[dhruv8sh]

Summary

• Implements Parts 0 and 1 of the plan for the server-side identity providers spec (Add design spec for server-side identity providers #1428). Part 2 (the first vendor provider and its rollout controls) is not in this PR.
• Part 0 keeps TS identity cookies away from parties that should not see them. The publisher origin keeps ts-ec but no longer receives ts-eids or the new identity cookies, Prebid Server receives no TS identity cookie in any mode, and the sealed cookies can't be template-cache keys.
• Part 1 holds every page load to one KV write. Only a real browser's document navigation writes, once, after the response is sent. /auction, /_ts/page-bids, /identify and proxy calls no longer write. They carry their changes forward in a sealed __Host-ts-eids-s cookie and per-batch __Host-ts-eids-r-* removal cookies. This keeps a busy page well under Fastly's per-key write limit, and pull sync now runs as the first provider on the new IdentityProvider trait.

Changes

File	Change
crates/trusted-server-core/src/constants.rs, cookies.rs	Identity cookie name and prefix lists; strip helpers that remove cookies by name or prefix
crates/trusted-server-core/src/auction/routing.rs, integrations/prebid.rs	Strip identity cookies from Prebid Server requests in every transport mode; drop a non-UTF-8 Cookie header instead of forwarding it raw
crates/trusted-server-core/src/publisher.rs	Strip ID cookies from origin requests; pass settings to auction EID targeting
crates/trusted-server-core/src/cookies/template_cache_policy.rs	Refuse the sealed identity cookies as template-cache keys
crates/trusted-server-core/src/ec/identity/ (new)	Provider trait, descriptors, catalog, consent policy and fingerprint, record revisions, servability check, sealed AES-256-GCM cookies, staged mutation, coordinator, dispatch, generic pull provider, request and finalize wiring, after-send flush, invariant tests
crates/trusted-server-core/src/ec/kv_types.rs, kv.rs, kv_backend.rs	Record revision, provider state and opt-out fields; single write_identity path; write-counting backend for tests; remove the old sync and bulk-upsert writes
crates/trusted-server-core/src/ec/finalize.rs, ec/mod.rs	Writer decision, browser EIDs seeded into new-visitor creation, removal carry on rotation, pull marks after send, cookie size measurement logs
crates/trusted-server-core/src/ec/eids.rs, identify.rs, admin.rs	Shared servability check for the bidstream, /identify and the admin view; /identify no longer writes; admin redacts provider state
crates/trusted-server-core/src/ec/pull_sync.rs, pull_sync_marker.rs	Reduced to URL, eligibility and completeness helpers; dispatch moves to the generic pull provider
crates/trusted-server-core/src/auction/endpoints.rs	Auction EIDs resolved from the server set; /auction stages a KV gap instead of writing
crates/trusted-server-core/src/http_util.rs, integrations/registry.rs	is_prefetch_request moved here, plus is_document_navigation; writer decision in proxy dispatch
crates/trusted-server-core/src/settings.rs, config.rs, migration_guards.rs, trusted-server.example.toml	[ec.identity] settings and validation; warning for the deprecated key
crates/trusted-server-adapter-fastly/src/app.rs, main.rs	Writer decision and generation seeding; after-send identity flush with an outcome log
crates/trusted-server-adapter-{axum,cloudflare,spin}/src/app.rs	Pass is_real_browser: false
Cargo.toml, crates/trusted-server-core/Cargo.toml, Cargo.lock	Add aes-gcm = "0.10" (the spec's choice for the sealed cookie)
docs/guide/configuration.md, edge-cookies.md, api-reference.md, CHANGELOG.md	Document the single write, the new cookies and the stripped cookies

Changes from the plan

• The __Host-ts-eids-s source index covers every registered [[ec.partners]] source, not only provider-claimed ones. Otherwise a browser entry for a partner that no provider claims could not be staged.
• The invariant tests run in core, driving the same steps the adapter runs. The Fastly adapter's KV store comes from the runtime, so a counting store can't be injected through the router.
• A pull sync 404 now becomes "no ID, retry in 24 hours" (the spec's backoff) instead of a retry on every request.
• Metrics are log lines in the existing measurement style, not per-request counters.
• The existing test-utils feature and TcfConsent::has_vendor_consent are reused instead of new equivalents.
• Hooks that Part 2 uses carry #[expect(dead_code)], so the build fails once Part 2 starts using them and the attribute can't be forgotten.

Closes

Part of #1246. It doesn't close the issue; #1416 does.

Spec

Spec: docs/superpowers/specs/2026-10-20-server-side-identity-providers-design.md (#1428)

Test plan

• cargo test-fastly && cargo test-axum
• cargo clippy-fastly && cargo clippy-axum
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other:
  • the remaining clippy aliases, and cargo test-fastly-reuse, test-cloudflare and test-spin;
  • the parity test, the native build-digest test and its clippy, the wasm clock lint, the CLI tests, and the Markdown format check;
  • the docs-proposal node --test and test.sh suites. shellcheck was not run because it isn't installed locally, and this PR doesn't touch scripts/.

Checklist

• Feature PRs: spec linked above, ending in a review log of two or more agent review rounds
• Changes follow AGENTS.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses log macros (not println!)
• New code has tests
• No secrets or credentials committed

[dhruv8sh]

Closing in favor of #1428