST, "/auction") => (
+            handle_auction(
+                settings,
+                orchestrator,
+                kv_graph.as_ref(),
+                registry_ref,
+                &ec_context,
+                runtime_services,
+                req,
             )
-        }
+            .await,
+            false,
+        ),
+
+        // SPA/CSR navigation endpoint — returns slots + bids JSON for the given path
+        (Method::GET, "/__ts/page-bids") => (
+            handle_page_bids(
+                settings,
+                orchestrator,
+                runtime_services,
+                kv_graph.as_ref(),
+                registry_ref,
+                slots,
+                req,
+            )
+            .await,
+            false,
+        ),
 
         // tsjs endpoints
         (Method::GET, "/first-party/proxy") => {
@@ -431,12 +448,19 @@ async fn route_request(
                 runtime_services,
                 kv_graph.as_ref(),
                 &mut ec_context,
+                trusted_server_core::publisher::AuctionDispatch {
+                    orchestrator,
+                    slots,
+                    registry: registry_ref,
+                },
                 req,
-            ) {
+            )
+            .await
+            {
                 Ok(PublisherResponse::Stream {
                     mut response,
                     body,
-                    params,
+                    mut params,
                 }) => {
                     // Publisher fallback has multiple delivery modes.
                     // EC finalization is header-only, so it must happen before
@@ -454,13 +478,17 @@ async fn route_request(
 
                     let mut streaming_body = response.stream_to_client();
                     let mut stream_succeeded = false;
-                    if let Err(err) = stream_publisher_body(
+                    if let Err(err) = stream_publisher_body_async(
                         body,
                         &mut streaming_body,
-                        &params,
+                        &mut params,
                         settings,
                         integration_registry,
-                    ) {
+                        orchestrator,
+                        runtime_services,
+                    )
+                    .await
+                    {
                         // Headers are already committed. Log and abort rather
                         // than trying to replace the response mid-stream.
                         log::error!("Streaming processing failed: {err:?}");
@@ -575,6 +603,16 @@ fn finalize_response(settings: &Settings, geo_info: Option<&GeoInfo>, response:
     }
 
     for (key, value) in &settings.response_headers {
+        // Never overwrite a privacy-critical Cache-Control header (private, no-store, etc.)
+        // that was set for per-user responses (HTML or page-bids).
+        if **key == header::CACHE_CONTROL
+            && response
+                .get_header(header::CACHE_CONTROL)
+                .and_then(|v| v.to_str().ok())
+                .is_some_and(|v| v.contains("private"))
+        {
+            continue;
+        }
         response.set_header(key, value);
     }
 }
diff --git a/crates/trusted-server-adapter-fastly/src/route_tests.rs b/crates/trusted-server-adapter-fastly/src/route_tests.rs
index 9aa4c54a..ed8b250a 100644
--- a/crates/trusted-server-adapter-fastly/src/route_tests.rs
+++ b/crates/trusted-server-adapter-fastly/src/route_tests.rs
@@ -19,6 +19,16 @@ use trusted_server_core::settings::Settings;
 
 use super::route_request;
 
+#[test]
+fn streaming_publisher_path_uses_async_auction_collector() {
+    let router_source = include_str!("main.rs");
+
+    assert!(
+        router_source.contains("stream_publisher_body_async("),
+        "streaming publisher responses must collect dispatched auctions before </body> injection"
+    );
+}
+
 struct StubJwksConfigStore;
 
 impl PlatformConfigStore for StubJwksConfigStore {
@@ -193,6 +203,7 @@ fn routes_use_request_local_consent() {
         &integration_registry,
         &partner_registry,
         &discovery_services,
+        &[],
         discovery_req,
     ))
     .expect("should route discovery request");
@@ -213,6 +224,7 @@ fn routes_use_request_local_consent() {
         &integration_registry,
         &partner_registry,
         &admin_services,
+        &[],
         admin_req,
     ))
     .expect("should route admin request");
diff --git a/crates/trusted-server-core/Cargo.toml b/crates/trusted-server-core/Cargo.toml
index 95ef3a03..fe999fc3 100644
--- a/crates/trusted-server-core/Cargo.toml
+++ b/crates/trusted-server-core/Cargo.toml
@@ -25,6 +25,7 @@ error-stack = { workspace = true }
 fastly = { workspace = true }
 flate2 = { workspace = true }
 futures = { workspace = true }
+glob = { workspace = true }
 hex = { workspace = true }
 hmac = { workspace = true }
 http = { workspace = true }
diff --git a/crates/trusted-server-core/build.rs b/crates/trusted-server-core/build.rs
index 6f56e85a..a0cc07b3 100644
--- a/crates/trusted-server-core/build.rs
+++ b/crates/trusted-server-core/build.rs
@@ -3,6 +3,19 @@
 // in the build context, so `dead_code` is expected.
 #![allow(clippy::unwrap_used, clippy::panic, dead_code)]
 
+// Stub out dependencies for build.rs context
+mod glob {
+    pub struct Pattern;
+    impl Pattern {
+        pub fn new(_: &str) -> Result<Self, String> {
+            Ok(Pattern)
+        }
+        pub fn matches(&self, _: &str) -> bool {
+            false
+        }
+    }
+}
+
 #[path = "src/error.rs"]
 mod error;
 
@@ -15,6 +28,51 @@ mod redacted;
 #[path = "src/consent_config.rs"]
 mod consent_config;
 
+#[path = "src/price_bucket.rs"]
+mod price_bucket;
+
+// CreativeOpportunitiesConfig for build.rs deserialization only
+mod creative_opportunities {
+    use serde::{Deserialize, Serialize};
+
+    /// Stub slot type — only used so settings.rs compiles in the build context.
+    #[derive(Debug, Clone, Deserialize, Serialize)]
+    pub struct CreativeOpportunitySlot {
+        pub id: String,
+    }
+
+    #[derive(Debug, Clone, Deserialize, Serialize)]
+    pub struct CreativeOpportunitiesConfig {
+        pub gam_network_id: String,
+        #[serde(default)]
+        pub auction_timeout_ms: Option<u32>,
+        #[serde(default = "default_price_granularity")]
+        pub price_granularity: String,
+        /// Deserialized as raw JSON values so build.rs can validate slot IDs
+        /// without pulling in the full runtime type. Uses `vec_from_seq_or_map`
+        /// so env var JSON blobs (strings) deserialize correctly.
+        #[serde(
+            default,
+            rename = "slot",
+            deserialize_with = "crate::settings::vec_from_seq_or_map"
+        )]
+        pub slot_raw: Vec<serde_json::Value>,
+        /// Typed slot vec — always empty in the build context; exists only so
+        /// settings.rs (included via #[path]) compiles against the stub.
+        #[serde(skip)]
+        pub slot: Vec<CreativeOpportunitySlot>,
+    }
+
+    impl CreativeOpportunitiesConfig {
+        /// No-op stub — pattern compilation only runs at runtime.
+        pub fn compile_slots(&mut self) {}
+    }
+
+    fn default_price_granularity() -> String {
+        "dense".to_string()
+    }
+}
+
 #[path = "src/settings.rs"]
 mod settings;
 
@@ -51,4 +109,30 @@ fn main() {
         fs::write(dest_path, merged_toml)
             .unwrap_or_else(|_| panic!("Failed to write {dest_path:?}"));
     }
+
+    // Validate slot IDs from [creative_opportunities.slot] in trusted-server.toml
+    let slot_id_re = regex::Regex::new(r"^[A-Za-z0-9_\-]+$").expect("should compile regex");
+    if let Some(co) = &settings.creative_opportunities {
+        for slot in &co.slot_raw {
+            if let Some(id) = slot.get("id").and_then(|v| v.as_str()) {
+                if !slot_id_re.is_match(id) {
+                    panic!(
+                        "trusted-server.toml [creative_opportunities.slot]: slot id '{}' is invalid; \
+                         only [A-Za-z0-9_-] allowed",
+                        id
+                    );
+                }
+            } else {
+                panic!(
+                    "trusted-server.toml [creative_opportunities.slot]: a slot entry is missing the required 'id' field"
+                );
+            }
+        }
+        if !co.slot_raw.is_empty() {
+            println!(
+                "cargo:warning=creative_opportunities: {} slot(s) validated",
+                co.slot_raw.len()
+            );
+        }
+    }
 }
diff --git a/crates/trusted-server-core/src/auction/endpoints.rs b/crates/trusted-server-core/src/auction/endpoints.rs
index d175be9f..f1c010de 100644
--- a/crates/trusted-server-core/src/auction/endpoints.rs
+++ b/crates/trusted-server-core/src/auction/endpoints.rs
@@ -34,11 +34,62 @@ const MAX_CLIENT_EID_SOURCE_BYTES: usize = 255;
 /// arbitrary WASM linear memory.
 const MAX_AUCTION_BODY_SIZE: usize = 256 * 1024;
 
-/// Handle auction request from /auction endpoint.
+/// Handle auction request from `POST /auction`.
 ///
-/// This is the main entry point for running header bidding auctions.
-/// It orchestrates bids from multiple providers (Prebid, APS, GAM, etc.) and returns
-/// the winning bids in `OpenRTB` format with creative HTML inline in the `adm` field.
+/// Accepts a JSON body matching [`AdRequest`][`super::formats::AdRequest`].
+/// The minimum valid request is:
+///
+/// ```json
+/// {
+///   "adUnits": [{
+///     "code": "atf_sidebar_ad",
+///     "mediaTypes": { "banner": { "sizes": [[300, 250]] } }
+///   }]
+/// }
+/// ```
+///
+/// ## Bidder params: inline vs. stored-request
+///
+/// Each ad unit's `bids` array is **optional**. When absent or empty the PBS
+/// integration falls back to a stored-request keyed by the unit's `code`
+/// field (`imp.ext.prebid.storedrequest = { id: "<code>" }`). A PBS stored
+/// request must therefore exist for every slot code that omits inline params.
+///
+/// When `bids` is supplied, each entry's `bidder`/`params` pair is forwarded
+/// directly as `imp.ext.prebid.bidder.<bidder>`.
+///
+/// ## Context passthrough (`config`)
+///
+/// The optional `config` object is filtered through
+/// [`auction.allowed_context_keys`][`crate::settings::AuctionConfig::allowed_context_keys`].
+/// Only keys listed there reach the auction providers (e.g. `"permutive_segments"`).
+/// All other keys are silently dropped. Values must be either strings or arrays of
+/// strings.
+///
+/// ## Response
+///
+/// Returns an `OpenRTB 2.x` response. Creative HTML is inlined in each bid's
+/// `adm` field after sanitisation and first-party URL rewriting. Response
+/// headers include `X-TS-EC` (the caller's Edge Cookie ID) and
+/// `X-TS-EC-Fresh` (a freshly generated ID for cookie renewal).
+///
+/// ## Scroll, refresh, and SPA navigation
+///
+/// This endpoint is intended for **initial page render** and **programmatic
+/// callers** (e.g. slim-Prebid, native apps, server-to-server integrations).
+/// It is **not** the intended path for scroll or GPT refresh events.
+///
+/// **SPA navigation** is handled by `GET /__ts/page-bids`: the client-side SPA
+/// hook (`installSpaAuctionHook`) intercepts `pushState`/`replaceState`/`popstate`
+/// events and calls that endpoint to fetch fresh slots and bids for each new
+/// route, then invokes `window.tsjs.adInit()` with the updated data.
+///
+/// **Scroll and GPT refresh** are owned by slim-Prebid in Phase 1: it runs
+/// post-`window.load`, listens for GPT refresh events, and runs client-side
+/// auctions independently of this endpoint.
+///
+/// A slot-template-aware refresh API (`POST /auction/refresh`) is deferred to a
+/// future phase and not designed here.
 ///
 /// # Errors
 ///
@@ -157,7 +208,7 @@ pub async fn handle_auction(
 /// Returns `None` when any prerequisite is missing (no KV store, no partner
 /// store, no EC, consent denied). On KV or partner-resolution errors, logs a
 /// warning and returns empty EIDs so the auction can proceed in degraded mode.
-fn resolve_auction_eids(
+pub(crate) fn resolve_auction_eids(
     kv: Option<&KvIdentityGraph>,
     registry: Option<&PartnerRegistry>,
     ec_context: &EcContext,
@@ -200,7 +251,7 @@ fn extract_cookie_value(req: &Request, name: &str) -> Option<String> {
     None
 }
 
-fn resolve_client_auction_eids(
+pub(crate) fn resolve_client_auction_eids(
     raw: Option<&JsonValue>,
     cookie_value: Option<&str>,
 ) -> Option<Vec<Eid>> {
@@ -296,7 +347,7 @@ fn parse_client_auction_uid(raw: &JsonValue) -> Option<Uid> {
     Some(Uid { id, atype, ext })
 }
 
-fn merge_auction_eids(
+pub(crate) fn merge_auction_eids(
     client_eids: Option<Vec<Eid>>,
     resolved_eids: Option<Vec<Eid>>,
 ) -> Option<Vec<Eid>> {
diff --git a/crates/trusted-server-core/src/auction/formats.rs b/crates/trusted-server-core/src/auction/formats.rs
index 08d6a6cd..ad29d0d9 100644
--- a/crates/trusted-server-core/src/auction/formats.rs
+++ b/crates/trusted-server-core/src/auction/formats.rs
@@ -28,7 +28,11 @@ use super::types::{
     PublisherInfo, SiteInfo, UserInfo,
 };
 
-/// Request body format for auction endpoints (tsjs/Prebid.js format).
+/// Request body for `POST /auction` (tsjs / Prebid.js wire format).
+///
+/// `adUnits` lists the placements to bid on. `config` carries optional
+/// context values (e.g. audience segments) filtered through
+/// [`auction.allowed_context_keys`][`crate::settings::AuctionConfig::allowed_context_keys`].
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct AdRequest {
@@ -37,6 +41,15 @@ pub struct AdRequest {
     pub eids: Option<JsonValue>,
 }
 
+/// A single ad placement in an [`AdRequest`].
+///
+/// `code` identifies the slot (e.g. `"atf_sidebar_ad"`) and becomes the
+/// impression ID in the outgoing `OpenRTB` request.
+///
+/// `bids` is optional. When absent or empty the PBS provider falls back to
+/// a stored-request keyed by `code` (`imp.ext.prebid.storedrequest.id`).
+/// When present, each entry's params are forwarded inline to PBS as
+/// `imp.ext.prebid.bidder.<bidder>`.
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct AdUnit {
@@ -45,7 +58,11 @@ pub struct AdUnit {
     pub bids: Option<Vec<BidConfig>>,
 }
 
-/// Bidder configuration from the request.
+/// Inline bidder params for one SSP within an [`AdUnit`].
+///
+/// `params` is passed verbatim to the corresponding PBS bidder adapter.
+/// When the `bids` array is absent, the slot falls back to PBS stored
+/// requests — see [`AdUnit`] for details.
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct BidConfig {
@@ -483,3 +500,171 @@ mod tests {
         );
     }
 }
+
+#[cfg(test)]
+mod convert_tests {
+    use super::*;
+    use crate::consent::ConsentContext;
+    use crate::test_support::tests::crate_test_settings_str;
+    use fastly::http::Method;
+    use fastly::Request;
+
+    fn make_settings() -> Settings {
+        Settings::from_toml(&crate_test_settings_str()).expect("should parse test settings")
+    }
+
+    fn make_req() -> Request {
+        Request::new(Method::POST, "https://test-publisher.com/auction")
+    }
+
+    fn call_convert(body: &AdRequest) -> AuctionRequest {
+        let settings = make_settings();
+        let req = make_req();
+        convert_tsjs_to_auction_request(
+            body,
+            &settings,
+            &req,
+            ConsentContext::default(),
+            Some("test-ec-id"),
+        )
+        .expect("should convert without error")
+    }
+
+    #[test]
+    fn no_bids_produces_empty_bidders_map() {
+        // An ad unit with no `bids` array must produce an empty bidders map.
+        // An empty bidders map triggers the PBS stored-request fallback:
+        // the PBS provider sets imp.ext.prebid.storedrequest = { id: "<code>" }.
+        let body = AdRequest {
+            ad_units: vec![AdUnit {
+                code: "atf_sidebar_ad".to_string(),
+                media_types: Some(MediaTypes {
+                    banner: Some(BannerUnit {
+                        sizes: vec![vec![300, 250]],
+                    }),
+                }),
+                bids: None,
+            }],
+            config: None,
+            eids: None,
+        };
+
+        let auction_request = call_convert(&body);
+
+        assert_eq!(auction_request.slots.len(), 1, "should have one slot");
+        let slot = &auction_request.slots[0];
+        assert_eq!(slot.id, "atf_sidebar_ad", "slot id should match unit code");
+        assert!(
+            slot.bidders.is_empty(),
+            "absent bids array should yield empty bidders map (PBS stored-request path)"
+        );
+    }
+
+    #[test]
+    fn inline_bids_populate_bidders_map() {
+        // When bids are supplied, each bidder+params pair should appear in the
+        // slot's bidders map so PBS receives inline params.
+        let body = AdRequest {
+            ad_units: vec![AdUnit {
+                code: "homepage_header_ad".to_string(),
+                media_types: Some(MediaTypes {
+                    banner: Some(BannerUnit {
+                        sizes: vec![vec![970, 90]],
+                    }),
+                }),
+                bids: Some(vec![BidConfig {
+                    bidder: "kargo".to_string(),
+                    params: serde_json::json!({ "placementId": "client_123" }),
+                }]),
+            }],
+            config: None,
+            eids: None,
+        };
+
+        let auction_request = call_convert(&body);
+
+        let slot = &auction_request.slots[0];
+        assert!(
+            slot.bidders.contains_key("kargo"),
+            "kargo bidder should be present in slot bidders map"
+        );
+        assert_eq!(
+            slot.bidders["kargo"]["placementId"], "client_123",
+            "bidder params should be forwarded verbatim"
+        );
+    }
+
+    #[test]
+    fn config_allowed_key_passes_through() {
+        // Keys in auction.allowed_context_keys must reach the auction context.
+        // The test settings do not set allowed_context_keys so the default
+        // (empty) applies — verify a key is NOT present rather than IS.
+        // To test the allow-list, inject a key via a custom settings string.
+        let settings_str = format!(
+            "{}\n[auction]\nallowed_context_keys = [\"permutive_segments\"]\n",
+            crate_test_settings_str()
+        );
+        let settings = Settings::from_toml(&settings_str).expect("should parse");
+        let req = make_req();
+
+        let body = AdRequest {
+            ad_units: vec![],
+            config: Some(serde_json::json!({
+                "permutive_segments": ["seg1", "seg2"],
+                "disallowed_key": "should be dropped",
+            })),
+            eids: None,
+        };
+
+        let auction_request = convert_tsjs_to_auction_request(
+            &body,
+            &settings,
+            &req,
+            ConsentContext::default(),
+            Some("test-ec-id"),
+        )
+        .expect("should convert");
+
+        assert!(
+            auction_request.context.contains_key("permutive_segments"),
+            "allowed key should be in auction context"
+        );
+        assert!(
+            !auction_request.context.contains_key("disallowed_key"),
+            "unlisted key should be dropped"
+        );
+    }
+
+    #[test]
+    fn invalid_banner_size_returns_error() {
+        // Banner sizes must be [width, height] pairs; a 3-element size is invalid.
+        let body = AdRequest {
+            ad_units: vec![AdUnit {
+                code: "bad_slot".to_string(),
+                media_types: Some(MediaTypes {
+                    banner: Some(BannerUnit {
+                        sizes: vec![vec![300, 250, 99]], // invalid — 3 elements
+                    }),
+                }),
+                bids: None,
+            }],
+            config: None,
+            eids: None,
+        };
+
+        let settings = make_settings();
+        let req = make_req();
+        let result = convert_tsjs_to_auction_request(
+            &body,
+            &settings,
+            &req,
+            ConsentContext::default(),
+            Some("test-ec-id"),
+        );
+
+        assert!(
+            result.is_err(),
+            "3-element banner size should return an error"
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/auction/orchestrator.rs b/crates/trusted-server-core/src/auction/orchestrator.rs
index fd59c778..8ccdca30 100644
--- a/crates/trusted-server-core/src/auction/orchestrator.rs
+++ b/crates/trusted-server-core/src/auction/orchestrator.rs
@@ -7,11 +7,43 @@ use std::sync::Arc;
 use std::time::{Duration, Instant};
 
 use crate::error::TrustedServerError;
+use crate::platform::{PlatformPendingRequest, PlatformResponse, RuntimeServices};
 
 use super::config::AuctionConfig;
 use super::provider::AuctionProvider;
 use super::types::{AuctionContext, AuctionRequest, AuctionResponse, Bid, BidStatus};
 
+/// In-flight auction requests dispatched to SSP backends.
+///
+/// Created by [`AuctionOrchestrator::dispatch_auction`] and consumed by
+/// [`AuctionOrchestrator::collect_dispatched_auction`]. Carrying this handle
+/// across `pending_origin.wait()` lets origin response and SSP HTTP requests
+/// race in Fastly's native layer, enabling TTFB ≈ origin latency rather than
+/// TTFB ≈ auction timeout.
+pub struct DispatchedAuction {
+    pending_requests: Vec<PlatformPendingRequest>,
+    backend_to_provider: HashMap<String, (String, Instant, Arc<dyn AuctionProvider>)>,
+    auction_start: Instant,
+    timeout_ms: u32,
+    floor_prices: HashMap<String, f64>,
+    /// Carried so the mediator call in collect can pass it as the auction request.
+    request: AuctionRequest,
+}
+
+#[cfg(test)]
+impl DispatchedAuction {
+    pub(crate) fn empty_for_test(request: AuctionRequest, timeout_ms: u32) -> Self {
+        Self {
+            pending_requests: Vec::new(),
+            backend_to_provider: HashMap::new(),
+            auction_start: Instant::now(),
+            timeout_ms,
+            floor_prices: HashMap::new(),
+            request,
+        }
+    }
+}
+
 const PROVIDER_ERROR_MESSAGE_CHARS: usize = 500;
 
 pub(crate) const ERROR_TYPE_HTTP_STATUS: &str = "http_status";
@@ -537,28 +569,29 @@ impl AuctionOrchestrator {
         }
 
         let starting_count = winning_bids.len();
-        winning_bids.retain(|slot_id, bid| match floor_prices.get(slot_id) {
-            Some(floor) => {
-                // Bids without price (e.g., APS) pass through - floor checked in mediation
-                match bid.price {
-                    Some(price) if price >= *floor => true,
-                    Some(_) => {
-                        log::info!(
-                            "Dropping winning bid below floor price for slot '{}'",
-                            slot_id
-                        );
-                        false
-                    }
-                    None => {
-                        log::debug!(
-                            "Passing bid with encoded price for slot '{}' - floor check deferred to mediation",
-                            slot_id
-                        );
-                        true
-                    }
-                }
+        winning_bids.retain(|slot_id, bid| match (floor_prices.get(slot_id), bid.price) {
+            (Some(floor), Some(price)) if price >= *floor => true,
+            (Some(_), Some(_)) => {
+                log::info!(
+                    "Dropping winning bid below floor price for slot '{}'",
+                    slot_id
+                );
+                false
             }
-            None => true,
+            (_, None) => {
+                // Any caller that needs to keep an undecoded (encoded-price)
+                // bid must decode it *before* invoking this function — both
+                // `select_winning_bids` and the mediator path already do.
+                // Letting `None`-price bids through here would cause
+                // `winning_bids.len()` to overcount what `build_bid_map`
+                // downstream is willing to emit, so they get dropped instead.
+                log::debug!(
+                    "Dropping bid for slot '{}' - no decoded price (caller must decode before apply_floor_prices)",
+                    slot_id
+                );
+                false
+            }
+            (None, Some(_)) => true,
         });
 
         if winning_bids.len() != starting_count {
@@ -598,6 +631,392 @@ impl AuctionOrchestrator {
         })
     }
 
+    /// Dispatch SSP bid requests without blocking WASM.
+    ///
+    /// Calls each enabled provider's [`AuctionProvider::request_bids`] (which
+    /// internally calls Fastly's `send_async`), then returns immediately with a
+    /// [`DispatchedAuction`] token. The Fastly host begins the SSP round-trips
+    /// while WASM continues to `pending_origin.wait()`.
+    ///
+    /// Returns `None` when no providers are configured or all providers are
+    /// disabled / over budget. The caller should fall back to the synchronous
+    /// `run_auction` path.
+    #[must_use]
+    pub fn dispatch_auction(
+        &self,
+        request: &AuctionRequest,
+        context: &AuctionContext<'_>,
+    ) -> Option<DispatchedAuction> {
+        let provider_names = self.config.provider_names();
+        if provider_names.is_empty() {
+            return None;
+        }
+
+        let auction_start = Instant::now();
+        let mut backend_to_provider: HashMap<String, (String, Instant, Arc<dyn AuctionProvider>)> =
+            HashMap::new();
+        let mut pending_requests: Vec<PlatformPendingRequest> = Vec::new();
+
+        for provider_name in provider_names {
+            let provider = match self.providers.get(provider_name) {
+                Some(p) => p,
+                None => {
+                    log::warn!("Provider '{}' not registered, skipping", provider_name);
+                    continue;
+                }
+            };
+
+            if !provider.is_enabled() {
+                log::debug!(
+                    "Provider '{}' is disabled, skipping",
+                    provider.provider_name()
+                );
+                continue;
+            }
+
+            let remaining_ms = remaining_budget_ms(auction_start, context.timeout_ms);
+            let effective_timeout = remaining_ms.min(provider.timeout_ms());
+
+            if effective_timeout == 0 {
+                log::warn!(
+                    "Auction timeout ({}ms) exhausted before launching '{}' — skipping",
+                    context.timeout_ms,
+                    provider.provider_name()
+                );
+                continue;
+            }
+
+            let backend_name = match provider.backend_name(effective_timeout) {
+                Some(name) => name,
+                None => {
+                    log::warn!(
+                        "Provider '{}' has no backend_name, skipping",
+                        provider.provider_name()
+                    );
+                    continue;
+                }
+            };
+
+            let provider_context = AuctionContext {
+                settings: context.settings,
+                request: context.request,
+                timeout_ms: effective_timeout,
+                provider_responses: context.provider_responses,
+                services: context.services,
+            };
+
+            let start_time = Instant::now();
+            match provider.request_bids(request, &provider_context) {
+                Ok(pending) => {
+                    log::info!(
+                        "Dispatching bid request to '{}' (backend: {}, budget: {}ms)",
+                        provider.provider_name(),
+                        backend_name,
+                        effective_timeout
+                    );
+                    backend_to_provider.insert(
+                        backend_name.clone(),
+                        (
+                            provider.provider_name().to_string(),
+                            start_time,
+                            Arc::clone(provider),
+                        ),
+                    );
+                    pending_requests
+                        .push(PlatformPendingRequest::new(pending).with_backend_name(backend_name));
+                }
+                Err(e) => {
+                    log::warn!(
+                        "Provider '{}' failed to dispatch request: {:?}",
+                        provider.provider_name(),
+                        e
+                    );
+                }
+            }
+        }
+
+        if pending_requests.is_empty() {
+            return None;
+        }
+
+        log::info!(
+            "Dispatched {} SSP requests (timeout: {}ms); Fastly host will race them against origin",
+            pending_requests.len(),
+            context.timeout_ms
+        );
+
+        Some(DispatchedAuction {
+            pending_requests,
+            backend_to_provider,
+            auction_start,
+            timeout_ms: context.timeout_ms,
+            floor_prices: self.floor_prices_by_slot(request),
+            request: request.clone(),
+        })
+    }
+
+    /// Collect bid responses from a previously-dispatched auction.
+    ///
+    /// Runs the select-loop phase (equivalent to Phase 2 of
+    /// `run_providers_parallel`) and, if the orchestrator has a mediator
+    /// configured, forwards collected bids to it. The overall auction deadline
+    /// is enforced from `dispatched.auction_start`.
+    ///
+    /// On any error or partial failure the method returns the best available
+    /// result rather than propagating — the caller should still inject the
+    /// winning bids even if some providers timed out.
+    pub async fn collect_dispatched_auction(
+        &self,
+        dispatched: DispatchedAuction,
+        services: &RuntimeServices,
+        context: &AuctionContext<'_>,
+    ) -> OrchestrationResult {
+        let DispatchedAuction {
+            pending_requests,
+            mut backend_to_provider,
+            auction_start,
+            timeout_ms,
+            floor_prices,
+            request,
+        } = dispatched;
+
+        log::info!(
+            "Collecting {} in-flight SSP responses (timeout: {}ms remaining: {}ms)",
+            pending_requests.len(),
+            timeout_ms,
+            remaining_budget_ms(auction_start, timeout_ms),
+        );
+
+        let mut responses: Vec<AuctionResponse> = Vec::new();
+        let mut remaining = pending_requests;
+
+        while !remaining.is_empty() {
+            let select_result = match services
+                .http_client()
+                .select(remaining)
+                .await
+                .change_context(TrustedServerError::Auction {
+                    message: "HTTP select failed".to_string(),
+                }) {
+                Ok(r) => r,
+                Err(e) => {
+                    log::warn!("select() failed during auction collection: {:?}", e);
+                    break;
+                }
+            };
+            remaining = select_result.remaining;
+
+            match select_result.ready {
+                Ok(platform_response) => {
+                    let backend_name = platform_response.backend_name.clone().unwrap_or_default();
+                    if let Some((provider_name, start_time, provider)) =
+                        backend_to_provider.remove(&backend_name)
+                    {
+                        let response_time_ms = start_time.elapsed().as_millis() as u64;
+                        match platform_response_to_fastly(platform_response) {
+                            Ok(response) => {
+                                match provider.parse_response(response, response_time_ms) {
+                                    Ok(auction_response) => {
+                                        log::info!(
+                                            "Provider '{}' returned {} bids ({}ms)",
+                                            auction_response.provider,
+                                            auction_response.bids.len(),
+                                            auction_response.response_time_ms
+                                        );
+                                        responses.push(auction_response);
+                                    }
+                                    Err(e) => {
+                                        log::warn!(
+                                            "Provider '{}' parse failed: {:?}",
+                                            provider_name,
+                                            e
+                                        );
+                                        responses.push(AuctionResponse::error(
+                                            &provider_name,
+                                            response_time_ms,
+                                        ));
+                                    }
+                                }
+                            }
+                            Err(e) => {
+                                log::warn!(
+                                    "Provider '{}' unsupported body: {:?}",
+                                    provider_name,
+                                    e
+                                );
+                                responses
+                                    .push(AuctionResponse::error(&provider_name, response_time_ms));
+                            }
+                        }
+                    } else {
+                        log::warn!(
+                            "Received response from unknown backend '{}', ignoring",
+                            backend_name
+                        );
+                    }
+                }
+                Err(e) => {
+                    log::warn!("A provider request failed during collection: {:?}", e);
+                }
+            }
+        }
+
+        let (mediator_response, winning_bids) = if let Some(mediator_name) = &self.config.mediator {
+            match self.providers.get(mediator_name.as_str()) {
+                Some(mediator) => {
+                    // Cap the mediator at whichever is tighter: its own configured
+                    // timeout or the remaining auction budget (A_deadline).  The old
+                    // comment here claimed origin drain could exhaust the budget before
+                    // collection, but SSP backends are given first_byte_timeout =
+                    // effective_timeout (capped at their provider timeout) at dispatch
+                    // time, so they cannot run past A_deadline independently.  Giving
+                    // the mediator an uncapped timeout lets it run past A_deadline,
+                    // violating the bounded hold invariant.
+                    let remaining = remaining_budget_ms(auction_start, timeout_ms);
+                    if remaining == 0 {
+                        log::warn!(
+                            "A_deadline exhausted before mediator '{}' — returning {} SSP bids without mediation",
+                            mediator.provider_name(),
+                            responses.len(),
+                        );
+                        let winning = self.select_winning_bids(&responses, &floor_prices);
+                        return OrchestrationResult {
+                            provider_responses: responses,
+                            mediator_response: None,
+                            winning_bids: winning,
+                            total_time_ms: auction_start.elapsed().as_millis() as u64,
+                            metadata: HashMap::new(),
+                        };
+                    }
+                    let mediator_timeout = remaining.min(mediator.timeout_ms());
+                    let mediator_start = Instant::now();
+                    log::info!(
+                        "Running mediator '{}' with {}ms budget (A_deadline remaining: {}ms, configured: {}ms)",
+                        mediator.provider_name(),
+                        mediator_timeout,
+                        remaining,
+                        mediator.timeout_ms(),
+                    );
+                    // The mediator runs on the collect path. See the doc-comment on
+                    // `AuctionContext::request`: the real client request was already
+                    // consumed by `send_async` during dispatch, so we substitute a
+                    // canonical placeholder URL. Any future mediator that needs real
+                    // client headers must snapshot them at dispatch time onto
+                    // `DispatchedAuction` rather than reading `context.request` here.
+                    let placeholder =
+                        fastly::Request::get(crate::auction::types::MEDIATOR_PLACEHOLDER_URL);
+                    let mediator_context = AuctionContext {
+                        settings: context.settings,
+                        request: &placeholder,
+                        timeout_ms: mediator_timeout,
+                        provider_responses: Some(&responses),
+                        services: context.services,
+                    };
+                    match mediator.request_bids(&request, &mediator_context) {
+                        Ok(pending) => {
+                            let platform_resp = services
+                                .http_client()
+                                .wait(PlatformPendingRequest::new(pending))
+                                .await;
+                            match platform_resp.change_context(TrustedServerError::Auction {
+                                message: format!(
+                                    "Mediator {} request failed",
+                                    mediator.provider_name()
+                                ),
+                            }) {
+                                Ok(platform_resp) => {
+                                    match platform_response_to_fastly(platform_resp).change_context(
+                                        TrustedServerError::Auction {
+                                            message: format!(
+                                                "Mediator {} unsupported body",
+                                                mediator.provider_name()
+                                            ),
+                                        },
+                                    ) {
+                                        Ok(response) => {
+                                            let response_time_ms =
+                                                mediator_start.elapsed().as_millis() as u64;
+                                            match mediator
+                                                .parse_response(response, response_time_ms)
+                                            {
+                                                Ok(mediator_resp) => {
+                                                    let winning = mediator_resp
+                                                        .bids
+                                                        .iter()
+                                                        .filter_map(|bid| {
+                                                            if bid.price.is_none() {
+                                                                log::warn!(
+                                                                    "Mediator '{}' returned bid for slot '{}' without decoded price - skipping",
+                                                                    mediator.provider_name(),
+                                                                    bid.slot_id
+                                                                );
+                                                                None
+                                                            } else {
+                                                                Some((bid.slot_id.clone(), bid.clone()))
+                                                            }
+                                                        })
+                                                        .collect();
+                                                    let winning = self
+                                                        .apply_floor_prices(winning, &floor_prices);
+                                                    (Some(mediator_resp), winning)
+                                                }
+                                                Err(e) => {
+                                                    log::warn!(
+                                                        "Mediator '{}' parse failed: {:?}",
+                                                        mediator.provider_name(),
+                                                        e
+                                                    );
+                                                    let winning = self.select_winning_bids(
+                                                        &responses,
+                                                        &floor_prices,
+                                                    );
+                                                    (None, winning)
+                                                }
+                                            }
+                                        }
+                                        Err(e) => {
+                                            log::warn!("Mediator body error: {:?}", e);
+                                            (
+                                                None,
+                                                self.select_winning_bids(&responses, &floor_prices),
+                                            )
+                                        }
+                                    }
+                                }
+                                Err(e) => {
+                                    log::warn!("Mediator request failed: {:?}", e);
+                                    (None, self.select_winning_bids(&responses, &floor_prices))
+                                }
+                            }
+                        }
+                        Err(e) => {
+                            log::warn!(
+                                "Mediator '{}' failed to dispatch: {:?}",
+                                mediator.provider_name(),
+                                e
+                            );
+                            (None, self.select_winning_bids(&responses, &floor_prices))
+                        }
+                    }
+                }
+                None => {
+                    log::warn!("Mediator '{}' not registered", mediator_name);
+                    (None, self.select_winning_bids(&responses, &floor_prices))
+                }
+            }
+        } else {
+            (None, self.select_winning_bids(&responses, &floor_prices))
+        };
+
+        OrchestrationResult {
+            provider_responses: responses,
+            mediator_response,
+            winning_bids,
+            total_time_ms: auction_start.elapsed().as_millis() as u64,
+            metadata: HashMap::new(),
+        }
+    }
+
     /// Check if orchestrator is enabled.
     #[must_use]
     pub fn is_enabled(&self) -> bool {
@@ -644,6 +1063,14 @@ impl OrchestrationResult {
     }
 }
 
+fn platform_response_to_fastly(
+    platform_response: PlatformResponse,
+) -> Result<fastly::Response, Report<TrustedServerError>> {
+    Ok(crate::compat::to_fastly_response(
+        platform_response.response,
+    ))
+}
+
 #[cfg(test)]
 mod tests {
     use crate::auction::config::AuctionConfig;
@@ -803,6 +1230,10 @@ mod tests {
                 height: 250,
                 nurl: None,
                 burl: None,
+                ad_id: None,
+                cache_id: None,
+                cache_host: None,
+                cache_path: None,
                 metadata: HashMap::new(),
             },
         );
@@ -819,6 +1250,10 @@ mod tests {
                 height: 250,
                 nurl: None,
                 burl: None,
+                ad_id: None,
+                cache_id: None,
+                cache_host: None,
+                cache_path: None,
                 metadata: HashMap::new(),
             },
         );
@@ -930,9 +1365,14 @@ mod tests {
     }
 
     #[test]
-    fn test_apply_floor_prices_allows_none_prices_for_encoded_bids() {
-        // Test that bids with None prices (APS-style) pass through floor pricing
-        // This is correct behavior for parallel-only strategy where mediation happens later
+    fn test_apply_floor_prices_drops_bids_with_undecoded_price() {
+        // Bids that reach apply_floor_prices with `price=None` cannot have a
+        // floor compared against them — and they would not survive downstream
+        // (build_bid_map filters them) — so apply_floor_prices drops them so
+        // the count it reports matches what eventually ships to the client.
+        // Both production paths (select_winning_bids and the mediator filter)
+        // already decode/skip None prices before calling this function; this
+        // test pins the contract.
         let orchestrator = AuctionOrchestrator::new(AuctionConfig::default());
         let mut floor_prices = HashMap::new();
         floor_prices.insert("slot-1".to_string(), 1.00);
@@ -942,7 +1382,7 @@ mod tests {
             "slot-1".to_string(),
             Bid {
                 slot_id: "slot-1".to_string(),
-                price: None, // APS bid with encoded price
+                price: None,
                 currency: "USD".to_string(),
                 creative: Some("<div>Ad</div>".to_string()),
                 adomain: None,
@@ -951,6 +1391,10 @@ mod tests {
                 height: 250,
                 nurl: None,
                 burl: None,
+                ad_id: None,
+                cache_id: None,
+                cache_host: None,
+                cache_path: None,
                 metadata: {
                     let mut m = HashMap::new();
                     m.insert(
@@ -962,25 +1406,96 @@ mod tests {
             },
         );
 
-        // Apply floor pricing - should pass through with None price
         let filtered = orchestrator.apply_floor_prices(winning_bids, &floor_prices);
 
-        assert_eq!(
-            filtered.len(),
-            1,
-            "APS bid with None price should pass through floor check"
+        assert!(
+            filtered.is_empty(),
+            "bid with None price should be dropped by apply_floor_prices"
         );
         assert!(
-            filtered.contains_key("slot-1"),
-            "Slot-1 should still be present"
+            !filtered.contains_key("slot-1"),
+            "slot-1 should not survive when its bid has no decoded price"
         );
+    }
+
+    #[test]
+    fn test_apply_floor_prices_drops_decoded_aps_bid_below_floor() {
+        // After mediation decodes an APS bid, apply_floor_prices must enforce the
+        // slot floor on the resulting price=Some(x) value. This test simulates the
+        // state of a bid after mediator decoding: price is Some, amznbid is gone.
+        let orchestrator = AuctionOrchestrator::new(AuctionConfig::default());
+        let mut floor_prices = HashMap::new();
+        floor_prices.insert("atf".to_string(), 0.50);
+
+        let mut winning_bids = HashMap::new();
+        winning_bids.insert(
+            "atf".to_string(),
+            Bid {
+                slot_id: "atf".to_string(),
+                price: Some(0.30), // decoded APS price — below $0.50 floor
+                currency: "USD".to_string(),
+                creative: Some("<div>APS Ad</div>".to_string()),
+                adomain: None,
+                bidder: "aps".to_string(),
+                width: 300,
+                height: 250,
+                nurl: None,
+                burl: None,
+                ad_id: None,
+                cache_id: None,
+                cache_host: None,
+                cache_path: None,
+                metadata: HashMap::new(),
+            },
+        );
+
+        let filtered = orchestrator.apply_floor_prices(winning_bids, &floor_prices);
+
         assert!(
-            filtered
-                .get("slot-1")
-                .expect("slot-1 should be present")
-                .price
-                .is_none(),
-            "Price should still be None (not decoded yet)"
+            filtered.is_empty(),
+            "Decoded APS bid below slot floor should be dropped"
+        );
+    }
+
+    #[test]
+    fn test_apply_floor_prices_keeps_decoded_aps_bid_at_or_above_floor() {
+        let orchestrator = AuctionOrchestrator::new(AuctionConfig::default());
+        let mut floor_prices = HashMap::new();
+        floor_prices.insert("atf".to_string(), 0.50);
+
+        let mut winning_bids = HashMap::new();
+        winning_bids.insert(
+            "atf".to_string(),
+            Bid {
+                slot_id: "atf".to_string(),
+                price: Some(0.75), // decoded APS price — above floor
+                currency: "USD".to_string(),
+                creative: Some("<div>APS Ad</div>".to_string()),
+                adomain: None,
+                bidder: "aps".to_string(),
+                width: 300,
+                height: 250,
+                nurl: None,
+                burl: None,
+                ad_id: None,
+                cache_id: None,
+                cache_host: None,
+                cache_path: None,
+                metadata: HashMap::new(),
+            },
+        );
+
+        let filtered = orchestrator.apply_floor_prices(winning_bids, &floor_prices);
+
+        assert_eq!(
+            filtered.len(),
+            1,
+            "Decoded APS bid at or above floor should be kept"
+        );
+        assert_eq!(
+            filtered.get("atf").expect("atf should be present").price,
+            Some(0.75),
+            "Price should be preserved"
         );
     }
 }
diff --git a/crates/trusted-server-core/src/auction/types.rs b/crates/trusted-server-core/src/auction/types.rs
index 9b74d89e..418da884 100644
--- a/crates/trusted-server-core/src/auction/types.rs
+++ b/crates/trusted-server-core/src/auction/types.rs
@@ -60,6 +60,14 @@ pub enum MediaType {
     Native,
 }
 
+impl MediaType {
+    /// Returns the Banner media type.
+    #[must_use]
+    pub fn banner() -> Self {
+        Self::Banner
+    }
+}
+
 /// Publisher information.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct PublisherInfo {
@@ -82,11 +90,11 @@ pub struct UserInfo {
     /// cookies/headers, not from stored data.
     #[serde(skip)]
     pub consent: Option<crate::consent::ConsentContext>,
-    /// Consent-gated Extended User IDs resolved from the KV identity graph.
+    /// Extended User IDs parsed from the [`crate::constants::COOKIE_TS_EIDS`] cookie.
     ///
-    /// Populated by the auction handler from partner data when the user has
-    /// a valid EC and consent permits EID transmission. `None` when no EIDs
-    /// are available (no EC, consent denied, or KV read failure).
+    /// Raw (un-gated) values from the browser; consent gating via
+    /// [`crate::consent::gate_eids_by_consent`] is applied in the provider
+    /// layer before any EID reaches a bid request.
     #[serde(skip)]
     pub eids: Option<Vec<crate::openrtb::Eid>>,
 }
@@ -107,6 +115,29 @@ pub struct SiteInfo {
 }
 
 /// Context passed to auction providers.
+///
+/// # The `request` field is path-dependent
+///
+/// `request` carries the **real downstream client request** in the dispatch
+/// path ([`AuctionOrchestrator::run_auction`][run] and
+/// [`dispatch_auction`][dispatch]). Providers there can read client headers
+/// (DNT, User-Agent, cookies, X-* customs) directly off it.
+///
+/// In the **collect path** ([`collect_dispatched_auction`][collect]) the
+/// mediator is invoked with a synthetic placeholder request
+/// (`https://placeholder.invalid/`), because the real client request has
+/// already been consumed by `send_async` during dispatch and the host pipeline
+/// can't lend it across the `.await`. **Mediators must not depend on reading
+/// client state from `context.request`** — the placeholder has none of the
+/// real headers. If a future mediator needs that data, snapshot it into a new
+/// field on this struct at dispatch time and stash it on the
+/// [`DispatchedAuction`] token so collect can attach it to the mediator's
+/// context. See <https://github.com/IABTechLab/trusted-server/issues/680>
+/// (P2-1) for the open follow-up.
+///
+/// [run]: crate::auction::AuctionOrchestrator::run_auction
+/// [dispatch]: crate::auction::AuctionOrchestrator::dispatch_auction
+/// [collect]: crate::auction::AuctionOrchestrator::collect_dispatched_auction
 pub struct AuctionContext<'a> {
     pub settings: &'a Settings,
     pub request: &'a Request,
@@ -118,6 +149,12 @@ pub struct AuctionContext<'a> {
     pub services: &'a RuntimeServices,
 }
 
+/// URL used by the orchestrator when invoking a mediator from the collect
+/// path. Providers can `debug_assert` against this value to catch a mediator
+/// that has accidentally started depending on `context.request` carrying real
+/// client headers.
+pub const MEDIATOR_PLACEHOLDER_URL: &str = "https://placeholder.invalid/";
+
 /// Response from a single auction provider.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct AuctionResponse {
@@ -158,6 +195,24 @@ pub struct Bid {
     pub nurl: Option<String>,
     /// Billing notification URL
     pub burl: Option<String>,
+    /// Ad ID from the bidder
+    pub ad_id: Option<String>,
+    /// Prebid Cache UUID for this bid.
+    ///
+    /// Populated from `ext.prebid.cache.bids.cacheId` in the PBS response.
+    /// Used as `hb_adid` targeting value in `window.tsjs.bids`. `None` for
+    /// non-PBS providers (e.g., APS) and PBS bids without Prebid Cache enabled.
+    pub cache_id: Option<String>,
+    /// Prebid Cache host (e.g., `"openads.adsrvr.org"`).
+    ///
+    /// Populated from the host of `ext.prebid.cache.bids.url`. Used as
+    /// `hb_cache_host` targeting value. `None` when cache is absent.
+    pub cache_host: Option<String>,
+    /// Prebid Cache path (e.g., `"/cache"`).
+    ///
+    /// Populated from the path of `ext.prebid.cache.bids.url`. Used as
+    /// `hb_cache_path` targeting value. `None` when cache is absent.
+    pub cache_path: Option<String>,
     /// Provider-specific bid metadata
     /// For APS bids, contains encoded price in "amznbid" field
     pub metadata: HashMap<String, serde_json::Value>,
@@ -282,6 +337,10 @@ mod tests {
             height: 250,
             nurl: None,
             burl: None,
+            ad_id: None,
+            cache_id: None,
+            cache_host: None,
+            cache_path: None,
             metadata: HashMap::new(),
         }
     }
@@ -393,4 +452,69 @@ mod tests {
             "should omit metadata field when empty"
         );
     }
+
+    #[test]
+    fn bid_with_cache_fields_round_trips_through_json() {
+        let bid = Bid {
+            slot_id: "atf".to_string(),
+            price: Some(1.50),
+            currency: "USD".to_string(),
+            creative: None,
+            adomain: None,
+            bidder: "thetradedesk".to_string(),
+            width: 300,
+            height: 250,
+            nurl: None,
+            burl: None,
+            ad_id: Some("bid-id".to_string()),
+            cache_id: Some("cache-uuid".to_string()),
+            cache_host: Some("cache.example.com".to_string()),
+            cache_path: Some("/pbc/v1/cache".to_string()),
+            metadata: HashMap::new(),
+        };
+        let json = serde_json::to_string(&bid).expect("should serialize Bid");
+        let restored: Bid = serde_json::from_str(&json).expect("should deserialize Bid");
+        assert_eq!(
+            restored.cache_id.as_deref(),
+            Some("cache-uuid"),
+            "should round-trip cache_id"
+        );
+        assert_eq!(
+            restored.cache_host.as_deref(),
+            Some("cache.example.com"),
+            "should round-trip cache_host"
+        );
+        assert_eq!(
+            restored.cache_path.as_deref(),
+            Some("/pbc/v1/cache"),
+            "should round-trip cache_path"
+        );
+    }
+
+    #[test]
+    fn media_type_banner_fn_returns_banner() {
+        assert_eq!(MediaType::banner(), MediaType::Banner);
+    }
+
+    #[test]
+    fn bid_has_ad_id_field() {
+        let bid = Bid {
+            slot_id: "s".to_string(),
+            price: Some(1.0),
+            currency: "USD".to_string(),
+            creative: None,
+            adomain: None,
+            bidder: "kargo".to_string(),
+            width: 300,
+            height: 250,
+            nurl: None,
+            burl: None,
+            ad_id: Some("prebid-ad-id-abc".to_string()),
+            cache_id: None,
+            cache_host: None,
+            cache_path: None,
+            metadata: Default::default(),
+        };
+        assert_eq!(bid.ad_id.as_deref(), Some("prebid-ad-id-abc"));
+    }
 }
diff --git a/crates/trusted-server-core/src/constants.rs b/crates/trusted-server-core/src/constants.rs
index 0dec1dae..8b954e0b 100644
--- a/crates/trusted-server-core/src/constants.rs
+++ b/crates/trusted-server-core/src/constants.rs
@@ -1,6 +1,8 @@
 use http::header::HeaderName;
 
 pub const COOKIE_TS_EC: &str = "ts-ec";
+/// Cookie written by the Trusted Server JS SDK containing a standard-base64-encoded
+/// JSON array of Extended User IDs (`[{ source, uids }]`) from identity providers.
 pub const COOKIE_TS_EIDS: &str = "ts-eids";
 pub const COOKIE_SHAREDID: &str = "sharedId";
 
diff --git a/crates/trusted-server-core/src/cookies.rs b/crates/trusted-server-core/src/cookies.rs
index e56c6834..2d558e31 100644
--- a/crates/trusted-server-core/src/cookies.rs
+++ b/crates/trusted-server-core/src/cookies.rs
@@ -9,8 +9,12 @@ use error_stack::{Report, ResultExt};
 use http::header;
 use http::Request;
 
+#[cfg(test)]
+use crate::constants::COOKIE_TS_EIDS;
 use crate::constants::{COOKIE_EUCONSENT_V2, COOKIE_GPP, COOKIE_GPP_SID, COOKIE_US_PRIVACY};
 use crate::error::TrustedServerError;
+#[cfg(test)]
+use base64::{engine::general_purpose::STANDARD, Engine as _};
 
 /// Cookie names carrying privacy consent signals.
 ///
@@ -69,6 +73,42 @@ pub fn handle_request_cookies(
     }
 }
 
