Rename Synthetic ID to Edge Cookie (EC) and simplify generation

[ChristianPavilonis]

Summary

• Rename "Synthetic ID" to "Edge Cookie (EC)" across all external-facing identifiers, config, internal Rust code, and documentation
• Simplify EC hash generation to use only client IP (IPv4 or /64-masked IPv6) with HMAC-SHA256, removing User-Agent, Accept-Language, Accept-Encoding, random_uuid inputs and Handlebars template rendering
• Downgrade EC ID generation logs from info to debug level since client IP is sensitive data

Changes

File	Change
crates/common/src/edge_cookie.rs (new)	Renamed from synthetic.rs; simplified hash to IP-only HMAC-SHA256; removed template rendering
crates/common/src/synthetic.rs (deleted)	Replaced by edge_cookie.rs
crates/common/src/constants.rs	Renamed constants: SYNTHETIC_ID_HEADER → HEADER_X_TS_EC, cookie/query names updated
crates/common/src/cookies.rs	Updated cookie name synthetic_id → ts-ec, function names to EC
crates/common/src/error.rs	Renamed SyntheticId → Ec error variant; removed Template variant
crates/common/src/settings.rs	Config section [synthetic] → [ec]; removed template field
crates/common/src/settings_data.rs	Updated settings data references to EC
crates/common/src/lib.rs	Module rename synthetic → edge_cookie
crates/common/src/http_util.rs	Updated header references to EC naming
crates/common/src/openrtb.rs	Wire field synthetic_fresh → ec_fresh (breaking wire-protocol change)
crates/common/src/proxy.rs	Updated query param synthetic_id → ts-ec
crates/common/src/publisher.rs	Updated EC references
crates/common/src/consent/mod.rs	Renamed allows_ssc_creation → allows_ec_creation with updated docs and tests
crates/common/src/consent/kv.rs	Updated doc comments to EC naming
crates/common/src/auction/formats.rs	Response headers: X-Synthetic-ID → X-TS-EC, X-Synthetic-Fresh → X-TS-EC-Fresh, X-Synthetic-Trusted-Server → X-TS-EC-Trusted-Server
crates/common/src/integrations/*.rs	Updated EC references across all integrations
crates/common/src/test_support.rs	Updated test helpers for EC naming
crates/common/Cargo.toml	Removed handlebars dependency
crates/js/lib/src/integrations/gpt/index.ts	Updated header name reference
Cargo.lock	Removed handlebars-related entries
crates/integration-tests/Cargo.lock	Synced shared dependency versions (derive_more 2.1.1)
trusted-server.toml	Config section [synthetic] → [ec]; removed template field
CLAUDE.md	Updated file paths and terminology
docs/guide/edge-cookies.md (new)	Replaces synthetic-ids.md
docs/guide/synthetic-ids.md (deleted)	Replaced by edge-cookies.md
docs/**/*.md (30+ files)	Renamed SyntheticID → Edge Cookie throughout documentation

Breaking changes

• Wire protocol: user.ext.synthetic_fresh → user.ext.ec_fresh in OpenRTB bid requests
• HTTP headers: X-Synthetic-ID → X-TS-EC, X-Synthetic-Fresh → X-TS-EC-Fresh
• Cookie name: synthetic_id → ts-ec
• Query parameter: synthetic_id → ts-ec
• Config section: [synthetic] → [ec] (no backward-compat alias)

Closes

Closes #462

Test plan

• cargo test --workspace — all tests passing
• cargo clippy --all-targets --all-features -- -D warnings — zero warnings
• cargo fmt --all -- --check — clean
• JS tests: cd crates/js/lib && npx vitest run — all tests passing
• Prettier: cd docs && npx prettier --check . — clean
• Integration dependency versions synced

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses tracing macros (not println!)
• New code has tests
• No secrets or credentials committed

[aram356]

Summary

Comprehensive rename of Synthetic ID → Server Side Cookie (SSC) with simplified HMAC generation (client IP only, dropping Handlebars templates). Cookie, header, query parameter, config section, and error variants are all renamed. The handlebars dependency is removed.

Blocking

🔧 wrench

• Missing new SSC headers in INTERNAL_HEADERS: x-ts-ssc-fresh and x-ts-ssc-trusted-server are defined but not added to the INTERNAL_HEADERS blocklist, allowing potential leak of user-identity headers to third-party origins via copy_custom_headers (crates/common/src/constants.rs:49)

Non-blocking

🤔 thinking

• Cookie name break: synthetic_id → ts-ssc silently invalidates existing user cookies (crates/common/src/constants.rs:3)
• Query parameter break: synthetic_id → ts-ssc in proxy forwarding may break downstream consumers (crates/common/src/proxy.rs:438)
• Entropy reduction: HMAC now uses only client IP; users behind same NAT share the HMAC prefix (crates/common/src/ssc.rs:63)

📝 note

• Silent template field removal: Old configs with template = "..." are silently ignored (no deny_unknown_fields). Operators won't know the field is unused.

CI Status

• cargo fmt: PASS
• cargo clippy: PASS
• cargo test: PASS
• vitest: PASS
• format-docs: PASS
• format-typescript: PASS
• CodeQL: PASS

[prk-Jr]

Summary

This PR completes the Synthetic ID → Server Side Cookie rename and simplifies ID generation, but I found a couple of migration/privacy regressions plus a docs/behavior mismatch that should be fixed before merge.

Blocking

🔧 wrench

• Docs and implementation diverge on consent + proxy behavior: the new SSC docs state that ID generation/forwarding are consent-gated and that /first-party/proxy generates a new SSC ID when missing, but the current implementation still generates IDs unconditionally in crates/common/src/publisher.rs:239, crates/common/src/integrations/registry.rs:659, and crates/common/src/auction/formats.rs:81, while proxy forwarding only reuses an existing ID in crates/common/src/proxy.rs:427. Either implement the documented rules or update the docs so they match the code.

CI Status

• fmt: PASS
• clippy: PASS
• rust tests: PASS
• js tests: PASS

Addressed: added x-ts-ssc-fresh to INTERNAL_HEADERS, removed x-ts-ssc-trusted-server. Non-blocking items are intentional design choices.