From 11e39dde4b7d6f78bd50fe0b47b3d084a773c871 Mon Sep 17 00:00:00 2001
From: Christian <christianpavilonis@outlook.com>
Date: Wed, 18 Mar 2026 13:17:02 -0500
Subject: [PATCH 1/5] Rename Synthetic ID to Edge Cookie (EC) and simplify
 generation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Rename all external identifiers: x-synthetic-id → x-ts-ec, synthetic_id
  cookie → ts-ec, synthetic_fresh → ec_fresh
- Simplify hash generation to use only client IP with HMAC-SHA256, removing
  User-Agent, Accept-Language, Accept-Encoding, and template rendering
- Rename config section [synthetic] → [ec] with backward-compat alias
- Rename ec.rs to edge_cookie.rs for clarity
- Remove handlebars dependency (and transitive deps)
- Add x-ts-ec-fresh to internal headers blocklist
- Update all docs with new Edge Cookie (EC) terminology
- Fix review findings: remove redundant serde rename, stale optimization
  entry, leftover 'synthetic' references in agent configs and docs

Closes #462
---
 .claude/agents/issue-creator.md               |   2 +-
 .claude/agents/repo-explorer.md               |   2 +-
 CLAUDE.md                                     |   4 +-
 Cargo.lock                                    | 670 ++++++++++--------
 OPTIMIZATION.md                               |   3 +-
 PUBLISHER_IDS_AUDIT.md                        |   2 +-
 crates/common/Cargo.toml                      |   1 -
 crates/common/README.md                       |  18 +-
 crates/common/src/auction/README.md           |   4 +-
 crates/common/src/auction/endpoints.rs        |  17 +-
 crates/common/src/auction/formats.rs          |  25 +-
 crates/common/src/auction/types.rs            |   2 +-
 crates/common/src/consent/kv.rs               |  57 +-
 crates/common/src/consent/mod.rs              |  27 +-
 crates/common/src/constants.rs                |   8 +-
 crates/common/src/cookies.rs                  |  43 +-
 crates/common/src/edge_cookie.rs              | 320 +++++++++
 crates/common/src/error.rs                    |  13 +-
 crates/common/src/http_util.rs                |   6 +-
 .../src/integrations/google_tag_manager.rs    |   8 +-
 crates/common/src/integrations/gpt.rs         |   8 +-
 crates/common/src/integrations/prebid.rs      |   7 +-
 crates/common/src/integrations/registry.rs    | 115 ++-
 crates/common/src/integrations/testlight.rs   |  14 +-
 crates/common/src/lib.rs                      |   5 +-
 crates/common/src/openrtb.rs                  |   4 +-
 crates/common/src/proxy.rs                    | 121 ++--
 crates/common/src/publisher.rs                |  71 +-
 crates/common/src/settings.rs                 |  35 +-
 crates/common/src/settings_data.rs            |   8 +-
 crates/common/src/synthetic.rs                | 354 ---------
 crates/common/src/test_support.rs             |   6 +-
 .../fastly/tests/kv_store/counter_store.json  |   2 +-
 crates/fastly/tests/kv_store/opid_store.json  |   2 +-
 crates/js/lib/src/integrations/gpt/index.ts   |   4 +-
 docs/.vitepress/config.mts                    |   4 +-
 docs/business-use-cases.md                    |   4 +-
 docs/epics/revenue-operations-dashboard.md    |   4 +-
 docs/guide/ad-serving.md                      |   6 +-
 docs/guide/api-reference.md                   |  16 +-
 docs/guide/architecture.md                    |   8 +-
 docs/guide/auction-orchestration.md           |  15 +-
 docs/guide/collective-sync.md                 |  38 +-
 docs/guide/configuration.md                   |  92 +--
 docs/guide/creative-processing.md             |   4 +-
 docs/guide/edge-cookies.md                    |  42 ++
 docs/guide/error-reference.md                 |   8 +-
 docs/guide/first-party-proxy.md               |  50 +-
 docs/guide/gdpr-compliance.md                 |   2 +-
 docs/guide/getting-started.md                 |   4 +-
 docs/guide/integration-guide.md               |  14 +-
 docs/guide/integrations-overview.md           |   8 +-
 docs/guide/integrations/didomi.md             |   2 +-
 docs/guide/integrations/google_tag_manager.md |   2 +-
 docs/guide/integrations/gpt.md                |   2 +-
 docs/guide/integrations/lockr.md              |  14 +-
 docs/guide/integrations/nextjs.md             |   2 +-
 docs/guide/integrations/prebid.md             |  10 +-
 docs/guide/onboarding.md                      |   4 +-
 docs/guide/synthetic-ids.md                   |  43 --
 docs/guide/testing.md                         |  51 +-
 docs/guide/what-is-trusted-server.md          |   2 +-
 docs/index.md                                 |   4 +-
 docs/roadmap.md                               |   6 +-
 trusted-server.toml                           |   9 +-
 65 files changed, 1188 insertions(+), 1270 deletions(-)
 create mode 100644 crates/common/src/edge_cookie.rs
 delete mode 100644 crates/common/src/synthetic.rs
 create mode 100644 docs/guide/edge-cookies.md
 delete mode 100644 docs/guide/synthetic-ids.md

diff --git a/.claude/agents/issue-creator.md b/.claude/agents/issue-creator.md
index ed99dd37..f3f1d405 100644
--- a/.claude/agents/issue-creator.md
+++ b/.claude/agents/issue-creator.md
@@ -79,7 +79,7 @@ Output the issue URL and type.
 - Use issue **types**, not labels, for categorization.
 - Every issue should have clear done-when / acceptance criteria.
 - Use the affected area dropdown values from the templates:
-  - Core (synthetic IDs, cookies, GDPR)
+  - Core (Edge Cookies, GDPR)
   - Integrations (prebid, lockr, permutive, etc.)
   - HTML processing / JS injection
   - Ad serving (Equativ)
diff --git a/.claude/agents/repo-explorer.md b/.claude/agents/repo-explorer.md
index e7fa3114..d1286ced 100644
--- a/.claude/agents/repo-explorer.md
+++ b/.claude/agents/repo-explorer.md
@@ -11,7 +11,7 @@ implementation details.
 
 This is a Rust workspace with three crates:
 
-- `crates/common/` — core library (integrations, HTML processing, synthetic IDs, GDPR)
+- `crates/common/` — core library (integrations, HTML processing, Edge Cookies, GDPR)
 - `crates/fastly/` — Fastly Compute entry point
 - `crates/js/` — TypeScript/JS build pipeline (per-integration IIFE bundles)
 
diff --git a/CLAUDE.md b/CLAUDE.md
index 9ad1845c..26a58929 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -6,7 +6,7 @@
 ## Project Overview
 
 Rust-based edge computing application targeting **Fastly Compute**. Handles
-privacy-preserving synthetic ID generation, ad serving with GDPR compliance,
+privacy-preserving Edge Cookie (EC) ID generation, ad serving with GDPR compliance,
 real-time bidding integration, and publisher-side JavaScript injection.
 
 ## Workspace Layout
@@ -366,7 +366,7 @@ both runtime behavior and build/tooling changes.
 | `crates/common/src/tsjs.rs`                  | Script tag generation with module IDs             |
 | `crates/common/src/html_processor.rs`        | Injects `<script>` at `<head>` start              |
 | `crates/common/src/publisher.rs`             | `/static/tsjs=` handler, concatenates modules     |
-| `crates/common/src/synthetic.rs`             | Synthetic ID generation                           |
+| `crates/common/src/edge_cookie.rs`            | Edge Cookie (EC) ID generation                    |
 | `crates/common/src/cookies.rs`               | Cookie handling                                   |
 | `crates/common/src/gdpr.rs`                  | GDPR consent management                           |
 | `crates/common/src/http_wrapper.rs`          | HTTP abstractions                                 |
diff --git a/Cargo.lock b/Cargo.lock
index 381d4b32..cb1a8aa6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -65,15 +65,15 @@ checksum = "4b46cbb362ab8752921c97e041f5e366ee6297bd428a31275b9fcf1e380f7299"
 
 [[package]]
 name = "anstyle"
-version = "1.0.13"
+version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5192cca8006f1fd4f7237516f40fa183bb07f8fbdfedaa0036de5ea9b0b45e78"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
 
 [[package]]
 name = "anyhow"
-version = "1.0.100"
+version = "1.0.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
 
 [[package]]
 name = "arraydeque"
@@ -89,7 +89,7 @@ checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -112,9 +112,9 @@ checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
 [[package]]
 name = "base64ct"
-version = "1.8.0"
+version = "1.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55248b47b0caf0546f7988906588779981c43bb1bc9d0c44087278f80cdb44ba"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
 [[package]]
 name = "bitflags"
@@ -124,9 +124,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.10.0"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
+checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af"
 dependencies = [
  "serde_core",
 ]
@@ -187,9 +187,9 @@ checksum = "d8e6738dfb11354886f890621b4a34c0b177f75538023f7100b608ab9adbd66b"
 
 [[package]]
 name = "bumpalo"
-version = "3.19.0"
+version = "3.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43"
+checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
 
 [[package]]
 name = "bytes"
@@ -205,9 +205,9 @@ checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
 
 [[package]]
 name = "cc"
-version = "1.2.48"
+version = "1.2.57"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c481bdbf0ed3b892f6f806287d72acd515b352a4ec27a208489b8c1bc839633a"
+checksum = "7a0dd1ca384932ff3641c8718a02769f1698e7563dc6974ffd03346116310423"
 dependencies = [
  "find-msvc-tools",
  "shlex",
@@ -296,18 +296,18 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.59"
+version = "4.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5caf74d17c3aec5495110c34cc3f78644bfa89af6c8993ed4de2790e49b6499"
+checksum = "b193af5b67834b676abd72466a96c1024e6a6ad978a1f484bd90b85c94041351"
 dependencies = [
  "clap_builder",
 ]
 
 [[package]]
 name = "clap_builder"
-version = "4.5.59"
+version = "4.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "370daa45065b80218950227371916a1633217ae42b2715b2287b606dcd618e24"
+checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
 dependencies = [
  "anstyle",
  "clap_lex",
@@ -315,18 +315,18 @@ dependencies = [
 
 [[package]]
 name = "clap_lex"
-version = "1.0.0"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a822ea5bc7590f9d40f1ba12c0dc3c2760f3482c6984db1573ad11031420831"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
 
 [[package]]
 name = "config"
-version = "0.15.19"
+version = "0.15.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b30fa8254caad766fc03cb0ccae691e14bf3bd72bfff27f72802ce729551b3d6"
+checksum = "8e68cfe19cd7d23ffde002c24ffa5cda73931913ef394d5eaaa32037dc940c0c"
 dependencies = [
  "async-trait",
- "convert_case",
+ "convert_case 0.6.0",
  "json5",
  "pathdiff",
  "ron",
@@ -334,8 +334,8 @@ dependencies = [
  "serde-untagged",
  "serde_core",
  "serde_json",
- "toml",
- "winnow",
+ "toml 1.0.7+spec-1.1.0",
+ "winnow 1.0.0",
  "yaml-rust2",
 ]
 
@@ -360,7 +360,7 @@ version = "0.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f9d839f2a20b0aee515dc581a6172f2321f96cab76c1a38a4c584a194955390e"
 dependencies = [
- "getrandom 0.2.16",
+ "getrandom 0.2.17",
  "once_cell",
  "tiny-keccak",
 ]
@@ -374,6 +374,15 @@ dependencies = [
  "unicode-segmentation",
 ]
 
+[[package]]
+name = "convert_case"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "633458d4ef8c78b72454de2d54fd6ab2e60f9e02be22f3c6104cdc8a4e0fceb9"
+dependencies = [
+ "unicode-segmentation",
+]
+
 [[package]]
 name = "cookie"
 version = "0.18.1"
@@ -500,7 +509,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "13b588ba4ac1a99f7f2964d24b3d896ddc6bf847ee3855dbd4366f058cfcd331"
 dependencies = [
  "quote",
- "syn 2.0.111",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -527,7 +536,7 @@ checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -551,7 +560,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "strsim",
- "syn 2.0.111",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -562,7 +571,7 @@ checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
 dependencies = [
  "darling_core",
  "quote",
- "syn 2.0.111",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -577,63 +586,34 @@ dependencies = [
 
 [[package]]
 name = "deranged"
-version = "0.5.5"
+version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ececcb659e7ba858fb4f10388c250a7252eb0a27373f1a72b8748afdd248e587"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
 dependencies = [
  "powerfmt",
  "serde_core",
 ]
 
-[[package]]
-name = "derive_builder"
-version = "0.20.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "507dfb09ea8b7fa618fcf76e953f4f5e192547945816d5358edffe39f6f94947"
-dependencies = [
- "derive_builder_macro",
-]
-
-[[package]]
-name = "derive_builder_core"
-version = "0.20.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d5bcf7b024d6835cfb3d473887cd966994907effbe9227e8c8219824d06c4e8"
-dependencies = [
- "darling",
- "proc-macro2",
- "quote",
- "syn 2.0.111",
-]
-
-[[package]]
-name = "derive_builder_macro"
-version = "0.20.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab63b0e2bf4d5928aff72e83a7dace85d7bba5fe12dcc3c5a572d78caffd3f3c"
-dependencies = [
- "derive_builder_core",
- "syn 2.0.111",
-]
-
 [[package]]
 name = "derive_more"
-version = "2.0.1"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "093242cf7570c207c83073cf82f79706fe7b8317e98620a47d5be7c3d8497678"
+checksum = "d751e9e49156b02b44f9c1815bcb94b984cdcc4396ecc32521c739452808b134"
 dependencies = [
  "derive_more-impl",
 ]
 
 [[package]]
 name = "derive_more-impl"
-version = "2.0.1"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bda628edc44c4bb645fbe0f758797143e4e07926f7ebf4e9bdfbd3d2ce621df3"
+checksum = "799a97264921d8623a957f6c3b9011f3b5492f557bbb7a5a19b7fa6d06ba8dcb"
 dependencies = [
+ "convert_case 0.10.0",
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "rustc_version",
+ "syn 2.0.117",
  "unicode-xid",
 ]
 
@@ -666,7 +646,7 @@ checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -686,9 +666,9 @@ checksum = "75b325c5dbd37f80359721ad39aca5a29fb04c89279657cffdda8736d0c0b9d2"
 
 [[package]]
 name = "dtoa"
-version = "1.0.10"
+version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6add3b8cff394282be81f3fc1a0605db594ed69890078ca6e2cab1c408bcf04"
+checksum = "4c3cf4824e2d5f025c7b531afcb2325364084a16806f6d47fbc1f5fbd9960590"
 
 [[package]]
 name = "dtoa-short"
@@ -767,12 +747,6 @@ dependencies = [
  "cfg-if",
 ]
 
-[[package]]
-name = "env_home"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7f84e12ccf0a7ddc17a6c41c93326024c42920d7ee630d04950e6926645c0fe"
-
 [[package]]
 name = "equivalent"
 version = "1.0.2"
@@ -781,25 +755,15 @@ checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
 [[package]]
 name = "erased-serde"
-version = "0.4.9"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89e8918065695684b2b0702da20382d5ae6065cf3327bc2d6436bd49a71ce9f3"
+checksum = "d2add8a07dd6a8d93ff627029c51de145e12686fbc36ecb298ac22e74cf02dec"
 dependencies = [
  "serde",
  "serde_core",
  "typeid",
 ]
 
-[[package]]
-name = "errno"
-version = "0.3.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
-dependencies = [
- "libc",
- "windows-sys",
-]
-
 [[package]]
 name = "error-stack"
 version = "0.6.0"
@@ -812,9 +776,9 @@ dependencies = [
 
 [[package]]
 name = "fastly"
-version = "0.11.12"
+version = "0.11.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71bbe202b3ec57a5af4beeeb8012d1fe7b058bc1532077fa3625abacfa9cdc95"
+checksum = "5f767502306f09f6dcb76302d09cd2ea8542e228d5f155166f0c2da925e16c61"
 dependencies = [
  "anyhow",
  "bytes",
@@ -840,9 +804,9 @@ dependencies = [
 
 [[package]]
 name = "fastly-macros"
-version = "0.11.12"
+version = "0.11.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4595b318e91b27b4924fec250fd456479808618071854d23a4748a05e711dd0"
+checksum = "51ae08eeeb5ed0c1a8b454fc89dca0e316e13b7889e81fc9a435503c1e84a2d7"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -851,9 +815,9 @@ dependencies = [
 
 [[package]]
 name = "fastly-shared"
-version = "0.11.12"
+version = "0.11.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7588a6d13dfab9e3c8ea5602fea17436fc2bcad14de980c18a50a441a49fe4b2"
+checksum = "d64ed1bba12ca45d1a2a80c2c55d903297adb3eeb4edc9d327c1d51ee709d404"
 dependencies = [
  "bitflags 1.3.2",
  "http",
@@ -861,14 +825,14 @@ dependencies = [
 
 [[package]]
 name = "fastly-sys"
-version = "0.11.12"
+version = "0.11.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "932e5d862257fa58bde67264532d91da2603396331a82bfb7b75a89b3a670de8"
+checksum = "8f1b82ebd99583740a074d8962ca75d7d17065b185a94e4919c3a3f2193268b6"
 dependencies = [
  "bitflags 1.3.2",
  "fastly-shared",
  "wasip2",
- "wit-bindgen",
+ "wit-bindgen 0.46.0",
 ]
 
 [[package]]
@@ -904,15 +868,15 @@ checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
 
 [[package]]
 name = "find-msvc-tools"
-version = "0.1.5"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a3076410a55c90011c298b04d0cfa770b00fa04e1e3c97d3f6c9de105a03844"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 
 [[package]]
 name = "flate2"
-version = "1.1.5"
+version = "1.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfe33edd8e85a12a67454e37f8c75e730830d83e313556ab9ebf9ee7fbeb3bfb"
+checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
 dependencies = [
  "crc32fast",
  "miniz_oxide",
@@ -1001,7 +965,7 @@ checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -1046,9 +1010,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.16"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
 dependencies = [
  "cfg-if",
  "libc",
@@ -1057,14 +1021,15 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.3.4"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
 dependencies = [
  "cfg-if",
  "libc",
  "r-efi",
  "wasip2",
+ "wasip3",
 ]
 
 [[package]]
@@ -1089,22 +1054,6 @@ dependencies = [
  "zerocopy",
 ]
 
-[[package]]
-name = "handlebars"
-version = "6.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b3f9296c208515b87bd915a2f5d1163d4b3f863ba83337d7713cf478055948e"
-dependencies = [
- "derive_builder",
- "log",
- "num-order",
- "pest",
- "pest_derive",
- "serde",
- "serde_json",
- "thiserror 2.0.17",
-]
-
 [[package]]
 name = "hashbrown"
 version = "0.14.5"
@@ -1193,8 +1142,8 @@ dependencies = [
  "proc-macro2",
  "quote",
  "strum_macros",
- "syn 2.0.111",
- "thiserror 2.0.17",
+ "syn 2.0.117",
+ "thiserror 2.0.18",
  "walkdir",
 ]
 
@@ -1206,14 +1155,14 @@ checksum = "d5acda598b043c6386d20fffe86c600b63c7ca4980ee9a28f7e9aaa15d749747"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "iana-time-zone"
-version = "0.1.64"
+version = "0.1.65"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33e57f83510bb73707521ebaffa789ec8caf86f9657cad665b092b581d40e9fb"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
 dependencies = [
  "android_system_properties",
  "core-foundation-sys",
@@ -1281,9 +1230,9 @@ checksum = "7aedcccd01fc5fe81e6b489c15b247b8b0690feb23304303a9e560f37efc560a"
 
 [[package]]
 name = "icu_properties"
-version = "2.1.1"
+version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e93fcd3157766c0c8da2f8cff6ce651a31f0810eaa1c51ec363ef790bbb5fb99"
+checksum = "020bfc02fe870ec3a66d93e677ccca0562506e5872c650f893269e08615d74ec"
 dependencies = [
  "icu_collections",
  "icu_locale_core",
@@ -1295,9 +1244,9 @@ dependencies = [
 
 [[package]]
 name = "icu_properties_data"
-version = "2.1.1"
+version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02845b3647bb045f1100ecd6480ff52f34c35f82d9880e029d329c21d1054899"
+checksum = "616c294cf8d725c6afcd8f55abc17c56464ef6211f9ed59cccffe534129c77af"
 
 [[package]]
 name = "icu_provider"
@@ -1314,6 +1263,12 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
 [[package]]
 name = "ident_case"
 version = "1.0.1"
@@ -1343,12 +1298,14 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.12.1"
+version = "2.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ad4bb2b565bca0645f4d68c5c9af97fba094e9791da685bf83cb5f3ce74acf2"
+checksum = "7714e70437a7dc3ac8eb7e6f8df75fd8eb422675fc7678aff7364301092b1017"
 dependencies = [
  "equivalent",
  "hashbrown 0.16.1",
+ "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -1391,9 +1348,9 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.15"
+version = "1.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
+checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
 
 [[package]]
 name = "jose-b64"
@@ -1433,9 +1390,9 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.83"
+version = "0.3.91"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "464a3709c7f55f1f721e5389aa6ea4e3bc6aba669353300af094b29ffbdde1d8"
+checksum = "b49715b7073f385ba4bc528e5747d02e66cb39c6146efb66b781f131f0fb399c"
 dependencies = [
  "once_cell",
  "wasm-bindgen",
@@ -1462,22 +1419,22 @@ dependencies = [
 ]
 
 [[package]]
-name = "libc"
-version = "0.2.182"
+name = "leb128fmt"
+version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6800badb6cb2082ffd7b6a67e6125bb39f18782f793520caee8cb8846be06112"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
 
 [[package]]
-name = "libm"
-version = "0.2.15"
+name = "libc"
+version = "0.2.183"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9fbbcab51052fe104eb5e5d351cf728d30a5be1fe14d9be8a3b097481fb97de"
+checksum = "b5b646652bf6661599e1da8901b3b9522896f01e736bad5f723fe7a3a27f899d"
 
 [[package]]
-name = "linux-raw-sys"
-version = "0.11.0"
+name = "libm"
+version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df1d3c3b53da64cf5760482273a98e575c651a67eec7f77df96b5b642de8f039"
+checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
 
 [[package]]
 name = "litemap"
@@ -1502,9 +1459,9 @@ checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
 
 [[package]]
 name = "log-fastly"
-version = "0.11.12"
+version = "0.11.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fc98cdb87b71bb8808549dae92b5f4915bfaed44339f1134b62f3bf145c0ad7"
+checksum = "58a5d864949b863161476a8129ef0322c56c77bb15f98d88991002072f497b1e"
 dependencies = [
  "fastly",
  "log",
@@ -1517,7 +1474,7 @@ version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5ff94cb6aef6ee52afd2c69331e9109906d855e82bd241f3110dfdf6185899ab"
 dependencies = [
- "bitflags 2.10.0",
+ "bitflags 2.11.0",
  "cfg-if",
  "cssparser",
  "encoding_rs",
@@ -1527,7 +1484,7 @@ dependencies = [
  "mime",
  "precomputed-hash",
  "selectors",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
 ]
 
 [[package]]
@@ -1538,9 +1495,9 @@ checksum = "b3eede3bdf92f3b4f9dc04072a9ce5ab557d5ec9038773bf9ffcd5588b3cc05b"
 
 [[package]]
 name = "memchr"
-version = "2.7.6"
+version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f52b00d39961fc5b2736ea853c9cc86238e165017a493d1d5c8eac6bdc4cc273"
+checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
 
 [[package]]
 name = "mime"
@@ -1594,7 +1551,7 @@ checksum = "ed3955f1a9c7c0c15e092f9c887db08b1fc683305fdf6eb6684f22555355e202"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -1617,21 +1574,6 @@ dependencies = [
  "num-traits",
 ]
 
-[[package]]
-name = "num-modular"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17bb261bf36fa7d83f4c294f834e91256769097b3cb505d44831e0a179ac647f"
-
-[[package]]
-name = "num-order"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "537b596b97c40fcf8056d153049eb22f481c17ebce72a513ec9286e4986d1bb6"
-dependencies = [
- "num-modular",
-]
-
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -1644,9 +1586,9 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.21.3"
+version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
 [[package]]
 name = "oorandom"
@@ -1727,9 +1669,9 @@ checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
 name = "pest"
-version = "2.8.4"
+version = "2.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cbcfd20a6d4eeba40179f05735784ad32bdaef05ce8e8af05f180d45bb3e7e22"
+checksum = "e0848c601009d37dfa3430c4666e147e49cdcf1b92ecd3e63657d8a5f19da662"
 dependencies = [
  "memchr",
  "ucd-trie",
@@ -1737,9 +1679,9 @@ dependencies = [
 
 [[package]]
 name = "pest_derive"
-version = "2.8.4"
+version = "2.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51f72981ade67b1ca6adc26ec221be9f463f2b5839c7508998daa17c23d94d7f"
+checksum = "11f486f1ea21e6c10ed15d5a7c77165d0ee443402f0780849d1768e7d9d6fe77"
 dependencies = [
  "pest",
  "pest_generator",
@@ -1747,22 +1689,22 @@ dependencies = [
 
 [[package]]
 name = "pest_generator"
-version = "2.8.4"
+version = "2.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dee9efd8cdb50d719a80088b76f81aec7c41ed6d522ee750178f83883d271625"
+checksum = "8040c4647b13b210a963c1ed407c1ff4fdfa01c31d6d2a098218702e6664f94f"
 dependencies = [
  "pest",
  "pest_meta",
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "pest_meta"
-version = "2.8.4"
+version = "2.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf1d70880e76bdc13ba52eafa6239ce793d85c8e43896507e43dd8984ff05b82"
+checksum = "89815c69d36021a140146f26659a81d6c2afa33d216d736dd4be5381a7362220"
 dependencies = [
  "pest",
  "sha2 0.10.9",
@@ -1809,7 +1751,7 @@ dependencies = [
  "phf_shared",
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -1823,9 +1765,9 @@ dependencies = [
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.16"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
 [[package]]
 name = "pkcs1"
@@ -1896,7 +1838,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
 dependencies = [
  "proc-macro2",
- "syn 2.0.111",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -1927,32 +1869,32 @@ dependencies = [
  "proc-macro-error-attr2",
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.103"
+version = "1.0.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ee95bc4ef87b8d5ba32e8b7714ccc834865276eab0aed5c9958d00ec45f49e8"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.42"
+version = "1.0.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a338cc41d27e6cc6dce6cefc13a0729dfbb81c262b1f519331575dd80ef3067f"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
 dependencies = [
  "proc-macro2",
 ]
 