+/// Parse Extended User IDs from the [`COOKIE_TS_EIDS`] cookie.
+///
+/// The cookie value is a standard-base64-encoded JSON array of
+/// [`crate::openrtb::Eid`] objects written by the Trusted Server JS SDK via
+/// `btoa(JSON.stringify(eids))`.
+///
+/// Returns `None` if the cookie is absent, base64-malformed, JSON-malformed,
+/// or the decoded array is empty. Parse failures are logged at `debug` level
+/// so operators can diagnose JS SDK / server mismatches.
+#[cfg(test)]
+#[must_use]
+pub(crate) fn parse_ts_eids_cookie(jar: Option<&CookieJar>) -> Option<Vec<crate::openrtb::Eid>> {
+    let value = jar?.get(COOKIE_TS_EIDS)?.value().to_owned();
+    let decoded = match STANDARD.decode(&value) {
+        Ok(b) => b,
+        Err(e) => {
+            log::debug!("ts-eids cookie: base64 decode failed: {e}");
+            return None;
+        }
+    };
+    match serde_json::from_slice::<Vec<crate::openrtb::Eid>>(&decoded) {
+        Ok(eids) if !eids.is_empty() => {
+            if eids.len() > 32 || eids.iter().any(|e| e.uids.len() > 32) {
+                log::debug!("ts-eids cookie: too many eids or uids, rejecting");
+                return None;
+            }
+            Some(eids)
+        }
+        Ok(_) => None,
+        Err(e) => {
+            log::debug!("ts-eids cookie: JSON parse failed: {e}");
+            None
+        }
+    }
+}
+
 /// Strips named cookies from a `Cookie` header value string.
 ///
 /// Parses the semicolon-separated cookie pairs, filters out any whose name
@@ -408,4 +448,73 @@ mod tests {
         let stripped = strip_cookies(header, CONSENT_COOKIE_NAMES);
         assert_eq!(stripped, "session=abc=123=def");
     }
+
+    fn make_jar_with(name: &str, value: &str) -> CookieJar {
+        parse_cookies_to_jar(&format!("{name}={value}"))
+    }
+
+    fn encode_eids(eids: &[serde_json::Value]) -> String {
+        use base64::{engine::general_purpose::STANDARD, Engine as _};
+        STANDARD.encode(serde_json::to_string(eids).expect("should serialize eids"))
+    }
+
+    #[test]
+    fn parse_ts_eids_cookie_returns_eids_for_valid_input() {
+        let encoded = encode_eids(&[serde_json::json!({
+            "source": "id5-sync.com",
+            "uids": [{"id": "abc123", "atype": 1}]
+        })]);
+        let jar = make_jar_with(COOKIE_TS_EIDS, &encoded);
+        let eids = parse_ts_eids_cookie(Some(&jar)).expect("should parse valid ts-eids cookie");
+        assert_eq!(eids.len(), 1, "should return one EID");
+        assert_eq!(eids[0].source, "id5-sync.com", "should preserve source");
+        assert_eq!(eids[0].uids[0].id, "abc123", "should preserve uid");
+    }
+
+    #[test]
+    fn parse_ts_eids_cookie_returns_none_when_cookie_absent() {
+        let jar = CookieJar::new();
+        assert!(
+            parse_ts_eids_cookie(Some(&jar)).is_none(),
+            "should return None when cookie absent"
+        );
+    }
+
+    #[test]
+    fn parse_ts_eids_cookie_returns_none_for_empty_array() {
+        let encoded = encode_eids(&[]);
+        let jar = make_jar_with(COOKIE_TS_EIDS, &encoded);
+        assert!(
+            parse_ts_eids_cookie(Some(&jar)).is_none(),
+            "should return None for empty EID array"
+        );
+    }
+
+    #[test]
+    fn parse_ts_eids_cookie_returns_none_for_corrupt_base64() {
+        let jar = make_jar_with(COOKIE_TS_EIDS, "not!!valid!!base64");
+        assert!(
+            parse_ts_eids_cookie(Some(&jar)).is_none(),
+            "should return None for corrupt base64"
+        );
+    }
+
+    #[test]
+    fn parse_ts_eids_cookie_returns_none_for_invalid_json() {
+        use base64::{engine::general_purpose::STANDARD, Engine as _};
+        let encoded = STANDARD.encode(b"this is not json");
+        let jar = make_jar_with(COOKIE_TS_EIDS, &encoded);
+        assert!(
+            parse_ts_eids_cookie(Some(&jar)).is_none(),
+            "should return None for invalid JSON"
+        );
+    }
+
+    #[test]
+    fn parse_ts_eids_cookie_returns_none_for_none_jar() {
+        assert!(
+            parse_ts_eids_cookie(None).is_none(),
+            "should return None when jar is None"
+        );
+    }
 }
diff --git a/crates/trusted-server-core/src/creative_opportunities.rs b/crates/trusted-server-core/src/creative_opportunities.rs
new file mode 100644
index 00000000..a7b3d579
--- /dev/null
+++ b/crates/trusted-server-core/src/creative_opportunities.rs
@@ -0,0 +1,540 @@
+//! Configuration types and URL matching for creative opportunity slots.
+//!
+//! A [`CreativeOpportunitySlot`] describes a single ad placement: which pages
+//! it appears on (via glob patterns), what ad formats it supports, and how it
+//! maps to provider-specific identifiers such as GAM unit paths and APS slot IDs.
+
+use std::collections::HashMap;
+
+use serde::{Deserialize, Serialize};
+
+use glob::Pattern;
+
+use crate::auction::types::{AdFormat, AdSlot, MediaType};
+use crate::price_bucket::PriceGranularity;
+use crate::settings::vec_from_seq_or_map;
+
+/// Top-level configuration for the creative opportunities system.
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct CreativeOpportunitiesConfig {
+    /// GAM network ID used to build default unit paths.
+    pub gam_network_id: String,
+    /// Maximum time in milliseconds to wait for the server-side auction before
+    /// closing the response body.
+    ///
+    /// The auction runs concurrently with HTML body streaming. Body content
+    /// above `</body>` has already been delivered and painted before the hold
+    /// begins, so **FCP is not affected**. What this timeout bounds is the slip
+    /// on `DOMContentLoaded` and `window.load`: third-party scripts that hook
+    /// those events fire later by at most this duration.
+    ///
+    /// The worst case is a cache-hit page where the origin drains in <50 ms
+    /// but the auction takes the full timeout — the browser sits idle waiting
+    /// for `</body>`. 500 ms is the recommended default and the hard upper
+    /// bound on DCL slip the publisher is willing to accept.
+    ///
+    /// When absent, falls back to `[auction].timeout_ms` from global config.
+    #[serde(default)]
+    pub auction_timeout_ms: Option<u32>,
+    /// Price granularity for header-bidding price bucketing.
+    #[serde(default = "PriceGranularity::dense")]
+    pub price_granularity: PriceGranularity,
+    /// Slot templates. Empty vec = feature disabled (no auction fired, no globals injected).
+    #[serde(default, deserialize_with = "vec_from_seq_or_map")]
+    pub slot: Vec<CreativeOpportunitySlot>,
+}
+
+impl CreativeOpportunitiesConfig {
+    /// Pre-compile glob patterns for all slots. Call once after deserialization.
+    pub fn compile_slots(&mut self) {
+        for slot in &mut self.slot {
+            slot.compile_patterns();
+        }
+    }
+}
+
+/// A single ad placement opportunity on the publisher's site.
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct CreativeOpportunitySlot {
+    /// Unique identifier for the slot (e.g., `"atf"`, `"below-fold-sidebar"`).
+    pub id: String,
+    /// Override for the GAM ad unit path.
+    ///
+    /// When absent, the path is derived as `/<gam_network_id>/<id>`.
+    pub gam_unit_path: Option<String>,
+    /// Override for the HTML `div` element ID that will hold the creative.
+    ///
+    /// Defaults to [`id`](Self::id) when absent.
+    pub div_id: Option<String>,
+    /// Glob patterns for page paths this slot should appear on.
+    pub page_patterns: Vec<String>,
+    /// Supported ad formats (size + media type combinations).
+    pub formats: Vec<CreativeOpportunityFormat>,
+    /// Optional floor price in CPM (USD).
+    pub floor_price: Option<f64>,
+    /// Slot-level targeting key–value pairs forwarded to the auction.
+    #[serde(default)]
+    pub targeting: HashMap<String, String>,
+    /// Provider-specific slot identifiers.
+    #[serde(default)]
+    pub providers: SlotProviders,
+    /// Pre-compiled [`page_patterns`](Self::page_patterns) for hot-path matching.
+    ///
+    /// Populated by [`compile_patterns`](Self::compile_patterns) once at startup
+    /// via [`CreativeOpportunitiesConfig::compile_slots`]. When this is
+    /// empty, [`matches_path`](Self::matches_path) falls back to compiling on
+    /// every call so callers that build slots by hand in tests
+    /// still work.
+    ///
+    /// `pub(crate)` rather than private so cross-module test helpers in this
+    /// crate can construct slots via struct-literal syntax with an empty cache.
+    #[serde(skip, default)]
+    pub(crate) compiled_patterns: Vec<Pattern>,
+}
+
+impl CreativeOpportunitySlot {
+    /// Returns `true` if `path` matches any of this slot's [`page_patterns`](Self::page_patterns).
+    ///
+    /// Patterns use glob syntax (e.g., `"/20**"` matches any path starting with `/20`,
+    /// `"/"` matches only the root). When a pattern contains `**` in a position that the
+    /// glob crate considers invalid (e.g., `b**`), the `**` is normalised to `*` before
+    /// matching. A single `*` matches any sequence of characters including path separators
+    /// because `require_literal_separator` is `false`.
+    ///
+    /// Patterns that cannot be compiled even after normalisation are silently skipped.
+    #[must_use]
+    pub fn matches_path(&self, path: &str) -> bool {
+        // Fast path: use the pre-compiled patterns when available so we don't
+        // re-run `Pattern::new` on every request. The vec is non-empty iff
+        // [`compile_patterns`](Self::compile_patterns) succeeded at load time
+        // and the slot has at least one pattern.
+        if !self.compiled_patterns.is_empty() {
+            return self.compiled_patterns.iter().any(|p| p.matches(path));
+        }
+
+        // Fallback for slots constructed by hand (tests, legacy callers that
+        // skip `compile_patterns`). Re-compiles on every call.
+        self.page_patterns
+            .iter()
+            .any(|pattern| match Pattern::new(pattern) {
+                Ok(p) => p.matches(path),
+                Err(_) => {
+                    let normalised = pattern.replace("**", "*");
+                    Pattern::new(&normalised)
+                        .map(|p| p.matches(path))
+                        .unwrap_or(false)
+                }
+            })
+    }
+
+    /// Compile [`page_patterns`](Self::page_patterns) into the
+    /// [`compiled_patterns`](Self::compiled_patterns) cache.
+    ///
+    /// Patterns that fail to compile (either directly or after the `**`→`*`
+    /// normalisation that [`matches_path`](Self::matches_path) does) are
+    /// silently skipped — the slot just becomes un-matchable, matching the
+    /// fallback behaviour.
+    ///
+    /// Idempotent: calling twice replaces the cache, so a slot list reloaded
+    /// at runtime won't accumulate stale patterns.
+    pub fn compile_patterns(&mut self) {
+        self.compiled_patterns = self
+            .page_patterns
+            .iter()
+            .filter_map(|pattern| {
+                Pattern::new(pattern)
+                    .or_else(|_| Pattern::new(&pattern.replace("**", "*")))
+                    .ok()
+            })
+            .collect();
+    }
+
+    /// Returns the GAM ad unit path for this slot.
+    ///
+    /// Uses the explicit [`gam_unit_path`](Self::gam_unit_path) override when set,
+    /// otherwise constructs `/<gam_network_id>/<id>`.
+    #[must_use]
+    pub fn resolved_gam_unit_path(&self, gam_network_id: &str) -> String {
+        self.gam_unit_path
+            .clone()
+            .unwrap_or_else(|| format!("/{}/{}", gam_network_id, self.id))
+    }
+
+    /// Returns the div element ID for this slot.
+    ///
+    /// Returns the [`div_id`](Self::div_id) override when set, otherwise returns [`id`](Self::id).
+    #[must_use]
+    pub fn resolved_div_id(&self) -> &str {
+        self.div_id.as_deref().unwrap_or(&self.id)
+    }
+
+    /// Converts this slot into an [`AdSlot`] ready for use in an auction request.
+    ///
+    /// Provider-specific params (e.g., APS `slotID`, PBS bidder params) are wired
+    /// into the `bidders` map keyed by provider/bidder name.
+    ///
+    /// When [`PrebidSlotParams::bidders`] is empty, a `trustedServer` entry is
+    /// injected so [`PrebidAuctionProvider`] expands all `config.bidders`
+    /// automatically. The slot's `targeting.zone` value is forwarded as
+    /// `trustedServer.zone` so zone-aware bid-param override rules fire correctly.
+    #[must_use]
+    pub fn to_ad_slot(&self) -> AdSlot {
+        let mut bidders: HashMap<String, serde_json::Value> = HashMap::new();
+        if let Some(ref aps) = self.providers.aps {
+            bidders.insert(
+                "aps".to_string(),
+                serde_json::json!({ "slotID": aps.slot_id }),
+            );
+        }
+        if let Some(ref prebid) = self.providers.prebid {
+            if prebid.bidders.is_empty() {
+                // No explicit per-bidder override: let the Prebid provider expand
+                // all config.bidders. The "trustedServer" key triggers
+                // expand_trusted_server_bidders in PrebidAuctionProvider, giving
+                // each bidder an empty params object that the override engine then
+                // fills with zone-aware rules.
+                let mut ts = serde_json::json!({ "bidderParams": {} });
+                if let Some(zone) = self.targeting.get("zone") {
+                    ts["zone"] = serde_json::Value::String(zone.clone());
+                }
+                bidders.insert("trustedServer".to_string(), ts);
+            } else {
+                for (name, params) in &prebid.bidders {
+                    bidders.insert(name.clone(), params.clone());
+                }
+            }
+        }
+        AdSlot {
+            id: self.id.clone(),
+            formats: self
+                .formats
+                .iter()
+                .map(CreativeOpportunityFormat::to_ad_format)
+                .collect(),
+            floor_price: self.floor_price,
+            targeting: self
+                .targeting
+                .iter()
+                .map(|(k, v)| (k.clone(), serde_json::Value::String(v.clone())))
+                .collect(),
+            bidders,
+        }
+    }
+}
+
+/// An ad format combining a media type with pixel dimensions.
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct CreativeOpportunityFormat {
+    /// Creative width in pixels.
+    pub width: u32,
+    /// Creative height in pixels.
+    pub height: u32,
+    /// Media type for this format.
+    #[serde(default = "MediaType::banner")]
+    pub media_type: MediaType,
+}
+
+impl CreativeOpportunityFormat {
+    fn to_ad_format(&self) -> AdFormat {
+        AdFormat {
+            media_type: self.media_type.clone(),
+            width: self.width,
+            height: self.height,
+        }
+    }
+}
+
+/// Provider-specific slot identifiers for a [`CreativeOpportunitySlot`].
+#[derive(Debug, Clone, Default, Deserialize, Serialize)]
+pub struct SlotProviders {
+    /// Amazon Publisher Services (APS/TAM) slot parameters.
+    pub aps: Option<ApsSlotParams>,
+    /// Prebid Server inline bidder parameters.
+    ///
+    /// When present, these are forwarded directly as `ext.prebid.bidder.*`
+    /// in the `OpenRTB` request, bypassing PBS stored request lookup for this slot.
+    /// Useful in development environments where stored requests are not available.
+    pub prebid: Option<PrebidSlotParams>,
+}
+
+/// APS-specific parameters for a slot.
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct ApsSlotParams {
+    /// The APS slot ID string used when making TAM bid requests.
+    pub slot_id: String,
+}
+
+/// Inline Prebid Server bidder parameters for a slot.
+///
+/// When `bidders` is empty, `to_ad_slot` injects a `trustedServer` entry so
+/// [`PrebidAuctionProvider`] expands all `config.bidders` automatically.
+/// When `bidders` is non-empty the map is forwarded verbatim, bypassing
+/// automatic expansion (useful for slots that need explicit per-bidder params).
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct PrebidSlotParams {
+    /// Per-bidder inline params map. Bidder name → params object.
+    ///
+    /// Leave empty (or omit `bidders` in config) to auto-expand all
+    /// `config.bidders` with zone-aware param overrides.
+    #[serde(default)]
+    pub bidders: HashMap<String, serde_json::Value>,
+}
+
+/// Validates that a slot ID contains only safe characters.
+///
+/// Allowed characters: ASCII alphanumerics, underscores (`_`), and hyphens (`-`).
+///
+/// # Errors
+///
+/// Returns an error string when the ID is empty or contains disallowed characters.
+pub fn validate_slot_id(id: &str) -> Result<(), String> {
+    if id.is_empty() {
+        return Err("slot id must not be empty".to_string());
+    }
+    if id
+        .chars()
+        .all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-')
+    {
+        Ok(())
+    } else {
+        Err(format!(
+            "slot id '{id}' contains invalid characters; only [A-Za-z0-9_-] allowed"
+        ))
+    }
+}
+
+/// Returns all slots whose [`page_patterns`](CreativeOpportunitySlot::page_patterns) match `path`.
+#[must_use]
+pub fn match_slots<'a>(
+    slots: &'a [CreativeOpportunitySlot],
+    path: &str,
+) -> Vec<&'a CreativeOpportunitySlot> {
+    slots.iter().filter(|s| s.matches_path(path)).collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn make_slot(id: &str, patterns: Vec<&str>) -> CreativeOpportunitySlot {
+        CreativeOpportunitySlot {
+            id: id.to_string(),
+            gam_unit_path: None,
+            div_id: None,
+            page_patterns: patterns.into_iter().map(String::from).collect(),
+            formats: vec![CreativeOpportunityFormat {
+                width: 300,
+                height: 250,
+                media_type: crate::auction::types::MediaType::Banner,
+            }],
+            floor_price: Some(0.50),
+            targeting: Default::default(),
+            providers: Default::default(),
+            compiled_patterns: Vec::new(),
+        }
+    }
+
+    #[test]
+    fn compile_patterns_populates_cache_and_match_uses_it() {
+        let mut slot = make_slot("atf", vec!["/20**", "/about"]);
+        assert!(
+            slot.compiled_patterns.is_empty(),
+            "freshly-built slot should have no compiled patterns"
+        );
+        slot.compile_patterns();
+        assert_eq!(
+            slot.compiled_patterns.len(),
+            2,
+            "compile_patterns should populate one entry per page pattern"
+        );
+        assert!(
+            slot.matches_path("/2024/01/my-article/"),
+            "matches_path should hit the compiled-pattern fast path"
+        );
+        assert!(
+            slot.matches_path("/about"),
+            "matches_path should hit /about via the compiled cache"
+        );
+        assert!(
+            !slot.matches_path("/contact"),
+            "matches_path should reject paths that match nothing in the cache"
+        );
+    }
+
+    #[test]
+    fn compile_slots_populates_every_slot() {
+        let mut slots = vec![make_slot("a", vec!["/a/*"]), make_slot("b", vec!["/b/*"])];
+        for slot in &mut slots {
+            slot.compile_patterns();
+        }
+        for slot in &slots {
+            assert_eq!(
+                slot.compiled_patterns.len(),
+                1,
+                "every slot's patterns should be pre-compiled after compile_patterns()"
+            );
+        }
+    }
+
+    #[test]
+    fn glob_matches_article_path() {
+        let slot = make_slot("atf", vec!["/20**"]);
+        assert!(
+            slot.matches_path("/2024/01/my-article/"),
+            "should match article path"
+        );
+        assert!(!slot.matches_path("/"), "should not match root");
+    }
+
+    #[test]
+    fn exact_match_homepage() {
+        let slot = make_slot("home", vec!["/"]);
+        assert!(slot.matches_path("/"), "should match root");
+        assert!(!slot.matches_path("/about"), "should not match /about");
+    }
+
+    #[test]
+    fn slot_id_validates_alphanumeric() {
+        assert!(validate_slot_id("atf_sidebar_ad").is_ok());
+        assert!(validate_slot_id("below-content-0").is_ok());
+        assert!(validate_slot_id("").is_err(), "empty id should fail");
+        assert!(
+            validate_slot_id("xss<script>").is_err(),
+            "html in id should fail"
+        );
+        assert!(validate_slot_id("has space").is_err(), "spaces should fail");
+    }
+
+    #[test]
+    fn resolved_gam_unit_path_uses_default_when_absent() {
+        let slot = make_slot("atf", vec!["/"]);
+        assert_eq!(
+            slot.resolved_gam_unit_path("21765378893"),
+            "/21765378893/atf"
+        );
+    }
+
+    #[test]
+    fn resolved_gam_unit_path_uses_override_when_set() {
+        let mut slot = make_slot("atf", vec!["/"]);
+        slot.gam_unit_path = Some("/21765378893/publisher/atf-sidebar".to_string());
+        assert_eq!(
+            slot.resolved_gam_unit_path("21765378893"),
+            "/21765378893/publisher/atf-sidebar"
+        );
+    }
+
+    #[test]
+    fn resolved_div_id_defaults_to_slot_id() {
+        let slot = make_slot("atf", vec!["/"]);
+        assert_eq!(slot.resolved_div_id(), "atf");
+    }
+
+    #[test]
+    fn to_ad_slot_wires_aps_params_into_bidders() {
+        let mut slot = make_slot("atf", vec!["/"]);
+        slot.providers.aps = Some(ApsSlotParams {
+            slot_id: "aps-slot-atf".to_string(),
+        });
+        let ad_slot = slot.to_ad_slot();
+        let aps_params = ad_slot.bidders.get("aps").expect("should have aps bidder");
+        assert_eq!(
+            aps_params.get("slotID").and_then(|v| v.as_str()),
+            Some("aps-slot-atf"),
+        );
+    }
+
+    #[test]
+    fn to_ad_slot_sets_floor_price_and_formats() {
+        let slot = make_slot("atf", vec!["/"]);
+        let ad_slot = slot.to_ad_slot();
+        assert_eq!(ad_slot.id, "atf");
+        assert_eq!(ad_slot.floor_price, Some(0.50));
+        assert_eq!(ad_slot.formats.len(), 1);
+    }
+
+    #[test]
+    fn to_ad_slot_injects_trusted_server_when_prebid_bidders_empty() {
+        let mut slot = make_slot("header", vec!["/"]);
+        slot.targeting
+            .insert("zone".to_string(), "header".to_string());
+        slot.providers.prebid = Some(PrebidSlotParams {
+            bidders: HashMap::new(),
+        });
+        let ad_slot = slot.to_ad_slot();
+
+        let ts = ad_slot
+            .bidders
+            .get("trustedServer")
+            .expect("should have trustedServer bidder");
+        assert_eq!(
+            ts.get("zone").and_then(|v| v.as_str()),
+            Some("header"),
+            "should forward zone from targeting"
+        );
+        assert!(
+            ts.get("bidderParams").is_some(),
+            "should include bidderParams key for expand_trusted_server_bidders"
+        );
+    }
+
+    #[test]
+    fn to_ad_slot_injects_trusted_server_without_zone_when_targeting_absent() {
+        let mut slot = make_slot("no-zone", vec!["/"]);
+        slot.providers.prebid = Some(PrebidSlotParams {
+            bidders: HashMap::new(),
+        });
+        let ad_slot = slot.to_ad_slot();
+
+        let ts = ad_slot
+            .bidders
+            .get("trustedServer")
+            .expect("should have trustedServer bidder");
+        assert!(
+            ts.get("zone").is_none(),
+            "should not inject zone when targeting has no zone key"
+        );
+    }
+
+    #[test]
+    fn to_ad_slot_uses_explicit_bidders_when_nonempty() {
+        let mut slot = make_slot("explicit", vec!["/"]);
+        slot.providers.prebid = Some(PrebidSlotParams {
+            bidders: HashMap::from([(
+                "mocktioneer".to_string(),
+                serde_json::json!({"custom": true}),
+            )]),
+        });
+        let ad_slot = slot.to_ad_slot();
+
+        assert!(
+            !ad_slot.bidders.contains_key("trustedServer"),
+            "should not inject trustedServer when explicit bidders are set"
+        );
+        let params = ad_slot
+            .bidders
+            .get("mocktioneer")
+            .expect("should have mocktioneer bidder");
+        assert_eq!(
+            params.get("custom").and_then(serde_json::Value::as_bool),
+            Some(true)
+        );
+    }
+
+    #[test]
+    fn prebid_slot_params_deserializes_without_bidders_field() {
+        let json = r#"{"bidders": {}}"#;
+        let params: PrebidSlotParams =
+            serde_json::from_str(json).expect("should deserialize with empty bidders");
+        assert!(params.bidders.is_empty(), "should have empty bidders map");
+
+        let json_no_field = r#"{}"#;
+        let params2: PrebidSlotParams =
+            serde_json::from_str(json_no_field).expect("should deserialize without bidders field");
+        assert!(
+            params2.bidders.is_empty(),
+            "should default to empty when bidders field absent"
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/html_processor.rs b/crates/trusted-server-core/src/html_processor.rs
index 18765f0c..8d3b45e6 100644
--- a/crates/trusted-server-core/src/html_processor.rs
+++ b/crates/trusted-server-core/src/html_processor.rs
@@ -4,15 +4,21 @@
 use std::cell::Cell;
 use std::io;
 use std::rc::Rc;
+use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::Arc;
 
-use lol_html::{element, html_content::ContentType, text, Settings as RewriterSettings};
+use lol_html::{
+    element,
+    html_content::{ContentType, EndTag},
+    text, EndTagHandler, Settings as RewriterSettings,
+};
 
 use crate::integrations::{
     AttributeRewriteOutcome, IntegrationAttributeContext, IntegrationDocumentState,
     IntegrationHtmlContext, IntegrationHtmlPostProcessor, IntegrationRegistry,
     IntegrationScriptContext, ScriptRewriteAction,
 };
+use crate::publisher::build_empty_bids_script;
 use crate::settings::Settings;
 use crate::streaming_processor::{HtmlRewriterAdapter, StreamProcessor};
 use crate::tsjs;
@@ -120,6 +126,13 @@ pub struct HtmlProcessorConfig {
     pub request_host: String,
     pub request_scheme: String,
     pub integrations: IntegrationRegistry,
+    /// Pre-computed `<script>(window.tsjs=window.tsjs||{}).adSlots=...;</script>`.
+    /// Injected at `<head>` open. `None` when no slots matched.
+    pub ad_slots_script: Option<String>,
+    /// Shared auction result — written by auction task before HTML processing begins.
+    /// Handler reads this in `el.on_end_tag()` on the body element.
+    /// `None` means no auction ran; inject empty `tsjs.bids = {}` as fallback.
+    pub ad_bids_state: std::sync::Arc<std::sync::Mutex<Option<String>>>,
 }
 
 impl HtmlProcessorConfig {
@@ -137,11 +150,36 @@ impl HtmlProcessorConfig {
             request_host: request_host.to_string(),
             request_scheme: request_scheme.to_string(),
             integrations: integrations.clone(),
+            ad_slots_script: None,
+            ad_bids_state: std::sync::Arc::new(std::sync::Mutex::new(None)),
         }
     }
+
+    /// Attach the streaming-auction `<script>` payloads to a config built via
+    /// [`HtmlProcessorConfig::from_settings`].
+    ///
+    /// Callers that drive the auction-hold streaming path use this rather than
+    /// constructing [`HtmlProcessorConfig`] inline so the canonical
+    /// [`from_settings`](Self::from_settings) builder stays the single source of
+    /// truth: future fields added there are inherited automatically.
+    #[must_use]
+    pub fn with_ad_state(
+        mut self,
+        ad_slots_script: Option<String>,
+        ad_bids_state: std::sync::Arc<std::sync::Mutex<Option<String>>>,
+    ) -> Self {
+        self.ad_slots_script = ad_slots_script;
+        self.ad_bids_state = ad_bids_state;
+        self
+    }
 }
 
-/// Create an HTML processor with URL replacement and integration hooks
+/// Create an HTML processor with URL replacement and integration hooks.
+///
+/// # Panics
+///
+/// Panics if the `ad_bids_state` `Mutex` is poisoned. This cannot happen in
+/// normal operation since no code holds the lock across a panic boundary.
 #[must_use]
 pub fn create_html_processor(config: HtmlProcessorConfig) -> impl StreamProcessor {
     let post_processors = config.integrations.html_post_processors();
@@ -214,8 +252,11 @@ pub fn create_html_processor(config: HtmlProcessorConfig) -> impl StreamProcesso
     });
 
     let injected_tsjs = Rc::new(Cell::new(false));
+    let injected_bids = Arc::new(AtomicBool::new(false));
     let integration_registry = config.integrations.clone();
     let script_rewriters = integration_registry.script_rewriters();
+    let ad_slots_script = config.ad_slots_script.clone();
+    let ad_bids_state = config.ad_bids_state.clone();
 
     let mut element_content_handlers = vec![
         // Inject unified tsjs bundle once at the start of <head>
@@ -224,9 +265,14 @@ pub fn create_html_processor(config: HtmlProcessorConfig) -> impl StreamProcesso
             let integrations = integration_registry.clone();
             let patterns = patterns.clone();
             let document_state = document_state.clone();
+            let ad_slots_script = ad_slots_script.clone();
             move |el| {
                 if !injected_tsjs.get() {
                     let mut snippet = String::new();
+                    // Inject ad slots script first so it appears before tsjs bundle.
+                    if let Some(ref slots_script) = ad_slots_script {
+                        snippet.push_str(slots_script);
+                    }
                     let ctx = IntegrationHtmlContext {
                         request_host: &patterns.request_host,
                         request_scheme: &patterns.request_scheme,
@@ -251,6 +297,42 @@ pub fn create_html_processor(config: HtmlProcessorConfig) -> impl StreamProcesso
                 Ok(())
             }
         }),
+        // Inject tsjs.bids before </body> via end_tag_handlers — only when
+        // slots matched this URL. When no slots matched, skip injection entirely
+        // so the publisher's existing client-side Prebid/GPT flow is unmodified
+        // (dual-mode rollout: calling tsjs.adInit with empty slots would invoke
+        // enableSingleRequest/enableServices and conflict with the publisher's GPT init).
+        // Guard with AtomicBool so the script is only injected once even if
+        // the origin HTML contains multiple <body> elements (e.g. template fragments).
+        element!("body", {
+            let state = ad_bids_state.clone();
+            let injected_bids = injected_bids.clone();
+            let has_slots = ad_slots_script.is_some();
+            move |el| {
+                if !has_slots {
+                    return Ok(());
+                }
+                let state = state.clone();
+                let injected_bids = injected_bids.clone();
+                if let Some(handlers) = el.end_tag_handlers() {
+                    let handler: EndTagHandler<'static> =
+                        Box::new(move |end_tag: &mut EndTag<'_>| {
+                            if injected_bids.swap(true, Ordering::SeqCst) {
+                                return Ok(());
+                            }
+                            let script_guard = state.lock().expect("should lock bid state");
+                            let bids_script = match &*script_guard {
+                                Some(s) => s.clone(),
+                                None => build_empty_bids_script(),
+                            };
+                            end_tag.before(&bids_script, ContentType::Html);
+                            Ok(())
+                        });
+                    handlers.push(handler);
+                }
+                Ok(())
+            }
+        }),
         // Replace URLs in href attributes
         element!("[href]", {
             let patterns = patterns.clone();
@@ -526,6 +608,8 @@ mod tests {
             request_host: "test.example.com".to_string(),
             request_scheme: "https".to_string(),
             integrations: IntegrationRegistry::default(),
+            ad_slots_script: None,
+            ad_bids_state: std::sync::Arc::new(std::sync::Mutex::new(None)),
         }
     }
 
@@ -1183,4 +1267,151 @@ mod tests {
             "should contain post-processor mutation"
         );
     }
+
+    #[test]
+    fn injects_ad_slots_at_head_open() {
+        let config = HtmlProcessorConfig {
+            origin_host: "origin.example.com".to_string(),
+            request_host: "example.com".to_string(),
+            request_scheme: "https".to_string(),
+            integrations: IntegrationRegistry::empty_for_tests(),
+            ad_slots_script: Some(
+                r#"<script>(window.tsjs=window.tsjs||{}).adSlots=JSON.parse("[]");</script>"#
+                    .to_string(),
+            ),
+            ad_bids_state: std::sync::Arc::new(std::sync::Mutex::new(None)),
+        };
+        let mut processor = create_html_processor(config);
+        let output = processor
+            .process_chunk(
+                b"<html><head><title>T</title></head><body>content</body></html>",
+                true,
+            )
+            .expect("should process");
+        let html = std::str::from_utf8(&output).expect("should be utf8");
+        assert!(
+            html.contains("window.tsjs=window.tsjs||{}"),
+            "should inject ad slots namespace at head-open"
+        );
+        assert!(
+            html.contains(".adSlots=JSON.parse"),
+            "should inject adSlots at head-open"
+        );
+        assert!(
+            !html.contains("__ts_request_id"),
+            "must NOT inject request_id"
+        );
+    }
+
+    #[test]
+    fn injects_ts_bids_before_body_close() {
+        let bids_script = r#"<script>(window.tsjs=window.tsjs||{}).bids=JSON.parse("{\"atf\":{\"hb_pb\":\"1.00\"}}");</script>"#;
+        let state = std::sync::Arc::new(std::sync::Mutex::new(Some(bids_script.to_string())));
+        let config = HtmlProcessorConfig {
+            origin_host: "origin.example.com".to_string(),
+            request_host: "example.com".to_string(),
+            request_scheme: "https".to_string(),
+            integrations: IntegrationRegistry::empty_for_tests(),
+            ad_slots_script: Some(
+                r#"<script>(window.tsjs=window.tsjs||{}).adSlots=[];</script>"#.to_string(),
+            ),
+            ad_bids_state: state,
+        };
+        let mut processor = create_html_processor(config);
+        let output = processor
+            .process_chunk(b"<html><head></head><body>content</body></html>", true)
+            .expect("should process");
+        let html = std::str::from_utf8(&output).expect("should be utf8");
+        assert!(
+            html.contains("window.tsjs=window.tsjs||{}"),
+            "should inject _ts namespace for bids before </body>"
+        );
+        assert!(
+            html.contains(".bids=JSON.parse"),
+            "should inject bids before </body>"
+        );
+        let bids_pos = html
+            .find("window.tsjs=window.tsjs||{}")
+            .expect("bids namespace should be in output");
+        let body_close_pos = html.find("</body>").expect("</body> should be in output");
+        assert!(bids_pos < body_close_pos, "bids must appear before </body>");
+    }
+
+    #[test]
+    fn injects_ts_bids_only_once_with_multiple_body_elements() {
+        let bids_script = r#"<script>(window.tsjs=window.tsjs||{}).bids=JSON.parse("{\"atf\":{\"hb_pb\":\"1.00\"}}");</script>"#;
+        let state = std::sync::Arc::new(std::sync::Mutex::new(Some(bids_script.to_string())));
+        let config = HtmlProcessorConfig {
+            origin_host: "origin.example.com".to_string(),
+            request_host: "example.com".to_string(),
+            request_scheme: "https".to_string(),
+            integrations: IntegrationRegistry::empty_for_tests(),
+            ad_slots_script: Some(
+                r#"<script>(window.tsjs=window.tsjs||{}).adSlots=[];</script>"#.to_string(),
+            ),
+            ad_bids_state: state,
+        };
+        let mut processor = create_html_processor(config);
+        // Malformed HTML with two <body> elements (common in CMS template pages)
+        let output = processor
+            .process_chunk(b"<html><body><body>content</body></body></html>", true)
+            .expect("should process");
+        let html = std::str::from_utf8(&output).expect("should be utf8");
+        assert_eq!(
+            html.matches(".bids=JSON.parse").count(),
+            1,
+            "should inject tsjs.bids exactly once even with multiple <body> elements"
+        );
+    }
+
+    #[test]
+    fn injects_empty_ts_bids_when_slots_matched_but_auction_returned_nothing() {
+        // Slots matched (ad_slots_script is Some) but auction task never wrote a result
+        // (state is None) — e.g. auction timed out with zero bids. Fallback to {}.
+        let state = std::sync::Arc::new(std::sync::Mutex::new(None));
+        let config = HtmlProcessorConfig {
+            origin_host: "origin.example.com".to_string(),
+            request_host: "example.com".to_string(),
+            request_scheme: "https".to_string(),
+            integrations: IntegrationRegistry::empty_for_tests(),
+            ad_slots_script: Some(
+                r#"<script>(window.tsjs=window.tsjs||{}).adSlots=[];</script>"#.to_string(),
+            ),
+            ad_bids_state: state,
+        };
+        let mut processor = create_html_processor(config);
+        let output = processor
+            .process_chunk(b"<html><head></head><body>content</body></html>", true)
+            .expect("should process");
+        let html = std::str::from_utf8(&output).expect("should be utf8");
+        assert!(
+            html.contains(".bids=JSON.parse(\"{}\")"),
+            "should inject empty bids fallback when auction produced nothing"
+        );
+    }
+
+    #[test]
+    fn does_not_inject_ts_bids_when_no_slots_matched() {
+        // No slots matched this URL — ad_slots_script is None. tsjs.bids must be
+        // omitted entirely so the publisher's existing client-side GPT flow is
+        // unmodified (spec §8: "Existing client-side Prebid/GPT flow runs unmodified").
+        let state = std::sync::Arc::new(std::sync::Mutex::new(None));
+        let config = HtmlProcessorConfig {
+            origin_host: "origin.example.com".to_string(),
+            request_host: "example.com".to_string(),
+            request_scheme: "https".to_string(),
+            integrations: IntegrationRegistry::empty_for_tests(),
+            ad_slots_script: None,
+            ad_bids_state: state,
+        };
+        let mut processor = create_html_processor(config);
+        let output = processor
+            .process_chunk(b"<html><head></head><body>content</body></html>", true)
+            .expect("should process");
+        let html = std::str::from_utf8(&output).expect("should be utf8");
+        assert!(
+            !html.contains(".bids=JSON.parse"),
+            "should NOT inject tsjs.bids when no slots matched"
+        );
+    }
 }
diff --git a/crates/trusted-server-core/src/integrations/adserver_mock.rs b/crates/trusted-server-core/src/integrations/adserver_mock.rs
index 50b1f9fa..8dc18e28 100644
--- a/crates/trusted-server-core/src/integrations/adserver_mock.rs
+++ b/crates/trusted-server-core/src/integrations/adserver_mock.rs
@@ -10,7 +10,7 @@ use fastly::Request;
 use serde::{Deserialize, Serialize};
 use serde_json::{json, Value as Json};
 use std::collections::{BTreeMap, HashMap};
-use std::sync::Arc;
+use std::sync::{Arc, Mutex};
 use std::time::Duration;
 use validator::Validate;
 
@@ -88,16 +88,28 @@ impl IntegrationConfig for AdServerMockConfig {
 // Provider
 // ============================================================================
 
+/// Lookup index built from original SSP bids during `request_bids`, consumed
+/// during `parse_response` to restore render/accounting fields that the mock
+/// mediator endpoint does not echo back.
+///
+/// Keyed by `(provider_name, slot_id, bidder_name)`.
+type BidIndex = HashMap<(String, String, String), Bid>;
+
 /// Mock ad server mediator provider.
 pub struct AdServerMockProvider {
     config: AdServerMockConfig,
+    /// Bridges SSP bid metadata from `request_bids` to `parse_response`.
+    bid_index: Mutex<Option<BidIndex>>,
 }
 
 impl AdServerMockProvider {
     /// Create a new mock ad server provider.
     #[must_use]
     pub fn new(config: AdServerMockConfig) -> Self {
-        Self { config }
+        Self {
+            config,
+            bid_index: Mutex::new(None),
+        }
     }
 
     /// Build the mediation endpoint URL, appending context values as query
@@ -133,36 +145,21 @@ impl AdServerMockProvider {
                     .bids
                     .iter()
                     .map(|bid| {
-                        // Check if this is an APS bid with encoded price (inferred from amznbid in metadata)
-                        let encoded_price = bid
-                            .metadata
-                            .get("amznbid")
-                            .and_then(|v| v.as_str())
-                            .map(String::from);
-
-                        if encoded_price.is_some() {
-                            // APS bid - send encoded price for mediation to decode
-                            json!({
-                                "imp_id": bid.slot_id,
-                                "encoded_price": encoded_price,
-                                "adm": bid.creative,
-                                "w": bid.width,
-                                "h": bid.height,
-                                "crid": format!("{}-creative", bid.bidder),
-                                "adomain": bid.adomain,
-                            })
-                        } else {
-                            // Regular bid with decoded price
-                            json!({
-                                "imp_id": bid.slot_id,
-                                "price": bid.price,
-                                "adm": bid.creative,
-                                "w": bid.width,
-                                "h": bid.height,
-                                "crid": format!("{}-creative", bid.bidder),
-                                "adomain": bid.adomain,
-                            })
-                        }
+                        // Mocktioneer mediator always requires a numeric `price` field.
+                        // APS bids carry price as an opaque encoded string (`amznbid`)
+                        // that cannot be decoded client-side; use `bid.price` when set
+                        // (a real decoded value) or fall back to a mock floor price for
+                        // test/demo purposes.
+                        let price = bid.price.unwrap_or(1.50);
+                        json!({
+                            "imp_id": bid.slot_id,
+                            "price": price,
+                            "adm": bid.creative,
+                            "w": bid.width,
+                            "h": bid.height,
+                            "crid": format!("{}-creative", bid.bidder),
+                            "adomain": bid.adomain,
+                        })
                     })
                     .collect();
 
@@ -227,8 +224,17 @@ impl AdServerMockProvider {
 
     /// Parse `OpenRTB` response from mediation endpoint.
     /// Mediation returns decoded prices for all bids (including APS bids that were encoded).
-    fn parse_mediation_response(&self, json: &Json, response_time_ms: u64) -> AuctionResponse {
-        // Parse OpenRTB response
+    ///
+    /// `bid_index` is the SSP-bid lookup built in `request_bids`. The mock mediator
+    /// does not echo render/accounting fields back, so they are restored from the index
+    /// using `(seat, impid, bidder)` where bidder is recovered from the echoed `crid`
+    /// field (`"{bidder}-creative"` format set during request construction).
+    fn parse_mediation_response(
+        &self,
+        json: &Json,
+        response_time_ms: u64,
+        bid_index: &BidIndex,
+    ) -> AuctionResponse {
         let empty_array = vec![];
         let seatbid = json["seatbid"].as_array().unwrap_or(&empty_array);
 
@@ -240,22 +246,50 @@ impl AdServerMockProvider {
             let bids = seat["bid"].as_array().unwrap_or(&empty_bids);
 
             for bid in bids {
-                // Mediation layer returns decoded prices for all bids
+                let slot_id = bid["impid"].as_str().unwrap_or("").to_string();
+
+                // Recover bidder name from crid ("{bidder}-creative") to look up the
+                // original SSP bid and restore render/accounting fields the mediator drops.
+                let crid = bid["crid"].as_str().unwrap_or("");
+                let bidder = crid.strip_suffix("-creative").unwrap_or_else(|| {
+                    log::debug!(
+                        "adserver_mock: crid '{crid}' does not match '<bidder>-creative'; render/accounting fields may be missing"
+                    );
+                    ""
+                });
+                let key = (seat_name.to_string(), slot_id.clone(), bidder.to_string());
+                let original = bid_index.get(&key);
+                let restored_bidder =
+                    original.map_or_else(|| seat_name.to_string(), |b| b.bidder.clone());
+
+                let width = bid["w"].as_u64().unwrap_or(0) as u32;
+                let height = bid["h"].as_u64().unwrap_or(0) as u32;
+                if width == 0 || height == 0 {
+                    log::debug!(
+                        "adserver_mock: bid for slot '{slot_id}' has zero dimension ({width}×{height}), skipping"
+                    );
+                    continue;
+                }
+
                 all_bids.push(Bid {
-                    slot_id: bid["impid"].as_str().unwrap_or("").to_string(),
-                    price: bid["price"].as_f64(), // Now properly decoded by mediation
+                    slot_id,
+                    price: bid["price"].as_f64(),
                     currency: "USD".to_string(),
                     creative: bid["adm"].as_str().map(String::from),
-                    width: bid["w"].as_u64().unwrap_or(0) as u32,
-                    height: bid["h"].as_u64().unwrap_or(0) as u32,
-                    bidder: seat_name.to_string(),
+                    width,
+                    height,
+                    bidder: restored_bidder,
                     adomain: bid["adomain"].as_array().map(|arr| {
                         arr.iter()
                             .filter_map(|v| v.as_str().map(String::from))
                             .collect()
                     }),
-                    nurl: None,
-                    burl: None,
+                    nurl: original.and_then(|b| b.nurl.clone()),
+                    burl: original.and_then(|b| b.burl.clone()),
+                    ad_id: original.and_then(|b| b.ad_id.clone()),
+                    cache_id: original.and_then(|b| b.cache_id.clone()),
+                    cache_host: original.and_then(|b| b.cache_host.clone()),
+                    cache_path: original.and_then(|b| b.cache_path.clone()),
                     metadata: HashMap::new(),
                 });
             }
@@ -288,6 +322,23 @@ impl AuctionProvider for AdServerMockProvider {
             bidder_responses.len()
         );
 
+        // Build bid index so parse_response can restore nurl/burl/ad_id from
+        // the original SSP bids (the mock mediator does not echo these fields).
+        let mut index = BidIndex::new();
+        for response in bidder_responses {
+            for bid in &response.bids {
+                index.insert(
+                    (
+                        response.provider.clone(),
+                        bid.slot_id.clone(),
+                        bid.bidder.clone(),
+                    ),
+                    bid.clone(),
+                );
+            }
+        }
+        *self.bid_index.lock().expect("should lock bid index") = Some(index);
+
         // Build mediation request
         let mediation_req = self
             .build_mediation_request(request, bidder_responses)
@@ -363,7 +414,15 @@ impl AuctionProvider for AdServerMockProvider {
 
         log::trace!("AdServer Mock response: {:?}", response_json);
 
-        let auction_response = self.parse_mediation_response(&response_json, response_time_ms);
+        let bid_index = self
+            .bid_index
+            .lock()
+            .expect("should lock bid index")
+            .take()
+            .unwrap_or_default();
+
+        let auction_response =
+            self.parse_mediation_response(&response_json, response_time_ms, &bid_index);
 
         log::info!(
             "AdServer Mock returned {} bids in {}ms",
@@ -507,6 +566,10 @@ mod tests {
                     adomain: Some(vec!["amazon.com".to_string()]),
                     nurl: None,
                     burl: None,
+                    ad_id: None,
+                    cache_id: None,
+                    cache_host: None,
+                    cache_path: None,
                     metadata: HashMap::new(),
                 }],
                 response_time_ms: 150,
@@ -524,8 +587,12 @@ mod tests {
                     height: 90,
                     bidder: "test-bidder".to_string(),
                     adomain: None,
-                    nurl: None,
-                    burl: None,
+                    nurl: Some("https://ssp.example/win?id=mock-bid-001".to_string()),
+                    burl: Some("https://ssp.example/bill?id=mock-bid-001".to_string()),
+                    ad_id: Some("mock-bid-001".to_string()),
+                    cache_id: None,
+                    cache_host: None,
+                    cache_path: None,
                     metadata: HashMap::new(),
                 }],
                 response_time_ms: 120,
@@ -583,7 +650,8 @@ mod tests {
             "cur": "USD"
         });
 
-        let auction_response = provider.parse_mediation_response(&mediation_response, 200);
+        let auction_response =
+            provider.parse_mediation_response(&mediation_response, 200, &BidIndex::new());
 
         assert_eq!(auction_response.provider, "adserver_mock");
         assert_eq!(auction_response.status, BidStatus::Success);
@@ -598,6 +666,98 @@ mod tests {
         assert_eq!(bid.height, 90);
     }
 
+    #[test]
+    fn parse_mediation_response_restores_original_bid_render_fields() {
+        let provider = AdServerMockProvider::new(AdServerMockConfig::default());
+        let mediation_response = json!({
+            "id": "test-auction-123",
+            "seatbid": [
+                {
+                    "seat": "prebid",
+                    "bid": [
+                        {
+                            "id": "mediated-bid-001",
+                            "impid": "header-banner",
+                            "price": 0.20,
+                            "adm": "<div>Mediated Ad</div>",
+                            "w": 728,
+                            "h": 90,
+                            "crid": "mocktioneer-creative",
+                            "adomain": ["example.com"]
+                        }
+                    ]
+                }
+            ],
+            "cur": "USD"
+        });
+        let mut bid_index = BidIndex::new();
+        bid_index.insert(
+            (
+                "prebid".to_string(),
+                "header-banner".to_string(),
+                "mocktioneer".to_string(),
+            ),
+            Bid {
+                slot_id: "header-banner".to_string(),
+                price: Some(0.20),
+                currency: "USD".to_string(),
+                creative: Some("<div>Original Ad</div>".to_string()),
+                adomain: Some(vec!["example.com".to_string()]),
+                bidder: "mocktioneer".to_string(),
+                width: 728,
+                height: 90,
+                nurl: Some("https://ssp.example/win".to_string()),
+                burl: Some("https://ssp.example/bill".to_string()),
+                ad_id: Some("bid-impression-id".to_string()),
+                cache_id: Some("cache-uuid".to_string()),
+                cache_host: Some("cache.example".to_string()),
+                cache_path: Some("/cache".to_string()),
+                metadata: HashMap::new(),
+            },
+        );
+
+        let auction_response =
+            provider.parse_mediation_response(&mediation_response, 42, &bid_index);
+
+        assert_eq!(auction_response.status, BidStatus::Success);
+        assert_eq!(auction_response.bids.len(), 1);
+        let bid = &auction_response.bids[0];
+        assert_eq!(
+            bid.bidder, "mocktioneer",
+            "should preserve underlying bidder for hb_bidder targeting"
+        );
+        assert_eq!(
+            bid.nurl.as_deref(),
+            Some("https://ssp.example/win"),
+            "should restore nurl"
+        );
+        assert_eq!(
+            bid.burl.as_deref(),
+            Some("https://ssp.example/bill"),
+            "should restore burl"
+        );
+        assert_eq!(
+            bid.ad_id.as_deref(),
+            Some("bid-impression-id"),
+            "should restore ad_id"
+        );
+        assert_eq!(
+            bid.cache_id.as_deref(),
+            Some("cache-uuid"),
+            "should restore PBS cache UUID"
+        );
+        assert_eq!(
+            bid.cache_host.as_deref(),
+            Some("cache.example"),
+            "should restore PBS cache host"
+        );
+        assert_eq!(
+            bid.cache_path.as_deref(),
+            Some("/cache"),
+            "should restore PBS cache path"
+        );
+    }
+
     #[test]
     fn test_parse_empty_mediation_response() {
         let config = AdServerMockConfig::default();
@@ -609,7 +769,8 @@ mod tests {
             "cur": "USD"
         });
 
-        let auction_response = provider.parse_mediation_response(&mediation_response, 100);
+        let auction_response =
+            provider.parse_mediation_response(&mediation_response, 100, &BidIndex::new());
 
         assert_eq!(auction_response.status, BidStatus::NoBid);
         assert_eq!(auction_response.bids.len(), 0);
@@ -666,6 +827,10 @@ mod tests {
                 adomain: Some(vec!["amazon.com".to_string()]),
                 nurl: None,
                 burl: None,
+                ad_id: None,
+                cache_id: None,
+                cache_host: None,
+                cache_path: None,
                 metadata: aps_metadata,
             }],
             response_time_ms: 100,
@@ -686,20 +851,15 @@ mod tests {
         let bid = &bidder_resp["bids"][0];
         assert_eq!(bid["imp_id"], "slot-1");
 
-        // Key assertions for APS-style encoded price bids:
-        // 1. Should NOT have "price" field (or it should be null)
-        assert!(
-            bid["price"].is_null(),
-            "APS bids should not have decoded price, got: {:?}",
-            bid["price"]
-        );
-        // 2. Should have "encoded_price" field
+        // APS bids have no decoded price (bid.price == None), so the mock floor
+        // price (1.50) is used.  Mocktioneer requires a numeric price field and
+        // does not accept an opaque encoded_price string.
         assert_eq!(
-            bid["encoded_price"].as_str(),
-            Some("encoded-price-value"),
-            "APS bids should have encoded_price from metadata"
+            bid["price"].as_f64(),
+            Some(1.50),
+            "APS bids with no decoded price should fall back to mock floor price 1.50"
         );
-        // 3. adm should be null (not a string)
+        // adm should be null (not a string)
         assert!(
             bid["adm"].is_null(),
             "Creative-less bids should have null adm, got: {:?}",
@@ -807,7 +967,8 @@ mod tests {
             "cur": "USD"
         });
 
-        let auction_response = provider.parse_mediation_response(&mediation_response, 200);
+        let auction_response =
+            provider.parse_mediation_response(&mediation_response, 200, &BidIndex::new());
 
         assert_eq!(auction_response.status, BidStatus::Success);
         assert_eq!(auction_response.bids.len(), 2);
diff --git a/crates/trusted-server-core/src/integrations/aps.rs b/crates/trusted-server-core/src/integrations/aps.rs
index 1c966e71..34e26ebe 100644
--- a/crates/trusted-server-core/src/integrations/aps.rs
+++ b/crates/trusted-server-core/src/integrations/aps.rs
@@ -286,24 +286,46 @@ impl IntegrationConfig for ApsConfig {
 /// Amazon APS auction provider.
 pub struct ApsAuctionProvider {
     config: ApsConfig,
+    // Maps APS slot ID → creative opportunity slot ID for the in-flight request.
+    // Written by request_bids before the async send; read by parse_response when the
+    // response arrives. Safe because Fastly Compute runs each request in an isolated
+    // single-threaded Wasm instance — the Mutex never contends in practice.
+    slot_id_map: std::sync::Mutex<HashMap<String, String>>,
 }
 
 impl ApsAuctionProvider {
     /// Create a new APS auction provider.
     #[must_use]
     pub fn new(config: ApsConfig) -> Self {
-        Self { config }
+        Self {
+            config,
+            slot_id_map: std::sync::Mutex::new(HashMap::new()),
+        }
     }
 
     /// Convert unified `AuctionRequest` to APS TAM bid request format.
     ///
+    /// Returns the serialisable `ApsBidRequest` and a map of APS slot ID →
+    /// creative-opportunity slot ID so the caller can remap bids in the response.
     /// Populates consent fields (GDPR, US Privacy, GPP) from the
     /// [`ConsentContext`](crate::consent::ConsentContext) attached to the request.
-    fn to_aps_request(&self, request: &AuctionRequest) -> ApsBidRequest {
+    fn to_aps_request(&self, request: &AuctionRequest) -> (ApsBidRequest, HashMap<String, String>) {
+        let mut slot_id_map: HashMap<String, String> = HashMap::new();
         let slots: Vec<ApsSlot> = request
             .slots
             .iter()
             .map(|slot| {
+                // Use the APS-specific slot ID from [slot.providers.aps] if configured;
+                // fall back to the creative-opportunity slot ID otherwise.
+                let aps_slot_id = slot
+                    .bidders
+                    .get("aps")
+                    .and_then(|p| p.get("slotID"))
+                    .and_then(|v| v.as_str())
+                    .unwrap_or(&slot.id)
+                    .to_string();
+                slot_id_map.insert(aps_slot_id.clone(), slot.id.clone());
+
                 // Extract sizes from banner formats
                 let sizes: Vec<[u32; 2]> = slot
                     .formats
@@ -313,7 +335,7 @@ impl ApsAuctionProvider {
                     .collect();
 
                 ApsSlot {
-                    slot_id: slot.id.clone(),
+                    slot_id: aps_slot_id,
                     sizes,
                     slot_name: Some(slot.id.clone()),
                 }
@@ -337,7 +359,7 @@ impl ApsAuctionProvider {
             })
         });
 
-        ApsBidRequest {
+        let bid_request = ApsBidRequest {
             pub_id: self.config.pub_id.clone(),
             slots,
             page_url: request.publisher.page_url.clone(),
@@ -347,7 +369,8 @@ impl ApsAuctionProvider {
             us_privacy,
             gpp,
             gpp_sid,
-        }
+        };
+        (bid_request, slot_id_map)
     }
 
     /// Parse size string (e.g., "300x250") into width and height.
@@ -383,7 +406,17 @@ impl ApsAuctionProvider {
         }
 
         // Parse size from "WxH" format
-        let (width, height) = Self::parse_size(&slot.size).unwrap_or((0, 0));
+        let (width, height) = match Self::parse_size(&slot.size) {
+            Some(dims) => dims,
+            None => {
+                log::debug!(
+                    "APS: slot '{}' has malformed size '{}', skipping",
+                    slot.slot_id,
+                    slot.size
+                );
+                return Err(());
+            }
+        };
 
         // Build metadata from targeting keys - includes encoded price for mediation
         let mut metadata = HashMap::new();
@@ -417,6 +450,10 @@ impl ApsAuctionProvider {
             height,
             nurl: None, // Real APS uses client-side event tracking
             burl: None,
+            ad_id: None,
+            cache_id: None,
+            cache_host: None,
+            cache_path: None,
             metadata,
         })
     }
@@ -432,9 +469,25 @@ impl ApsAuctionProvider {
                 aps_response.contextual.slots.len()
             );
 
+            // Take the map by value so it does not linger on the provider
+            // across requests if the Fastly Compute runtime ever reuses Wasm
+            // instances. Today each request gets its own instance so this is
+            // belt-and-suspenders; tomorrow it may not be.
+            let slot_map = std::mem::take(
+                &mut *self
+                    .slot_id_map
+                    .lock()
+                    .expect("should lock APS slot id map"),
+            );
             for slot in aps_response.contextual.slots {
                 match self.parse_aps_slot(&slot) {
-                    Ok(bid) => {
+                    Ok(mut bid) => {
+                        // Remap APS slot ID (e.g. "aps-slot-atf-sidebar") back to the
+                        // creative-opportunity slot ID (e.g. "atf_sidebar_ad") so the
+                        // mediator and bid_map can match by creative slot ID.
+                        if let Some(creative_id) = slot_map.get(&bid.slot_id) {
+                            bid.slot_id = creative_id.clone();
+                        }
                         let encoded_price = bid
                             .metadata
                             .get("amznbid")
@@ -484,8 +537,13 @@ impl AuctionProvider for ApsAuctionProvider {
             self.config.pub_id
         );
 
-        // Transform to APS format
-        let aps_request = self.to_aps_request(request);
+        // Transform to APS format; store the APS-slot-ID → creative-slot-ID map so
+        // parse_response can remap bids back to the creative opportunity slot ID.
+        let (aps_request, slot_id_map) = self.to_aps_request(request);
+        *self
+            .slot_id_map
+            .lock()
+            .expect("should lock APS slot id map") = slot_id_map;
 
         // Serialize to JSON
         let aps_json =
@@ -702,7 +760,7 @@ mod tests {
 
         let provider = ApsAuctionProvider::new(config);
         let auction_request = create_test_auction_request();
-        let aps_request = provider.to_aps_request(&auction_request);
+        let (aps_request, _slot_id_map) = provider.to_aps_request(&auction_request);
 
         // Verify basic fields
         assert_eq!(aps_request.pub_id, "5128");
@@ -728,6 +786,83 @@ mod tests {
         assert_eq!(slot2.sizes[0], [300, 250]);
     }
 
+    #[test]
+    fn aps_slot_id_from_bidders_map_used_in_request_and_remapped_in_response() {
+        use serde_json::json;
+
+        let config = ApsConfig {
+            enabled: true,
+            pub_id: "5128".to_string(),
+            endpoint: default_endpoint(),
+            timeout_ms: 800,
+        };
+        let provider = ApsAuctionProvider::new(config);
+
+        let mut bidders = HashMap::new();
+        bidders.insert(
+            "aps".to_string(),
+            json!({ "slotID": "aps-slot-atf-sidebar" }),
+        );
+        let request = AuctionRequest {
+            id: "test".to_string(),
+            slots: vec![AdSlot {
+                id: "atf_sidebar_ad".to_string(),
+                formats: vec![AdFormat {
+                    media_type: MediaType::Banner,
+                    width: 300,
+                    height: 250,
+                }],
+                floor_price: None,
+                targeting: HashMap::new(),
+                bidders,
+            }],
+            publisher: PublisherInfo {
+                domain: "example.com".to_string(),
+                page_url: None,
+            },
+            user: UserInfo {
+                id: Some("user-1".to_string()),
+                consent: None,
+                eids: None,
+            },
+            device: None,
+            site: None,
+            context: HashMap::new(),
+        };
+
+        let (aps_request, slot_id_map) = provider.to_aps_request(&request);
+        assert_eq!(
+            aps_request.slots[0].slot_id, "aps-slot-atf-sidebar",
+            "should send configured APS slot ID to APS"
+        );
+        assert_eq!(
+            slot_id_map.get("aps-slot-atf-sidebar").map(String::as_str),
+            Some("atf_sidebar_ad"),
+            "should build reverse map from APS slot ID to creative slot ID"
+        );
+
+        *provider.slot_id_map.lock().expect("should lock") = slot_id_map;
+
+        let aps_response = json!({
+            "contextual": {
+                "slots": [{
+                    "slotID": "aps-slot-atf-sidebar",
+                    "size": "300x250",
+                    "fif": "1",
+                    "amznbid": "1gtm3q",
+                    "meta": ["slotID"]
+                }]
+            }
+        });
+
+        let response = provider.parse_aps_response(&aps_response, 100);
+        assert_eq!(response.bids.len(), 1, "should parse one bid");
+        assert_eq!(
+            response.bids[0].slot_id, "atf_sidebar_ad",
+            "bid slot_id should be remapped to creative slot ID"
+        );
+    }
+
     #[test]
     fn test_aps_response_parsing_success() {
         let config = ApsConfig {
@@ -956,7 +1091,7 @@ mod tests {
             ..Default::default()
         });
 
-        let aps_request = provider.to_aps_request(&request);
+        let (aps_request, _slot_id_map) = provider.to_aps_request(&request);
 
         // Verify GDPR consent
         let gdpr = aps_request.gdpr.expect("should have gdpr");
@@ -985,7 +1120,7 @@ mod tests {
         let provider = ApsAuctionProvider::new(config);
         let request = create_test_auction_request(); // consent is None
 
-        let aps_request = provider.to_aps_request(&request);
+        let (aps_request, _slot_id_map) = provider.to_aps_request(&request);
 
         assert!(aps_request.gdpr.is_none());
         assert!(aps_request.us_privacy.is_none());
@@ -1012,7 +1147,7 @@ mod tests {
             ..Default::default()
         });
 
-        let aps_request = provider.to_aps_request(&request);
+        let (aps_request, _slot_id_map) = provider.to_aps_request(&request);
         let json = serde_json::to_value(&aps_request).expect("should serialize");
 
         // GDPR fields present
diff --git a/crates/trusted-server-core/src/integrations/gpt.rs b/crates/trusted-server-core/src/integrations/gpt.rs
index 0affbe95..d5fafc10 100644
--- a/crates/trusted-server-core/src/integrations/gpt.rs
+++ b/crates/trusted-server-core/src/integrations/gpt.rs
@@ -80,6 +80,16 @@ pub struct GptConfig {
     /// Whether to rewrite GPT script URLs in publisher HTML.
     #[serde(default = "default_rewrite_script")]
     pub rewrite_script: bool,
+
+    /// URL for the slim-Prebid bundle loaded post-window.load.
+    ///
+    /// When set, `installSlimPrebidLoader()` in the GPT bundle will load this
+    /// script after `window.load`, enabling scroll/refresh client-side auctions
+    /// and userID module warm-up. Set to the publisher's tsjs-prebid bundle URL.
+    ///
+    /// Override via env var: `TRUSTED_SERVER__INTEGRATIONS__GPT__SLIM_PREBID_URL`
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub slim_prebid_url: Option<String>,
 }
 
 impl IntegrationConfig for GptConfig {
@@ -430,18 +440,48 @@ impl IntegrationHeadInjector for GptIntegration {
         GPT_INTEGRATION_ID
     }
 
+    /// Injects the `tsjs.adInit` bootstrap script into `<head>`.
+    ///
+    /// ## Scroll / refresh handoff contract (Phase 1)
+    ///
+    /// `tsjs.adInit` handles **initial render only**: it wires server-side bid
+    /// targeting into GPT slots and fires win beacons (`nurl`/`burl`) via
+    /// `slotRenderEnded`. It does **not** trigger refresh auctions or handle
+    /// GPT slot refresh events.
+    ///
+    /// Post-`window.load`, slim-Prebid takes over: it listens for GPT refresh
+    /// events, runs client-side auctions, and sets targeting for subsequent
+    /// impressions. SPA pushState navigation is also slim-Prebid's domain.
+    /// The `POST /auction` endpoint is not involved in scroll or refresh flows.
     fn head_inserts(&self, _ctx: &IntegrationHtmlContext<'_>) -> Vec<String> {
-        // Set the enable flag and best-effort call the activation function
-        // registered by the GPT shim module. The bundle also auto-installs
-        // when it sees the pre-set flag, so this works regardless of whether
-        // the inline bootstrap runs before or after the TSJS bundle.
-        vec![
-            "<script>window.__tsjs_gpt_enabled=true;window.__tsjs_installGptShim&&window.__tsjs_installGptShim();</script>"
+        let mut scripts = vec![
+            "<script>window.__tsjs_gpt_enabled=true;\
+             window.__tsjs_installGptShim&&window.__tsjs_installGptShim();</script>"
                 .to_string(),
-        ]
+            format!("<script>{}</script>", GPT_BOOTSTRAP_JS),
+        ];
+
+        if let Some(ref url) = self.config.slim_prebid_url {
+            scripts.push(format!(
+                "<script>window.__tsjs_slim_prebid_url={};</script>",
+                serde_json::to_string(url).expect("should serialize string")
+            ));
+        }
+
+        scripts
     }
 }
 
+/// Inline `window.tsjs.adInit` bootstrap injected at `<head>` so the bids
+/// script at `</body>` can call it before the TSJS bundle has loaded.
+///
+/// The bundle's idempotent implementation in
+/// `crates/js/lib/src/integrations/gpt/index.ts` later overwrites this stub.
+/// Both implementations guard the one-time-per-page setup with
+/// `window.tsjs.servicesEnabled` so neither double-enables services if the
+/// publisher's own init code also calls `googletag.enableServices()`.
+const GPT_BOOTSTRAP_JS: &str = include_str!("gpt_bootstrap.js");
+
 // Default value functions
 
 fn default_enabled() -> bool {
@@ -474,6 +514,7 @@ mod tests {
             script_url: default_script_url(),
             cache_ttl_seconds: 3600,
             rewrite_script: true,
+            slim_prebid_url: None,
         }
     }
 
@@ -1013,7 +1054,7 @@ mod tests {
 
         let inserts = integration.head_inserts(&ctx);
 
-        assert_eq!(inserts.len(), 1, "should emit exactly one head insert");
+        assert_eq!(inserts.len(), 2, "should emit exactly two head inserts");
         assert_eq!(
             inserts[0],
             "<script>window.__tsjs_gpt_enabled=true;window.__tsjs_installGptShim&&window.__tsjs_installGptShim();</script>",
@@ -1021,6 +1062,77 @@ mod tests {
         );
     }
 
