[dhruv8sh]

Summary

• Browser-side ID modules miss visitors whose pages never load them, and their IDs only reach KV after a browser round trip. Server-side providers let Trusted Server fetch ID5, LiveIntent, LiveRamp ATS, UID2 and Yahoo ConnectID IDs at the edge and write them straight to the EC identity graph, and let Lockr revocations reach KV even when no page script runs.
• Several vendors match on a hashed email or their own first-party cookie, so providers get two new inputs: a hashed email from the first-party ts-hem cookie (set with tsjs.setEmail / setHashedEmail, never stored in KV, never sent to the origin or Prebid Server) and declared first-party cookies such as LiveIntent's _lc2_fpi.
• One implementation plan per provider documents each vendor's protocol choices, verified against the live endpoints.

Stacked on #1428, which adds the identity provider framework these providers implement. Merge #1428 first.

Changes

File	Change
integrations/{id5,liveintent,liveramp,uid2,connectid}.rs	New resolving providers, each an [integrations.<id>] integration
integrations/lockr_identity.rs, integrations/lockr.rs	Revoke-only Lockr capture provider behind capture_identity
integrations/vendor_eid.rs, integrations/vendor_request.rs	Permissive vendor EID parsing; is_routable_ip, so loopback and private client IPs are never sent to vendors
ec/identity/{input,descriptor,request,flush,test_support}.rs, ec/mod.rs	Hashed-email and declared-cookie inputs, carried from the request to providers; harness with_cookie
cookies.rs, constants.rs	ts-hem cookie, treated as a TS identity cookie and stripped from origin requests
config.rs, integrations/mod.rs, Cargo.toml	Registration, deploy validation, UID2 secret fields, aes-gcm for UID2 envelopes
trusted-server-js/lib/src/core/hashed_email.ts	setEmail, setHashedEmail, clearHashedEmail
docs/guide/integrations/identity-vendors.md, docs/guide/identity-providers.md	Operator guide for the six vendors; author guide inputs
docs/superpowers/plans/2026-10-28-identity-provider-*.md	Implementation plans

Closes

Closes #1246

Spec

Spec: docs/superpowers/specs/2026-10-20-server-side-identity-providers-design.md (section 12, vendor examples), from #1428.

Test plan

• cargo test-fastly && cargo test-fastly-reuse && cargo test-axum && cargo test-cloudflare && cargo test-spin
• cargo clippy-fastly, clippy-axum, clippy-cloudflare, clippy-cloudflare-wasm, clippy-spin-native, clippy-spin-wasm, clippy-cli, clippy-codegen
• cargo fmt --all -- --check
• Parity tests and scripts/lint-wasm-clock.sh
• JS tests: cd crates/trusted-server-js/lib && npx vitest run, plus npm run lint
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via Viceroy: a headless browser session through ts dev proxy stored ID5, ConnectID (from the hashed email) and LiveIntent's partner IDs in KV, alongside browser-ingested IDs
• Other: provider tests cover request shape, consent skips, error and malformed responses, expiry and refresh, state round trips and conformance for every provider (about 117 provider tests)

Checklist

• Feature PRs: spec linked above, ending in a review log of two or more agent review rounds
• Changes follow AGENTS.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses tracing macros (not println!)
• New code has tests
• No secrets or credentials committed