 [[package]]
 name = "r-efi"
-version = "5.3.0"
+version = "6.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
 [[package]]
 name = "rand"
@@ -1981,7 +1923,7 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 dependencies = [
- "getrandom 0.2.16",
+ "getrandom 0.2.17",
 ]
 
 [[package]]
@@ -1990,7 +1932,7 @@ version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
- "bitflags 2.10.0",
+ "bitflags 2.11.0",
 ]
 
 [[package]]
@@ -2007,9 +1949,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.13"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5276caf25ac86c8d810222b3dbb938e512c55c6831a10f3e6ed1c93b84041f1c"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -2018,9 +1960,9 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.8"
+version = "0.8.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58"
+checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
 
 [[package]]
 name = "ron"
@@ -2028,7 +1970,7 @@ version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fd490c5b18261893f14449cbd28cb9c0b637aebf161cd77900bfdedaff21ec32"
 dependencies = [
- "bitflags 2.10.0",
+ "bitflags 2.11.0",
  "once_cell",
  "serde",
  "serde_derive",
@@ -2081,19 +2023,6 @@ dependencies = [
  "semver",
 ]
 
-[[package]]
-name = "rustix"
-version = "1.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd15f8a2c5551a84d56efdc1cd049089e409ac19a3072d5037a17fd70719ff3e"
-dependencies = [
- "bitflags 2.10.0",
- "errno",
- "libc",
- "linux-raw-sys",
- "windows-sys",
-]
-
 [[package]]
 name = "rustversion"
 version = "1.0.22"
@@ -2102,9 +2031,9 @@ checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
 
 [[package]]
 name = "ryu"
-version = "1.0.20"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
 [[package]]
 name = "same-file"
@@ -2140,7 +2069,7 @@ version = "0.33.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "feef350c36147532e1b79ea5c1f3791373e61cbd9a6a2615413b3807bb164fb7"
 dependencies = [
- "bitflags 2.10.0",
+ "bitflags 2.11.0",
  "cssparser",
  "derive_more",
  "log",
@@ -2198,7 +2127,7 @@ checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -2222,14 +2151,14 @@ checksum = "175ee3e80ae9982737ca543e96133087cbd9a485eecc3bc4de9c1a37b47ea59c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "serde_spanned"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e24345aa0fe688594e73770a5f6d1b216508b4f93484c0026d521acd30134392"
+checksum = "f8bbf91e5a4d6315eee45e704372590b30e260ee83af6639d64557f51b067776"
 dependencies = [
  "serde_core",
 ]
@@ -2297,21 +2226,21 @@ dependencies = [
 
 [[package]]
 name = "simd-adler32"
-version = "0.3.7"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d66dc143e6b11c1eddc06d5c423cfc97062865baf299914ab64caa38182078fe"
+checksum = "e320a6c5ad31d271ad523dcf3ad13e2767ad8b1cb8f047f75a8aeaf8da139da2"
 
 [[package]]
 name = "siphasher"
-version = "1.0.1"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56199f7ddabf13fe5074ce809e7d3f42b42ae711800501b5b16ea82ad029c39d"
+checksum = "b2aa850e253778c88a04c3d7323b043aeda9d3e30d5971937c1855769763678e"
 
 [[package]]
 name = "slab"
-version = "0.4.11"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2ae44ef20feb57a68b23d846850f861394c2e02dc425a50098ae8c90267589"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
 [[package]]
 name = "smallvec"
@@ -2356,7 +2285,7 @@ dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -2378,9 +2307,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.111"
+version = "2.0.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "390cc9a294ab71bdb1aa2e99d13be9c753cd2d7bd6560c77118597410c4d2e87"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2395,7 +2324,7 @@ checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -2418,11 +2347,11 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.17"
+version = "2.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f63587ca0f12b72a0600bcba1d40081f830876000bb46dd2337a3051618f4fc8"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
 dependencies = [
- "thiserror-impl 2.0.17",
+ "thiserror-impl 2.0.18",
 ]
 
 [[package]]
@@ -2433,18 +2362,18 @@ checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.17"
+version = "2.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ff15c8ecd7de3849db632e14d18d2571fa09dfc5ed93479bc4485c7a517c913"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -2509,9 +2438,9 @@ dependencies = [
 
 [[package]]
 name = "tokio"
-version = "1.49.0"
+version = "1.50.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72a2903cd7736441aac9df9d7688bd0ce48edccaadf181c3b90be801e81d3d86"
+checksum = "27ad5e34374e03cfffefc301becb44e9dc3c17584f414349ebe29ed26661822d"
 dependencies = [
  "bytes",
  "pin-project-lite",
@@ -2520,20 +2449,20 @@ dependencies = [
 
 [[package]]
 name = "tokio-macros"
-version = "2.6.0"
+version = "2.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5"
+checksum = "5c55a2eff8b69ce66c84f85e1da1c233edc36ceb85a2058d11b0d6a3c7e7569c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "tokio-stream"
-version = "0.1.17"
+version = "0.1.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eca58d7bba4a75707817a2c44174253f9236b2d5fbd055602e9d5c07c139a047"
+checksum = "32da49809aab5c3bc678af03902d4ccddea2a87d028d86392a4b1560c6906c70"
 dependencies = [
  "futures-core",
  "pin-project-lite",
@@ -2553,42 +2482,64 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "0.9.8"
+version = "0.9.12+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0dc8b1fb61449e27716ec0e1bdf0f6b8f3e8f6b05391e8497b8b6d7804ea6d8"
+checksum = "cf92845e79fc2e2def6a5d828f0801e29a2f8acc037becc5ab08595c7d5e9863"
 dependencies = [
  "indexmap",
  "serde_core",
  "serde_spanned",
- "toml_datetime",
+ "toml_datetime 0.7.5+spec-1.1.0",
  "toml_parser",
  "toml_writer",
- "winnow",
+ "winnow 0.7.15",
+]
+
+[[package]]
+name = "toml"
+version = "1.0.7+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd28d57d8a6f6e458bc0b8784f8fdcc4b99a437936056fa122cb234f18656a96"
+dependencies = [
+ "serde_core",
+ "serde_spanned",
+ "toml_datetime 1.0.1+spec-1.1.0",
+ "toml_parser",
+ "winnow 1.0.0",
 ]
 
 [[package]]
 name = "toml_datetime"
-version = "0.7.3"
+version = "0.7.5+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "1.0.1+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2cdb639ebbc97961c51720f858597f7f24c4fc295327923af55b74c3c724533"
+checksum = "9b320e741db58cac564e26c607d3cc1fdc4a88fd36c879568c07856ed83ff3e9"
 dependencies = [
  "serde_core",
 ]
 
 [[package]]
 name = "toml_parser"
-version = "1.0.4"
+version = "1.0.10+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0cbe268d35bdb4bb5a56a2de88d0ad0eb70af5384a99d648cd4b3d04039800e"
+checksum = "7df25b4befd31c4816df190124375d5a20c6b6921e2cad937316de3fccd63420"
 dependencies = [
- "winnow",
+ "winnow 1.0.0",
 ]
 
 [[package]]
 name = "toml_writer"
-version = "1.0.4"
+version = "1.0.7+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df8b2b54733674ad286d16267dcfc7a71ed5c776e4ac7aa3c3e2561f7c637bf2"
+checksum = "f17aaa1c6e3dc22b1da4b6bba97d066e354c7945cac2f7852d4e4e7ca7a6b56d"
 
 [[package]]
 name = "trusted-server-common"
@@ -2609,7 +2560,6 @@ dependencies = [
  "fastly",
  "flate2",
  "futures",
- "handlebars",
  "hex",
  "hmac",
  "http",
@@ -2629,7 +2579,7 @@ dependencies = [
  "temp-env",
  "tokio",
  "tokio-test",
- "toml",
+ "toml 0.9.12+spec-1.1.0",
  "trusted-server-js",
  "trusted-server-openrtb",
  "url",
@@ -2694,9 +2644,9 @@ checksum = "2896d95c02a80c6d6a5d6e953d479f5ddf2dfdb6a244441010e373ac0fb88971"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.22"
+version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
 [[package]]
 name = "unicode-segmentation"
@@ -2746,11 +2696,11 @@ checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
 [[package]]
 name = "uuid"
-version = "1.18.1"
+version = "1.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f87b8aa10b915a06587d0dec516c282ff295b475d94abf425d62b57710070a2"
+checksum = "a68d3c8f01c0cfa54a75291d83601161799e4a89a39e0929f4b0354d88757a37"
 dependencies = [
- "getrandom 0.3.4",
+ "getrandom 0.4.2",
  "js-sys",
  "wasm-bindgen",
 ]
@@ -2782,7 +2732,7 @@ dependencies = [
  "proc-macro-error2",
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -2809,18 +2759,27 @@ checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
 [[package]]
 name = "wasip2"
-version = "1.0.1+wasi-0.2.4"
+version = "1.0.2+wasi-0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0562428422c63773dad2c345a1882263bbf4d65cf3f42e90921f787ef5ad58e7"
+checksum = "9517f9239f02c069db75e65f174b3da828fe5f5b945c4dd26bd25d89c03ebcf5"
 dependencies = [
- "wit-bindgen",
+ "wit-bindgen 0.51.0",
+]
+
+[[package]]
+name = "wasip3"
+version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
+dependencies = [
+ "wit-bindgen 0.51.0",
 ]
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.106"
+version = "0.2.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d759f433fa64a2d763d1340820e46e111a7a5ab75f993d1852d70b03dbb80fd"
+checksum = "6532f9a5c1ece3798cb1c2cfdba640b9b3ba884f5db45973a6f442510a87d38e"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -2831,9 +2790,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.106"
+version = "0.2.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48cb0d2638f8baedbc542ed444afc0644a29166f1595371af4fecf8ce1e7eeb3"
+checksum = "18a2d50fcf105fb33bb15f00e7a77b772945a2ee45dcf454961fd843e74c18e6"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -2841,35 +2800,67 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.106"
+version = "0.2.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cefb59d5cd5f92d9dcf80e4683949f15ca4b511f4ac0a6e14d4e1ac60c6ecd40"
+checksum = "03ce4caeaac547cdf713d280eda22a730824dd11e6b8c3ca9e42247b25c631e3"
 dependencies = [
  "bumpalo",
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn 2.0.117",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.106"
+version = "0.2.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cbc538057e648b67f72a982e708d485b2efa771e1ac05fec311f9f63e5800db4"
+checksum = "75a326b8c223ee17883a4251907455a2431acc2791c98c26279376490c378c16"
 dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "wasm-encoder"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
+dependencies = [
+ "leb128fmt",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
+dependencies = [
+ "anyhow",
+ "indexmap",
+ "wasm-encoder",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
+dependencies = [
+ "bitflags 2.11.0",
+ "hashbrown 0.15.5",
+ "indexmap",
+ "semver",
+]
+
 [[package]]
 name = "which"
-version = "8.0.0"
+version = "8.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3fabb953106c3c8eea8306e4393700d7657561cb43122571b172bbfb7c7ba1d"
+checksum = "81995fafaaaf6ae47a7d0cc83c67caf92aeb7e5331650ae6ff856f7c0c60c459"
 dependencies = [
- "env_home",
- "rustix",
- "winsafe",
+ "libc",
 ]
 
 [[package]]
@@ -2902,7 +2893,7 @@ checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -2913,7 +2904,7 @@ checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -2951,26 +2942,115 @@ dependencies = [
 
 [[package]]
 name = "winnow"
-version = "0.7.14"
+version = "0.7.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a5364e9d77fcdeeaa6062ced926ee3381faa2ee02d3eb83a5c27a8825540829"
+checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
+
+[[package]]
+name = "winnow"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a90e88e4667264a994d34e6d1ab2d26d398dcdca8b7f52bec8668957517fc7d8"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
-name = "winsafe"
-version = "0.0.19"
+name = "wit-bindgen"
+version = "0.46.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d135d17ab770252ad95e9a872d365cf3090e3be864a34ab46f48555993efc904"
+checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59"
+dependencies = [
+ "bitflags 2.11.0",
+]
 
 [[package]]
 name = "wit-bindgen"
-version = "0.46.0"
+version = "0.51.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59"
+checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+dependencies = [
+ "bitflags 2.11.0",
+ "wit-bindgen-rust-macro",
+]
+
+[[package]]
+name = "wit-bindgen-core"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
+dependencies = [
+ "anyhow",
+ "heck",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-bindgen-rust"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
+dependencies = [
+ "anyhow",
+ "heck",
+ "indexmap",
+ "prettyplease",
+ "syn 2.0.117",
+ "wasm-metadata",
+ "wit-bindgen-core",
+ "wit-component",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
+dependencies = [
+ "anyhow",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+ "wit-bindgen-core",
+ "wit-bindgen-rust",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
+dependencies = [
+ "anyhow",
+ "bitflags 2.11.0",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder",
+ "wasm-metadata",
+ "wasmparser",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
 dependencies = [
- "bitflags 2.10.0",
+ "anyhow",
+ "id-arena",
+ "indexmap",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-xid",
+ "wasmparser",
 ]
 
 [[package]]
@@ -3009,28 +3089,28 @@ checksum = "b659052874eb698efe5b9e8cf382204678a0086ebf46982b79d6ca3182927e5d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn 2.0.117",
  "synstructure",
 ]
 
 [[package]]
 name = "zerocopy"
-version = "0.8.31"
+version = "0.8.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd74ec98b9250adb3ca554bdde269adf631549f51d8a8f8f0a10b50f1cb298c3"
+checksum = "f2578b716f8a7a858b7f02d5bd870c14bf4ddbbcf3a4c05414ba6503640505e3"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.31"
+version = "0.8.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8a8d209fdf45cf5138cbb5a506f6b52522a25afccc534d1475dad8e31105c6a"
+checksum = "7e6cc098ea4d3bd6246687de65af3f920c430e236bee1e3bf2e441463f08a02f"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn 2.0.117",
 ]
 
 [[package]]
@@ -3050,7 +3130,7 @@ checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn 2.0.117",
  "synstructure",
 ]
 
@@ -3093,7 +3173,7 @@ checksum = "eadce39539ca5cb3985590102671f2567e659fca9666581ad3411d59207951f3"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn 2.0.117",
 ]
 
 [[package]]
diff --git a/OPTIMIZATION.md b/OPTIMIZATION.md
index 05e23247..62e4ce2b 100644
--- a/OPTIMIZATION.md
+++ b/OPTIMIZATION.md
@@ -35,7 +35,7 @@ This document presents a performance analysis and optimization plan for the Trus
 | ~2% | `IntegrationRegistry` | Route lookup + attribute rewriting + initialization |
 | ~0.8% | Memory allocation (`RawVec::reserve`) | Buffer growth during processing |
 | ~0.5% | Logging (`fern` / `log_fastly`) | Minimal overhead |
-| ~0.5% | Synthetic ID generation | HMAC computation |
+| ~0.5% | EC ID generation | HMAC computation |
 | ~0.5% | Header extraction | `fastly::http::handle::get_header_values` |
 
 ### Key Takeaways
@@ -271,7 +271,6 @@ let settings: Settings = postcard::from_bytes(SETTINGS_DATA)
 | `eq_ignore_ascii_case` for compression detection | `streaming_processor.rs:47` | 5 |
 | `Cow<str>` for string replacements | `streaming_replacer.rs:120-125` | 5-10 |
 | Remove base64 roundtrip in token computation | `http_util.rs:286-294` | 10-15 |
-| Replace Handlebars with manual interpolation | `synthetic.rs:82-99` | ~20 |
 | Cache `origin_host()` result per-request | `settings.rs` | 5-10 |
 
 ---
diff --git a/PUBLISHER_IDS_AUDIT.md b/PUBLISHER_IDS_AUDIT.md
index cf9b3195..470e2ca0 100644
--- a/PUBLISHER_IDS_AUDIT.md
+++ b/PUBLISHER_IDS_AUDIT.md
@@ -11,7 +11,7 @@ This document lists all publisher-specific IDs and configurations found in the c
 - `server_url = "https://securepubads.g.doubleclick.net/gampad/ads"` (line 15)
 
 **Equativ Configuration:**
-- `sync_url = "https://adapi-srv-eu.smartadserver.com/ac?pgid=2040327&fmtid=137675&synthetic_id={{synthetic_id}}"` (line 8)
+- `sync_url = "https://adapi-srv-eu.smartadserver.com/ac?pgid=2040327&fmtid=137675&ec_id={{ec_id}}"` (line 8)
   - Page ID: `2040327`
   - Format ID: `137675`
 
diff --git a/crates/common/Cargo.toml b/crates/common/Cargo.toml
index 0e3f0f51..6ed40827 100644
--- a/crates/common/Cargo.toml
+++ b/crates/common/Cargo.toml
@@ -25,7 +25,6 @@ error-stack = { workspace = true }
 fastly = { workspace = true }
 flate2 = { workspace = true }
 futures = { workspace = true }
-handlebars = { workspace = true }
 hex = { workspace = true }
 hmac = { workspace = true }
 http = { workspace = true }
diff --git a/crates/common/README.md b/crates/common/README.md
index 6e40e99c..74179c0e 100644
--- a/crates/common/README.md
+++ b/crates/common/README.md
@@ -47,12 +47,12 @@ JS bundles (served by publisher module):
 
 Behavior is covered by an extensive test suite in `crates/common/src/creative.rs`.
 
-## Synthetic Identifier Propagation
-
-- `synthetic.rs` generates a synthetic identifier per user request and exposes helpers:
-  - `generate_synthetic_id` — creates a fresh HMAC-based ID using request signals and appends a short random suffix (format: `64hex.6alnum`).
-  - `get_synthetic_id` — extracts an existing ID from the `x-synthetic-id` header or `synthetic_id` cookie.
-  - `get_or_generate_synthetic_id` — reuses the existing ID when present, otherwise creates one.
-- `publisher.rs::handle_publisher_request` stamps proxied origin responses with `x-synthetic-id`, and (when absent) issues the `synthetic_id` cookie so the browser keeps the identifier on subsequent requests.
-- `proxy.rs::handle_first_party_proxy` replays the identifier to third-party creative origins by appending `synthetic_id=<value>` to the reconstructed target URL, follows redirects (301/302/303/307/308) up to four hops, and keeps downstream fetches linked to the same user scope.
-- `proxy.rs::handle_first_party_click` adds `synthetic_id=<value>` to outbound click redirect URLs so analytics endpoints can associate clicks with impressions without third-party cookies.
+## Edge Cookie (EC) Identifier Propagation
+
+- `edge_cookie.rs` generates an edge cookie identifier per user request and exposes helpers:
+  - `generate_ec_id` — creates a fresh HMAC-based ID using the client IP address and appends a short random suffix (format: `64hex.6alnum`).
+  - `get_ec_id` — extracts an existing ID from the `x-ts-ec` header or `ts-ec` cookie.
+  - `get_or_generate_ec_id` — reuses the existing ID when present, otherwise creates one.
+- `publisher.rs::handle_publisher_request` stamps proxied origin responses with `x-ts-ec`, and (when absent) issues the `ts-ec` cookie so the browser keeps the identifier on subsequent requests.
+- `proxy.rs::handle_first_party_proxy` replays the identifier to third-party creative origins by appending `ts-ec=<value>` to the reconstructed target URL, follows redirects (301/302/303/307/308) up to four hops, and keeps downstream fetches linked to the same user scope.
+- `proxy.rs::handle_first_party_click` adds `ts-ec=<value>` to outbound click redirect URLs so analytics endpoints can associate clicks with impressions without third-party cookies.
diff --git a/crates/common/src/auction/README.md b/crates/common/src/auction/README.md
index 64877d22..5c85f190 100644
--- a/crates/common/src/auction/README.md
+++ b/crates/common/src/auction/README.md
@@ -67,7 +67,7 @@ When a request arrives at the `/auction` endpoint, it goes through the following
                               ▼
 ┌──────────────────────────────────────────────────────────────────────┐
 │  4. Generate User IDs (mod.rs:206-214)                               │
-│     - Create/retrieve synthetic ID (persistent)                      │
+│     - Create/retrieve EC ID (persistent)                             │
 │     - Generate fresh ID (per-request)                                │
 └──────────────────────────────────────────────────────────────────────┘
                               │
@@ -519,7 +519,7 @@ impl AuctionProvider for YourAuctionProvider {
 
 APS and adserver_mock providers are used for testing the orchestration pattern:
 
-- **APS Mock**: Returns synthetic bids with Amazon branding
+- **APS Mock**: Returns mock bids with Amazon branding
 - **AdServer Mock**: Acts as mediator by calling mocktioneer's mediation endpoint, selects winning bids based on highest CPM
 
 Set `mock = false` in APS config when real APS integration is ready.
diff --git a/crates/common/src/auction/endpoints.rs b/crates/common/src/auction/endpoints.rs
index bf039358..d7eee351 100644
--- a/crates/common/src/auction/endpoints.rs
+++ b/crates/common/src/auction/endpoints.rs
@@ -6,10 +6,10 @@ use fastly::{Request, Response};
 use crate::auction::formats::AdRequest;
 use crate::consent;
 use crate::cookies::handle_request_cookies;
+use crate::edge_cookie::get_or_generate_ec_id;
 use crate::error::TrustedServerError;
 use crate::geo::GeoInfo;
 use crate::settings::Settings;
-use crate::synthetic::get_or_generate_synthetic_id;
 
 use super::formats::{convert_to_openrtb_response, convert_tsjs_to_auction_request};
 use super::types::AuctionContext;
@@ -45,13 +45,12 @@ pub async fn handle_auction(
         body.ad_units.len()
     );
 
-    // Generate synthetic ID early so the consent pipeline can use it for
+    // Generate EC ID early so the consent pipeline can use it for
     // KV Store fallback/write operations.
-    let synthetic_id = get_or_generate_synthetic_id(settings, &req).change_context(
-        TrustedServerError::Auction {
-            message: "Failed to generate synthetic ID".to_string(),
-        },
-    )?;
+    let ec_id =
+        get_or_generate_ec_id(settings, &req).change_context(TrustedServerError::Auction {
+            message: "Failed to generate EC ID".to_string(),
+        })?;
 
     // Extract consent from request cookies, headers, and geo.
     let cookie_jar = handle_request_cookies(&req)?;
@@ -61,12 +60,12 @@ pub async fn handle_auction(
         req: &req,
         config: &settings.consent,
         geo: geo.as_ref(),
-        synthetic_id: Some(synthetic_id.as_str()),
+        ec_id: Some(ec_id.as_str()),
     });
 
     // Convert tsjs request format to auction request
     let auction_request =
-        convert_tsjs_to_auction_request(&body, settings, &req, consent_context, &synthetic_id)?;
+        convert_tsjs_to_auction_request(&body, settings, &req, consent_context, &ec_id)?;
 
     // Create auction context
     let context = AuctionContext {
diff --git a/crates/common/src/auction/formats.rs b/crates/common/src/auction/formats.rs
index 6cc7055b..5710607b 100644
--- a/crates/common/src/auction/formats.rs
+++ b/crates/common/src/auction/formats.rs
@@ -14,12 +14,13 @@ use uuid::Uuid;
 
 use crate::auction::context::ContextValue;
 use crate::consent::ConsentContext;
+use crate::constants::{HEADER_X_TS_EC, HEADER_X_TS_EC_FRESH};
 use crate::creative;
+use crate::edge_cookie::generate_ec_id;
 use crate::error::TrustedServerError;
 use crate::geo::GeoInfo;
 use crate::openrtb::{to_openrtb_i32, OpenRtbBid, OpenRtbResponse, ResponseExt, SeatBid, ToExt};
 use crate::settings::Settings;
-use crate::synthetic::generate_synthetic_id;
 
 use super::orchestrator::OrchestrationResult;
 use super::types::{
@@ -71,26 +72,25 @@ pub struct BannerUnit {
 /// (the `/auction` endpoint handler) and forwarded through to the
 /// [`OpenRTB`][`crate::openrtb::OpenRtbRequest`] bid request.
 ///
-/// The `synthetic_id` is generated by the caller before the consent pipeline
+/// The `ec_id` is generated by the caller before the consent pipeline
 /// runs, so that KV Store operations can use it as a key.
 ///
 /// # Errors
 ///
 /// Returns an error if:
-/// - Fresh synthetic ID generation fails
+/// - Fresh EC ID generation fails
 /// - Request contains invalid banner sizes (must be [width, height])
 pub fn convert_tsjs_to_auction_request(
     body: &AdRequest,
     settings: &Settings,
     req: &Request,
     consent: ConsentContext,
-    synthetic_id: &str,
+    ec_id: &str,
 ) -> Result<AuctionRequest, Report<TrustedServerError>> {
-    let synthetic_id = synthetic_id.to_owned();
-    let fresh_id =
-        generate_synthetic_id(settings, req).change_context(TrustedServerError::Auction {
-            message: "Failed to generate fresh ID".to_string(),
-        })?;
+    let ec_id = ec_id.to_owned();
+    let fresh_id = generate_ec_id(settings, req).change_context(TrustedServerError::Auction {
+        message: "Failed to generate fresh EC ID".to_string(),
+    })?;
 
     // Convert ad units to slots
     let mut slots = Vec::new();
@@ -183,7 +183,7 @@ pub fn convert_tsjs_to_auction_request(
             page_url: Some(format!("https://{}", settings.publisher.domain)),
         },
         user: UserInfo {
-            id: synthetic_id,
+            id: ec_id,
             fresh_id,
             consent: Some(consent),
         },
@@ -309,8 +309,7 @@ pub fn convert_to_openrtb_response(
 