+    #[test]
+    fn head_inserts_includes_ts_ad_init_with_synchronous_bids_read() {
+        let config = test_config();
+        let integration = GptIntegration::new(config);
+        let doc_state = IntegrationDocumentState::default();
+        let ctx = IntegrationHtmlContext {
+            request_host: "edge.example.com",
+            request_scheme: "https",
+            origin_host: "example.com",
+            document_state: &doc_state,
+        };
+        let inserts = integration.head_inserts(&ctx);
+        let combined = inserts.join("");
+        assert!(combined.contains("ts.adInit"), "should define tsjs.adInit");
+        assert!(
+            combined.contains("ts.bids"),
+            "should read tsjs.bids synchronously"
+        );
+        assert!(
+            combined.contains("ts_initial"),
+            "should set ts_initial sentinel"
+        );
+        assert!(
+            combined.contains("slotRenderEnded"),
+            "should register slotRenderEnded"
+        );
+        assert!(
+            combined.contains("sendBeacon"),
+            "should fire nurl and burl via sendBeacon"
+        );
+        assert!(
+            combined.contains("nurl"),
+            "should fire nurl on confirmed render"
+        );
+        assert!(
+            !combined.contains("/ts-bids"),
+            "must NOT fetch /ts-bids — bids are inline on the page"
+        );
+        assert!(
+            !combined.contains("bidsPromise"),
+            "must NOT use bidsPromise — bids are synchronous"
+        );
+        assert!(
+            !combined.contains("__ts_request_id"),
+            "must NOT reference request_id — no longer used"
+        );
+    }
+
+    #[test]
+    fn head_inserts_bootstrap_guards_enable_services_with_idempotency_flag() {
+        let config = test_config();
+        let integration = GptIntegration::new(config);
+        let doc_state = IntegrationDocumentState::default();
+        let ctx = IntegrationHtmlContext {
+            request_host: "edge.example.com",
+            request_scheme: "https",
+            origin_host: "example.com",
+            document_state: &doc_state,
+        };
+        let combined = integration.head_inserts(&ctx).join("");
+        assert!(
+            combined.contains("ts.servicesEnabled"),
+            "should guard enableServices/enableSingleRequest with the tsjs.servicesEnabled flag"
+        );
+        assert!(combined.contains("ts.adInit"), "should install tsjs.adInit");
+        assert!(
+            !combined.contains("googletag.pubads().refresh()"),
+            "should never call unbounded refresh() — only refresh(newSlots)"
+        );
+    }
+
     #[test]
     fn head_injector_integration_id() {
         let integration = GptIntegration::new(test_config());
@@ -1029,4 +1141,59 @@ mod tests {
             "gpt"
         );
     }
+
+    #[test]
+    fn head_inserts_emits_slim_prebid_url_when_configured() {
+        let config = GptConfig {
+            slim_prebid_url: Some("https://cdn.example.com/tsjs-prebid.min.js".to_string()),
+            ..test_config()
+        };
+        let integration = GptIntegration::new(config);
+        let doc_state = IntegrationDocumentState::default();
+        let ctx = IntegrationHtmlContext {
+            request_host: "edge.example.com",
+            request_scheme: "https",
+            origin_host: "example.com",
+            document_state: &doc_state,
+        };
+
+        let inserts = integration.head_inserts(&ctx);
+
+        assert_eq!(
+            inserts.len(),
+            3,
+            "should emit three head inserts when slim_prebid_url is set"
+        );
+        assert_eq!(
+            inserts[2],
+            r#"<script>window.__tsjs_slim_prebid_url="https://cdn.example.com/tsjs-prebid.min.js";</script>"#,
+            "should emit the slim-Prebid URL as a JSON-encoded string assignment"
+        );
+    }
+
+    #[test]
+    fn head_inserts_omits_slim_prebid_url_when_not_configured() {
+        let integration = GptIntegration::new(test_config());
+        let doc_state = IntegrationDocumentState::default();
+        let ctx = IntegrationHtmlContext {
+            request_host: "edge.example.com",
+            request_scheme: "https",
+            origin_host: "example.com",
+            document_state: &doc_state,
+        };
+
+        let inserts = integration.head_inserts(&ctx);
+
+        assert_eq!(
+            inserts.len(),
+            2,
+            "should emit exactly two head inserts when slim_prebid_url is absent"
+        );
+        assert!(
+            inserts
+                .iter()
+                .all(|s| !s.contains("__tsjs_slim_prebid_url")),
+            "should not emit slim-Prebid URL tag when not configured"
+        );
+    }
 }
diff --git a/crates/trusted-server-core/src/integrations/gpt_bootstrap.js b/crates/trusted-server-core/src/integrations/gpt_bootstrap.js
new file mode 100644
index 00000000..0c7ea0dd
--- /dev/null
+++ b/crates/trusted-server-core/src/integrations/gpt_bootstrap.js
@@ -0,0 +1,109 @@
+// Edge-injected GPT auction bootstrap.
+//
+// This is the minimal `window.tsjs.adInit` that runs on first page load
+// before the TSJS bundle has had a chance to install its richer
+// idempotent implementation. The bundle in
+// crates/js/lib/src/integrations/gpt/index.ts overwrites `tsjs.adInit`
+// once it loads.
+//
+// Contract with the bundle:
+//   - Both implementations must set `window.tsjs.servicesEnabled = true`
+//     after calling `enableSingleRequest()`/`enableServices()` so a
+//     subsequent call becomes a no-op.
+//   - `refresh()` is called only for the slots defined in this pass,
+//     never the global slot list.
+//
+// Only installed if `window.tsjs.adInit` isn't already defined.
+(function () {
+  if (typeof window === "undefined") return;
+  var ts = (window.tsjs = window.tsjs || {});
+  if (ts.adInit) return;
+
+  ts.adInit = function () {
+    var slots = ts.adSlots || [];
+    var bids = ts.bids || {};
+    var divToSlotId = {};
+
+    googletag.cmd.push(function () {
+      // Slots TS defined itself — tracked for SPA destroy. Publisher-owned
+      // slots are reused but never destroyed by TS on navigation.
+      var newSlots = [];
+      // All slots to refresh (TS-defined + publisher-owned reused).
+      var slotsToRefresh = [];
+      slots.forEach(function (slot) {
+        // Resolve actual div ID: exact match first, then prefix query.
+        // div_id in config may be a stable prefix (e.g. "ad-header-0-") when
+        // the suffix is dynamically generated by the framework at render time.
+        var el =
+          document.getElementById(slot.div_id) ||
+          document.querySelector(
+            "[id^='" + slot.div_id + "']:not([id$='-container'])",
+          );
+        if (!el) return;
+        var actualDivId = el.id;
+        var b = bids[slot.id] || {};
+
+        var existingSlots = googletag.pubads().getSlots();
+        var s =
+          existingSlots.find(function (gs) {
+            return gs.getSlotElementId() === actualDivId;
+          }) || null;
+        var tsOwned = false;
+        if (!s) {
+          // Use outer container div for TS's slot when publisher hasn't defined
+          // theirs yet — keeps both slots on separate divs so publisher's
+          // later defineSlot on the inner div doesn't conflict.
+          var containerEl = document.getElementById(actualDivId + "-container");
+          var slotDivId = containerEl ? containerEl.id : actualDivId;
+          s = googletag.defineSlot(slot.gam_unit_path, slot.formats, slotDivId);
+          if (!s) return;
+          s.addService(googletag.pubads());
+          tsOwned = true;
+        }
+
+        Object.entries(slot.targeting || {}).forEach(function (e) {
+          s.setTargeting(e[0], e[1]);
+        });
+        [
+          "hb_pb",
+          "hb_bidder",
+          "hb_adid",
+          "hb_cache_host",
+          "hb_cache_path",
+        ].forEach(function (k) {
+          if (b[k]) s.setTargeting(k, b[k]);
+        });
+        // Keep in sync with TS_INITIAL_TARGETING_KEY in index.ts
+        s.setTargeting("ts_initial", "1");
+        divToSlotId[actualDivId] = slot.id;
+        if (tsOwned) newSlots.push(s);
+        slotsToRefresh.push(s);
+      });
+      ts.prevGptSlots = newSlots;
+      ts.divToSlotId = divToSlotId;
+      if (!ts.servicesEnabled) {
+        googletag.pubads().enableSingleRequest();
+        googletag.enableServices();
+        ts.servicesEnabled = true;
+        googletag.pubads().addEventListener("slotRenderEnded", function (ev) {
+          var divId = ev.slot.getSlotElementId();
+          var slotId = (ts.divToSlotId || {})[divId];
+          if (!slotId) return;
+          var b = (ts.bids || {})[slotId] || {};
+          var ourBidWon =
+            !ev.isEmpty &&
+            (b.hb_adid
+              ? ev.slot.getTargeting("hb_adid")[0] === b.hb_adid
+              : !!b.hb_bidder);
+          if (ourBidWon) {
+            if (b.nurl) navigator.sendBeacon(b.nurl);
+            if (b.burl) navigator.sendBeacon(b.burl);
+          }
+        });
+      }
+      if (slotsToRefresh.length > 0) {
+        googletag.pubads().refresh(slotsToRefresh);
+      }
+    });
+  };
+})();
diff --git a/crates/trusted-server-core/src/integrations/prebid.rs b/crates/trusted-server-core/src/integrations/prebid.rs
index 63b60e3d..b757a1bf 100644
--- a/crates/trusted-server-core/src/integrations/prebid.rs
+++ b/crates/trusted-server-core/src/integrations/prebid.rs
@@ -8,6 +8,7 @@ use fastly::http::{header, Method, StatusCode, Url};
 use fastly::{Request, Response};
 use serde::{Deserialize, Serialize};
 use serde_json::Value as Json;
+use url::Url as ParsedUrl;
 use validator::Validate;
 
 use crate::auction::orchestrator::ERROR_TYPE_HTTP_STATUS;
@@ -27,8 +28,8 @@ use crate::integrations::{
 };
 use crate::openrtb::{
     to_openrtb_i32, Banner, ConsentedProvidersSettings, Device, Format, Geo, Imp, ImpExt,
-    OpenRtbRequest, PrebidExt, PrebidImpExt, Publisher, Regs, RegsExt, RequestExt, Site, ToExt,
-    TrustedServerExt, User, UserExt,
+    ImpStoredRequest, OpenRtbRequest, PrebidExt, PrebidImpExt, Publisher, Regs, RegsExt,
+    RequestExt, Site, ToExt, TrustedServerExt, User, UserExt,
 };
 use crate::request_signing::{RequestSigner, SigningParams, SIGNING_VERSION};
 use crate::settings::{IntegrationConfig, Settings};
@@ -181,6 +182,21 @@ pub struct PrebidIntegrationConfig {
     /// - `both` — consent in both cookies and body (default)
     #[serde(default)]
     pub consent_forwarding: ConsentForwardingMode,
+    /// Strip `nurl` and `burl` from PBS bids before they reach `window.tsjs.bids`.
+    ///
+    /// Set to `true` when the PBS deployment is configured to fire win/billing
+    /// notifications server-side (e.g. `ext.prebid.events.enabled`), so the
+    /// client does not double-fire them via `sendBeacon`. Default: `false`.
+    #[serde(default)]
+    pub suppress_nurl: bool,
+    /// Bidder seats whose `nurl` and `burl` should be stripped before they reach
+    /// `window.tsjs.bids`.
+    ///
+    /// Use this when only specific PBS seats fire win/billing notifications
+    /// internally. The global [`suppress_nurl`](Self::suppress_nurl) switch still
+    /// suppresses every bidder when set.
+    #[serde(default, deserialize_with = "crate::settings::vec_from_seq_or_map")]
+    pub suppress_nurl_bidders: Vec<String>,
 }
 
 impl IntegrationConfig for PrebidIntegrationConfig {
@@ -939,22 +955,27 @@ impl PrebidAuctionProvider {
                 // Build the bidder map for PBS.
                 // The JS adapter sends "trustedServer" as the bidder (our orchestrator
                 // adapter name). Replace it with the real PBS bidders from config.
-                // Pass through any other bidders with their params as-is.
+                // Only pass through keys that are known PBS bidders — skip provider-specific
+                // keys like "aps" which belong to their own separate auction provider.
                 let mut bidder: HashMap<String, Json> = HashMap::new();
                 for (name, params) in &slot.bidders {
                     if name == TRUSTED_SERVER_BIDDER {
                         bidder.extend(expand_trusted_server_bidders(&self.config.bidders, params));
-                    } else {
+                    } else if self.config.bidders.iter().any(|b| b == name) {
                         bidder.insert(name.clone(), params.clone());
                     }
                 }
 
-                // Fallback to config bidders if none provided
-                if bidder.is_empty() {
-                    for b in &self.config.bidders {
-                        bidder.insert(b.clone(), Json::Object(serde_json::Map::new()));
-                    }
-                }
+                // When no inline PBS bidder params exist (e.g. creative-opportunity slots
+                // whose PBS params live in stored requests), tell PBS to resolve bidder
+                // config from the stored request keyed by this slot ID.
+                let storedrequest = if bidder.is_empty() {
+                    Some(ImpStoredRequest {
+                        id: slot.id.clone(),
+                    })
+                } else {
+                    None
+                };
 
                 // Apply canonical and compatibility-derived rules in normalized order.
                 for (name, params) in &mut bidder {
@@ -976,7 +997,10 @@ impl PrebidAuctionProvider {
                     secure: Some(true), // require HTTPS creatives
                     tagid: Some(slot.id.clone()),
                     ext: ImpExt {
-                        prebid: PrebidImpExt { bidder },
+                        prebid: PrebidImpExt {
+                            bidder,
+                            storedrequest,
+                        },
                     }
                     .to_ext(),
                     ..Default::default()
@@ -1325,6 +1349,15 @@ impl PrebidAuctionProvider {
         }
     }
 
+    fn should_suppress_bid_notifications(&self, bidder: &str) -> bool {
+        self.config.suppress_nurl
+            || self
+                .config
+                .suppress_nurl_bidders
+                .iter()
+                .any(|suppressed_bidder| suppressed_bidder == bidder)
+    }
+
     /// Parse a single bid from `OpenRTB` response.
     fn parse_bid(&self, bid_obj: &Json, seat: &str) -> Result<AuctionBid, ()> {
         let slot_id = bid_obj
@@ -1354,15 +1387,30 @@ impl PrebidAuctionProvider {
             .and_then(|v| u32::try_from(v).ok())
             .unwrap_or(0);
 
-        let nurl = bid_obj
-            .get("nurl")
-            .and_then(|v| v.as_str())
-            .map(std::string::ToString::to_string);
+        let suppress_bid_notifications = self.should_suppress_bid_notifications(seat);
+        let nurl = if suppress_bid_notifications {
+            None
+        } else {
+            bid_obj
+                .get("nurl")
+                .and_then(|v| v.as_str())
+                .map(std::string::ToString::to_string)
+        };
 
-        let burl = bid_obj
-            .get("burl")
+        let burl = if suppress_bid_notifications {
+            None
+        } else {
+            bid_obj
+                .get("burl")
+                .and_then(|v| v.as_str())
+                .map(std::string::ToString::to_string)
+        };
+
+        let ad_id = bid_obj
+            .get("adid")
+            .or_else(|| bid_obj.get("id"))
             .and_then(|v| v.as_str())
-            .map(std::string::ToString::to_string);
+            .map(String::from);
 
         let adomain = bid_obj
             .get("adomain")
@@ -1373,6 +1421,49 @@ impl PrebidAuctionProvider {
                     .collect()
             });
 
+        // Extract PBS Cache coordinates from ext.prebid.cache.bids
+        let cache_entry = bid_obj
+            .get("ext")
+            .and_then(|e| e.get("prebid"))
+            .and_then(|p| p.get("cache"))
+            .and_then(|c| c.get("bids"));
+
+        let cache_id = cache_entry
+            .and_then(|c| c.get("cacheId"))
+            .and_then(|v| v.as_str())
+            .map(String::from);
+
+        let (cache_host, cache_path) = cache_entry
+            .and_then(|c| c.get("url"))
+            .and_then(|v| v.as_str())
+            .and_then(|url_str| {
+                ParsedUrl::parse(url_str)
+                    .map_err(|e| log::debug!("PBS cache URL parse failed: {}", e))
+                    .ok()
+            })
+            .map(|u| {
+                let host = u.host_str().map(String::from);
+                // path() returns "/" for root — only use if non-trivial
+                let path = u.path().to_string();
+                let path = if path.is_empty() || path == "/" {
+                    None
+                } else {
+                    Some(path)
+                };
+                (host, path)
+            })
+            .unwrap_or((None, None));
+
+        // Guard: if we extracted a cache UUID but couldn't extract the host,
+        // the bid will have hb_adid set but no endpoint to fetch from — creative will fail.
+        if cache_id.is_some() && cache_host.is_none() {
+            log::warn!(
+                "PBS bid has cache UUID but cache URL could not be parsed — \
+                 creative will fail to render for slot '{}'",
+                slot_id
+            );
+        }
+
         Ok(AuctionBid {
             slot_id,
             price: Some(price), // Prebid provides decoded prices
@@ -1384,6 +1475,10 @@ impl PrebidAuctionProvider {
             height,
             nurl,
             burl,
+            ad_id,
+            cache_id,
+            cache_host,
+            cache_path,
             metadata: std::collections::HashMap::new(),
         })
     }
@@ -1683,6 +1778,8 @@ mod tests {
             bid_param_overrides: HashMap::default(),
             bid_param_override_rules: Vec::new(),
             consent_forwarding: ConsentForwardingMode::Both,
+            suppress_nurl: false,
+            suppress_nurl_bidders: Vec::new(),
         }
     }
 
@@ -4481,6 +4578,92 @@ set = { placementId = "explicit_header" }
         assert_eq!(statuses[1]["status"], "timeout");
     }
 
+    // ========================================================================
+    // PBS stored request tests
+    // ========================================================================
+
+    #[test]
+    fn to_openrtb_uses_stored_request_when_slot_has_no_pbs_bidder_params() {
+        // Slot only has "aps" provider — not a PBS bidder
+        let slot = make_slot(
+            "atf_sidebar_ad",
+            HashMap::from([("aps".to_string(), json!({"slotID": "aps-slot-atf-sidebar"}))]),
+        );
+        let request = make_auction_request(vec![slot]);
+
+        let ortb = call_to_openrtb(base_config(), &request);
+        let ext = ortb.imp[0].ext.as_ref().expect("should have imp ext");
+        let prebid = ext.get("prebid").expect("should have prebid in ext");
+
+        assert!(
+            prebid.get("bidder").is_none(),
+            "should not send inline bidder params when using stored request"
+        );
+        assert_eq!(
+            prebid["storedrequest"]["id"], "atf_sidebar_ad",
+            "should use slot id as stored request id"
+        );
+    }
+
+    #[test]
+    fn to_openrtb_uses_stored_request_when_slot_has_empty_bidders() {
+        let slot = make_slot("homepage_header_ad", HashMap::new());
+        let request = make_auction_request(vec![slot]);
+
+        let ortb = call_to_openrtb(base_config(), &request);
+        let ext = ortb.imp[0].ext.as_ref().expect("should have imp ext");
+        let prebid = ext.get("prebid").expect("should have prebid in ext");
+
+        assert_eq!(
+            prebid["storedrequest"]["id"], "homepage_header_ad",
+            "should use slot id as stored request id for slot with no bidder map"
+        );
+    }
+
+    #[test]
+    fn to_openrtb_uses_inline_bidder_params_not_stored_request_for_trusted_server_slots() {
+        let mut config = base_config();
+        config.bidders = vec!["kargo".to_string()];
+
+        let slot = make_ts_slot(
+            "in_content_ad",
+            &json!({ "kargo": { "placementId": "client_123" } }),
+            None,
+        );
+        let request = make_auction_request(vec![slot]);
+
+        let ortb = call_to_openrtb(config, &request);
+        let ext = ortb.imp[0].ext.as_ref().expect("should have imp ext");
+        let prebid = ext.get("prebid").expect("should have prebid in ext");
+
+        assert!(
+            prebid.get("storedrequest").is_none(),
+            "should not use stored request when inline bidder params are present"
+        );
+        assert_eq!(
+            prebid["bidder"]["kargo"]["placementId"], "client_123",
+            "should use inline bidder params from trustedServer expansion"
+        );
+    }
+
+    #[test]
+    fn to_openrtb_skips_aps_key_from_slot_bidders_in_pbs_request() {
+        let slot = make_slot(
+            "atf_sidebar_ad",
+            HashMap::from([("aps".to_string(), json!({"slotID": "aps-slot-atf-sidebar"}))]),
+        );
+        let request = make_auction_request(vec![slot]);
+
+        let ortb = call_to_openrtb(base_config(), &request);
+        let ext = ortb.imp[0].ext.as_ref().expect("should have imp ext");
+        let prebid = ext.get("prebid").expect("should have prebid in ext");
+
+        assert!(
+            prebid.get("bidder").is_none(),
+            "should not forward aps key into PBS imp.ext.prebid.bidder"
+        );
+    }
+
     #[test]
     fn register_rejects_invalid_bid_param_override_rule() {
         let toml = format!(
@@ -4528,4 +4711,234 @@ set = { networkId = 42 }
             "should fail fast when a canonical rule has no matcher fields"
         );
     }
+
+    #[test]
+    fn parse_bid_extracts_cache_id_from_ext_prebid_cache_bids() {
+        let bid_json = serde_json::json!({
+            "id": "bid-id-123",
+            "impid": "atf_sidebar_ad",
+            "price": 1.50,
+            "adm": "<div>ad</div>",
+            "w": 300,
+            "h": 250,
+            "ext": {
+                "prebid": {
+                    "cache": {
+                        "bids": {
+                            "url": "https://openads.adsrvr.org/cache?uuid=f47447a0-b759-4f2f-9887-af458b79b570",
+                            "cacheId": "f47447a0-b759-4f2f-9887-af458b79b570"
+                        }
+                    }
+                }
+            }
+        });
+        let provider = PrebidAuctionProvider::new(base_config());
+        let bid = provider
+            .parse_bid(&bid_json, "thetradedesk")
+            .expect("should parse bid");
+        assert_eq!(
+            bid.cache_id.as_deref(),
+            Some("f47447a0-b759-4f2f-9887-af458b79b570"),
+            "should extract cacheId as cache_id"
+        );
+        assert_eq!(
+            bid.cache_host.as_deref(),
+            Some("openads.adsrvr.org"),
+            "should extract host from cache URL"
+        );
+        assert_eq!(
+            bid.cache_path.as_deref(),
+            Some("/cache"),
+            "should extract path from cache URL"
+        );
+    }
+
+    #[test]
+    fn parse_bid_sets_cache_fields_to_none_when_no_cache_entry() {
+        let bid_json = serde_json::json!({
+            "id": "bid-id-456",
+            "impid": "atf_sidebar_ad",
+            "price": 0.50,
+            "w": 300,
+            "h": 250
+        });
+        let provider = PrebidAuctionProvider::new(base_config());
+        let bid = provider
+            .parse_bid(&bid_json, "appnexus")
+            .expect("should parse bid");
+        assert!(bid.cache_id.is_none(), "should be None when cache absent");
+        assert!(bid.cache_host.is_none(), "should be None when cache absent");
+        assert!(bid.cache_path.is_none(), "should be None when cache absent");
+    }
+
+    #[test]
+    fn parse_bid_handles_malformed_cache_url_gracefully() {
+        let bid_json = serde_json::json!({
+            "id": "bid-id-789",
+            "impid": "atf_sidebar_ad",
+            "price": 0.50,
+            "w": 300,
+            "h": 250,
+            "ext": {
+                "prebid": {
+                    "cache": {
+                        "bids": {
+                            "url": "not-a-valid-url",
+                            "cacheId": "some-uuid"
+                        }
+                    }
+                }
+            }
+        });
+        let provider = PrebidAuctionProvider::new(base_config());
+        let bid = provider
+            .parse_bid(&bid_json, "appnexus")
+            .expect("should parse bid without panicking");
+        assert_eq!(
+            bid.cache_id.as_deref(),
+            Some("some-uuid"),
+            "should still extract cacheId even if URL is malformed"
+        );
+        assert!(
+            bid.cache_host.is_none(),
+            "should be None when URL parse fails"
+        );
+        assert!(
+            bid.cache_path.is_none(),
+            "should be None when URL parse fails"
+        );
+    }
+
+    #[test]
+    fn parse_bid_includes_nurl_and_burl_by_default() {
+        let bid_json = serde_json::json!({
+            "impid": "atf_sidebar_ad",
+            "price": 1.50,
+            "w": 300,
+            "h": 250,
+            "nurl": "https://ssp.example/win?id=abc123",
+            "burl": "https://ssp.example/bill?id=abc123"
+        });
+        let provider = PrebidAuctionProvider::new(base_config());
+        let bid = provider
+            .parse_bid(&bid_json, "appnexus")
+            .expect("should parse bid");
+        assert_eq!(
+            bid.nurl.as_deref(),
+            Some("https://ssp.example/win?id=abc123"),
+            "should include nurl when suppress_nurl is false"
+        );
+        assert_eq!(
+            bid.burl.as_deref(),
+            Some("https://ssp.example/bill?id=abc123"),
+            "should include burl when suppress_nurl is false"
+        );
+    }
+
+    #[test]
+    fn parse_bid_strips_nurl_and_burl_when_suppress_nurl_enabled() {
+        let bid_json = serde_json::json!({
+            "impid": "atf_sidebar_ad",
+            "price": 1.50,
+            "w": 300,
+            "h": 250,
+            "nurl": "https://ssp.example/win?id=abc123",
+            "burl": "https://ssp.example/bill?id=abc123"
+        });
+        let config = PrebidIntegrationConfig {
+            suppress_nurl: true,
+            ..base_config()
+        };
+        let provider = PrebidAuctionProvider::new(config);
+        let bid = provider
+            .parse_bid(&bid_json, "appnexus")
+            .expect("should parse bid");
+        assert_eq!(
+            bid.nurl, None,
+            "should strip nurl when suppress_nurl is true"
+        );
+        assert_eq!(
+            bid.burl, None,
+            "should strip burl when suppress_nurl is true"
+        );
+    }
+
+    #[test]
+    fn parse_bid_strips_nurl_and_burl_for_configured_suppressed_bidder_only() {
+        let bid_json = serde_json::json!({
+            "impid": "atf_sidebar_ad",
+            "price": 1.50,
+            "w": 300,
+            "h": 250,
+            "nurl": "https://ssp.example/win?id=abc123",
+            "burl": "https://ssp.example/bill?id=abc123"
+        });
+        let config = PrebidIntegrationConfig {
+            suppress_nurl_bidders: vec!["appnexus".to_string()],
+            ..base_config()
+        };
+        let provider = PrebidAuctionProvider::new(config);
+
+        let suppressed_bid = provider
+            .parse_bid(&bid_json, "appnexus")
+            .expect("should parse suppressed bidder bid");
+        let preserved_bid = provider
+            .parse_bid(&bid_json, "openx")
+            .expect("should parse unsuppressed bidder bid");
+
+        assert_eq!(
+            suppressed_bid.nurl, None,
+            "should strip nurl only for the configured bidder"
+        );
+        assert_eq!(
+            suppressed_bid.burl, None,
+            "should strip burl only for the configured bidder"
+        );
+        assert_eq!(
+            preserved_bid.nurl.as_deref(),
+            Some("https://ssp.example/win?id=abc123"),
+            "should preserve nurl for bidders not configured for suppression"
+        );
+        assert_eq!(
+            preserved_bid.burl.as_deref(),
+            Some("https://ssp.example/bill?id=abc123"),
+            "should preserve burl for bidders not configured for suppression"
+        );
+    }
+
+    #[test]
+    fn parse_bid_preserves_ad_id_alongside_cache_id() {
+        let bid_json = serde_json::json!({
+            "id": "bid-impression-id",
+            "impid": "atf_sidebar_ad",
+            "adid": "bidder-ad-id-abc",
+            "price": 1.0,
+            "w": 300,
+            "h": 250,
+            "ext": {
+                "prebid": {
+                    "cache": {
+                        "bids": {
+                            "url": "https://cache.example.com/cache",
+                            "cacheId": "cache-uuid-xyz"
+                        }
+                    }
+                }
+            }
+        });
+        let provider = PrebidAuctionProvider::new(base_config());
+        let bid = provider
+            .parse_bid(&bid_json, "appnexus")
+            .expect("should parse bid");
+        assert_eq!(
+            bid.ad_id.as_deref(),
+            Some("bidder-ad-id-abc"),
+            "should keep ad_id from adid field"
+        );
+        assert_eq!(
+            bid.cache_id.as_deref(),
+            Some("cache-uuid-xyz"),
+            "should extract cache UUID separately"
+        );
+    }
 }
diff --git a/crates/trusted-server-core/src/integrations/registry.rs b/crates/trusted-server-core/src/integrations/registry.rs
index 389dd50d..748485a5 100644
--- a/crates/trusted-server-core/src/integrations/registry.rs
+++ b/crates/trusted-server-core/src/integrations/registry.rs
@@ -861,6 +861,14 @@ impl IntegrationRegistry {
             .collect()
     }
 
+    #[cfg(test)]
+    #[must_use]
+    pub fn empty_for_tests() -> Self {
+        Self {
+            inner: Arc::new(IntegrationRegistryInner::default()),
+        }
+    }
+
     #[cfg(test)]
     #[must_use]
     pub fn from_rewriters(
diff --git a/crates/trusted-server-core/src/integrations/sourcepoint.rs b/crates/trusted-server-core/src/integrations/sourcepoint.rs
index bb8dc565..cec10d01 100644
--- a/crates/trusted-server-core/src/integrations/sourcepoint.rs
+++ b/crates/trusted-server-core/src/integrations/sourcepoint.rs
@@ -1070,9 +1070,9 @@ mod tests {
         let integration = SourcepointIntegration::new(Arc::new(config(true)));
         let document_state = IntegrationDocumentState::default();
         let ctx = IntegrationHtmlContext {
-            request_host: "ts.prospecta.com",
+            request_host: "ts.example.com",
             request_scheme: "https",
-            origin_host: "origin.prospecta.com",
+            origin_host: "origin.example.com",
             document_state: &document_state,
         };
 
diff --git a/crates/trusted-server-core/src/lib.rs b/crates/trusted-server-core/src/lib.rs
index ab33bf17..b77e2685 100644
--- a/crates/trusted-server-core/src/lib.rs
+++ b/crates/trusted-server-core/src/lib.rs
@@ -42,6 +42,7 @@ pub mod consent_config;
 pub mod constants;
 pub mod cookies;
 pub mod creative;
+pub mod creative_opportunities;
 pub mod ec;
 pub mod error;
 pub mod geo;
@@ -52,6 +53,7 @@ pub mod integrations;
 pub mod models;
 pub mod openrtb;
 pub mod platform;
+pub mod price_bucket;
 pub mod proxy;
 pub mod publisher;
 pub mod redacted;
diff --git a/crates/trusted-server-core/src/openrtb.rs b/crates/trusted-server-core/src/openrtb.rs
index d480615a..4123c775 100644
--- a/crates/trusted-server-core/src/openrtb.rs
+++ b/crates/trusted-server-core/src/openrtb.rs
@@ -69,7 +69,7 @@ pub struct ConsentedProvidersSettings {
 }
 
 /// An Extended User ID entry from an identity provider.
-#[derive(Debug, Clone, Deserialize, Serialize)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Eid {
     /// Identity provider domain (e.g. `"id5-sync.com"`).
     pub source: String,
@@ -78,7 +78,7 @@ pub struct Eid {
 }
 
 /// A single user identifier within an [`Eid`] entry.
-#[derive(Debug, Clone, Deserialize, Serialize)]
+#[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Uid {
     /// The identifier value.
     pub id: String,
@@ -156,9 +156,21 @@ pub struct ImpExt {
 
 impl ToExt for ImpExt {}
 
-#[derive(Debug, Serialize)]
+#[derive(Debug, Default, Serialize)]
 pub struct PrebidImpExt {
+    #[serde(skip_serializing_if = "std::collections::HashMap::is_empty")]
     pub bidder: std::collections::HashMap<String, Value>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub storedrequest: Option<ImpStoredRequest>,
+}
+
+/// PBS imp-level stored request reference.
+///
+/// PBS merges the stored imp JSON (keyed by `id`) into the outgoing request,
+/// populating bidder params that are not sent inline.
+#[derive(Debug, Serialize)]
+pub struct ImpStoredRequest {
+    pub id: String,
 }
 
 #[derive(Debug, Serialize)]
diff --git a/crates/trusted-server-core/src/price_bucket.rs b/crates/trusted-server-core/src/price_bucket.rs
new file mode 100644
index 00000000..cfdca9eb
--- /dev/null
+++ b/crates/trusted-server-core/src/price_bucket.rs
@@ -0,0 +1,158 @@
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize, Default)]
+#[serde(rename_all = "lowercase")]
+pub enum PriceGranularity {
+    Low,
+    Medium,
+    #[default]
+    Dense,
+    High,
+    Auto,
+}
+
+impl PriceGranularity {
+    #[must_use]
+    pub fn dense() -> Self {
+        Self::Dense
+    }
+}
+
+#[must_use]
+pub fn price_bucket(cpm: f64, granularity: PriceGranularity) -> String {
+    // Reject NaN / Inf early so the `(x * 100.0).floor() as u64` cast below
+    // can never see a non-finite value (the cast's behaviour for NaN/Inf is
+    // implementation-defined in Rust and "saturate to 0" only by convention).
+    if !cpm.is_finite() || cpm <= 0.0 {
+        return "0.00".to_string();
+    }
+    match granularity {
+        PriceGranularity::Low => {
+            let capped = cpm.min(5.0);
+            let cents = (capped * 100.0).floor() as u64;
+            let bucketed_cents = (cents / 50) * 50;
+            format!("{:.2}", bucketed_cents as f64 / 100.0)
+        }
+        PriceGranularity::Medium => {
+            let capped = cpm.min(20.0);
+            let cents = (capped * 100.0).floor() as u64;
+            let bucketed_cents = (cents / 10) * 10;
+            format!("{:.2}", bucketed_cents as f64 / 100.0)
+        }
+        PriceGranularity::High => {
+            let capped = cpm.min(20.0);
+            let cents = (capped * 100.0).floor() as u64;
+            format!("{:.2}", cents as f64 / 100.0)
+        }
+        PriceGranularity::Dense | PriceGranularity::Auto => dense_bucket(cpm),
+    }
+}
+
+fn dense_bucket(cpm: f64) -> String {
+    if cpm >= 20.0 {
+        return "20.00".to_string();
+    }
+    if cpm >= 8.0 {
+        let cents = (cpm * 100.0).floor() as u64;
+        let bucketed_cents = (cents / 50) * 50;
+        return format!("{:.2}", bucketed_cents as f64 / 100.0);
+    }
+    if cpm >= 3.0 {
+        let cents = (cpm * 100.0).floor() as u64;
+        let bucketed_cents = (cents / 5) * 5;
+        return format!("{:.2}", bucketed_cents as f64 / 100.0);
+    }
+    let cents = (cpm * 100.0).floor() as u64;
+    format!("{:.2}", cents as f64 / 100.0)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn dense_below_3_increments_by_0_01() {
+        assert_eq!(price_bucket(0.0, PriceGranularity::Dense), "0.00");
+        assert_eq!(price_bucket(0.01, PriceGranularity::Dense), "0.01");
+        assert_eq!(price_bucket(0.015, PriceGranularity::Dense), "0.01");
+        assert_eq!(price_bucket(1.23, PriceGranularity::Dense), "1.23");
+        assert_eq!(price_bucket(2.99, PriceGranularity::Dense), "2.99");
+    }
+
+    #[test]
+    fn dense_3_to_8_increments_by_0_05() {
+        assert_eq!(price_bucket(3.00, PriceGranularity::Dense), "3.00");
+        assert_eq!(price_bucket(3.03, PriceGranularity::Dense), "3.00");
+        assert_eq!(price_bucket(3.05, PriceGranularity::Dense), "3.05");
+        assert_eq!(price_bucket(7.99, PriceGranularity::Dense), "7.95");
+    }
+
+    #[test]
+    fn dense_8_to_20_increments_by_0_50() {
+        assert_eq!(price_bucket(8.00, PriceGranularity::Dense), "8.00");
+        assert_eq!(price_bucket(8.49, PriceGranularity::Dense), "8.00");
+        assert_eq!(price_bucket(8.50, PriceGranularity::Dense), "8.50");
+        assert_eq!(price_bucket(19.99, PriceGranularity::Dense), "19.50");
+    }
+
+    #[test]
+    fn dense_above_20_caps_at_20() {
+        assert_eq!(price_bucket(20.00, PriceGranularity::Dense), "20.00");
+        assert_eq!(price_bucket(50.00, PriceGranularity::Dense), "20.00");
+    }
+
+    #[test]
+    fn low_increments_by_0_50_capped_at_5() {
+        assert_eq!(price_bucket(0.49, PriceGranularity::Low), "0.00");
+        assert_eq!(price_bucket(0.50, PriceGranularity::Low), "0.50");
+        assert_eq!(price_bucket(5.01, PriceGranularity::Low), "5.00");
+    }
+
+    #[test]
+    fn medium_increments_by_0_10_capped_at_20() {
+        assert_eq!(price_bucket(1.05, PriceGranularity::Medium), "1.00");
+        assert_eq!(price_bucket(1.10, PriceGranularity::Medium), "1.10");
+        assert_eq!(price_bucket(20.5, PriceGranularity::Medium), "20.00");
+    }
+
+    #[test]
+    fn high_increments_by_0_01_capped_at_20() {
+        assert_eq!(price_bucket(1.234, PriceGranularity::High), "1.23");
+        assert_eq!(price_bucket(20.5, PriceGranularity::High), "20.00");
+    }
+
+    #[test]
+    fn auto_routes_through_dense() {
+        assert_eq!(
+            price_bucket(2.53, PriceGranularity::Auto),
+            price_bucket(2.53, PriceGranularity::Dense)
+        );
+    }
+
+    #[test]
+    fn non_finite_cpm_returns_zero_bucket() {
+        for granularity in [
+            PriceGranularity::Dense,
+            PriceGranularity::Low,
+            PriceGranularity::Medium,
+            PriceGranularity::High,
+            PriceGranularity::Auto,
+        ] {
+            assert_eq!(
+                price_bucket(f64::NAN, granularity),
+                "0.00",
+                "NaN cpm should bucket to 0.00 for granularity {granularity:?}"
+            );
+            assert_eq!(
+                price_bucket(f64::INFINITY, granularity),
+                "0.00",
+                "+Inf cpm should bucket to 0.00 for granularity {granularity:?}"
+            );
+            assert_eq!(
+                price_bucket(f64::NEG_INFINITY, granularity),
+                "0.00",
+                "-Inf cpm should bucket to 0.00 for granularity {granularity:?}"
+            );
+        }
+    }
+}
diff --git a/crates/trusted-server-core/src/publisher.rs b/crates/trusted-server-core/src/publisher.rs
index ebd977b0..1c4c7e02 100644
--- a/crates/trusted-server-core/src/publisher.rs
+++ b/crates/trusted-server-core/src/publisher.rs
@@ -4,28 +4,39 @@
 //! the API boundary:
 //! - pass-through for non-processable `2xx` content
 //! - streamed processing for stream-safe processable responses
-//! - buffered responses for unsupported encodings, `204/205`, or HTML routes
-//!   that require full-document post-processing
+//! - buffered responses for unsupported encodings or `204/205`
 //!
 //! Unsupported `Content-Encoding` values must bypass rewriting entirely. The
 //! streaming processor treats unknown encodings as identity, so publisher code
 //! must gate them out before the body enters the rewrite pipeline.
 
 use std::io::Write;
+use std::sync::{Arc, Mutex};
 
 use error_stack::{Report, ResultExt};
 use fastly::http::{header, StatusCode};
 use fastly::{Body, Request, Response};
 
+use crate::auction::endpoints::{
+    merge_auction_eids, resolve_auction_eids, resolve_client_auction_eids,
+};
+use crate::auction::orchestrator::{AuctionOrchestrator, DispatchedAuction};
+use crate::auction::types::{
+    AuctionContext, AuctionRequest, Bid, DeviceInfo, PublisherInfo, SiteInfo, UserInfo,
+};
 use crate::backend::BackendConfig;
 use crate::compat;
-use crate::constants::HEADER_X_COMPRESS_HINT;
+use crate::consent::gate_eids_by_consent;
+use crate::constants::{COOKIE_TS_EIDS, HEADER_X_COMPRESS_HINT};
+use crate::cookies::handle_request_cookies;
 use crate::ec::kv::KvIdentityGraph;
+use crate::ec::registry::PartnerRegistry;
 use crate::ec::EcContext;
 use crate::error::TrustedServerError;
 use crate::http_util::{is_navigation_request, serve_static_with_etag, RequestInfo};
 use crate::integrations::IntegrationRegistry;
 use crate::platform::RuntimeServices;
+use crate::price_bucket::{price_bucket, PriceGranularity};
 use crate::rsc_flight::RscFlightUrlRewriter;
 use crate::settings::Settings;
 use crate::streaming_processor::{Compression, PipelineConfig, StreamProcessor, StreamingPipeline};
@@ -33,6 +44,11 @@ use crate::streaming_replacer::create_url_replacer;
 
 const SUPPORTED_ENCODING_VALUES: [&str; 3] = ["gzip", "deflate", "br"];
 
+/// Read buffer size for streaming body processing and brotli internal buffers.
+/// Both the `Decompressor` and `CompressorWriter` use this value so all
+/// brotli I/O layers operate on consistently-sized chunks.
+const STREAM_CHUNK_SIZE: usize = 8192;
+
 fn restrict_accept_encoding(req: &mut Request) {
     // If the client sent no Accept-Encoding, leave the request unchanged so the
     // origin responds without compression. Adding encodings here would cause the
@@ -187,6 +203,8 @@ struct ProcessResponseParams<'a> {
     settings: &'a Settings,
     content_type: &'a str,
     integration_registry: &'a IntegrationRegistry,
+    ad_slots_script: Option<&'a str>,
+    ad_bids_state: &'a Arc<Mutex<Option<String>>>,
 }
 
 /// Process response body through the streaming pipeline.
@@ -231,6 +249,8 @@ fn process_response_streaming<W: Write>(
             params.request_scheme,
             params.settings,
             params.integration_registry,
+            params.ad_slots_script.map(str::to_string),
+            params.ad_bids_state.clone(),
         )?;
         StreamingPipeline::new(config, processor).process(body, output)?;
     } else if is_rsc_flight {
@@ -257,12 +277,20 @@ fn process_response_streaming<W: Write>(
 }
 
 /// Create a unified HTML stream processor.
+///
+/// Builds the config via [`HtmlProcessorConfig::from_settings`] and then
+/// layers the auction-hold streaming fields on top via
+/// [`HtmlProcessorConfig::with_ad_state`], so the canonical builder stays the
+/// single source of truth: a future field added to `from_settings` is
+/// inherited here automatically.
 fn create_html_stream_processor(
     origin_host: &str,
     request_host: &str,
     request_scheme: &str,
     settings: &Settings,
     integration_registry: &IntegrationRegistry,
+    ad_slots_script: Option<String>,
+    ad_bids_state: Arc<Mutex<Option<String>>>,
 ) -> Result<impl StreamProcessor, Report<TrustedServerError>> {
     use crate::html_processor::{create_html_processor, HtmlProcessorConfig};
 
@@ -272,7 +300,8 @@ fn create_html_stream_processor(
         origin_host,
         request_host,
         request_scheme,
-    );
+    )
+    .with_ad_state(ad_slots_script, ad_bids_state);
 
     Ok(create_html_processor(config))
 }
@@ -290,7 +319,7 @@ pub enum PublisherResponse {
         /// Origin body to be piped through the streaming pipeline.
         body: Body,
         /// Parameters for [`process_response_streaming`].
-        params: OwnedProcessResponseParams,
+        params: Box<OwnedProcessResponseParams>,
     },
     /// Non-processable `2xx` response (images, fonts, video). The adapter must
     /// reattach the body before sending it to the client.
@@ -312,13 +341,10 @@ pub enum PublisherResponse {
 pub(crate) enum ResponseRoute {
     /// `2xx` non-processable content (images, fonts, video), not `204/205`.
     PassThrough,
-    /// Processable content with supported encoding and either non-HTML or no
-    /// HTML post-processors registered.
+    /// Processable content with supported encoding.
     Stream,
     /// Response returned unmodified via [`PublisherResponse::Buffered`].
     BufferedUnmodified,
-    /// HTML with post-processors registered; requires full-document buffering.
-    BufferedProcessed,
 }
 
 /// Decide how a proxied response should be routed.
@@ -330,7 +356,7 @@ pub(crate) fn classify_response_route(
     content_type: &str,
     content_encoding: &str,
     request_host: &str,
-    has_post_processors: bool,
+    _has_post_processors: bool,
 ) -> ResponseRoute {
     if status == StatusCode::NO_CONTENT || status == StatusCode::RESET_CONTENT {
         return ResponseRoute::BufferedUnmodified;
@@ -353,11 +379,6 @@ pub(crate) fn classify_response_route(
         return ResponseRoute::BufferedUnmodified;
     }
 
-    let is_html = content_type.contains("text/html");
-    if is_html && has_post_processors {
-        return ResponseRoute::BufferedProcessed;
-    }
-
     ResponseRoute::Stream
 }
 
@@ -370,6 +391,14 @@ pub struct OwnedProcessResponseParams {
     pub(crate) request_host: String,
     pub(crate) request_scheme: String,
     pub(crate) content_type: String,
+    pub(crate) ad_slots_script: Option<String>,
+    pub(crate) ad_bids_state: Arc<Mutex<Option<String>>>,
+    /// In-flight SSP bids dispatched before `pending_origin.wait()`.
+    /// The streaming phase collects these and writes bids to `ad_bids_state`
+    /// before processing the last body chunk, so `</body>` injection sees live bids.
+    pub(crate) dispatched_auction: Option<DispatchedAuction>,
+    /// Price granularity used to bucket bids when building `tsjs.bids`.
+    pub(crate) price_granularity: PriceGranularity,
 }
 
 /// Stream the publisher response body through the processing pipeline.
@@ -398,10 +427,539 @@ pub fn stream_publisher_body<W: Write>(
         settings,
         content_type: &params.content_type,
         integration_registry,
+        ad_slots_script: params.ad_slots_script.as_deref(),
+        ad_bids_state: &params.ad_bids_state,
     };
     process_response_streaming(body, output, &borrowed)
 }
 
+/// Stream publisher body with a `</body` tail hold for live bid injection.
+///
+/// Drives the origin body through the HTML pipeline one chunk at a time, using a
+/// small buffer that holds the first raw `</body` tail. When the origin body is
+/// exhausted (`read` returns `Ok(0)`):
+///
+/// 1. [`collect_dispatched_auction`](AuctionOrchestrator::collect_dispatched_auction)
+///    is awaited with the remaining deadline.
+/// 2. Winning bids are written to `ad_bids_state`.
+/// 3. The held tail is fed through the pipeline so `lol_html` fires its
+///    `</body>` handler with bids now in state.
+///
+/// For non-HTML content types the auction is collected before any body bytes
+/// are written (no `</body>` to inject).  If `params.dispatched_auction` is
+/// `None` the function falls back to the synchronous
+/// [`stream_publisher_body`] path.
+///
+/// # Errors
+///
+/// Returns an error if processing fails mid-stream. Headers are already
+/// committed at that point; the caller logs and drops the `StreamingBody`.
+pub async fn stream_publisher_body_async<W: Write>(
+    body: Body,
+    output: &mut W,
+    params: &mut OwnedProcessResponseParams,
+    settings: &Settings,
+    integration_registry: &IntegrationRegistry,
+    orchestrator: &AuctionOrchestrator,
+    services: &RuntimeServices,
+) -> Result<(), Report<TrustedServerError>> {
+    let Some(dispatched) = params.dispatched_auction.take() else {
+        // No auction — use the existing sync pipeline unchanged.
+        return stream_publisher_body(body, output, params, settings, integration_registry);
+    };
+
+    let is_html = params.content_type.contains("text/html");
+
+    if !is_html {
+        // Non-HTML: collect auction first, then stream.  There is no </body>
+        // to hold, so delaying the entire body until collection is acceptable.
+        let placeholder = Request::get(crate::auction::types::MEDIATOR_PLACEHOLDER_URL);
+        let result = orchestrator
+            .collect_dispatched_auction(
+                dispatched,
+                services,
+                &make_collect_context(settings, services, &placeholder),
+            )
+            .await;
+        write_bids_to_state(
+            &result.winning_bids,
+            params.price_granularity,
+            &params.ad_bids_state,
+            settings.debug.inject_adm_for_testing,
+        );
+        return stream_publisher_body(body, output, params, settings, integration_registry);
+    }
+
+    // HTML: build the processor once and drive it chunk by chunk.
+    // One-behind buffer: stream chunk N-1 immediately; hold chunk N until origin
+    // EOF, then await auction and process chunk N (which contains </body>).
+    let mut processor = create_html_stream_processor(
+        &params.origin_host,
+        &params.request_host,
+        &params.request_scheme,
+        settings,
+        integration_registry,
+        params.ad_slots_script.as_deref().map(str::to_string),
+        params.ad_bids_state.clone(),
+    )?;
+
+    let compression = Compression::from_content_encoding(&params.content_encoding);
+    stream_html_with_auction_hold(
+        body,
+        output,
+        &mut processor,
+        compression,
+        AuctionCollectCtx {
+            dispatched,
+            price_granularity: params.price_granularity,
+            ad_bids_state: &params.ad_bids_state,
+            orchestrator,
+            services,
+            settings,
+        },
+    )
+    .await
+}
+
+/// Build a minimal [`AuctionContext`] for the collect phase.
+///
+/// See [`AuctionContext::request`]: the orchestrator's collect path runs
+/// after `send_async` has already consumed the real client request, so this
+/// context carries a synthetic placeholder. The orchestrator itself
+/// instantiates a fresh placeholder when it actually invokes a mediator —
+/// this argument is plumbing for the (presently unused) case where the
+/// orchestrator needs the caller's request shape.
+fn make_collect_context<'a>(
+    settings: &'a Settings,
+    services: &'a RuntimeServices,
+    placeholder: &'a Request,
+) -> AuctionContext<'a> {
+    debug_assert_eq!(
+        placeholder.get_url_str(),
+        crate::auction::types::MEDIATOR_PLACEHOLDER_URL,
+        "make_collect_context must be given the canonical placeholder; \
+         callers must not forward a real client request through the collect path"
+    );
+    AuctionContext {
+        settings,
+        request: placeholder,
+        timeout_ms: 0,
+        provider_responses: None,
+        services,
+    }
+}
+
+/// Well-known crawler User-Agent fragments. Best-effort: an attacker can
+/// trivially spoof their UA, so this is for opt-out signalling to honest
+/// crawlers (preventing SSP auctions burning partner quota on their behalf),
+/// not security.
+pub(crate) const BOT_USER_AGENT_FRAGMENTS: &[&str] =
+    &["Googlebot", "Bingbot", "AhrefsBot", "SemrushBot", "DotBot"];
+
+/// Returns true when the request's User-Agent matches any well-known crawler
+/// fragment in [`BOT_USER_AGENT_FRAGMENTS`].
+pub(crate) fn is_bot_user_agent(req: &Request) -> bool {
+    let ua = req.get_header_str("user-agent").unwrap_or("");
+    BOT_USER_AGENT_FRAGMENTS
+        .iter()
+        .any(|frag| ua.contains(frag))
+}
+
+/// Returns true when the request advertises itself as a prefetch via either
+/// the standard `Sec-Purpose` or the legacy `Purpose` header.
+pub(crate) fn is_prefetch_request(req: &Request) -> bool {
+    req.get_header_str("sec-purpose")
+        .is_some_and(|v| v.contains("prefetch"))
+        || req
+            .get_header_str("purpose")
+            .is_some_and(|v| v.contains("prefetch"))
+}
+
+/// Returns true only when the publisher request should run the full
+/// server-side ad stack: auction dispatch plus initial ad-slot injection.
+pub(crate) fn should_run_server_side_ad_stack(
+    is_get: bool,
+    is_navigation: bool,
+    is_prefetch: bool,
+    is_bot: bool,
+    has_matched_slots: bool,
+    consent_allows_auction: bool,
+) -> bool {
+    is_get
+        && is_navigation
+        && !is_prefetch
+        && !is_bot
+        && has_matched_slots
+        && consent_allows_auction
+}
+
+/// Write winning bids from an auction result into the shared `ad_bids_state` lock.
+pub(crate) fn write_bids_to_state(
+    winning_bids: &std::collections::HashMap<String, Bid>,
+    price_granularity: PriceGranularity,
+    ad_bids_state: &Arc<Mutex<Option<String>>>,
+    inject_adm: bool,
+) {
+    log::debug!(
+        "write_bids_to_state: {} winning bid(s): [{}]",
+        winning_bids.len(),
+        winning_bids.keys().cloned().collect::<Vec<_>>().join(", ")
+    );
+    let bid_map = build_bid_map(winning_bids, price_granularity, inject_adm);
+    let bids_script = build_bids_script(&bid_map);
+    *ad_bids_state.lock().expect("should lock bid state") = Some(bids_script);
+}
+
+/// Prepend an HTML comment summarising the auction result onto the shared
+/// `ad_bids_state` so it lands directly before the injected bids `<script>`.
+///
+/// `path_label` differentiates the streaming-with-auction-hold path (`stream`)
+/// from the buffered path (`buffered`) in the resulting `<!-- ts-debug: -->`
+/// marker so on-page debugging can tell which code path produced the bids.
+pub(crate) fn prepend_auction_debug_comment(
+    path_label: &str,
+    result: &crate::auction::orchestrator::OrchestrationResult,
+    ad_bids_state: &Arc<Mutex<Option<String>>>,
+) {
+    let ssp_count = result.provider_responses.len();
+    let mediator_info = match &result.mediator_response {
+        Some(r) => format!("ok({}_bids)", r.bids.len()),
+        None => "none".to_string(),
+    };
+    let debug_comment = format!(
+        "<!-- ts-debug: path={path_label} ssp={ssp_count} mediator={mediator_info} winning={} time={}ms -->",
+        result.winning_bids.len(),
+        result.total_time_ms,
+    );
+    let mut state = ad_bids_state
+        .lock()
+        .expect("should lock bid state for debug");
+    match &mut *state {
+        Some(script) => {
+            *script = format!("{debug_comment}\n{script}");
+        }
+        None => {
+            // invariant: write_bids_to_state is always called before this and
+            // always sets Some(_); this branch is unreachable in production.
+            *state = Some(debug_comment);
+        }
+    }
+}
+
+/// Bundles the auction-collection dependencies passed through the streaming helpers.
+struct AuctionCollectCtx<'a> {
+    dispatched: DispatchedAuction,
+    price_granularity: PriceGranularity,
+    ad_bids_state: &'a Arc<Mutex<Option<String>>>,
+    orchestrator: &'a AuctionOrchestrator,
+    services: &'a RuntimeServices,
+    settings: &'a Settings,
+}
+
+/// Run the close-body hold loop for HTML bodies, collecting the auction before
+/// the raw `</body` tail is processed so `lol_html` sees live bids.
+async fn stream_html_with_auction_hold<W: Write, P: StreamProcessor>(
+    body: Body,
+    output: &mut W,
+    processor: &mut P,
+    compression: Compression,
+    ctx: AuctionCollectCtx<'_>,
+) -> Result<(), Report<TrustedServerError>> {
+    use brotli::enc::writer::CompressorWriter;
+    use brotli::enc::BrotliEncoderParams;
+    use brotli::Decompressor;
+    use flate2::read::{GzDecoder, ZlibDecoder};
+    use flate2::write::{GzEncoder, ZlibEncoder};
+
+    match compression {
+        Compression::None => body_close_hold_loop(body, output, processor, ctx).await,
+        Compression::Gzip => {
+            let decoder = GzDecoder::new(body);
+            let mut encoder = GzEncoder::new(&mut *output, flate2::Compression::default());
+            body_close_hold_loop(decoder, &mut encoder, processor, ctx).await?;
+            encoder.finish().change_context(TrustedServerError::Proxy {
+                message: "Failed to finalize gzip encoder".to_string(),
+            })?;
+            Ok(())
+        }
+        Compression::Deflate => {
+            let decoder = ZlibDecoder::new(body);
+            let mut encoder = ZlibEncoder::new(&mut *output, flate2::Compression::default());
+            body_close_hold_loop(decoder, &mut encoder, processor, ctx).await?;
+            encoder.finish().change_context(TrustedServerError::Proxy {
+                message: "Failed to finalize deflate encoder".to_string(),
+            })?;
+            Ok(())
+        }
+        Compression::Brotli => {
+            let decoder = Decompressor::new(body, STREAM_CHUNK_SIZE);
+            let params = BrotliEncoderParams {
+                quality: 4,
+                lgwin: 22,
+                ..Default::default()
+            };
+            let mut encoder =
+                CompressorWriter::with_params(&mut *output, STREAM_CHUNK_SIZE, &params);
+            body_close_hold_loop(decoder, &mut encoder, processor, ctx).await?;
+            let _ = encoder.into_inner();
+            Ok(())
+        }
+    }
+}
+
+const BODY_CLOSE_PREFIX: &[u8] = b"</body";
+
+struct BodyCloseHoldBuffer {
+    buffered: Vec<u8>,
+    found_close: bool,
+}
+
+impl BodyCloseHoldBuffer {
+    fn new() -> Self {
+        Self {
+            buffered: Vec::new(),
+            found_close: false,
+        }
+    }
+
+    fn push(&mut self, chunk: &[u8]) -> Vec<u8> {
+        self.buffered.extend_from_slice(chunk);
+
+        if self.found_close {
+            return Vec::new();
+        }
+
+        if let Some(pos) = find_ascii_case_insensitive(&self.buffered, BODY_CLOSE_PREFIX) {
+            self.found_close = true;
+            return self.buffered.drain(..pos).collect();
+        }
+
+        let keep_len = BODY_CLOSE_PREFIX.len().saturating_sub(1);
+        if self.buffered.len() <= keep_len {
+            return Vec::new();
+        }
+
+        let split_at = self.buffered.len() - keep_len;
+        self.buffered.drain(..split_at).collect()
+    }
+
+    fn found_close(&self) -> bool {
+        self.found_close
+    }
+
+    fn finish(self) -> Vec<u8> {
+        self.buffered
+    }
+}
+
+fn find_ascii_case_insensitive(haystack: &[u8], needle: &[u8]) -> Option<usize> {
+    haystack.windows(needle.len()).position(|window| {
+        window
+            .iter()
+            .zip(needle)
+            .all(|(left, right)| left.eq_ignore_ascii_case(right))
+    })
+}
+
+/// Core close-body hold loop.
+///
+/// Streams processed output until the first case-insensitive `</body` prefix is
+/// seen, then collects the auction, writes bids, and processes the held tail
+/// before reading post-body chunks. If no close-body tag is found, collection
+/// happens at EOF before finalization.
+async fn body_close_hold_loop<R: std::io::Read, W: Write, P: StreamProcessor>(
+    mut reader: R,
+    writer: &mut W,
+    processor: &mut P,
+    ctx: AuctionCollectCtx<'_>,
+) -> Result<(), Report<TrustedServerError>> {
+    let AuctionCollectCtx {
+        dispatched,
+        price_granularity,
+        ad_bids_state,
+        orchestrator,
+        services,
+        settings,
+    } = ctx;
+    let mut buffer = vec![0u8; STREAM_CHUNK_SIZE];
+    let mut hold = Some(BodyCloseHoldBuffer::new());
+    let mut dispatched = Some(dispatched);
+
+    loop {
+        match reader.read(&mut buffer) {
+            Ok(0) => {
+                if let Some(hold) = hold.take() {
+                    let dispatched = dispatched
+                        .take()
+                        .expect("should have dispatched auction to collect");
+                    collect_stream_auction(
+                        dispatched,
+                        price_granularity,
+                        ad_bids_state,
+                        orchestrator,
+                        services,
+                        settings,
+                    )
+                    .await;
+
+                    let held = hold.finish();
+                    write_processed_chunk(
+                        writer,
+                        processor,
+                        &held,
+                        false,
+                        "Failed to process held body close",
+                        "Failed to write held body close",
+                    )?;
+                }
+                // Signal EOF to lol_html (fires end() which flushes remaining state).
+                let final_out = processor.process_chunk(&[], true).change_context(
+                    TrustedServerError::Proxy {
+                        message: "Failed to finalize processor".to_string(),
+                    },
+                )?;
+                if !final_out.is_empty() {
+                    writer
+                        .write_all(&final_out)
+                        .change_context(TrustedServerError::Proxy {
+                            message: "Failed to write finalized output".to_string(),
+                        })?;
+                }
+                break;
+            }
+            Ok(n) => {
+                if let Some(hold_buffer) = hold.as_mut() {
+                    let ready = hold_buffer.push(&buffer[..n]);
+                    write_processed_chunk(
+                        writer,
+                        processor,
+                        &ready,
+                        false,
+                        "Failed to process chunk",
+                        "Failed to write chunk",
+                    )?;
+
+                    if hold_buffer.found_close() {
+                        let dispatched = dispatched
+                            .take()
+                            .expect("should have dispatched auction to collect");
+                        collect_stream_auction(
+                            dispatched,
+                            price_granularity,
+                            ad_bids_state,
+                            orchestrator,
+                            services,
+                            settings,
+                        )
+                        .await;
+
+                        let held = hold
+                            .take()
+                            .expect("should have close-body hold buffer")
+                            .finish();
+                        write_processed_chunk(
+                            writer,
+                            processor,
+                            &held,
+                            false,
+                            "Failed to process held body close",
+                            "Failed to write held body close",
+                        )?;
+                    }
+                } else {
+                    write_processed_chunk(
+                        writer,
+                        processor,
+                        &buffer[..n],
+                        false,
+                        "Failed to process chunk",
+                        "Failed to write chunk",
+                    )?;
+                }
+            }
+            Err(e) => {
+                return Err(Report::new(TrustedServerError::Proxy {
+                    message: format!("Failed to read origin body: {e}"),
+                }));
+            }
+        }
+    }
+
+    writer.flush().change_context(TrustedServerError::Proxy {
+        message: "Failed to flush output".to_string(),
+    })?;
+    Ok(())
+}
+
+async fn collect_stream_auction(
+    dispatched: DispatchedAuction,
+    price_granularity: PriceGranularity,
+    ad_bids_state: &Arc<Mutex<Option<String>>>,
+    orchestrator: &AuctionOrchestrator,
+    services: &RuntimeServices,
+    settings: &Settings,
+) {
+    log::info!("body_close_hold_loop: collecting dispatched auction before held body tail");
+    let placeholder = Request::get(crate::auction::types::MEDIATOR_PLACEHOLDER_URL);
+    let collect_ctx = make_collect_context(settings, services, &placeholder);
+    let result = orchestrator
+        .collect_dispatched_auction(dispatched, services, &collect_ctx)
+        .await;
+    log::info!(
+        "body_close_hold_loop: collect complete - {} winning bid(s)",
+        result.winning_bids.len()
+    );
+    write_bids_to_state(
+        &result.winning_bids,
+        price_granularity,
+        ad_bids_state,
+        settings.debug.inject_adm_for_testing,
+    );
+
+    if settings.debug.auction_html_comment {
+        prepend_auction_debug_comment("stream", &result, ad_bids_state);
+    }
+}
+
+fn write_processed_chunk<W: Write, P: StreamProcessor>(
+    writer: &mut W,
+    processor: &mut P,
+    chunk: &[u8],
+    is_last: bool,
+    process_error: &str,
+    write_error: &str,
+) -> Result<(), Report<TrustedServerError>> {
+    if chunk.is_empty() && !is_last {
+        return Ok(());
+    }
+
+    let out =
+        processor
+            .process_chunk(chunk, is_last)
+            .change_context(TrustedServerError::Proxy {
+                message: process_error.to_string(),
+            })?;
+    if !out.is_empty() {
+        writer
+            .write_all(&out)
+            .change_context(TrustedServerError::Proxy {
+                message: write_error.to_string(),
+            })?;
+    }
+
+    Ok(())
+}
+
+/// Auction dispatch context passed to [`handle_publisher_request`].
+pub struct AuctionDispatch<'a> {
+    /// Orchestrator that dispatches and collects SSP bid requests.
+    pub orchestrator: &'a crate::auction::orchestrator::AuctionOrchestrator,
+    /// Creative opportunity slot definitions matched against the request path.
+    pub slots: &'a [crate::creative_opportunities::CreativeOpportunitySlot],
+    /// Partner registry for KV-backed EID resolution. `None` skips KV enrichment.
+    pub registry: Option<&'a PartnerRegistry>,
+}
+
 /// Proxies requests to the publisher's origin server.
 ///
 /// Returns a [`PublisherResponse`] indicating how the response should be sent:
@@ -414,15 +972,21 @@ pub fn stream_publisher_body<W: Write>(
 ///
 /// # Errors
 ///
-/// Returns a [`TrustedServerError`] if:
-/// - The proxy request fails
-/// - The origin backend is unreachable
-pub fn handle_publisher_request(
+/// Returns a [`TrustedServerError`] if the proxy request fails or the
+/// origin backend is unreachable.
+///
+/// # Panics
+///
+/// Panics if `should_run_auction` is `true` but `settings.creative_opportunities` is `None`.
+/// This is a logic invariant: `should_run_auction` is only set when creative opportunities
+/// are configured, so this state is unreachable in practice.
+pub async fn handle_publisher_request(
     settings: &Settings,
     integration_registry: &IntegrationRegistry,
     services: &RuntimeServices,
     kv: Option<&KvIdentityGraph>,
     ec_context: &mut EcContext,
+    auction: AuctionDispatch<'_>,
     mut req: Request,
 ) -> Result<PublisherResponse, Report<TrustedServerError>> {
     log::debug!("Proxying request to publisher_origin");
@@ -446,11 +1010,13 @@ pub fn handle_publisher_request(
         req.get_header("x-forwarded-proto"),
     );
 
