[dhruv8sh]

Stacked on #1487.

Summary

• Adds server-side identity providers for ID5, LiveIntent, LiveRamp, Yahoo ConnectID, UID2, Prebid SharedID, Criteo and Unified ID (TDID). Each one plugs into the S2S EID collection framework from Collect server-side identity provider EIDs in a single page-load write #1487.
• Adds a Lockr cookie capability, so a provider can take its ID from a Lockr-managed first-party cookie.
• Adds the framework hooks the providers need. They could move into Collect server-side identity provider EIDs in a single page-load write #1487 if reviewers prefer:
  • providers can read their own first-party cookies, including every duplicate of a cookie name for opt-out checks
  • provider builds get the configured provider ID
  • lookups can read cookies and build an EID ext
  • providers can name sources they exclude where GDPR applies
  • a failed lookup logs its HTTP status

Per vendor

Provider	Source	Lockr capability
ID5	ID5 first-party cookie (including encoded cookies), else the /gs/v2 fetch API with an RFC 3339 ts and gpp_sid as an array; carries linkType and keeps ext; a universal_uid of 0 is an opt-out	Yes
LiveIntent	Lookup API that sends the LiveIntent first-party cookie; partner IDs are marked; needs a did- distributor ID; segments only when non-empty	No
LiveRamp	First-party envelope cookie (_lr_env, or the bare envelope Prebid stores in idl_env); with an endpoint, placement_id and custom_id_namespace, a visitor without a cookie is looked up server side by Custom ID	Yes
ConnectID	Yahoo's connectId first-party cookie; no server call	No
UID2	First-party token cookie; with an endpoint, the token is refreshed server side before it expires	Yes
SharedID	Prebid _sharedid / _pubcid cookie as an atype 1 EID; honours _pubcid_optout; with generate = true (default off), generates a UUID stored only in the row	No
Criteo	cto_bidid cookie, stored verbatim as the atype 1 EID Prebid sends	No
Unified ID	TDID from the pbjs-unifiedid cookie, with rtiPartner ext and adserver.org inserter/matcher, mm 4	No

Consent and cookie handling

• UID2 is excluded where GDPR applies, based on the visitor's detected jurisdiction. UID2 is not looked up there, UID2 IDs LiveIntent resolves are dropped, and UID2 IDs already stored in the row are removed.
• A vendor cookie fills only the sources it covers; the provider's other due sources are still looked up, and the two results are merged.
• The lookup rate limit is checked only once a request is built, so cookie-only providers use no budget.
• Cookie readers try each value in turn, skipping empty values and IDs that have already expired; opt-out checks look at every duplicate of a cookie.
• Cookie-supplied expiry is bounded, and vendor cookie opt-outs remove stored IDs.

Known limitations

• ConnectID and SharedID opt-outs kept in localStorage are invisible to the server. A leftover connectId cookie is still read until it expires, and SharedID generation should be enabled only where the opt-out lives in the _pubcid_optout cookie.
• LiveRamp server-side lookup needs Custom ID enabled on the placement and the publisher's namespace; it has not been tested against LiveRamp yet.
• Logged-in and hashed-email inputs are not used by any provider.
• Capturing Lockr responses is not supported.

The plans list the remaining unported reference behaviours.

Changes

Area	Change
crates/trusted-server-identity-providers/src/{id5,liveintent,liveramp,connectid,uid2,sharedid,criteo,unifiedid}.rs	Provider implementations and tests
crates/trusted-server-identity-providers/src/common.rs	Shared helpers: cookie name lists, Lockr cookie capability, parsing
crates/trusted-server-core/src/ec/provider.rs, ec/coordinator/	Framework hooks for own-cookie reading, provider ID, EID ext, cookies in lookups, GDPR source exclusion, cookie/lookup merging, and HTTP status logging
crates/trusted-server-core/src/settings.rs, adapter-fastly/src/app.rs	Passes the provider ID and registers providers
trusted-server.example.toml	Example provider config, using example.com hosts except LiveIntent's fixed attribute sources
docs/guide/configuration.md, docs/guide/api-reference.md	Provider configuration docs
docs/superpowers/plans/2026-11-02-identity-provider-*.md	One plan per provider plus the Lockr capability

Closes

Part of #1246 and #1245. No issue is closed yet.

Spec

The spec is in #1487. This PR adds only plans, no new spec.

Test plan

• cargo test-fastly && cargo test-fastly-reuse && cargo test-axum && cargo test-cloudflare && cargo test-spin
• All 8 clippy aliases
• cargo fmt --all -- --check
• Parity tests, plus the template_build_digest test and its clippy run
• scripts/lint-wasm-clock.sh
• JS vitest, format and lint
• Docs and markdown prettier
• ./scripts/test-cli.sh, the node pin guard, docs-proposal scripts, and ts dev lint domains against the base branch
• Local run against ID5's public test partner: the /gs/v2 fetch returned an ID that was stored in KV and attached to the auction
• Local run reading a real LiveRamp envelope cookie into KV
• LiveRamp server-side Custom ID lookup against LiveRamp (pending placement setup)
• UID2 refresh against the UID2 service

Checklist

• Changes follow AGENTS.md conventions
• No unwrap() in production code
• Uses log macros
• New code has tests
• No secrets or credentials committed

[jwrosewell]

@dhruv8sh, the same point as on #1487. Directionally, eight identity vendors as files in one shared crate is not compatible with V2 (the 55 pull requests tracked in #777, merged in order), where each vendor is a module in a folder of its own at identity/<vendor> with its own named maintainer, so each provider owns and maintains its module.

The V2 spec is identifier-modules, with the folder layout in integrations-crate, both in #1342. The associated pull request is #1382 (a module hands core its identifiers, starting with the Prebid EID cookie).

Could you evaluate the V2 spec and #1382 before progressing this pull request?