     Ok(Response::from_status(StatusCode::OK)
         .with_header(header::CONTENT_TYPE, "application/json")
-        .with_header("X-Synthetic-ID", &auction_request.user.id)
-        .with_header("X-Synthetic-Fresh", &auction_request.user.fresh_id)
-        .with_header("X-Synthetic-Trusted-Server", &auction_request.user.id)
+        .with_header(HEADER_X_TS_EC, &auction_request.user.id)
+        .with_header(HEADER_X_TS_EC_FRESH, &auction_request.user.fresh_id)
         .with_body(body_bytes))
 }
diff --git a/crates/common/src/auction/types.rs b/crates/common/src/auction/types.rs
index 0838ec2b..aa863d61 100644
--- a/crates/common/src/auction/types.rs
+++ b/crates/common/src/auction/types.rs
@@ -69,7 +69,7 @@ pub struct PublisherInfo {
 /// Privacy-preserving user information.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct UserInfo {
-    /// Synthetic/hashed user ID
+    /// Stable EC ID (from cookie or freshly generated)
     pub id: String,
     /// Fresh ID for this session
     pub fresh_id: String,
diff --git a/crates/common/src/consent/kv.rs b/crates/common/src/consent/kv.rs
index 47323af1..961a4252 100644
--- a/crates/common/src/consent/kv.rs
+++ b/crates/common/src/consent/kv.rs
@@ -1,7 +1,7 @@
 //! KV Store consent persistence.
 //!
 //! Stores and retrieves consent data from a Fastly KV Store, keyed by
-//! Synthetic ID. This provides consent continuity for returning users
+//! EC ID. This provides consent continuity for returning users
 //! whose browsers may not have consent cookies on every request.
 //!
 //! # Storage layout
@@ -248,13 +248,9 @@ fn open_store(store_name: &str) -> Option<fastly::kv_store::KVStore> {
 /// Entries written by older code versions may lack metadata, in which case
 /// this returns `false` and the entry will be unconditionally re-written
 /// with the current fingerprint (self-healing migration).
-fn fingerprint_unchanged(
-    store: &fastly::kv_store::KVStore,
-    synthetic_id: &str,
-    new_fp: &str,
-) -> bool {
+fn fingerprint_unchanged(store: &fastly::kv_store::KVStore, ec_id: &str, new_fp: &str) -> bool {
     let stored_fp = store
-        .lookup(synthetic_id)
+        .lookup(ec_id)
         .ok()
         .and_then(|resp| resp.metadata())
         .and_then(|bytes| serde_json::from_slice::<ConsentKvMetadata>(&bytes).ok())
@@ -263,7 +259,7 @@ fn fingerprint_unchanged(
     stored_fp.as_deref() == Some(new_fp)
 }
 
-/// Loads consent data from the KV Store for a given Synthetic ID.
+/// Loads consent data from the KV Store for a given EC ID.
 ///
 /// Returns `Some(ConsentContext)` if a valid entry is found, [`None`] if the
 /// key does not exist or deserialization fails. Errors are logged but never
@@ -272,15 +268,15 @@ fn fingerprint_unchanged(
 /// # Arguments
 ///
 /// * `store_name` — The KV Store name (from `consent.consent_store` config).
-/// * `synthetic_id` — The Synthetic ID used as the KV Store key.
+/// * `ec_id` — The EC ID used as the KV Store key.
 #[must_use]
-pub fn load_consent_from_kv(store_name: &str, synthetic_id: &str) -> Option<ConsentContext> {
+pub fn load_consent_from_kv(store_name: &str, ec_id: &str) -> Option<ConsentContext> {
     let store = open_store(store_name)?;
 
-    let mut response = match store.lookup(synthetic_id) {
+    let mut response = match store.lookup(ec_id) {
         Ok(resp) => resp,
         Err(e) => {
-            log::debug!("Consent KV lookup miss for '{synthetic_id}': {e}");
+            log::debug!("Consent KV lookup miss for '{ec_id}': {e}");
             return None;
         }
     };
@@ -289,13 +285,13 @@ pub fn load_consent_from_kv(store_name: &str, synthetic_id: &str) -> Option<Cons
     match serde_json::from_slice::<KvConsentEntry>(&body_bytes) {
         Ok(entry) => {
             log::info!(
-                "Loaded consent from KV store for '{synthetic_id}' (stored_at_ds={})",
+                "Loaded consent from KV store for '{ec_id}' (stored_at_ds={})",
                 entry.stored_at_ds
             );
             Some(context_from_entry(&entry))
         }
         Err(e) => {
-            log::warn!("Failed to deserialize consent KV entry for '{synthetic_id}': {e}");
+            log::warn!("Failed to deserialize consent KV entry for '{ec_id}': {e}");
             None
         }
     }
@@ -310,15 +306,10 @@ pub fn load_consent_from_kv(store_name: &str, synthetic_id: &str) -> Option<Cons
 /// # Arguments
 ///
 /// * `store_name` — The KV Store name (from `consent.consent_store` config).
-/// * `synthetic_id` — The Synthetic ID used as the KV Store key.
+/// * `ec_id` — The EC ID used as the KV Store key.
 /// * `ctx` — The current request's consent context.
 /// * `max_age_days` — TTL for the entry, matching `max_consent_age_days`.
-pub fn save_consent_to_kv(
-    store_name: &str,
-    synthetic_id: &str,
-    ctx: &ConsentContext,
-    max_age_days: u32,
-) {
+pub fn save_consent_to_kv(store_name: &str, ec_id: &str, ctx: &ConsentContext, max_age_days: u32) {
     if ctx.is_empty() {
         log::debug!("Skipping consent KV write: consent is empty");
         return;
@@ -330,9 +321,9 @@ pub fn save_consent_to_kv(
 
     let metadata = metadata_from_context(ctx);
 
-    if fingerprint_unchanged(&store, synthetic_id, &metadata.fp) {
+    if fingerprint_unchanged(&store, ec_id, &metadata.fp) {
         log::debug!(
-            "Consent unchanged for '{synthetic_id}' (fp={}), skipping write",
+            "Consent unchanged for '{ec_id}' (fp={}), skipping write",
             metadata.fp
         );
         return;
@@ -341,11 +332,11 @@ pub fn save_consent_to_kv(
     let entry = entry_from_context(ctx, super::now_deciseconds());
 
     let Ok(body) = serde_json::to_string(&entry) else {
-        log::warn!("Failed to serialize consent entry for '{synthetic_id}'");
+        log::warn!("Failed to serialize consent entry for '{ec_id}'");
         return;
     };
     let Ok(meta_str) = serde_json::to_string(&metadata) else {
-        log::warn!("Failed to serialize consent metadata for '{synthetic_id}'");
+        log::warn!("Failed to serialize consent metadata for '{ec_id}'");
         return;
     };
 
@@ -355,38 +346,38 @@ pub fn save_consent_to_kv(
         .build_insert()
         .metadata(&meta_str)
         .time_to_live(ttl)
-        .execute(synthetic_id, body)
+        .execute(ec_id, body)
     {
         Ok(()) => {
             log::info!(
-                "Saved consent to KV store for '{synthetic_id}' (fp={}, ttl={max_age_days}d)",
+                "Saved consent to KV store for '{ec_id}' (fp={}, ttl={max_age_days}d)",
                 metadata.fp
             );
         }
         Err(e) => {
-            log::warn!("Failed to write consent to KV store for '{synthetic_id}': {e}");
+            log::warn!("Failed to write consent to KV store for '{ec_id}': {e}");
         }
     }
 }
 
-/// Deletes a consent entry from the KV Store for a given Synthetic ID.
+/// Deletes a consent entry from the KV Store for a given EC ID.
 ///
 /// Used when a user revokes consent — the existing SSC cookie is being
 /// expired, so the persisted consent data must also be removed.
 ///
 /// Errors are logged but never propagated — KV Store failures must not
 /// break the request pipeline.
-pub fn delete_consent_from_kv(store_name: &str, synthetic_id: &str) {
+pub fn delete_consent_from_kv(store_name: &str, ec_id: &str) {
     let Some(store) = open_store(store_name) else {
         return;
     };
 
-    match store.delete(synthetic_id) {
+    match store.delete(ec_id) {
         Ok(()) => {
-            log::info!("Deleted consent KV entry for '{synthetic_id}' (consent revoked)");
+            log::info!("Deleted consent KV entry for '{ec_id}' (consent revoked)");
         }
         Err(e) => {
-            log::warn!("Failed to delete consent KV entry for '{synthetic_id}': {e}");
+            log::warn!("Failed to delete consent KV entry for '{ec_id}': {e}");
         }
     }
 }
diff --git a/crates/common/src/consent/mod.rs b/crates/common/src/consent/mod.rs
index e4e3bda4..6bb033be 100644
--- a/crates/common/src/consent/mod.rs
+++ b/crates/common/src/consent/mod.rs
@@ -22,7 +22,7 @@
 //!     req: &req,
 //!     config: &settings.consent,
 //!     geo: geo.as_ref(),
-//!     synthetic_id: Some("sid_abc123"),
+//!     ec_id: Some("ec_abc123"),
 //! });
 //! ```
 
@@ -66,12 +66,12 @@ pub struct ConsentPipelineInput<'a> {
     pub config: &'a ConsentConfig,
     /// Geolocation data from the request (for jurisdiction detection).
     pub geo: Option<&'a GeoInfo>,
-    /// Synthetic ID for KV Store consent persistence.
+    /// EC ID for KV Store consent persistence.
     ///
     /// When set along with `config.consent_store`, enables:
     /// - **Read fallback**: loads consent from KV when cookies are absent.
     /// - **Write-on-change**: persists cookie-sourced consent to KV.
-    pub synthetic_id: Option<&'a str>,
+    pub ec_id: Option<&'a str>,
 }
 
 /// Extracts, decodes, and normalizes consent signals from a request.
@@ -516,14 +516,14 @@ fn should_try_kv_fallback(signals: &RawConsentSignals) -> bool {
 /// Attempts to load consent from the KV Store when cookie signals are empty.
 ///
 /// Returns `Some(ConsentContext)` if a valid entry was found and decoded,
-/// `None` otherwise. Requires both `consent_store` and `synthetic_id` to
+/// `None` otherwise. Requires both `consent_store` and `ec_id` to
 /// be configured.
 fn try_kv_fallback(input: &ConsentPipelineInput<'_>) -> Option<ConsentContext> {
     let store_name = input.config.consent_store.as_deref()?;
-    let synthetic_id = input.synthetic_id?;
+    let ec_id = input.ec_id?;
 
-    log::debug!("No cookie consent signals, trying KV fallback for '{synthetic_id}'");
-    let mut ctx = kv::load_consent_from_kv(store_name, synthetic_id)?;
+    log::debug!("No cookie consent signals, trying KV fallback for '{ec_id}'");
+    let mut ctx = kv::load_consent_from_kv(store_name, ec_id)?;
 
     // Re-detect jurisdiction from current geo (may differ from stored value).
     ctx.jurisdiction = jurisdiction::detect_jurisdiction(input.geo, input.config);
@@ -542,16 +542,11 @@ fn try_kv_write(input: &ConsentPipelineInput<'_>, ctx: &ConsentContext) {
     let Some(store_name) = input.config.consent_store.as_deref() else {
         return;
     };
-    let Some(synthetic_id) = input.synthetic_id else {
+    let Some(ec_id) = input.ec_id else {
         return;
     };
 
-    kv::save_consent_to_kv(
-        store_name,
-        synthetic_id,
-        ctx,
-        input.config.max_consent_age_days,
-    );
+    kv::save_consent_to_kv(store_name, ec_id, ctx, input.config.max_consent_age_days);
 }
 
 // ---------------------------------------------------------------------------
@@ -750,7 +745,7 @@ mod tests {
             req: &req,
             config: &config,
             geo: None,
-            synthetic_id: None,
+            ec_id: None,
         });
 
         assert!(
@@ -779,7 +774,7 @@ mod tests {
             req: &req,
             config: &config,
             geo: None,
-            synthetic_id: None,
+            ec_id: None,
         });
 
         assert!(
diff --git a/crates/common/src/constants.rs b/crates/common/src/constants.rs
index d5b8c7f6..0ee9fc76 100644
--- a/crates/common/src/constants.rs
+++ b/crates/common/src/constants.rs
@@ -1,9 +1,10 @@
 use http::header::HeaderName;
 
-pub const COOKIE_SYNTHETIC_ID: &str = "synthetic_id";
+pub const COOKIE_TS_EC: &str = "ts-ec";
 
 pub const HEADER_X_PUB_USER_ID: HeaderName = HeaderName::from_static("x-pub-user-id");
-pub const HEADER_X_SYNTHETIC_ID: HeaderName = HeaderName::from_static("x-synthetic-id");
+pub const HEADER_X_TS_EC: HeaderName = HeaderName::from_static("x-ts-ec");
+pub const HEADER_X_TS_EC_FRESH: HeaderName = HeaderName::from_static("x-ts-ec-fresh");
 pub const HEADER_X_CONSENT_ADVERTISING: HeaderName =
     HeaderName::from_static("x-consent-advertising");
 pub const HEADER_X_FORWARDED_FOR: HeaderName = HeaderName::from_static("x-forwarded-for");
@@ -43,7 +44,8 @@ pub const HEADER_REFERER: HeaderName = HeaderName::from_static("referer");
 /// Uses `&str` slices because `HeaderName` has interior mutability and cannot appear
 /// in `const` context.
 pub const INTERNAL_HEADERS: &[&str] = &[
-    "x-synthetic-id",
+    "x-ts-ec",
+    "x-ts-ec-fresh",
     "x-pub-user-id",
     "x-subject-id",
     "x-consent-advertising",
diff --git a/crates/common/src/cookies.rs b/crates/common/src/cookies.rs
index 8757cae5..b733cc89 100644
--- a/crates/common/src/cookies.rs
+++ b/crates/common/src/cookies.rs
@@ -9,7 +9,7 @@ use fastly::http::header;
 use fastly::Request;
 
 use crate::constants::{
-    COOKIE_EUCONSENT_V2, COOKIE_GPP, COOKIE_GPP_SID, COOKIE_SYNTHETIC_ID, COOKIE_US_PRIVACY,
+    COOKIE_EUCONSENT_V2, COOKIE_GPP, COOKIE_GPP_SID, COOKIE_TS_EC, COOKIE_US_PRIVACY,
 };
 use crate::error::TrustedServerError;
 use crate::settings::Settings;
@@ -126,41 +126,34 @@ pub fn forward_cookie_header(from: &Request, to: &mut Request, strip_consent: bo
     }
 }
 
-/// Creates a synthetic ID cookie string.
+/// Creates an EC cookie string.
 ///
 /// Generates a properly formatted cookie with security attributes
-/// for storing the synthetic ID.
+/// for storing the EC ID.
 #[must_use]
-pub fn create_synthetic_cookie(settings: &Settings, synthetic_id: &str) -> String {
+pub fn create_ec_cookie(settings: &Settings, ec_id: &str) -> String {
     format!(
         "{}={}; Domain={}; Path=/; Secure; SameSite=Lax; Max-Age={}",
-        COOKIE_SYNTHETIC_ID, synthetic_id, settings.publisher.cookie_domain, COOKIE_MAX_AGE,
+        COOKIE_TS_EC, ec_id, settings.publisher.cookie_domain, COOKIE_MAX_AGE,
     )
 }
 
-/// Sets the synthetic ID cookie on the given response.
+/// Sets the EC ID cookie on the given response.
 ///
 /// This helper abstracts the logic of creating the cookie string and appending
 /// the Set-Cookie header to the response.
-pub fn set_synthetic_cookie(
-    settings: &Settings,
-    response: &mut fastly::Response,
-    synthetic_id: &str,
-) {
-    response.append_header(
-        header::SET_COOKIE,
-        create_synthetic_cookie(settings, synthetic_id),
-    );
+pub fn set_ec_cookie(settings: &Settings, response: &mut fastly::Response, ec_id: &str) {
+    response.append_header(header::SET_COOKIE, create_ec_cookie(settings, ec_id));
 }
 
-/// Expires the synthetic ID cookie by setting `Max-Age=0`.
+/// Expires the EC cookie by setting `Max-Age=0`.
 ///
 /// Used when a user revokes consent — the browser will delete the cookie
 /// on receipt of this header.
-pub fn expire_synthetic_cookie(settings: &Settings, response: &mut fastly::Response) {
+pub fn expire_ec_cookie(settings: &Settings, response: &mut fastly::Response) {
     let cookie = format!(
         "{}=; Domain={}; Path=/; Secure; SameSite=Lax; Max-Age=0",
-        COOKIE_SYNTHETIC_ID, settings.publisher.cookie_domain,
+        COOKIE_TS_EC, settings.publisher.cookie_domain,
     );
     response.append_header(header::SET_COOKIE, cookie);
 }
@@ -247,23 +240,23 @@ mod tests {
     }
 
     #[test]
-    fn test_create_synthetic_cookie() {
+    fn test_create_ec_cookie() {
         let settings = create_test_settings();
-        let result = create_synthetic_cookie(&settings, "12345");
+        let result = create_ec_cookie(&settings, "12345");
         assert_eq!(
             result,
             format!(
                 "{}=12345; Domain={}; Path=/; Secure; SameSite=Lax; Max-Age={}",
-                COOKIE_SYNTHETIC_ID, settings.publisher.cookie_domain, COOKIE_MAX_AGE,
+                COOKIE_TS_EC, settings.publisher.cookie_domain, COOKIE_MAX_AGE,
             )
         );
     }
 
     #[test]
-    fn test_set_synthetic_cookie() {
+    fn test_set_ec_cookie() {
         let settings = create_test_settings();
         let mut response = fastly::Response::new();
-        set_synthetic_cookie(&settings, &mut response, "test-id-123");
+        set_ec_cookie(&settings, &mut response, "test-id-123");
 
         let cookie_header = response
             .get_header(header::SET_COOKIE)
@@ -272,10 +265,10 @@ mod tests {
             .to_str()
             .expect("header should be valid UTF-8");
 
-        let expected = create_synthetic_cookie(&settings, "test-id-123");
+        let expected = create_ec_cookie(&settings, "test-id-123");
         assert_eq!(
             cookie_str, expected,
-            "Set-Cookie header should match create_synthetic_cookie output"
+            "Set-Cookie header should match create_ec_cookie output"
         );
     }
 
diff --git a/crates/common/src/edge_cookie.rs b/crates/common/src/edge_cookie.rs
new file mode 100644
index 00000000..779f118a
--- /dev/null
+++ b/crates/common/src/edge_cookie.rs
@@ -0,0 +1,320 @@
+//! Edge Cookie (EC) ID generation using HMAC.
+//!
+//! This module provides functionality for generating privacy-preserving EC IDs
+//! based on the client IP address and a secret key.
+
+use std::net::IpAddr;
+
+use error_stack::{Report, ResultExt};
+use fastly::Request;
+use hmac::{Hmac, Mac};
+use rand::Rng;
+use sha2::Sha256;
+
+use crate::constants::{COOKIE_TS_EC, HEADER_X_TS_EC};
+use crate::cookies::handle_request_cookies;
+use crate::error::TrustedServerError;
+use crate::settings::Settings;
+
+type HmacSha256 = Hmac<Sha256>;
+
+const ALPHANUMERIC_CHARSET: &[u8] =
+    b"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
+
+/// Normalizes an IP address for stable EC ID generation.
+///
+/// For IPv6 addresses, masks to /64 prefix to handle Privacy Extensions
+/// where devices rotate their interface identifier (lower 64 bits).
+/// IPv4 addresses are returned unchanged.
+fn normalize_ip(ip: IpAddr) -> String {
+    match ip {
+        IpAddr::V4(ipv4) => ipv4.to_string(),
+        IpAddr::V6(ipv6) => {
+            let segments = ipv6.segments();
+            // Keep only the first 4 segments (64 bits) for /64 prefix
+            format!(
+                "{:x}:{:x}:{:x}:{:x}::",
+                segments[0], segments[1], segments[2], segments[3]
+            )
+        }
+    }
+}
+
+/// Generates a random alphanumeric string of the specified length.
+fn generate_random_suffix(length: usize) -> String {
+    let mut rng = rand::thread_rng();
+    (0..length)
+        .map(|_| {
+            let idx = rng.gen_range(0..ALPHANUMERIC_CHARSET.len());
+            ALPHANUMERIC_CHARSET[idx] as char
+        })
+        .collect()
+}
+
+/// Generates a fresh EC ID based on client IP address.
+///
+/// Uses only the client IP (not user-agent or other headers) intentionally:
+/// EC IDs are meant to be simple, privacy-preserving identifiers — not
+/// high-entropy fingerprints. The random suffix provides per-cookie
+/// uniqueness for users behind the same NAT/proxy.
+///
+/// Creates an HMAC-SHA256-based ID using the configured secret key and
+/// the client IP address, then appends a random suffix for additional
+/// uniqueness. The resulting format is `{64hex}.{6alnum}`.
+///
+/// # Errors
+///
+/// - [`TrustedServerError::Ec`] if HMAC generation fails
+pub fn generate_ec_id(
+    settings: &Settings,
+    req: &Request,
+) -> Result<String, Report<TrustedServerError>> {
+    let client_ip = req
+        .get_client_ip_addr()
+        .map(normalize_ip)
+        .unwrap_or_else(|| "unknown".to_string());
+
+    log::debug!("Input for fresh EC ID: client_ip={}", client_ip);
+
+    let mut mac = HmacSha256::new_from_slice(settings.ec.secret_key.expose().as_bytes())
+        .change_context(TrustedServerError::Ec {
+            message: "Failed to create HMAC instance".to_string(),
+        })?;
+    mac.update(client_ip.as_bytes());
+    let hmac_hash = hex::encode(mac.finalize().into_bytes());
+
+    // Append random 6-character alphanumeric suffix for additional uniqueness
+    let random_suffix = generate_random_suffix(6);
+    let ec_id = format!("{hmac_hash}.{random_suffix}");
+
+    log::debug!("Generated fresh EC ID: {}", ec_id);
+
+    Ok(ec_id)
+}
+
+/// Gets an existing EC ID from the request.
+///
+/// Attempts to retrieve an existing EC ID from:
+/// 1. The `x-ts-ec` header
+/// 2. The `ts-ec` cookie
+///
+/// Returns `None` if neither source contains an EC ID.
+///
+/// # Errors
+///
+/// - [`TrustedServerError::InvalidHeaderValue`] if cookie parsing fails
+pub fn get_ec_id(req: &Request) -> Result<Option<String>, Report<TrustedServerError>> {
+    if let Some(ec_id) = req.get_header(HEADER_X_TS_EC).and_then(|h| h.to_str().ok()) {
+        let id = ec_id.to_string();
+        log::debug!("Using existing EC ID from header: {}", id);
+        return Ok(Some(id));
+    }
+
+    match handle_request_cookies(req)? {
+        Some(jar) => {
+            if let Some(cookie) = jar.get(COOKIE_TS_EC) {
+                let id = cookie.value().to_string();
+                log::debug!("Using existing EC ID from cookie: {}", id);
+                return Ok(Some(id));
+            }
+        }
+        None => {
+            log::debug!("No cookie header found in request");
+        }
+    }
+
+    Ok(None)
+}
+
+/// Gets or creates an EC ID from the request.
+///
+/// Attempts to retrieve an existing EC ID from:
+/// 1. The `x-ts-ec` header
+/// 2. The `ts-ec` cookie
+///
+/// If neither exists, generates a new EC ID.
+///
+/// # Errors
+///
+/// Returns an error if ID generation fails.
+pub fn get_or_generate_ec_id(
+    settings: &Settings,
+    req: &Request,
+) -> Result<String, Report<TrustedServerError>> {
+    if let Some(id) = get_ec_id(req)? {
+        return Ok(id);
+    }
+
+    // If no existing EC ID found, generate a fresh one
+    let ec_id = generate_ec_id(settings, req)?;
+    log::debug!("No existing EC ID, generated: {}", ec_id);
+    Ok(ec_id)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use fastly::http::{HeaderName, HeaderValue};
+    use std::net::{Ipv4Addr, Ipv6Addr};
+
+    use crate::test_support::tests::create_test_settings;
+
+    #[test]
+    fn test_normalize_ip_ipv4_unchanged() {
+        let ipv4 = IpAddr::V4(Ipv4Addr::new(192, 168, 1, 100));
+        assert_eq!(normalize_ip(ipv4), "192.168.1.100");
+    }
+
+    #[test]
+    fn test_normalize_ip_ipv6_masks_to_64() {
+        // Full IPv6 address with interface identifier
+        let ipv6 = IpAddr::V6(Ipv6Addr::new(
+            0x2001, 0x0db8, 0x85a3, 0x0000, 0x8a2e, 0x0370, 0x7334, 0x1234,
+        ));
+        assert_eq!(normalize_ip(ipv6), "2001:db8:85a3:0::");
+    }
+
+    #[test]
+    fn test_normalize_ip_ipv6_different_suffix_same_prefix() {
+        // Two IPv6 addresses with same /64 prefix but different interface identifiers
+        // (simulating Privacy Extensions rotation)
+        let ipv6_a = IpAddr::V6(Ipv6Addr::new(
+            0x2001, 0x0db8, 0xabcd, 0x0001, 0x1111, 0x2222, 0x3333, 0x4444,
+        ));
+        let ipv6_b = IpAddr::V6(Ipv6Addr::new(
+            0x2001, 0x0db8, 0xabcd, 0x0001, 0xaaaa, 0xbbbb, 0xcccc, 0xdddd,
+        ));
+        // Both should normalize to the same /64 prefix
+        assert_eq!(normalize_ip(ipv6_a), normalize_ip(ipv6_b));
+        assert_eq!(normalize_ip(ipv6_a), "2001:db8:abcd:1::");
+    }
+
+    fn create_test_request(headers: Vec<(HeaderName, &str)>) -> Request {
+        let mut req = Request::new("GET", "http://example.com");
+        for (key, value) in headers {
+            req.set_header(
+                key,
+                HeaderValue::from_str(value).expect("should create valid header value"),
+            );
+        }
+
+        req
+    }
+
+    fn is_ec_id_format(value: &str) -> bool {
+        let mut parts = value.split('.');
+        let hmac_part = match parts.next() {
+            Some(part) => part,
+            None => return false,
+        };
+        let suffix_part = match parts.next() {
+            Some(part) => part,
+            None => return false,
+        };
+        if parts.next().is_some() {
+            return false;
+        }
+        if hmac_part.len() != 64 || suffix_part.len() != 6 {
+            return false;
+        }
+        if !hmac_part.chars().all(|c| c.is_ascii_hexdigit()) {
+            return false;
+        }
+        if !suffix_part.chars().all(|c| c.is_ascii_alphanumeric()) {
+            return false;
+        }
+        true
+    }
+
+    #[test]
+    fn test_generate_ec_id() {
+        let settings: Settings = create_test_settings();
+        let req = create_test_request(vec![]);
+
+        let ec_id = generate_ec_id(&settings, &req).expect("should generate EC ID");
+        log::info!("Generated EC ID: {}", ec_id);
+        assert!(
+            is_ec_id_format(&ec_id),
+            "should match EC ID format: {{64hex}}.{{6alnum}}"
+        );
+    }
+
+    #[test]
+    fn test_is_ec_id_format_accepts_valid_value() {
+        let value = format!("{}.{}", "a".repeat(64), "Ab12z9");
+        assert!(
+            is_ec_id_format(&value),
+            "should accept a valid EC ID format"
+        );
+    }
+
+    #[test]
+    fn test_is_ec_id_format_rejects_invalid_values() {
+        let missing_suffix = "a".repeat(64);
+        assert!(
+            !is_ec_id_format(&missing_suffix),
+            "should reject missing suffix"
+        );
+
+        let invalid_hex = format!("{}.{}", "a".repeat(63) + "g", "Ab12z9");
+        assert!(
+            !is_ec_id_format(&invalid_hex),
+            "should reject non-hex HMAC content"
+        );
+
+        let invalid_suffix = format!("{}.{}", "a".repeat(64), "ab-129");
+        assert!(
+            !is_ec_id_format(&invalid_suffix),
+            "should reject non-alphanumeric suffix"
+        );
+
+        let extra_segment = format!("{}.{}.{}", "a".repeat(64), "Ab12z9", "zz");
+        assert!(
+            !is_ec_id_format(&extra_segment),
+            "should reject extra segments"
+        );
+    }
+
+    #[test]
+    fn test_get_ec_id_with_header() {
+        let settings = create_test_settings();
+        let req = create_test_request(vec![(HEADER_X_TS_EC, "existing_ec_id")]);
+
+        let ec_id = get_ec_id(&req).expect("should get EC ID");
+        assert_eq!(ec_id, Some("existing_ec_id".to_string()));
+
+        let ec_id = get_or_generate_ec_id(&settings, &req).expect("should reuse header EC ID");
+        assert_eq!(ec_id, "existing_ec_id");
+    }
+
+    #[test]
+    fn test_get_ec_id_with_cookie() {
+        let settings = create_test_settings();
+        let req = create_test_request(vec![(
+            fastly::http::header::COOKIE,
+            &format!("{}=existing_cookie_id", COOKIE_TS_EC),
+        )]);
+
+        let ec_id = get_ec_id(&req).expect("should get EC ID");
+        assert_eq!(ec_id, Some("existing_cookie_id".to_string()));
+
+        let ec_id = get_or_generate_ec_id(&settings, &req).expect("should reuse cookie EC ID");
+        assert_eq!(ec_id, "existing_cookie_id");
+    }
+
+    #[test]
+    fn test_get_ec_id_none() {
+        let req = create_test_request(vec![]);
+        let ec_id = get_ec_id(&req).expect("should handle missing ID");
+        assert!(ec_id.is_none());
+    }
+
+    #[test]
+    fn test_get_or_generate_ec_id_generate_new() {
+        let settings = create_test_settings();
+        let req = create_test_request(vec![]);
+
+        let ec_id = get_or_generate_ec_id(&settings, &req).expect("should get or generate EC ID");
+        assert!(!ec_id.is_empty());
+    }
+}
diff --git a/crates/common/src/error.rs b/crates/common/src/error.rs
index 0e4a7456..76fe39a7 100644
--- a/crates/common/src/error.rs
+++ b/crates/common/src/error.rs
@@ -70,13 +70,9 @@ pub enum TrustedServerError {
     #[display("Settings error: {message}")]
     Settings { message: String },
 