+    let is_navigation = is_navigation_request(&http_req);
+
     // Generate a new EC ID only for document navigations. Subresource
     // requests (fonts, images, CSS) may lack consent signals such as the
     // Sec-GPC header, so we skip generation to avoid setting identity
     // cookies when the user's consent preference is unknown.
-    if is_navigation_request(&http_req) {
+    if is_navigation {
         if let Err(err) = ec_context.generate_if_needed(settings, kv) {
             log::warn!("EC generation failed: {err:?}");
         }
@@ -467,6 +1033,11 @@ pub fn handle_publisher_request(
         ec_context.ec_value(),
     );
 
+    let consent_context = ec_context.consent().clone();
+    let ec_id = ec_context.ec_value().filter(|_| ec_allowed);
+    let cookie_jar = handle_request_cookies(&http_req)?;
+    let geo = ec_context.geo_info().cloned();
+
     let backend_name = BackendConfig::from_url(
         &settings.publisher.origin_url,
         settings.proxy.certificate_check,
@@ -480,14 +1051,143 @@ pub fn handle_publisher_request(
         backend_name,
         settings.publisher.origin_url
     );
+
+    let request_path = req.get_path().to_string();
+    let is_get = req.get_method() == fastly::http::Method::GET;
+
+    let is_prefetch = is_prefetch_request(&req);
+    let is_bot = is_bot_user_agent(&req);
+
+    let matched_slots: Vec<_> = if settings.creative_opportunities.is_some() && is_get {
+        crate::creative_opportunities::match_slots(auction.slots, &request_path)
+            .into_iter()
+            .cloned()
+            .collect()
+    } else {
+        Vec::new()
+    };
+
+    // Non-GDPR regions (US, etc.) have no TCF string — auction is freely allowed.
+    // GDPR regions require TCF Purpose 1 (storage/access) before firing.
+    let consent_allows_auction = !consent_context.gdpr_applies
+        || consent_context
+            .tcf
+            .as_ref()
+            .is_some_and(|tcf| tcf.has_purpose_consent(1));
+
+    let should_run_ad_stack = should_run_server_side_ad_stack(
+        is_get,
+        is_navigation,
+        is_prefetch,
+        is_bot,
+        !matched_slots.is_empty(),
+        consent_allows_auction,
+    );
+    let should_run_auction = should_run_ad_stack;
+
+    if matched_slots.is_empty() && settings.creative_opportunities.is_some() {
+        log::debug!(
+            "No creative opportunity slots matched path '{}' — skipping auction and injection",
+            request_path
+        );
+    }
+
+    let auction_timeout_ms = settings
+        .creative_opportunities
+        .as_ref()
+        .and_then(|co| co.auction_timeout_ms)
+        .unwrap_or(settings.auction.timeout_ms);
+
+    let ad_bids_state: Arc<Mutex<Option<String>>> = Arc::new(Mutex::new(None));
+
+    let price_granularity = settings
+        .creative_opportunities
+        .as_ref()
+        .map(|co| co.price_granularity)
+        .unwrap_or_default();
+
+    // Dispatch SSP bid requests while req still has the original client headers
+    // (User-Agent, x-forwarded-for, cookies, etc.).  The borrow ends when
+    // dispatch_auction returns — DispatchedAuction holds no lifetime — so req
+    // can be mutated and sent to origin immediately after.
+    let dispatched_auction = if should_run_auction {
+        let slots_ctx = MatchedSlotsContext {
+            matched_slots: &matched_slots,
+            request_path: &request_path,
+        };
+        let mut auction_request = build_auction_request(
+            &slots_ctx,
+            ec_id,
+            &consent_context,
+            &request_info,
+            req.get_header_str("user-agent"),
+        );
+        let ts_eids_value = cookie_jar
+            .as_ref()
+            .and_then(|j| j.get(COOKIE_TS_EIDS))
+            .map(|c| c.value().to_owned());
+        let client_eids = if ec_id.is_some() {
+            resolve_client_auction_eids(None, ts_eids_value.as_deref())
+        } else {
+            None
+        };
+        let kv_eids = resolve_auction_eids(kv, auction.registry, ec_context);
+        let merged_eids = merge_auction_eids(client_eids, kv_eids);
+        let had_eids = merged_eids.as_ref().is_some_and(|v| !v.is_empty());
+        auction_request.user.eids =
+            gate_eids_by_consent(merged_eids, auction_request.user.consent.as_ref());
+        if had_eids && auction_request.user.eids.is_none() {
+            log::warn!("Server-side auction EIDs stripped by TCF consent gating");
+        }
+        let client_ip = services.client_info.client_ip.map(|ip| ip.to_string());
+        if client_ip.is_some() || geo.is_some() {
+            let device = auction_request.device.get_or_insert(DeviceInfo {
+                user_agent: None,
+                ip: None,
+                geo: None,
+            });
+            device.ip = client_ip;
+            device.geo = geo.clone();
+        }
+        let auction_context = AuctionContext {
+            settings,
+            request: &req,
+            timeout_ms: auction_timeout_ms,
+            provider_responses: None,
+            services,
+        };
+        auction
+            .orchestrator
+            .dispatch_auction(&auction_request, &auction_context)
+    } else {
+        None
+    };
+    log::info!(
+        "dispatch_auction: {}",
+        if dispatched_auction.is_some() {
+            "Some — auction running async"
+        } else {
+            "None — falling back to sync or skipped"
+        }
+    );
+
     // Only advertise encodings the rewrite pipeline can decode and re-encode.
     restrict_accept_encoding(&mut req);
     req.set_header("host", &origin_host);
 
-    let mut response = req
-        .send(&backend_name)
+    // Dispatch origin — SSP requests are already racing in Fastly's native layer.
+    // TTFB ≈ origin latency instead of TTFB ≈ auction timeout.
+    let pending_origin =
+        req.send_async(&backend_name)
+            .change_context(TrustedServerError::Proxy {
+                message: "Failed to dispatch async origin request".to_string(),
+            })?;
+
+    // Now yield for origin.
+    let mut response = pending_origin
+        .wait()
         .change_context(TrustedServerError::Proxy {
-            message: "Failed to proxy request to origin".to_string(),
+            message: "Failed to await origin response".to_string(),
         })?;
 
     log::debug!("Response headers:");
@@ -495,6 +1195,27 @@ pub fn handle_publisher_request(
         log::debug!("  {}: {:?}", name, value);
     }
 
+    let ad_slots_script = if should_run_ad_stack {
+        settings
+            .creative_opportunities
+            .as_ref()
+            .map(|co_config| build_ad_slots_script(&matched_slots, co_config))
+    } else {
+        None
+    };
+
+    // §4.7: assembled HTML responses must never be shared-cached — per-user bid data
+    // travels inline. Apply regardless of slot match or auction outcome (§8).
+    let origin_content_type = response
+        .get_header(header::CONTENT_TYPE)
+        .and_then(|h| h.to_str().ok())
+        .unwrap_or_default();
+    if origin_content_type.contains("text/html") {
+        response.set_header(header::CACHE_CONTROL, "private, max-age=0");
+        response.remove_header("surrogate-control");
+        response.remove_header("fastly-surrogate-control");
+    }
+
     let content_type = response
         .get_header(header::CONTENT_TYPE)
         .map(|h| h.to_str().unwrap_or_default())
@@ -566,45 +1287,254 @@ pub fn handle_publisher_request(
             Ok(PublisherResponse::Stream {
                 response,
                 body,
-                params: OwnedProcessResponseParams {
+                params: Box::new(OwnedProcessResponseParams {
                     content_encoding,
                     origin_host,
                     origin_url: settings.publisher.origin_url.clone(),
                     request_host: request_host.to_string(),
                     request_scheme: request_scheme.to_string(),
                     content_type,
-                },
+                    ad_slots_script: ad_slots_script.clone(),
+                    ad_bids_state: ad_bids_state.clone(),
+                    dispatched_auction,
+                    price_granularity,
+                }),
             })
         }
-        ResponseRoute::BufferedProcessed => {
-            log::debug!(
-                "Buffered response - Content-Type: {}, Content-Encoding: {}, Request Host: {}, Origin Host: {}",
-                content_type,
-                content_encoding,
-                request_host,
-                origin_host,
-            );
+    }
+}
 
-            let body = response.take_body();
-            let params = ProcessResponseParams {
-                content_encoding: &content_encoding,
-                origin_host: &origin_host,
-                origin_url: &settings.publisher.origin_url,
-                request_host,
-                request_scheme,
-                settings,
-                content_type: &content_type,
-                integration_registry,
-            };
-            let mut output = Vec::new();
-            process_response_streaming(body, &mut output, &params)?;
+/// Bundle of the per-request creative-opportunity inputs that travel together.
+///
+/// Extracted so `build_auction_request` stays under the project's
+/// 7-argument cap (`matched_slots` + `request_path` live for the same
+/// request scope and are passed together everywhere).
+pub(crate) struct MatchedSlotsContext<'a> {
+    pub matched_slots: &'a [crate::creative_opportunities::CreativeOpportunitySlot],
+    pub request_path: &'a str,
+}
 
-            response.set_header(header::CONTENT_LENGTH, output.len().to_string());
-            response.set_body(Body::from(output));
+/// Build an [`AuctionRequest`] from matched creative opportunity slots.
+pub(crate) fn build_auction_request(
+    slots_ctx: &MatchedSlotsContext<'_>,
+    ec_id: Option<&str>,
+    consent_context: &crate::consent::ConsentContext,
+    request_info: &crate::http_util::RequestInfo,
+    user_agent: Option<&str>,
+) -> AuctionRequest {
+    let slots = slots_ctx
+        .matched_slots
+        .iter()
+        .map(crate::creative_opportunities::CreativeOpportunitySlot::to_ad_slot)
+        .collect();
+    let page_url = format!(
+        "{}://{}{}",
+        request_info.scheme, request_info.host, slots_ctx.request_path
+    );
+    let ec_id = ec_id.filter(|id| !id.is_empty());
+    let request_id = ec_id.map_or_else(
+        || format!("ts-req-{}", uuid::Uuid::new_v4().simple()),
+        |id| format!("ts-{id}"),
+    );
+    AuctionRequest {
+        id: request_id,
+        slots,
+        publisher: PublisherInfo {
+            domain: request_info.host.clone(),
+            page_url: Some(page_url.clone()),
+        },
+        user: UserInfo {
+            id: ec_id.map(str::to_string),
+            consent: Some(consent_context.clone()),
+            eids: None,
+        },
+        device: user_agent.filter(|ua| !ua.is_empty()).map(|ua| DeviceInfo {
+            user_agent: Some(ua.to_string()),
+            ip: None,
+            geo: None,
+        }),
+        site: Some(SiteInfo {
+            domain: request_info.host.clone(),
+            page: page_url,
+        }),
+        context: std::collections::HashMap::new(),
+    }
+}
 
-            Ok(PublisherResponse::Buffered(response))
+/// Escape a JSON string so it is safe to embed inside a JS double-quoted string literal
+/// inside an HTML `<script>` block.
+///
+/// Escapes required:
+/// - `\` and `"` — prevent JS string termination / invalid escape sequences
+/// - `<`, `>`, `&` — prevent `</script>` injection breaking out of the script context
+/// - U+2028, U+2029 — line/paragraph separators that are valid JSON but terminate
+///   a JS string literal in some parsers
+///
+/// All substitutions use `\uXXXX` form, which is valid inside both JSON strings
+/// and JS string literals. The result is always safe to write as `JSON.parse("…")`.
+fn html_escape_for_script(s: &str) -> String {
+    let mut out = String::with_capacity(s.len());
+    for ch in s.chars() {
+        match ch {
+            '\\' => out.push_str("\\\\"),
+            '"' => out.push_str("\\\""),
+            '<' => out.push_str("\\u003C"),
+            '>' => out.push_str("\\u003E"),
+            '&' => out.push_str("\\u0026"),
+            '\u{2028}' => out.push_str("\\u2028"),
+            '\u{2029}' => out.push_str("\\u2029"),
+            _ => out.push(ch),
         }
     }
+    out
+}
+
+/// Build a price-bucketed bid map from winning bids.
+///
+/// Returns a JSON object map of slot ID → bid metadata including the bucketed
+/// CPM (`hb_pb`), bidder (`hb_bidder`), and optional ad ID, nurl, and burl.
+pub(crate) fn build_bid_map(
+    winning_bids: &std::collections::HashMap<String, Bid>,
+    granularity: crate::price_bucket::PriceGranularity,
+    include_adm: bool,
+) -> serde_json::Map<String, serde_json::Value> {
+    winning_bids
+        .iter()
+        .filter_map(|(slot_id, bid)| {
+            bid.price.map(|cpm| {
+                let bucket = price_bucket(cpm, granularity);
+                let mut obj = serde_json::Map::new();
+                obj.insert("hb_pb".to_string(), serde_json::Value::String(bucket));
+                obj.insert(
+                    "hb_bidder".to_string(),
+                    serde_json::Value::String(bid.bidder.clone()),
+                );
+                // hb_adid: use PBS Cache UUID when present — the Prebid Universal Creative uses
+                // this as the cache lookup key, NOT the OpenRTB bid ID (bid.ad_id). Fall back to
+                // bid.ad_id for APS and other non-PBS providers.
+                let hb_adid = bid.cache_id.as_deref().or(bid.ad_id.as_deref());
+                if let Some(id) = hb_adid {
+                    obj.insert(
+                        "hb_adid".to_string(),
+                        serde_json::Value::String(id.to_string()),
+                    );
+                }
+
+                // Cache endpoint coordinates — only present for PBS bids with Prebid Cache enabled.
+                // The Prebid Universal Creative constructs:
+                //   https://<hb_cache_host><hb_cache_path>?uuid=<hb_adid>
+                if let Some(ref host) = bid.cache_host {
+                    obj.insert(
+                        "hb_cache_host".to_string(),
+                        serde_json::Value::String(host.clone()),
+                    );
+                }
+                if let Some(ref path) = bid.cache_path {
+                    obj.insert(
+                        "hb_cache_path".to_string(),
+                        serde_json::Value::String(path.clone()),
+                    );
+                }
+                if let Some(ref nurl) = bid.nurl {
+                    obj.insert("nurl".to_string(), serde_json::Value::String(nurl.clone()));
+                }
+                if let Some(ref burl) = bid.burl {
+                    obj.insert("burl".to_string(), serde_json::Value::String(burl.clone()));
+                }
+                // Include raw creative markup only for explicit debug injection.
+                // The pbRender bridge can use it while PBS Cache is unavailable.
+                if include_adm {
+                    if let Some(ref adm) = bid.creative {
+                        obj.insert("adm".to_string(), serde_json::Value::String(adm.clone()));
+                    }
+                    obj.insert(
+                        "debug_bid".to_string(),
+                        serde_json::json!({
+                            "slot_id": bid.slot_id,
+                            "price": bid.price,
+                            "currency": bid.currency,
+                            "creative": bid.creative,
+                            "adomain": bid.adomain,
+                            "bidder": bid.bidder,
+                            "width": bid.width,
+                            "height": bid.height,
+                            "nurl": bid.nurl,
+                            "burl": bid.burl,
+                            "ad_id": bid.ad_id,
+                            "cache_id": bid.cache_id,
+                            "cache_host": bid.cache_host,
+                            "cache_path": bid.cache_path,
+                            "metadata": bid.metadata,
+                        }),
+                    );
+                }
+                (slot_id.clone(), serde_json::Value::Object(obj))
+            })
+        })
+        .collect()
+}
+
+/// Build the `tsjs.bids` `<script>` tag from a bucketed bid map.
+///
+/// The JSON is embedded via `JSON.parse(…)` so the browser parser never sees
+/// raw `</script>` sequences inside the string.
+pub(crate) fn build_bids_script(bid_map: &serde_json::Map<String, serde_json::Value>) -> String {
+    let json = serde_json::to_string(bid_map)
+        .expect("serde_json::to_string of Map<String,Value> should be infallible");
+    let escaped = html_escape_for_script(&json);
+    format!(
+        "<script>(window.tsjs=window.tsjs||{{}}).bids=JSON.parse(\"{}\");(function(){{var f=window.tsjs.adInit;if(typeof f===\"function\")f();}})();</script>",
+        escaped
+    )
+}
+
+/// Build the empty-bids `<script>` tag used when no bids were returned.
+///
+/// Shares the same shape as [`build_bids_script`] so any change to the script
+/// format stays in one place.
+pub(crate) fn build_empty_bids_script() -> String {
+    build_bids_script(&serde_json::Map::new())
+}
+
+/// Build the `tsjs.adSlots` `<script>` tag from matched slots.
+///
+/// Property names match what the client-side TSJS bundle expects:
+/// `gam_unit_path`, `div_id`, `formats`, and `targeting`.
+pub(crate) fn build_ad_slots_script(
+    matched_slots: &[crate::creative_opportunities::CreativeOpportunitySlot],
+    co_config: &crate::creative_opportunities::CreativeOpportunitiesConfig,
+) -> String {
+    let slots: Vec<serde_json::Value> = matched_slots
+        .iter()
+        .map(|slot| {
+            let gam_path = slot.resolved_gam_unit_path(&co_config.gam_network_id);
+            let div_id = slot.resolved_div_id();
+            let formats: Vec<serde_json::Value> = slot
+                .formats
+                .iter()
+                .map(|f| serde_json::json!([f.width, f.height]))
+                .collect();
+            let targeting: serde_json::Map<String, serde_json::Value> = slot
+                .targeting
+                .iter()
+                .map(|(k, v)| (k.clone(), serde_json::Value::String(v.clone())))
+                .collect();
+            serde_json::json!({
+                "id": slot.id,
+                "gam_unit_path": gam_path,
+                "div_id": div_id,
+                "formats": formats,
+                "targeting": targeting,
+            })
+        })
+        .collect();
+    let json = serde_json::to_string(&slots)
+        .expect("serde_json::to_string of Vec<Value> should be infallible");
+    let escaped = html_escape_for_script(&json);
+    format!(
+        "<script>(window.tsjs=window.tsjs||{{}}).adSlots=JSON.parse(\"{}\");</script>",
+        escaped
+    )
 }
 
 /// Whether the content type requires processing (URL rewriting, HTML injection).
@@ -626,9 +1556,196 @@ fn is_supported_content_encoding(encoding: &str) -> bool {
     matches!(encoding, "" | "identity" | "gzip" | "deflate" | "br")
 }
 
+/// Handle `GET /__ts/page-bids?path=<path>` — server-side auction for SPA navigation.
+///
+/// Matches creative opportunity slots for the given path, runs a server-side
+/// auction (APS + PBS), and returns the slot definitions and winning bids as JSON.
+/// Called by the client-side SPA navigation hook after `pushState` / `popstate`.
+///
+/// # Errors
+///
+/// Returns [`TrustedServerError`] if cookie parsing or EC ID generation fails.
+pub async fn handle_page_bids(
+    settings: &Settings,
+    orchestrator: &AuctionOrchestrator,
+    services: &RuntimeServices,
+    kv: Option<&KvIdentityGraph>,
+    registry: Option<&PartnerRegistry>,
+    slots: &[crate::creative_opportunities::CreativeOpportunitySlot],
+    req: Request,
+) -> Result<Response, Report<TrustedServerError>> {
+    let Some(co_config) = &settings.creative_opportunities else {
+        return Ok(Response::from_status(StatusCode::NOT_FOUND)
+            .with_body_text_plain("Creative opportunities not configured"));
+    };
+
+    let path_param = req
+        .get_url()
+        .query_pairs()
+        .find(|(k, _)| k == "path")
+        .map(|(_, v)| v.into_owned())
+        .unwrap_or_else(|| "/".to_string());
+
+    let matched_slots: Vec<_> = crate::creative_opportunities::match_slots(slots, &path_param)
+        .into_iter()
+        .cloned()
+        .collect();
+
+    let http_req = compat::from_fastly_headers_ref(&req);
+    let request_info =
+        crate::http_util::RequestInfo::from_request(&http_req, &services.client_info);
+    let ec_ctx =
+        EcContext::read_from_request(settings, &req).change_context(TrustedServerError::Proxy {
+            message: "page-bids: failed to read EC context".to_string(),
+        })?;
+    let ec_id = ec_ctx.ec_value().filter(|_| ec_ctx.ec_allowed());
+    let consent_context = ec_ctx.consent().clone();
+    let geo = ec_ctx.geo_info().cloned();
+    let cookie_jar = handle_request_cookies(&http_req)?;
+
+    let consent_allows_auction = !consent_context.gdpr_applies
+        || consent_context
+            .tcf
+            .as_ref()
+            .is_some_and(|tcf| tcf.has_purpose_consent(1));
+
+    // Same bot / prefetch guards the publisher path uses — without them this
+    // endpoint would fire real SSP auctions on Sec-Purpose=prefetch warm-up
+    // navigations and known crawler UA scans, burning partner request quota.
+    let is_prefetch = is_prefetch_request(&req);
+    let is_bot = is_bot_user_agent(&req);
+
+    if matched_slots.is_empty() {
+        log::debug!(
+            "No creative opportunity slots matched path '{}' — skipping auction",
+            path_param
+        );
+    } else if is_bot || is_prefetch {
+        log::debug!(
+            "page-bids: skipping auction for path '{}' (is_bot={}, is_prefetch={})",
+            path_param,
+            is_bot,
+            is_prefetch
+        );
+    }
+
+    let winning_bids =
+        if !matched_slots.is_empty() && consent_allows_auction && !is_bot && !is_prefetch {
+            let slots_ctx = MatchedSlotsContext {
+                matched_slots: &matched_slots,
+                request_path: &path_param,
+            };
+            let mut auction_request = build_auction_request(
+                &slots_ctx,
+                ec_id,
+                &consent_context,
+                &request_info,
+                req.get_header_str("user-agent"),
+            );
+            let ts_eids_value = cookie_jar
+                .as_ref()
+                .and_then(|j| j.get(COOKIE_TS_EIDS))
+                .map(|c| c.value().to_owned());
+            let client_eids = if ec_id.is_some() {
+                resolve_client_auction_eids(None, ts_eids_value.as_deref())
+            } else {
+                None
+            };
+            let kv_eids = resolve_auction_eids(kv, registry, &ec_ctx);
+            let merged_eids = merge_auction_eids(client_eids, kv_eids);
+            let had_eids = merged_eids.as_ref().is_some_and(|v| !v.is_empty());
+            auction_request.user.eids =
+                gate_eids_by_consent(merged_eids, auction_request.user.consent.as_ref());
+            if had_eids && auction_request.user.eids.is_none() {
+                log::warn!("Page-bids auction EIDs stripped by TCF consent gating");
+            }
+            let client_ip = services.client_info.client_ip.map(|ip| ip.to_string());
+            if client_ip.is_some() || geo.is_some() {
+                let device = auction_request.device.get_or_insert(DeviceInfo {
+                    user_agent: None,
+                    ip: None,
+                    geo: None,
+                });
+                device.ip = client_ip;
+                device.geo = geo.clone();
+            }
+            let timeout_ms = co_config
+                .auction_timeout_ms
+                .unwrap_or(settings.auction.timeout_ms);
+            let auction_context = AuctionContext {
+                settings,
+                request: &req,
+                timeout_ms,
+                provider_responses: None,
+                services,
+            };
+            match orchestrator
+                .run_auction(&auction_request, &auction_context)
+                .await
+            {
+                Ok(result) => result.winning_bids,
+                Err(e) => {
+                    log::warn!("page-bids auction failed: {e:?}");
+                    std::collections::HashMap::new()
+                }
+            }
+        } else {
+            std::collections::HashMap::new()
+        };
+
+    let bid_map = build_bid_map(
+        &winning_bids,
+        co_config.price_granularity,
+        settings.debug.inject_adm_for_testing,
+    );
+
+    let slots_json: Vec<serde_json::Value> = matched_slots
+        .iter()
+        .map(|slot| {
+            let gam_path = slot.resolved_gam_unit_path(&co_config.gam_network_id);
+            let div_id = slot.resolved_div_id();
+            let formats: Vec<serde_json::Value> = slot
+                .formats
+                .iter()
+                .map(|f| serde_json::json!([f.width, f.height]))
+                .collect();
+            let targeting: serde_json::Map<String, serde_json::Value> = slot
+                .targeting
+                .iter()
+                .map(|(k, v)| (k.clone(), serde_json::Value::String(v.clone())))
+                .collect();
+            serde_json::json!({
+                "id": slot.id,
+                "gam_unit_path": gam_path,
+                "div_id": div_id,
+                "formats": formats,
+                "targeting": targeting,
+            })
+        })
+        .collect();
+
+    let body = serde_json::json!({
+        "slots": slots_json,
+        "bids": bid_map,
+    });
+
+    let json_str = serde_json::to_string(&body).change_context(TrustedServerError::Proxy {
+        message: "Failed to serialize page-bids response".to_string(),
+    })?;
+
+    let mut response = Response::from_status(StatusCode::OK);
+    response.set_header(header::CONTENT_TYPE, "application/json");
+    response.set_header(header::CACHE_CONTROL, "private, no-store");
+    response.set_body(json_str);
+
+    Ok(response)
+}
+
 #[cfg(test)]
 mod tests {
-    use std::io::{Read as _, Write as _};
+    use std::io::{self, Read as _, Write as _};
+    use std::sync::atomic::{AtomicUsize, Ordering};
+    use std::sync::Arc;
 
     use brotli::enc::writer::CompressorWriter;
     use brotli::Decompressor;
@@ -636,21 +1753,64 @@ mod tests {
     use flate2::write::GzEncoder;
 
     use super::*;
+    use crate::auction::types::{AdFormat, AdSlot, MediaType};
     use crate::integrations::IntegrationRegistry;
+    use crate::platform::test_support::noop_services;
     use crate::test_support::tests::create_test_settings;
     use fastly::http::{header, Method, StatusCode};
 
-    fn gzip_encode(input: &[u8]) -> Vec<u8> {
-        let mut encoder = GzEncoder::new(Vec::new(), flate2::Compression::default());
-        encoder
-            .write_all(input)
-            .expect("should write gzip test input");
-        encoder.finish().expect("should finish gzip encoding")
+    struct ChunkedReader {
+        chunks: std::collections::VecDeque<Vec<u8>>,
+        read_count: Arc<AtomicUsize>,
     }
 
-    fn gzip_decode(input: &[u8]) -> Vec<u8> {
-        let mut decoder = GzDecoder::new(input);
-        let mut output = Vec::new();
+    impl ChunkedReader {
+        fn new(chunks: &[&[u8]], read_count: Arc<AtomicUsize>) -> Self {
+            Self {
+                chunks: chunks.iter().map(|chunk| chunk.to_vec()).collect(),
+                read_count,
+            }
+        }
+    }
+
+    impl io::Read for ChunkedReader {
+        fn read(&mut self, buf: &mut [u8]) -> io::Result<usize> {
+            let Some(chunk) = self.chunks.pop_front() else {
+                return Ok(0);
+            };
+            self.read_count.fetch_add(1, Ordering::SeqCst);
+            let len = chunk.len().min(buf.len());
+            buf[..len].copy_from_slice(&chunk[..len]);
+            Ok(len)
+        }
+    }
+
+    struct RecordingProcessor {
+        read_count: Arc<AtomicUsize>,
+        body_close_processed_at: Arc<AtomicUsize>,
+    }
+
+    impl StreamProcessor for RecordingProcessor {
+        fn process_chunk(&mut self, chunk: &[u8], _is_last: bool) -> Result<Vec<u8>, io::Error> {
+            if find_ascii_case_insensitive(chunk, BODY_CLOSE_PREFIX).is_some() {
+                self.body_close_processed_at
+                    .store(self.read_count.load(Ordering::SeqCst), Ordering::SeqCst);
+            }
+            Ok(chunk.to_vec())
+        }
+    }
+
+    fn gzip_encode(input: &[u8]) -> Vec<u8> {
+        let mut encoder = GzEncoder::new(Vec::new(), flate2::Compression::default());
+        encoder
+            .write_all(input)
+            .expect("should write gzip test input");
+        encoder.finish().expect("should finish gzip encoding")
+    }
+
+    fn gzip_decode(input: &[u8]) -> Vec<u8> {
+        let mut decoder = GzDecoder::new(input);
+        let mut output = Vec::new();
         decoder
             .read_to_end(&mut output)
             .expect("should decode gzip test output");
@@ -685,6 +1845,39 @@ mod tests {
             request_host: settings.publisher.domain.clone(),
             request_scheme: "https".to_owned(),
             content_type: "application/json".to_owned(),
+            ad_slots_script: None,
+            ad_bids_state: std::sync::Arc::new(std::sync::Mutex::new(None)),
+            dispatched_auction: None,
+            price_granularity: Default::default(),
+        }
+    }
+
+    fn test_auction_request() -> AuctionRequest {
+        AuctionRequest {
+            id: "test-auction".to_string(),
+            slots: vec![AdSlot {
+                id: "atf".to_string(),
+                formats: vec![AdFormat {
+                    media_type: MediaType::Banner,
+                    width: 300,
+                    height: 250,
+                }],
+                floor_price: None,
+                targeting: Default::default(),
+                bidders: Default::default(),
+            }],
+            publisher: PublisherInfo {
+                domain: "test-publisher.com".to_string(),
+                page_url: Some("https://test-publisher.com/article".to_string()),
+            },
+            user: UserInfo {
+                id: None,
+                consent: None,
+                eids: None,
+            },
+            device: None,
+            site: None,
+            context: Default::default(),
         }
     }
 
@@ -742,6 +1935,126 @@ mod tests {
         );
     }
 
+    #[test]
+    fn server_side_ad_stack_runs_only_when_all_auction_gates_pass() {
+        assert!(
+            should_run_server_side_ad_stack(true, true, false, false, true, true),
+            "GET, real navigation, matched slots, and consent should run TS ad stack"
+        );
+
+        assert!(
+            !should_run_server_side_ad_stack(false, true, false, false, true, true),
+            "non-GET requests should skip TS ad stack"
+        );
+        assert!(
+            !should_run_server_side_ad_stack(true, false, false, false, true, true),
+            "non-document requests should skip TS ad stack"
+        );
+        assert!(
+            !should_run_server_side_ad_stack(true, true, true, false, true, true),
+            "prefetch requests should skip TS ad stack and injection"
+        );
+        assert!(
+            !should_run_server_side_ad_stack(true, true, false, true, true, true),
+            "bot requests should skip TS ad stack and injection"
+        );
+        assert!(
+            !should_run_server_side_ad_stack(true, true, false, false, false, true),
+            "requests with no matching slots should skip TS ad stack"
+        );
+        assert!(
+            !should_run_server_side_ad_stack(true, true, false, false, true, false),
+            "requests without required consent should skip TS ad stack and injection"
+        );
+    }
+
+    #[tokio::test]
+    async fn body_close_hold_loop_processes_close_tail_before_reading_post_body_chunks() {
+        let settings = create_test_settings();
+        let services = noop_services();
+        let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
+        let dispatched = DispatchedAuction::empty_for_test(test_auction_request(), 500);
+        let read_count = Arc::new(AtomicUsize::new(0));
+        let body_close_processed_at = Arc::new(AtomicUsize::new(0));
+        let reader = ChunkedReader::new(
+            &[
+                b"<html><body>painted</body>",
+                b"<script>late()</script>",
+                b"</html>",
+            ],
+            Arc::clone(&read_count),
+        );
+        let mut processor = RecordingProcessor {
+            read_count: Arc::clone(&read_count),
+            body_close_processed_at: Arc::clone(&body_close_processed_at),
+        };
+        let ad_bids_state = Arc::new(Mutex::new(None));
+        let ctx = AuctionCollectCtx {
+            dispatched,
+            price_granularity: PriceGranularity::default(),
+            ad_bids_state: &ad_bids_state,
+            orchestrator: &orchestrator,
+            services: &services,
+            settings: &settings,
+        };
+        let mut output = Vec::new();
+
+        body_close_hold_loop(reader, &mut output, &mut processor, ctx)
+            .await
+            .expect("should stream body with auction hold");
+
+        assert_eq!(
+            body_close_processed_at.load(Ordering::SeqCst),
+            1,
+            "close-body tail should be processed as soon as it is found, before later chunks are read"
+        );
+        assert_eq!(
+            std::str::from_utf8(&output).expect("should be utf8"),
+            "<html><body>painted</body><script>late()</script></html>",
+            "post-body chunks should still stream in order"
+        );
+    }
+
+    #[test]
+    fn body_close_hold_buffer_holds_close_body_tail_in_single_chunk() {
+        let mut hold = BodyCloseHoldBuffer::new();
+
+        let ready = hold.push(b"<html><body>painted</body></html>");
+        let held = hold.finish();
+
+        assert_eq!(
+            std::str::from_utf8(&ready).expect("should be utf8"),
+            "<html><body>painted",
+            "content before </body> should stream before auction collection"
+        );
+        assert_eq!(
+            std::str::from_utf8(&held).expect("should be utf8"),
+            "</body></html>",
+            "the close-body tag and trailing bytes should be held"
+        );
+    }
+
+    #[test]
+    fn body_close_hold_buffer_holds_close_body_tail_across_chunks() {
+        let mut hold = BodyCloseHoldBuffer::new();
+
+        let first = hold.push(b"<html><body>painted</bo");
+        let second = hold.push(b"dy></html>");
+        let held = hold.finish();
+
+        let streamed = [first, second].concat();
+        assert_eq!(
+            std::str::from_utf8(&streamed).expect("should be utf8"),
+            "<html><body>painted",
+            "split </body> bytes must not leak before auction collection"
+        );
+        assert_eq!(
+            std::str::from_utf8(&held).expect("should be utf8"),
+            "</body></html>",
+            "split close-body tag should be held intact"
+        );
+    }
+
     #[test]
     fn unsupported_encoding_response_is_returned_unmodified() {
         assert_eq!(
@@ -812,7 +2125,7 @@ mod tests {
     }
 
     #[test]
-    fn route_buffers_html_with_post_processors_for_processing() {
+    fn route_streams_html_with_post_processors() {
         assert_eq!(
             classify_response_route(
                 StatusCode::OK,
@@ -821,7 +2134,7 @@ mod tests {
                 "example.com",
                 true,
             ),
-            ResponseRoute::BufferedProcessed,
+            ResponseRoute::Stream,
         );
     }
 
@@ -913,7 +2226,7 @@ mod tests {
                 true,
             ),
             ResponseRoute::BufferedUnmodified,
-            "204 + HTML + post-processors must not route to BufferedProcessed",
+            "204 + HTML + post-processors must not route to Stream",
         );
     }
 
@@ -957,7 +2270,7 @@ mod tests {
     }
 
     #[test]
-    fn route_processes_non_2xx_html_with_post_processors() {
+    fn route_streams_non_2xx_html_with_post_processors() {
         assert_eq!(
             classify_response_route(
                 StatusCode::NOT_FOUND,
@@ -966,7 +2279,7 @@ mod tests {
                 "example.com",
                 true,
             ),
-            ResponseRoute::BufferedProcessed,
+            ResponseRoute::Stream,
         );
     }
 
@@ -1321,4 +2634,1047 @@ mod tests {
             "should reject unknown module names"
         );
     }
+
+    #[test]
+    fn stream_publisher_body_preserves_gzip_round_trip() {
+        use flate2::write::GzEncoder;
+        use std::io::Write;
+
+        let settings = create_test_settings();
+        let registry =
+            IntegrationRegistry::new(&settings).expect("should create integration registry");
+
+        // Compress CSS containing an origin URL that should be rewritten.
+        // CSS uses the text URL replacer (not lol_html), so inline URLs are rewritten.
+        let html = b"body { background: url('https://origin.example.com/page'); }";
+        let mut compressed = Vec::new();
+        {
+            let mut encoder = GzEncoder::new(&mut compressed, flate2::Compression::default());
+            encoder.write_all(html).expect("should compress");
+            encoder.finish().expect("should finish compression");
+        }
+
+        let body = Body::from(compressed);
+        let params = OwnedProcessResponseParams {
+            content_encoding: "gzip".to_string(),
+            origin_host: "origin.example.com".to_string(),
+            origin_url: "https://origin.example.com".to_string(),
+            request_host: "proxy.example.com".to_string(),
+            request_scheme: "https".to_string(),
+            content_type: "text/css".to_string(),
+            ad_slots_script: None,
+            ad_bids_state: Arc::new(Mutex::new(None)),
+            dispatched_auction: None,
+            price_granularity: crate::price_bucket::PriceGranularity::default(),
+        };
+
+        let mut output = Vec::new();
+        stream_publisher_body(body, &mut output, &params, &settings, &registry)
+            .expect("should process gzip CSS");
+
+        // Decompress output
+        use flate2::read::GzDecoder;
+        use std::io::Read;
+        let mut decoder = GzDecoder::new(&output[..]);
+        let mut decompressed = String::new();
+        decoder
+            .read_to_string(&mut decompressed)
+            .expect("should decompress output");
+
+        assert!(
+            decompressed.contains("proxy.example.com"),
+            "should rewrite origin to proxy. Got: {decompressed}"
+        );
+        assert!(
+            !decompressed.contains("origin.example.com"),
+            "should not contain original host. Got: {decompressed}"
+        );
+    }
+
+    /// Empty origin body on the streaming route must produce no output
+    /// without erroring. Exercises the `Ok(0)` branch of `process_chunks`
+    /// plus the processor's `is_last=true, chunk=[]` terminal call.
+    #[test]
+    fn stream_publisher_body_handles_empty_body() {
+        let settings = create_test_settings();
+        let registry =
+            IntegrationRegistry::new(&settings).expect("should create integration registry");
+
+        let params = OwnedProcessResponseParams {
+            content_encoding: String::new(),
+            origin_host: "origin.example.com".to_string(),
+            origin_url: "https://origin.example.com".to_string(),
+            request_host: "proxy.example.com".to_string(),
+            request_scheme: "https".to_string(),
+            content_type: "text/html; charset=utf-8".to_string(),
+            ad_slots_script: None,
+            ad_bids_state: Arc::new(Mutex::new(None)),
+            dispatched_auction: None,
+            price_granularity: crate::price_bucket::PriceGranularity::default(),
+        };
+
+        let mut output = Vec::new();
+        stream_publisher_body(Body::new(), &mut output, &params, &settings, &registry)
+            .expect("should succeed on empty body");
+
+        assert!(
+            output.is_empty(),
+            "empty origin body should produce empty streaming output. Got: {output:?}"
+        );
+    }
+
+    /// Mid-stream decoder failure must surface as an error. The adapter
+    /// relies on this: once headers are committed, it logs and drops the
+    /// `StreamingBody` so the client sees a truncated response. If a decode
+    /// failure silently emitted bytes, the client would see a malformed
+    /// document instead.
+    #[test]
+    fn stream_publisher_body_surfaces_mid_stream_decode_error() {
+        let settings = create_test_settings();
+        let registry =
+            IntegrationRegistry::new(&settings).expect("should create integration registry");
+
+        // Claim gzip encoding but feed non-gzip bytes. The GzDecoder will
+        // error as soon as it tries to read the gzip header.
+        let params = OwnedProcessResponseParams {
+            content_encoding: "gzip".to_string(),
+            origin_host: "origin.example.com".to_string(),
+            origin_url: "https://origin.example.com".to_string(),
+            request_host: "proxy.example.com".to_string(),
+            request_scheme: "https".to_string(),
+            content_type: "text/html".to_string(),
+            ad_slots_script: None,
+            ad_bids_state: Arc::new(Mutex::new(None)),
+            dispatched_auction: None,
+            price_granularity: crate::price_bucket::PriceGranularity::default(),
+        };
+
+        let bogus_body = Body::from(b"<html>not gzip</html>".to_vec());
+        let mut output = Vec::new();
+        let result = stream_publisher_body(bogus_body, &mut output, &params, &settings, &registry);
+
+        assert!(
+            result.is_err(),
+            "decoding bogus gzip as gzip should return Err so the adapter can drop the stream"
+        );
+    }
+
+    /// Pass-through dispatch contract: the adapter treats `PublisherResponse::PassThrough`
+    /// by reattaching the origin body unchanged and letting Fastly emit it.
+    /// Simulate that step and assert byte identity plus Content-Length
+    /// preservation. Distinct from `pass_through_preserves_body_and_content_length`
+    /// which only tests the header preservation; this one walks the full
+    /// take-then-reattach pattern the adapter uses.
+    #[test]
+    fn publisher_response_pass_through_reattach_preserves_bytes() {
+        // Simulate a 2xx image/png response: Body::from(bytes), take_body(),
+        // then set_body(body). `classify_response_route` already picks
+        // PassThrough for this combination; this covers the adapter's
+        // reattachment half of the contract.
+        let image_bytes: Vec<u8> = (0..=127).cycle().take(2048).collect();
+
+        let mut response = Response::from_status(StatusCode::OK);
+        response.set_header(header::CONTENT_TYPE, "image/png");
+        response.set_header(header::CONTENT_LENGTH, image_bytes.len().to_string());
+        response.set_body(Body::from(image_bytes.clone()));
+
+        // Mirror adapter: take body, then reattach.
+        let body = response.take_body();
+        response.set_body(body);
+
+        assert_eq!(
+            response
+                .get_header_str(header::CONTENT_LENGTH)
+                .expect("content-length should survive"),
+            "2048"
+        );
+        let round_trip = response.into_body().into_bytes();
+        assert_eq!(
+            round_trip, image_bytes,
+            "pass-through reattach must preserve bytes exactly"
+        );
+    }
+
+    /// Streaming dispatch contract: HTML with a registered post-processor still
+    /// routes through `Stream`, and the shared processor pipeline still applies
+    /// the post-processor rewrite.
+    #[test]
+    fn streaming_html_with_post_processors_rewrites_body() {
+        // Configure nextjs so a post-processor is registered.
+        let mut settings = create_test_settings();
+        settings
+            .integrations
+            .insert_config(
+                "nextjs",
+                &serde_json::json!({
+                    "enabled": true,
+                    "rewrite_attributes": ["href", "link", "url"],
+                }),
+            )
+            .expect("should update nextjs config");
+
+        let registry =
+            IntegrationRegistry::new(&settings).expect("should create integration registry");
+
+        assert!(
+            registry.has_html_post_processors(),
+            "nextjs integration must register an HTML post-processor"
+        );
+        assert_eq!(
+            classify_response_route(
+                StatusCode::OK,
+                "text/html; charset=utf-8",
+                "",
+                "proxy.example.com",
+                registry.has_html_post_processors(),
+            ),
+            ResponseRoute::Stream,
+            "HTML with post-processors must route to Stream"
+        );
+
+        // Feed a small HTML body through the same pipeline the Stream arm uses.
+        let html =
+            b"<html><body><a href=\"https://origin.example.com/page\">link</a></body></html>";
+        let body = Body::from(html.to_vec());
+
+        let params = OwnedProcessResponseParams {
+            content_encoding: String::new(),
+            origin_host: "origin.example.com".to_string(),
+            origin_url: "https://origin.example.com".to_string(),
+            request_host: "proxy.example.com".to_string(),
+            request_scheme: "https".to_string(),
+            content_type: "text/html; charset=utf-8".to_string(),
+            ad_slots_script: None,
+            ad_bids_state: Arc::new(Mutex::new(None)),
+            dispatched_auction: None,
+            price_granularity: crate::price_bucket::PriceGranularity::default(),
+        };
+        let mut output = Vec::new();
+        stream_publisher_body(body, &mut output, &params, &settings, &registry)
+            .expect("should process streaming HTML");
+
+        assert!(
+            !output.is_empty(),
+            "streaming processed output must not be empty"
+        );
+        let as_str = std::str::from_utf8(&output).expect("output should be valid UTF-8");
+        assert!(
+            as_str.contains("proxy.example.com"),
+            "origin must be rewritten. Got: {as_str}"
+        );
+        assert!(
+            !as_str.contains("origin.example.com"),
+            "origin host must not leak. Got: {as_str}"
+        );
+    }
+
+    /// Document-state survives from the streaming pass into the post-processor.
+    /// `NextJsRscPlaceholderRewriter` writes into `IntegrationDocumentState`
+    /// during streaming; `NextJsHtmlPostProcessor` reads it and substitutes.
+    /// Regression test: with post-processors registered, placeholders must
+    /// be inserted during streaming and substituted out of the final output.
+    #[test]
+    fn document_state_placeholders_substitute_through_accumulating_path() {
+        let mut settings = create_test_settings();
+        settings
+            .integrations
+            .insert_config(
+                "nextjs",
+                &serde_json::json!({
+                    "enabled": true,
+                    "rewrite_attributes": ["href", "link", "url"],
+                }),
+            )
+            .expect("should update nextjs config");
+        let registry =
+            IntegrationRegistry::new(&settings).expect("should create integration registry");
+
+        // Small, single-fragment RSC script — placeholder path (not fallback).
+        let html = br#"<html><body><script>self.__next_f.push([1,"1:{\"link\":\"https://origin.example.com/page\"}"])</script></body></html>"#;
+        let params = OwnedProcessResponseParams {
+            content_encoding: String::new(),
+            origin_host: "origin.example.com".to_string(),
+            origin_url: "https://origin.example.com".to_string(),
+            request_host: "proxy.example.com".to_string(),
+            request_scheme: "https".to_string(),
+            content_type: "text/html".to_string(),
+            ad_slots_script: None,
+            ad_bids_state: Arc::new(Mutex::new(None)),
+            dispatched_auction: None,
+            price_granularity: crate::price_bucket::PriceGranularity::default(),
+        };
+
+        let mut output = Vec::new();
+        stream_publisher_body(
+            Body::from(html.to_vec()),
+            &mut output,
+            &params,
+            &settings,
+            &registry,
+        )
+        .expect("should process RSC push");
+
+        let processed = String::from_utf8(output).expect("valid UTF-8");
+        assert!(
+            !processed.contains("__ts_rsc_payload_"),
+            "placeholder must be substituted before reaching output. Got: {processed}"
+        );
+        assert!(
+            processed.contains("proxy.example.com/page"),
+            "origin URL must be rewritten in the substituted payload. Got: {processed}"
+        );
+        assert!(
+            !processed.contains("origin.example.com"),
+            "origin host must not leak. Got: {processed}"
+        );
+    }
+
+    #[cfg(test)]
+    mod creative_opportunities_tests {
+        use super::super::{
+            build_ad_slots_script, build_auction_request, build_bid_map, build_bids_script,
+            html_escape_for_script, MatchedSlotsContext,
+        };
+        use crate::auction::types::{Bid, MediaType};
+        use crate::consent::ConsentContext;
+        use crate::creative_opportunities::{
+            CreativeOpportunitiesConfig, CreativeOpportunityFormat, CreativeOpportunitySlot,
+        };
+        use crate::http_util::RequestInfo;
+        use crate::price_bucket::PriceGranularity;
+        use std::collections::HashMap;
+
+        fn make_config() -> CreativeOpportunitiesConfig {
+            CreativeOpportunitiesConfig {
+                gam_network_id: "21765378893".to_string(),
+                auction_timeout_ms: Some(500),
+                price_granularity: PriceGranularity::Dense,
+                slot: Vec::new(),
+            }
+        }
+
+        fn make_slot() -> CreativeOpportunitySlot {
+            CreativeOpportunitySlot {
+                id: "atf_sidebar_ad".to_string(),
+                gam_unit_path: Some("/21765378893/publisher/atf-sidebar".to_string()),
+                div_id: Some("div-atf-sidebar".to_string()),
+                page_patterns: vec!["/20**".to_string()],
+                formats: vec![CreativeOpportunityFormat {
+                    width: 300,
+                    height: 250,
+                    media_type: MediaType::Banner,
+                }],
+                floor_price: Some(0.50),
+                targeting: [("pos".to_string(), "atf".to_string())]
+                    .into_iter()
+                    .collect(),
+                providers: Default::default(),
+                compiled_patterns: Vec::new(),
+            }
+        }
+
+        fn make_bid(
+            slot_id: &str,
+            price: f64,
+            bidder: &str,
+            ad_id: &str,
+            nurl: &str,
+            burl: &str,
+        ) -> Bid {
+            Bid {
+                slot_id: slot_id.to_string(),
+                price: Some(price),
+                currency: "USD".to_string(),
+                creative: None,
+                adomain: None,
+                bidder: bidder.to_string(),
+                width: 300,
+                height: 250,
+                nurl: Some(nurl.to_string()),
+                burl: Some(burl.to_string()),
+                ad_id: Some(ad_id.to_string()),
+                cache_id: None,
+                cache_host: None,
+                cache_path: None,
+                metadata: Default::default(),
+            }
+        }
+
+        #[test]
+        fn ad_slots_script_contains_slot_data() {
+            let slots = vec![make_slot()];
+            let config = make_config();
+            let script = build_ad_slots_script(&slots, &config);
+            assert!(
+                script.contains("window.tsjs=window.tsjs||{}"),
+                "should initialise tsjs namespace"
+            );
+            assert!(
+                script.contains(".adSlots=JSON.parse"),
+                "should use JSON.parse for adSlots"
+            );
+            assert!(script.contains("atf_sidebar_ad"), "should include slot id");
+            assert!(!script.contains("adInit"), "must NOT contain adInit");
+            assert!(
+                !script.contains("__ts_request_id"),
+                "must NOT contain request_id"
+            );
+        }
+
+        #[test]
+        fn ad_slots_script_is_xss_safe() {
+            let slots = vec![make_slot()];
+            let config = make_config();
+            let script = build_ad_slots_script(&slots, &config);
+            let inner = script
+                .trim_start_matches("<script>")
+                .trim_end_matches("</script>");
+            assert!(!inner.contains('<'), "no unescaped < in script content");
+            assert!(!inner.contains('>'), "no unescaped > in script content");
+        }
+
+        #[test]
+        fn bid_map_includes_nurl_and_burl() {
+            let mut winning_bids = HashMap::new();
+            winning_bids.insert(
+                "atf_sidebar_ad".to_string(),
+                make_bid(
+                    "atf_sidebar_ad",
+                    1.50,
+                    "kargo",
+                    "abc123",
+                    "https://ssp/win",
+                    "https://ssp/bill",
+                ),
+            );
+            let map = build_bid_map(&winning_bids, PriceGranularity::Dense, false);
+            let entry = map.get("atf_sidebar_ad").expect("should have bid entry");
+            let obj = entry.as_object().expect("should be object");
+            assert_eq!(
+                obj.get("hb_pb").and_then(|v| v.as_str()),
+                Some("1.50"),
+                "should bucket price with dense granularity"
+            );
+            assert_eq!(
+                obj.get("hb_bidder").and_then(|v| v.as_str()),
+                Some("kargo"),
+                "should include bidder"
+            );
+            assert_eq!(
+                obj.get("hb_adid").and_then(|v| v.as_str()),
+                Some("abc123"),
+                "should fall back to ad_id when no cache_id present"
+            );
+            assert_eq!(
+                obj.get("nurl").and_then(|v| v.as_str()),
+                Some("https://ssp/win"),
+                "should include nurl"
+            );
+            assert_eq!(
+                obj.get("burl").and_then(|v| v.as_str()),
+                Some("https://ssp/bill"),
+                "should include burl"
+            );
+        }
+
+        #[test]
+        fn client_bid_map_omits_adm_by_default() {
+            let mut winning_bids = HashMap::new();
+            let mut bid = make_bid(
+                "atf_sidebar_ad",
+                1.50,
+                "kargo",
+                "abc123",
+                "https://ssp/win",
+                "https://ssp/bill",
+            );
+            bid.creative = Some("<div>Creative</div>".to_string());
+            winning_bids.insert("atf_sidebar_ad".to_string(), bid);
+
+            let map = build_bid_map(&winning_bids, PriceGranularity::Dense, false);
+            let obj = map
+                .get("atf_sidebar_ad")
+                .expect("should have bid entry")
+                .as_object()
+                .expect("should be object");
+
+            assert!(
+                obj.get("adm").is_none(),
+                "should omit adm when debug injection is disabled"
+            );
+            assert!(
+                obj.get("debug_bid").is_none(),
+                "should omit debug bid when debug injection is disabled"
+            );
+        }
+
+        #[test]
+        fn client_bid_map_includes_adm_when_debug_injection_enabled() {
+            let mut winning_bids = HashMap::new();
+            let mut bid = make_bid(
+                "atf_sidebar_ad",
+                1.50,
+                "kargo",
+                "abc123",
+                "https://ssp/win",
+                "https://ssp/bill",
+            );
+            bid.creative = Some("<div>Creative</div>".to_string());
+            winning_bids.insert("atf_sidebar_ad".to_string(), bid);
+
+            let map = build_bid_map(&winning_bids, PriceGranularity::Dense, true);
+            let obj = map
+                .get("atf_sidebar_ad")
+                .expect("should have bid entry")
+                .as_object()
+                .expect("should be object");
+
+            assert_eq!(
+                obj.get("adm").and_then(|v| v.as_str()),
+                Some("<div>Creative</div>"),
+                "should include adm when debug injection is enabled"
+            );
+        }
+
+        #[test]
+        fn client_bid_map_includes_debug_bid_when_debug_injection_enabled() {
+            let mut winning_bids = HashMap::new();
+            let mut bid = make_bid(
+                "atf_sidebar_ad",
+                1.50,
+                "mocktioneer",
+                "bid-ad-id",
+                "https://ssp/win",
+                "https://ssp/bill",
+            );
+            bid.creative = Some("<div>Creative</div>".to_string());
+            bid.adomain = Some(vec!["example.com".to_string()]);
+            bid.cache_id = Some("cache-uuid".to_string());
+            bid.cache_host = Some("cache.example".to_string());
+            bid.cache_path = Some("/cache".to_string());
+            bid.metadata.insert(
+                "raw_field".to_string(),
+                serde_json::Value::String("raw-value".to_string()),
+            );
+            winning_bids.insert("atf_sidebar_ad".to_string(), bid);
+
+            let map = build_bid_map(&winning_bids, PriceGranularity::Dense, true);
+            let obj = map
+                .get("atf_sidebar_ad")
+                .expect("should have bid entry")
+                .as_object()
+                .expect("should be object");
+            let debug_bid = obj
+                .get("debug_bid")
+                .and_then(|v| v.as_object())
+                .expect("should include debug bid when debug injection is enabled");
+
+            assert_eq!(
+                debug_bid.get("slot_id").and_then(|v| v.as_str()),
+                Some("atf_sidebar_ad"),
+                "should expose original slot id"
+            );
+            assert_eq!(
+                debug_bid.get("bidder").and_then(|v| v.as_str()),
+                Some("mocktioneer"),
+                "should expose original bidder"
+            );
+            assert_eq!(
+                debug_bid.get("ad_id").and_then(|v| v.as_str()),
+                Some("bid-ad-id"),
+                "should expose original bid ad id"
+            );
+            assert_eq!(
+                debug_bid.get("cache_id").and_then(|v| v.as_str()),
+                Some("cache-uuid"),
+                "should expose original PBS cache id"
+            );
+            assert_eq!(
+                debug_bid.get("metadata").and_then(|v| v.get("raw_field")),
+                Some(&serde_json::Value::String("raw-value".to_string())),
+                "should expose provider metadata"
+            );
+        }
+
+        #[test]
+        fn bid_map_uses_cache_id_for_hb_adid_when_present() {
+            let mut winning_bids = HashMap::new();
+            winning_bids.insert(
+                "atf_sidebar_ad".to_string(),
+                Bid {
+                    slot_id: "atf_sidebar_ad".to_string(),
+                    price: Some(1.50),
+                    currency: "USD".to_string(),
+                    creative: None,
+                    adomain: None,
+                    bidder: "thetradedesk".to_string(),
+                    width: 300,
+                    height: 250,
+                    nurl: None,
+                    burl: None,
+                    ad_id: Some("bid-impression-id".to_string()),
+                    cache_id: Some("f47447a0-b759-4f2f-9887-af458b79b570".to_string()),
+                    cache_host: Some("openads.adsrvr.org".to_string()),
+                    cache_path: Some("/cache".to_string()),
+                    metadata: Default::default(),
+                },
+            );
+            let map = build_bid_map(&winning_bids, PriceGranularity::Dense, false);
+            let obj = map
+                .get("atf_sidebar_ad")
+                .expect("should have bid entry")
+                .as_object()
+                .expect("should be object");
+            assert_eq!(
+                obj.get("hb_adid").and_then(|v| v.as_str()),
+                Some("f47447a0-b759-4f2f-9887-af458b79b570"),
+                "should use cache_id for hb_adid, not ad_id"
+            );
+            assert_eq!(
+                obj.get("hb_cache_host").and_then(|v| v.as_str()),
+                Some("openads.adsrvr.org"),
+                "should emit hb_cache_host"
+            );
+            assert_eq!(
+                obj.get("hb_cache_path").and_then(|v| v.as_str()),
+                Some("/cache"),
+                "should emit hb_cache_path"
+            );
+        }
+
+        #[test]
+        fn bid_map_falls_back_to_ad_id_when_cache_id_absent() {
+            let mut winning_bids = HashMap::new();
+            winning_bids.insert(
+                "atf_sidebar_ad".to_string(),
+                Bid {
+                    slot_id: "atf_sidebar_ad".to_string(),
+                    price: Some(0.50),
+                    currency: "USD".to_string(),
+                    creative: None,
+                    adomain: None,
+                    bidder: "amazon-aps".to_string(),
+                    width: 300,
+                    height: 250,
+                    nurl: None,
+                    burl: None,
+                    ad_id: Some("aps-bid-token".to_string()),
+                    cache_id: None,
+                    cache_host: None,
+                    cache_path: None,
+                    metadata: Default::default(),
+                },
+            );
+            let map = build_bid_map(&winning_bids, PriceGranularity::Dense, false);
+            let obj = map
+                .get("atf_sidebar_ad")
+                .expect("should have bid entry")
+                .as_object()
+                .expect("should be object");
+            assert_eq!(
+                obj.get("hb_adid").and_then(|v| v.as_str()),
+                Some("aps-bid-token"),
+                "should fall back to ad_id when cache_id absent"
+            );
+            assert!(
+                obj.get("hb_cache_host").is_none(),
+                "should not emit hb_cache_host when absent"
+            );
+            assert!(
+                obj.get("hb_cache_path").is_none(),
+                "should not emit hb_cache_path when absent"
+            );
+        }
+
+        #[test]
+        fn bid_map_omits_hb_adid_when_both_cache_id_and_ad_id_absent() {
+            let mut winning_bids = HashMap::new();
+            winning_bids.insert(
+                "atf_sidebar_ad".to_string(),
+                Bid {
+                    slot_id: "atf_sidebar_ad".to_string(),
+                    price: Some(0.50),
+                    currency: "USD".to_string(),
+                    creative: None,
+                    adomain: None,
+                    bidder: "amazon-aps".to_string(),
+                    width: 300,
+                    height: 250,
+                    nurl: None,
+                    burl: None,
+                    ad_id: None,
+                    cache_id: None,
+                    cache_host: None,
+                    cache_path: None,
+                    metadata: Default::default(),
+                },
+            );
+            let map = build_bid_map(&winning_bids, PriceGranularity::Dense, false);
+            let obj = map
+                .get("atf_sidebar_ad")
+                .expect("should have bid entry")
+                .as_object()
+                .expect("should be object");
+            assert!(
+                obj.get("hb_adid").is_none(),
+                "should omit hb_adid when no cache_id and no ad_id"
+            );
+        }
+
+        #[test]
+        fn bid_map_excludes_slot_when_price_is_none() {
+            let mut winning_bids = HashMap::new();
+            winning_bids.insert(
+                "no-price-slot".to_string(),
+                Bid {
+                    slot_id: "no-price-slot".to_string(),
+                    price: None,
+                    currency: "USD".to_string(),
+                    creative: None,
+                    adomain: None,
+                    bidder: "kargo".to_string(),
+                    width: 300,
+                    height: 250,
+                    nurl: None,
+                    burl: None,
+                    ad_id: None,
+                    cache_id: None,
+                    cache_host: None,
+                    cache_path: None,
+                    metadata: Default::default(),
+                },
+            );
+            let map = build_bid_map(&winning_bids, PriceGranularity::Dense, false);
+            assert!(
+                map.is_empty(),
+                "slot with no price should be excluded from bid map"
+            );
+        }
+
+        #[test]
+        fn bids_script_is_xss_safe() {
+            let mut map = serde_json::Map::new();
+            map.insert("atf".to_string(), serde_json::json!({"hb_pb": "1.00"}));
+            let script = build_bids_script(&map);
+            let inner = script
+                .trim_start_matches("<script>")
+                .trim_end_matches("</script>");
+            assert!(!inner.contains('<'), "no unescaped < in bids script");
+            assert!(!inner.contains('>'), "no unescaped > in bids script");
+        }
+
+        #[test]
+        fn bids_script_calls_ad_init_without_retry_timer() {
+            let mut map = serde_json::Map::new();
+            map.insert("atf".to_string(), serde_json::json!({"hb_pb": "1.00"}));
+
+            let script = build_bids_script(&map);
+
+            assert!(
+                script.contains("window.tsjs.adInit"),
+                "should hand off bids to adInit"
+            );
+            assert!(
+                !script.contains("setTimeout"),
+                "should not retry adInit on a timer"
+            );
+            assert!(
+                !script.contains("prevGptSlots"),
+                "should not use TS-owned slots as adInit success signal"
+            );
+        }
+
+        #[test]
+        fn auction_request_without_ec_id_omits_user_id_and_uses_non_ec_request_id() {
+            let slot = make_slot();
+            let slots = [slot];
+            let slots_ctx = MatchedSlotsContext {
+                matched_slots: &slots,
+                request_path: "/2024/01/my-article/",
+            };
+            let request_info = RequestInfo {
+                host: "publisher.example.com".to_string(),
+                scheme: "https".to_string(),
+            };
+
+            let request = build_auction_request(
+                &slots_ctx,
+                None,
+                &ConsentContext::default(),
+                &request_info,
+                Some("Mozilla/5.0"),
+            );
+
+            assert_eq!(request.user.id, None, "should not forward an EC user id");
+            assert!(
+                request.id.starts_with("ts-req-"),
+                "should use a non-EC request id, got {}",
+                request.id
+            );
+        }
+
+        #[test]
+        fn auction_request_with_ec_id_sets_user_id_and_ec_request_id() {
+            let slot = make_slot();
+            let slots = [slot];
+            let slots_ctx = MatchedSlotsContext {
+                matched_slots: &slots,
+                request_path: "/2024/01/my-article/",
+            };
+            let request_info = RequestInfo {
+                host: "publisher.example.com".to_string(),
+                scheme: "https".to_string(),
+            };
+
+            let request = build_auction_request(
+                &slots_ctx,
+                Some("ec-abc"),
+                &ConsentContext::default(),
+                &request_info,
+                Some("Mozilla/5.0"),
+            );
+
+            assert_eq!(
+                request.user.id.as_deref(),
+                Some("ec-abc"),
+                "should forward EC id when identity consent allows it"
+            );
+            assert_eq!(
+                request.id, "ts-ec-abc",
+                "should preserve existing EC-derived request id when present"
+            );
+        }
+
+        #[test]
+        fn html_escape_encodes_special_chars() {
+            assert_eq!(
+                html_escape_for_script("text\\with\\backslash"),
+                "text\\\\with\\\\backslash",
+                "should escape backslashes"
+            );
+            assert_eq!(
+                html_escape_for_script("string\"with\"quotes"),
+                "string\\\"with\\\"quotes",
+                "should escape quotes"
+            );
+            assert_eq!(
+                html_escape_for_script("simple"),
+                "simple",
+                "should not change simple text"
+            );
+            assert_eq!(
+                html_escape_for_script("both\\\"mixed"),
+                "both\\\\\\\"mixed",
+                "should escape both backslashes and quotes"
+            );
+            assert_eq!(
+                html_escape_for_script("<script>alert(1)</script>"),
+                "\\u003Cscript\\u003Ealert(1)\\u003C/script\\u003E",
+                "should unicode-escape angle brackets to prevent script injection"
+            );
+            assert_eq!(
+                html_escape_for_script("a&b"),
+                "a\\u0026b",
+                "should unicode-escape ampersand"
+            );
+            assert_eq!(
+                html_escape_for_script("line\u{2028}sep"),
+                "line\\u2028sep",
+                "should unicode-escape U+2028 line separator"
+            );
+            assert_eq!(
+                html_escape_for_script("para\u{2029}sep"),
+                "para\\u2029sep",
+                "should unicode-escape U+2029 paragraph separator"
+            );
+        }
+    }
+
+    mod page_bids_no_match_tests {
+        use super::super::*;
+        use crate::auction::AuctionOrchestrator;
+        use crate::creative_opportunities::{CreativeOpportunityFormat, CreativeOpportunitySlot};
+        use crate::platform::test_support::noop_services;
+        use crate::test_support::tests::crate_test_settings_str;
+        use fastly::http::Method;
+        use fastly::Request;
+
+        fn settings_with_co() -> Settings {
+            let toml = format!(
+                "{}\n[creative_opportunities]\ngam_network_id = \"12345\"\n",
+                crate_test_settings_str()
+            );
+            Settings::from_toml(&toml).expect("should parse settings with creative_opportunities")
+        }
+
+        fn article_slot() -> Vec<CreativeOpportunitySlot> {
+            vec![CreativeOpportunitySlot {
+                id: "atf".to_string(),
+                gam_unit_path: None,
+                div_id: None,
+                page_patterns: vec!["/20**".to_string()],
+                formats: vec![CreativeOpportunityFormat {
+                    width: 300,
+                    height: 250,
+                    media_type: crate::auction::types::MediaType::Banner,
+                }],
+                floor_price: Some(0.50),
+                targeting: Default::default(),
+                providers: Default::default(),
+                compiled_patterns: Vec::new(),
+            }]
+        }
+
+        fn make_page_bids_request(path: &str) -> Request {
+            Request::new(
+                Method::GET,
+                format!("https://test-publisher.com/_ts/page-bids?path={path}"),
+            )
+        }
+
+        #[tokio::test]
+        async fn empty_slots_file_returns_empty_slots_and_bids() {
+            // Spec §8 kill-switch: creative-opportunities.toml with zero slots disables
+            // all server-side auction activity and injection.
+            let settings = settings_with_co();
+            let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
+            let services = noop_services();
+            let req = make_page_bids_request("/2024/01/my-article/");
+
+            let response =
+                handle_page_bids(&settings, &orchestrator, &services, None, None, &[], req)
+                    .await
+                    .expect("should return ok response");
+
+            let body: serde_json::Value =
+                serde_json::from_slice(&response.into_body_bytes()).expect("should be json");
+
+            assert_eq!(
+                body["slots"]
+                    .as_array()
+                    .expect("slots should be array")
+                    .len(),
+                0,
+                "empty slots should produce zero injected slots"
+            );
+            assert_eq!(
+                body["bids"]
+                    .as_object()
+                    .expect("bids should be object")
+                    .len(),
+                0,
+                "empty slots should produce zero bids"
+            );
+        }
+
+        #[tokio::test]
+        async fn bot_user_agent_returns_slots_but_no_bids() {
+            // Crawlers should get slot definitions (so HTML structure is unchanged)
+            // but the server must not burn SSP request quota running a real auction
+            // for them. Same gate the publisher path applies.
+            let settings = settings_with_co();
+            let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
+            let services = noop_services();
+            let slots = article_slot();
+            let mut req = make_page_bids_request("/2024/01/my-article/");
+            req.set_header("user-agent", "Mozilla/5.0 (compatible; Googlebot/2.1)");
+
+            let response =
+                handle_page_bids(&settings, &orchestrator, &services, None, None, &slots, req)
+                    .await
+                    .expect("should return ok response");
+
+            let body: serde_json::Value =
+                serde_json::from_slice(&response.into_body_bytes()).expect("should be json");
+
+            assert_eq!(
+                body["slots"]
+                    .as_array()
+                    .expect("slots should be array")
+                    .len(),
+                1,
+                "bot request should still get slot definitions"
+            );
+            assert_eq!(
+                body["bids"]
+                    .as_object()
+                    .expect("bids should be object")
+                    .len(),
+                0,
+                "bot request must not run an auction (no SSP cost burned for crawlers)"
+            );
+        }
+
+        #[tokio::test]
+        async fn prefetch_request_returns_slots_but_no_bids() {
+            // Navigations triggered by Sec-Purpose=prefetch should not fire real
+            // SSP auctions — the user has not yet visited the page.
+            let settings = settings_with_co();
+            let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
+            let services = noop_services();
+            let slots = article_slot();
+            let mut req = make_page_bids_request("/2024/01/my-article/");
+            req.set_header("sec-purpose", "prefetch");
+
+            let response =
+                handle_page_bids(&settings, &orchestrator, &services, None, None, &slots, req)
+                    .await
+                    .expect("should return ok response");
+
+            let body: serde_json::Value =
+                serde_json::from_slice(&response.into_body_bytes()).expect("should be json");
+
+            assert_eq!(
+                body["slots"]
+                    .as_array()
+                    .expect("slots should be array")
+                    .len(),
+                1,
+                "prefetch request should still get slot definitions"
+            );
+            assert_eq!(
+                body["bids"]
+                    .as_object()
+                    .expect("bids should be object")
+                    .len(),
+                0,
+                "prefetch request must not run an auction"
+            );
+        }
+
+        #[tokio::test]
+        async fn url_not_matching_any_pattern_returns_empty_response() {
+            // Slots exist but request path does not match — no auction, no injection.
+            let settings = settings_with_co();
+            let orchestrator = AuctionOrchestrator::new(settings.auction.clone());
+            let services = noop_services();
+            let slots = article_slot(); // slot matches /20** only
+            let req = make_page_bids_request("/about"); // does not match
+
+            let response =
+                handle_page_bids(&settings, &orchestrator, &services, None, None, &slots, req)
+                    .await
+                    .expect("should return ok response");
+
+            let body: serde_json::Value =
+                serde_json::from_slice(&response.into_body_bytes()).expect("should be json");
+
+            assert_eq!(
+                body["slots"]
+                    .as_array()
+                    .expect("slots should be array")
+                    .len(),
+                0,
+                "non-matching URL should produce zero injected slots"
+            );
+            assert_eq!(
+                body["bids"]
+                    .as_object()
+                    .expect("bids should be object")
+                    .len(),
+                0,
+                "non-matching URL should produce zero bids"
+            );
+        }
+    }
 }
diff --git a/crates/trusted-server-core/src/settings.rs b/crates/trusted-server-core/src/settings.rs
index 1b8bf3c4..642ee436 100644
--- a/crates/trusted-server-core/src/settings.rs
+++ b/crates/trusted-server-core/src/settings.rs
@@ -12,6 +12,7 @@ use validator::{Validate, ValidationError};
 