-    /// Synthetic ID generation or validation failed.
-    #[display("Synthetic ID error: {message}")]
-    SyntheticId { message: String },
-
-    /// Template rendering error.
-    #[display("Template error: {message}")]
-    Template { message: String },
+    /// EC ID generation or validation failed.
+    #[display("EC error: {message}")]
+    Ec { message: String },
 }
 
 impl Error for TrustedServerError {}
@@ -106,8 +102,7 @@ impl IntoHttpResponse for TrustedServerError {
             Self::Prebid { .. } => StatusCode::BAD_GATEWAY,
             Self::Integration { .. } => StatusCode::BAD_GATEWAY,
             Self::Proxy { .. } => StatusCode::BAD_GATEWAY,
-            Self::SyntheticId { .. } => StatusCode::INTERNAL_SERVER_ERROR,
-            Self::Template { .. } => StatusCode::INTERNAL_SERVER_ERROR,
+            Self::Ec { .. } => StatusCode::INTERNAL_SERVER_ERROR,
         }
     }
 
diff --git a/crates/common/src/http_util.rs b/crates/common/src/http_util.rs
index a53a2e4a..8aafc5c3 100644
--- a/crates/common/src/http_util.rs
+++ b/crates/common/src/http_util.rs
@@ -567,7 +567,7 @@ mod tests {
         req.set_header("x-custom-1", "value1");
         // HeaderName is case-insensitive and always lowercase, but set_header accepts strings
         req.set_header("X-Custom-2", "value2");
-        req.set_header("x-synthetic-id", "should not copy");
+        req.set_header("x-ts-ec", "should not copy");
         req.set_header("x-geo-country", "US");
 
         let mut target = Request::new(fastly::http::Method::GET, "https://target.com");
@@ -584,8 +584,8 @@ mod tests {
             "Should copy arbitrary X-header (case insensitive)"
         );
         assert!(
-            target.get_header("x-synthetic-id").is_none(),
-            "Should filter x-synthetic-id"
+            target.get_header("x-ts-ec").is_none(),
+            "Should filter x-ts-ec"
         );
         assert!(
             target.get_header("x-geo-country").is_none(),
diff --git a/crates/common/src/integrations/google_tag_manager.rs b/crates/common/src/integrations/google_tag_manager.rs
index 0f3b5f29..2f6f338e 100644
--- a/crates/common/src/integrations/google_tag_manager.rs
+++ b/crates/common/src/integrations/google_tag_manager.rs
@@ -254,7 +254,7 @@ impl GoogleTagManagerIntegration {
         target_url: &'a str,
     ) -> Result<ProxyRequestConfig<'a>, PayloadSizeError> {
         let mut proxy_config = ProxyRequestConfig::new(target_url);
-        proxy_config.forward_synthetic_id = false;
+        proxy_config.forward_ec_id = false;
 
         // If it's a POST request (e.g. /collect beacon), we must manually attach the body
         // because ProxyRequestConfig doesn't automatically copy it from the source request.
@@ -1308,11 +1308,10 @@ cookie_domain = ".test-publisher.com"
 origin_url = "https://origin.test-publisher.com"
 proxy_secret = "test-secret"
 
-[synthetic]
+[ec]
 counter_store = "test-counter-store"
 opid_store = "test-opid-store"
 secret_key = "test-secret-key"
-template = "{{client_ip}}:{{user_agent}}"
 
 [integrations.google_tag_manager]
 enabled = true
@@ -1344,11 +1343,10 @@ cookie_domain = ".test-publisher.com"
 origin_url = "https://origin.test-publisher.com"
 proxy_secret = "test-secret"
 
-[synthetic]
+[ec]
 counter_store = "test-counter-store"
 opid_store = "test-opid-store"
 secret_key = "test-secret-key"
-template = "{{client_ip}}:{{user_agent}}"
 
 [integrations.google_tag_manager]
 container_id = "GTM-DEFAULT"
diff --git a/crates/common/src/integrations/gpt.rs b/crates/common/src/integrations/gpt.rs
index 535b3d27..8575b37e 100644
--- a/crates/common/src/integrations/gpt.rs
+++ b/crates/common/src/integrations/gpt.rs
@@ -129,7 +129,7 @@ impl GptIntegration {
             .with_streaming()
             .without_forward_headers();
         config.follow_redirects = false;
-        config.forward_synthetic_id = false;
+        config.forward_ec_id = false;
 
         Self::apply_request_header_allowlist(config, req)
     }
@@ -623,7 +623,7 @@ mod tests {
     // -- GPT proxy configuration --
 
     #[test]
-    fn build_proxy_config_uses_streaming_without_synthetic_forwarding_or_redirects() {
+    fn build_proxy_config_uses_streaming_without_ec_forwarding_or_redirects() {
         let req = Request::new(
             Method::GET,
             "https://edge.example.com/integrations/gpt/script",
@@ -638,8 +638,8 @@ mod tests {
             "should stream GPT assets verbatim without rewrite processing"
         );
         assert!(
-            !config.forward_synthetic_id,
-            "should not append synthetic_id to GPT asset requests"
+            !config.forward_ec_id,
+            "should not append EC ID to GPT asset requests"
         );
         assert!(
             !config.follow_redirects,
diff --git a/crates/common/src/integrations/prebid.rs b/crates/common/src/integrations/prebid.rs
index 901071e4..0c37c786 100644
--- a/crates/common/src/integrations/prebid.rs
+++ b/crates/common/src/integrations/prebid.rs
@@ -699,7 +699,7 @@ impl PrebidAuctionProvider {
                 // EIDs will be populated by identity providers; consent gating
                 // is applied via `gate_eids_by_consent` before they are set here.
                 eids: None,
-                synthetic_fresh: Some(request.user.fresh_id.clone()),
+                ec_fresh: Some(request.user.fresh_id.clone()),
             }
             .to_ext(),
             ..Default::default()
@@ -1399,7 +1399,7 @@ mod tests {
         )
     }
 
-    /// Shared TOML prefix for config-parsing tests (publisher + synthetic sections).
+    /// Shared TOML prefix for config-parsing tests (publisher + ec sections).
     const TOML_BASE: &str = r#"
 [[handlers]]
 path = "^/admin"
@@ -1412,11 +1412,10 @@ cookie_domain = ".test-publisher.com"
 origin_url = "https://origin.test-publisher.com"
 proxy_secret = "test-secret"
 
-[synthetic]
+[ec]
 counter_store = "test-counter-store"
 opid_store = "test-opid-store"
 secret_key = "test-secret-key"
-template = "{{client_ip}}:{{user_agent}}"
 "#;
 
     /// Parse a TOML string containing only the `[integrations.prebid]` section
diff --git a/crates/common/src/integrations/registry.rs b/crates/common/src/integrations/registry.rs
index 158a1e29..0a5f8192 100644
--- a/crates/common/src/integrations/registry.rs
+++ b/crates/common/src/integrations/registry.rs
@@ -8,11 +8,11 @@ use fastly::http::Method;
 use fastly::{Request, Response};
 use matchit::Router;
 
-use crate::constants::HEADER_X_SYNTHETIC_ID;
-use crate::cookies::set_synthetic_cookie;
+use crate::constants::HEADER_X_TS_EC;
+use crate::cookies::set_ec_cookie;
+use crate::edge_cookie::get_or_generate_ec_id;
 use crate::error::TrustedServerError;
 use crate::settings::Settings;
-use crate::synthetic::get_or_generate_synthetic_id;
 
 /// Action returned by attribute rewriters to describe how the runtime should mutate the element.
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -644,8 +644,8 @@ impl IntegrationRegistry {
 
     /// Dispatch a proxy request when an integration handles the path.
     ///
-    /// This method automatically sets the `x-synthetic-id` header and
-    /// `synthetic_id` cookie on successful responses.
+    /// This method automatically sets the `x-ts-ec` header and
+    /// `ts-ec` cookie on successful responses.
     #[must_use]
     pub async fn handle_proxy(
         &self,
@@ -655,27 +655,25 @@ impl IntegrationRegistry {
         mut req: Request,
     ) -> Option<Result<Response, Report<TrustedServerError>>> {
         if let Some((proxy, _)) = self.find_route(method, path) {
-            // Generate synthetic ID before consuming request
-            let synthetic_id_result = get_or_generate_synthetic_id(settings, &req);
+            // Generate EC ID before consuming request
+            let ec_id_result = get_or_generate_ec_id(settings, &req);
 
-            // Set synthetic ID header on the request so integrations can read it
-            if let Ok(ref synthetic_id) = synthetic_id_result {
-                req.set_header(HEADER_X_SYNTHETIC_ID, synthetic_id.as_str());
+            // Set EC ID header on the request so integrations can read it
+            if let Ok(ref ec_id) = ec_id_result {
+                req.set_header(HEADER_X_TS_EC, ec_id.as_str());
             }
 
             let mut result = proxy.handle(settings, req).await;
 
-            // Set synthetic ID header on successful responses
+            // Set EC ID header on successful responses
             if let Ok(ref mut response) = result {
-                match synthetic_id_result {
-                    Ok(ref synthetic_id) => {
-                        response.set_header(HEADER_X_SYNTHETIC_ID, synthetic_id.as_str());
-                        set_synthetic_cookie(settings, response, synthetic_id.as_str());
+                match ec_id_result {
+                    Ok(ref ec_id) => {
+                        response.set_header(HEADER_X_TS_EC, ec_id.as_str());
+                        set_ec_cookie(settings, response, ec_id.as_str());
                     }
                     Err(ref err) => {
-                        log::warn!(
-                            "Failed to generate synthetic ID for integration response: {err:?}"
-                        );
+                        log::warn!("Failed to generate EC ID for integration response: {err:?}");
                     }
                 }
             }
@@ -1205,29 +1203,29 @@ mod tests {
         assert!(!registry.has_route(&Method::POST, "/integrations/test/users"));
     }
 
-    // Tests for synthetic ID header on proxy responses
-    use crate::constants::COOKIE_SYNTHETIC_ID;
+    // Tests for EC ID header on proxy responses
+    use crate::constants::COOKIE_TS_EC;
     use crate::test_support::tests::create_test_settings;
     use fastly::http::header;
 
     /// Mock proxy that returns a simple 200 OK response
-    struct SyntheticIdTestProxy;
+    struct EcTestProxy;
 
     #[async_trait(?Send)]
-    impl IntegrationProxy for SyntheticIdTestProxy {
+    impl IntegrationProxy for EcTestProxy {
         fn integration_name(&self) -> &'static str {
-            "synthetic_id_test"
+            "ec_test"
         }
 
         fn routes(&self) -> Vec<IntegrationEndpoint> {
             vec![
                 IntegrationEndpoint {
                     method: Method::GET,
-                    path: "/integrations/test/synthetic".to_string(),
+                    path: "/integrations/test/ec".to_string(),
                 },
                 IntegrationEndpoint {
                     method: Method::POST,
-                    path: "/integrations/test/synthetic".to_string(),
+                    path: "/integrations/test/ec".to_string(),
                 },
             ]
         }
@@ -1237,32 +1235,32 @@ mod tests {
             _settings: &Settings,
             _req: Request,
         ) -> Result<Response, Report<TrustedServerError>> {
-            // Return a simple response without the synthetic ID header.
+            // Return a simple response without the EC ID header.
             // The registry's handle_proxy should add it.
             Ok(Response::from_status(fastly::http::StatusCode::OK).with_body("test response"))
         }
     }
 
     #[test]
-    fn handle_proxy_sets_synthetic_id_header_on_response() {
+    fn handle_proxy_sets_ec_id_header_on_response() {
         let settings = create_test_settings();
         let routes = vec![(
             Method::GET,
-            "/integrations/test/synthetic",
+            "/integrations/test/ec",
             (
-                Arc::new(SyntheticIdTestProxy) as Arc<dyn IntegrationProxy>,
-                "synthetic_id_test",
+                Arc::new(EcTestProxy) as Arc<dyn IntegrationProxy>,
+                "ec_test",
             ),
         )];
         let registry = IntegrationRegistry::from_routes(routes);
 
-        // Create a request without a synthetic ID cookie
-        let req = Request::get("https://test-publisher.com/integrations/test/synthetic");
+        // Create a request without an EC ID cookie
+        let req = Request::get("https://test-publisher.com/integrations/test/ec");
 
         // Call handle_proxy (uses futures executor in test environment)
         let result = futures::executor::block_on(registry.handle_proxy(
             &Method::GET,
-            "/integrations/test/synthetic",
+            "/integrations/test/ec",
             &settings,
             req,
         ));
@@ -1274,23 +1272,23 @@ mod tests {
 
         let response = response.unwrap();
 
-        // Verify x-synthetic-id header is present
+        // Verify x-ts-ec header is present
         assert!(
-            response.get_header(HEADER_X_SYNTHETIC_ID).is_some(),
-            "Response should have x-synthetic-id header"
+            response.get_header(HEADER_X_TS_EC).is_some(),
+            "Response should have x-ts-ec header"
         );
 
         // Verify Set-Cookie header is present (since no cookie was in request)
         let set_cookie = response.get_header(header::SET_COOKIE);
         assert!(
             set_cookie.is_some(),
-            "Response should have Set-Cookie header for synthetic_id"
+            "Response should have Set-Cookie header for ts-ec"
         );
 
         let cookie_value = set_cookie.unwrap().to_str().unwrap();
         assert!(
-            cookie_value.contains(COOKIE_SYNTHETIC_ID),
-            "Set-Cookie should contain synthetic_id cookie, got: {}",
+            cookie_value.contains(COOKIE_TS_EC),
+            "Set-Cookie should contain ts-ec cookie, got: {}",
             cookie_value
         );
     }
@@ -1300,22 +1298,19 @@ mod tests {
         let settings = create_test_settings();
         let routes = vec![(
             Method::GET,
-            "/integrations/test/synthetic",
-            (
-                Arc::new(SyntheticIdTestProxy) as Arc<dyn IntegrationProxy>,
-                "test",
-            ),
+            "/integrations/test/ec",
+            (Arc::new(EcTestProxy) as Arc<dyn IntegrationProxy>, "test"),
         )];
 
         let registry = IntegrationRegistry::from_routes(routes);
 
-        let mut req = Request::get("https://test.example.com/integrations/test/synthetic");
+        let mut req = Request::get("https://test.example.com/integrations/test/ec");
         // Pre-existing cookie
-        req.set_header(header::COOKIE, "synthetic_id=existing_id_12345");
+        req.set_header(header::COOKIE, "ts-ec=existing_id_12345");
 
         let result = futures::executor::block_on(registry.handle_proxy(
             &Method::GET,
-            "/integrations/test/synthetic",
+            "/integrations/test/ec",
             &settings,
             req,
         ))
@@ -1323,10 +1318,10 @@ mod tests {
 
         let response = result.expect("proxy handle should succeed");
 
-        // Should still have x-synthetic-id header
+        // Should still have x-ts-ec header
         assert!(
-            response.get_header(HEADER_X_SYNTHETIC_ID).is_some(),
-            "Response should still have x-synthetic-id header"
+            response.get_header(HEADER_X_TS_EC).is_some(),
+            "Response should still have x-ts-ec header"
         );
 
         // Should ALWAYS set the cookie again (per new requirements)
@@ -1340,8 +1335,8 @@ mod tests {
         if let Some(cookie) = set_cookie {
             let cookie_str = cookie.to_str().unwrap_or("");
             assert!(
-                cookie_str.contains(COOKIE_SYNTHETIC_ID),
-                "Should contain synthetic_id cookie, got: {}",
+                cookie_str.contains(COOKIE_TS_EC),
+                "Should contain ts-ec cookie, got: {}",
                 cookie_str
             );
         }
@@ -1352,20 +1347,20 @@ mod tests {
         let settings = create_test_settings();
         let routes = vec![(
             Method::POST,
-            "/integrations/test/synthetic",
+            "/integrations/test/ec",
             (
-                Arc::new(SyntheticIdTestProxy) as Arc<dyn IntegrationProxy>,
-                "synthetic_id_test",
+                Arc::new(EcTestProxy) as Arc<dyn IntegrationProxy>,
+                "ec_test",
             ),
         )];
         let registry = IntegrationRegistry::from_routes(routes);
 
-        let req = Request::post("https://test-publisher.com/integrations/test/synthetic")
-            .with_body("test body");
+        let req =
+            Request::post("https://test-publisher.com/integrations/test/ec").with_body("test body");
 
         let result = futures::executor::block_on(registry.handle_proxy(
             &Method::POST,
-            "/integrations/test/synthetic",
+            "/integrations/test/ec",
             &settings,
             req,
         ));
@@ -1376,8 +1371,8 @@ mod tests {
 
         let response = response.unwrap();
         assert!(
-            response.get_header(HEADER_X_SYNTHETIC_ID).is_some(),
-            "POST response should have x-synthetic-id header"
+            response.get_header(HEADER_X_TS_EC).is_some(),
+            "POST response should have x-ts-ec header"
         );
     }
 
diff --git a/crates/common/src/integrations/testlight.rs b/crates/common/src/integrations/testlight.rs
index 1c8e31b5..0c810b1a 100644
--- a/crates/common/src/integrations/testlight.rs
+++ b/crates/common/src/integrations/testlight.rs
@@ -8,6 +8,7 @@ use serde::{Deserialize, Serialize};
 use serde_json::{Map, Value};
 use validator::Validate;
 
+use crate::edge_cookie::get_ec_id;
 use crate::error::TrustedServerError;
 use crate::integrations::{
     AttributeRewriteAction, IntegrationAttributeContext, IntegrationAttributeRewriter,
@@ -15,7 +16,6 @@ use crate::integrations::{
 };
 use crate::proxy::{proxy_request, ProxyRequestConfig};
 use crate::settings::{IntegrationConfig, Settings};
-use crate::synthetic::get_synthetic_id;
 use crate::tsjs;
 
 const TESTLIGHT_INTEGRATION_ID: &str = "testlight";
@@ -139,23 +139,23 @@ impl IntegrationProxy for TestlightIntegration {
             .validate()
             .map_err(|err| Report::new(Self::error(format!("Invalid request payload: {err}"))))?;
 
-        // Read synthetic ID from header (set by registry) or cookie
-        let synthetic_id = get_synthetic_id(&req)
-            .change_context(Self::error("Failed to read synthetic ID"))?
+        // Read EC ID from header (set by registry) or cookie
+        let ec_id = get_ec_id(&req)
+            .change_context(Self::error("Failed to read EC ID"))?
             .ok_or_else(|| {
                 Report::new(Self::error(
-                    "Synthetic ID not found in request header or cookie — \
+                    "EC ID not found in request header or cookie — \
                      check that the integration registry propagated it",
                 ))
             })?;
 
-        payload.user.id = Some(synthetic_id);
+        payload.user.id = Some(ec_id);
 
         let payload_bytes = serde_json::to_vec(&payload)
             .change_context(Self::error("Failed to serialize request body"))?;
 
         let mut proxy_config = ProxyRequestConfig::new(&self.config.endpoint);
-        proxy_config.forward_synthetic_id = false;
+        proxy_config.forward_ec_id = false;
         proxy_config.body = Some(payload_bytes);
         proxy_config.stream_passthrough = true;
         proxy_config.headers.push((
diff --git a/crates/common/src/lib.rs b/crates/common/src/lib.rs
index 1fd95369..a0d61705 100644
--- a/crates/common/src/lib.rs
+++ b/crates/common/src/lib.rs
@@ -16,8 +16,7 @@
 //! - [`privacy`]: Privacy utilities and helpers
 //! - [`settings`]: Configuration management and validation
 //! - [`streaming_replacer`]: Streaming URL replacement for large responses
-//! - [`synthetic`]: Synthetic ID generation using HMAC
-//! - [`templates`]: Handlebars template handling
+//! - [`ec`]: Edge Cookie (EC) ID generation using HMAC
 //! - [`test_support`]: Testing utilities and mocks
 //! - [`why`]: Debugging and introspection utilities
 
@@ -41,6 +40,7 @@ pub mod consent_config;
 pub mod constants;
 pub mod cookies;
 pub mod creative;
+pub mod edge_cookie;
 pub mod error;
 pub mod fastly_storage;
 pub mod geo;
@@ -59,6 +59,5 @@ pub mod settings;
 pub mod settings_data;
 pub mod streaming_processor;
 pub mod streaming_replacer;
-pub mod synthetic;
 pub mod test_support;
 pub mod tsjs;
diff --git a/crates/common/src/openrtb.rs b/crates/common/src/openrtb.rs
index b7a8849e..fc8f390c 100644
--- a/crates/common/src/openrtb.rs
+++ b/crates/common/src/openrtb.rs
@@ -50,7 +50,7 @@ pub struct UserExt {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub eids: Option<Vec<Eid>>,
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub synthetic_fresh: Option<String>,
+    pub ec_fresh: Option<String>,
 }
 
 impl ToExt for UserExt {}
@@ -332,7 +332,7 @@ mod tests {
                     consented_providers: Some("2~2628.2316~dv.".to_string()),
                 }),
                 eids: None,
-                synthetic_fresh: None,
+                ec_fresh: None,
             }
             .to_ext(),
             ..Default::default()
diff --git a/crates/common/src/proxy.rs b/crates/common/src/proxy.rs
index 27de3510..26c45e81 100644
--- a/crates/common/src/proxy.rs
+++ b/crates/common/src/proxy.rs
@@ -10,10 +10,10 @@ use crate::constants::{
     HEADER_USER_AGENT, HEADER_X_FORWARDED_FOR,
 };
 use crate::creative::{CreativeCssProcessor, CreativeHtmlProcessor};
+use crate::edge_cookie::get_ec_id;
 use crate::error::TrustedServerError;
 use crate::settings::Settings;
 use crate::streaming_processor::{Compression, PipelineConfig, StreamProcessor, StreamingPipeline};
-use crate::synthetic::get_synthetic_id;
 
 /// Chunk size used for streaming content through the rewrite pipeline.
 const STREAMING_CHUNK_SIZE: usize = 8192;
@@ -36,8 +36,8 @@ pub struct ProxyRequestConfig<'a> {
     pub target_url: &'a str,
     /// Whether redirects should be followed automatically.
     pub follow_redirects: bool,
-    /// Whether to append the caller's synthetic ID as a query param.
-    pub forward_synthetic_id: bool,
+    /// Whether to append the caller's EC ID as a query param.
+    pub forward_ec_id: bool,
     /// Optional body to send to the origin.
     pub body: Option<Vec<u8>>,
     /// Additional headers to forward to the origin.
@@ -49,13 +49,13 @@ pub struct ProxyRequestConfig<'a> {
 }
 
 impl<'a> ProxyRequestConfig<'a> {
-    /// Build a proxy configuration that follows redirects and forwards the synthetic ID.
+    /// Build a proxy configuration that follows redirects and forwards the EC ID.
     #[must_use]
     pub fn new(target_url: &'a str) -> Self {
         Self {
             target_url,
             follow_redirects: true,
-            forward_synthetic_id: true,
+            forward_ec_id: true,
             body: None,
             headers: Vec::new(),
             copy_request_headers: true,
@@ -395,7 +395,7 @@ struct ProxyRequestHeaders<'a> {
 /// Proxy a request to a clear target URL while reusing creative rewrite logic.
 ///
 /// This forwards a curated header set, follows redirects when enabled, and can append
-/// the caller's synthetic ID as a `synthetic_id` query parameter to the target URL.
+/// the caller's EC ID as a `ts-ec` query parameter to the target URL.
 /// Optional bodies/headers can be supplied via [`ProxyRequestConfig`].
 ///
 /// # Errors
@@ -410,7 +410,7 @@ pub async fn proxy_request(
     let ProxyRequestConfig {
         target_url,
         follow_redirects,
-        forward_synthetic_id,
+        forward_ec_id,
         body,
         headers,
         copy_request_headers,
@@ -423,8 +423,8 @@ pub async fn proxy_request(
         })
     })?;
 
-    if forward_synthetic_id {
-        append_synthetic_id(&req, &mut target_url_parsed);
+    if forward_ec_id {
+        append_ec_id(&req, &mut target_url_parsed);
     }
 
     proxy_with_redirects(
@@ -442,40 +442,41 @@ pub async fn proxy_request(
     .await
 }
 
-fn append_synthetic_id(req: &Request, target_url_parsed: &mut url::Url) {
-    let synthetic_id_param = match get_synthetic_id(req) {
+/// Upserts the `ts-ec` query parameter on a URL, replacing any existing value.
+fn upsert_ec_query_param(url: &mut url::Url, ec_id: &str) {
+    let mut pairs: Vec<(String, String)> = url
+        .query_pairs()
+        .filter(|(k, _)| k.as_ref() != "ts-ec")
+        .map(|(k, v)| (k.into_owned(), v.into_owned()))
+        .collect();
+
+    pairs.push(("ts-ec".to_string(), ec_id.to_string()));
+
+    url.set_query(None);
+    let mut serializer = url::form_urlencoded::Serializer::new(String::new());
+    for (k, v) in &pairs {
+        serializer.append_pair(k, v);
+    }
+    url.set_query(Some(&serializer.finish()));
+}
+
+fn append_ec_id(req: &Request, target_url_parsed: &mut url::Url) {
+    let ec_id_param = match get_ec_id(req) {
         Ok(id) => id,
         Err(e) => {
-            log::warn!("failed to extract synthetic ID for forwarding: {:?}", e);
+            log::warn!("failed to extract EC ID for forwarding: {:?}", e);
             None
         }
     };
 
-    if let Some(synthetic_id) = synthetic_id_param {
-        let mut pairs: Vec<(String, String)> = target_url_parsed
-            .query_pairs()
-            .filter(|(k, _)| k.as_ref() != "synthetic_id")
-            .map(|(k, v)| (k.into_owned(), v.into_owned()))
-            .collect();
-
-        pairs.push(("synthetic_id".to_string(), synthetic_id));
-
-        target_url_parsed.set_query(None);
-        if !pairs.is_empty() {
-            let mut serializer = url::form_urlencoded::Serializer::new(String::new());
-            for (k, v) in &pairs {
-                serializer.append_pair(k, v);
-            }
-            let query_str = serializer.finish();
-            target_url_parsed.set_query(Some(&query_str));
-        }
-
+    if let Some(ec_id) = ec_id_param {
+        upsert_ec_query_param(target_url_parsed, &ec_id);
         log::debug!(
-            "forwarding synthetic_id to origin url {}",
+            "forwarding EC ID to origin url {}",
             target_url_parsed.as_str()
         );
     } else {
-        log::debug!("no synthetic_id to forward to origin");
+        log::debug!("no EC ID to forward to origin");
     }
 }
 
@@ -632,7 +633,7 @@ pub async fn handle_first_party_proxy(
         ProxyRequestConfig {
             target_url: &target_url,
             follow_redirects: true,
-            forward_synthetic_id: true,
+            forward_ec_id: true,
             body: None,
             headers: Vec::new(),
             copy_request_headers: true,
@@ -662,44 +663,24 @@ pub async fn handle_first_party_click(
         had_params,
     } = reconstruct_and_validate_signed_target(settings, req.get_url_str())?;
 
-    let synthetic_id = match get_synthetic_id(&req) {
+    let ec_id = match get_ec_id(&req) {
         Ok(id) => id,
         Err(e) => {
-            log::warn!("failed to extract synthetic ID for forwarding: {:?}", e);
+            log::warn!("failed to extract EC ID for forwarding: {:?}", e);
             None
         }
     };
 
     let mut redirect_target = full_for_token.clone();
-    if let Some(ref synthetic_id_value) = synthetic_id {
+    if let Some(ref ec_id_value) = ec_id {
         match url::Url::parse(&redirect_target) {
             Ok(mut url) => {
-                let mut pairs: Vec<(String, String)> = url
-                    .query_pairs()
-                    .filter(|(k, _)| k.as_ref() != "synthetic_id")
-                    .map(|(k, v)| (k.into_owned(), v.into_owned()))
-                    .collect();
-                pairs.push(("synthetic_id".to_string(), synthetic_id_value.clone()));
-
-                url.set_query(None);
-                if !pairs.is_empty() {
-                    let mut serializer = url::form_urlencoded::Serializer::new(String::new());
-                    for (k, v) in &pairs {
-                        serializer.append_pair(k, v);
-                    }
-                    let query_str = serializer.finish();
-                    url.set_query(Some(&query_str));
-                }
-
-                let final_target = url.to_string();
-                log::debug!("forwarding synthetic_id to target url {}", final_target);
-                redirect_target = final_target;
+                upsert_ec_query_param(&mut url, ec_id_value);
+                redirect_target = url.to_string();
+                log::debug!("forwarding EC ID to target url {}", redirect_target);
             }
             Err(e) => {
-                log::warn!(
-                    "failed to parse target url for synthetic forwarding: {:?}",
-                    e
-                );
+                log::warn!("failed to parse target url for EC ID forwarding: {:?}", e);
             }
         }
     }
@@ -714,13 +695,13 @@ pub async fn handle_first_party_click(
         .and_then(|h| h.to_str().ok())
         .unwrap_or("");
     log::info!(
-        "redirect tsurl={} params_present={} target={} referer={} ua={} synthetic_id={}",
+        "redirect tsurl={} params_present={} target={} referer={} ua={} ec_id={}",
         tsurl,
         had_params,
         redirect_target,
         referer,
         ua,
-        synthetic_id.as_deref().unwrap_or("")
+        ec_id.as_deref().unwrap_or("")
     );
 
     // 302 redirect to target URL
@@ -1222,10 +1203,7 @@ mod tests {
 
         assert_eq!(cfg.target_url, "https://example.com/asset");
         assert!(cfg.follow_redirects, "should follow redirects by default");
-        assert!(
-            cfg.forward_synthetic_id,
-            "should forward synthetic id by default"
-        );
+        assert!(cfg.forward_ec_id, "should forward EC ID by default");
         assert_eq!(cfg.body.as_deref(), Some(&[1, 2, 3][..]));
         assert_eq!(cfg.headers.len(), 1, "should include custom header");
         assert!(
@@ -1313,7 +1291,7 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn click_appends_synthetic_id_when_present() {
+    async fn click_appends_ec_id_when_present() {
         let settings = create_test_settings();
         let tsurl = "https://cdn.example/a.png";
         let params = "foo=1";
@@ -1328,7 +1306,7 @@ mod tests {
                 sig
             ),
         );
-        req.set_header(crate::constants::HEADER_X_SYNTHETIC_ID, "synthetic-123");
+        req.set_header(crate::constants::HEADER_X_TS_EC, "ec-123");
 
         let resp = handle_first_party_click(&settings, req)
             .await
@@ -1344,10 +1322,7 @@ mod tests {
             .map(|(k, v)| (k.into_owned(), v.into_owned()))
             .collect();
         assert_eq!(pairs.remove("foo").as_deref(), Some("1"));
-        assert_eq!(
-            pairs.remove("synthetic_id").as_deref(),
-            Some("synthetic-123")
-        );
+        assert_eq!(pairs.remove("ts-ec").as_deref(), Some("ec-123"));
         assert!(pairs.is_empty());
     }
 
diff --git a/crates/common/src/publisher.rs b/crates/common/src/publisher.rs
index cec56b25..5b6787c5 100644
--- a/crates/common/src/publisher.rs
+++ b/crates/common/src/publisher.rs
@@ -4,8 +4,9 @@ use fastly::{Body, Request, Response};
 
 use crate::backend::BackendConfig;
 use crate::consent::{allows_ssc_creation, build_consent_context, ConsentPipelineInput};
-use crate::constants::{COOKIE_SYNTHETIC_ID, HEADER_X_COMPRESS_HINT, HEADER_X_SYNTHETIC_ID};
-use crate::cookies::{expire_synthetic_cookie, handle_request_cookies, set_synthetic_cookie};
+use crate::constants::{COOKIE_TS_EC, HEADER_X_COMPRESS_HINT, HEADER_X_TS_EC};
+use crate::cookies::{expire_ec_cookie, handle_request_cookies, set_ec_cookie};
+use crate::edge_cookie::get_or_generate_ec_id;
 use crate::error::TrustedServerError;
 use crate::http_util::{serve_static_with_etag, RequestInfo};
 use crate::integrations::IntegrationRegistry;
@@ -13,7 +14,6 @@ use crate::rsc_flight::RscFlightUrlRewriter;
 use crate::settings::Settings;
 use crate::streaming_processor::{Compression, PipelineConfig, StreamProcessor, StreamingPipeline};
 use crate::streaming_replacer::create_url_replacer;
-use crate::synthetic::get_or_generate_synthetic_id;
 
 /// Unified tsjs static serving: `/static/tsjs=<filename>`
 ///
@@ -235,21 +235,21 @@ pub fn handle_publisher_request(
         req.get_header("x-forwarded-proto"),
     );
 
-    // Parse cookies once for reuse by both consent extraction and synthetic ID logic.
+    // Parse cookies once for reuse by both consent extraction and EC ID logic.
     let cookie_jar = handle_request_cookies(&req)?;
 
-    // Capture the current SSC cookie value for revocation handling.
-    // This must come from the cookie itself (not the x-synthetic-id header)
+    // Capture the current EC cookie value for revocation handling.
+    // This must come from the cookie itself (not the x-ts-ec header)
     // to ensure KV deletion targets the same identifier being revoked.
-    let existing_ssc_cookie = cookie_jar
+    let existing_ec_cookie = cookie_jar
         .as_ref()
-        .and_then(|jar| jar.get(COOKIE_SYNTHETIC_ID))
+        .and_then(|jar| jar.get(COOKIE_TS_EC))
         .map(|cookie| cookie.value().to_owned());
 
-    // Generate synthetic identifiers before the request body is consumed.
+    // Generate EC identifiers before the request body is consumed.
     // Always generated for internal use (KV lookups, logging) even when
     // consent is absent — the cookie is only *set* when consent allows it.
-    let synthetic_id = get_or_generate_synthetic_id(settings, &req)?;
+    let ec_id = get_or_generate_ec_id(settings, &req)?;
 
     // Extract, decode, and log consent signals (TCF, GPP, US Privacy, GPC)
     // from the incoming request. The ConsentContext carries both raw strings
@@ -262,14 +262,10 @@ pub fn handle_publisher_request(
         req: &req,
         config: &settings.consent,
         geo: geo.as_ref(),
-        synthetic_id: Some(synthetic_id.as_str()),
+        ec_id: Some(ec_id.as_str()),
     });
-    let ssc_allowed = allows_ssc_creation(&consent_context);
-    log::debug!(
-        "Proxy synthetic IDs - trusted: {}, ssc_allowed: {}",
-        synthetic_id,
-        ssc_allowed,
-    );
+    let ec_allowed = allows_ssc_creation(&consent_context);
+    log::debug!("Proxy EC ID: {}, ec_allowed: {}", ec_id, ec_allowed,);
 
     let backend_name = BackendConfig::from_url(
         &settings.publisher.origin_url,
@@ -365,26 +361,26 @@ pub fn handle_publisher_request(
         );
     }
 
-    // Consent-gated SSC creation:
-    // - Consent given → set synthetic ID header + cookie.
+    // Consent-gated EC creation:
+    // - Consent given → set EC ID header + cookie.
     // - Consent absent + existing cookie → revoke (expire cookie + delete KV entry).
     // - Consent absent + no cookie → do nothing.
-    if ssc_allowed {
-        response.set_header(HEADER_X_SYNTHETIC_ID, synthetic_id.as_str());
-        set_synthetic_cookie(settings, &mut response, synthetic_id.as_str());
-    } else if let Some(cookie_synthetic_id) = existing_ssc_cookie.as_deref() {
+    if ec_allowed {
+        response.set_header(HEADER_X_TS_EC, ec_id.as_str());
+        set_ec_cookie(settings, &mut response, ec_id.as_str());
+    } else if let Some(cookie_ec_id) = existing_ec_cookie.as_deref() {
         log::info!(
-            "SSC revoked for '{}': consent withdrawn (jurisdiction={})",
-            cookie_synthetic_id,
+            "EC revoked for '{}': consent withdrawn (jurisdiction={})",
+            cookie_ec_id,
             consent_context.jurisdiction,
         );
-        expire_synthetic_cookie(settings, &mut response);
+        expire_ec_cookie(settings, &mut response);
         if let Some(store_name) = &settings.consent.consent_store {
-            crate::consent::kv::delete_consent_from_kv(store_name, cookie_synthetic_id);
+            crate::consent::kv::delete_consent_from_kv(store_name, cookie_ec_id);
         }
     } else {
         log::debug!(
-            "SSC skipped: no consent and no existing cookie (jurisdiction={})",
+            "EC skipped: no consent and no existing cookie (jurisdiction={})",
             consent_context.jurisdiction,
         );
     }
@@ -512,29 +508,28 @@ mod tests {
     }
 
     #[test]
-    fn revocation_targets_cookie_synthetic_id_not_header() {
+    fn revocation_targets_cookie_ec_id_not_header() {
         let settings = create_test_settings();
         let mut req = Request::new(Method::GET, "https://test.example.com/page");
-        req.set_header("x-synthetic-id", "header_id");
-        req.set_header("cookie", "synthetic_id=cookie_id; other=value");
+        req.set_header("x-ts-ec", "header_id");
+        req.set_header("cookie", "ts-ec=cookie_id; other=value");
 
         let cookie_jar = handle_request_cookies(&req).expect("should parse cookies");
-        let existing_ssc_cookie = cookie_jar
+        let existing_ec_cookie = cookie_jar
             .as_ref()
-            .and_then(|jar| jar.get(COOKIE_SYNTHETIC_ID))
+            .and_then(|jar| jar.get(COOKIE_TS_EC))
             .map(|cookie| cookie.value().to_owned());
 
-        let resolved_synthetic_id =
-            get_or_generate_synthetic_id(&settings, &req).expect("should resolve synthetic id");
+        let resolved_ec_id = get_or_generate_ec_id(&settings, &req).expect("should resolve EC ID");
 
         assert_eq!(
-            existing_ssc_cookie.as_deref(),
+            existing_ec_cookie.as_deref(),
             Some("cookie_id"),
             "should read revocation target from cookie value"
         );
         assert_eq!(
-            resolved_synthetic_id, "header_id",
-            "should still resolve request synthetic ID from header precedence"
+            resolved_ec_id, "header_id",
+            "should still resolve request EC ID from header precedence"
         );
     }
 
diff --git a/crates/common/src/settings.rs b/crates/common/src/settings.rs
index 74fd8696..0ca69fc5 100644
--- a/crates/common/src/settings.rs
+++ b/crates/common/src/settings.rs
@@ -191,18 +191,17 @@ impl DerefMut for IntegrationSettings {
     }
 }
 
+/// Edge Cookie (EC) configuration.
 #[allow(unused)]
 #[derive(Debug, Default, Clone, Deserialize, Serialize, Validate)]
-pub struct Synthetic {
+pub struct Ec {
     pub counter_store: String,
     pub opid_store: String,
-    #[validate(custom(function = Synthetic::validate_secret_key))]
+    #[validate(custom(function = Ec::validate_secret_key))]
     pub secret_key: Redacted<String>,
-    #[validate(length(min = 1))]
-    pub template: String,
 }
 
-impl Synthetic {
+impl Ec {
     /// Known placeholder values that must not be used in production.
     pub const SECRET_KEY_PLACEHOLDERS: &[&str] = &["secret-key", "secret_key", "trusted-server"];
 
@@ -333,7 +332,7 @@ pub struct Settings {
     pub publisher: Publisher,
     #[serde(default)]
     #[validate(nested)]
-    pub synthetic: Synthetic,
+    pub ec: Ec,
     #[serde(default)]
     pub integrations: IntegrationSettings,
     #[serde(default, deserialize_with = "vec_from_seq_or_map")]
@@ -429,8 +428,8 @@ impl Settings {
     pub fn reject_placeholder_secrets(&self) -> Result<(), Report<TrustedServerError>> {
         let mut insecure_fields: Vec<&str> = Vec::new();
 
-        if Synthetic::is_placeholder_secret_key(self.synthetic.secret_key.expose()) {
-            insecure_fields.push("synthetic.secret_key");
+        if Ec::is_placeholder_secret_key(self.ec.secret_key.expose()) {
+            insecure_fields.push("ec.secret_key");
         }
         if Publisher::is_placeholder_proxy_secret(self.publisher.proxy_secret.expose()) {
             insecure_fields.push("publisher.proxy_secret");
@@ -707,10 +706,9 @@ mod tests {
             settings.publisher.origin_url,
             "https://origin.test-publisher.com"
         );
-        assert_eq!(settings.synthetic.counter_store, "test-counter-store");
-        assert_eq!(settings.synthetic.opid_store, "test-opid-store");
-        assert_eq!(settings.synthetic.secret_key.expose(), "test-secret-key");
-        assert!(settings.synthetic.template.contains("{{client_ip}}"));
+        assert_eq!(settings.ec.counter_store, "test-counter-store");
+        assert_eq!(settings.ec.opid_store, "test-opid-store");
+        assert_eq!(settings.ec.secret_key.expose(), "test-secret-key");
 
         settings.validate().expect("Failed to validate settings");
     }
@@ -746,9 +744,9 @@ mod tests {
 
     #[test]
     fn is_placeholder_secret_key_rejects_all_known_placeholders() {
-        for placeholder in Synthetic::SECRET_KEY_PLACEHOLDERS {
+        for placeholder in Ec::SECRET_KEY_PLACEHOLDERS {
             assert!(
-                Synthetic::is_placeholder_secret_key(placeholder),
+                Ec::is_placeholder_secret_key(placeholder),
                 "should detect placeholder secret_key '{placeholder}'"
             );
         }
@@ -757,11 +755,11 @@ mod tests {
     #[test]
     fn is_placeholder_secret_key_is_case_insensitive() {
         assert!(
-            Synthetic::is_placeholder_secret_key("SECRET-KEY"),
+            Ec::is_placeholder_secret_key("SECRET-KEY"),
             "should detect case-insensitive placeholder secret_key"
         );
         assert!(
-            Synthetic::is_placeholder_secret_key("Trusted-Server"),
+            Ec::is_placeholder_secret_key("Trusted-Server"),
             "should detect mixed-case placeholder secret_key"
         );
     }
@@ -769,7 +767,7 @@ mod tests {
     #[test]
     fn is_placeholder_secret_key_accepts_non_placeholder() {
         assert!(
-            !Synthetic::is_placeholder_secret_key("test-secret-key"),
+            !Ec::is_placeholder_secret_key("test-secret-key"),
             "should accept non-placeholder secret_key"
         );
     }
@@ -1386,11 +1384,10 @@ mod tests {
             origin_url = "https://origin.test-publisher.com"
             proxy_secret = "unit-test-proxy-secret"
 
-            [synthetic]
+            [ec]
             counter_store = "test-counter-store"
             opid_store = "test-opid-store"
             secret_key = "test-secret-key"
-            template = "{{client_ip}}"
 
             [request_signing]
             config_store_id = "test-config-store-id"
diff --git a/crates/common/src/settings_data.rs b/crates/common/src/settings_data.rs
index d764f0bd..094f6c4c 100644
--- a/crates/common/src/settings_data.rs
+++ b/crates/common/src/settings_data.rs
@@ -88,8 +88,8 @@ mod tests {
             .expect_err("should reject placeholder secret_key");
         let root = err.current_context();
         assert!(
-            matches!(root, TrustedServerError::InsecureDefault { field } if field.contains("synthetic.secret_key")),
-            "error should mention synthetic.secret_key, got: {root}"
+            matches!(root, TrustedServerError::InsecureDefault { field } if field.contains("ec.secret_key")),
+            "error should mention ec.secret_key, got: {root}"
         );
     }
 