 use crate::auction_config_types::AuctionConfig;
 use crate::consent_config::ConsentConfig;
+use crate::creative_opportunities::CreativeOpportunitiesConfig;
 use crate::error::TrustedServerError;
 use crate::redacted::Redacted;
 
@@ -647,6 +648,21 @@ pub struct DebugConfig {
     /// Fastly-observed TLS details that browser JS cannot normally read.
     #[serde(default)]
     pub ja4_endpoint_enabled: bool,
+
+    /// Inject a `<!-- ts-debug: ... -->` HTML comment before `</body>` showing
+    /// auction pipeline stats (SSP count, mediator status, winning bid count).
+    /// Never enable in production — visible in page source.
+    #[serde(default)]
+    pub auction_html_comment: bool,
+
+    /// Include raw `adm` creative markup in `window.tsjs.bids` for GPT/GAM
+    /// debug rendering through the Prebid Universal Creative bridge.
+    ///
+    /// Use this to validate the server-side auction→GAM targeting→creative
+    /// rendering pipeline while PBS Cache is unavailable. Never enable in
+    /// production — injects raw HTML from SSPs.
+    #[serde(default)]
+    pub inject_adm_for_testing: bool,
 }
 
 #[derive(Debug, Default, Clone, Deserialize, Serialize, Validate)]
@@ -674,6 +690,8 @@ pub struct Settings {
     #[serde(default)]
     pub proxy: Proxy,
     #[serde(default)]
+    pub creative_opportunities: Option<CreativeOpportunitiesConfig>,
+    #[serde(default)]
     pub debug: DebugConfig,
 }
 
@@ -758,15 +776,30 @@ impl Settings {
     ///
     /// # Errors
     ///
-    /// Returns a configuration error if any handler path regex does not compile.
-    pub fn prepare_runtime(&self) -> Result<(), Report<TrustedServerError>> {
+    /// Returns a configuration error if any cached runtime artifact cannot be prepared.
+    pub fn prepare_runtime(&mut self) -> Result<(), Report<TrustedServerError>> {
         for handler in &self.handlers {
             handler.prepare_runtime()?;
         }
 
+        if let Some(co) = &mut self.creative_opportunities {
+            co.compile_slots();
+        }
+
         Ok(())
     }
 
+    /// Returns compiled creative opportunity slots, or empty slice if feature is disabled.
+    #[must_use]
+    pub fn creative_opportunity_slots(
+        &self,
+    ) -> &[crate::creative_opportunities::CreativeOpportunitySlot] {
+        self.creative_opportunities
+            .as_ref()
+            .map(|co| co.slot.as_slice())
+            .unwrap_or(&[])
+    }
+
     /// Rejects known placeholder secret values.
     ///
     /// # Errors
@@ -2645,6 +2678,35 @@ mod tests {
     ///
     /// If this test fails, a route was added or removed in the Fastly
     /// router without updating `ADMIN_ENDPOINTS` (or vice versa).
+    #[test]
+    fn settings_parses_creative_opportunities_section() {
+        let toml = r#"
+[[handlers]]
+path = "^/_ts/admin"
+username = "admin"
+password = "unit-test-admin-secret"
+
+[publisher]
+domain = "example.com"
+cookie_domain = ".example.com"
+origin_url = "https://origin.example.com"
+proxy_secret = "secret"
+
+[ec]
+passphrase = "test-secret-key-32-bytes-minimum"
+
+[creative_opportunities]
+gam_network_id = "21765378893"
+auction_timeout_ms = 500
+"#;
+        let settings = Settings::from_toml(toml).expect("should parse");
+        let co = settings
+            .creative_opportunities
+            .expect("should have creative_opportunities");
+        assert_eq!(co.gam_network_id, "21765378893");
+        assert_eq!(co.auction_timeout_ms, Some(500));
+    }
+
     #[test]
     fn admin_endpoints_match_fastly_router() {
         let router_source = include_str!("../../trusted-server-adapter-fastly/src/main.rs");
diff --git a/docs/guide/auction-orchestration.md b/docs/guide/auction-orchestration.md
index 3a55bc3d..d7595881 100644
--- a/docs/guide/auction-orchestration.md
+++ b/docs/guide/auction-orchestration.md
@@ -373,8 +373,8 @@ This is why mediation is important when using APS: without a mediator, APS bids
 ```toml
 [integrations.aps]
 enabled = true
-pub_id = "5128"
-endpoint = "https://aax.amazon-adsystem.com/e/dtb/bid"
+pub_id = "example-publisher"
+endpoint = "https://aps.example.com/e/dtb/bid"
 timeout_ms = 800
 ```
 
@@ -593,8 +593,8 @@ debug = false
 
 [integrations.aps]
 enabled = true
-pub_id = "5128"
-endpoint = "https://aax.amazon-adsystem.com/e/dtb/bid"
+pub_id = "example-publisher"
+endpoint = "https://aps.example.com/e/dtb/bid"
 timeout_ms = 800
 
 [integrations.adserver_mock]
@@ -629,12 +629,12 @@ price_floor = 0.50
 
 #### `[integrations.aps]`
 
-| Field        | Type   | Default                                     | Description                 |
-| ------------ | ------ | ------------------------------------------- | --------------------------- |
-| `enabled`    | bool   | `false`                                     | Enable APS provider         |
-| `pub_id`     | string | —                                           | APS publisher ID (required) |
-| `endpoint`   | string | `https://aax.amazon-adsystem.com/e/dtb/bid` | APS TAM endpoint            |
-| `timeout_ms` | u32    | `800`                                       | Request timeout             |
+| Field        | Type   | Default                             | Description                 |
+| ------------ | ------ | ----------------------------------- | --------------------------- |
+| `enabled`    | bool   | `false`                             | Enable APS provider         |
+| `pub_id`     | string | —                                   | APS publisher ID (required) |
+| `endpoint`   | string | `https://aps.example.com/e/dtb/bid` | APS TAM endpoint            |
+| `timeout_ms` | u32    | `800`                               | Request timeout             |
 
 #### `[integrations.adserver_mock]`
 
diff --git a/docs/guide/configuration.md b/docs/guide/configuration.md
index 9863de1c..aceec9fa 100644
--- a/docs/guide/configuration.md
+++ b/docs/guide/configuration.md
@@ -85,7 +85,7 @@ secret_store_id = "01GYYY"
 
 [integrations.prebid]
 enabled = true
-server_url = "https://prebid-server.com/openrtb2/auction"
+server_url = "https://prebid-server.example.com/openrtb2/auction"
 timeout_ms = 1200
 bidders = ["kargo", "appnexus", "openx"]
 client_side_bidders = ["rubicon"]
@@ -726,6 +726,8 @@ apply when the integration section exists in `trusted-server.toml`.
 | `bid_param_overrides`      | Table         | `{}`                                                                   | Static per-bidder param overrides; normalized into the canonical override-rule engine and shallow-merged into bidder params                           |
 | `bid_param_zone_overrides` | Table         | `{}`                                                                   | Per-bidder, per-zone param overrides; normalized into the canonical override-rule engine and shallow-merged into bidder params                        |
 | `bid_param_override_rules` | Array[Table]  | `[]`                                                                   | Canonical ordered override rules with `when` matchers and `set` objects; evaluated after compatibility fields so later rules win on conflicts         |
+| `suppress_nurl`            | Boolean       | `false`                                                                | Strip `nurl` and `burl` from every PBS bid when the PBS deployment fires win/billing notifications server-side                                        |
+| `suppress_nurl_bidders`    | Array[String] | `[]`                                                                   | Bidder seats whose `nurl` and `burl` should be stripped while preserving client-side win/billing pixels for other bidders                             |
 | `debug`                    | Boolean       | `false`                                                                | Enable debug mode (sets `ext.prebid.debug` and `returnallbidstatus`; surfaces debug metadata in responses)                                            |
 | `test_mode`                | Boolean       | `false`                                                                | Set OpenRTB `test: 1` flag for non-billable test traffic (independent of `debug`)                                                                     |
 | `debug_query_params`       | String        | `None`                                                                 | Extra query params appended for debugging                                                                                                             |
@@ -899,8 +901,8 @@ timeout_ms = 2000
 
 [integrations.aps]
 enabled = true
-pub_id = "5128"
-endpoint = "https://aax.amazon-adsystem.com/e/dtb/bid"
+pub_id = "example-publisher"
+endpoint = "https://aps.example.com/e/dtb/bid"
 