@@ -118,8 +118,8 @@ mod tests {
         match root {
             TrustedServerError::InsecureDefault { field } => {
                 assert!(
-                    field.contains("synthetic.secret_key"),
-                    "error should mention synthetic.secret_key, got: {field}"
+                    field.contains("ec.secret_key"),
+                    "error should mention ec.secret_key, got: {field}"
                 );
                 assert!(
                     field.contains("publisher.proxy_secret"),
diff --git a/crates/common/src/synthetic.rs b/crates/common/src/synthetic.rs
deleted file mode 100644
index 38a3456f..00000000
--- a/crates/common/src/synthetic.rs
+++ /dev/null
@@ -1,354 +0,0 @@
-//! Synthetic ID generation using HMAC.
-//!
-//! This module provides functionality for generating privacy-preserving synthetic IDs
-//! based on various request parameters and a secret key.
-
-use std::net::IpAddr;
-
-use error_stack::{Report, ResultExt};
-use fastly::http::header;
-use fastly::Request;
-use handlebars::Handlebars;
-use hmac::{Hmac, Mac};
-use rand::Rng;
-use serde_json::json;
-use sha2::Sha256;
-use uuid::Uuid;
-
-use crate::constants::{COOKIE_SYNTHETIC_ID, HEADER_X_SYNTHETIC_ID};
-use crate::cookies::handle_request_cookies;
-use crate::error::TrustedServerError;
-use crate::settings::Settings;
-
-type HmacSha256 = Hmac<Sha256>;
-
-const ALPHANUMERIC_CHARSET: &[u8] =
-    b"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
-
-/// Normalizes an IP address for stable synthetic ID generation.
-///
-/// For IPv6 addresses, masks to /64 prefix to handle Privacy Extensions
-/// where devices rotate their interface identifier (lower 64 bits).
-/// IPv4 addresses are returned unchanged.
-fn normalize_ip(ip: IpAddr) -> String {
-    match ip {
-        IpAddr::V4(ipv4) => ipv4.to_string(),
-        IpAddr::V6(ipv6) => {
-            let segments = ipv6.segments();
-            // Keep only the first 4 segments (64 bits) for /64 prefix
-            format!(
-                "{:x}:{:x}:{:x}:{:x}::",
-                segments[0], segments[1], segments[2], segments[3]
-            )
-        }
-    }
-}
-
-/// Generates a random alphanumeric string of the specified length.
-fn generate_random_suffix(length: usize) -> String {
-    let mut rng = rand::thread_rng();
-    (0..length)
-        .map(|_| {
-            let idx = rng.gen_range(0..ALPHANUMERIC_CHARSET.len());
-            ALPHANUMERIC_CHARSET[idx] as char
-        })
-        .collect()
-}
-
-/// Generates a fresh synthetic ID based on request parameters.
-///
-/// Creates an HMAC-SHA256-based ID using the configured secret key and request
-/// attributes, then appends a random suffix for additional uniqueness.
-///
-/// # Errors
-///
-/// - [`TrustedServerError::Template`] if the template rendering fails
-/// - [`TrustedServerError::SyntheticId`] if HMAC generation fails
-pub fn generate_synthetic_id(
-    settings: &Settings,
-    req: &Request,
-) -> Result<String, Report<TrustedServerError>> {
-    let client_ip = req.get_client_ip_addr().map(normalize_ip);
-    let user_agent = req
-        .get_header(header::USER_AGENT)
-        .map(|h| h.to_str().unwrap_or("unknown"));
-    let accept_language = req
-        .get_header(header::ACCEPT_LANGUAGE)
-        .and_then(|h| h.to_str().ok())
-        .map(|lang| lang.split(',').next().unwrap_or("unknown"));
-    let accept_encoding = req
-        .get_header(header::ACCEPT_ENCODING)
-        .and_then(|h| h.to_str().ok());
-    let random_uuid = Uuid::new_v4().to_string();
-
-    let handlebars = Handlebars::new();
-    let data = &json!({
-        "client_ip": client_ip.unwrap_or("unknown".to_string()),
-        "user_agent": user_agent.unwrap_or("unknown"),
-        "accept_language": accept_language.unwrap_or("unknown"),
-        "accept_encoding": accept_encoding.unwrap_or("unknown"),
-        "random_uuid": random_uuid
-    });
-
-    let input_string = handlebars
-        .render_template(&settings.synthetic.template, data)
-        .change_context(TrustedServerError::Template {
-            message: "Failed to render synthetic ID template".to_string(),
-        })?;
-
-    log::trace!("Input string for fresh ID: {} {}", input_string, data);
-
-    let mut mac = HmacSha256::new_from_slice(settings.synthetic.secret_key.expose().as_bytes())
-        .change_context(TrustedServerError::SyntheticId {
-            message: "Failed to create HMAC instance".to_string(),
-        })?;
-    mac.update(input_string.as_bytes());
-    let hmac_hash = hex::encode(mac.finalize().into_bytes());
-
-    // Append random 6-character alphanumeric suffix for additional uniqueness
-    let random_suffix = generate_random_suffix(6);
-    let synthetic_id = format!("{}.{}", hmac_hash, random_suffix);
-
-    log::trace!("Generated fresh ID: {}", synthetic_id);
-
-    Ok(synthetic_id)
-}
-
-/// Gets or creates a synthetic ID from the request.
-///
-/// Attempts to retrieve an existing synthetic ID from:
-/// 1. The `x-synthetic-id` header
-/// 2. The `synthetic_id` cookie
-///
-/// If neither exists, generates a new synthetic ID.
-///
-/// # Errors
-///
-/// - [`TrustedServerError::Template`] if template rendering fails during generation
-/// - [`TrustedServerError::SyntheticId`] if ID generation fails
-pub fn get_synthetic_id(req: &Request) -> Result<Option<String>, Report<TrustedServerError>> {
-    if let Some(synthetic_id) = req
-        .get_header(HEADER_X_SYNTHETIC_ID)
-        .and_then(|h| h.to_str().ok())
-    {
-        let id = synthetic_id.to_string();
-        log::trace!("Using existing Synthetic ID from header: {}", id);
-        return Ok(Some(id));
-    }
-
-    match handle_request_cookies(req)? {
-        Some(jar) => {
-            if let Some(cookie) = jar.get(COOKIE_SYNTHETIC_ID) {
-                let id = cookie.value().to_string();
-                log::trace!("Using existing Trusted Server ID from cookie: {}", id);
-                return Ok(Some(id));
-            }
-        }
-        None => {
-            log::debug!("No cookie header found in request");
-        }
-    }
-
-    Ok(None)
-}
-
-/// Gets or creates a synthetic ID from the request.
-///
-/// Attempts to retrieve an existing synthetic ID from:
-/// 1. The `x-synthetic-id` header
-/// 2. The `synthetic_id` cookie
-///
-/// If neither exists, generates a new synthetic ID.
-///
-/// # Errors
-///
-/// Returns an error if template rendering fails during generation or if ID generation fails.
-pub fn get_or_generate_synthetic_id(
-    settings: &Settings,
-    req: &Request,
-) -> Result<String, Report<TrustedServerError>> {
-    if let Some(id) = get_synthetic_id(req)? {
-        return Ok(id);
-    }
-
-    // If no existing Synthetic ID found, generate a fresh one
-    let synthetic_id = generate_synthetic_id(settings, req)?;
-    log::trace!("No existing synthetic_id, generated: {}", synthetic_id);
-    Ok(synthetic_id)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use fastly::http::{HeaderName, HeaderValue};
-    use std::net::{Ipv4Addr, Ipv6Addr};
-
-    use crate::test_support::tests::create_test_settings;
-
-    #[test]
-    fn test_normalize_ip_ipv4_unchanged() {
-        let ipv4 = IpAddr::V4(Ipv4Addr::new(192, 168, 1, 100));
-        assert_eq!(normalize_ip(ipv4), "192.168.1.100");
-    }
-
-    #[test]
-    fn test_normalize_ip_ipv6_masks_to_64() {
-        // Full IPv6 address with interface identifier
-        let ipv6 = IpAddr::V6(Ipv6Addr::new(
-            0x2001, 0x0db8, 0x85a3, 0x0000, 0x8a2e, 0x0370, 0x7334, 0x1234,
-        ));
-        assert_eq!(normalize_ip(ipv6), "2001:db8:85a3:0::");
-    }
-
-    #[test]
-    fn test_normalize_ip_ipv6_different_suffix_same_prefix() {
-        // Two IPv6 addresses with same /64 prefix but different interface identifiers
-        // (simulating Privacy Extensions rotation)
-        let ipv6_a = IpAddr::V6(Ipv6Addr::new(
-            0x2001, 0x0db8, 0xabcd, 0x0001, 0x1111, 0x2222, 0x3333, 0x4444,
-        ));
-        let ipv6_b = IpAddr::V6(Ipv6Addr::new(
-            0x2001, 0x0db8, 0xabcd, 0x0001, 0xaaaa, 0xbbbb, 0xcccc, 0xdddd,
-        ));
-        // Both should normalize to the same /64 prefix
-        assert_eq!(normalize_ip(ipv6_a), normalize_ip(ipv6_b));
-        assert_eq!(normalize_ip(ipv6_a), "2001:db8:abcd:1::");
-    }
-
-    fn create_test_request(headers: Vec<(HeaderName, &str)>) -> Request {
-        let mut req = Request::new("GET", "http://example.com");
-        for (key, value) in headers {
-            req.set_header(
-                key,
-                HeaderValue::from_str(value).expect("should create valid header value"),
-            );
-        }
-
-        req
-    }
-
-    fn is_synthetic_id_format(value: &str) -> bool {
-        let mut parts = value.split('.');
-        let hmac_part = match parts.next() {
-            Some(part) => part,
-            None => return false,
-        };
-        let suffix_part = match parts.next() {
-            Some(part) => part,
-            None => return false,
-        };
-        if parts.next().is_some() {
-            return false;
-        }
-        if hmac_part.len() != 64 || suffix_part.len() != 6 {
-            return false;
-        }
-        if !hmac_part.chars().all(|c| c.is_ascii_hexdigit()) {
-            return false;
-        }
-        if !suffix_part.chars().all(|c| c.is_ascii_alphanumeric()) {
-            return false;
-        }
-        true
-    }
-
-    #[test]
-    fn test_generate_synthetic_id() {
-        let settings: Settings = create_test_settings();
-        let req = create_test_request(vec![
-            (header::USER_AGENT, "Mozilla/5.0"),
-            (header::ACCEPT_LANGUAGE, "en-US,en;q=0.9"),
-            (header::ACCEPT_ENCODING, "gzip, deflate, br"),
-        ]);
-
-        let synthetic_id =
-            generate_synthetic_id(&settings, &req).expect("should generate synthetic ID");
-        log::trace!("Generated synthetic ID: {}", synthetic_id);
-        assert!(
-            is_synthetic_id_format(&synthetic_id),
-            "should match synthetic ID format"
-        );
-    }
-
-    #[test]
-    fn test_is_synthetic_id_format_accepts_valid_value() {
-        let value = format!("{}.{}", "a".repeat(64), "Ab12z9");
-        assert!(
-            is_synthetic_id_format(&value),
-            "should accept a valid synthetic ID format"
-        );
-    }
-
-    #[test]
-    fn test_is_synthetic_id_format_rejects_invalid_values() {
-        let missing_suffix = "a".repeat(64);
-        assert!(
-            !is_synthetic_id_format(&missing_suffix),
-            "should reject missing suffix"
-        );
-
-        let invalid_hex = format!("{}.{}", "a".repeat(63) + "g", "Ab12z9");
-        assert!(
-            !is_synthetic_id_format(&invalid_hex),
-            "should reject non-hex HMAC content"
-        );
-
-        let invalid_suffix = format!("{}.{}", "a".repeat(64), "ab-129");
-        assert!(
-            !is_synthetic_id_format(&invalid_suffix),
-            "should reject non-alphanumeric suffix"
-        );
-
-        let extra_segment = format!("{}.{}.{}", "a".repeat(64), "Ab12z9", "zz");
-        assert!(
-            !is_synthetic_id_format(&extra_segment),
-            "should reject extra segments"
-        );
-    }
-
-    #[test]
-    fn test_get_synthetic_id_with_header() {
-        let settings = create_test_settings();
-        let req = create_test_request(vec![(HEADER_X_SYNTHETIC_ID, "existing_synthetic_id")]);
-
-        let synthetic_id = get_synthetic_id(&req).expect("should get synthetic ID");
-        assert_eq!(synthetic_id, Some("existing_synthetic_id".to_string()));
-
-        let synthetic_id = get_or_generate_synthetic_id(&settings, &req)
-            .expect("should reuse header synthetic ID");
-        assert_eq!(synthetic_id, "existing_synthetic_id");
-    }
-
-    #[test]
-    fn test_get_synthetic_id_with_cookie() {
-        let settings = create_test_settings();
-        let req = create_test_request(vec![(
-            header::COOKIE,
-            &format!("{}=existing_cookie_id", COOKIE_SYNTHETIC_ID),
-        )]);
-
-        let synthetic_id = get_synthetic_id(&req).expect("should get synthetic ID");
-        assert_eq!(synthetic_id, Some("existing_cookie_id".to_string()));
-
-        let synthetic_id = get_or_generate_synthetic_id(&settings, &req)
-            .expect("should reuse cookie synthetic ID");
-        assert_eq!(synthetic_id, "existing_cookie_id");
-    }
-
-    #[test]
-    fn test_get_synthetic_id_none() {
-        let req = create_test_request(vec![]);
-        let synthetic_id = get_synthetic_id(&req).expect("should handle missing ID");
-        assert!(synthetic_id.is_none());
-    }
-
-    #[test]
-    fn test_get_or_generate_synthetic_id_generate_new() {
-        let settings = create_test_settings();
-        let req = create_test_request(vec![]);
-
-        let synthetic_id = get_or_generate_synthetic_id(&settings, &req)
-            .expect("should get or generate synthetic ID");
-        assert!(!synthetic_id.is_empty());
-    }
-}
diff --git a/crates/common/src/test_support.rs b/crates/common/src/test_support.rs
index 1cdae640..2d29ec77 100644
--- a/crates/common/src/test_support.rs
+++ b/crates/common/src/test_support.rs
@@ -30,15 +30,15 @@ pub mod tests {
             enabled = false
             rewrite_attributes = ["href", "link", "url"]
 
-            [synthetic] 
+            [ec]
             counter_store = "test-counter-store"
             opid_store = "test-opid-store"
             secret_key = "test-secret-key"
-            template = "{{client_ip}}:{{user_agent}}:{{first_party_id}}:{{auth_user_id}}:{{publisher_domain}}:{{accept_language}}"
             [request_signing]
             config_store_id = "test-config-store-id"
             secret_store_id = "test-secret-store-id"
-            "#.to_string()
+            "#
+        .to_string()
     }
 
     #[must_use]
diff --git a/crates/fastly/tests/kv_store/counter_store.json b/crates/fastly/tests/kv_store/counter_store.json
index 35faa205..8c3b91f8 100644
--- a/crates/fastly/tests/kv_store/counter_store.json
+++ b/crates/fastly/tests/kv_store/counter_store.json
@@ -1,3 +1,3 @@
 {
-    "synthetic_id": 10
+    "ec_counter": 10
 }
diff --git a/crates/fastly/tests/kv_store/opid_store.json b/crates/fastly/tests/kv_store/opid_store.json
index 35faa205..8c3b91f8 100644
--- a/crates/fastly/tests/kv_store/opid_store.json
+++ b/crates/fastly/tests/kv_store/opid_store.json
@@ -1,3 +1,3 @@
 {
-    "synthetic_id": 10
+    "ec_counter": 10
 }
diff --git a/crates/js/lib/src/integrations/gpt/index.ts b/crates/js/lib/src/integrations/gpt/index.ts
index 3b33fb59..0b9e3023 100644
--- a/crates/js/lib/src/integrations/gpt/index.ts
+++ b/crates/js/lib/src/integrations/gpt/index.ts
@@ -18,7 +18,7 @@ import { installGptGuard } from './script_guard';
  *     signals before the real GPT processes the command.
  *
  * Future enhancements (driven by config or tsjs API):
- *   - Inject synthetic ID as page-level key-value targeting.
+ *   - Inject EC ID as page-level key-value targeting.
  *   - Gate ad requests on consent status.
  *   - Rewrite ad-unit paths for A/B testing.
  */
@@ -80,7 +80,7 @@ function ensureGoogleTagStub(win: GptWindow): Partial<GoogleTag> {
  * Wrap a queued GPT callback to add instrumentation and future hook points.
  *
  * Today the wrapper only logs; as the integration matures it will inject
- * synthetic ID targeting and consent gates.
+ * EC ID targeting and consent gates.
  */
 function wrapCommand(fn: () => void): () => void {
   return () => {
diff --git a/docs/.vitepress/config.mts b/docs/.vitepress/config.mts
index 6b7e9396..d66a820c 100644
--- a/docs/.vitepress/config.mts
+++ b/docs/.vitepress/config.mts
@@ -36,7 +36,7 @@ export default withMermaid(
   defineConfig({
     title: 'Trusted Server',
     description:
-      'Privacy-preserving edge computing for ad serving and synthetic ID generation',
+      'Privacy-preserving edge computing for ad serving and edge cookie (EC) generation',
     base: '/trusted-server',
 
     // Replace version placeholders like {{NODEJS_VERSION}} with values from .tool-versions
@@ -77,7 +77,7 @@ export default withMermaid(
         {
           text: 'Core Concepts',
           items: [
-            { text: 'Synthetic IDs', link: '/guide/synthetic-ids' },
+            { text: 'Edge Cookies', link: '/guide/edge-cookies' },
             { text: 'GDPR Compliance', link: '/guide/gdpr-compliance' },
             { text: 'Ad Serving', link: '/guide/ad-serving' },
             {
diff --git a/docs/business-use-cases.md b/docs/business-use-cases.md
index 02f60204..67c7b51d 100644
--- a/docs/business-use-cases.md
+++ b/docs/business-use-cases.md
@@ -10,7 +10,7 @@ Trusted Server delivers measurable business value across revenue generation, com
 
 **Problem**: Safari and Firefox block third-party cookies, fragmenting user identity and reducing addressable inventory CPMs by 30-50%.
 
-**Solution**: Trusted Server's synthetic ID system maintains user recognition across cookieless browsers through first-party identifiers.
+**Solution**: Trusted Server's Edge Cookie (EC) system maintains user recognition across cookieless browsers through first-party identifiers.
 
 **Business Impact**:
 
@@ -258,7 +258,7 @@ Trusted Server delivers measurable business value across revenue generation, com
 
 **Vendor Consolidation**:
 
-- Identity vendors: 3 → 1 (Lockr + synthetic IDs)
+- Identity vendors: 3 → 1 (Lockr + EC IDs)
 - Ad tech vendors: 5 → 2 (Prebid + Trusted Server)
 - CMP vendors: Integrated (Didomi first-party)
 - Analytics: Built-in observability
diff --git a/docs/epics/revenue-operations-dashboard.md b/docs/epics/revenue-operations-dashboard.md
index ca934759..c1907d25 100644
--- a/docs/epics/revenue-operations-dashboard.md
+++ b/docs/epics/revenue-operations-dashboard.md
@@ -72,7 +72,7 @@ A real-time publisher transparency dashboard providing visibility into ad moneti
 #### Technical Tasks
 
 - [ ] Instrument proxy request handlers to emit domain call events
-- [ ] Add session/page_id correlation (via synthetic ID or request header)
+- [ ] Add session/page_id correlation (via EC ID or request header)
 - [ ] Create domain allowlist configuration in settings.toml
 - [ ] Emit `unauthorized_domain` alert event when unknown domain called
 - [ ] Track request timing (DNS, connect, TTFB, total)
@@ -84,7 +84,7 @@ A real-time publisher transparency dashboard providing visibility into ad moneti
   "event_type": "domain_call",
   "timestamp": "2026-01-24T09:45:00Z",
   "page_id": "uuid",
-  "synthetic_id": "abc123",
+  "ec_id": "abc123",
   "domain": "ads.example.com",
   "full_url": "https://ads.example.com/bid?id=123",
   "request_type": "xhr",
diff --git a/docs/guide/ad-serving.md b/docs/guide/ad-serving.md
index 2999e121..44449b12 100644
--- a/docs/guide/ad-serving.md
+++ b/docs/guide/ad-serving.md
@@ -30,7 +30,7 @@ Real-time bidding integration:
 
 1. Request validation
 2. GDPR consent check
-3. Synthetic ID generation (if consented)
+3. EC ID generation (if consented)
 4. Ad server request
 5. Response processing
 6. Creative delivery
@@ -77,7 +77,7 @@ Creatives served directly from ad server:
 // Placeholder example
 trustedServer.trackImpression({
   adId: 'ad-123',
-  syntheticId: 'synthetic-xyz',
+  ecId: 'ec-xyz',
   consent: true,
 })
 ```
@@ -87,7 +87,7 @@ trustedServer.trackImpression({
 Click tracking with privacy preservation:
 
 - No PII in URLs
-- Synthetic ID only (with consent)
+- EC ID only (with consent)
 - Encrypted parameters
 
 ## Performance
diff --git a/docs/guide/api-reference.md b/docs/guide/api-reference.md
index 2ddcb71d..880efc83 100644
--- a/docs/guide/api-reference.md
+++ b/docs/guide/api-reference.md
@@ -37,7 +37,7 @@ curl "https://edge.example.com/first-party/ad?slot=header-banner&w=728&h=90"
 
 **Response Headers:**
 
-- `x-synthetic-id` - Synthetic ID (`64hex.6alnum` format)
+- `x-ts-ec` - EC ID (`64hex.6alnum` format)
 
 **Use Cases:**
 
@@ -127,7 +127,7 @@ Unified proxy for resources referenced by creatives (images, scripts, CSS, etc.)
 
 - Validates `tstoken` against reconstructed URL
 - Follows redirects (301/302/303/307/308, max 4 hops)
-- Injects synthetic ID as `synthetic_id` query parameter
+- Injects EC ID as `ts-ec` query parameter
 - Logs 1×1 pixel impressions
 
 **Example:**
@@ -160,12 +160,12 @@ Click tracking redirect endpoint.
 **Response:**
 
 - **Status:** `302 Found`
-- **Location:** Reconstructed target URL with synthetic ID injected
+- **Location:** Reconstructed target URL with EC ID injected
 
 **Behavior:**
 
 - Validates `tstoken` against reconstructed URL
-- Injects `synthetic_id` query parameter
+- Injects `ts-ec` query parameter
 - Logs click metadata (tsurl, referer, user agent)
 - Does not proxy content (redirect only)
 
@@ -173,7 +173,7 @@ Click tracking redirect endpoint.
 
 ```bash
 curl -I "https://edge.example.com/first-party/click?tsurl=https://advertiser.com/landing&campaign=123&tstoken=xyz..."
-# → 302 Location: https://advertiser.com/landing?campaign=123&synthetic_id=abc123
+# → 302 Location: https://advertiser.com/landing?campaign=123&ts-ec=abc123
 ```
 
 ---
@@ -529,7 +529,7 @@ Proxies to `cdn.permutive.com` for static assets.
 
 #### POST /integrations/testlight/auction
 
-Testing auction endpoint with synthetic ID injection.
+Testing auction endpoint with EC ID injection.
 
 **Request Body:**
 
@@ -543,11 +543,11 @@ Testing auction endpoint with synthetic ID injection.
 ```
 
 **Response:**
-Proxies to configured endpoint with `user.id` populated with synthetic ID.
+Proxies to configured endpoint with `user.id` populated with EC ID.
 
 **Response Headers:**
 
-- `x-synthetic-id` - Synthetic ID (`64hex.6alnum` format)
+- `x-ts-ec` - EC ID (`64hex.6alnum` format)
 
 ---
 
diff --git a/docs/guide/architecture.md b/docs/guide/architecture.md
index 5d875976..18c44777 100644
--- a/docs/guide/architecture.md
+++ b/docs/guide/architecture.md
@@ -14,7 +14,7 @@ flowchart TD
   subgraph edge["Trusted Server"]
     direction TB
     gdpr["GDPR Check"]
-    ids["Synthetic IDs"]
+    ids["EC IDs"]
     ads["Ad Serving"]
     gdpr --> ids --> ads
   end
@@ -29,7 +29,7 @@ flowchart TD
 
 Core library containing shared functionality:
 
-- Synthetic ID generation
+- Edge Cookie (EC) ID generation
 - Cookie handling
 - HTTP abstractions
 - GDPR consent management
@@ -71,7 +71,7 @@ All tracking operations require explicit GDPR consent checks before execution.
 
 1. **Request Ingress** - Request arrives at Fastly edge
 2. **Consent Validation** - GDPR consent checked
-3. **ID Generation** - Synthetic ID generated (if consented)
+3. **ID Generation** - EC ID generated (if consented)
 4. **Ad Request** - Backend ad server called
 5. **Response Processing** - Creative processed and modified
 6. **Response Egress** - Response sent to browser
@@ -85,7 +85,7 @@ Used for:
 - Counter storage
 - Domain mappings
 - Configuration cache
-- Synthetic ID state
+- EC ID state
 
 ### No User Data Persistence
 
diff --git a/docs/guide/auction-orchestration.md b/docs/guide/auction-orchestration.md
index 5c3ca8dd..73cad4d4 100644
--- a/docs/guide/auction-orchestration.md
+++ b/docs/guide/auction-orchestration.md
@@ -176,7 +176,7 @@ The auction system processes requests through a pipeline of transformations:
 POST /auction (AdRequest in Prebid.js format)
   │
   ├─ Parse body → AdRequest { adUnits[] }
-  ├─ Generate synthetic + fresh user IDs
+  ├─ Generate EC + fresh user IDs
   ├─ Convert adUnits → AdSlots with formats and bidder params
   ├─ Extract device info (User-Agent, geo)
   │
@@ -195,7 +195,7 @@ Convert OrchestrationResult → OpenRTB 2.x Response
   │
   ├─ Rewrite creative HTML with first-party proxy URLs
   ├─ Add ext.orchestrator metadata
-  └─ Set synthetic ID response headers
+  └─ Set EC ID response headers
 ```
 
 ### Key Components
@@ -332,7 +332,7 @@ Transforms auction requests into OpenRTB 2.x format and sends them to a Prebid S
 
 - `AdSlot` → `Imp` with `Banner { format: [Format { w, h }] }`
 - Bidder params from slot config → `ext.prebid.bidder` map
-- Synthetic and fresh user IDs injected into `User` object
+- EC and fresh user IDs injected into `User` object
 - Device info, geo data, and GPC signals included
 - Optional Ed25519 request signing (see [Request Signing](/guide/request-signing))
 
@@ -429,7 +429,7 @@ pub struct AuctionRequest {
     pub id: String,                                    // UUID
     pub slots: Vec<AdSlot>,                            // Ad placements
     pub publisher: PublisherInfo,                       // Domain, page URL
-    pub user: UserInfo,                                // Synthetic ID, fresh ID, consent
+    pub user: UserInfo,                                // EC ID, fresh ID, consent
     pub device: Option<DeviceInfo>,                    // UA, IP, geo
     pub site: Option<SiteInfo>,                        // Domain, page
     pub context: HashMap<String, serde_json::Value>,   // Additional metadata
@@ -549,11 +549,10 @@ Auction results are returned in standard OpenRTB format with an `ext.orchestrato
 }
 ```
 
-The response also includes synthetic ID headers:
+The response also includes EC ID headers:
 
-- `X-Synthetic-ID` — The persistent synthetic user ID
-- `X-Synthetic-Fresh` — A fresh ID generated for this session
-- `X-Synthetic-Trusted-Server` — Trusted Server marker
+- `X-TS-EC` — The persistent EC user ID
+- `X-TS-EC-Fresh` — A fresh ID generated for this session
 
 ## Creative Processing
 
diff --git a/docs/guide/collective-sync.md b/docs/guide/collective-sync.md
index 25082da4..4028062c 100644
--- a/docs/guide/collective-sync.md
+++ b/docs/guide/collective-sync.md
@@ -1,6 +1,6 @@
 # Collective Sync Architecture
 
-Trusted Server supports cross-publisher data sharing through a **Collective Sync** model. Publishers who share the same synthetic ID secret key can synchronize user data across their properties, enabling privacy-preserving audience insights without third-party cookies.
+Trusted Server supports cross-publisher data sharing through a **Collective Sync** model. Publishers who share the same EC secret key can synchronize user data across their properties, enabling privacy-preserving audience insights without third-party cookies.
 
 ## Overview
 
@@ -13,7 +13,7 @@ sequenceDiagram
     participant Partner as Partner TS Instance
 
     Browser->>TS: Page request
-    TS->>KV: Lookup synthetic_id
+    TS->>KV: Lookup ts-ec
     alt Cache hit
         KV-->>TS: Return user data
     else Cache miss
@@ -63,7 +63,7 @@ kv_store = "collective_store"
 
 ### KV Store Record
 
-Each synthetic ID maps to a compact JSON record optimized for fast reads:
+Each EC ID maps to a compact JSON record optimized for fast reads:
 
 ```json
 {
@@ -74,12 +74,12 @@ Each synthetic ID maps to a compact JSON record optimized for fast reads:
 }
 ```
 
-| Field | Type     | Description                        |
-| ----- | -------- | ---------------------------------- |
-| `sid` | string   | Full synthetic ID (`64hex.6alnum`) |
-| `seg` | string[] | Audience segments                  |
-| `lst` | integer  | Last seen timestamp (Unix epoch)   |
-| `src` | string[] | Contributing publisher domains     |
+| Field | Type     | Description                      |
+| ----- | -------- | -------------------------------- |
+| `sid` | string   | Full EC ID (`64hex.6alnum`)      |
+| `seg` | string[] | Audience segments                |
+| `lst` | integer  | Last seen timestamp (Unix epoch) |
+| `src` | string[] | Contributing publisher domains   |
 
 ### Object Store Record (Source of Truth)
 
@@ -87,7 +87,7 @@ The Object Store maintains a richer record with full history:
 
 ```json
 {
-  "synthetic_id": "0f99d7dc...a98e.45np22",
+  "ec_id": "0f99d7dc...a98e.45np22",
   "hmac_base": "0f99d7dc...a98e",
   "random_suffix": "45np22",
   "segments": ["auto-intender", "sports-fan"],
@@ -115,8 +115,8 @@ Authorization: Bearer <collective-token>
 Response (NDJSON stream for large datasets):
 
 ```json
-{"synthetic_id": "abc123.x1y2z3", "segments": [...], "last_seen": "..."}
-{"synthetic_id": "def456.a1b2c3", "segments": [...], "last_seen": "..."}
+{"ec_id": "abc123.x1y2z3", "segments": [...], "last_seen": "..."}
+{"ec_id": "def456.a1b2c3", "segments": [...], "last_seen": "..."}
 ```
 
 ### Incremental Updates
@@ -133,7 +133,7 @@ Response includes only records modified after the `since` timestamp:
 ```json
 {
   "records": [
-    {"synthetic_id": "abc123.x1y2z3", "segments": [...], "last_seen": "..."}
+    {"ec_id": "abc123.x1y2z3", "segments": [...], "last_seen": "..."}
   ],
   "next_cursor": "1706475000",
   "has_more": false
@@ -152,7 +152,7 @@ Content-Type: application/json
 {
   "records": [
     {
-      "synthetic_id": "abc123.x1y2z3",
+      "ec_id": "abc123.x1y2z3",
       "segments": ["new-segment"],
       "source_domain": "pub-a.com"
     }
@@ -162,7 +162,7 @@ Content-Type: application/json
 
 The sync endpoint handles:
 
-- Deduplication by synthetic_id
+- Deduplication by ec_id
 - Segment merging (union of all observed segments)
 - Source tracking (which publishers contributed data)
 - Version increment for conflict resolution
@@ -173,8 +173,8 @@ The sync endpoint handles:
 
 ```
 1. Browser request arrives at edge
-2. Extract/generate synthetic_id
-3. KV Store lookup by synthetic_id
+2. Extract/generate EC ID
+3. KV Store lookup by EC ID
 4. If hit: return cached segments
 5. If miss: fetch from Object Store, populate KV, return
 ```
@@ -191,7 +191,7 @@ The sync endpoint handles:
 
 ## Privacy Considerations
 
-- **No PII**: Synthetic IDs contain no personally identifiable information
+- **No PII**: EC IDs contain no personally identifiable information
 - **Consent-gated**: Only users with GDPR consent are included
 - **Publisher control**: Each publisher controls what segments they share
 - **Audit trail**: Object Store maintains full history of data sources
@@ -208,6 +208,6 @@ The sync endpoint handles:
 
 ## Next Steps
 
-- [Synthetic IDs](/guide/synthetic-ids) - Understand ID generation
+- [Edge Cookies](/guide/edge-cookies) - Understand ID generation
 - [Configuration Reference](/guide/configuration) - Full config options
 - [GDPR Compliance](/guide/gdpr-compliance) - Privacy requirements
diff --git a/docs/guide/configuration.md b/docs/guide/configuration.md
index cc83660b..c61b6865 100644
--- a/docs/guide/configuration.md
+++ b/docs/guide/configuration.md
@@ -23,11 +23,10 @@ cookie_domain = ".publisher.com"
 origin_url = "https://origin.publisher.com"
 proxy_secret = "your-secure-secret-here"
 
-[synthetic]
+[ec]
 counter_store = "counter_store"
 opid_store = "opid_store"
 secret_key = "your-hmac-secret"
-template = "{{ client_ip }}:{{ user_agent }}:{{ accept_language }}:{{ accept_encoding }}"
 ```
 
 ### Environment Variable Overrides
@@ -40,7 +39,7 @@ at runtime.
 # Format: TRUSTED_SERVER__SECTION__FIELD
 export TRUSTED_SERVER__PUBLISHER__DOMAIN=publisher.com
 export TRUSTED_SERVER__PUBLISHER__ORIGIN_URL=https://origin.publisher.com
-export TRUSTED_SERVER__SYNTHETIC__SECRET_KEY=your-secret
+export TRUSTED_SERVER__EC__SECRET_KEY=your-secret
 ```
 
 ### Generate Secure Secrets
@@ -63,7 +62,7 @@ openssl rand -base64 32
 | Section             | Purpose                                      |
 | ------------------- | -------------------------------------------- |
 | `[publisher]`       | Domain, origin, proxy settings               |
-| `[synthetic]`       | Synthetic ID generation                      |
+| `[ec]`              | Edge Cookie (EC) ID generation               |
 | `[request_signing]` | Ed25519 request signing                      |
 | `[auction]`         | Auction orchestration                        |
 | `[integrations.*]`  | Partner integrations (Prebid, Next.js, etc.) |
@@ -77,11 +76,10 @@ cookie_domain = ".publisher.com"
 origin_url = "https://origin.publisher.com"
 proxy_secret = "change-me-to-secure-value"
 
-[synthetic]
+[ec]
 counter_store = "counter_store"
 opid_store = "opid_store"
 secret_key = "your-hmac-secret-key"
-template = "{{ client_ip }}:{{ user_agent }}:{{ accept_language }}:{{ accept_encoding }}"
 
 [request_signing]
 enabled = true
@@ -204,11 +202,11 @@ TRUSTED_SERVER__PUBLISHER__PROXY_SECRET=your-secret-here
 
 #### `cookie_domain`
 
-**Purpose**: Domain scope for synthetic ID cookies.
+**Purpose**: Domain scope for EC cookies.
 