 [integrations.prebid]
 enabled = true
diff --git a/docs/guide/integrations/prebid.md b/docs/guide/integrations/prebid.md
index 42e0d6b7..1e887005 100644
--- a/docs/guide/integrations/prebid.md
+++ b/docs/guide/integrations/prebid.md
@@ -58,6 +58,8 @@ set = { placementId = "_s2sHeaderPlacement" }
 | `bid_param_overrides`      | Table         | `{}`                                                                   | Static per-bidder param overrides; normalized into the canonical override-rule engine and shallow-merged into bidder params                      |
 | `bid_param_zone_overrides` | Table         | `{}`                                                                   | Per-bidder, per-zone param overrides; normalized into the canonical override-rule engine and shallow-merged into bidder params                   |
 | `bid_param_override_rules` | Array[Table]  | `[]`                                                                   | Canonical ordered override rules with `when` matchers and `set` objects; evaluated after compatibility fields so later rules win on conflicts    |
+| `suppress_nurl`            | Boolean       | `false`                                                                | Strip `nurl` and `burl` from every PBS bid when the PBS deployment fires win/billing notifications server-side                                   |
+| `suppress_nurl_bidders`    | Array[String] | `[]`                                                                   | Bidder seats whose `nurl` and `burl` should be stripped while preserving client-side win/billing pixels for other bidders                        |
 | `debug`                    | Boolean       | `false`                                                                | Enable Prebid debug mode (sets `ext.prebid.debug` and `ext.prebid.returnallbidstatus`; surfaces debug metadata in auction responses)             |
 | `test_mode`                | Boolean       | `false`                                                                | Set the OpenRTB `test: 1` flag so bidders treat the auction as non-billable test traffic. Separate from `debug` to avoid suppressing real demand |
 | `debug_query_params`       | String        | `None`                                                                 | Extra query params appended for debugging                                                                                                        |
diff --git a/docs/superpowers/plans/2026-04-30-server-side-ad-templates.md b/docs/superpowers/plans/2026-04-30-server-side-ad-templates.md
new file mode 100644
index 00000000..0429bd9a
--- /dev/null
+++ b/docs/superpowers/plans/2026-04-30-server-side-ad-templates.md
@@ -0,0 +1,2004 @@
+# Server-Side Ad Templates Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Enable the Fastly edge to fire a full header-bidding auction (PBS + APS) in parallel with the origin fetch, inject `window.__ts_ad_slots` into `<head>`, then inject `window.__ts_bids` inline before `</body>` so the client drives GPT directly — without Prebid.js and without blocking FCP.
+
+**Architecture:** A new `creative-opportunities.toml` holds per-URL slot templates. At request time the publisher path matches the URL and fires the auction + origin fetch concurrently via `send_async()`. `window.__ts_ad_slots` is injected at `<head>` open with no auction wait. The `</body>` close tag is held — bounded by `A_deadline` — until the auction completes or times out; `window.__ts_bids` is then injected inline before the close tag so bids and HTML travel together in a single response. The client's `__tsAdInit` reads `window.__ts_bids` synchronously (no fetch, no Promise) and drives GPT. Both `nurl` and `burl` fire client-side from `slotRenderEnded` to avoid billing inflation. A slim-Prebid bundle lazy-loads post-`window.load` for refresh auctions and identity warm-up.
+
+**Tech Stack:** Rust 2024, `lol_html` 2.7.2 (existing), `glob` crate (new workspace dep), `serde`/`toml` (existing), `std::sync::{Arc, RwLock}` for within-request shared auction state, `AuctionOrchestrator::run_auction` (existing `async fn`), TypeScript for GPT shim extension.
+
+> **Phase 1 streaming note:** The spec describes true streaming where body content above `</body>` paints before the auction completes. Implementing this with lol_html's synchronous callback model requires a complex outer streaming loop (emit chunks as they arrive from origin; hold only the `</body>` chunk until auction resolves). Phase 1 uses a simpler approach: await the auction (or `A_deadline`) before processing origin HTML through lol_html, then send the fully assembled response. This still delivers the server-side auction benefit and achieves the same ad-visible latency target (~870ms cache hit). The FCP claim (~80ms) of the spec requires the streaming approach and is tracked as a Phase 2 optimization. The shared `Arc<RwLock<Option<String>>>` is the correct coordination primitive either way — the Phase 2 upgrade path only changes when the auction is awaited relative to lol_html processing.
+
+---
+
+## File Map
+
+### New files
+
+| File                                                       | Responsibility                                                                              |
+| ---------------------------------------------------------- | ------------------------------------------------------------------------------------------- |
+| `creative-opportunities.toml`                              | Slot template definitions (page patterns, formats, floor prices, per-provider params)       |
+| `crates/trusted-server-core/src/creative_opportunities.rs` | Config types, TOML parsing, URL glob matching, slot→`AdSlot` conversion, startup validation |
+| `crates/trusted-server-core/src/price_bucket.rs`           | Prebid price granularity tables; converts `f64` CPM to `hb_pb` string                       |
+
+### Modified files
+
+| File                                                    | Change summary                                                                                                                                                                                                       |
+| ------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `Cargo.toml`                                            | Add `glob = "0.3"` to `[workspace.dependencies]`                                                                                                                                                                     |
+| `crates/trusted-server-core/Cargo.toml`                 | Add `glob = { workspace = true }`                                                                                                                                                                                    |
+| `crates/trusted-server-core/Cargo.toml` (build-deps)    | Verify `regex` is listed under `[build-dependencies]` (needed for slot-ID validation in `build.rs`)                                                                                                                  |
+| `crates/trusted-server-core/src/auction/types.rs`       | Add `MediaType::banner()` constructor; add `ad_id: Option<String>` to `Bid`                                                                                                                                          |
+| `crates/trusted-server-core/src/settings.rs`            | Add `creative_opportunities: Option<CreativeOpportunitiesConfig>` to `Settings`                                                                                                                                      |
+| `trusted-server.toml`                                   | Add `[creative_opportunities]` section                                                                                                                                                                               |
+| `crates/trusted-server-core/build.rs`                   | Validate slot IDs at build time using inline TOML parse; `rerun-if-changed` for `creative-opportunities.toml`                                                                                                        |
+| `crates/trusted-server-core/src/html_processor.rs`      | Add `ad_slots_script: Option<String>` (head) and `ad_bids_script: Arc<RwLock<Option<String>>>` (body) to `HtmlProcessorConfig`; inject at `<head>` open and via `el.on_end_tag()` on body element                    |
+| `crates/trusted-server-core/src/publisher.rs`           | Convert to `async fn`; add eligibility gates (bot UA, prefetch, HEAD); EID decoration; shared `AuctionBidState`; inject `__ts_bids` before `</body>`; `Cache-Control: private, max-age=0`; strip `Surrogate-Control` |
+| `crates/trusted-server-adapter-fastly/src/main.rs`      | Await the now-async handler; pass orchestrator reference; no `/ts-bids` route                                                                                                                                        |
+| `crates/trusted-server-core/src/integrations/gpt.rs`    | Extend `head_inserts()` to emit `__tsAdInit` that reads `window.__ts_bids` synchronously; `ts_initial=1` sentinel; nurl+burl from `slotRenderEnded`                                                                  |
+| `crates/js/lib/src/integrations/gpt/index.ts`           | Synchronous `__tsAdInit` with `window.__ts_bids` read; nurl+burl `sendBeacon`; lazy slim-Prebid loader post-`window.load`                                                                                            |
+| `crates/trusted-server-core/src/integrations/prebid.rs` | Add `suppress_nurl: bool` config (default `false`) as per-bidder escape hatch; remove server-side nurl firing                                                                                                        |
+
+### Deleted (relative to prior revision of this spec)
+
+- `crates/trusted-server-core/src/bid_cache.rs` — never created; in-process cache rejected because Fastly Compute per-request Wasm isolates are not pinned across requests
+- `/ts-bids` endpoint — never created; body-injection replaces the fetch pattern
+
+---
+
+## Task 1: Add `glob` workspace dependency
+
+**Files:**
+
+- Modify: `Cargo.toml`
+- Modify: `crates/trusted-server-core/Cargo.toml`
+
+- [ ] **Step 1: Write a failing compile test**
+
+  In `crates/trusted-server-core/src/lib.rs`, temporarily add:
+
+  ```rust
+  // Compilation test — remove after Step 4
+  use glob::Pattern as _;
+  ```
+
+  Run: `cargo check --package trusted-server-core`
+  Expected: error `use of undeclared crate or module 'glob'`
+
+- [ ] **Step 2: Add glob to workspace `Cargo.toml`**
+
+  Under `[workspace.dependencies]`, add:
+
+  ```toml
+  glob = "0.3"
+  ```
+
+- [ ] **Step 3: Add glob to core crate**
+
+  In `crates/trusted-server-core/Cargo.toml` under `[dependencies]`, add:
+
+  ```toml
+  glob = { workspace = true }
+  ```
+
+- [ ] **Step 4: Remove temp import, verify compile**
+
+  Remove the temp `use glob::Pattern as _;` from `lib.rs`.
+  Run: `cargo check --package trusted-server-core`
+  Expected: clean compile
+
+- [ ] **Step 5: Commit**
+
+  ```bash
+  git add Cargo.toml crates/trusted-server-core/Cargo.toml
+  git commit -m "Add glob workspace dependency for URL pattern matching"
+  ```
+
+---
+
+## Task 2: `price_bucket.rs` — Prebid price granularity
+
+**Files:**
+
+- Create: `crates/trusted-server-core/src/price_bucket.rs`
+- Modify: `crates/trusted-server-core/src/lib.rs`
+
+The `hb_pb` value in bid responses is a discretized bucket string from Prebid's granularity tables. "Dense" is the default used in most Prebid deployments.
+
+- [ ] **Step 1: Write failing tests**
+
+  Create `crates/trusted-server-core/src/price_bucket.rs` with only the tests:
+
+  ```rust
+  #[cfg(test)]
+  mod tests {
+      use super::*;
+
+      #[test]
+      fn dense_below_3_increments_by_0_01() {
+          assert_eq!(price_bucket(0.0, PriceGranularity::Dense), "0.00");
+          assert_eq!(price_bucket(0.01, PriceGranularity::Dense), "0.01");
+          assert_eq!(price_bucket(0.015, PriceGranularity::Dense), "0.01");
+          assert_eq!(price_bucket(1.23, PriceGranularity::Dense), "1.23");
+          assert_eq!(price_bucket(2.99, PriceGranularity::Dense), "2.99");
+      }
+
+      #[test]
+      fn dense_3_to_8_increments_by_0_05() {
+          assert_eq!(price_bucket(3.00, PriceGranularity::Dense), "3.00");
+          assert_eq!(price_bucket(3.03, PriceGranularity::Dense), "3.00");
+          assert_eq!(price_bucket(3.05, PriceGranularity::Dense), "3.05");
+          assert_eq!(price_bucket(7.99, PriceGranularity::Dense), "7.95");
+      }
+
+      #[test]
+      fn dense_8_to_20_increments_by_0_50() {
+          assert_eq!(price_bucket(8.00, PriceGranularity::Dense), "8.00");
+          assert_eq!(price_bucket(8.49, PriceGranularity::Dense), "8.00");
+          assert_eq!(price_bucket(8.50, PriceGranularity::Dense), "8.50");
+          assert_eq!(price_bucket(19.99, PriceGranularity::Dense), "19.50");
+      }
+
+      #[test]
+      fn dense_above_20_caps_at_20() {
+          assert_eq!(price_bucket(20.00, PriceGranularity::Dense), "20.00");
+          assert_eq!(price_bucket(50.00, PriceGranularity::Dense), "20.00");
+      }
+
+      #[test]
+      fn low_increments_by_0_50_capped_at_5() {
+          assert_eq!(price_bucket(0.49, PriceGranularity::Low), "0.00");
+          assert_eq!(price_bucket(0.50, PriceGranularity::Low), "0.50");
+          assert_eq!(price_bucket(5.01, PriceGranularity::Low), "5.00");
+      }
+
+      #[test]
+      fn medium_increments_by_0_10_capped_at_20() {
+          assert_eq!(price_bucket(1.05, PriceGranularity::Medium), "1.00");
+          assert_eq!(price_bucket(1.10, PriceGranularity::Medium), "1.10");
+          assert_eq!(price_bucket(20.5, PriceGranularity::Medium), "20.00");
+      }
+
+      #[test]
+      fn high_increments_by_0_01_capped_at_20() {
+          assert_eq!(price_bucket(1.234, PriceGranularity::High), "1.23");
+          assert_eq!(price_bucket(20.5, PriceGranularity::High), "20.00");
+      }
+
+      #[test]
+      fn auto_routes_through_dense() {
+          assert_eq!(
+              price_bucket(2.53, PriceGranularity::Auto),
+              price_bucket(2.53, PriceGranularity::Dense)
+          );
+      }
+  }
+  ```
+
+  Run: `cargo test -p trusted-server-core price_bucket`
+  Expected: compile error (module not yet exported from lib.rs)
+
+- [ ] **Step 2: Implement price_bucket.rs**
+
+  ```rust
+  use serde::{Deserialize, Serialize};
+
+  #[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize, Default)]
+  #[serde(rename_all = "lowercase")]
+  pub enum PriceGranularity {
+      Low,
+      Medium,
+      #[default]
+      Dense,
+      High,
+      Auto,
+  }
+
+  impl PriceGranularity {
+      pub fn dense() -> Self {
+          Self::Dense
+      }
+  }
+
+  pub fn price_bucket(cpm: f64, granularity: PriceGranularity) -> String {
+      if cpm <= 0.0 {
+          return "0.00".to_string();
+      }
+      match granularity {
+          PriceGranularity::Low => {
+              let capped = cpm.min(5.0);
+              format!("{:.2}", (capped / 0.50).floor() * 0.50)
+          }
+          PriceGranularity::Medium => {
+              let capped = cpm.min(20.0);
+              format!("{:.2}", (capped / 0.10).floor() * 0.10)
+          }
+          PriceGranularity::High => {
+              let capped = cpm.min(20.0);
+              format!("{:.2}", (capped / 0.01).floor() * 0.01)
+          }
+          PriceGranularity::Dense | PriceGranularity::Auto => dense_bucket(cpm),
+      }
+  }
+
+  fn dense_bucket(cpm: f64) -> String {
+      if cpm >= 20.0 {
+          return "20.00".to_string();
+      }
+      if cpm >= 8.0 {
+          return format!("{:.2}", (cpm / 0.50).floor() * 0.50);
+      }
+      if cpm >= 3.0 {
+          return format!("{:.2}", (cpm / 0.05).floor() * 0.05);
+      }
+      format!("{:.2}", (cpm / 0.01).floor() * 0.01)
+  }
+  ```
+
+- [ ] **Step 3: Export from lib.rs**
+
+  ```rust
+  pub mod price_bucket;
+  ```
+
+- [ ] **Step 4: Run tests**
+
+  Run: `cargo test -p trusted-server-core price_bucket`
+  Expected: all tests pass
+
+- [ ] **Step 5: Commit**
+
+  ```bash
+  git add crates/trusted-server-core/src/price_bucket.rs \
+          crates/trusted-server-core/src/lib.rs
+  git commit -m "Add Prebid price granularity bucketing (dense default, auto = dense)"
+  ```
+
+---
+
+## Task 3: Extend `auction::types` — `MediaType::banner()` and `Bid::ad_id`
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/auction/types.rs`
+- Modify: `crates/trusted-server-core/src/integrations/prebid.rs`
+
+`CreativeOpportunityFormat` uses `#[serde(default = "MediaType::banner")]` which requires a free function. Add `ad_id: Option<String>` to `Bid` for `hb_adid` targeting. The `suppress_nurl` config escape hatch is also added here to `PrebidConfig`.
+
+- [ ] **Step 1: Write failing tests**
+
+  In `auction/types.rs` test module:
+
+  ```rust
+  #[test]
+  fn media_type_banner_fn_returns_banner() {
+      assert_eq!(MediaType::banner(), MediaType::Banner);
+  }
+
+  #[test]
+  fn bid_has_ad_id_field() {
+      let bid = Bid {
+          slot_id: "s".to_string(),
+          price: Some(1.0),
+          currency: "USD".to_string(),
+          creative: None,
+          adomain: None,
+          bidder: "kargo".to_string(),
+          width: 300,
+          height: 250,
+          nurl: None,
+          burl: None,
+          ad_id: Some("prebid-ad-id-abc".to_string()),
+          metadata: Default::default(),
+      };
+      assert_eq!(bid.ad_id.as_deref(), Some("prebid-ad-id-abc"));
+  }
+  ```
+
+  Run: `cargo test -p trusted-server-core auction::types::tests`
+  Expected: compile error (`MediaType::banner` not found, `ad_id` field missing)
+
+- [ ] **Step 2: Add `MediaType::banner()` and `Bid::ad_id`**
+
+  In `auction/types.rs`, add to `MediaType`:
+
+  ```rust
+  impl MediaType {
+      pub fn banner() -> Self {
+          Self::Banner
+      }
+  }
+  ```
+
+  Add `ad_id: Option<String>` field to `Bid`. Update the `make_bid` test helper to include `ad_id: None`.
+
+- [ ] **Step 3: Run tests**
+
+  Run: `cargo test -p trusted-server-core auction`
+  Expected: all tests pass
+
+- [ ] **Step 4: Populate `ad_id` in prebid.rs**
+
+  In `crates/trusted-server-core/src/integrations/prebid.rs`, in the `Bid` construction, find where `nurl` and `burl` are set and add:
+
+  ```rust
+  ad_id: bid_obj.get("adid")
+      .or_else(|| bid_obj.get("id"))
+      .and_then(|v| v.as_str())
+      .map(String::from),
+  ```
+
+  (Prebid Server uses lowercase `adid`. Fall back to `id` if absent.)
+
+- [ ] **Step 5: Add `suppress_nurl` to `PrebidConfig`**
+
+  In `prebid.rs`, add to the `PrebidConfig` struct:
+
+  ```rust
+  #[serde(default)]
+  pub suppress_nurl: bool,
+  ```
+
+  Write a test:
+
+  ```rust
+  #[test]
+  fn prebid_config_suppress_nurl_defaults_to_false() {
+      let config = PrebidConfig::default();
+      assert!(!config.suppress_nurl, "should not suppress nurl by default");
+  }
+  ```
+
+  Run: `cargo test -p trusted-server-core integrations::prebid`
+  Expected: passes
+
+- [ ] **Step 6: Commit**
+
+  ```bash
+  git add crates/trusted-server-core/src/auction/types.rs \
+          crates/trusted-server-core/src/integrations/prebid.rs
+  git commit -m "Add MediaType::banner(), Bid::ad_id, and suppress_nurl config to PrebidConfig"
+  ```
+
+---
+
+## Task 4: `creative_opportunities.rs` — Config types and URL matching
+
+**Files:**
+
+- Create: `crates/trusted-server-core/src/creative_opportunities.rs`
+- Modify: `crates/trusted-server-core/src/lib.rs`
+
+- [ ] **Step 1: Write failing tests**
+
+  Create `crates/trusted-server-core/src/creative_opportunities.rs` with only tests:
+
+  ```rust
+  #[cfg(test)]
+  mod tests {
+      use super::*;
+
+      fn make_slot(id: &str, patterns: Vec<&str>) -> CreativeOpportunitySlot {
+          CreativeOpportunitySlot {
+              id: id.to_string(),
+              gam_unit_path: None,
+              div_id: None,
+              page_patterns: patterns.into_iter().map(String::from).collect(),
+              formats: vec![CreativeOpportunityFormat {
+                  width: 300,
+                  height: 250,
+                  media_type: crate::auction::types::MediaType::Banner,
+              }],
+              floor_price: Some(0.50),
+              targeting: Default::default(),
+              providers: Default::default(),
+          }
+      }
+
+      #[test]
+      fn glob_matches_article_path() {
+          let slot = make_slot("atf", vec!["/20**"]);
+          assert!(slot.matches_path("/2024/01/my-article/"), "should match article path");
+          assert!(!slot.matches_path("/"), "should not match root");
+      }
+
+      #[test]
+      fn exact_match_homepage() {
+          let slot = make_slot("home", vec!["/"]);
+          assert!(slot.matches_path("/"), "should match root");
+          assert!(!slot.matches_path("/about"), "should not match /about");
+      }
+
+      #[test]
+      fn slot_id_validates_alphanumeric() {
+          assert!(validate_slot_id("atf_sidebar_ad").is_ok());
+          assert!(validate_slot_id("below-content-0").is_ok());
+          assert!(validate_slot_id("").is_err(), "empty id should fail");
+          assert!(validate_slot_id("xss<script>").is_err(), "html in id should fail");
+          assert!(validate_slot_id("has space").is_err(), "spaces should fail");
+      }
+
+      #[test]
+      fn resolved_gam_unit_path_uses_default_when_absent() {
+          let slot = make_slot("atf", vec!["/"]);
+          assert_eq!(slot.resolved_gam_unit_path("21765378893"), "/21765378893/atf");
+      }
+
+      #[test]
+      fn resolved_gam_unit_path_uses_override_when_set() {
+          let mut slot = make_slot("atf", vec!["/"]);
+          slot.gam_unit_path = Some("/21765378893/publisher/atf-sidebar".to_string());
+          assert_eq!(
+              slot.resolved_gam_unit_path("21765378893"),
+              "/21765378893/publisher/atf-sidebar"
+          );
+      }
+
+      #[test]
+      fn resolved_div_id_defaults_to_slot_id() {
+          let slot = make_slot("atf", vec!["/"]);
+          assert_eq!(slot.resolved_div_id(), "atf");
+      }
+
+      #[test]
+      fn to_ad_slot_wires_aps_params_into_bidders() {
+          let mut slot = make_slot("atf", vec!["/"]);
+          slot.providers.aps = Some(ApsSlotParams { slot_id: "aps-slot-atf".to_string() });
+          let ad_slot = slot.to_ad_slot("21765378893");
+          let aps_params = ad_slot.bidders.get("aps").expect("should have aps bidder");
+          assert_eq!(
+              aps_params.get("slotID").and_then(|v| v.as_str()),
+              Some("aps-slot-atf"),
+          );
+      }
+
+      #[test]
+      fn to_ad_slot_sets_floor_price_and_formats() {
+          let slot = make_slot("atf", vec!["/"]);
+          let ad_slot = slot.to_ad_slot("21765378893");
+          assert_eq!(ad_slot.id, "atf");
+          assert_eq!(ad_slot.floor_price, Some(0.50));
+          assert_eq!(ad_slot.formats.len(), 1);
+      }
+  }
+  ```
+
+  Run: `cargo test -p trusted-server-core creative_opportunities`
+  Expected: compile error (module not yet exported)
+
+- [ ] **Step 2: Implement creative_opportunities.rs**
+
+  ```rust
+  use std::collections::HashMap;
+
+  use glob::Pattern;
+  use serde::{Deserialize, Serialize};
+
+  use crate::auction::types::{AdFormat, AdSlot, MediaType};
+  use crate::price_bucket::PriceGranularity;
+
+  #[derive(Debug, Clone, Deserialize, Serialize)]
+  pub struct CreativeOpportunitiesConfig {
+      pub gam_network_id: String,
+      #[serde(default)]
+      pub auction_timeout_ms: Option<u32>,
+      #[serde(default = "PriceGranularity::dense")]
+      pub price_granularity: PriceGranularity,
+  }
+
+  #[derive(Debug, Clone, Deserialize)]
+  pub struct CreativeOpportunitySlot {
+      pub id: String,
+      pub gam_unit_path: Option<String>,
+      pub div_id: Option<String>,
+      pub page_patterns: Vec<String>,
+      pub formats: Vec<CreativeOpportunityFormat>,
+      pub floor_price: Option<f64>,
+      #[serde(default)]
+      pub targeting: HashMap<String, String>,
+      #[serde(default)]
+      pub providers: SlotProviders,
+  }
+
+  impl CreativeOpportunitySlot {
+      pub fn matches_path(&self, path: &str) -> bool {
+          self.page_patterns.iter().any(|pattern| {
+              Pattern::new(pattern)
+                  .map(|p| p.matches(path))
+                  .unwrap_or(false)
+          })
+      }
+
+      pub fn resolved_gam_unit_path(&self, gam_network_id: &str) -> String {
+          self.gam_unit_path
+              .clone()
+              .unwrap_or_else(|| format!("/{}/{}", gam_network_id, self.id))
+      }
+
+      pub fn resolved_div_id(&self) -> &str {
+          self.div_id.as_deref().unwrap_or(&self.id)
+      }
+
+      pub fn to_ad_slot(&self, gam_network_id: &str) -> AdSlot {
+          let mut bidders: HashMap<String, serde_json::Value> = HashMap::new();
+          if let Some(ref aps) = self.providers.aps {
+              bidders.insert("aps".to_string(), serde_json::json!({ "slotID": aps.slot_id }));
+          }
+          AdSlot {
+              id: self.id.clone(),
+              formats: self.formats.iter().map(CreativeOpportunityFormat::to_ad_format).collect(),
+              floor_price: self.floor_price,
+              targeting: self.targeting.iter()
+                  .map(|(k, v)| (k.clone(), serde_json::Value::String(v.clone())))
+                  .collect(),
+              bidders,
+          }
+      }
+  }
+
+  #[derive(Debug, Clone, Deserialize)]
+  pub struct CreativeOpportunityFormat {
+      pub width: u32,
+      pub height: u32,
+      #[serde(default = "MediaType::banner")]
+      pub media_type: MediaType,
+  }
+
+  impl CreativeOpportunityFormat {
+      fn to_ad_format(&self) -> AdFormat {
+          AdFormat { media_type: self.media_type.clone(), width: self.width, height: self.height }
+      }
+  }
+
+  #[derive(Debug, Clone, Default, Deserialize)]
+  pub struct SlotProviders {
+      pub aps: Option<ApsSlotParams>,
+  }
+
+  #[derive(Debug, Clone, Deserialize)]
+  pub struct ApsSlotParams {
+      pub slot_id: String,
+  }
+
+  #[derive(Debug, Clone, Deserialize, Default)]
+  pub struct CreativeOpportunitiesFile {
+      #[serde(rename = "slot", default)]
+      pub slots: Vec<CreativeOpportunitySlot>,
+  }
+
+  pub fn validate_slot_id(id: &str) -> Result<(), String> {
+      if id.is_empty() {
+          return Err("slot id must not be empty".to_string());
+      }
+      if id.chars().all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-') {
+          Ok(())
+      } else {
+          Err(format!("slot id '{id}' contains invalid characters; only [A-Za-z0-9_-] allowed"))
+      }
+  }
+
+  pub fn match_slots<'a>(
+      slots: &'a [CreativeOpportunitySlot],
+      path: &str,
+  ) -> Vec<&'a CreativeOpportunitySlot> {
+      slots.iter().filter(|s| s.matches_path(path)).collect()
+  }
+  ```
+
+- [ ] **Step 3: Export from lib.rs**
+
+  ```rust
+  pub mod creative_opportunities;
+  ```
+
+- [ ] **Step 4: Run tests**
+
+  Run: `cargo test -p trusted-server-core creative_opportunities`
+  Expected: all tests pass
+
+- [ ] **Step 5: Commit**
+
+  ```bash
+  git add crates/trusted-server-core/src/creative_opportunities.rs \
+          crates/trusted-server-core/src/lib.rs
+  git commit -m "Add creative_opportunities config types, URL glob matching, APS params wiring"
+  ```
+
+---
+
+## Task 5: Settings integration and `creative-opportunities.toml`
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/settings.rs`
+- Create: `creative-opportunities.toml`
+- Modify: `trusted-server.toml`
+
+- [ ] **Step 1: Write failing test**
+
+  In `settings.rs` test module:
+
+  ```rust
+  #[test]
+  fn settings_parses_creative_opportunities_section() {
+      let toml = r#"
+  [publisher]
+  domain = "example.com"
+  cookie_domain = ".example.com"
+  origin_url = "https://origin.example.com"
+  proxy_secret = "secret"
+
+  [creative_opportunities]
+  gam_network_id = "21765378893"
+  auction_timeout_ms = 500
+  "#;
+      let settings = Settings::from_toml(toml).expect("should parse");
+      let co = settings.creative_opportunities.expect("should have creative_opportunities");
+      assert_eq!(co.gam_network_id, "21765378893");
+      assert_eq!(co.auction_timeout_ms, Some(500));
+  }
+  ```
+
+  Run: `cargo test -p trusted-server-core settings_parses_creative_opportunities`
+  Expected: compile error (`Settings` has no field `creative_opportunities`)
+
+- [ ] **Step 2: Add to `Settings`**
+
+  In `settings.rs`, add import:
+
+  ```rust
+  use crate::creative_opportunities::CreativeOpportunitiesConfig;
+  ```
+
+  In the `Settings` struct:
+
+  ```rust
+  #[serde(default)]
+  pub creative_opportunities: Option<CreativeOpportunitiesConfig>,
+  ```
+
+- [ ] **Step 3: Run test**
+
+  Run: `cargo test -p trusted-server-core settings_parses_creative_opportunities`
+  Expected: passes
+
+- [ ] **Step 4: Create `creative-opportunities.toml`**
+
+  At repo root alongside `trusted-server.toml`:
+
+  ```toml
+  # Slot templates for server-side ad auction.
+  # Empty file = feature disabled (no auction fired, no globals injected).
+
+  [[slot]]
+  id = "atf_sidebar_ad"
+  gam_unit_path = "/21765378893/publisher/atf-sidebar"
+  div_id = "div-atf-sidebar"
+  page_patterns = ["/20**"]
+  formats = [{ width = 300, height = 250 }]
+  floor_price = 0.50
+
+  [slot.targeting]
+  pos = "atf"
+  zone = "atfSidebar"
+
+  [slot.providers.aps]
+  slot_id = "aps-slot-atf-sidebar"
+  ```
+
+- [ ] **Step 5: Add `[creative_opportunities]` to `trusted-server.toml`**
+
+  ```toml
+  [creative_opportunities]
+  gam_network_id = "21765378893"
+  auction_timeout_ms = 500
+  price_granularity = "dense"
+  ```
+
+- [ ] **Step 6: Run full workspace tests**
+
+  Run: `cargo test --workspace`
+  Expected: all pass
+
+- [ ] **Step 7: Commit**
+
+  ```bash
+  git add crates/trusted-server-core/src/settings.rs \
+          creative-opportunities.toml \
+          trusted-server.toml
+  git commit -m "Wire CreativeOpportunitiesConfig into Settings; add creative-opportunities.toml"
+  ```
+
+---
+
+## Task 6: Build-time slot-ID validation
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/build.rs`
+- Modify (or create): `crates/trusted-server-adapter-fastly/build.rs`
+
+- [ ] **Step 1: Add slot-ID validation to `build.rs`**
+
+  In `crates/trusted-server-core/build.rs`, add after the existing settings validation.
+
+  > **Note:** `build.rs` runs in a separate compilation context and cannot import `creative_opportunities::validate_slot_id`. Reimplement the same `[A-Za-z0-9_-]+` check inline using the `regex` crate (build-dependency only — not in the wasm binary). This is an intentional duplication boundary.
+
+  ```rust
+  const CREATIVE_OPPORTUNITIES_PATH: &str = "../../creative-opportunities.toml";
+
+  println!("cargo:rerun-if-changed={}", CREATIVE_OPPORTUNITIES_PATH);
+
+  let co_path = std::path::Path::new(CREATIVE_OPPORTUNITIES_PATH);
+  if co_path.exists() {
+      let co_content = std::fs::read_to_string(co_path)
+          .expect("should read creative-opportunities.toml");
+      let co_value: toml::Value = toml::from_str(&co_content)
+          .expect("creative-opportunities.toml: invalid TOML");
+      let slot_id_re = regex::Regex::new(r"^[A-Za-z0-9_\-]+$").expect("should compile");
+      if let Some(slots) = co_value.get("slot").and_then(|v| v.as_array()) {
+          for slot in slots {
+              let id = slot.get("id")
+                  .and_then(|v| v.as_str())
+                  .expect("creative-opportunities.toml: slot missing 'id' field");
+              if !slot_id_re.is_match(id) {
+                  panic!(
+                      "creative-opportunities.toml: slot id '{}' is invalid; \
+                       only [A-Za-z0-9_-] allowed",
+                      id
+                  );
+              }
+          }
+          println!(
+              "cargo:warning=creative-opportunities.toml: {} slot(s) validated",
+              slots.len()
+          );
+      }
+  }
+  ```
+
+- [ ] **Step 2: Verify `regex` is in build-dependencies**
+
+  In `crates/trusted-server-core/Cargo.toml`, under `[build-dependencies]`, ensure `regex` is listed:
+
+  ```toml
+  [build-dependencies]
+  regex = "1"
+  # ... other build deps
+  ```
+
+  Add if absent. This is a build-only dependency — does not enter the WASM binary.
+
+- [ ] **Step 3: Run build to verify**
+
+  Run: `cargo build --package trusted-server-core`
+  Expected: builds, warning `creative-opportunities.toml: 1 slot(s) validated`
+
+- [ ] **Step 4: Test the guard**
+
+  Temporarily add to `creative-opportunities.toml`:
+
+  ```toml
+  [[slot]]
+  id = "bad slot!"
+  page_patterns = ["/"]
+  formats = []
+  ```
+
+  Run: `cargo build --package trusted-server-core`
+  Expected: panics with invalid slot ID message. Revert the change.
+
+- [ ] **Step 5: Add `rerun-if-changed` for adapter crate**
+
+  Check whether `crates/trusted-server-adapter-fastly/build.rs` exists. If it does, add:
+
+  ```rust
+  println!("cargo:rerun-if-changed=../../../creative-opportunities.toml");
+  ```
+
+  If no `build.rs` exists in the adapter crate, create one:
+
+  ```rust
+  fn main() {
+      println!("cargo:rerun-if-changed=../../../creative-opportunities.toml");
+  }
+  ```
+
+  Run: `cargo build --package trusted-server-adapter-fastly`
+  Expected: clean build.
+
+- [ ] **Step 6: Commit**
+
+  ```bash
+  git add crates/trusted-server-core/build.rs \
+          crates/trusted-server-adapter-fastly/build.rs
+  git commit -m "Validate creative-opportunities.toml slot IDs at build time using inline TOML parse"
+  ```
+
+---
+
+## Task 7: HTML processor — head injection and body-end injection
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/html_processor.rs`
+- Modify: `crates/trusted-server-core/src/integrations/registry.rs`
+
+TS injects two `<script>` blocks:
+
+1. `window.__ts_ad_slots` — at `<head>` open, no wait, via existing `el.prepend()`.
+2. `window.__ts_bids` — before `</body>`, via `el.on_end_tag()` on the body element. The handler reads from a shared `Arc<RwLock<Option<String>>>` written by the auction task (Task 9). By the time `</body>` is reached in the HTML stream, Task 9 has already awaited the auction (or its deadline), so the shared state is always populated.
+
+> **Critical design constraint:** `</head>` must never be held. Only `</body>` is held (by the outer streaming mechanism in Task 9). `HtmlProcessorConfig` receives the ready-to-inject script strings; it does not decide when to wait.
+
+- [ ] **Step 1: Write failing tests**
+
+  In `html_processor.rs` tests:
+
+  ```rust
+  #[test]
+  fn injects_ad_slots_at_head_open() {
+      let config = HtmlProcessorConfig {
+          origin_host: "origin.example.com".to_string(),
+          request_host: "example.com".to_string(),
+          request_scheme: "https".to_string(),
+          integrations: IntegrationRegistry::empty_for_tests(),
+          ad_slots_script: Some(
+              r#"<script>window.__ts_ad_slots=JSON.parse("[]");</script>"#.to_string()
+          ),
+          ad_bids_state: std::sync::Arc::new(std::sync::RwLock::new(None)),
+      };
+      let mut processor = create_html_processor(config);
+      let output = processor
+          .process_chunk(b"<html><head><title>T</title></head><body>content</body></html>", true)
+          .expect("should process");
+      let html = std::str::from_utf8(&output).expect("should be utf8");
+      assert!(html.contains("window.__ts_ad_slots"), "should inject ad slots at head-open");
+      assert!(!html.contains("__ts_request_id"), "must NOT inject request_id — body-injection arch has no request_id");
+  }
+
+  #[test]
+  fn injects_ts_bids_before_body_close() {
+      let bids_script = r#"<script>window.__ts_bids=JSON.parse("{\"atf\":{\"hb_pb\":\"1.00\"}}");</script>"#;
+      let state = std::sync::Arc::new(std::sync::RwLock::new(
+          Some(bids_script.to_string())
+      ));
+      let config = HtmlProcessorConfig {
+          origin_host: "origin.example.com".to_string(),
+          request_host: "example.com".to_string(),
+          request_scheme: "https".to_string(),
+          integrations: IntegrationRegistry::empty_for_tests(),
+          ad_slots_script: None,
+          ad_bids_state: state,
+      };
+      let mut processor = create_html_processor(config);
+      let output = processor
+          .process_chunk(b"<html><head></head><body>content</body></html>", true)
+          .expect("should process");
+      let html = std::str::from_utf8(&output).expect("should be utf8");
+      assert!(html.contains("window.__ts_bids"), "should inject bids before </body>");
+      let bids_pos = html.find("window.__ts_bids").expect("bids should be in output");
+      let body_close_pos = html.find("</body>").expect("</body> should be in output");
+      assert!(bids_pos < body_close_pos, "bids must appear before </body>");
+  }
+
+  #[test]
+  fn injects_empty_ts_bids_when_state_is_none() {
+      let state = std::sync::Arc::new(std::sync::RwLock::new(None));
+      let config = HtmlProcessorConfig {
+          origin_host: "origin.example.com".to_string(),
+          request_host: "example.com".to_string(),
+          request_scheme: "https".to_string(),
+          integrations: IntegrationRegistry::empty_for_tests(),
+          ad_slots_script: None,
+          ad_bids_state: state,
+      };
+      let mut processor = create_html_processor(config);
+      let output = processor
+          .process_chunk(b"<html><head></head><body>content</body></html>", true)
+          .expect("should process");
+      let html = std::str::from_utf8(&output).expect("should be utf8");
+      assert!(html.contains("__ts_bids=JSON.parse(\"{}\""), "should inject empty bids on None state");
+  }
+  ```
+
+  Run: `cargo test -p trusted-server-core html_processor`
+  Expected: compile error (no `ad_bids_state` field yet)
+
+- [ ] **Step 2: Add `empty_for_tests()` to `IntegrationRegistry`**
+
+  In `registry.rs`, add:
+
+  ```rust
+  #[cfg(test)]
+  impl IntegrationRegistry {
+      pub fn empty_for_tests() -> Self {
+          Self {
+              inner: Arc::new(RegistryInner {
+                  proxies: Default::default(),
+                  attribute_rewriters: Default::default(),
+                  script_rewriters: Vec::new(),
+                  html_post_processors: Vec::new(),
+                  head_injectors: Vec::new(),
+                  metadata: Default::default(),
+              })
+          }
+      }
+  }
+  ```
+
+  (Adjust field names to match the actual `RegistryInner` struct.)
+
+- [ ] **Step 3: Update `HtmlProcessorConfig`**
+
+  ```rust
+  pub struct HtmlProcessorConfig {
+      pub origin_host: String,
+      pub request_host: String,
+      pub request_scheme: String,
+      pub integrations: IntegrationRegistry,
+      /// Pre-computed `<script>window.__ts_ad_slots=...;</script>`.
+      /// Injected at `<head>` open. `None` when no slots matched.
+      pub ad_slots_script: Option<String>,
+      /// Shared auction result script — written by the auction task before HTML processing
+      /// begins. Handler reads this in `el.on_end_tag()` on the body element.
+      /// `None` means no auction ran (consent denied, bot UA, no slot match, etc.);
+      /// inject empty `__ts_bids = {}` as graceful fallback.
+      pub ad_bids_state: std::sync::Arc<std::sync::RwLock<Option<String>>>,
+  }
+  ```
+
+  Update `from_settings` (or wherever `HtmlProcessorConfig` is constructed) to initialize `ad_bids_state: Arc::new(RwLock::new(None))`.
+
+- [ ] **Step 4: Inject `ad_slots_script` at head-open**
+
+  In `create_html_processor`, within the existing `element!("head", ...)` handler:
+
+  ```rust
+  let ad_slots_script = config.ad_slots_script.clone();
+  // existing captures...
+
+  element!("head", |el| {
+      let mut snippet = String::new();
+      if let Some(ref slots_script) = ad_slots_script {
+          snippet.push_str(slots_script);
+      }
+      // existing integration head inserts...
+      if !snippet.is_empty() {
+          el.prepend(&snippet, ContentType::Html);
+      }
+      // DO NOT register on_end_tag — </head> flushes immediately
+      Ok(())
+  })
+  ```
+
+- [ ] **Step 5: Inject `__ts_bids` before `</body>` via `el.on_end_tag()`**
+
+  Add a new handler in `create_html_processor`. The shared state is already populated by the time lol_html reaches `</body>` (Task 9 awaits the auction before starting HTML processing):
+
+  ```rust
+  let ad_bids_state = config.ad_bids_state.clone();
+
+  element!("body", |el| {
+      let state = ad_bids_state.clone();
+      el.on_end_tag(move |end_tag| {
+          let script = state.read().expect("should read bid state");
+          let bids_script = match &*script {
+              Some(s) => s.clone(),
+              None => {
+                  r#"<script>window.__ts_bids=JSON.parse("{}");</script>"#.to_string()
+              }
+          };
+          end_tag.before(&bids_script, ContentType::Html);
+          Ok(())
+      })?;
+      Ok(())
+  })
+  ```
+
+- [ ] **Step 6: Run tests**
+
+  Run: `cargo test -p trusted-server-core html_processor`
+  Expected: all tests pass
+
+- [ ] **Step 7: Run full suite**
+
+  Run: `cargo test --workspace`
+  Expected: clean
+
+- [ ] **Step 8: Commit**
+
+  ```bash
+  git add crates/trusted-server-core/src/html_processor.rs \
+          crates/trusted-server-core/src/integrations/registry.rs
+  git commit -m "Inject __ts_ad_slots at head-open and __ts_bids before </body> via shared auction state"
+  ```
+
+---
+
+## Task 8: `handle_publisher_request` async restructuring
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/publisher.rs`
+- Modify: `crates/trusted-server-adapter-fastly/src/main.rs`
+
+> **Key constraint from spec §4.3 and §3:** No `bid_cache`. No `/ts-bids`. No `request_id`. Bids travel inline with the HTML response via body injection. The `Arc<RwLock<Option<String>>>` is the coordination mechanism within a single request's lifetime — it is written before HTML processing and read by the lol_html `</body>` handler.
+
+> **Eligibility gating (spec §4.3):** Auctions fire only for real GET requests from non-bot, non-prefetch clients with TCF Purpose 1 consent and at least one matching slot. All other requests proceed with no auction and no `__ts_bids` injection.
+
+> **Cache-Control (spec §4.7):** Set `Cache-Control: private, max-age=0` (not `no-store`) to preserve BFCache eligibility. Strip `Surrogate-Control` and `Fastly-Surrogate-Control`.
+
+- [ ] **Step 1: Update function signature**
+
+  Change `handle_publisher_request` in `publisher.rs`:
+
+  > **Existing context:** The existing `publisher.rs` function body already computes `consent_context`, `ec_id`, `request_info`, `origin_host`, and `backend_name` before the origin fetch. Steps below insert new logic between those existing computations and the origin fetch — they do not replace them.
+
+  ```rust
+  pub async fn handle_publisher_request(
+      settings: &Settings,
+      integration_registry: &IntegrationRegistry,
+      services: &RuntimeServices,
+      orchestrator: &crate::auction::orchestrator::AuctionOrchestrator,
+      slots_file: &crate::creative_opportunities::CreativeOpportunitiesFile,
+      mut req: Request,
+  ) -> Result<PublisherResponse, Report<TrustedServerError>>
+  ```
+
+  Add imports at top of file:
+
+  ```rust
+  use std::sync::{Arc, RwLock};
+  use fastly::http::header;
+  use crate::auction::orchestrator::AuctionOrchestrator;
+  use crate::auction::types::{AuctionContext, AuctionRequest, PublisherInfo, UserInfo, SiteInfo};
+  use crate::creative_opportunities::{CreativeOpportunitiesFile, match_slots};
+  use crate::price_bucket::price_bucket;
+  ```
+
+  > **`send_async` return type:** `req.send_async()` returns `fastly::handle::PendingRequestHandle` (re-exported as `fastly::PendingRequest` in recent versions). Confirm the exact type from the `fastly` crate version in `Cargo.toml`; `.wait()` is the blocking resolve method on whichever type is returned.
+
+- [ ] **Step 2: Apply auction-eligibility gates**
+
+  At the top of the function body, before origin fetch:
+
+  ```rust
+  let request_path = req.get_path().to_string();
+  let request_method = req.get_method().clone();
+
+  // Gate 1: Only GET triggers auctions. HEAD skips everything.
+  let is_get = request_method == fastly::http::Method::GET;
+
+  // Gate 2: Skip prefetch hints (Sec-Purpose: prefetch or Purpose: prefetch).
+  let is_prefetch = req.get_header_str("sec-purpose")
+      .map_or(false, |v| v.contains("prefetch"))
+      || req.get_header_str("purpose")
+      .map_or(false, |v| v.contains("prefetch"));
+
+  // Gate 3: Skip well-known crawler UAs (protects SSP QPS budget).
+  let user_agent = req.get_header_str("user-agent").unwrap_or("");
+  let is_bot = ["Googlebot", "Bingbot", "AhrefsBot", "SemrushBot", "DotBot"]
+      .iter()
+      .any(|bot| user_agent.contains(bot));
+
+  // Gate 4: Slot match.
+  let matched_slots: Vec<_> = if settings.creative_opportunities.is_some() && is_get {
+      match_slots(&slots_file.slots, &request_path)
+          .into_iter()
+          .cloned()
+          .collect()
+  } else {
+      Vec::new()
+  };
+
+  // Gate 5: TCF Purpose 1 consent.
+  let consent_allows_auction = consent_context
+      .tcf
+      .as_ref()
+      .map_or(false, |tcf| tcf.has_purpose_consent(1));
+
+  let should_run_auction = is_get
+      && !is_prefetch
+      && !is_bot
+      && !matched_slots.is_empty()
+      && consent_allows_auction;
+
+  let auction_timeout_ms = settings
+      .creative_opportunities
+      .as_ref()
+      .and_then(|co| co.auction_timeout_ms)
+      .unwrap_or(settings.auction.timeout_ms);
+  ```
+
+- [ ] **Step 3: Create shared bid state, fire origin + auction concurrently**
+
+  ```rust
+  // Shared state: auction task writes the ready-to-inject script; lol_html </body>
+  // handler reads it. Both within the same request — no cross-request sharing.
+  let ad_bids_state: Arc<RwLock<Option<String>>> = Arc::new(RwLock::new(None));
+
+  restrict_accept_encoding(&mut req);
+  req.set_header("host", &origin_host);
+
+  // Fire origin immediately — both origin and auction SSP calls overlap on the network.
+  let pending_origin = req
+      .send_async(&backend_name)
+      .change_context(TrustedServerError::Proxy {
+          message: "Failed to dispatch async origin request".to_string(),
+      })?;
+
+  // Run auction. Internal SSP calls use send_async and overlap with origin fetch.
+  let auction_result = if should_run_auction {
+      let co_config = settings.creative_opportunities.as_ref()
+          .expect("should be present when should_run_auction is true");
+      let auction_request = build_auction_request(
+          &matched_slots,
+          &ec_id,
+          &consent_context,
+          &request_info,
+          co_config,
+      );
+      let placeholder_req = fastly::Request::new();
+      let auction_context = AuctionContext {
+          settings,
+          request: &placeholder_req,
+          client_info: &services.client_info,
+          timeout_ms: auction_timeout_ms,
+          provider_responses: None,
+      };
+      match orchestrator.run_auction(&auction_request, &auction_context, services).await {
+          Ok(result) => Some(result),
+          Err(e) => {
+              log::warn!("server-side auction failed, proceeding without bids: {e:?}");
+              None
+          }
+      }
+  } else {
+      None
+  };
+
+  // Write auction result to shared state before HTML processing begins.
+  // The lol_html </body> handler reads this synchronously — it is always populated here.
+  // `build_bid_map` returns `serde_json::Map<String, serde_json::Value>`.
+  if should_run_auction {
+      let co_config = settings.creative_opportunities.as_ref()
+          .expect("should be present");
+      let empty_bids: std::collections::HashMap<String, crate::auction::types::Bid> =
+          std::collections::HashMap::new();
+      let winning_bids = auction_result.as_ref()
+          .map(|r| &r.winning_bids)
+          .unwrap_or(&empty_bids);
+      let bid_map = build_bid_map(winning_bids, co_config.price_granularity);
+      let bids_script = build_bids_script(&bid_map);
+      *ad_bids_state.write().expect("should write bid state") = Some(bids_script);
+  }
+
+  // Await origin response (may already be buffered since we started it before the auction).
+  let mut response = pending_origin
+      .wait()
+      .change_context(TrustedServerError::Proxy {
+          message: "Failed to await origin response".to_string(),
+      })?;
+  ```
+
+- [ ] **Step 4: Build head injection script, set cache headers, force chunked encoding**
+
+  After acquiring `response`:
+
+  ```rust
+  let ad_slots_script = if let Some(co_config) = &settings.creative_opportunities {
+      if !matched_slots.is_empty() {
+          Some(build_ad_slots_script(&matched_slots, co_config))
+      } else {
+          None
+      }
+  } else {
+      None
+  };
+
+  // Set cache headers when slots matched. private, max-age=0 (not no-store) preserves
+  // BFCache eligibility — browser back/forward cache restores the already-rendered ad
+  // without firing a new GAM call, which is the desired behavior.
+  if ad_slots_script.is_some() {
+      response.set_header(header::CACHE_CONTROL, "private, max-age=0");
+      response.remove_header("surrogate-control");
+      response.remove_header("fastly-surrogate-control");
+  }
+
+  // Force chunked encoding so </head> reaches the browser immediately as chunks arrive.
+  // Sending both Content-Length and Transfer-Encoding is invalid HTTP/1.1.
+  response.remove_header(header::CONTENT_LENGTH);
+  response.set_header("transfer-encoding", "chunked");
+  ```
+
+- [ ] **Step 5: Thread shared state into `OwnedProcessResponseParams`**
+
+  Update `OwnedProcessResponseParams`:
+
+  ```rust
+  pub struct OwnedProcessResponseParams {
+      // existing fields...
+      pub(crate) ad_slots_script: Option<String>,
+      pub(crate) ad_bids_state: Arc<RwLock<Option<String>>>,
+  }
+  ```
+
+  Pass both through to `create_html_stream_processor` and into `HtmlProcessorConfig`.
+
+- [ ] **Step 6: Add `pub(crate)` helper functions**
+
+  > **`BidMap` type:** Use `serde_json::Map<String, serde_json::Value>` directly — no separate module needed.
+
+  Add helpers in this order (each function is used by the one below it, so define leaf functions first):
+
+  ```rust
+  /// HTML-escape a JSON string for safe inline `<script>` injection via `JSON.parse`.
+  /// Unicode-escapes `<`, `>`, `&`, U+2028, U+2029 to prevent markup breakout.
+  fn html_escape_for_script(json: &str) -> String {
+      json.replace('&', "\\u0026")
+          .replace('<', "\\u003c")
+          .replace('>', "\\u003e")
+          .replace('\u{2028}', "\\u2028")
+          .replace('\u{2029}', "\\u2029")
+  }
+
+  /// Build the `BidMap` written to shared state and injected before `</body>`.
+  /// Keyed by slot ID. Values: hb_pb, hb_bidder, hb_adid, nurl (optional), burl (optional).
+  pub(crate) fn build_bid_map(
+      winning_bids: &std::collections::HashMap<String, crate::auction::types::Bid>,
+      price_granularity: crate::price_bucket::PriceGranularity,
+  ) -> serde_json::Map<String, serde_json::Value> {
+      winning_bids
+          .iter()
+          .filter_map(|(slot_id, bid)| {
+              let cpm = bid.price?;
+              let mut entry = serde_json::Map::new();
+              entry.insert("hb_pb".to_string(), serde_json::Value::String(price_bucket(cpm, price_granularity)));
+              entry.insert("hb_bidder".to_string(), serde_json::Value::String(bid.bidder.clone()));
+              entry.insert("hb_adid".to_string(), serde_json::Value::String(
+                  bid.ad_id.as_deref().unwrap_or("").to_string()
+              ));
+              if let Some(ref nurl) = bid.nurl {
+                  entry.insert("nurl".to_string(), serde_json::Value::String(nurl.clone()));
+              }
+              if let Some(ref burl) = bid.burl {
+                  entry.insert("burl".to_string(), serde_json::Value::String(burl.clone()));
+              }
+              Some((slot_id.clone(), serde_json::Value::Object(entry)))
+          })
+          .collect()
+  }
+
+  /// Build the `<script>` block injected before `</body>`.
+  /// Contains `window.__ts_bids` keyed by slot ID.
+  pub(crate) fn build_bids_script(bid_map: &serde_json::Map<String, serde_json::Value>) -> String {
+      let bids_str = serde_json::to_string(bid_map).expect("should serialize bids");
+      let escaped = html_escape_for_script(&bids_str);
+      format!(r#"<script>window.__ts_bids=JSON.parse("{escaped}");</script>"#)
+  }
+
+  /// Build the `<script>` block injected at `<head>` open.
+  /// Contains `window.__ts_ad_slots` only — no request ID, no bids.
+  pub(crate) fn build_ad_slots_script(
+      matched_slots: &[crate::creative_opportunities::CreativeOpportunitySlot],
+      co_config: &crate::creative_opportunities::CreativeOpportunitiesConfig,
+  ) -> String {
+      let slots_json: Vec<_> = matched_slots.iter().map(|slot| {
+          serde_json::json!({
+              "id": slot.id,
+              "gam_unit_path": slot.resolved_gam_unit_path(&co_config.gam_network_id),
+              "div_id": slot.resolved_div_id(),
+              "formats": slot.formats.iter()
+                  .map(|f| serde_json::json!([f.width, f.height]))
+                  .collect::<Vec<_>>(),
+              "targeting": slot.targeting,
+          })
+      }).collect();
+      let slots_json_str = serde_json::to_string(&slots_json).expect("should serialize ad slots");
+      let escaped = html_escape_for_script(&slots_json_str);
+      format!(r#"<script>window.__ts_ad_slots=JSON.parse("{escaped}");</script>"#)
+  }
+
+  fn build_auction_request(
+      matched_slots: &[crate::creative_opportunities::CreativeOpportunitySlot],
+      ec_id: &str,
+      consent_context: &crate::consent::ConsentContext,
+      request_info: &crate::http_util::RequestInfo,
+      co_config: &crate::creative_opportunities::CreativeOpportunitiesConfig,
+  ) -> AuctionRequest {
+      AuctionRequest {
+          id: uuid::Uuid::new_v4().to_string(),
+          slots: matched_slots.iter()
+              .map(|s| s.to_ad_slot(&co_config.gam_network_id))
+              .collect(),
+          publisher: PublisherInfo {
+              domain: request_info.host.clone(),
+              page_url: Some(format!("{}://{}", request_info.scheme, request_info.host)),
+          },
+          user: UserInfo {
+              id: ec_id.to_string(),
+              fresh_id: uuid::Uuid::new_v4().to_string(),
+              consent: Some(consent_context.clone()),
+          },
+          device: None,
+          site: Some(SiteInfo {
+              domain: request_info.host.clone(),
+              page: request_info.host.clone(),
+          }),
+          context: Default::default(),
+      }
+  }
+  ```
+
+  > **Type note:** All helper signatures use `serde_json::Map<String, serde_json::Value>` directly. Do not create a `BidMap` type alias or `bid_types.rs` module.
+
+- [ ] **Step 7: Update `main.rs` call site**
+
+  In `crates/trusted-server-adapter-fastly/src/main.rs`:
+
+  ```rust
+  // At startup (top of main() / request handler setup, before the request dispatch loop).
+  // include_str! embeds the file at compile time — no runtime file I/O.
+  const CREATIVE_OPPORTUNITIES_TOML: &str =
+      include_str!("../../../creative-opportunities.toml");
+
+  let slots_file: trusted_server_core::creative_opportunities::CreativeOpportunitiesFile =
+      toml::from_str(CREATIVE_OPPORTUNITIES_TOML)
+          .expect("should parse creative-opportunities.toml");
+  ```
+
+  `slots_file` is a local in the startup/handler scope and passed by reference into `handle_publisher_request` on each request — no `Arc` needed since it's immutable and the handler borrows it.
+
+  Update the call to `handle_publisher_request`:
+
+  ```rust
+  match handle_publisher_request(
+      settings,
+      integration_registry,
+      &publisher_services,
+      orchestrator,   // existing
+      &slots_file,    // new
+      req,
+  ).await {
+      // existing match arms unchanged
+  }
+  ```
+
+  There is **no `/ts-bids` route** to add. The body injection is complete within `handle_publisher_request`.
+
+- [ ] **Step 8: Compile check**
+
+  Run: `cargo check --workspace`
+  Expected: clean compile
+
+- [ ] **Step 9: Run full tests**
+
+  Run: `cargo test --workspace`
+  Expected: all pass
+
+- [ ] **Step 10: Commit**
+
+  ```bash
+  git add crates/trusted-server-core/src/publisher.rs \
+          crates/trusted-server-adapter-fastly/src/main.rs
+  git commit -m "Convert handle_publisher_request to async; body-inject __ts_bids; eligibility gates; max-age=0"
+  ```
+
+---
+
+## Task 9: GPT head injector — emit `__tsAdInit` with synchronous bid read
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/integrations/gpt.rs`
+
+> **Critical:** `__tsAdInit` reads `window.__ts_bids` **synchronously** — no fetch, no Promise. `window.__ts_bids` is already on the page (injected before `</body>`) when `__tsAdInit` runs (it executes post-DCL, after `</body>` is received). Both `nurl` and `burl` fire client-side from `slotRenderEnded`; neither is fired server-side.
+
+- [ ] **Step 1: Write failing test**
+
+  ```rust
+  #[test]
+  fn head_inserts_includes_ts_ad_init_with_synchronous_bids_read() {
+      let config = test_config();
+      let integration = GptIntegration::new(config);
+      let ctx = make_test_context();
+      let inserts = integration.head_inserts(&ctx);
+      let combined = inserts.join("");
+      assert!(combined.contains("__tsAdInit"), "should define __tsAdInit");
+      assert!(combined.contains("window.__ts_bids"), "should read window.__ts_bids synchronously");
+      assert!(combined.contains("ts_initial"), "should set ts_initial sentinel");
+      assert!(combined.contains("slotRenderEnded"), "should register slotRenderEnded");
+      assert!(combined.contains("sendBeacon"), "should fire nurl and burl via sendBeacon");
+      assert!(combined.contains("nurl"), "should fire nurl on confirmed render");
+      assert!(!combined.contains("/ts-bids"), "must NOT fetch /ts-bids — bids are inline on the page");
+      assert!(!combined.contains("bidsPromise"), "must NOT use bidsPromise — bids are synchronous");
+      assert!(!combined.contains("__ts_request_id"), "must NOT reference request_id — no longer used");
+  }
+  ```
+
+  Run: `cargo test -p trusted-server-core integrations::gpt`
+  Expected: FAIL
+
+- [ ] **Step 2: Replace `head_inserts()` in gpt.rs**
+
+  ```rust
+  impl IntegrationHeadInjector for GptIntegration {
+      fn integration_id(&self) -> &'static str {
+          GPT_INTEGRATION_ID
+      }
+
+      fn head_inserts(&self, _ctx: &IntegrationHtmlContext<'_>) -> Vec<String> {
+          vec![
+              "<script>window.__tsjs_gpt_enabled=true;\
+               window.__tsjs_installGptShim&&window.__tsjs_installGptShim();</script>"
+                  .to_string(),
+              // __tsAdInit: reads window.__ts_bids synchronously (injected before </body>).
+              // No fetch, no Promise. Executes post-DCL when </body> has already arrived.
+              // Both nurl and burl fire client-side from slotRenderEnded — never server-side.
+              // Note: window.__tsjs_installGptShim above is an EXISTING function in the
+              // tsjs-core bundle that stubs googletag.cmd before the real GPT loads.
+              concat!(
+                  "<script>",
+                  "window.__tsAdInit=function(){",
+                    "var slots=window.__ts_ad_slots||[];",
+                    "var bids=window.__ts_bids||{};",
+                    "googletag.cmd.push(function(){",
+                      "var gptSlots=slots.map(function(slot){",
+                        "var s=googletag.defineSlot(slot.gam_unit_path,slot.formats,slot.div_id);",
+                        "if(!s)return null;",
+                        "s.addService(googletag.pubads());",
+                        "Object.entries(slot.targeting||{}).forEach(function(e){s.setTargeting(e[0],e[1]);});",
+                        "var b=bids[slot.id]||{};",
+                        "[\"hb_pb\",\"hb_bidder\",\"hb_adid\"].forEach(function(k){if(b[k])s.setTargeting(k,b[k]);});",
+                        "s.setTargeting(\"ts_initial\",\"1\");",
+                        "return{id:slot.id,gptSlot:s};",
+                      "}).filter(Boolean);",
+                      "googletag.pubads().enableSingleRequest();",
+                      "googletag.enableServices();",
+                      "googletag.pubads().addEventListener(\"slotRenderEnded\",function(ev){",
+                        "var id=ev.slot.getSlotElementId();",
+                        "var b=bids[id]||{};",
+                        "var ourBidWon=!ev.isEmpty&&b.hb_adid&&ev.slot.getTargeting(\"hb_adid\")[0]===b.hb_adid;",
+                        "if(ourBidWon){",
+                          "if(b.nurl)navigator.sendBeacon(b.nurl);",
+                          "if(b.burl)navigator.sendBeacon(b.burl);",
+                        "}",
+                      "});",
+                      "googletag.pubads().refresh();",
+                    "});",
+                  "};",
+                  "</script>"
+              ).to_string(),
+          ]
+      }
+  }
+  ```
+
+- [ ] **Step 3: Run tests**
+
+  Run: `cargo test -p trusted-server-core integrations::gpt`
+  Expected: all pass including new test
+
+- [ ] **Step 4: Commit**
+
+  ```bash
+  git add crates/trusted-server-core/src/integrations/gpt.rs
+  git commit -m "Emit __tsAdInit with synchronous window.__ts_bids read; nurl+burl from slotRenderEnded"
+  ```
+
+---
+
+## Task 10: `gpt/index.ts` — TypeScript `__tsAdInit` with slim-Prebid lazy loader
+
+**Files:**
+
+- Modify: `crates/js/lib/src/integrations/gpt/index.ts`
+
+The TypeScript version mirrors the Rust inline string from Task 9 and adds the lazy slim-Prebid loader. Slim-Prebid loads post-`window.load` and handles two things: refresh auctions (via existing GPT refresh triggers) and userID module warm-up to enrich the EC graph for the next request.
+
+- [ ] **Step 1: Write failing tests**
+
+  In `crates/js/lib/src/integrations/gpt/index.test.ts`:
+
+  ```typescript
+  import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+  describe('installTsAdInit', () => {
+    beforeEach(() => {
+      delete (window as any).__ts_ad_slots
+      delete (window as any).__ts_bids
+      delete (window as any).__tsAdInit
+    })
+
+    it('reads window.__ts_bids synchronously and applies bid targeting before refresh', async () => {
+      const mockSlot = {
+        addService: vi.fn().mockReturnThis(),
+        setTargeting: vi.fn().mockReturnThis(),
+        getSlotElementId: vi.fn().mockReturnValue('atf'),
+        getTargeting: vi.fn().mockReturnValue(['abc']),
+      }
+      const mockPubads = {
+        enableSingleRequest: vi.fn(),
+        addEventListener: vi.fn(),
+        refresh: vi.fn(),
+      }
+      ;(window as any).googletag = {
+        cmd: { push: vi.fn((fn: () => void) => fn()) },
+        defineSlot: vi.fn().mockReturnValue(mockSlot),
+        pubads: vi.fn().mockReturnValue(mockPubads),
+        enableServices: vi.fn(),
+      }
+      ;(window as any).__ts_ad_slots = [
+        {
+          id: 'atf',
+          gam_unit_path: '/123/atf',
+          div_id: 'atf',
+          formats: [[300, 250]],
+          targeting: { pos: 'atf' },
+        },
+      ]
+      ;(window as any).__ts_bids = {
+        atf: {
+          hb_pb: '1.00',
+          hb_bidder: 'kargo',
+          hb_adid: 'abc',
+          nurl: 'https://ssp/win',
+          burl: 'https://ssp/bill',
+        },
+      }
+
+      const fetchSpy = vi.spyOn(global, 'fetch')
+
+      const { installTsAdInit } = await import('./index')
+      installTsAdInit()
+      ;(window as any).__tsAdInit()
+
+      expect(fetchSpy).not.toHaveBeenCalled()
+      expect(mockSlot.setTargeting).toHaveBeenCalledWith('hb_pb', '1.00')
+      expect(mockSlot.setTargeting).toHaveBeenCalledWith('hb_bidder', 'kargo')
+      expect(mockSlot.setTargeting).toHaveBeenCalledWith('ts_initial', '1')
+      expect(mockPubads.refresh).toHaveBeenCalled()
+
+      fetchSpy.mockRestore()
+    })
+
+    it('fires both nurl and burl via sendBeacon on slotRenderEnded when our bid won', async () => {
+      const beaconSpy = vi.spyOn(navigator, 'sendBeacon').mockReturnValue(true)
+      let capturedListener: ((e: any) => void) | undefined
+
+      const mockSlot = {
+        addService: vi.fn().mockReturnThis(),
+        setTargeting: vi.fn().mockReturnThis(),
+        getSlotElementId: vi.fn().mockReturnValue('atf'),
+        getTargeting: vi.fn().mockReturnValue(['abc']),
+      }
+      const mockPubads = {
+        enableSingleRequest: vi.fn(),
+        refresh: vi.fn(),
+        addEventListener: vi.fn((event: string, fn: (e: any) => void) => {
+          if (event === 'slotRenderEnded') capturedListener = fn
+        }),
+      }
+      ;(window as any).googletag = {
+        cmd: { push: vi.fn((fn: () => void) => fn()) },
+        defineSlot: vi.fn().mockReturnValue(mockSlot),
+        pubads: vi.fn().mockReturnValue(mockPubads),
+        enableServices: vi.fn(),
+      }
+      ;(window as any).__ts_ad_slots = [
+        {
+          id: 'atf',
+          gam_unit_path: '/123/atf',
+          div_id: 'atf',
+          formats: [[300, 250]],
+          targeting: {},
+        },
+      ]
+      ;(window as any).__ts_bids = {
+        atf: {
+          hb_pb: '1.00',
+          hb_bidder: 'kargo',
+          hb_adid: 'abc',
+          nurl: 'https://ssp/win',
+          burl: 'https://ssp/bill',
+        },
+      }
+
+      const { installTsAdInit } = await import('./index')
+      installTsAdInit()
+      ;(window as any).__tsAdInit()
+
+      expect(capturedListener).toBeDefined()
+      capturedListener!({ isEmpty: false, slot: mockSlot })
+
+      expect(beaconSpy).toHaveBeenCalledWith('https://ssp/win')
+      expect(beaconSpy).toHaveBeenCalledWith('https://ssp/bill')
+      beaconSpy.mockRestore()
+    })
+
+    it('does not fire nurl/burl when bid did not win GAM line item', async () => {
+      const beaconSpy = vi.spyOn(navigator, 'sendBeacon').mockReturnValue(true)
+      let capturedListener: ((e: any) => void) | undefined
+
+      const mockSlotNoMatch = {
+        addService: vi.fn().mockReturnThis(),
+        setTargeting: vi.fn().mockReturnThis(),
+        getSlotElementId: vi.fn().mockReturnValue('atf'),
+        getTargeting: vi.fn().mockReturnValue(['OTHER_BID_ID']),
+      }
+      const mockPubads = {
+        enableSingleRequest: vi.fn(),
+        refresh: vi.fn(),
+        addEventListener: vi.fn((event: string, fn: (e: any) => void) => {
+          if (event === 'slotRenderEnded') capturedListener = fn
+        }),
+      }
+      ;(window as any).googletag = {
+        cmd: { push: vi.fn((fn: () => void) => fn()) },
+        defineSlot: vi.fn().mockReturnValue(mockSlotNoMatch),
+        pubads: vi.fn().mockReturnValue(mockPubads),
+        enableServices: vi.fn(),
+      }
+      ;(window as any).__ts_ad_slots = [
+        {
+          id: 'atf',
+          gam_unit_path: '/123/atf',
+          div_id: 'atf',
+          formats: [[300, 250]],
+          targeting: {},
+        },
+      ]
+      ;(window as any).__ts_bids = {
+        atf: {
+          hb_pb: '1.00',
+          hb_bidder: 'kargo',
+          hb_adid: 'abc',
+          nurl: 'https://ssp/win',
+          burl: 'https://ssp/bill',
+        },
+      }
+
+      const { installTsAdInit } = await import('./index')
+      installTsAdInit()
+      ;(window as any).__tsAdInit()
+      capturedListener!({ isEmpty: false, slot: mockSlotNoMatch })
+
+      expect(beaconSpy).not.toHaveBeenCalled()
+      beaconSpy.mockRestore()
+    })
+
+    it('calls refresh even when __ts_bids is empty (graceful fallback)', () => {