 **Usage**:
 
-- Set on `synthetic_id` cookie
+- Set on `ts-ec` cookie
 - Controls cookie sharing across subdomains
 
 **Format**: Domain with optional leading dot
@@ -267,43 +265,40 @@ openssl rand -base64 32
 Changing `proxy_secret` invalidates all existing signed URLs. Plan rotations carefully and use graceful transition periods.
 :::
 
-## Synthetic ID Configuration
+## EC Configuration
 
-Settings for generating privacy-preserving synthetic identifiers.
+Settings for generating privacy-preserving Edge Cookie identifiers.
 
-### `[synthetic]`
+### `[ec]`
 
 | Field           | Type   | Required | Description                                    |
 | --------------- | ------ | -------- | ---------------------------------------------- |
 | `counter_store` | String | Yes      | Fastly KV store name for counters              |
 | `opid_store`    | String | Yes      | Fastly KV store name for publisher ID mappings |
 | `secret_key`    | String | Yes      | HMAC secret for ID generation                  |
-| `template`      | String | Yes      | Handlebars template for ID composition         |
 
 **Example**:
 
 ```toml
-[synthetic]
+[ec]
 counter_store = "counter_store"
 opid_store = "opid_store"
 secret_key = "your-secure-hmac-secret"
-template = "{{ client_ip }}:{{ user_agent }}:{{ accept_language }}:{{ accept_encoding }}"
 ```
 
 **Environment Override**:
 
 ```bash
-TRUSTED_SERVER__SYNTHETIC__COUNTER_STORE=counter_store
-TRUSTED_SERVER__SYNTHETIC__OPID_STORE=opid_store
-TRUSTED_SERVER__SYNTHETIC__SECRET_KEY=your-secret
-TRUSTED_SERVER__SYNTHETIC__TEMPLATE="{{ client_ip }}:{{ user_agent }}:{{ accept_language }}:{{ accept_encoding }}"
+TRUSTED_SERVER__EC__COUNTER_STORE=counter_store
+TRUSTED_SERVER__EC__OPID_STORE=opid_store
+TRUSTED_SERVER__EC__SECRET_KEY=your-secret
 ```
 
 ### Field Details
 
 #### `counter_store`
 
-**Purpose**: Fastly KV store for synthetic ID counters.
+**Purpose**: Fastly KV store for EC ID counters.
 
 **Usage**:
 
@@ -333,7 +328,7 @@ fastly kv-store create --name=counter_store
 
 **Usage**:
 
-- Maps publisher IDs to synthetic IDs
+- Maps publisher IDs to EC IDs
 - Enables first-party ID integration
 - Optional (used if publisher provides IDs)
 
@@ -348,14 +343,14 @@ fastly kv-store create --name=opid_store
 
 ```json
 {
-  "publisher-id-123": "synthetic-abc",
-  "publisher-id-456": "synthetic-def"
+  "publisher-id-123": "ec-abc",
+  "publisher-id-456": "ec-def"
 }
 ```
 
 #### `secret_key`
 
-**Purpose**: HMAC secret for synthetic ID base generation.
+**Purpose**: HMAC secret for EC ID base generation.
 
 **Security**:
 
@@ -376,50 +371,6 @@ openssl rand -hex 32
 - Empty string
 - Exactly `"secret-key"`, `"secret_key"`, or `"trusted-server"` (known placeholders, case-insensitive)
 
-#### `template`
-
-**Purpose**: Handlebars template defining ID composition.
-
-**Available Variables**:
-
-| Variable          | Description                                | Example                                |
-| ----------------- | ------------------------------------------ | -------------------------------------- |
-| `client_ip`       | Client IP address (IPv6 normalized to /64) | `192.168.1.1`                          |
-| `user_agent`      | User-Agent header                          | `Mozilla/5.0...`                       |
-| `accept_language` | Accept-Language header (first token)       | `en-US`                                |
-| `accept_encoding` | Accept-Encoding header                     | `gzip, deflate`                        |
-| `random_uuid`     | Random UUID v4 per generation              | `9b1d3b94-1e26-4a5f-bc39-1e6f2b6a3a0f` |
-
-**Template Examples**:
-
-**Simple (IP + UA)**:
-
-```toml
-template = "{{ client_ip }}:{{ user_agent }}"
-```
-
-**With Locale + Encoding**:
-
-```toml
-template = "{{ client_ip }}:{{ accept_language }}:{{ accept_encoding }}"
-```
-
-**With Randomized Suffix Input**:
-
-```toml
-template = "{{ client_ip }}:{{ user_agent }}:{{ random_uuid }}"
-```
-
-**Validation**: Must be non-empty string.
-
-::: tip Template Design
-Choose template variables based on your privacy and uniqueness requirements:
-
-- **More variables** = More unique IDs, less privacy
-- **Fewer variables** = More privacy, potential collisions
-- **Include `random_uuid`** only if you want a new ID for every generation
-  :::
-
 ## Response Headers
 
 Custom headers added to all responses.
@@ -925,11 +876,10 @@ Configuration is validated at startup:
 - `origin_url` is valid URL
 - `proxy_secret` ≠ known placeholder (`"change-me-proxy-secret"` — case-insensitive)
 
-**Synthetic Validation**:
+**EC Validation**:
 
 - `secret_key` ≥ 1 character
 - `secret_key` ≠ known placeholders (`"secret-key"`, `"secret_key"`, `"trusted-server"` — case-insensitive)
-- `template` non-empty
 
 **Handler Validation**:
 
@@ -986,7 +936,7 @@ TRUSTED_SERVER__PUBLISHER__PROXY_SECRET=$(cat /run/secrets/proxy_secret_staging)
 ```bash
 # All secrets from environment
 TRUSTED_SERVER__PUBLISHER__PROXY_SECRET=$(cat /run/secrets/proxy_secret)
-TRUSTED_SERVER__SYNTHETIC__SECRET_KEY=$(cat /run/secrets/synthetic_secret)
+TRUSTED_SERVER__EC__SECRET_KEY=$(cat /run/secrets/ec_secret)
 TRUSTED_SERVER__HANDLERS__0__PASSWORD=$(cat /run/secrets/admin_password)
 ```
 
@@ -1094,5 +1044,5 @@ cat trusted-server.toml | npx toml-cli validate
 
 - Set up [Request Signing](/guide/request-signing) for secure API calls
 - Configure [First-Party Proxy](/guide/first-party-proxy) for URL proxying
-- Learn about [Synthetic IDs](/guide/synthetic-ids) for privacy-preserving identification
+- Learn about [Edge Cookies](/guide/edge-cookies) for privacy-preserving identification
 - Review [Integrations](/guide/integrations-overview) for partner support
diff --git a/docs/guide/creative-processing.md b/docs/guide/creative-processing.md
index 431f4771..7a8977a9 100644
--- a/docs/guide/creative-processing.md
+++ b/docs/guide/creative-processing.md
@@ -8,7 +8,7 @@ Creative processing transforms third-party ad creatives by rewriting URLs to go
 
 - **Privacy Control** - All resources load through your domain
 - **First-Party Context** - Cookies and storage use your domain
-- **Synthetic ID Integration** - Automatic ID forwarding to trackers
+- **EC ID Integration** - Automatic ID forwarding to trackers
 - **Security** - Validated, signed URLs prevent tampering
 - **GDPR Compliance** - Controlled data sharing
 
@@ -955,4 +955,4 @@ Track these metrics:
 - Learn about [First-Party Proxy](/guide/first-party-proxy) for URL handling
 - Review [Integration Guide](/guide/integration-guide) for custom rewriters
 - Set up [Configuration](/guide/configuration) for your creatives
-- Explore [Synthetic IDs](/guide/synthetic-ids) for identity management
+- Explore [Edge Cookies](/guide/edge-cookies) for identity management
diff --git a/docs/guide/edge-cookies.md b/docs/guide/edge-cookies.md
new file mode 100644
index 00000000..636850a3
--- /dev/null
+++ b/docs/guide/edge-cookies.md
@@ -0,0 +1,42 @@
+# Edge Cookies (EC)
+
+Trusted Server's EC module maintains user recognition across all browsers through first-party identifiers.
+
+## What are Edge Cookies?
+
+Edge Cookies (EC) are privacy-safe identifiers generated on a first site visit using HMAC-based hashing that allow tracking with user consent while protecting user privacy. Trusted Server derives a deterministic HMAC base from the client IP address and appends a short random suffix to reduce collision risk. They are passed in requests on subsequent visits and activity.
+
+Trusted Server surfaces the current EC ID via response headers and a first-party cookie. For the exact header and cookie names, see the [API Reference](/guide/api-reference).
+
+## How They Work
+
+### HMAC-Based Generation
+
+EC IDs use HMAC (Hash-based Message Authentication Code) to generate a deterministic base from the client IP address, then append a short random suffix.
+
+**Format**: `64-hex-hmac`.`6-alphanumeric-suffix`
+
+**IP normalization**: IPv6 addresses are normalized to a /64 prefix before hashing.
+
+## Configuration
+
+Configure EC secrets in `trusted-server.toml`. See the full [Configuration Reference](/guide/configuration) for the `ec` section and environment variable overrides.
+
+## Privacy Considerations
+
+- IDs are only generated with explicit user consent
+- No personally identifiable information (PII) is included
+- The hash input is the client IP address only
+- IDs can be rotated on schedule
+
+## Best Practices
+
+1. Always verify GDPR consent before generating IDs
+2. Rotate secret keys periodically
+3. Monitor ID collision rates
+
+## Next Steps
+
+- Learn about [GDPR Compliance](/guide/gdpr-compliance)
+- Configure [Ad Serving](/guide/ad-serving)
+- Learn about [Collective Sync](/guide/collective-sync) for cross-publisher data sharing details and diagrams
diff --git a/docs/guide/error-reference.md b/docs/guide/error-reference.md
index c75988e9..dc7b434a 100644
--- a/docs/guide/error-reference.md
+++ b/docs/guide/error-reference.md
@@ -69,7 +69,7 @@ proxy_secret = "change-me-to-random-string"
 - `publisher.domain`
 - `publisher.origin_url`
 - `publisher.proxy_secret`
-- `synthetic.secret_key`
+- `ec.secret_key`
 
 ---
 
@@ -129,12 +129,12 @@ See [Configuration Reference](./configuration.md) for complete patterns.
 
 ## Runtime Errors
 
-### Synthetic ID generation failed
+### EC ID generation failed
 
 **Error Message:**
 
 ```
-Failed to generate synthetic ID: KV store not available
+Failed to generate EC ID: KV store not available
 ```
 
 **Cause:** KV store (counter_store or opid_store) not configured in Fastly
@@ -146,7 +146,7 @@ Failed to generate synthetic ID: KV store not available
 3. Update `trusted-server.toml`:
 
 ```toml
-[synthetic]
+[ec]
 counter_store = "counter_store"  # Must match Fastly KV store name
 opid_store = "opid_store"
 ```
diff --git a/docs/guide/first-party-proxy.md b/docs/guide/first-party-proxy.md
index c3e04fc2..0a2e144c 100644
--- a/docs/guide/first-party-proxy.md
+++ b/docs/guide/first-party-proxy.md
@@ -7,7 +7,7 @@ Learn how Trusted Server proxies third-party assets through first-party domains
 The First-Party Proxy system rewrites third-party URLs in ad creatives to route through your domain, providing:
 
 - **Privacy Protection** - No direct third-party cookies or tracking
-- **Synthetic ID Forwarding** - Controlled identity propagation
+- **EC ID Forwarding** - Controlled identity propagation
 - **Creative Rewrites** - Automatic HTML/CSS URL transformation
 - **Click Tracking** - First-party click redirects
 - **Content Security** - Validated, signed URLs prevent tampering
@@ -18,7 +18,7 @@ The First-Party Proxy system rewrites third-party URLs in ad creatives to route
 flowchart TD
   original["`Creative (Original) &lt;img src='tracker.com/pixel.gif' /&gt;`"]
   rewritten["Creative (Rewritten)<br/>&lt;img src='/first-party/proxy?<br/>tsurl=https://tracker.com/<br/>pixel.gif&amp;tstoken=abc123...' /&gt;"]
-  server["Trusted Server<br/>1. Validate tstoken<br/>2. Append synthetic_id<br/>3. Proxy to tracker.com<br/>4. Return response"]
+  server["Trusted Server<br/>1. Validate tstoken<br/>2. Append ts-ec<br/>3. Proxy to tracker.com<br/>4. Return response"]
 
   original -->|Rewrite| rewritten -->|Browser Request| server
 ```
@@ -46,7 +46,7 @@ GET /first-party/proxy?tsurl=https://example.com/ad.html&tstoken=signature
 **Behavior**:
 
 1. **Validates** the `tstoken` signature against reconstructed URL
-2. **Appends** `synthetic_id` query parameter (if available)
+2. **Appends** `ts-ec` query parameter (if available)
 3. **Proxies** request to target URL with forwarded headers:
    - `User-Agent`
    - `Accept`
@@ -81,7 +81,7 @@ Signed proxy URL:
 Final proxied request:
 
 ```
-https://tracker.com/pixel.gif?campaign=123&uid=abc&synthetic_id=xyz
+https://tracker.com/pixel.gif?campaign=123&uid=abc&ts-ec=xyz
 ```
 
 ### `/first-party/click` - Click Redirects
@@ -99,14 +99,14 @@ GET /first-party/click?tsurl=https://advertiser.com/landing&tstoken=signature
 **Behavior**:
 
 1. **Validates** the `tstoken` signature
-2. **Appends** `synthetic_id` parameter to target URL
+2. **Appends** `ts-ec` parameter to target URL
 3. **Issues** 302 redirect to target (browser navigates directly)
 4. **Logs** click metadata:
    - Target URL base (`tsurl`)
    - Whether parameters were present
    - Full reconstructed URL
    - Referer, User-Agent
-   - Synthetic ID (if available)
+    - EC ID (if available)
 
 **Example**:
 
@@ -127,7 +127,7 @@ User clicks → Server responds:
 
 ```
 HTTP/1.1 302 Found
-Location: https://advertiser.com/buy?product=widget&synthetic_id=xyz
+Location: https://advertiser.com/buy?product=widget&ts-ec=xyz
 ```
 
 ::: tip Click vs Proxy
@@ -335,7 +335,7 @@ The proxy automatically follows HTTP redirects:
 **Behavior**:
 
 1. Follow up to **4 redirect hops**
-2. Re-apply `synthetic_id` on each hop
+2. Re-apply `ts-ec` on each hop
 3. Switch to `GET` after `303` response
 4. Log when redirect limit reached
 5. Preserve request headers across hops
@@ -349,16 +349,16 @@ Request: /first-party/proxy?tsurl=https://short.link&tstoken=sig
   → Rewrite HTML and return
 ```
 
-## Synthetic ID Propagation
+## EC ID Propagation
 
 ### Automatic Forwarding
 
-When proxying, Trusted Server automatically appends the `synthetic_id` parameter:
+When proxying, Trusted Server automatically appends the `ts-ec` parameter:
 
 **Source Priority**:
 
-1. `x-synthetic-id` request header
-2. `synthetic_id` cookie
+1. `x-ts-ec` request header
+2. `ts-ec` cookie
 3. Generate new ID if missing
 
 **Example**:
@@ -366,23 +366,23 @@ When proxying, Trusted Server automatically appends the `synthetic_id` parameter
 ```
 Original request to proxy:
   /first-party/proxy?tsurl=https://tracker.com/pixel.gif&tstoken=sig
-  Cookie: synthetic_id=user123
+  Cookie: ts-ec=user123
 
 Proxied backend request:
-  https://tracker.com/pixel.gif?synthetic_id=user123
+  https://tracker.com/pixel.gif?ts-ec=user123
 ```
 
 ### Redirect Propagation
 
-Synthetic IDs are re-applied on **every redirect hop**:
+EC IDs are re-applied on **every redirect hop**:
 
 ```
 /first-party/proxy?tsurl=https://redirect1.com&tstoken=sig
-  → https://redirect1.com?synthetic_id=user123
+  → https://redirect1.com?ts-ec=user123
   → 302 to https://redirect2.com
-  → https://redirect2.com?synthetic_id=user123
+  → https://redirect2.com?ts-ec=user123
   → 302 to https://final.com
-  → https://final.com?synthetic_id=user123
+  → https://final.com?ts-ec=user123
   → 200 response
 ```
 
@@ -390,7 +390,7 @@ This ensures downstream trackers receive consistent IDs even through redirect ch
 
 ### Click ID Forwarding
 
-Click redirects also forward synthetic IDs:
+Click redirects also forward EC IDs:
 
 ```html
 <a href="/first-party/click?tsurl=https://advertiser.com&tstoken=sig"></a>
@@ -400,15 +400,15 @@ User clicks → redirect includes ID:
 
 ```
 302 Found
-Location: https://advertiser.com?synthetic_id=user123
+Location: https://advertiser.com?ts-ec=user123
 ```
 
 ::: tip Privacy Control
-Synthetic IDs are only forwarded when:
+EC IDs are only forwarded when:
 
 1. User has given GDPR consent (if required)
 2. ID exists in request (header/cookie)
-3. Integration hasn't disabled forwarding (`forward_synthetic_id: false`)
+3. Integration hasn't disabled forwarding (`forward_ec_id: false`)
    :::
 
 ## Configuration
@@ -422,7 +422,7 @@ Configure proxy behavior in `trusted-server.toml`:
 domain = "publisher.com"
 origin_url = "https://origin.publisher.com"
 proxy_secret = "your-secure-random-secret"
-cookie_domain = ".publisher.com"  # For synthetic_id cookies
+cookie_domain = ".publisher.com"  # For ts-ec cookies
 ```
 
 ### URL Rewrite Exclusions
@@ -511,7 +511,7 @@ Only essential headers are forwarded to reduce overhead:
 **Not Forwarded**:
 
 - Authentication headers (unless explicitly added)
-- Cookies (except synthetic ID appended as query param)
+- Cookies (except EC ID appended as query param)
 - Custom headers (unless added via `ProxyRequestConfig`)
 
 ## Error Handling
@@ -652,6 +652,6 @@ X-TS-Version = "1.0"
 ## Next Steps
 
 - Learn about [Creative Processing](/guide/creative-processing) for HTML rewriting details
-- Review [Synthetic IDs](/guide/synthetic-ids) for identity management
+- Review [Edge Cookies](/guide/edge-cookies) for identity management
 - Set up [Configuration](/guide/configuration) for your deployment
 - Explore [Integration Guide](/guide/integration-guide) for custom integrations
diff --git a/docs/guide/gdpr-compliance.md b/docs/guide/gdpr-compliance.md
index 0b17f3f3..5897066f 100644
--- a/docs/guide/gdpr-compliance.md
+++ b/docs/guide/gdpr-compliance.md
@@ -62,7 +62,7 @@ Trusted Server supports:
 
 Only essential data is collected:
 
-- Synthetic IDs (with consent)
+- EC IDs (with consent)
 - Minimal request metadata
 - No PII storage
 
diff --git a/docs/guide/getting-started.md b/docs/guide/getting-started.md
index 47eb250d..ce4b328d 100644
--- a/docs/guide/getting-started.md
+++ b/docs/guide/getting-started.md
@@ -58,7 +58,7 @@ Edit `trusted-server.toml` to configure:
 
 - Ad server integrations
 - KV store mappings
-- Synthetic ID templates
+- EC configuration
 - GDPR settings
 
 See [Configuration](/guide/configuration) for details.
@@ -71,6 +71,6 @@ fastly compute publish
 
 ## Next Steps
 
-- Learn about [Synthetic IDs](/guide/synthetic-ids)
+- Learn about [Edge Cookies](/guide/edge-cookies)
 - Understand [GDPR Compliance](/guide/gdpr-compliance)
 - Configure [Ad Serving](/guide/ad-serving)
diff --git a/docs/guide/integration-guide.md b/docs/guide/integration-guide.md
index f199db94..3a8c4354 100644
--- a/docs/guide/integration-guide.md
+++ b/docs/guide/integration-guide.md
@@ -112,7 +112,7 @@ impl IntegrationProxy for MyIntegration {
         settings: &Settings,
         req: Request,
     ) -> Result<Response, Report<TrustedServerError>> {
-        // Parse/generate synthetic IDs, forward upstream, and return the response.
+        // Parse/generate EC IDs, forward upstream, and return the response.
     }
 }
 ```
@@ -127,7 +127,7 @@ The shared context already injects Trusted Server logging, headers, and error ha
 
 #### Proxying Upstream Requests
 
-Use the shared helper in `crates/common/src/proxy.rs` to forward requests so you automatically get the same header copying, redirect handling, HTML/CSS rewrite behavior, and synthetic ID handling the first-party proxy uses:
+Use the shared helper in `crates/common/src/proxy.rs` to forward requests so you automatically get the same header copying, redirect handling, HTML/CSS rewrite behavior, and EC ID handling the first-party proxy uses:
 