+      const mockPubads = {
+        enableSingleRequest: vi.fn(),
+        addEventListener: vi.fn(),
+        refresh: vi.fn(),
+      }
+      ;(window as any).googletag = {
+        cmd: { push: vi.fn((fn: () => void) => fn()) },
+        defineSlot: vi.fn().mockReturnValue({
+          addService: vi.fn().mockReturnThis(),
+          setTargeting: vi.fn().mockReturnThis(),
+        }),
+        pubads: vi.fn().mockReturnValue(mockPubads),
+        enableServices: vi.fn(),
+      }
+      ;(window as any).__ts_ad_slots = []
+      ;(window as any).__ts_bids = {}
+
+      const { installTsAdInit } = require('./index')
+      installTsAdInit()
+      ;(window as any).__tsAdInit()
+
+      expect(mockPubads.refresh).toHaveBeenCalled()
+    })
+  })
+  ```
+
+  Run: `cd crates/js/lib && npx vitest run`
+  Expected: FAIL — `installTsAdInit` not defined or assertions fail
+
+- [ ] **Step 2: Implement `installTsAdInit` in `index.ts`**
+
+  Replace the old `/ts-bids` fetch implementation with:
+
+  ```typescript
+  interface TsAdSlot {
+    id: string
+    gam_unit_path: string
+    div_id: string
+    formats: Array<number[]>
+    targeting: Record<string, string>
+  }
+
+  interface TsBidData {
+    hb_pb?: string
+    hb_bidder?: string
+    hb_adid?: string
+    nurl?: string
+    burl?: string
+  }
+
+  type TsWindow = Window & {
+    __ts_ad_slots?: TsAdSlot[]
+    __ts_bids?: Record<string, TsBidData>
+    __tsAdInit?: () => void
+  }
+
+  /**
+   * Install `window.__tsAdInit`.
+   *
+   * Reads `window.__ts_ad_slots` (injected at head-open) and `window.__ts_bids`
+   * (injected before </body>) synchronously — no fetch, no Promise. Applies bid
+   * targeting to GPT slots, sets the `ts_initial` sentinel, registers
+   * `slotRenderEnded` to fire both nurl and burl via sendBeacon when our
+   * specific Prebid bid wins the GAM line item match, then calls refresh().
+   */
+  export function installTsAdInit(): void {
+    const w = window as TsWindow
+    w.__tsAdInit = function () {
+      const slots = w.__ts_ad_slots ?? []
+      const bids = w.__ts_bids ?? {}
+      const g = (window as GptWindow).googletag
+      if (!g) return
+
+      g.cmd.push(() => {
+        const gptSlots = slots
+          .map((slot) => {
+            const gptSlot = g.defineSlot?.(
+              slot.gam_unit_path,
+              slot.formats,
+              slot.div_id
+            )
+            if (!gptSlot) return null
+            gptSlot.addService(g.pubads())
+            Object.entries(slot.targeting ?? {}).forEach(([k, v]) =>
+              gptSlot.setTargeting(k, v)
+            )
+            const bid = bids[slot.id] ?? {}
+            ;(['hb_pb', 'hb_bidder', 'hb_adid'] as const).forEach((key) => {
+              if (bid[key]) gptSlot.setTargeting(key, bid[key]!)
+            })
+            gptSlot.setTargeting('ts_initial', '1')
+            return { id: slot.id, gptSlot }
+          })
+          .filter(Boolean) as Array<{
+          id: string
+          gptSlot: NonNullable<ReturnType<typeof g.defineSlot>>
+        }>
+
+        g.pubads().enableSingleRequest()
+        g.enableServices()
+
+        g.pubads().addEventListener?.('slotRenderEnded', (event: any) => {
+          const slotId: string = event.slot?.getSlotElementId?.() ?? ''
+          const bid = bids[slotId] ?? {}
+          const ourBidWon =
+            !event.isEmpty &&
+            bid.hb_adid &&
+            event.slot?.getTargeting?.('hb_adid')?.[0] === bid.hb_adid
+          if (ourBidWon) {
+            if (bid.nurl) navigator.sendBeacon(bid.nurl)
+            if (bid.burl) navigator.sendBeacon(bid.burl)
+          }
+        })
+
+        g.pubads().refresh()
+      })
+    }
+  }
+  ```
+
+- [ ] **Step 3: Add lazy slim-Prebid loader (post-`window.load`)**
+
+  After `installTsAdInit`, add:
+
+  ```typescript
+  /**
+   * Register the slim-Prebid lazy loader. Fires after window.load — off the
+   * critical path. slim-Prebid handles refresh auctions and userID module
+   * warm-up (ID5, sharedID, LiveRamp ATS, Lockr). It skips initial-render slots
+   * (ts_initial=1) and registers as the GPT refresh handler for scroll/sticky auctions.
+   *
+   * Phase 1: no-op unless window.__tsjs_slim_prebid_url is set (it won't be until
+   * the slim-Prebid bundle build target ships in a later phase).
+   */
+  export function installSlimPrebidLoader(): void {
+    const url = (window as any).__tsjs_slim_prebid_url as string | undefined
+    if (!url) return
+    window.addEventListener('load', () => {
+      const script = document.createElement('script')
+      script.src = url
+      script.defer = true
+      document.head.appendChild(script)
+    })
+  }
+  ```
+
+  Call `installTsAdInit()` from the integration's existing initialization path — wherever the module's init function runs at page load (look for the existing `init()` or module-level call that sets up the GPT integration). Add:
+
+  ```typescript
+  // In the integration's init / module entry point:
+  installTsAdInit()
+  ```
+
+  `window.__tsAdInit()` itself is called by `__tsAdInit` being invoked from the `<script>` block at the bottom of `</body>` (the same script block that calls `window.__tsAdInit()` after the browser receives it).
+
+- [ ] **Step 4: Run JS tests**
+
+  Run: `cd crates/js/lib && npx vitest run`
+  Expected: new tests pass
+
+- [ ] **Step 5: Build JS bundle**
+
+  Run: `cd crates/js/lib && node build-all.mjs`
+  Expected: clean build
+
+- [ ] **Step 6: Commit**
+
+  ```bash
+  git add crates/js/lib/src/integrations/gpt/
+  git commit -m "Add synchronous __tsAdInit (reads window.__ts_bids inline); nurl+burl from slotRenderEnded; slim-Prebid lazy loader"
+  ```
+
+---
+
+## Task 11: End-to-end integration tests
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/publisher.rs` (test module)
+
+Tests use `pub(crate)` helpers from Task 8 directly.
+
+- [ ] **Step 1: Write tests**
+
+  In `publisher.rs` test module:
+
+  ```rust
+  #[cfg(test)]
+  mod creative_opportunities_tests {
+      use super::{build_ad_slots_script, build_bids_script, build_bid_map, html_escape_for_script};
+      use crate::creative_opportunities::{
+          CreativeOpportunitiesConfig, CreativeOpportunitySlot, CreativeOpportunityFormat,
+      };
+      use crate::auction::types::{Bid, MediaType};
+      use crate::price_bucket::PriceGranularity;
+      use std::collections::HashMap;
+
+      fn make_config() -> CreativeOpportunitiesConfig {
+          CreativeOpportunitiesConfig {
+              gam_network_id: "21765378893".to_string(),
+              auction_timeout_ms: Some(500),
+              price_granularity: PriceGranularity::Dense,
+          }
+      }
+
+      fn make_slot() -> CreativeOpportunitySlot {
+          CreativeOpportunitySlot {
+              id: "atf_sidebar_ad".to_string(),
+              gam_unit_path: Some("/21765378893/publisher/atf-sidebar".to_string()),
+              div_id: Some("div-atf-sidebar".to_string()),
+              page_patterns: vec!["/20**".to_string()],
+              formats: vec![CreativeOpportunityFormat {
+                  width: 300, height: 250, media_type: MediaType::Banner,
+              }],
+              floor_price: Some(0.50),
+              targeting: [("pos".to_string(), "atf".to_string())].into_iter().collect(),
+              providers: Default::default(),
+          }
+      }
+
+      #[test]
+      fn ad_slots_script_contains_slot_data() {
+          let slots = vec![make_slot()];
+          let config = make_config();
+          let script = build_ad_slots_script(&slots, &config);
+          assert!(script.contains("window.__ts_ad_slots=JSON.parse"), "should use JSON.parse");
+          assert!(script.contains("atf_sidebar_ad"), "should include slot id");
+          assert!(!script.contains("__ts_bids"), "must NOT contain bids");
+          assert!(!script.contains("__ts_request_id"), "must NOT contain request_id");
+      }
+
+      #[test]
+      fn ad_slots_script_is_xss_safe() {
+          let slots = vec![make_slot()];
+          let config = make_config();
+          let script = build_ad_slots_script(&slots, &config);
+          let inner = script
+              .trim_start_matches("<script>")
+              .trim_end_matches("</script>");
+          assert!(!inner.contains('<'), "no unescaped < in script content");
+          assert!(!inner.contains('>'), "no unescaped > in script content");
+      }
+
+      #[test]
+      fn bid_map_includes_nurl_and_burl() {
+          let mut winning_bids = HashMap::new();
+          winning_bids.insert("atf_sidebar_ad".to_string(), Bid {
+              slot_id: "atf_sidebar_ad".to_string(),
+              price: Some(2.53),
+              currency: "USD".to_string(),
+              creative: None,
+              adomain: None,
+              bidder: "kargo".to_string(),
+              width: 300,
+              height: 250,
+              nurl: Some("https://ssp/win".to_string()),
+              burl: Some("https://ssp/bill".to_string()),
+              ad_id: Some("abc123".to_string()),
+              metadata: Default::default(),
+          });
+          let map = build_bid_map(&winning_bids, PriceGranularity::Dense);
+          let entry = map.get("atf_sidebar_ad").expect("should have bid entry");
+          assert_eq!(entry.get("hb_pb").and_then(|v| v.as_str()), Some("2.50"));
+          assert_eq!(entry.get("hb_bidder").and_then(|v| v.as_str()), Some("kargo"));
+          assert_eq!(entry.get("hb_adid").and_then(|v| v.as_str()), Some("abc123"));
+          assert_eq!(entry.get("nurl").and_then(|v| v.as_str()), Some("https://ssp/win"));
+          assert_eq!(entry.get("burl").and_then(|v| v.as_str()), Some("https://ssp/bill"));
+      }
+
+      #[test]
+      fn bid_map_excludes_slot_when_price_is_none() {
+          let mut winning_bids = HashMap::new();
+          winning_bids.insert("no-price-slot".to_string(), Bid {
+              slot_id: "no-price-slot".to_string(),
+              price: None,
+              currency: "USD".to_string(),
+              creative: None,
+              adomain: None,
+              bidder: "kargo".to_string(),
+              width: 300,
+              height: 250,
+              nurl: None,
+              burl: None,
+              ad_id: None,
+              metadata: Default::default(),
+          });
+          let map = build_bid_map(&winning_bids, PriceGranularity::Dense);
+          assert!(map.is_empty(), "slot with no price should be excluded from bid map");
+      }
+
+      #[test]
+      fn bids_script_is_xss_safe() {
+          let mut map = serde_json::Map::new();
+          map.insert("atf".to_string(), serde_json::json!({"hb_pb": "1.00"}));
+          let script = build_bids_script(&map);
+          let inner = script
+              .trim_start_matches("<script>")
+              .trim_end_matches("</script>");
+          assert!(!inner.contains('<'), "no unescaped < in bids script");
+          assert!(!inner.contains('>'), "no unescaped > in bids script");
+      }
+
+      #[test]
+      fn html_escape_encodes_special_chars() {
+          assert_eq!(html_escape_for_script("<script>"), "\\u003cscript\\u003e");
+          assert_eq!(html_escape_for_script("&"), "\\u0026");
+          assert_eq!(html_escape_for_script("\u{2028}"), "\\u2028");
+      }
+  }
+  ```
+
+- [ ] **Step 2: Run tests**
+
+  Run: `cargo test -p trusted-server-core creative_opportunities_tests`
+  Expected: all pass
+
+- [ ] **Step 3: Run full workspace tests**
+
+  Run: `cargo test --workspace`
+  Expected: all pass
+
+- [ ] **Step 4: Run JS tests**
+
+  Run: `cd crates/js/lib && npx vitest run`
+  Expected: all pass
+
+- [ ] **Step 5: Commit**
+
+  ```bash
+  git add crates/trusted-server-core/src/publisher.rs
+  git commit -m "Add end-to-end publisher helper tests for body-injection architecture"
+  ```
diff --git a/docs/superpowers/plans/2026-05-29-pr680-reviewer-findings.md b/docs/superpowers/plans/2026-05-29-pr680-reviewer-findings.md
new file mode 100644
index 00000000..83866e3b
--- /dev/null
+++ b/docs/superpowers/plans/2026-05-29-pr680-reviewer-findings.md
@@ -0,0 +1,630 @@
+# PR #680 Reviewer Findings Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Address the two reviewer-required findings from PR #680 plus low-effort cleanups: consolidate slot config into `trusted-server.toml`, consolidate `window.__ts*` globals under `window.tsjs`, and fix the TypeScript `formats` type cast and `ts_initial` hardcoded string.
+
+**Architecture:** Slot templates move from the standalone `creative-opportunities.toml` (embedded via `include_str!`) into the `[creative_opportunities]` section of `trusted-server.toml`, using the existing `vec_from_seq_or_map` deserializer pattern already used for `BID_PARAM_ZONE_OVERRIDES`. The window globals rename is a coordinated change across `gpt_bootstrap.js`, `index.ts`, and `publisher.rs` — all three must change together since they share a runtime contract.
+
+**Tech Stack:** Rust (serde, toml), TypeScript, vanilla JS, `cargo test --workspace`, `npx vitest run`
+
+---
+
+## Context for all tasks
+
+- **Branch:** create `fix/pr680-review-findings` off `server-side-ad-templates-impl` before starting
+- **Current codebase:** `crates/trusted-server-core/`, `crates/trusted-server-adapter-fastly/`, `crates/js/lib/`
+- **CI gates:** `cargo fmt`, `cargo clippy --workspace --all-targets --all-features -- -D warnings`, `cargo test --workspace`, `npx vitest run`, `npm run format`
+- **Error handling:** use `error-stack` (`Report<E>`), not anyhow. Use `derive_more::Display`, not thiserror.
+- **No `unwrap()` in production code** — use `expect("should ...")`.
+- **Do not** add `println!` / `eprintln!` — use `log::` macros.
+
+---
+
+## Task 1: Consolidate slot config into `trusted-server.toml`
+
+**What:** Delete `creative-opportunities.toml`. Move `[[slot]]` arrays into `trusted-server.toml` as `[[creative_opportunities.slot]]`. Wire the `vec_from_seq_or_map` deserializer so env var JSON blobs also work. Remove the `SLOTS_FILE` static and `include_str!` from `main.rs`. Update `build.rs` to validate slot IDs from settings instead of a separate file.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/creative_opportunities.rs`
+- Modify: `crates/trusted-server-core/src/settings.rs`
+- Modify: `crates/trusted-server-adapter-fastly/src/main.rs`
+- Modify: `crates/trusted-server-core/build.rs`
+- Modify: `crates/trusted-server-core/src/publisher.rs` (function signatures)
+- Modify: `trusted-server.toml`
+- Delete: `creative-opportunities.toml`
+
+**Steps:**
+
+- [ ] **Step 1: Create the branch**
+
+```bash
+git checkout -b fix/pr680-review-findings
+```
+
+- [ ] **Step 2: Add `Serialize` and `slot` field to structs**
+
+In `crates/trusted-server-core/src/creative_opportunities.rs`:
+
+1. Add `Serialize` to `CreativeOpportunitySlot` derive — it already has `#[serde(skip, default)]` on `compiled_patterns` so that field won't serialize.
+
+```rust
+#[derive(Debug, Clone, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct CreativeOpportunitySlot { ... }
+```
+
+Also add `Serialize` to `CreativeOpportunityFormat`, `SlotProviders`, `ApsSlotParams` (any struct used inside `CreativeOpportunitySlot`).
+
+2. Add a `slot` field to `CreativeOpportunitiesConfig`:
+
+```rust
+use crate::settings::vec_from_seq_or_map;
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct CreativeOpportunitiesConfig {
+    pub gam_network_id: String,
+    #[serde(default)]
+    pub auction_timeout_ms: Option<u32>,
+    #[serde(default = "PriceGranularity::dense")]
+    pub price_granularity: PriceGranularity,
+    /// Slot templates. Empty = feature disabled.
+    #[serde(default, deserialize_with = "vec_from_seq_or_map")]
+    pub slot: Vec<CreativeOpportunitySlot>,
+}
+```
+
+Note: the field is named `slot` (not `slots`) to match the TOML key `[[creative_opportunities.slot]]`.
+
+- [ ] **Step 3: Delete `CreativeOpportunitiesFile`**
+
+Remove the `CreativeOpportunitiesFile` struct and its `impl` from `creative_opportunities.rs`. The `compile` logic moves to a free function or into `CreativeOpportunitiesConfig`:
+
+```rust
+impl CreativeOpportunitiesConfig {
+    /// Pre-compile glob patterns for all slots. Call once after deserialization.
+    pub fn compile_slots(&mut self) {
+        for slot in &mut self.slot {
+            slot.compile_patterns();
+        }
+    }
+}
+```
+
+- [ ] **Step 4: Wire slot compilation into `Settings::prepare_runtime`**
+
+Glob pattern pre-compilation must happen once at startup, not per-request. `Settings::prepare_runtime` is already called after deserialization in both `from_toml_and_env` (build time) and `get_settings()` (runtime). Add slot compilation there:
+
+```rust
+// In settings.rs, inside Settings::prepare_runtime
+pub fn prepare_runtime(&mut self) -> Result<(), Report<TrustedServerError>> {
+    for handler in &self.handlers {
+        handler.prepare_runtime()?;
+    }
+    // Pre-compile slot glob patterns for hot-path matching.
+    if let Some(co) = &mut self.creative_opportunities {
+        co.compile_slots();
+    }
+    Ok(())
+}
+```
+
+Note: `prepare_runtime` must take `&mut self` for this change. Check current signature — if it takes `&self`, change it to `&mut self` and update call sites.
+
+Also add a helper method for call sites that need the slot slice:
+
+```rust
+impl Settings {
+    /// Returns compiled creative opportunity slots, or empty slice if disabled.
+    pub fn creative_opportunity_slots(&self) -> &[CreativeOpportunitySlot] {
+        self.creative_opportunities
+            .as_ref()
+            .map(|co| co.slot.as_slice())
+            .unwrap_or(&[])
+    }
+}
+```
+
+- [ ] **Step 5: Update `build.rs` stub and slot validation**
+
+First update the `creative_opportunities` stub in `build.rs` to add the `slot` field — without this the settings parse will fail at build time when `trusted-server.toml` contains `[[creative_opportunities.slot]]` entries:
+
+```rust
+mod creative_opportunities {
+    use serde::{Deserialize, Serialize};
+
+    #[derive(Debug, Clone, Deserialize, Serialize)]
+    pub struct CreativeOpportunitiesConfig {
+        pub gam_network_id: String,
+        #[serde(default)]
+        pub auction_timeout_ms: Option<u32>,
+        #[serde(default = "default_price_granularity")]
+        pub price_granularity: String,
+        // Use serde_json::Value to avoid pulling in full slot type in build context.
+        #[serde(default)]
+        pub slot: Vec<serde_json::Value>,
+    }
+
+    fn default_price_granularity() -> String {
+        "dense".to_string()
+    }
+}
+```
+
+Then replace the separate-file validation block with reading slots from `Settings`:
+
+```rust
+// After settings are parsed, validate slot IDs
+let slot_id_re = regex::Regex::new(r"^[A-Za-z0-9_\-]+$").expect("should compile regex");
+if let Some(co) = &settings.creative_opportunities {
+    for slot in &co.slot {
+        if let Err(e) = trusted_server_core::creative_opportunities::validate_slot_id(&slot.id) {
+            panic!("trusted-server.toml [creative_opportunities.slot]: {e}");
+        }
+    }
+    if !co.slot.is_empty() {
+        println!(
+            "cargo:warning=creative_opportunities: {} slot(s) validated",
+            co.slot.len()
+        );
+    }
+}
+```
+
+Remove: `CREATIVE_OPPORTUNITIES_PATH` const, the `co_path.exists()` block, and the `println!("cargo:rerun-if-changed={}", CREATIVE_OPPORTUNITIES_PATH)` line.
+
+Note: `build.rs` already pulls in `src/creative_opportunities.rs` as a module — make sure the module stub includes the new `Serialize` derive (it may need the serde `Serialize` import).
+
+- [ ] **Step 6: Update `main.rs` — remove `SLOTS_FILE` static**
+
+Remove:
+
+```rust
+const CREATIVE_OPPORTUNITIES_TOML: &str = include_str!("../../../creative-opportunities.toml");
+static SLOTS_FILE: std::sync::LazyLock<...> = ...;
+```
+
+Replace `slots_file` parameter threading with deriving slots from `settings`:
+
+Where `slots_file` was passed as `&*SLOTS_FILE`, pass `settings.creative_opportunity_slots()` instead. This requires `settings` to be available at that call site (it is — `settings` is already in scope).
+
+Update function signatures in `main.rs` that reference `CreativeOpportunitiesFile` to accept `&[CreativeOpportunitySlot]` instead.
+
+- [ ] **Step 7: Update `publisher.rs` function signatures**
+
+Functions that take `&crate::creative_opportunities::CreativeOpportunitiesFile` change to `&[crate::creative_opportunities::CreativeOpportunitySlot]`:
+
+```rust
+// Before
+pub(crate) fn handle_page_bids(
+    ...
+    slots_file: &crate::creative_opportunities::CreativeOpportunitiesFile,
+    ...
+)
+
+// After
+pub(crate) fn handle_page_bids(
+    ...
+    slots: &[crate::creative_opportunities::CreativeOpportunitySlot],
+    ...
+)
+```
+
+Inside the function body, replace `slots_file.slots` with `slots`.
+
+Update all call sites and test helpers in `publisher.rs` that construct `CreativeOpportunitiesFile { slots: vec![...] }` to pass `&[slot]` directly.
+
+- [ ] **Step 8: Update `trusted-server.toml`**
+
+Move the slots from `creative-opportunities.toml` into `trusted-server.toml` under `[creative_opportunities]`. Use `[[creative_opportunities.slot]]` syntax. Use only example/fictional values per project convention (example.com domains, fictional IDs):
+
+```toml
+[creative_opportunities]
+gam_network_id = "88059007"
+auction_timeout_ms = 1500
+price_granularity = "dense"
+
+[[creative_opportunities.slot]]
+id = "atf_sidebar_ad"
+gam_unit_path = "/a/b/news"
+div_id = "div-ad-atf-sidebar"
+page_patterns = ["/news/**"]
+formats = [{ width = 300, height = 250 }]
+floor_price = 0.50
+
+[creative_opportunities.slot.targeting]
+pos = "atf"
+zone = "atfSidebar"
+
+[creative_opportunities.slot.providers.aps]
+slot_id = "aps-slot-atf-sidebar"
+```
+
+- [ ] **Step 9: Delete `creative-opportunities.toml`**
+
+```bash
+git rm creative-opportunities.toml
+```
+
+- [ ] **Step 10: Run tests**
+
+```bash
+cargo test --workspace
+```
+
+Expected: all tests pass. Fix any compile errors from the signature changes.
+
+- [ ] **Step 11: Run clippy and fmt**
+
+```bash
+cargo fmt --all -- --check
+cargo clippy --workspace --all-targets --all-features -- -D warnings
+```
+
+- [ ] **Step 12: Commit**
+
+```bash
+git add -p
+git commit -m "Move slot templates from creative-opportunities.toml into trusted-server.toml"
+```
+
+---
+
+## Task 2: Consolidate `window.__ts*` globals under `window.tsjs`
+
+**What:** All `window.__ts*` globals become properties on a single `window._ts` namespace object. Changes must be coordinated across three files: `gpt_bootstrap.js`, `index.ts`, and `publisher.rs`. Tests in `index.test.ts` must be updated too.
+
+**Rename table:**
+
+| Old global                    | New property                   | Notes                        |
+| ----------------------------- | ------------------------------ | ---------------------------- |
+| `window.__ts_ad_slots`        | `window.tsjs.adSlots`          | Array, set at head-open      |
+| `window.__ts_bids`            | `window.tsjs.bids`             | Object, set before `</body>` |
+| `window.__tsAdInit`           | `window.tsjs.adInit`           | Function                     |
+| `window.__tsPrevGptSlots`     | `window.tsjs.prevGptSlots`     | Array                        |
+| `window.__tsServicesEnabled`  | `window.tsjs.servicesEnabled`  | Boolean                      |
+| `window.__tsDivToSlotId`      | `window.tsjs.divToSlotId`      | Object                       |
+| `window.__tsSpaHookInstalled` | `window.tsjs.spaHookInstalled` | Boolean                      |
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/publisher.rs`
+- Modify: `crates/trusted-server-core/src/integrations/gpt_bootstrap.js`
+- Modify: `crates/js/lib/src/integrations/gpt/index.ts`
+- Modify: `crates/js/lib/src/integrations/gpt/index.test.ts`
+- Modify: `crates/js/lib/test/integrations/gpt/index.test.ts` (if exists)
+
+**Steps:**
+
+- [ ] **Step 1: Update `publisher.rs` injected scripts**
+
+`build_ad_slots_script` generates the `<script>` injected at `<head>` open. Change:
+
+```rust
+// Before
+format!("<script>window.__ts_ad_slots=JSON.parse(\"{}\");</script>", escaped)
+
+// After — initialise _ts if absent, then set adSlots
+format!("<script>(window.tsjs=window.tsjs||{{}}).adSlots=JSON.parse(\"{}\");</script>", escaped)
+```
+
+`build_bids_script` generates the script injected before `</body>`. Change:
+
+```rust
+// Before
+format!(
+    "<script>window.__ts_bids=JSON.parse(\"{}\");if(typeof window.__tsAdInit===\"function\")window.__tsAdInit();</script>",
+    escaped
+)
+
+// After
+format!(
+    "<script>(window.tsjs=window.tsjs||{{}}).bids=JSON.parse(\"{}\");if(typeof window.tsjs.adInit===\"function\")window.tsjs.adInit();</script>",
+    escaped
+)
+```
+
+Note: `{{}}` is the Rust format-string escape for a literal `{}`.
+
+Update any test assertions in `publisher.rs` that check for the old global names.
+
+- [ ] **Step 2: Update `gpt_bootstrap.js`**
+
+Replace all `window.__ts*` references. The bootstrap IIFE runs before the TS bundle, so it must initialise `window._ts` if absent:
+
+```js
+;(function () {
+  if (typeof window === 'undefined') return
+  // Initialise namespace; adInit guard prevents double-install.
+  var ts = (window._ts = window._ts || {})
+  if (ts.adInit) return
+
+  ts.adInit = function () {
+    var slots = ts.adSlots || []
+    var bids = ts.bids || {}
+    var divToSlotId = {}
+    googletag.cmd.push(function () {
+      var newSlots = []
+      slots.forEach(function (slot) {
+        var s = googletag.defineSlot(
+          slot.gam_unit_path,
+          slot.formats,
+          slot.div_id
+        )
+        if (!s) return
+        s.addService(googletag.pubads())
+        Object.entries(slot.targeting || {}).forEach(function (e) {
+          s.setTargeting(e[0], e[1])
+        })
+        var b = bids[slot.id] || {}
+        ;['hb_pb', 'hb_bidder', 'hb_adid'].forEach(function (k) {
+          if (b[k]) s.setTargeting(k, b[k])
+        })
+        s.setTargeting('ts_initial', '1')
+        divToSlotId[slot.div_id] = slot.id
+        newSlots.push(s)
+      })
+      ts.prevGptSlots = newSlots
+      ts.divToSlotId = divToSlotId
+      if (!ts.servicesEnabled) {
+        googletag.pubads().enableSingleRequest()
+        googletag.enableServices()
+        ts.servicesEnabled = true
+        googletag.pubads().addEventListener('slotRenderEnded', function (ev) {
+          var divId = ev.slot.getSlotElementId()
+          var slotId = (ts.divToSlotId || {})[divId]
+          if (!slotId) return
+          var b = (ts.bids || {})[slotId] || {}
+          var ourBidWon =
+            !ev.isEmpty &&
+            (b.hb_adid
+              ? ev.slot.getTargeting('hb_adid')[0] === b.hb_adid
+              : !!b.hb_bidder)
+          if (ourBidWon) {
+            if (b.nurl) navigator.sendBeacon(b.nurl)
+            if (b.burl) navigator.sendBeacon(b.burl)
+          }
+        })
+      }
+      if (newSlots.length > 0) {
+        googletag.pubads().refresh(newSlots)
+      }
+    })
+  }
+})()
+```
+
+- [ ] **Step 3: Update `index.ts` — rename `TsWindow` type**
+
+Replace the `TsWindow` interface:
+
+```typescript
+type TsNamespace = {
+  adSlots?: TsAdSlot[]
+  bids?: Record<string, TsBidData>
+  adInit?: () => void
+  prevGptSlots?: GoogleTagSlot[]
+  servicesEnabled?: boolean
+  divToSlotId?: Record<string, string>
+  spaHookInstalled?: boolean
+}
+
+type TsWindow = Window & {
+  _ts?: TsNamespace
+}
+```
+
+- [ ] **Step 4: Update `installTsAdInit` in `index.ts`**
+
+Update all properties to live under `window.tsjs`. Use `window.tsjs` directly:
+
+```typescript
+export function installTsAdInit(): void {
+  const w = window as TsWindow
+  const ts = (w._ts = w._ts ?? {})
+  ts.adInit = function () {
+    const slots = ts.adSlots ?? []
+    const bids = ts.bids ?? {}
+    const g = (window as GptWindow).googletag
+    if (!g) return
+
+    g.cmd?.push(() => {
+      if (ts.prevGptSlots && ts.prevGptSlots.length > 0) {
+        g.destroySlots?.(ts.prevGptSlots)
+        ts.prevGptSlots = []
+      }
+      const newSlots: GoogleTagSlot[] = []
+      const divToSlotId: Record<string, string> = {}
+
+      slots.forEach((slot) => {
+        const gptSlot = g.defineSlot?.(
+          slot.gam_unit_path,
+          slot.formats as Array<number | number[]>,
+          slot.div_id
+        )
+        if (!gptSlot) return
+        gptSlot.addService(g.pubads!())
+        Object.entries(slot.targeting ?? {}).forEach(([k, v]) =>
+          gptSlot.setTargeting(k, v)
+        )
+        const bid = bids[slot.id] ?? {}
+        ;(['hb_pb', 'hb_bidder', 'hb_adid'] as const).forEach((key) => {
+          if (bid[key]) gptSlot.setTargeting(key, bid[key]!)
+        })
+        gptSlot.setTargeting('ts_initial', '1')
+        divToSlotId[slot.div_id] = slot.id
+        newSlots.push(gptSlot)
+      })
+
+      ts.prevGptSlots = newSlots
+      ts.divToSlotId = divToSlotId
+
+      if (!ts.servicesEnabled) {
+        g.pubads!().enableSingleRequest()
+        g.enableServices?.()
+        ts.servicesEnabled = true
+        g.pubads!().addEventListener?.(
+          'slotRenderEnded',
+          (event: SlotRenderEndedEvent) => {
+            const divId: string = event.slot?.getSlotElementId?.() ?? ''
+            const slotId = (ts.divToSlotId ?? {})[divId]
+            if (!slotId) return
+            const bid = (ts.bids ?? {})[slotId] ?? {}
+            const ourBidWon =
+              !event.isEmpty &&
+              (bid.hb_adid
+                ? event.slot?.getTargeting?.('hb_adid')?.[0] === bid.hb_adid
+                : !!bid.hb_bidder)
+            if (ourBidWon) {
+              if (bid.nurl) navigator.sendBeacon(bid.nurl)
+              if (bid.burl) navigator.sendBeacon(bid.burl)
+            }
+          }
+        )
+      }
+      if (newSlots.length > 0) {
+        g.pubads!().refresh(newSlots)
+      }
+    })
+  }
+}
+```
+
+- [ ] **Step 5: Update `installSpaHook` in `index.ts`**
+
+Replace `__tsSpaHookInstalled` and `__ts_ad_slots`/`__ts_bids` reads:
+
+```typescript
+export function installSpaHook(): void {
+  const win = window as TsWindow
+  const ts = (win._ts = win._ts ?? {})
+  if (ts.spaHookInstalled) return
+  ts.spaHookInstalled = true
+  // ... rest of SPA hook logic uses ts.adSlots, ts.bids, ts.adInit
+}
+```
+
+- [ ] **Step 6: Update tests in `index.test.ts`**
+
+Find all test assertions that reference `window.__ts_ad_slots`, `window.__ts_bids`, `window.__tsAdInit`, etc. and update to `window.tsjs.adSlots`, `window.tsjs.bids`, `window.tsjs.adInit` etc.
+
+Run tests first to see what fails:
+
+```bash
+cd crates/js/lib && npx vitest run
+```
+
+Fix each failing assertion.
+
+- [ ] **Step 7: Run JS tests and format**
+
+```bash
+cd crates/js/lib && npx vitest run
+cd crates/js/lib && npm run format
+```
+
+Expected: all tests pass, no format errors.
+
+- [ ] **Step 8: Run Rust tests**
+
+```bash
+cargo test --workspace
+```
+
+Update any test assertions in `publisher.rs` that check for old global names (e.g. `script.contains("window.__ts_ad_slots")`).
+
+- [ ] **Step 9: Run clippy and fmt**
+
+```bash
+cargo fmt --all -- --check
+cargo clippy --workspace --all-targets --all-features -- -D warnings
+```
+
+- [ ] **Step 10: Commit**
+
+```bash
+git commit -m "Namespace window globals under window._ts"
+```
+
+---
+
+## Task 3: Fix `formats` type and extract `ts_initial` constant
+
+**What:** Two small TypeScript/JS cleanups. `TsAdSlot.formats` should be typed as `Array<[number, number]>` (tuple, not array-of-array) to match GPT's actual input. The string `'ts_initial'` is hardcoded in both `gpt_bootstrap.js` and `index.ts` — extract as a named constant in `index.ts` (no JS equivalent needed since the bootstrap is vanilla JS).
+
+**Files:**
+
+- Modify: `crates/js/lib/src/integrations/gpt/index.ts`
+- Modify: `crates/trusted-server-core/src/integrations/gpt_bootstrap.js` (comment only — JS can't share TS constants)
+
+**Steps:**
+
+- [ ] **Step 1: Fix `TsAdSlot.formats` type**
+
+In `index.ts`, change:
+
+```typescript
+// Before
+interface TsAdSlot {
+  ...
+  formats: Array<number[]>;
+}
+
+// After
+interface TsAdSlot {
+  ...
+  formats: Array<[number, number]>;
+}
+```
+
+Update the cast at the GPT `defineSlot` call site — `[number, number]` satisfies `number | number[]` so the cast can be removed or simplified:
+
+```typescript
+// Before
+slot.formats as Array<number | number[]>
+
+// After — [number, number][] already satisfies Array<number | number[]>
+slot.formats
+```
+
+- [ ] **Step 2: Extract `ts_initial` constant in `index.ts`**
+
+Near the top of `index.ts`, add:
+
+```typescript
+const TS_INITIAL_TARGETING_KEY = 'ts_initial'
+```
+
+Replace both occurrences of `'ts_initial'` in `installTsAdInit` with `TS_INITIAL_TARGETING_KEY`.
+
+Add a comment in `gpt_bootstrap.js` where `'ts_initial'` appears:
+
+```js
+// Keep in sync with TS_INITIAL_TARGETING_KEY in index.ts
+s.setTargeting('ts_initial', '1')
+```
+
+- [ ] **Step 3: Run JS tests and format**
+
+```bash
+cd crates/js/lib && npx vitest run
+cd crates/js/lib && npm run format
+```
+
+- [ ] **Step 4: Commit**
+
+```bash
+git commit -m "Fix TsAdSlot formats type and extract ts_initial constant"
+```
+
+---
+
+## Final verification
+
+- [ ] `cargo fmt --all -- --check`
+- [ ] `cargo clippy --workspace --all-targets --all-features -- -D warnings`
+- [ ] `cargo test --workspace`
+- [ ] `cd crates/js/lib && npx vitest run`
+- [ ] `cd crates/js/lib && npm run format`
+- [ ] `cd docs && npm run format`
diff --git a/docs/superpowers/plans/2026-05-29-prebid-creative-rendering-fix.md b/docs/superpowers/plans/2026-05-29-prebid-creative-rendering-fix.md
new file mode 100644
index 00000000..7a3f3420
--- /dev/null
+++ b/docs/superpowers/plans/2026-05-29-prebid-creative-rendering-fix.md
@@ -0,0 +1,760 @@
+# Prebid Creative Rendering Fix Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Fix `hb_adid` to carry the PBS Cache UUID (not the OpenRTB bid ID) so the Prebid Universal Creative in GAM can fetch and render the correct creative markup.
+
+**Architecture:** Three-file change: add `cache_id`/`cache_host`/`cache_path` fields to the shared `Bid` struct in `types.rs`, extract these from `ext.prebid.cache.bids` in `prebid.rs`'s `parse_bid`, then emit them as `hb_adid`/`hb_cache_host`/`hb_cache_path` in `publisher.rs`'s `build_bid_map`. `AuctionBid` in `prebid.rs` is a type alias for `Bid` (`use ... Bid as AuctionBid`), so only one struct needs the new fields.
+
+**Tech Stack:** Rust 2024, `serde`, `url` crate (already in workspace deps at v2.5.8), `cargo test --workspace`
+
+---
+
+## Context for all tasks
+
+- **Branch:** `fix/server-side-ad-template-entrypoint` (already checked out)
+- **Spec:** `docs/superpowers/specs/2026-05-29-prebid-creative-rendering-fix.md`
+- **Error handling:** `error-stack` (`Report<E>`), not anyhow. Use `expect("should ...")` not `unwrap()`.
+- **No `println!`/`eprintln!`** — use `log::` macros.
+- **All public items must have doc comments.**
+- CI gates: `cargo fmt --all -- --check`, `cargo clippy --workspace --all-targets --all-features -- -D warnings`, `cargo test --workspace`
+
+---
+
+## Task 1: Add cache fields to `Bid` struct and fix all construction sites
+
+**What:** Add three new `Option<String>` fields to `Bid`. Since Rust struct literals are exhaustive, every place that constructs a `Bid { ... }` in the codebase will fail to compile until the new fields are added. Fix all of them with `None` defaults (except the APS provider which constructs a real `Bid` — also `None` since APS doesn't use PBS Cache).
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/auction/types.rs:200` (after `ad_id` field)
+- Modify (test helpers/literals — add `None` fields):
+  - `crates/trusted-server-core/src/auction/types.rs:314` (`make_bid` helper)
+  - `crates/trusted-server-core/src/auction/types.rs:445` (inline `Bid` literal)
+  - `crates/trusted-server-core/src/publisher.rs:2616` (`make_bid` helper)
+  - `crates/trusted-server-core/src/publisher.rs:2714` (inline `Bid` literal)
+  - `crates/trusted-server-core/src/auction/orchestrator.rs:1121,1138,1278,1325,1358` (test `Bid` literals)
+  - `crates/trusted-server-core/src/integrations/aps.rs:442` (production `Bid` construction)
+
+**Steps:**
+
+- [ ] **Step 1: Add three fields to `Bid` struct in `types.rs`**
+
+  In `crates/trusted-server-core/src/auction/types.rs`, after line 200 (`pub ad_id: Option<String>,`), add:
+
+  ```rust
+  /// Prebid Cache UUID for this bid.
+  ///
+  /// Populated from `ext.prebid.cache.bids.cacheId` in the PBS response.
+  /// Used as `hb_adid` targeting value in `window._ts.bids`. `None` for
+  /// non-PBS providers (e.g., APS) and PBS bids without Prebid Cache enabled.
+  pub cache_id: Option<String>,
+  /// Prebid Cache host (e.g., `"openads.adsrvr.org"`).
+  ///
+  /// Populated from the host of `ext.prebid.cache.bids.url`. Used as
+  /// `hb_cache_host` targeting value. `None` when cache is absent.
+  pub cache_host: Option<String>,
+  /// Prebid Cache path (e.g., `"/cache"`).
+  ///
+  /// Populated from the path of `ext.prebid.cache.bids.url`. Used as
+  /// `hb_cache_path` targeting value. `None` when cache is absent.
+  pub cache_path: Option<String>,
+  ```
+
+- [ ] **Step 2: Verify compile fails as expected**
+
+  ```bash
+  cargo check --package trusted-server-core 2>&1 | grep "missing field"
+  ```
+
+  Expected: multiple errors about missing `cache_id`, `cache_host`, `cache_path` in `Bid` struct literals. This confirms every construction site will be found.
+
+- [ ] **Step 3: Fix `make_bid` helper in `types.rs` (line ~314)**
+
+  Add three `None` fields to the `Bid {}` literal inside the `make_bid` test helper:
+
+  ```rust
+  fn make_bid(bidder: &str) -> Bid {
+      Bid {
+          slot_id: "slot-1".to_string(),
+          price: Some(1.0),
+          currency: "USD".to_string(),
+          creative: None,
+          adomain: None,
+          bidder: bidder.to_string(),
+          width: 300,
+          height: 250,
+          nurl: None,
+          burl: None,
+          ad_id: None,
+          cache_id: None,
+          cache_host: None,
+          cache_path: None,
+          metadata: HashMap::new(),
+      }
+  }
+  ```
+
+- [ ] **Step 4: Fix inline `Bid` literal in `types.rs` (line ~445)**
+
+  Find the `Bid {` literal around line 445 in the test section of `types.rs`. Add:
+
+  ```rust
+  cache_id: None,
+  cache_host: None,
+  cache_path: None,
+  ```
+
+- [ ] **Step 5: Fix `make_bid` helper in `publisher.rs` (line ~2616)**
+
+  In the `make_bid` test helper function in `publisher.rs`, add to the `Bid {}` literal:
+
+  ```rust
+  cache_id: None,
+  cache_host: None,
+  cache_path: None,
+  ```
+
+- [ ] **Step 6: Fix inline `Bid` literal in `publisher.rs` (line ~2714)**
+
+  Find the `Bid {` literal around line 2714 in `publisher.rs` tests. Add:
+
+  ```rust
+  cache_id: None,
+  cache_host: None,
+  cache_path: None,
+  ```
+
+- [ ] **Step 7: Fix five `Bid` literals in `orchestrator.rs` (lines ~1121,1138,1278,1325,1358)**
+
+  Add to each of the five `Bid {}` literals in the test section of `orchestrator.rs`:
+
+  ```rust
+  cache_id: None,
+  cache_host: None,
+  cache_path: None,
+  ```
+
+- [ ] **Step 8: Fix APS production `Bid` construction in `aps.rs` (line ~442)**
+
+  In `aps.rs`, inside `parse_aps_response` (or wherever the `Ok(Bid { ... })` is around line 442), add:
+
+  ```rust
+  cache_id: None,
+  cache_host: None,
+  cache_path: None,
+  ```
+
+  APS does not use PBS Cache — these fields are intentionally `None` for APS bids.
+
+- [ ] **Step 9: Verify compile succeeds**
+
+  ```bash
+  cargo check --package trusted-server-core 2>&1 | grep -E "^error"
+  ```
+
+  Expected: no output (clean compile).
+
+- [ ] **Step 10: Run tests to confirm nothing regressed**
+
+  ```bash
+  cargo test --workspace 2>&1 | tail -5
+  ```
+
+  Expected: all tests pass.
+
+- [ ] **Step 11: Run clippy and fmt**
+
+  ```bash
+  cargo fmt --all
+  cargo clippy --workspace --all-targets --all-features -- -D warnings 2>&1 | tail -5
+  ```
+
+  Expected: clean.
+
+- [ ] **Step 12: Commit**
+
+  ```bash
+  git add crates/trusted-server-core/src/auction/types.rs \
+          crates/trusted-server-core/src/publisher.rs \
+          crates/trusted-server-core/src/auction/orchestrator.rs \
+          crates/trusted-server-core/src/integrations/aps.rs
+  git commit -m "Add cache_id, cache_host, cache_path fields to Bid struct"
+  ```
+
+---
+
+## Task 2: Extract PBS Cache fields in `prebid.rs` `parse_bid` + tests
+
+**What:** After extracting `ad_id` in `parse_bid`, extract `ext.prebid.cache.bids.cacheId` as `cache_id` and split `ext.prebid.cache.bids.url` into `cache_host` + `cache_path`. Populate all three new fields on the returned `AuctionBid`. Add TDD tests first.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/integrations/prebid.rs:1362–1391` (extraction + struct literal)
+- Test: `crates/trusted-server-core/src/integrations/prebid.rs` (test module near bottom)
+
+**Steps:**
+
+- [ ] **Step 1: Write the failing tests**
+
+  Find the `#[cfg(test)]` module in `prebid.rs`. Add these tests (they will fail because extraction doesn't exist yet):
+
+  ```rust
+  #[test]
+  fn parse_bid_extracts_cache_id_from_ext_prebid_cache_bids() {
+      // Real PBS response shape from auction_response.json
+      let bid_json = serde_json::json!({
+          "id": "bid-id-123",
+          "impid": "atf_sidebar_ad",
+          "price": 1.50,
+          "adm": "<div>ad</div>",
+          "w": 300,
+          "h": 250,
+          "ext": {
+              "prebid": {
+                  "cache": {
+                      "bids": {
+                          "url": "https://openads.adsrvr.org/cache?uuid=f47447a0-b759-4f2f-9887-af458b79b570",
+                          "cacheId": "f47447a0-b759-4f2f-9887-af458b79b570"
+                      }
+                  }
+              }
+          }
+      });
+      let provider = PrebidAuctionProvider::new(base_config());
+      let bid = provider
+          .parse_bid(&bid_json, "thetradedesk")
+          .expect("should parse bid");
+      assert_eq!(
+          bid.cache_id.as_deref(),
+          Some("f47447a0-b759-4f2f-9887-af458b79b570"),
+          "should extract cacheId as cache_id"
+      );
+      assert_eq!(
+          bid.cache_host.as_deref(),
+          Some("openads.adsrvr.org"),
+          "should extract host from cache URL"
+      );
+      assert_eq!(
+          bid.cache_path.as_deref(),
+          Some("/cache"),
+          "should extract path from cache URL"
+      );
+  }
+
+  #[test]
+  fn parse_bid_sets_cache_fields_to_none_when_no_cache_entry() {
+      let bid_json = serde_json::json!({
+          "id": "bid-id-456",
+          "impid": "atf_sidebar_ad",
+          "price": 0.50,
+          "w": 300,
+          "h": 250
+          // no ext.prebid.cache
+      });
+      let provider = PrebidAuctionProvider::new(base_config());
+      let bid = provider
+          .parse_bid(&bid_json, "appnexus")
+          .expect("should parse bid");
+      assert!(bid.cache_id.is_none(), "should be None when cache absent");
+      assert!(bid.cache_host.is_none(), "should be None when cache absent");
+      assert!(bid.cache_path.is_none(), "should be None when cache absent");
+  }
+
+  #[test]
+  fn parse_bid_handles_malformed_cache_url_gracefully() {
+      let bid_json = serde_json::json!({
+          "id": "bid-id-789",
+          "impid": "atf_sidebar_ad",
+          "price": 0.50,
+          "w": 300,
+          "h": 250,
+          "ext": {
+              "prebid": {
+                  "cache": {
+                      "bids": {
+                          "url": "not-a-valid-url",
+                          "cacheId": "some-uuid"
+                      }
+                  }
+              }
+          }
+      });
+      let provider = PrebidAuctionProvider::new(base_config());
+      let bid = provider
+          .parse_bid(&bid_json, "appnexus")
+          .expect("should parse bid without panicking");
+      assert_eq!(
+          bid.cache_id.as_deref(),
+          Some("some-uuid"),
+          "should still extract cacheId even if URL is malformed"
+      );
+      assert!(bid.cache_host.is_none(), "should be None when URL parse fails");
+      assert!(bid.cache_path.is_none(), "should be None when URL parse fails");
+  }
+
+  #[test]
+  fn parse_bid_preserves_ad_id_alongside_cache_id() {
+      let bid_json = serde_json::json!({
+          "id": "bid-impression-id",
+          "impid": "atf_sidebar_ad",
+          "adid": "bidder-ad-id-abc",
+          "price": 1.0,
+          "w": 300,
+          "h": 250,
+          "ext": {
+              "prebid": {
+                  "cache": {
+                      "bids": {
+                          "url": "https://cache.example.com/cache",
+                          "cacheId": "cache-uuid-xyz"
+                      }
+                  }
+              }
+          }
+      });
+      let provider = PrebidAuctionProvider::new(base_config());
+      let bid = provider
+          .parse_bid(&bid_json, "appnexus")
+          .expect("should parse bid");
+      assert_eq!(
+          bid.ad_id.as_deref(),
+          Some("bidder-ad-id-abc"),
+          "should keep ad_id from adid field"
+      );
+      assert_eq!(
+          bid.cache_id.as_deref(),
+          Some("cache-uuid-xyz"),
+          "should extract cache UUID separately"
+      );
+  }
+  ```
+
+  Note: `base_config()` and `PrebidAuctionProvider::new()` are the standard test construction pattern used throughout the existing `prebid.rs` test module. `parse_bid` is a private method but is accessible from the `#[cfg(test)]` module in the same file.
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+  ```bash
+  cargo test --package trusted-server-core parse_bid_extracts_cache_id 2>&1 | tail -15
+  ```
+
+  Expected: compile error (`no field 'cache_id' on type 'Bid'`) or test failure. Either confirms the extraction code is missing.
+
+- [ ] **Step 3: Add cache extraction to `parse_bid` in `prebid.rs`**
+
+  In `parse_bid` (around line 1362), after the `ad_id` extraction block and before the `Ok(AuctionBid { ... })`, add:
+
+  ```rust
+  // Extract PBS Cache coordinates from ext.prebid.cache.bids.
+  // The Prebid Universal Creative uses cacheId as hb_adid and the host/path
+  // to construct the fetch URL: https://<host><path>?uuid=<cacheId>
+  let cache_entry = bid_obj
+      .get("ext")
+      .and_then(|e| e.get("prebid"))
+      .and_then(|p| p.get("cache"))
+      .and_then(|c| c.get("bids"));
+
+  let cache_id = cache_entry
+      .and_then(|c| c.get("cacheId"))
+      .and_then(|v| v.as_str())
+      .map(String::from);
+
+  let (cache_host, cache_path) = cache_entry
+      .and_then(|c| c.get("url"))
+      .and_then(|v| v.as_str())
+      .and_then(|url_str| {
+          url::Url::parse(url_str)
+              .map_err(|e| log::debug!("PBS cache URL parse failed: {e}"))
+              .ok()
+      })
+      .map(|u| {
+          let host = u.host_str().map(String::from);
+          let path = u.path().to_string();
+          let path = if path.is_empty() || path == "/" {
+              None
+          } else {
+              Some(path)
+          };
+          (host, path)
+      })
+      .unwrap_or((None, None));
+
+  if cache_id.is_some() && cache_host.is_none() {
+      log::warn!(
+          "PBS bid has cache UUID but cache URL could not be parsed — \
+           creative will fail to render for slot '{slot_id}'"
+      );
+  }
+  ```
+
+  Then add the three fields to the `Ok(AuctionBid { ... })` struct literal (around line 1377):
+
+  ```rust
+  Ok(AuctionBid {
+      slot_id,
+      price: Some(price),
+      currency: DEFAULT_CURRENCY.to_string(),
+      creative,
+      adomain,
+      bidder: seat.to_string(),
+      width,
+      height,
+      nurl,
+      burl,
+      ad_id,
+      cache_id,
+      cache_host,
+      cache_path,
+      metadata: std::collections::HashMap::new(),
+  })
+  ```
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+  ```bash
+  cargo test --package trusted-server-core parse_bid 2>&1 | tail -20
+  ```
+
+  Expected: all 4 new tests pass.
+
+- [ ] **Step 5: Run full test suite**
+
+  ```bash
+  cargo test --workspace 2>&1 | tail -5
+  ```
+
+  Expected: all tests pass.
+
+- [ ] **Step 6: Run clippy and fmt**
+
+  ```bash
+  cargo fmt --all
+  cargo clippy --workspace --all-targets --all-features -- -D warnings 2>&1 | tail -5
+  ```
+
+  Expected: clean. If clippy warns about the `log::debug!` return value being unused inside `map_err`, suppress with `let _ = ...` or restructure.
+
+- [ ] **Step 7: Commit**
+
+  ```bash
+  git add crates/trusted-server-core/src/integrations/prebid.rs
+  git commit -m "Extract PBS Cache UUID and endpoint from bid ext into Bid fields"
+  ```
+
+---
+
+## Task 3: Emit cache fields in `build_bid_map` + update tests
+
+**What:** Change `build_bid_map` to use `bid.cache_id` for `hb_adid` (falling back to `bid.ad_id` for APS/other providers), and emit `hb_cache_host`/`hb_cache_path` when present. Update the existing `bid_map_includes_nurl_and_burl` test (which currently passes `"abc123"` as `ad_id` and asserts `hb_adid = "abc123"`) to use a cache-based bid. Add new tests covering cache fields and fallback path.
+
+**Files:**
+
+- Modify: `crates/trusted-server-core/src/publisher.rs:1311–1342` (`build_bid_map`)
+- Modify: `crates/trusted-server-core/src/publisher.rs:2608–2630` (`make_bid` helper — add cache params)
+- Modify: `crates/trusted-server-core/src/publisher.rs:2666–2707` (existing `bid_map_includes_nurl_and_burl` test)
+- Test: `crates/trusted-server-core/src/publisher.rs` (new tests in the existing test module)
+
+**Steps:**
+
+- [ ] **Step 1: Write new failing tests for cache field emission**
+
+  Add these tests to the `#[cfg(test)]` module in `publisher.rs`, near the existing `bid_map_includes_nurl_and_burl` test:
+
+  ```rust
+  #[test]
+  fn bid_map_uses_cache_id_for_hb_adid_when_present() {
+      let mut winning_bids = HashMap::new();
+      winning_bids.insert(
+          "atf_sidebar_ad".to_string(),
+          Bid {
+              slot_id: "atf_sidebar_ad".to_string(),
+              price: Some(1.50),
+              currency: "USD".to_string(),
+              creative: None,
+              adomain: None,
+              bidder: "thetradedesk".to_string(),
+              width: 300,
+              height: 250,
+              nurl: None,
+              burl: None,
+              ad_id: Some("bid-impression-id".to_string()),
+              cache_id: Some("f47447a0-b759-4f2f-9887-af458b79b570".to_string()),
+              cache_host: Some("openads.adsrvr.org".to_string()),
+              cache_path: Some("/cache".to_string()),
+              metadata: Default::default(),
+          },
+      );
+      let map = build_bid_map(&winning_bids, PriceGranularity::Dense);
+      let obj = map
+          .get("atf_sidebar_ad")
+          .expect("should have entry")
+          .as_object()
+          .expect("should be object");
+
+      assert_eq!(
+          obj.get("hb_adid").and_then(|v| v.as_str()),
+          Some("f47447a0-b759-4f2f-9887-af458b79b570"),
+          "should use cache_id for hb_adid, not ad_id"
+      );
+      assert_eq!(
+          obj.get("hb_cache_host").and_then(|v| v.as_str()),
+          Some("openads.adsrvr.org"),
+          "should emit hb_cache_host"
+      );
+      assert_eq!(
+          obj.get("hb_cache_path").and_then(|v| v.as_str()),
+          Some("/cache"),
+          "should emit hb_cache_path"
+      );
+  }
+
+  #[test]
+  fn bid_map_falls_back_to_ad_id_when_cache_id_absent() {
+      let mut winning_bids = HashMap::new();
+      winning_bids.insert(
+          "atf_sidebar_ad".to_string(),
+          Bid {
+              slot_id: "atf_sidebar_ad".to_string(),
+              price: Some(0.50),
+              currency: "USD".to_string(),
+              creative: None,
+              adomain: None,
+              bidder: "aps-amazon".to_string(),
+              width: 300,
+              height: 250,
+              nurl: None,
+              burl: None,
+              ad_id: Some("aps-bid-token".to_string()),
+              cache_id: None,
+              cache_host: None,
+              cache_path: None,
+              metadata: Default::default(),
+          },
+      );
+      let map = build_bid_map(&winning_bids, PriceGranularity::Dense);
+      let obj = map
+          .get("atf_sidebar_ad")
+          .expect("should have entry")
+          .as_object()
+          .expect("should be object");
+
+      assert_eq!(
+          obj.get("hb_adid").and_then(|v| v.as_str()),
+          Some("aps-bid-token"),
+          "should fall back to ad_id when cache_id absent"
+      );
+      assert!(
+          obj.get("hb_cache_host").is_none(),
+          "should not emit hb_cache_host when absent"
+      );
+      assert!(
+          obj.get("hb_cache_path").is_none(),
+          "should not emit hb_cache_path when absent"
+      );
+  }
+
+  #[test]
+  fn bid_map_omits_hb_adid_when_both_cache_id_and_ad_id_absent() {
+      let mut winning_bids = HashMap::new();
+      winning_bids.insert(
+          "atf_sidebar_ad".to_string(),
+          Bid {
+              slot_id: "atf_sidebar_ad".to_string(),
+              price: Some(0.50),
+              currency: "USD".to_string(),
+              creative: None,
+              adomain: None,
+              bidder: "amazon-aps".to_string(),
+              width: 300,
+              height: 250,
+              nurl: None,
+              burl: None,
+              ad_id: None,
+              cache_id: None,
+              cache_host: None,
+              cache_path: None,
+              metadata: Default::default(),
+          },
+      );
+      let map = build_bid_map(&winning_bids, PriceGranularity::Dense);
+      let obj = map
+          .get("atf_sidebar_ad")
+          .expect("should have entry")
+          .as_object()
+          .expect("should be object");
+
+      assert!(
+          obj.get("hb_adid").is_none(),
+          "should omit hb_adid when no cache_id and no ad_id"
+      );
+  }
+  ```
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+  ```bash
+  cargo test --package trusted-server-core bid_map_uses_cache_id 2>&1 | tail -15
+  ```
+
+  Expected: test fails — `hb_adid` returns `"bid-impression-id"` (the wrong value) instead of the cache UUID, and `hb_cache_host`/`hb_cache_path` are not emitted.
+
+- [ ] **Step 3: Update `build_bid_map` in `publisher.rs`**
+
+  Replace the current `hb_adid` emission block (lines ~1326–1331) and the `nurl`/`burl` block with:
+
+  ```rust
+  // hb_adid: PBS Cache UUID when present (Prebid Universal Creative uses this
+  // as the cache lookup key). Falls back to ad_id for APS and other non-PBS
+  // providers. Note: ad_id (OpenRTB bid ID) is NOT the same as the cache UUID.
+  let hb_adid = bid.cache_id.as_deref().or(bid.ad_id.as_deref());
+  if let Some(id) = hb_adid {
+      obj.insert(
+          "hb_adid".to_string(),
+          serde_json::Value::String(id.to_string()),
+      );
+  }
+
+  // Cache endpoint coordinates — only present for PBS bids with Prebid Cache.
+  // The Prebid Universal Creative constructs:
+  //   https://<hb_cache_host><hb_cache_path>?uuid=<hb_adid>
+  if let Some(ref host) = bid.cache_host {
+      obj.insert(
+          "hb_cache_host".to_string(),
+          serde_json::Value::String(host.clone()),
+      );
+  }
+  if let Some(ref path) = bid.cache_path {
+      obj.insert(
+          "hb_cache_path".to_string(),
+          serde_json::Value::String(path.clone()),
+      );
+  }
+
+  if let Some(ref nurl) = bid.nurl {
+      obj.insert("nurl".to_string(), serde_json::Value::String(nurl.clone()));
+  }
+  if let Some(ref burl) = bid.burl {
+      obj.insert("burl".to_string(), serde_json::Value::String(burl.clone()));
+  }
+  ```
+
+- [ ] **Step 4: Update the existing `bid_map_includes_nurl_and_burl` test**
+
+  The existing test at line ~2666 constructs a bid via `make_bid("atf_sidebar_ad", 1.50, "kargo", "abc123", ...)` and asserts `hb_adid = "abc123"`. Update `make_bid` to accept optional `cache_id`, `cache_host`, `cache_path`, OR create a separate variant. The simplest fix: update the assertion in the existing test to reflect the new priority logic.
+
+  The test currently passes `ad_id = "abc123"` and `cache_id = None`. After the fix, `hb_adid` should still be `"abc123"` (fallback path). So the existing assertion is correct — just verify it still passes. No change needed to that test body. Just update `make_bid` to set the new fields to `None`:
+
+  ```rust
+  fn make_bid(
+      slot_id: &str,
+      price: f64,
+      bidder: &str,
+      ad_id: &str,
+      nurl: &str,
+      burl: &str,
+  ) -> Bid {
+      Bid {
+          slot_id: slot_id.to_string(),
+          price: Some(price),
+          currency: "USD".to_string(),
+          creative: None,
+          adomain: None,
+          bidder: bidder.to_string(),
+          width: 300,
+          height: 250,
+          nurl: Some(nurl.to_string()),
+          burl: Some(burl.to_string()),
+          ad_id: Some(ad_id.to_string()),
+          cache_id: None,
+          cache_host: None,
+          cache_path: None,
+          metadata: Default::default(),
+      }
+  }
+  ```
+
+  Also update the assertion comment at line ~2694 from `"should include ad_id"` to `"should fall back to ad_id when no cache_id"`.
+
+- [ ] **Step 5: Run all new tests**
+
+  ```bash
+  cargo test --package trusted-server-core bid_map 2>&1 | tail -20
+  ```
+
+  Expected: all `bid_map_*` tests pass, including both new and existing.
+
+- [ ] **Step 6: Add round-trip serialization test for `Bid`**
+
+  Add this test to the `#[cfg(test)]` module in `types.rs`:
+
+  ```rust
+  #[test]
+  fn bid_with_cache_fields_round_trips_through_json() {
+      let bid = Bid {
+          slot_id: "atf".to_string(),
+          price: Some(1.50),
+          currency: "USD".to_string(),
+          creative: None,
+          adomain: None,
+          bidder: "thetradedesk".to_string(),
+          width: 300,
+          height: 250,
+          nurl: None,
+          burl: None,
+          ad_id: Some("bid-id".to_string()),
+          cache_id: Some("cache-uuid".to_string()),
+          cache_host: Some("cache.example.com".to_string()),
+          cache_path: Some("/pbc/v1/cache".to_string()),
+          metadata: HashMap::new(),
+      };
+      let json = serde_json::to_string(&bid).expect("should serialize Bid");
+      let restored: Bid = serde_json::from_str(&json).expect("should deserialize Bid");
+      assert_eq!(restored.cache_id.as_deref(), Some("cache-uuid"), "should round-trip cache_id");
+      assert_eq!(restored.cache_host.as_deref(), Some("cache.example.com"), "should round-trip cache_host");
+      assert_eq!(restored.cache_path.as_deref(), Some("/pbc/v1/cache"), "should round-trip cache_path");
+  }
+  ```
+
+  Run:
+
+  ```bash
+  cargo test --package trusted-server-core bid_with_cache_fields_round_trips 2>&1 | tail -5
+  ```
+
+  Expected: PASS.
+
+- [ ] **Step 7: Run full CI suite**
+
+  ```bash
+  cargo test --workspace 2>&1 | tail -5
+  cargo fmt --all -- --check
+  cargo clippy --workspace --all-targets --all-features -- -D warnings 2>&1 | tail -5
+  ```
+
+  Expected: all pass, no warnings.
+
+- [ ] **Step 8: Commit**
+
+  ```bash
+  git add crates/trusted-server-core/src/publisher.rs \
+          crates/trusted-server-core/src/auction/types.rs
+  git commit -m "Emit hb_adid from PBS Cache UUID and add hb_cache_host/hb_cache_path to bid map"
+  ```
+
+---
+
+## Final verification
+
+- [ ] Run `cargo test --workspace` — all pass
+- [ ] Run `cargo clippy --workspace --all-targets --all-features -- -D warnings` — clean
+- [ ] Run `cargo fmt --all -- --check` — clean
+- [ ] In browser devtools after deploy: `window._ts.bids` shows `hb_cache_host`, `hb_cache_path`, and `hb_adid` matching the UUID in `ext.prebid.cache.bids.cacheId` from the raw PBS response
+
+---
+
+## Rollout reminder (from spec §8)
+
+1. TS: this branch deployed
+2. GAM: ad ops updates Prebid line item creatives to server-side cache-fetch variant (see spec §4.6)
+3. PBS: Prebid Cache already enabled (confirmed from real response)
+4. Verify in devtools
diff --git a/docs/superpowers/specs/2026-04-15-server-side-ad-templates-design.md b/docs/superpowers/specs/2026-04-15-server-side-ad-templates-design.md
new file mode 100644
index 00000000..8617ef87
--- /dev/null
+++ b/docs/superpowers/specs/2026-04-15-server-side-ad-templates-design.md
@@ -0,0 +1,1198 @@
+# Server-Side Ad Templates Design
+
+_Author · 2026-04-15_
+_Revised · 2026-05-04 (body-injection rework)_
+
+---
+
+## 1. Problem Statement
+
+Today's display ad pipeline on most publisher sites is structurally sequential and
+browser-bound:
+
+1. Page HTML arrives at browser
+2. Prebid.js (~300KB) downloads and parses
+3. Smart Slots SDK scans the DOM to discover ad placements
+4. `addAdUnits()` registers slot definitions
+5. Prebid auction fires from the browser (~80–150ms RTT to SSPs)
+6. Bids return (~1,000–1,500ms window)
+7. GPT `setTargeting()` + `refresh()` fires
+8. GAM creative renders
+
+**Total time to ad visible: ~3,100ms.**
+
+The browser is the slowest possible place to run an auction. It must first download and
+parse multiple SDKs, scan the DOM to discover what ad slots exist, and then fire SSP
+requests over a consumer internet connection with high and variable latency.
+
+Trusted Server sits at the Fastly edge — milliseconds from the user, with
+data-center-to-data-center RTT to Prebid Server (~20–30ms vs ~80–150ms from a browser).
+The server knows, from the request URL alone, exactly which ad slots are available on any
+given page. There is no reason to wait for the browser.
+
+---
+
+## 2. Goal
+
+Enable Trusted Server to:
+
+1. Match an incoming page request URL against a set of pre-configured slot templates.
+2. Immediately fire the full server-side auction (all providers: PBS, APS, future
+   wrappers) in parallel with the origin HTML fetch — before the browser receives a
+   single byte.
+3. Inject GPT slot definitions into `<head>` so the client can define slots without any
+   SDK.
+4. Inject the auction result inline before `</body>`, so bids and HTML travel together
+   in a single response. The auction runs in parallel with origin fetch and body
+   streaming; the close-of-body tag is held only until the auction completes or
+   `A_deadline` fires, whichever is first. **FCP is unaffected** — body content above
+   `</body>` has already streamed and painted by the time the close tag is held.
+5. Eliminate Prebid.js from the page-load critical path. A stripped-down Prebid bundle
+   (_slim-Prebid_) is lazy-loaded post-`window.load` to handle scroll/refresh auctions
+   and to run userID modules that enrich the EC identity graph for the next request.
+
+**Target time to ad visible: ~870ms (cache hit) / ~1,020ms (cache miss). FCP unchanged
+from a no-TS baseline.** Net saving on ad-visible: ~2,200–2,400ms vs today, compounded
+across every navigation in the user's clickstream rather than once per session.
+
+> **Note:** The latency numbers in this document are modeled estimates based on known
+> edge→PBS RTT ranges and typical origin response times. They should be validated with
+> production measurements after Phase 1 ships. Quantitative claims in §6 are tagged with
+> the assumptions they depend on.
+
+---
+
+## 3. Non-Goals
+
+- Eliminating client-side GPT / Google Ad Manager — GAM remains in the rendering
+  pipeline. The GAM call (`securepubads.g.doubleclick.net`) moving server-side is
+  aspirational, contingent on Google agreement, and is not committed for any phase
+  (see §9.6).
+- Eliminating Prebid entirely — a stripped-down Prebid bundle (_slim-Prebid_) is
+  lazy-loaded post-`window.load` to handle scroll/refresh auctions and userID
+  enrichment. **TS owns the first impression; Prebid owns subsequent refresh
+  auctions.**
+- Dynamic slot discovery (reading the DOM) — this design commits to pre-defined,
+  URL-matched slot templates. Smart Slots' dynamic injection behavior is replaced by
+  server knowledge.
+- Changing the `AuctionOrchestrator` internally — the orchestrator already handles
+  parallel provider fan-out. This design adds a new trigger point, not new auction
+  logic.
+- A separate `/ts-bids` endpoint — an earlier revision of this spec proposed a fetch
+  endpoint backed by an in-process `bid_cache`. That design was rejected because
+  in-process caches don't survive Fastly Compute's per-request Wasm isolate model:
+  isolates are not pinned across requests, and there is no documented contract for
+  cross-request shared state. Body-injection achieves the same FCP property with a
+  single response and no shared-state requirement.
+
+---
+
+## 4. Architecture
+
+### 4.1 Slot configuration in `trusted-server.toml`
+
+Slot templates live in `trusted-server.toml` under `[[creative_opportunities.slot]]`
+(consolidated from the original `creative-opportunities.toml`). Each entry holds page
+pattern matching rules, ad formats, floor prices, GAM targeting key-values, and
+per-provider bidder params. PBS bidder-level params (placement IDs, account IDs) live
+in Prebid Server stored requests, keyed by slot ID. APS params are specified inline per
+slot under `[slot.providers.aps]`.
+
+Loaded at build time via `include_str!()` and compiled into the WASM binary. Slot
+changes require a redeploy; this is intentional (fast reads, no KV overhead, no
+per-request cost). A migration path to KV-backed config is tracked in §9.5.
+
+`floor_price` is the publisher-owned hard floor per slot — the source of truth for the
+minimum acceptable bid price, enforced at the edge before bids reach the ad server. Any
+bid below the floor is discarded at the orchestrator level before it enters `tsjs.bids`.
+SSPs may apply their own dynamic floors independently within their platforms; this floor
+is the publisher's baseline that supersedes all other floor logic by virtue of being
+enforced earliest in the pipeline.
+
+#### Top-level config (in `trusted-server.toml`)
+
+```toml
+[creative_opportunities]
+# GAM network ID used to construct default ad-unit paths.
+gam_network_id = "21765378893"
+
+# Optional. Defaults to [auction].timeout_ms if not set.
+# Recommended: 500ms (vs client-side 1000–1500ms) due to lower edge→PBS RTT.
+# This value is also the upper bound on the </body>-close hold; once A_deadline
+# fires, TS injects an empty tsjs.bids and emits </body> regardless.
+auction_timeout_ms = 500
+
+# Granularity table for hb_pb price bucket strings.
+# Options: "low" | "medium" | "high" | "auto" | "dense" | "custom"
+# Defaults to "dense" if not set.
+price_granularity = "dense"
+```
+
+#### `[creative_opportunities]` schema
+
+```toml
+[[slot]]
+id = "atf_sidebar_ad"
+# Optional. Defaults to "/{gam_network_id}/{id}".
+# Override for non-standard GAM ad-unit paths.
+gam_unit_path = "/21765378893/publisher/atf-sidebar"
+# Optional. DOM container element ID. Defaults to slot id.
+div_id = "div-atf-sidebar"
+page_patterns = ["/20**"]
+formats = [{ width = 300, height = 250 }]
+floor_price = 0.50
+
+[slot.targeting]
+pos = "atf"
+zone = "atfSidebar"
+
+[slot.providers.aps]
+slot_id = "aps-slot-atf-sidebar"
+
+[[slot]]
+id = "below-content-ad"
+page_patterns = ["/20**"]
+formats = [{ width = 300, height = 250 }, { width = 728, height = 90 }]
+floor_price = 0.25
+
+[slot.targeting]
+pos = "btf"
+zone = "belowContent"
+
+[slot.providers.aps]
+slot_id = "aps-slot-below-content"
+
+[[slot]]
+id = "ad-homepage-0"
+page_patterns = ["/", "/index.html"]
+formats = [{ width = 970, height = 250 }, { width = 728, height = 90 }]
+floor_price = 1.00
+
+[slot.targeting]
+pos = "atf"
+zone = "homepage"
+slot_index = "0"
+
+[slot.providers.aps]
+slot_id = "aps-slot-homepage-0"
+```
+
+#### Rust types
+
+```rust
+#[derive(Debug, Clone, serde::Deserialize)]
+pub struct CreativeOpportunitiesConfig {
+    pub gam_network_id: String,
+    #[serde(default = "default_auction_timeout_ms")]
+    pub auction_timeout_ms: Option<u32>,
+    #[serde(default = "PriceGranularity::dense")]
+    pub price_granularity: PriceGranularity,
+}
+
+#[derive(Debug, Clone, serde::Deserialize)]
+pub struct CreativeOpportunitySlot {
+    pub id: String,
+    pub gam_unit_path: Option<String>,   // defaults to /{gam_network_id}/{id}
+    pub div_id: Option<String>,           // defaults to id
+    pub page_patterns: Vec<String>,
+    pub formats: Vec<CreativeOpportunityFormat>,
+    pub floor_price: Option<f64>,
+    #[serde(default)]
+    pub targeting: HashMap<String, String>, // strings only — validated at startup
+    #[serde(default)]
+    pub providers: SlotProviders,
+}
+
+/// Separate from auction::AdFormat so media_type can default to Banner
+/// without requiring it in the TOML. Converted to AdFormat at auction time.
+#[derive(Debug, Clone, serde::Deserialize)]
+pub struct CreativeOpportunityFormat {
+    pub width: u32,
+    pub height: u32,
+    #[serde(default = "MediaType::banner")]
+    pub media_type: MediaType,
+}
+
+#[derive(Debug, Clone, Default, serde::Deserialize)]
+pub struct SlotProviders {
+    pub aps: Option<ApsSlotParams>,
+}
+
+#[derive(Debug, Clone, serde::Deserialize)]
+pub struct ApsSlotParams {
+    pub slot_id: String,
+}
+```
+
+> **Targeting value types:** `targeting` values are `String`-only (not
+> `serde_json::Value`). GPT's `setTargeting()` only accepts `string | string[]`;
+> non-string values are silently dropped by the browser. Validated at startup — a
+> non-string targeting value is a startup error.
+
+> **Slot ID validation:** Slot IDs are validated at startup against a strict allowlist
+> (`[A-Za-z0-9_-]+`). IDs outside this set fail startup. This prevents XSS via crafted
+> IDs appearing in the injected `<script>` block.
+
+### 4.2 URL Pattern Matching
+
+At request time, TS matches the request path against each slot's `page_patterns`.
+Patterns use the `glob` crate (WASM-compatible):
+
+- `/20**` — matches all date-prefixed article paths (e.g., `/2024/01/my-article/`). Note:
+  `**` matches across path separators; `*` stops at `/`. Use `**` for multi-segment
+  patterns.
+- `/` — matches the homepage exactly
+- `/index.html` — exact match
+
+Multiple slots can match a single URL. All matching slots are collected and fed into a
+single auction as separate impressions. Pattern matching is purely in-memory against the
+pre-parsed config — sub-millisecond. The pattern-match cost is O(slots × patterns);
+startup logs the compiled pattern count.
+
+### 4.3 Auction Trigger and the Bounded Body-End Hold
+
+#### Async restructuring of the publisher path
+
+The current `handle_publisher_request` is a synchronous `fn`. Running the auction in
+parallel with the origin fetch requires:
+
+1. Converting `handle_publisher_request` to `async fn`
+2. Switching the origin fetch from blocking `.send()` to `.send_async()` (returns
+   `PlatformPendingRequest`)
+3. Adding `orchestrator: &AuctionOrchestrator` as a parameter
+4. Awaiting both the auction future and the pending origin request
+
+This is an explicit structural change to the publisher request path. It is listed in §7
+as a required migration, not a minor modification.
+
+#### Auction-eligibility gating
+
+Auctions fire on **real first-page-load impressions only**, not on every TS-matched
+request. Before firing, TS gates on:
+
+- **Consent** — TCF Purpose 1 (storage access) is the minimum. If consent is absent or
+  denied, no auction. The page renders normally; GAM falls back to its own auction.
+- **Bot / crawler User-Agent** — well-known crawler UAs (Googlebot, Bingbot,
+  AhrefsBot, etc.) skip the auction. SSP QPS budgets are finite; burning them on
+  crawler hits is a real cost.
+- **Prefetch hints** — requests carrying `Sec-Purpose: prefetch` or `Purpose: prefetch`
+  skip the auction. Avoids spending auction inventory on speculative navigations that
+  may never paint.
+- **Method** — only `GET` requests trigger auctions. `HEAD` requests skip.
+- **Slot match** — at least one slot in `[creative_opportunities]` (in `trusted-server.toml`) must match the
+  request path. Empty match = no auction.
+
+Skipped auctions emit no `tsjs.bids` and let the page proceed unmodified by the ad
+stack. Skipped requests still benefit from the EC cookie set / KV identity update
+paths that run independently of the auction.
+
+#### Consent and EC ID
+
+Before firing the auction, TS reads consent signals and the EC ID from the incoming
+page request. EC ID resolution → KV lookup → enriched EID set retrieval is part of the
+existing EC pipeline and is the load-bearing identity input to the auction (see §4.8).
+
+Consent gating:
+
+- If consent is **absent or denied** (no TCF consent string, or purpose 1 not consented):
+  the auction is not fired. `tsjs.bids` is omitted from the page. GPT falls back to its
+  own auction. This is treated as a first-class edge case in §8.
+- **Mid-page consent revocation** is out of scope for Phase 1; bids already injected
+  remain. Phase 2 will address consent event propagation.
+
+#### Auction execution
+
+When the gates above are satisfied, TS calls `AuctionOrchestrator::run_auction()` with
+the matched slots converted to `AdSlot` objects, decorated with `user.eids` from the
+EC graph. This happens at request receipt time, in parallel with the origin fetch via
+`send_async()`.
+
+The orchestrator's existing behavior is unchanged:
+
+- All providers (PBS, APS) are dispatched simultaneously
+- Per-provider timeout budgets are enforced from the remaining auction deadline
+  (`creative_opportunities.auction_timeout_ms`, falling back to `[auction].timeout_ms`)
+- Floor price filtering, bid unification, and winning bid selection are applied as today
+- PBS resolves bidder params from its stored requests by slot ID
+- APS bidder params are read from `[slot.providers.aps]` in `trusted-server.toml`
+
+#### The bounded `</body>` hold
+
+Bids are injected into the page inline before `</body>`. This requires holding the
+close-of-body tag until the auction completes. The hold is **bounded by `A_deadline`**
+and **invisible to FCP** because all body content above `</body>` has already streamed
+and painted by the time the close tag is held.
+
+**Timing definitions:**
+
+- `T₀` = request receipt at the edge
+- `A_deadline` = `T₀ + auction_timeout_ms`
+- `origin_drain_time` = wall-clock when the origin response (or its `</body>` chunk in
+  the streaming case) reaches the edge
+
+**Body-close emission time:**
+
+```
+body_close_emit_time = max(origin_drain_time, min(A_deadline, auction_complete_time))
+```
+
+In English:
+
+- If the auction completes before origin drains: body close tag flushes when origin
+  emits it, with bid data injected. **No hold.** Typical cache-hit path where origin is
+  ~5ms and auction is ~500ms — the auction is the long pole, but it has already
+  finished by the time we need it because we waited for origin too.
+- If origin drains before the auction completes: body close held until either auction
+  completes or `A_deadline` fires. Hold is bounded by `A_deadline`.
+- If `A_deadline` fires first: TS injects `tsjs.bids = {}` (graceful no-bid fallback)
+  and emits the close tag. GPT proceeds without bid targeting; GAM runs its own auction.
+  This is the **soft inner deadline watchdog** — auction overrun never blocks the page
+  past `A_deadline`.
+
+**Why this works without hurting FCP:** body content above `</body>` has already
+streamed and painted. Holding `</body>` delays `DOMContentLoaded` and `window.load`
+events but not FCP. Third-party scripts hooked on DCL fire later by at most the hold
+duration; this is a real cost on cache-hit pages where origin drains in <50ms but
+auction takes ~500ms. The publisher decides this trade-off via `auction_timeout_ms` —
+500ms is the recommended default and the hard upper bound on DCL slip.
+
+**FCP is unaffected by the auction.** First Contentful Paint is bounded by origin time
+and resource load time, exactly the same as a page without TS in the path.
+
+> **Implementation mechanic:** lol_html's `el.on_end_tag()` registers a synchronous
+> handler against the body element. Coordinating an async auction result into a
+> synchronous handler requires shared state (e.g., `Arc<RwLock<Option<BidResult>>>`)
+> that the auction task writes when complete and the close-tag handler reads, plus an
+> outer flow-control mechanism that holds chunk emission past `</body>` until the
+> shared state is populated or `A_deadline` fires. Detailed mechanics are part of the
+> implementation plan (see §7).
+
+### 4.4 Head and Body Injection
+
+TS injects two `<script>` blocks into the HTML response:
+
+1. **`window.tsjs.adSlots`** — at `<head>` open, immediately from config. No auction
+   wait. Available to GPT the moment the browser parses `<head>`.
+2. **`window.tsjs.bids`** — before `</body>`, after the bounded hold described in §4.3.
+   Carries the per-slot Prebid targeting and `nurl`/`burl` for billing.
+
+#### `tsjs.adSlots` (at `<head>` open)
+
+Owned by the `gpt` integration head injector:
+
+```json
+[
+  {
+    "id": "atf_sidebar_ad",
+    "gam_unit_path": "/21765378893/publisher/atf-sidebar",
+    "div_id": "div-atf-sidebar",
+    "formats": [[300, 250]],
+    "targeting": { "pos": "atf", "zone": "atfSidebar" }
+  },
+  {
+    "id": "below-content-ad",
+    "gam_unit_path": "/21765378893/below-content-ad",
+    "div_id": "below-content-ad",
+    "formats": [
+      [300, 250],
+      [728, 90]
+    ],
+    "targeting": { "pos": "btf", "zone": "belowContent" }
+  }
+]
+```
+
+#### `tsjs.bids` (before `</body>`)
+
+JSON object keyed by slot ID:
+
+```json
+{
+  "atf_sidebar_ad": {
+    "hb_pb": "2.50",
+    "hb_bidder": "kargo",
+    "hb_adid": "abc123",
+    "nurl": "https://ssp.example/win?id=abc123",
+    "burl": "https://ssp.example/billing?id=abc123"
+  },
+  "below-content-ad": {
+    "hb_pb": "1.00",
+    "hb_bidder": "appnexus",
+    "hb_adid": "def456",
+    "nurl": "https://appnexus.example/win?id=def456",
+    "burl": "https://appnexus.example/billing?id=def456"
+  }
+}
+```
+
+`hb_pb` is computed using the **dense** granularity table (publisher-configurable via
+`price_granularity` in `[creative_opportunities]`). Per-slot keys are `hb_pb`,
+`hb_bidder`, `hb_adid`, `nurl`, `burl` — both `nurl` and `burl` ride into the page
+because both are fired client-side from `slotRenderEnded` (see §4.5).
+
+#### Injection mechanic
+
+`tsjs.adSlots` is emitted via the existing `el.prepend()` head handler (already used
+by integrations for head-tag injection).
+
+`tsjs.bids` is emitted via lol_html's `el.on_end_tag()` registered against the body
+element. The handler reads from a shared auction-result state (resolved by the auction
+task, fallback to `{}` on watchdog) and calls
+`end_tag.before(<script>...</script>, ContentType::Html)`.
+
+> **Security:** All string values are JSON-serialized via `serde_json` and HTML-escaped
+> before insertion into the `<script>` block. The wrapper uses
+> `JSON.parse(<escaped string>)`, never raw string interpolation. `<`, `>`, `&`, U+2028,
+> U+2029 are unicode-escaped to neutralize any markup that could break out of the
+> `<script>` context.
+
+> **Cache contract (load-bearing invariant):** The HTML response with `tsjs.bids`
+> contains per-user bid data inline. TS sets **`Cache-Control: private, max-age=0`** on
+> the browser-facing response. **`Surrogate-Control` and `Fastly-Surrogate-Control`
+> are stripped** so downstream Fastly-aware caches do not override the directive. The
+> Fastly edge cache for the **origin** response is unaffected — TS reads the cached
+> origin HTML and assembles a fresh per-request response on every hit. **The
+> assembled response must never be re-cached** by any intermediate proxy or shared
+> cache. See §4.7 for the full caching rationale, including why `no-store` was
+> rejected in favor of `max-age=0` (BFCache eligibility).
+
+### 4.5 Win Notifications — Both `nurl` and `burl` Client-Side
+
+Win notification responsibilities are split by where the truth lives. **Both `nurl`
+and `burl` fire client-side from the GPT `slotRenderEnded` event after `hb_adid`
+match.** Server-side firing is rejected for both because it would report wins for
+auctions whose bids never actually rendered (direct deal won the GAM line item, GAM
+backfill won, user navigated away before tsjs loaded, etc.) — that's billing inflation
+and a violation of MRC counting standards.
+
+**Render-confirmed firing pattern (registered in `tsjs.adInit`):**
+
+```javascript
+googletag.pubads().addEventListener('slotRenderEnded', function (event) {
+  var slotId = event.slot.getSlotElementId()
+  var bidData = (window.tsjs.bids || {})[slotId] || {}
+  var ourBidWon =
+    !event.isEmpty &&
+    bidData.hb_adid &&
+    event.slot.getTargeting('hb_adid')[0] === bidData.hb_adid
+
+  if (ourBidWon) {
+    if (bidData.nurl) navigator.sendBeacon(bidData.nurl)
+    if (bidData.burl) navigator.sendBeacon(bidData.burl)
+  }
+})
+```
+
+The `hb_adid` match confirms two things: that the slot was filled (`!event.isEmpty`)
+**and** that **our** Prebid bid (not a direct deal or backfill) won the GAM line item
+match. Only then are SSP win/billing pixels fired.
+
+**Per-bidder suppression** (`[integrations.prebid].suppress_nurl_bidders`, default
+`[]`) is retained as an escape hatch in case a specific PBS seat fires `nurl`
+internally and wants to avoid double-firing. `[integrations.prebid].suppress_nurl =
+true` remains a deployment-wide compatibility switch. APS `burl` follows the same
+client-side path.
+
+> **Operational note:** Client-side firing introduces a small (~50–200ms) delay in
+> win-pixel arrival vs server-side firing. SSPs accept this — it's identical to
+> conventional client-side Prebid integrations today. Server-side firing would arrive
+> faster but would inflate counts on impressions that never rendered.
+
+### 4.6 Client Residual
+
+Prebid.js is removed from the page-load critical path. A small inline shim
+(`tsjs.adInit`) reads `window.tsjs.bids` synchronously from the page, drives GPT
+directly, and registers the `slotRenderEnded` listener for win/billing pixels. **No
+fetch, no Promise, no second round-trip — bids are already on the page.**
+
+```javascript
+window.tsjs.adInit = function () {
+  var slots = window.tsjs.adSlots || []
+  var bids = window.tsjs.bids || {}
+
+  googletag.cmd.push(function () {
+    slots.forEach(function (slot) {
+      var gptSlot = googletag
+        .defineSlot(slot.gam_unit_path, slot.formats, slot.div_id)
+        .addService(googletag.pubads())
+
+      // Apply config-defined targeting
+      Object.entries(slot.targeting || {}).forEach(function ([k, v]) {
+        gptSlot.setTargeting(k, v)
+      })
+
+      // Apply auction-result targeting
+      var bidData = bids[slot.id] || {}
+      ;['hb_pb', 'hb_bidder', 'hb_adid'].forEach(function (key) {
+        if (bidData[key]) gptSlot.setTargeting(key, bidData[key])
+      })
+
+      // Slot-ownership sentinel — slim-Prebid skips initial-rendered slots and
+      // clears this key when running its own auction on refresh.
+      gptSlot.setTargeting('ts_initial', '1')
+    })
+
+    googletag.pubads().enableSingleRequest()
+    googletag.enableServices()
+
+    // Fire win/billing pixels on confirmed render (see §4.5)
+    googletag.pubads().addEventListener('slotRenderEnded', function (event) {
+      var slotId = event.slot.getSlotElementId()
+      var bidData = bids[slotId] || {}
+      if (
+        !event.isEmpty &&
+        bidData.hb_adid &&
+        event.slot.getTargeting('hb_adid')[0] === bidData.hb_adid
+      ) {
+        if (bidData.nurl) navigator.sendBeacon(bidData.nurl)
+        if (bidData.burl) navigator.sendBeacon(bidData.burl)
+      }
+    })
+
+    googletag.pubads().refresh()
+  })
+}
+```
+
+#### Phase B: lazy slim-Prebid for refresh and identity warm-up
+
+After `window.load`, tsjs lazy-loads a stripped-down Prebid bundle (_slim-Prebid_) in
+the background. This bundle has two responsibilities, neither on the user's critical
+path:
+
+- Run **userID modules** to refresh identity provider tokens (ID5, sharedID, LiveRamp,
+  etc.). Tokens are written to first-party cookies that subsequent TS requests
+  harvest server-side and merge into the EC graph (see §4.8).
+- Register as the **auction handler for GPT scroll/refresh events**. When the
+  publisher's refresh policy fires (sticky-anchor refresh, viewability dwell, infinite
+  scroll), slim-Prebid runs a fresh client-side auction on refreshing slots and
+  applies new `hb_*` targeting before the publisher's `refresh()` trigger.
+
+Slim-Prebid is a **custom Prebid build** with bid adapters that TS handles
+server-side removed. Realistic bundle size with the major userID modules (ID5,
+sharedID, LiveRamp ATS, Lockr) and a minimal auction wrapper is ~80–120KB minified —
+meaningfully smaller than full Prebid (~250KB+) but not as small as a pure shim.
+Bundle composition is open (see §9.8).
+
+**Slot ownership signal:** `ts_initial=1` on initial-rendered slots distinguishes
+TS-served impressions from Prebid-served refresh impressions. Slim-Prebid checks for
+this key on refresh; it clears the key when re-targeting (the refresh impression is
+Prebid-served, not TS-served) and runs its own client-side auction. GAM line-item
+attribution and reporting can use this sentinel to separate the two streams.
+
+This script is part of the existing `gpt` integration bundle
+(`crates/js/lib/src/integrations/gpt/index.ts`). The lazy slim-Prebid loader is a new
+sibling module loaded post-`window.load`.
+
+#### Failure modes
+
+- **`tsjs.bids = {}`** (auction watchdog fired or zero bids above floor): GPT runs
+  without bid targeting; GAM falls back to its own auction. Same graceful degradation
+  path as a no-bid scenario today.
+- **`tsjs.bids` missing entirely** (consent denied, bot UA, no slot match): same
+  fallback, plus the page proceeds with no TS ad stack at all.
+- **slim-Prebid fails to load:** refresh auctions don't fire; initial-render
+  impressions unaffected. Publisher's existing GPT refresh logic (if any) takes over.
+- **`tsjs.adInit` not yet defined when `</body>` script executes:** the shim is loaded
+  via the `gpt` integration bundle which is part of the head injection — this is a
+  build-time invariant, not a runtime risk.
+
+### 4.7 Caching Behavior
+
+Page assets and bid results have very different cacheability properties. The
+architecture is designed so that everything that can be cached, is.
+
+**What gets cached where:**
+
+| Asset                   | Cached at                          | Cacheability                                              |
+| ----------------------- | ---------------------------------- | --------------------------------------------------------- |
+| Origin HTML             | Fastly edge HTTP cache             | Yes, if origin sends `Cache-Control: public, max-age=...` |
+| Origin CSS / fonts / JS | Fastly edge + browser              | Yes (typically hashed URLs, immutable)                    |
+| `tsjs` bundle           | Fastly edge + browser              | Yes (already content-hashed via `bundle.rs`, immutable)   |
+| `tsjs.adSlots` payload  | Computed per-request               | Sub-millisecond match — not worth caching                 |
+| `tsjs.bids` payload     | Live result of per-request auction | Per-user, never shared                                    |
+| Assembled HTML response | Browser disk cache + BFCache only  | `private, max-age=0` — same-user only, never shared       |
+
+**Architecture:**
+
+1. Fastly's built-in HTTP cache stores the **origin response** keyed by URL, governed
+   by the origin's own `Cache-Control` headers. TS does not implement its own HTML
+   caching layer — it leverages the existing Fastly cache.
+2. On request: TS reads from cache (cache hit, ~5ms) or fetches from origin (cache
+   miss, ~150ms typical).
+3. TS injects `tsjs.adSlots` at `<head>` open and `tsjs.bids` before `</body>` per
+   request. **The cached origin entry is never modified** — modifications happen on
+   the per-request assembled response only.
+4. The auction runs in parallel regardless of HTML cache state.
+
+**`Cache-Control` directive on the assembled response:**
+
+TS sets **`Cache-Control: private, max-age=0`** on the browser-facing response. This:
+
+- **`private`** prevents intermediate-cache leaks. Per-user bid data must never be
+  served from a shared cache to a different user.
+- **`max-age=0`** forces revalidation on hard reload. A fresh request gets a fresh
+  auction.
+- **(deliberately not `no-store`)** preserves browser BFCache eligibility. Chrome and
+  Firefox treat `no-store` as a hard ineligibility signal for the back/forward cache,
+  which provides instant restore on back-button navigation. Losing BFCache is a real
+  UX downgrade for navigation-heavy sites (news, recirculation, "next article"
+  flows).
+
+**Why `no-store` was rejected:** the threats `no-store` would mitigate beyond
+`private` are (a) browser disk cache cross-OS-user leaks (rare; same exposure as any
+per-user HTML today, e.g., logged-in pages) and (b) BFCache restoration showing stale
+bid data — but BFCache restoration replays the already-rendered ad without firing a
+new GAM call, so stale bids are inert. Trading BFCache instant-restore for these two
+marginal threats is a net loss.
+
+**Headers stripped on the way out:**
+
+- `Surrogate-Control` and `Fastly-Surrogate-Control` from origin — these would
+  override `Cache-Control` for downstream Fastly-aware caches.
+
+`Cache-Control` from origin on the **origin response stored in the Fastly edge cache**
+is preserved — that's how Fastly knows when to serve cached origin HTML to the next
+request. Only the **browser-facing assembled response** carries `private, max-age=0`.
+
+The `bid_cache` and `request_id` machinery from the prior revision is **gone** — bids
+travel inline with the HTML response, not via a separate fetch.
+
+**When caching doesn't apply (origin-side):**
+
+- **Logged-in users** — origin typically returns `Cache-Control: private`. Falls back
+  to cache-miss timing (full origin fetch).
+- **Personalized SSR** — same.
+- **Dynamic NextJS routes without ISR** — origin sends `Cache-Control: no-store` or
+  short max-age. Falls back to cache-miss timing.
+- **First request after deploy or cache purge** — cold cache, full origin fetch.
+- **Long-tail URLs** — low cache hit rate, treat as cache-miss case.
+
+For typical news / content publisher sites with anonymous visitors on stable content
+pages, expect 70–90%+ Fastly edge cache hit rate. The cache-hit timing in §5 is the
+realistic common case.
+
+### 4.8 Identity Model
+
+The server-side auction's CPM uplift depends materially on the identity decoration of
+`user.eids` in the bid stream. **TS does not collect identity in the auction critical
+path** — identity is _retrieved_ from the EC KV graph at request time and _enriched_
+asynchronously through three sync paths.
+
+> **Reference:** This section summarizes the identity dependency for auction purposes.
+> Full identity architecture, partner sync flows, and Phase A/B tier model live in the
+> separate _Identity Resolution_ design (forthcoming).
+
+#### EC graph as load-bearing input
+
+At request time, before firing the auction:
+
+1. TS resolves the `ts-ec` cookie or generates a new EC ID
+   (HMAC-SHA256(IP, publisher_passphrase)).
+2. KV lookup against `ec_store` retrieves the enriched EID set bound to the EC ID
+   (partner UIDs from sync paths described below).
+3. EIDs are decorated into `AuctionRequest.user.eids` and forwarded to PBS + APS.
+
+The EC graph is populated by three sync paths (all running off the auction critical
+path):
+
+- **Pixel sync (browser → TS)** — `/identify` endpoint receives partner-resolved IDs
+  via image-pixel or postMessage flows from the publisher's site.
+- **S2S batch push (partner → TS)** — partners push EID sets keyed by IP or hashed
+  email to TS via authenticated S2S endpoints.
+- **S2S pull (TS → partner)** — TS resolves EC IDs against partner databases (IP graph,
+  bid-stream history) on a scheduled batch interval.
+
+#### Phase A vs Phase B identity
+
+| Phase   | When                          | Source                                                                                                | Effect                               |
+| ------- | ----------------------------- | ----------------------------------------------------------------------------------------------------- | ------------------------------------ |
+| Phase A | Auction critical path         | EC + KV + Tier 1 server-side providers (SharedID 1P cookie, UID2 server SDK, LiveRamp ATS API, Lockr) | Decorates _this_ auction             |
+| Phase B | Post-`window.load` (off path) | slim-Prebid userID modules (ID5, ATSv2 envelope, Criteo ID, etc.)                                     | Enriches EC graph for _next_ request |
+
+Phase A adds **no auction latency** — KV lookup happens in parallel with origin
+fetch and slot match, sub-millisecond once the EC ID is resolved. Phase B is
+fire-and-forget after first paint and benefits subsequent navigations.
+
+#### Bare-EC first-impression caveat
+
+A user with no prior interaction with the EC graph (truly new EC, no federated
+consortium hit, no prior partner sync) gets an auction with **bare identity** on the
+very first impression of the EC's lifetime. Subsequent impressions are enriched as
+Phase B and partner sync paths populate the graph. The duration of the bare window
+depends on partner sync cadence:
+
+- Pixel sync fires on next `/identify` call — usually within seconds of first paint.
+- S2S batch push is partner-scheduled — minutes to hours.
+- S2S pull is TS-scheduled — minutes to hours.
+
+**Measurement:** the auction emits an `auction_eid_count` metric (number of EIDs
+decorated per auction). Distribution of this metric vs revenue uplift validates the
+identity coverage / CPM relationship in production. A high-volume zero-EID tail
+signals that partner sync paths need acceleration.
+
+#### Federated-consortium passphrase
+
+EC = HMAC(IP, passphrase). Publishers sharing a passphrase share an EC graph. A user
+new to publisher A but known to publisher B (using the shared passphrase) hits a
+**populated graph** on first request to A. This shrinks the bare-EC cohort
+meaningfully for publishers participating in a consortium. Operationally, this
+requires data-sharing agreements between consortium members — a contractual surface,
+not a technical one.
+
+#### Clickstream-compounding property
+
+Every full page navigation in a user's session is an independent TS-accelerated
+server-side auction. A user reading article 1 → article 2 → article 3 gets three
+independent auctions, each decorated with the EID set the EC graph held at that
+moment. The speed win and the identity decoration **compound across the clickstream**
+rather than being a session-start one-time benefit.
+
+**SPA caveat:** pure client-side SPAs that route via `pushState` without issuing an
+HTML request do not re-trigger TS. All slots on SPA-routed views rely on slim-Prebid
+for both auction and identity. Streaming-SSR setups (Next.js App Router, etc.) that
+emit HTTP requests on route changes get the full TS-accelerated auction per route.
+See §8.
+
+---
+
+## 5. Request-Time Sequence
+
+Sequence applies to all origins (WordPress, Drupal, Rails, NextJS 14/16, static sites).
+TS forces chunked encoding on every response, so origin format is invisible from the
+browser's perspective.
+
+### 5.1 Visual Sequence (full content + creative flow)
+
+```mermaid
+sequenceDiagram
+    autonumber
+    participant B as Browser
+    participant E as TS Edge<br/>(Fastly)
+    participant C as Fastly HTTP Cache
+    participant O as Publisher Origin<br/>(WP / NextJS / etc)
+    participant A as Auction<br/>(PBS + APS)
+    participant S as SSPs<br/>(Kargo / Index / etc)
+    participant G as GAM<br/>(securepubads)
+
+    Note over B,G: t=0ms — Navigation start
+
+    B->>E: GET ts.publisher.com/article
+
+    Note over E: t=1ms — URL → slots match<br/>EC cookie → KV EID enrichment<br/>Consent + bot/prefetch gating
+
+    par Auction kicks off server-side
+        E->>A: POST bid requests<br/>(PBS + APS in parallel)<br/>user.eids decorated from KV
+        A->>S: Fan out to all SSPs
+        S-->>A: Bids return
+        A-->>E: Aggregated bid responses<br/>(t≤A_deadline, ~502ms)
+    and Origin HTML lookup
+        E->>C: Lookup origin HTML by URL
+        alt Cache HIT (typical for content pages)
+            C-->>E: Cached HTML (~5ms)
+        else Cache MISS (cold / dynamic / logged-in)
+            C->>O: GET origin HTML
+            O-->>C: HTML response (~150ms)
+            C-->>E: HTML response
+        end
+    end
+
+    Note over E: Force Transfer-Encoding: chunked<br/>Inject tsjs.adSlots at <head> open<br/>Cache-Control: private, max-age=0
+
+    E-->>B: Stream <head> + body chunks (no hold)
+
+    Note over B: TTFB: ~10ms (hit) / ~155ms (miss)<br/></head> flushes immediately<br/>Body parsing begins
+
+    Note over B: 🎨 FCP: ~80ms (hit) / ~250ms (miss)
+
+    Note over E: At </body>: hold close tag until<br/>auction_complete OR A_deadline<br/>(bounded by auction_timeout_ms)
+
+    alt Auction completes before A_deadline
+        Note over E: Inject tsjs.bids JSON before </body><br/>Emit </body>
+    else A_deadline fires first (auction overrun)
+        Note over E: Inject tsjs.bids = {} (graceful fallback)<br/>Emit </body>
+    end
+
+    E-->>B: </body> chunk arrives
+
+    Note over B: tsjs executes (DCL fires)<br/>tsjs.adInit reads tsjs.bids inline<br/>Defines GPT slots + applies hb_* targeting<br/>Sets ts_initial=1 sentinel<br/>Registers slotRenderEnded listener<br/>googletag.pubads().refresh() fires
+
+    B->>G: GET /gampad/ads<br/>with hb_* key-values
+
+    Note over G: GAM matches hb_pb against<br/>Prebid line items, selects winner
+
+    G-->>B: Ad markup<br/>(iframe HTML or creative URL)
+
+    Note over B: Creative iframe loads in slot<br/>Fetches sub-resources<br/>(images, scripts, viewability pixels)
+
+    Note over B: 🎯 Creative paints<br/>slotRenderEnded event fires<br/>tsjs.adInit checks hb_adid match
+
+    alt Our Prebid bid won the GAM line item match
+        B->>S: navigator.sendBeacon(nurl)<br/>navigator.sendBeacon(burl)
+    else Direct deal / backfill won (hb_adid mismatch or empty)
+        Note over B: No nurl/burl fired (correct — different creative rendered)
+    end
+
+    Note over B: window.load fires
+    Note over B: Phase B: lazy slim-Prebid loads<br/>(userID modules + refresh handler)<br/>(off critical path)
+
+    Note over B,G: ✅ AD VISIBLE<br/>Cache hit: ~870ms total<br/>Cache miss: ~1,020ms total<br/>FCP: ~80ms (hit) / ~250ms (miss)<br/><br/>vs client-side today: ~3,250ms ad-visible / FCP ~500ms+
+```
+
+### 5.2 Cache-Hit Sequence (typical for content publisher pages)
+
+This is the common case for anonymous visitors on cacheable content pages.
+
+```
+t=0ms     GET ts.publisher.com/article arrives at Fastly edge
+
+t=1ms     URL matched against [creative_opportunities] slots in trusted-server.toml
+          Slots matched: [atf_sidebar_ad, below-content-ad, section_ad]
+          EC cookie resolved → KV lookup for EID enrichment
+          Consent: TCF Purpose 1 present → auction proceeds
+          Bot/prefetch gates: pass
+
+t=2ms     AuctionOrchestrator.run_auction() dispatched (parallel)
+          PBS + APS dispatched in parallel via send_async()
+          user.eids decorated from KV graph
+          Edge→PBS RTT: ~20–30ms
+          Fastly cache lookup dispatched in parallel
+          tsjs.adSlots <script> assembled from config
+
+t=5ms     Cache HIT — origin HTML retrieved from Fastly edge cache
+          TS forces Transfer-Encoding: chunked
+          tsjs.adSlots injected at <head> open
+          Cache-Control: private, max-age=0 set on response
+          Stream begins to browser
+
+t=10ms    Browser TTFB ~10ms
+          CSS, fonts, framework JS, tsjs all begin downloading
+          (most also from Fastly cache + browser cache)
+
+t=60ms    </head> chunk reaches browser (no hold)
+          Body parsing begins immediately
+
+t=80ms    FIRST CONTENTFUL PAINT ✨ (auction never blocked rendering)
+
+t=502ms   Server-side auction completes (≤500ms budget) or A_deadline fires
+          Winning bids selected; nurl/burl per slot included in tsjs.bids
+          tsjs.bids JSON injected before </body>
+          </body> emitted
+          (origin drained at t=5ms, so </body> was held ~497ms — DCL slip)
+
+t=510ms   </body> reaches browser
+          tsjs executes (DCL fires)
+          tsjs.adInit reads tsjs.bids inline (no fetch)
+          GPT slots defined; hb_* + ts_initial=1 targeting applied
+          slotRenderEnded listener registered
+          googletag.pubads().refresh() fires
+
+t=620ms   GET /gampad/ads (GAM RTT ~110ms)
+
+t=720ms   Creative fetch begins
+
+t=870ms   Creative sub-resources + paint
+          slotRenderEnded fires; nurl + burl fired via sendBeacon
+
+          AD VISIBLE ~870ms
+          FIRST CONTENTFUL PAINT ~80ms
+
+(post window.load — off critical path)
+~t=1,500ms   slim-Prebid lazy-loads
+             userID modules run, refresh 1P identity cookies
+             GPT refresh handler registered (off critical path)
+```
+
+### 5.3 Cache-Miss Sequence (cold cache, dynamic page, logged-in user)
+
+Worst case — first request to a URL after a deploy or cache purge, or a page marked
+uncacheable by origin (`Cache-Control: private`).
+
+```
+t=0ms     GET ts.publisher.com/article arrives at Fastly edge
+t=1ms     URL matched, EC lookup, consent + gate checks
+t=2ms     Auction dispatched, origin fetch dispatched in parallel
+
+t=150ms   Origin HTML arrives at edge (cache miss — full origin RTT)
+          TS forces chunked encoding, injects tsjs.adSlots at <head> open
+          Stream begins to browser
+
+t=200ms   </head> reaches browser (no hold)
+t=250ms   FIRST CONTENTFUL PAINT
+t=502ms   Auction completes; tsjs.bids injected; </body> emitted
+          (origin drained at 150ms, auction at 502ms — </body> held ~352ms)
+t=512ms   </body> reaches browser; tsjs runs; refresh() fires
+t=622ms   GET /gampad/ads
+t=722ms   Creative fetch
+t=1,020ms AD VISIBLE
+```
+
+### 5.4 Key Timing Properties
+
+| Metric     | Cache hit | Cache miss | Client-side today |
+| ---------- | --------- | ---------- | ----------------- |
+| TTFB       | ~10ms     | ~155ms     | ~150–500ms        |
+| FCP        | ~80ms     | ~250ms     | ~500ms+           |
+| DCL        | ~510ms    | ~512ms     | ~700ms+           |
+| Ad visible | ~870ms    | ~1,020ms   | ~3,250ms          |
+
+- **The auction never blocks FCP.** FCP is bounded by origin time and browser parsing
+  only — same as a page without TS in the ad path.
+- **Body content paints first; ads slot in after.** The page is responsive and
+  readable while ads finish loading.
+- **DCL is delayed by the auction hold** (up to `auction_timeout_ms`). Third-party
+  scripts hooked on DCL fire later by at most the hold duration. This is the explicit
+  trade-off for the speed win on ad-visible.
+- **Cache-hit FCP under 100ms is achievable** for anonymous visitors on stable content.
+  The typical case for news publisher article pages.
+- **Ad-visible converges across cache hit/miss** because the auction is the long pole
+  in both cases. Cache miss costs FCP, not ad-visible.
+
+---
+
+## 6. Performance Summary
+
+| Stage                      | Client-side today | TS cache hit | TS cache miss | Saving (cache hit)  |
+| -------------------------- | ----------------- | ------------ | ------------- | ------------------- |
+| Origin HTML to browser     | ~150ms            | ~10ms TTFB   | ~155ms TTFB   | parallel w/ auction |
+| Script load chain          | ~700ms            | ~40ms        | ~40ms         | -660ms              |
+| Script parse/JIT           | ~280ms            | ~10ms        | ~10ms         | -270ms              |
+| Sequential SDK hops        | ~200ms            | 0            | 0             | -200ms              |
+| Auction window             | ~1,500ms          | ~500ms       | ~500ms        | -1,000ms            |
+| GAM + creative             | ~570ms            | ~360ms       | ~360ms        | -210ms              |
+| **Ad visible (wall)**      | **~3,250ms**      | **~870ms**   | **~1,020ms**  | **~2,380ms**        |
+| **First Contentful Paint** | ~500ms+           | **~80ms**    | **~250ms**    | **-420ms**          |
+
+> Components don't sum cleanly because of parallelism — auction + origin fetch run
+> concurrently, and the GAM + creative leg is post-body-close. The wall-clock totals
+> are what matter.
+
+**Compounding across the clickstream.** Every full page navigation in a user's session
+is an independent TS-accelerated server-side auction. The speed win and identity
+decoration compound across the clickstream rather than being a session-start one-time
+benefit. Modern engagement patterns (multi-article reads, recirculation modules,
+auto-advance "next article") mean a meaningful share of impressions are
+initial-slot impressions, not refresh impressions — exactly the surface this design
+optimizes.
+
+**Auction RTT improvement.** Browser fires SSP requests at 80–150ms RTT; edge fires at
+20–30ms. Auction timeout can drop from 1,000–1,500ms to 500ms while still collecting
+more complete results, because edge→PBS latency is ~5–7x lower.
+
+**TS edge overhead.** TS adds processing on the request path: URL match, UUID-free
+gating, EC/KV lookup, head-script assembly, header rewrite, force-chunk. Estimated at
+≤5ms on warm Wasm isolates; to be measured in production. The §6 cache-hit numbers
+include this overhead.
+
+**Identity coverage caveat.** First-time visitors with no prior EC graph hit get a
+bare-identity auction on impression #1. CPM uplift on Tier 3 (browser-coupled) ID
+providers — ID5, ATSv2 envelope, Criteo ID, etc. — only lands on impression #2+ within
+an EC lifetime, after Phase B has populated 1P cookies for next-request harvest. The
+clickstream-compounding property means this dilution mostly resolves within the first
+few navigations of a new EC.
+
+**Confidence intervals.** The numbers above are point estimates against modeled
+assumptions (origin RTT, edge→PBS RTT, GAM RTT, creative weight). p95 ad-visible is
+likely 1.3–1.5x the median for slow networks and tail GAM/creative RTTs. Production
+measurement plan is to instrument each leg independently before claiming the headline
+saving.
+
+---
+
+## 7. Implementation Scope
+
+### New
+
+- `[[creative_opportunities.slot]]` entries in `trusted-server.toml` — slot template
+  config (consolidated; no separate file)
+- `crates/trusted-server-core/src/creative_opportunities.rs` — config types, TOML
+  parsing, URL glob matching, slot-to-`AdSlot` conversion
+- `crates/trusted-server-core/src/price_bucket.rs` — Prebid price granularity tables
+  (dense default; publisher-configurable); converts raw CPM `f64` to `hb_pb` string
+- `crates/trusted-server-core/build.rs` updates — startup slot-ID validation against
+  `trusted-server.toml` `[creative_opportunities]` section
+- **slim-Prebid bundle build target** — custom Prebid build with TS-handled bid
+  adapters removed; bundled with `crates/js/lib/src/integrations/gpt/` and lazy-loaded
+  post-`window.load`. Bundle composition tracked in §9.8.
+- **Auction-eligibility gating** — bot UA list, prefetch hint detection, HEAD-method
+  short-circuit; runs before any auction work
+
+### Modified
+
+- **`crates/trusted-server-core/src/publisher.rs`** — primary structural change:
+  - Convert `handle_publisher_request` from `fn` to `async fn`
+  - Switch origin fetch from `.send()` to `.send_async()` (returns
+    `PlatformPendingRequest`)
+  - Add `orchestrator: &AuctionOrchestrator` parameter
+  - Apply auction-eligibility gates (consent, bot UA, prefetch, method, slot match)
+  - Resolve EC cookie → KV lookup for EID enrichment; decorate `user.eids` on
+    `AuctionRequest`
+  - Match slots, fire auction (returns a future), origin fetch in parallel
+  - Coordinate the `</body>` hold: shared auction-result state populated by the
+    auction task; close-tag handler reads from it; outer flow holds chunk emission
+    past `</body>` until the state is populated or `A_deadline` fires
+  - Force chunked encoding on the response (strip `Content-Length`, set
+    `Transfer-Encoding: chunked`)
+- **`crates/trusted-server-adapter-fastly/src/main.rs`** — `.await` the now-async
+  publisher handler; pass orchestrator reference
+- **`crates/trusted-server-core/src/html_processor.rs`**:
+  - Inject `window.tsjs.adSlots` at `<head>` open via existing `el.prepend()` head
+    handler (no hold)
+  - Inject `window.tsjs.bids` before `</body>` via lol_html's `el.on_end_tag()` on
+    the body element, reading from shared auction-result state
+  - Set `Cache-Control: private, max-age=0` on the assembled response
+  - Strip `Surrogate-Control` and `Fastly-Surrogate-Control` from the response
+- **`crates/trusted-server-core/src/integrations/gpt.rs`** — extend head injector to
+  emit `window.tsjs.adSlots` from matched slots; emit `tsjs.adInit` bootstrap script
+- **`crates/js/lib/src/integrations/gpt/index.ts`** — add `tsjs.adInit` function with
+  synchronous bid read, `slotRenderEnded` nurl + burl firing, `ts_initial` sentinel;
+  add lazy slim-Prebid loader scheduled for post-`window.load`
+- **`crates/trusted-server-core/src/integrations/prebid.rs`** — add
+  `suppress_nurl_bidders` per-bidder config (default `[]`); **no server-side nurl firing
+  in the page-load path** (firing is client-side from `slotRenderEnded`)
+- **`trusted-server.toml`** — add `[creative_opportunities]` section
+- **`crates/trusted-server-core/src/settings.rs`** — add `CreativeOpportunitiesConfig`
+  to `Settings`
+
+### Deleted (relative to prior revision of this spec)
+
+- `crates/trusted-server-core/src/bid_cache.rs` — never created; in-process cache
+  approach was rejected
+- `/ts-bids` endpoint — never created
+- `request_id` UUID minting and `__ts_request_id` page injection — never created
+
+### Unchanged
+
+- `AuctionOrchestrator` internals — no changes; new call site only
+- PBS stored request configuration — bidder params remain in PBS, keyed by slot ID
+- GAM line item configuration — targeting key-values pass through unchanged
+
+---
+
+## 8. Edge Cases
+
+**No slots match the URL** — auction is not fired. `tsjs.bids` is omitted. The page
+renders with `tsjs.adSlots` still absent (no slots = no slot config to inject); no
+`</body>` hold. Existing client-side Prebid/GPT flow runs unmodified (for publishers
+in dual-mode rollout).
+
+**Consent absent or denied** — auction is not fired. `tsjs.bids` is omitted; `</body>`
+flushes immediately on origin emit. `Cache-Control: private, max-age=0` is still set.
+Page loads normally; GAM runs its own auction without TS targeting.
+
+**Bot / crawler User-Agent** — auction skipped. `tsjs.bids` omitted; `</body>` flushes
+immediately. SSP QPS budget preserved. Crawlers typically don't render JS, but if they
+do, GPT runs without TS targeting.
+
+**Prefetch hint (`Sec-Purpose: prefetch` or `Purpose: prefetch`)** — auction skipped.
+Avoids burning auction inventory on speculative navigations that may never paint. If
+the user does click through, the actual click navigation is a fresh request and
+triggers a real auction.
+
+**HEAD request** — auction skipped; response carries headers only.
+
+**Auction times out with partial results (watchdog)** — `tsjs.bids` includes whatever
+bids arrived before `A_deadline`. Slots with no bid are omitted. GPT fires without
+pre-set targeting for those slots; GAM falls back to its own auction.
+
+**Auction times out with zero results** — `tsjs.bids = {}` injected. All slots fire
+GAM without bid targeting. No revenue impact beyond the timeout scenario itself.
+
+**Buffered origin (WordPress, Drupal, Rails, NextJS 14, static sites)** — origin
+returns full HTML in one response. TS strips `Content-Length`, sets
+`Transfer-Encoding: chunked`, and feeds the response through the streaming pipeline
+as chunks. From the browser's perspective, behavior is identical to a streaming
+origin. The `</body>` hold mechanic is identical. Auction runs in parallel with
+origin response; usually completes around the same time origin drains.
+
+**Streaming origin (NextJS 16, Remix, SvelteKit with streaming)** — origin emits HTML
+chunks progressively. TS forwards them through the streaming pipeline directly. No
+buffering at the edge before `</body>`. The `</body>` hold mechanic is identical.
+
+**SPA / pushState navigation** — pure client-side SPAs (CSR React/Vue, hashbang
+routing) don't issue an HTML request on route change, so TS never sees the
+navigation and no server-side auction fires for the new "page." All slots on
+SPA-routed views rely on slim-Prebid for both auction and identity. Streaming-SSR
+setups (Next.js App Router, etc.) that emit HTTP requests on route changes get the
+full TS-accelerated auction per route. The speed-win story differs by publisher
+architecture and should be confirmed during onboarding.
+
+**Bare-EC first impression** — a new EC with no prior partner sync hits the auction
+with `user.eids = []`. Bid stream lacks Tier 3 identity; CPMs may be 10–30% lower than
+enriched impressions. Subsequent navigations populate the EC graph. Measure via the
+`auction_eid_count` distribution.
+
+**BFCache restoration** — user navigates back to a TS-served page. Browser restores
+the page from BFCache (eligible because we set `private, max-age=0`, not `no-store`).
+Already-rendered ads display from the BFCache snapshot; no new GAM call fires; no new
+auction needed. `tsjs.bids` in JS heap is stale but inert. This is the desired
+behavior — instant back-button restore for the user.
+
+**Slow origin (origin drain > A_deadline)** — `</body>` waits for origin regardless
+of auction state. Auction has more wall-clock budget; results more likely complete by
+the time origin drains. No extra hold beyond origin drain.
+
+**Slim-Prebid fails to load** — refresh auctions don't fire; initial-render
+impressions are unaffected. Publisher's existing GPT refresh logic (if any) takes
+over. Phase B identity refresh doesn't happen for that session — EC graph staleness
+shifts to next session's S2S sync.
+
+**`[creative_opportunities]` missing or malformed in `trusted-server.toml`** — startup
+fails with a clear error. No silent degradation.
+
+**Config empty (zero slots)** — treated as "no match" for all URLs; auction never
+fires. No error. Useful as a kill-switch: deploying an empty `[creative_opportunities]`
+section (or removing all `[[creative_opportunities.slot]]` entries) disables the
+feature without a code change.
+
+**Slot ID not found in PBS stored requests** — PBS returns a no-bid for that slot.
+Slot is omitted from `tsjs.bids`. The remaining slots proceed normally.
+
+---
+
+## 9. Open Questions
+
+1. **URL pattern coverage** — does `/20**` cover all article paths, or are there
+   non-date-prefixed article URLs? Publisher to confirm per onboarding.
+2. **PBS stored request setup** — slot IDs in `trusted-server.toml` `[creative_opportunities]` must have
+   corresponding stored requests configured in the publisher's PBS instance before
+   this goes live. Recommend a CI check or startup probe to PBS that lists stored
+   requests and diffs against the toml; tracked as a Phase 1 implementation item.
+3. **Homepage slot count** — the example shows slots 0 and 1. Are there additional
+   slots following the same pattern? Slot IDs and count to be confirmed with ad ops.
+4. **Auction timeout** — ✅ Resolved: dedicated key
+   `[creative_opportunities].auction_timeout_ms` with fallback to
+   `[auction].timeout_ms`. This value is also the upper bound on the `</body>` hold.
+   Per-provider ceilings (`[integrations.prebid].timeout_ms`,
+   `[integrations.aps].timeout_ms`) remain unchanged; the orchestrator's existing
+   `min(remaining_budget, provider_timeout)` logic applies.
+5. **KV-backed config migration path** — Phase 1 ships with `include_str!()` for
+   simplicity and cost. When ad ops require live slot edits between deploys, the
+   migration path is: load from `services.kv_store()` at request time with a
+   compiled-in fallback. Design tracked as a follow-up.
+6. **Server-side GAM** — the real latency ceiling beyond the auction is the GAM call
+   (`securepubads.g.doubleclick.net`, ~110ms RTT). Routing GAM through the edge would
+   eliminate that hop, but it requires Google agreement which is a business
+   negotiation, not an engineering decision. **Aspirational, not committed for any
+   phase.** The current architecture is shape-compatible (`tsjs.adSlots` gives the
+   edge full slot inventory) so no rework would be required if Google agrees later.
+7. **`tsjs-gpt` bootstrap delivery** — ✅ Resolved: `tsjs.adInit` is part of the
+   existing `gpt` integration bundle, not a new integration. Injection order:
+   `window.tsjs.adSlots` (head) → existing GPT shim → `tsjs.adInit` (head) →
+   `window.tsjs.bids` (body close). Bid script can rely on `tsjs.adInit` and slot
+   config being defined.
+8. **slim-Prebid bundle composition** — which userID modules ship in the lazy bundle?
+   Default candidates: ID5, sharedID, LiveRamp ATS, Lockr. Each adds bundle weight
+   (~10–25KB each). Publisher per-deployment override should be possible. Bundle
+   target size is "as small as possible while covering the publisher's enabled
+   identity providers." Tracked as a slim-Prebid build-system item.
+9. **Privacy Sandbox interaction** — Topics API (`Sec-Browsing-Topics`) can be read at
+   the edge and decorated into the bid stream as a future enhancement. Protected
+   Audience (FLEDGE) is on-device by design and cannot move server-side; it runs in
+   parallel client-side via slim-Prebid (when supported). Out of scope for Phase 1
+   beyond this acknowledgment.
+10. **Per-bidder consent resolution** — Phase 1 gates on TCF Purpose 1 globally.
+    Real-world consent is per-vendor, per-purpose, and interacts with Google Consent
+    Mode, USP_v2, and GPP. A bidder may be allowed for some purposes but not others.
+    Phase 2 should specify per-bidder consent-resolution rules and partial-consent
+    behavior. Tracked as a follow-up before Phase 2.
diff --git a/docs/superpowers/specs/2026-05-29-prebid-creative-rendering-fix.md b/docs/superpowers/specs/2026-05-29-prebid-creative-rendering-fix.md
new file mode 100644
index 00000000..3299f6ee
--- /dev/null
+++ b/docs/superpowers/specs/2026-05-29-prebid-creative-rendering-fix.md
@@ -0,0 +1,345 @@
+# Prebid Creative Rendering Fix Design
+
+_Author · 2026-05-29_
+
+---
+
+## 1. Problem Statement
+
+The Trusted Server server-side auction returns winning bids from PBS, but ads never
+render on the Prebid path because `hb_adid` carries the wrong value.
+
+The Prebid Universal Creative in GAM constructs the creative fetch URL as:
+
+```
+https://<hb_cache_host><hb_cache_path>?uuid=<hb_adid>
+```
+
+TS currently sets `hb_adid` from `bid.adid` or `bid.id` (the OpenRTB bid ID /
+impression ID). PBS actually caches the creative markup and returns the cache UUID
+in `ext.prebid.cache.bids.cacheId`. The Universal Creative needs the **cache UUID**,
+not the bid ID. The cache host and path are also not forwarded today.
+
+**Effect:** GAM receives a wrong UUID, fetches nothing, and the slot renders empty.
+
+---
+
+## 2. Root Cause — Two Extraction Gaps
+
+### Gap 1: Wrong `hb_adid` source
+
+`prebid.rs` extracts:
+
+```rust
+let ad_id = bid_obj
+    .get("adid")
+    .or_else(|| bid_obj.get("id"))   // ← falls back to impression ID
+    .and_then(|v| v.as_str())
+    .map(String::from);
+```
+
+Real PBS response has (in `ext.prebid.cache.bids`):
+
+```json
+{
+  "url": "https://openads.adsrvr.org/cache?uuid=f47447a0-b759-4f2f-9887-af458b79b570",
+  "cacheId": "f47447a0-b759-4f2f-9887-af458b79b570"
+}
+```
+
+`bid.id` = `"ad-header-0-_R_4uapbsnql8alb_"` — the impression ID, useless to the
+creative renderer.
+
+### Gap 2: Cache host and path not forwarded
+
+`build_bid_map` in `publisher.rs` emits `hb_pb`, `hb_bidder`, `hb_adid`, `nurl`,
+`burl`. It does not emit `hb_cache_host` or `hb_cache_path`. The Prebid Universal
+Creative needs both to construct the fetch URL.
+
+---
+
+## 3. Non-Goals
+
+- APS creative rendering — APS does not use PBS Cache. APS creative delivery is
+  Amazon-owned and not addressed here.
+- APS win detection over-fire — separate known limitation, separate issue.
+- Dual bootstrap sync risk — separate maintenance issue.
+- Slim-Prebid bundle — out of scope for Phase 1.
+
+---
+
+## 4. Design
+
+### 4.1 New Fields on `Bid` (types.rs)
+
+Add three fields to `Bid` to carry the PBS Cache coordinates extracted from the bid
+response:
+
+```rust
+/// Prebid Cache UUID for this bid. Populated from
+/// `ext.prebid.cache.bids.cacheId` in the PBS response.
+/// Used as `hb_adid` targeting value in `window.tsjs.bids`.
+/// None for non-PBS providers (e.g., APS) and PBS bids without cache enabled.
+pub cache_id: Option<String>,
+
+/// Prebid Cache host (e.g., `"openads.adsrvr.org"`). Populated from
+/// the host component of `ext.prebid.cache.bids.url`.
+/// Used as `hb_cache_host` targeting value.
+pub cache_host: Option<String>,
+
+/// Prebid Cache path (e.g., `"/cache"`). Populated from
+/// the path component of `ext.prebid.cache.bids.url`.
+/// Used as `hb_cache_path` targeting value.
+pub cache_path: Option<String>,
+```
+
+### 4.2 Extraction in `prebid.rs`
+
+In `parse_bid_object`, after extracting `nurl`/`burl`, extract the cache fields from
+`ext.prebid.cache.bids`:
+
+```rust
+// Extract PBS Cache coordinates from ext.prebid.cache.bids
+let cache_entry = bid_obj
+    .get("ext")
+    .and_then(|e| e.get("prebid"))
+    .and_then(|p| p.get("cache"))
+    .and_then(|c| c.get("bids"));
+
+let cache_id = cache_entry
+    .and_then(|c| c.get("cacheId"))
+    .and_then(|v| v.as_str())
+    .map(String::from);
+
+let (cache_host, cache_path) = cache_entry
+    .and_then(|c| c.get("url"))
+    .and_then(|v| v.as_str())
+    .and_then(|url_str| {
+        url::Url::parse(url_str)
+            .map_err(|e| log::debug!("PBS cache URL parse failed: {}", e))
+            .ok()
+    })
+    .map(|u| {
+        let host = u.host_str().map(String::from);
+        // path() returns "/" for root — only use if non-trivial
+        let path = u.path().to_string();
+        let path = if path.is_empty() || path == "/" { None } else { Some(path) };
+        (host, path)
+    })
+    .unwrap_or((None, None));
+
+// Guard: if we extracted a cache UUID but couldn't extract the host,
+// the bid will have hb_adid set but no endpoint to fetch from — creative will fail.
+if cache_id.is_some() && cache_host.is_none() {
+    log::warn!(
+        "PBS bid has cache UUID but cache URL could not be parsed — \
+         creative will fail to render for slot '{}'",
+        slot_id
+    );
+}
+```
+
+Note: `url` crate is already a workspace dependency. If not, parse host/path manually
+by splitting on the first `/` after the scheme.
+
+The `ad_id` field (from `bid.adid` / `bid.id`) is **kept** — it maps to the OpenRTB
+`adid` / `id` field that APS and other non-PBS providers may use. The cache fields are
+**in addition**, not replacing `ad_id`.
+
+Populate all three fields on `AuctionBid`:
+
+```rust
+Ok(AuctionBid {
+    ...,
+    ad_id,
+    cache_id,
+    cache_host,
+    cache_path,
+    ...
+})
+```
+
+### 4.3 `build_bid_map` in `publisher.rs`
+
+Priority for `hb_adid`: use `cache_id` when present (PBS path), fall back to `ad_id`
+(APS / other providers, backward compat):
+
+```rust
+// hb_adid: use PBS Cache UUID when present — the Prebid Universal Creative uses
+// this as the cache lookup key, NOT the OpenRTB bid ID (bid.ad_id). Fall back to
+// bid.ad_id for APS and other non-PBS providers.
+let hb_adid = bid.cache_id.as_deref().or(bid.ad_id.as_deref());
+if let Some(id) = hb_adid {
+    obj.insert("hb_adid".to_string(), serde_json::Value::String(id.to_string()));
+}
+
+// Cache coordinates — only present for PBS bids with Prebid Cache enabled
+if let Some(ref host) = bid.cache_host {
+    obj.insert("hb_cache_host".to_string(), serde_json::Value::String(host.clone()));
+}
+if let Some(ref path) = bid.cache_path {
+    obj.insert("hb_cache_path".to_string(), serde_json::Value::String(path.clone()));
+}
+```
+
+### 4.4 What `window.tsjs.bids` looks like after the fix
+
+```json
+{
+  "atf_sidebar_ad": {
+    "hb_pb": "0.01",
+    "hb_bidder": "thetradedesk",
+    "hb_adid": "f47447a0-b759-4f2f-9887-af458b79b570",
+    "hb_cache_host": "openads.adsrvr.org",
+    "hb_cache_path": "/cache",
+    "nurl": "https://...",
+    "burl": "https://..."
+  }
+}
+```
+
+### 4.5 Win detection — no change required
+
+`slotRenderEnded` checks:
+
+```js
+event.slot.getTargeting('hb_adid')[0] === bid.hb_adid
+```
+
+`adInit()` calls `setTargeting('hb_adid', cacheId)` with the cache UUID.
+`event.slot.getTargeting('hb_adid')[0]` returns that same cache UUID.
+`bid.hb_adid` is now also the cache UUID.
+Match holds. No change to the win detection logic.
+
+### 4.6 GAM line item creative requirement (publisher action — not TS code)
+
+This is a **hard dependency outside the TS codebase**. The publisher must configure
+GAM line items with a server-side compatible Prebid creative. The standard
+client-side Universal Creative calls `pbjs.renderAd()` which requires Prebid.js to be
+loaded — it will not be at first render (slim-Prebid loads post-`window.load`).
+
+The server-side compatible creative uses the `hb_cache_*` macros to fetch the markup
+directly from PBS Cache:
+
+```html
+<script>
+  ;(function () {
+    var host = '%%PATTERN:hb_cache_host%%'
+    var path = '%%PATTERN:hb_cache_path%%'
+    var uuid = '%%PATTERN:hb_adid%%'
+    if (!host || !uuid) return
+    var url = 'https://' + host + path + '?uuid=' + encodeURIComponent(uuid)
+    var xhr = new XMLHttpRequest()
+    xhr.open('GET', url)
+    xhr.onload = function () {
+      if (xhr.status === 200) document.write(xhr.responseText)
+    }
+    xhr.send()
+  })()
+</script>
+```
+
+Alternatively, publishers using the Prebid Universal Creative package can use:
+
+```html
+<script src="https://cdn.jsdelivr.net/npm/prebid-universal-creative/dist/creative.js"></script>
+<script>
+  pbuc.renderAd({
+    adId: '%%PATTERN:hb_adid%%',
+    cacheHost: '%%PATTERN:hb_cache_host%%',
+    cachePath: '%%PATTERN:hb_cache_path%%',
+  })
+</script>
+```
+
+> **This creative configuration is a publisher/ad ops action, not a TS code change.**
+> Document it in the integration guide and verify during onboarding.
+
+> **Cache TTL:** PBS Cache entries expire per the `bid.exp` field (default 300–3600s;
+> the real response has `"exp": 3600`). Creative fetch must complete within this window.
+> BFCache page restores after long idle sessions may hit expired cache entries — the
+> creative will silently fail to render in that case. This is acceptable for Phase 1;
+> the probability is low for typical session lengths.
+
+---
+
+## 5. APS — Out of Scope
+
+APS does not use PBS Cache. APS bids will have `cache_id = None`, `cache_host = None`,
+`cache_path = None`. The existing `ad_id` fallback path remains for APS. APS creative
+rendering depends on Amazon's own GAM creative tag — separate from the Prebid path.
+
+APS win detection over-fires on the `!!bid.hb_bidder` fallback remain a known
+limitation tracked separately.
+
+---
+
+## 6. Files Changed
+
+| File                                                    | Change                                                                                                                                    |
+| ------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
+| `crates/trusted-server-core/src/auction/types.rs`       | Add `cache_id`, `cache_host`, `cache_path` to `Bid` struct                                                                                |
+| `crates/trusted-server-core/src/integrations/prebid.rs` | Extract `ext.prebid.cache.bids.{cacheId,url}` in `parse_bid_object`; update `AuctionBid` → `Bid` conversion to carry the three new fields |
+| `crates/trusted-server-core/src/publisher.rs`           | `build_bid_map`: use `cache_id` for `hb_adid`, emit `hb_cache_host`/`hb_cache_path`                                                       |
+
+> **Implementer note — `AuctionBid` → `Bid` conversion:** `prebid.rs` constructs an
+> intermediate `AuctionBid` type that is later converted to the shared `Bid` type from
+> `types.rs`. The new `cache_id`, `cache_host`, `cache_path` fields must be added to
+> **both** types and the conversion must map them explicitly. Verify by grepping for
+> where `AuctionBid` is constructed and where it is converted to `Bid`; if they are the
+> same type (a type alias), only one struct needs the new fields. If they differ, both
+> need updating or the fields will silently be `None` in `build_bid_map`.
+
+Test files:
+| File | Change |
+|---|---|
+| `crates/trusted-server-core/src/integrations/prebid.rs` tests | Add test: PBS response with cache entry → correct `hb_adid`, `hb_cache_host`, `hb_cache_path` injected |
+| `crates/trusted-server-core/src/publisher.rs` tests | Add test: `build_bid_map` emits cache fields when present; falls back to `ad_id` when absent |
+
+---
+
+## 7. Testing
+
+**Unit tests:**
+
+1. `prebid.rs`: bid with `ext.prebid.cache.bids.cacheId` → `bid.cache_id = Some(uuid)`, `bid.cache_host = Some("openads.adsrvr.org")`, `bid.cache_path = Some("/cache")`
+2. `prebid.rs`: bid without `ext.prebid.cache` → `bid.cache_id = None`, `bid.cache_host = None`, `bid.cache_path = None`
+3. `prebid.rs`: bid with only `adid` (no cache) → `bid.ad_id = Some(...)`, `bid.cache_id = None`
+4. `prebid.rs`: bid with malformed cache URL → `cache_host = None`, `cache_path = None`, no panic
+5. `publisher.rs` `build_bid_map`: bid with `cache_id` → `hb_adid` uses `cache_id`, `hb_cache_host`/`hb_cache_path` emitted
+6. `publisher.rs` `build_bid_map`: bid with no `cache_id` but has `ad_id` → `hb_adid` falls back to `ad_id`, no cache keys emitted
+7. `publisher.rs` `build_bid_map`: APS bid (no `cache_id`, no `ad_id`) → no `hb_adid` emitted
+8. `types.rs`: `Bid` with all three cache fields round-trips through `serde_json::to_string` / `from_str`
+
+> **Note for implementer:** `make_bid()` or equivalent `Bid` construction helpers in test modules
+> must be updated to initialise `cache_id`, `cache_host`, `cache_path` to `None`
+> (they will fail to compile otherwise once the fields are added to the struct).
+
+**Integration verification (manual):**
+
+After deploying, verify `window.tsjs.bids` in browser devtools shows `hb_cache_host`
+and `hb_cache_path` present. Verify `hb_adid` matches the UUID in
+`ext.prebid.cache.bids.cacheId` from the raw PBS response.
+
+---
+
+## 8. Rollout Dependency Checklist
+
+Before this fix has end-to-end effect:
+
+- [ ] TS: this PR merged and deployed
+- [ ] GAM: publisher ad ops updates all Prebid line item creatives to the server-side
+      cache-fetch variant (see §4.6)
+- [ ] PBS: Prebid Cache enabled and populated (confirmed from real response — already
+      working)
+- [ ] Verify: `window.tsjs.bids` shows correct cache UUID in `hb_adid` after deploy
+
+---
+
+## 9. Known Remaining Gaps (not in scope)
+
+| Gap                                                               | Severity | Tracking           |
+| ----------------------------------------------------------------- | -------- | ------------------ |
+| APS win detection over-fires nurl/burl                            | P1       | Separate issue     |
+| Dual bootstrap (`gpt_bootstrap.js` + `installTsAdInit`) sync risk | P2       | Separate issue     |
+| Slim-Prebid bundle not yet built                                  | Phase 2  | §9.8 of design doc |
diff --git a/trusted-server.toml b/trusted-server.toml
index 7f04e277..b8d3c50b 100644
--- a/trusted-server.toml
+++ b/trusted-server.toml
@@ -57,8 +57,8 @@ config_store_id = "<fastly-config-store-id>" # set config/secret store ids for k
 secret_store_id = "<fastly-secret-store-id>"
 
 [integrations.prebid]
-enabled = true
-server_url = "http://68.183.113.79:8000"
+enabled = false
+server_url = "https://prebid-server.example.com/openrtb2/auction"
 timeout_ms = 1000
 bidders = ["kargo", "appnexus", "openx"]
 debug = false
@@ -92,6 +92,12 @@ client_side_bidders = []
 # when.zone = "header"
 # set = { placementId = "_abc" }
 
+# Set to true if PBS is configured to fire win/billing notifications server-side
+# (ext.prebid.events.enabled), to prevent the client from double-firing nurl/burl.
+# suppress_nurl = false
+# For per-bidder suppression, list PBS seats that fire win/billing internally.
+# suppress_nurl_bidders = ["exampleBidder"]
+
 [integrations.nextjs]
 enabled = false
 rewrite_attributes = ["href", "link", "siteBaseUrl", "siteProductionDomain", "url"]
@@ -149,6 +155,7 @@ enabled = false
 script_url = "https://securepubads.g.doubleclick.net/tag/js/gpt.js"
 cache_ttl_seconds = 3600
 rewrite_script = true
+# slim_prebid_url = "https://cdn.example.com/tsjs-prebid.min.js"
 
 # Consent forwarding configuration
 # Controls how Trusted Server interprets and forwards privacy consent signals.
@@ -208,19 +215,19 @@ rewrite_script = true
 # ]
 
 [auction]
-enabled = true
+enabled = false
 providers = ["prebid"]
-# mediator = "adserver_mock"  # will use mediator when set
-timeout_ms = 2000
+# mediator = "adserver_mock"
+timeout_ms = 2000  # override per-publisher via TRUSTED_SERVER__AUCTION__TIMEOUT_MS
 # Context keys the JS client is allowed to forward into auction requests.
 # Keys not in this list are silently dropped. An empty list blocks all keys.
 allowed_context_keys = ["permutive_segments"]
 
 [integrations.aps]
 enabled = false
-pub_id = "your-aps-publisher-id"
-endpoint = "https://origin-mocktioneer.cdintel.com/e/dtb/bid"
-timeout_ms = 1000
+pub_id = "example-publisher"
+endpoint = "https://aps.example.com/e/dtb/bid"
+timeout_ms = 1000  # override per-publisher via TRUSTED_SERVER__INTEGRATIONS__APS__TIMEOUT_MS
 
 [integrations.google_tag_manager]
 enabled = false
@@ -229,11 +236,18 @@ container_id = "GTM-XXXXXX"
 
 [integrations.adserver_mock]
 enabled = false
-endpoint = "https://origin-mocktioneer.cdintel.com/adserver/mediate"
+endpoint = "https://mediator.example.com/adserver/mediate"
 timeout_ms = 1000
 
 # Debug configuration (all flags default to false — do not enable in production)
-# [debug]
+[debug]
+# Inject <!-- ts-debug: ssp=N mediator=ok(N_bids) winning=N --> before </body>.
+# Visible in page source. Disable after investigation.
+# auction_html_comment = true
+#
+# Inject raw adm creative markup into window.tsjs.bids for GPT/GAM bridge
+# debugging while PBS Cache is unavailable. NEVER enable in production.
+# inject_adm_for_testing = true
 # Enable the JA4/TLS fingerprint debug endpoint at GET /_ts/debug/ja4.
 # Returns a plain-text response with the following fields (Fastly-observed values):
 #   ja4         — JA4 TLS client fingerprint
@@ -255,3 +269,19 @@ timeout_ms = 1000
 # query parameter name. Arrays are joined with commas.
 [integrations.adserver_mock.context_query_params]
 permutive_segments = "permutive"
+
+[creative_opportunities]
+gam_network_id = "123456789"
+# FCP is not affected by this value — body content above </body> has already
+# streamed and painted before the hold begins. What this caps is the slip on
+# DOMContentLoaded and window.load. Worst case: a cache-hit page where origin
+# drains in <50 ms but the auction runs to the limit. 500 ms is the recommended
+# default; raise only if your SSPs need more headroom and your analytics confirm
+# the DCL slip is acceptable.
+auction_timeout_ms = 1500  # override via TRUSTED_SERVER__CREATIVE_OPPORTUNITIES__AUCTION_TIMEOUT_MS
+price_granularity = "dense"
+
+# No slot templates are enabled in the checked-in default config. Add
+# `[[creative_opportunities.slot]]` entries via private config or override the
+# entire array via:
+# TRUSTED_SERVER__CREATIVE_OPPORTUNITIES__SLOT='[{"id":"...","gam_unit_path":"...",...}]'