 ```rust
 use crate::proxy::{proxy_request, ProxyRequestConfig};
@@ -145,7 +145,7 @@ let response = proxy_request(
 .await?;
 ```
 
-Set `forward_synthetic_id` to `false` if the upstream should not receive the caller's synthetic ID (`Testlight` does this), and disable `follow_redirects` if you need to surface redirects directly to the caller.
+Set `forward_ec_id` to `false` if the upstream should not receive the caller's EC ID (`Testlight` does this), and disable `follow_redirects` if you need to surface redirects directly to the caller.
 
 **Streaming passthrough example:**
 
@@ -261,7 +261,7 @@ Integrations that ship additional JS (such as Testlight) typically expose a `shi
 4. Use `fastly compute serve` (with Viceroy installed) to hit `/integrations/<id>/…` and fetch HTML from your origin to confirm rewrites are applied.
 
 ::: tip Testing Strategy
-For unit tests, prefer exposing helper constructors that accept a synthetic `shim_src` so your tests can point rewriters at a deterministic URL without touching the Tsjs build artifacts.
+For unit tests, prefer exposing helper constructors that accept a stub `shim_src` so your tests can point rewriters at a deterministic URL without touching the Tsjs build artifacts.
 :::
 
 By following these steps you can ship independent integration modules that plug into the Trusted Server runtime without modifying the Fastly entrypoint or HTML processor each time.
@@ -290,7 +290,7 @@ Integrations are loaded in one of two ways:
 
 **Loading**: Deferred (`<script defer>`)
 
-**Purpose**: Production Prebid Server bridge that owns `/first-party/ad` & `/third-party/ad`, injects synthetic IDs, rewrites creatives/notification URLs, and removes publisher-supplied Prebid scripts. The NPM-bundled Prebid.js is served as a separate deferred bundle (`tsjs-prebid.min.js`) to avoid blocking page rendering (168 KB).
+**Purpose**: Production Prebid Server bridge that owns `/first-party/ad` & `/third-party/ad`, injects EC IDs, rewrites creatives/notification URLs, and removes publisher-supplied Prebid scripts. The NPM-bundled Prebid.js is served as a separate deferred bundle (`tsjs-prebid.min.js`) to avoid blocking page rendering (168 KB).
 
 **Key files**:
 
@@ -318,7 +318,7 @@ Tests or scaffolding can inject configs by calling `settings.integrations.insert
 
 **2. Routes Owned by the Integration**
 
-`IntegrationProxy::routes` declares the `/integrations/prebid/first-party/ad` (GET) and `/integrations/prebid/third-party/ad` (POST) endpoints. Both handlers share helpers that shape OpenRTB payloads, inject synthetic IDs + geo/request-signing context, forward requests via `ensure_backend_from_url`, and run the HTML creative rewrites before responding. All routes are properly namespaced under `/integrations/prebid/` to follow the integration routing pattern.
+`IntegrationProxy::routes` declares the `/integrations/prebid/first-party/ad` (GET) and `/integrations/prebid/third-party/ad` (POST) endpoints. Both handlers share helpers that shape OpenRTB payloads, inject EC IDs + geo/request-signing context, forward requests via `ensure_backend_from_url`, and run the HTML creative rewrites before responding. All routes are properly namespaced under `/integrations/prebid/` to follow the integration routing pattern.
 
 **3. HTML Rewrites Through the Registry**
 
@@ -337,7 +337,7 @@ We plan to expand integration capabilities in several areas:
 1. **Declarative Routing & Middleware** - Richer endpoints (path params, shared middleware, structured context) beyond simple method/path matching.
 2. **Granular HTML Hooks** - Ordered selectors, head/body injection points, and DOM-aware helpers so multiple integrations can safely collaborate.
 3. **Integration Manifest** - Schema describing required bundles, routes, config validation, and feature flags to keep registration data-driven.
-4. **Shared Request Utilities** - Reusable building blocks for synthetic ID injection, consent enforcement, and OpenRTB shaping.
+4. **Shared Request Utilities** - Reusable building blocks for EC ID injection, consent enforcement, and OpenRTB shaping.
 5. **tsjs Tooling** - Auto-generated integration bundles, scaffolding for TS shims/tests, and metadata surfaced back to Rust.
 6. **Testing & Observability Hooks** - Integration-focused mocks, local harnesses, and telemetry emitters for easier validation and monitoring.
 
diff --git a/docs/guide/integrations-overview.md b/docs/guide/integrations-overview.md
index 8f1be770..1c312584 100644
--- a/docs/guide/integrations-overview.md
+++ b/docs/guide/integrations-overview.md
@@ -20,7 +20,7 @@ Trusted Server provides built-in integrations with popular third-party services,
 **Key Features:**
 
 - OpenRTB 2.x protocol conversion
-- Synthetic ID injection for privacy
+- EC ID injection for privacy
 - First-party creative resource proxying
 - CDN URL rewriting (7+ major SSPs)
 - GPC signal support
@@ -125,7 +125,7 @@ rewrite_sdk = true
 
 **Key Features:**
 
-- Synthetic ID injection demonstration
+- EC ID injection demonstration
 - Flexible JSON schema (preserves unknown fields)
 - Stream passthrough mode
 - Script replacement capability
@@ -146,7 +146,7 @@ rewrite_scripts = false
 
 - `POST /integrations/testlight/auction` - Auction endpoint with ID injection
 
-**When to use:** You're developing or testing integration functionality and need a simple endpoint to validate synthetic ID injection.
+**When to use:** You're developing or testing integration functionality and need a simple endpoint to validate EC ID injection.
 
 **Learn more:** [Testing Guide](./testing.md)
 
@@ -263,7 +263,7 @@ No. Integration configuration is read at startup. You must redeploy to change in
 
 ### Are integrations required?
 
-No. All integrations are optional. You can run Trusted Server with no integrations enabled and use it purely for synthetic ID generation and first-party proxying.
+No. All integrations are optional. You can run Trusted Server with no integrations enabled and use it purely for EC ID generation and first-party proxying.
 
 ### How do I add a new integration?
 
diff --git a/docs/guide/integrations/didomi.md b/docs/guide/integrations/didomi.md
index a68ab2da..524ba3be 100644
--- a/docs/guide/integrations/didomi.md
+++ b/docs/guide/integrations/didomi.md
@@ -132,7 +132,7 @@ Proxied:  https://your-domain.com/integrations/didomi/consent/api/v1/events
 
 Didomi consent status is checked before:
 
-- Generating synthetic IDs
+- Generating EC IDs
 - Syncing with identity partners (Lockr)
 - Activating tracking pixels
 - Sharing data with third parties
diff --git a/docs/guide/integrations/google_tag_manager.md b/docs/guide/integrations/google_tag_manager.md
index 074c7a88..60263125 100644
--- a/docs/guide/integrations/google_tag_manager.md
+++ b/docs/guide/integrations/google_tag_manager.md
@@ -231,4 +231,4 @@ See [crates/common/src/integrations/google_tag_manager.rs](https://github.com/IA
 
 - Review [Prebid Integration](/guide/integrations/prebid) for header bidding.
 - Check [Configuration Guide](/guide/configuration) for other integration settings.
-- Learn more about [Synthetic IDs](/guide/synthetic-ids) which are generated alongside this integration.
+- Learn more about [Edge Cookies](/guide/edge-cookies) which are generated alongside this integration.
diff --git a/docs/guide/integrations/gpt.md b/docs/guide/integrations/gpt.md
index 181bb942..ff78ee4c 100644
--- a/docs/guide/integrations/gpt.md
+++ b/docs/guide/integrations/gpt.md
@@ -105,7 +105,7 @@ Intercepts scripts from `securepubads.g.doubleclick.net` and rewrites them to th
 
 Takes over `googletag.cmd` so every queued callback is wrapped before GPT executes it. This enables future hook points for:
 
-- Synthetic ID injection as page-level key-value targeting
+- EC ID injection as page-level key-value targeting
 - Consent gating of ad requests
 - Ad-unit path rewriting for A/B testing
 
diff --git a/docs/guide/integrations/lockr.md b/docs/guide/integrations/lockr.md
index 27af48cc..11a69e0c 100644
--- a/docs/guide/integrations/lockr.md
+++ b/docs/guide/integrations/lockr.md
@@ -26,7 +26,7 @@ Lockr is an identity resolution and privacy platform that helps publishers manag
 ┌──────────────────────────────────────────────────┐
 │  User Visit                                      │
 │  ↓                                               │
-│  Trusted Server generates Synthetic ID           │
+│  Trusted Server generates EC ID                  │
 │  ↓                                               │
 │  Lockr Integration maps to Lockr Identity        │
 │  ↓                                               │
@@ -70,9 +70,9 @@ TRUSTED_SERVER__INTEGRATIONS__LOCKR__PROJECT_ID=your-project-id
 
 ### Identity Synchronization
 
-Lockr integration automatically syncs Trusted Server synthetic IDs with Lockr's identity vault:
+Lockr integration automatically syncs Trusted Server EC IDs with Lockr's identity vault:
 
-1. User visits site (Trusted Server generates synthetic ID)
+1. User visits site (Trusted Server generates EC ID)
 2. If GDPR consent granted, sync with Lockr
 3. Lockr returns unified identity
 4. Identity available for bid requests and analytics
@@ -146,11 +146,11 @@ The Lockr integration is implemented in [crates/common/src/integrations/lockr.rs
 
 - Route: `/integrations/lockr/sync`
 - Method: POST
-- Purpose: Synchronize synthetic ID with Lockr vault
+- Purpose: Synchronize EC ID with Lockr vault
 
 **ID Mapping**:
 
-- Maps Trusted Server synthetic ID → Lockr unified ID
+- Maps Trusted Server EC ID → Lockr unified ID
 - Cached for performance
 - Respects consent status
 
@@ -193,7 +193,7 @@ Track Lockr sync success/failure rates:
 Validate end-to-end identity flow:
 
 ```bash
-# 1. Generate synthetic ID
+# 1. Generate EC ID
 curl https://edge.example.com/
 
 # 2. Verify Lockr sync (check logs)
@@ -261,7 +261,7 @@ curl https://edge.example.com/
 
 ## Next Steps
 
-- Learn about [Synthetic IDs](/guide/synthetic-ids) for identity generation
+- Learn about [Edge Cookies](/guide/edge-cookies) for identity generation
 - Review [GDPR Compliance](/guide/gdpr-compliance) for consent management
 - Explore [Didomi Integration](/guide/integrations/didomi) for CMP integration
 - Check [Configuration Reference](/guide/configuration) for advanced options
diff --git a/docs/guide/integrations/nextjs.md b/docs/guide/integrations/nextjs.md
index 455a495e..832ec263 100644
--- a/docs/guide/integrations/nextjs.md
+++ b/docs/guide/integrations/nextjs.md
@@ -120,7 +120,7 @@ Targets the Next.js data script for rewriting.
 Run your Next.js application behind Trusted Server for:
 
 - First-party asset loading
-- Synthetic ID injection
+- EC ID injection
 - Privacy-compliant tracking
 - Ad serving integration
 
diff --git a/docs/guide/integrations/prebid.md b/docs/guide/integrations/prebid.md
index 4458b0f5..b47cfa21 100644
--- a/docs/guide/integrations/prebid.md
+++ b/docs/guide/integrations/prebid.md
@@ -111,12 +111,12 @@ Full OpenRTB protocol conversion:
 
 - Converts ad units to OpenRTB `imp` objects
 - Injects publisher domain and page URL
-- Adds synthetic ID for privacy-safe tracking
+- Adds EC ID for privacy-safe tracking
 - Supports banner formats (video and native are currently not emitted by the Prebid provider)
 
-### Synthetic ID Injection
+### EC ID Injection
 
-Automatically injects privacy-preserving synthetic ID into bid requests for user recognition without cookies.
+Automatically injects privacy-preserving EC ID into bid requests for user recognition without cookies.
 
 ### Request Signing
 
@@ -289,7 +289,7 @@ The `to_openrtb()` method in `PrebidAuctionProvider` builds OpenRTB requests:
 - Marks impressions as `secure: 1` (HTTPS-only creatives)
 - Sets `tagid` from the slot ID
 - Adds site metadata with publisher domain, page URL, `site.ref` from the Referer header, and `site.publisher` from the domain
-- Injects synthetic ID in the user object
+- Injects EC ID in the user object
 - Forwards user consent string and sets the GDPR flag based on geo and consent presence
 - Translates the `Sec-GPC` header to a US Privacy string (`us_privacy`)
 - Extracts `DNT` and `Accept-Language` headers into device fields
@@ -313,4 +313,4 @@ The `to_openrtb()` method in `PrebidAuctionProvider` builds OpenRTB requests:
 - Review [Ad Serving Guide](/guide/ad-serving) for general concepts
 - Check [OpenRTB Support](/roadmap) on the roadmap for enhancements
 - Explore [Request Signing](/guide/request-signing) for authentication
-- Learn about [Synthetic IDs](/guide/synthetic-ids) for privacy-safe tracking
+- Learn about [Edge Cookies](/guide/edge-cookies) for privacy-safe tracking
diff --git a/docs/guide/onboarding.md b/docs/guide/onboarding.md
index a25afe7e..d7be8d31 100644
--- a/docs/guide/onboarding.md
+++ b/docs/guide/onboarding.md
@@ -40,7 +40,7 @@ Welcome to the Trusted Server project! This guide keeps internal onboarding note
 | `crates/fastly/src/main.rs`                  | Request routing entry point      |
 | `crates/common/src/publisher.rs`             | Publisher origin handling        |
 | `crates/common/src/proxy.rs`                 | First-party proxy implementation |
-| `crates/common/src/synthetic.rs`             | Synthetic ID generation          |
+| `crates/common/src/edge_cookie.rs`            | EC ID generation                 |
 | `crates/common/src/integrations/registry.rs` | Integration module pattern       |
 | `trusted-server.toml`                        | Application configuration        |
 
@@ -146,7 +146,7 @@ Use this checklist to track your onboarding progress:
 
 - [ ] Read through `main.rs` to understand request routing
 - [ ] Trace a request through `publisher.rs` and `proxy.rs`
-- [ ] Understand synthetic ID generation in `synthetic.rs`
+- [ ] Understand EC ID generation in `edge_cookie.rs`
 - [ ] Review an existing integration (e.g., `prebid.rs`)
 
 ### Documentation & Contribution
diff --git a/docs/guide/synthetic-ids.md b/docs/guide/synthetic-ids.md
deleted file mode 100644
index 45914a90..00000000
--- a/docs/guide/synthetic-ids.md
+++ /dev/null
@@ -1,43 +0,0 @@
-# Synthetic IDs
-
-Trusted Server's Synthetic ID module maintains user recognition across all browsers through first-party identifiers.
-
-## What are Synthetic IDs?
-
-Synthetic IDs are privacy-safe identifiers generated on a first site visit using HMAC-based templates that allow tracking with user consent while protecting user privacy. Trusted Server derives a deterministic HMAC base from the template inputs and appends a short random suffix to reduce collision risk. They are passed in requests on subsequent visits and activity.
-
-Trusted Server surfaces the current synthetic ID via response headers and a first-party cookie. For the exact header and cookie names, see the [API Reference](/guide/api-reference).
-
-## How They Work
-
-### HMAC-Based Generation
-
-Synthetic IDs use HMAC (Hash-based Message Authentication Code) to generate a deterministic base from a configurable template, then append a short random suffix.
-
-**Format**: `64-hex-hmac`.`6-alphanumeric-suffix`
-
-**IP normalization**: IPv6 addresses are normalized to a /64 prefix before templating.
-
-## Configuration
-
-Configure synthetic ID templates and secrets in `trusted-server.toml`. See the full [Configuration Reference](/guide/configuration) for the `synthetic` section and environment variable overrides.
-
-## Privacy Considerations
-
-- IDs are only generated with explicit user consent
-- No personally identifiable information (PII) is included
-- Templates are configurable per-deployment
-- IDs can be rotated on schedule
-
-## Best Practices
-
-1. Always verify GDPR consent before generating IDs
-2. Rotate secret keys periodically
-3. Use appropriate template complexity for your use case
-4. Monitor ID collision rates
-
-## Next Steps
-
-- Learn about [GDPR Compliance](/guide/gdpr-compliance)
-- Configure [Ad Serving](/guide/ad-serving)
-- Learn about [Collective Sync](/guide/collective-sync) for cross-publisher data sharing details and diagrams
diff --git a/docs/guide/testing.md b/docs/guide/testing.md
index 96fee697..3fe1c36e 100644
--- a/docs/guide/testing.md
+++ b/docs/guide/testing.md
@@ -21,23 +21,23 @@ cargo test
 Tests are organized alongside source code in `#[cfg(test)]` modules:
 
 ```rust
-// crates/common/src/synthetic.rs
+// crates/common/src/edge_cookie.rs
 #[cfg(test)]
 mod tests {
     use super::*;
 
     #[test]
-    fn test_generate_synthetic_id() {
+    fn test_generate_ec_id() {
         let settings = create_test_settings();
         let req = create_test_request(vec![
             (header::USER_AGENT, "Mozilla/5.0"),
             (header::COOKIE, "pub_userid=12345"),
         ]);
 
-        let synthetic_id = generate_synthetic_id(&settings, &req)
-            .expect("should generate synthetic ID");
+        let ec_id = generate_ec_id(&settings, &req)
+            .expect("should generate EC ID");
 
-        assert!(!synthetic_id.is_empty());
+        assert!(!ec_id.is_empty());
     }
 }
 ```
@@ -51,7 +51,7 @@ mod tests {
 cargo test
 
 # Run specific test by name
-cargo test test_generate_synthetic_id
+cargo test test_generate_ec_id
 
 # Run tests with output visible
 cargo test -- --nocapture
@@ -60,7 +60,7 @@ cargo test -- --nocapture
 cargo test -p trusted-server-common
 
 # Run tests matching a pattern
-cargo test synthetic
+cargo test ec
 ```
 
 ### Integration Tests
@@ -86,42 +86,42 @@ curl http://localhost:7676/.well-known/trusted-server.json
 
 ## Real Test Examples
 
-### Synthetic ID Tests
+### EC ID Tests
 
-From `crates/common/src/synthetic.rs`:
+From `crates/common/src/edge_cookie.rs`:
 
 ```rust
 #[test]
-fn test_get_synthetic_id_with_header() {
+fn test_get_ec_id_with_header() {
     let settings = create_test_settings();
     let req = create_test_request(vec![(
-        HEADER_X_SYNTHETIC_ID,
-        "existing_synthetic_id",
+        HEADER_X_TS_EC,
+        "existing_ec_id",
     )]);
 
-    let synthetic_id = get_synthetic_id(&req)
-        .expect("should get synthetic ID");
-    assert_eq!(synthetic_id, Some("existing_synthetic_id".to_string()));
+    let ec_id = get_ec_id(&req)
+        .expect("should get EC ID");
+    assert_eq!(ec_id, Some("existing_ec_id".to_string()));
 }
 
 #[test]
-fn test_get_synthetic_id_with_cookie() {
+fn test_get_ec_id_with_cookie() {
     let settings = create_test_settings();
     let req = create_test_request(vec![
-        (header::COOKIE, "synthetic_id=existing_cookie_id")
+        (header::COOKIE, "ts-ec=existing_cookie_id")
     ]);
 
-    let synthetic_id = get_synthetic_id(&req)
-        .expect("should get synthetic ID");
-    assert_eq!(synthetic_id, Some("existing_cookie_id".to_string()));
+    let ec_id = get_ec_id(&req)
+        .expect("should get EC ID");
+    assert_eq!(ec_id, Some("existing_cookie_id".to_string()));
 }
 
 #[test]
-fn test_get_synthetic_id_none() {
+fn test_get_ec_id_none() {
     let req = create_test_request(vec![]);
-    let synthetic_id = get_synthetic_id(&req)
+    let ec_id = get_ec_id(&req)
         .expect("should handle missing ID");
-    assert!(synthetic_id.is_none());
+    assert!(ec_id.is_none());
 }
 ```
 
@@ -187,7 +187,7 @@ fn proxy_request_config_supports_streaming_and_headers() {
 
     assert_eq!(cfg.target_url, "https://example.com/asset");
     assert!(cfg.follow_redirects, "should follow redirects by default");
-    assert!(cfg.forward_synthetic_id, "should forward synthetic id by default");
+    assert!(cfg.forward_ec_id, "should forward EC ID by default");
 }
 
 #[test]
@@ -317,12 +317,13 @@ k6 run load-test.js
 ## Best Practices
 
 1. **Test all new features** - Write tests alongside new code
-2. **Use descriptive names** - `test_synthetic_id_generation_with_consent`
+2. **Use descriptive names** - `test_ec_id_generation_with_consent`
 3. **Test edge cases** - Empty inputs, missing headers, invalid data
 4. **Keep tests fast** - Mock external dependencies
 5. **Use test helpers** - `create_test_settings()`, `create_test_request()`
 6. **Assert specific values** - Not just `assert!(result.is_ok())`
 
+
 ## Next Steps
 
 - Review [Architecture](/guide/architecture) for system design
diff --git a/docs/guide/what-is-trusted-server.md b/docs/guide/what-is-trusted-server.md
index 1a42b747..a5ca6f63 100644
--- a/docs/guide/what-is-trusted-server.md
+++ b/docs/guide/what-is-trusted-server.md
@@ -12,7 +12,7 @@ Trusted Server provides publishers benefits such as:
 - Increased ad inventory revenue within cookie restricted (Safari Webkit) or other JS-challenged environments
 - Ability to serve ALL assets under 1st party context with on-the-fly URL detection and rewriting via HTML/CSS stream inspection
 - Cryptographically sign bid requests for downstream partners to verify requests originated from specific publisher's Trusted Server instance, preventing fraud and spoofing
-- Creates privacy-safe synthetic identifiers (HMAC base + short random suffix) without relying on third-party cookies
+- Creates privacy-safe edge cookie identifiers (HMAC base + short random suffix) without relying on third-party cookies
 - Native integration with Prebid-Server and other third-party monetization and ID vendors
 - Native support for parsing RSC (React Server Components) for Next.JS front-end origins
 - Dynamic backend support for ease of integrating existing publisher environments
diff --git a/docs/index.md b/docs/index.md
index 4b07ec38..655798d5 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -19,8 +19,8 @@ hero:
       text: View on GitHub
       link: https://github.com/IABTechLab/trusted-server 
 features:
-  - title: Synthetic ID Generation
-    details: HMAC-based synthetic IDs that preserve privacy while enabling tracking with user consent
+  - title: Edge Cookie (EC) Generation
+    details: HMAC-based edge cookies that preserve privacy while enabling tracking with user consent
   - title: GDPR Compliant
     details: Built-in consent management and validation to ensure compliance with privacy regulations
   - title: Edge Computing
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 5892bc65..d76c14b9 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -110,14 +110,14 @@ Our development is focused on three key areas:
 - Zero-cold-start header bidding
 - Reduce external dependencies
 
-**Better Synthetic ID Syncing**
+**Better EC ID Syncing**
 
 - Enhanced ID sync with downstream partners
 - Batch sync optimization
 - Partner ID mapping tables
 - Sync status monitoring
 
-**Standalone Synthetic ID Service**
+**Standalone EC ID Service**
 
 - Dedicated ID generation microservice
 - Cross-publisher ID graph support
@@ -233,7 +233,7 @@ A comprehensive creative forensics engine for ad behavior monitoring and fraud p
 
 - SPIN + Akamai Support
 - Prebid Server Rust Port (alpha)
-- Standalone Synthetic ID Service
+- Standalone EC ID Service
 
 ### Q3 2026
 
diff --git a/trusted-server.toml b/trusted-server.toml
index 4a4f3128..ccfa8397 100644
--- a/trusted-server.toml
+++ b/trusted-server.toml
@@ -14,17 +14,10 @@ cookie_domain = ".test-publisher.com"
 origin_url = "https://origin.test-publisher.com"
 proxy_secret = "change-me-proxy-secret"
 
-[synthetic]
+[ec]
 counter_store = "counter_store"
 opid_store = "opid_store"
 secret_key = "trusted-server"
-# Possible values
-#   - "client_ip"
-#   - "user_agent"
-#   - "accept_language"
-#   - "accept_encoding"
-#   - "random_uuid"
-template = "{{ client_ip }}:{{ user_agent }}:{{ accept_language }}:{{ accept_encoding }}"
 
 # Custom headers to be included in every response
 # Allows publishers to include tags such as X-Robots-Tag: noindex

From e2b8a493c4dcdb8da42c233090f1fd0103b54ae3 Mon Sep 17 00:00:00 2001
From: Christian <christianpavilonis@outlook.com>
Date: Wed, 18 Mar 2026 14:30:38 -0500
Subject: [PATCH 2/5] Fix remaining SSC naming vestiges, CI formatting, and
 dependency sync
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Rename allows_ssc_creation → allows_ec_creation and update all doc
  comments, test names, and assertion messages to use Edge Cookie (EC)
- Fix intra-doc link [`ec`] → [`edge_cookie`] in lib.rs
- Downgrade test log from info to debug in edge_cookie.rs for consistency
- Add fallback comment and wire-protocol breaking-change doc in openrtb.rs
- Run prettier --write on 3 doc files to fix format-docs CI
- Update integration-tests Cargo.lock to sync derive_more 2.1.1
---
 crates/common/src/consent/kv.rs     |  2 +-
 crates/common/src/consent/mod.rs    | 84 ++++++++++++++---------------
 crates/common/src/edge_cookie.rs    |  4 +-
 crates/common/src/lib.rs            |  2 +-
 crates/common/src/openrtb.rs        |  4 ++
 crates/common/src/publisher.rs      |  4 +-
 crates/integration-tests/Cargo.lock | 76 +++++++++++++++-----------
 docs/guide/first-party-proxy.md     |  2 +-
 docs/guide/onboarding.md            |  2 +-
 docs/guide/testing.md               |  1 -
 10 files changed, 101 insertions(+), 80 deletions(-)

diff --git a/crates/common/src/consent/kv.rs b/crates/common/src/consent/kv.rs
index 961a4252..9aa51349 100644
--- a/crates/common/src/consent/kv.rs
+++ b/crates/common/src/consent/kv.rs
@@ -362,7 +362,7 @@ pub fn save_consent_to_kv(store_name: &str, ec_id: &str, ctx: &ConsentContext, m
 
 /// Deletes a consent entry from the KV Store for a given EC ID.
 ///
-/// Used when a user revokes consent — the existing SSC cookie is being
+/// Used when a user revokes consent — the existing EC cookie is being
 /// expired, so the persisted consent data must also be removed.
 ///
 /// Errors are logged but never propagated — KV Store failures must not
diff --git a/crates/common/src/consent/mod.rs b/crates/common/src/consent/mod.rs
index 6bb033be..b33a330b 100644
--- a/crates/common/src/consent/mod.rs
+++ b/crates/common/src/consent/mod.rs
@@ -463,22 +463,22 @@ pub fn gate_eids_by_consent<T>(
 }
 
 // ---------------------------------------------------------------------------
-// SSC consent gating
+// EC consent gating
 // ---------------------------------------------------------------------------
 
-/// Determines whether SSC (Synthetic Session Cookie) creation is permitted
-/// based on the user's consent and detected jurisdiction.
+/// Determines whether Edge Cookie (EC) creation is permitted based on the
+/// user's consent and detected jurisdiction.
 ///
 /// The decision follows the jurisdiction's consent model:
 ///
 /// - **GDPR (EU/UK)**: opt-in required — TCF Purpose 1 (store/access
 ///   information on a device) must be explicitly consented. If no TCF data is
-///   available under GDPR, consent is assumed absent and SSC is blocked.
-/// - **US state privacy**: opt-out model — SSC is allowed unless the user has
+///   available under GDPR, consent is assumed absent and EC is blocked.
+/// - **US state privacy**: opt-out model — EC is allowed unless the user has
 ///   explicitly opted out via the US Privacy string or Global Privacy Control.
-/// - **Non-regulated / Unknown**: SSC is allowed (no consent requirement).
+/// - **Non-regulated / Unknown**: EC is allowed (no consent requirement).
 #[must_use]
-pub fn allows_ssc_creation(ctx: &ConsentContext) -> bool {
+pub fn allows_ec_creation(ctx: &ConsentContext) -> bool {
     match &ctx.jurisdiction {
         jurisdiction::Jurisdiction::Gdpr => {
             // EU/UK: explicit opt-in required (TCF Purpose 1 = store/access device).
@@ -610,7 +610,7 @@ mod tests {
     use fastly::Request;
 
     use super::{
-        allows_ssc_creation, apply_expiration_check, apply_tcf_conflict_resolution,
+        allows_ec_creation, apply_expiration_check, apply_tcf_conflict_resolution,
         build_consent_context, build_context_from_signals, should_try_kv_fallback,
         ConsentPipelineInput,
     };
@@ -882,7 +882,7 @@ mod tests {
     }
 
     // -----------------------------------------------------------------------
-    // allows_ssc_creation tests
+    // allows_ec_creation tests
     // -----------------------------------------------------------------------
 
     /// Helper: builds a TCF consent with configurable Purpose 1 (storage).
@@ -891,7 +891,7 @@ mod tests {
     }
 
     #[test]
-    fn ssc_allowed_gdpr_with_storage_consent() {
+    fn ec_allowed_gdpr_with_storage_consent() {
         let ctx = ConsentContext {
             jurisdiction: Jurisdiction::Gdpr,
             tcf: Some(make_tcf_with_storage(true)),
@@ -899,13 +899,13 @@ mod tests {
             ..ConsentContext::default()
         };
         assert!(
-            allows_ssc_creation(&ctx),
-            "GDPR + TCF Purpose 1 consented should allow SSC"
+            allows_ec_creation(&ctx),
+            "GDPR + TCF Purpose 1 consented should allow EC"
         );
     }
 
     #[test]
-    fn ssc_blocked_gdpr_without_storage_consent() {
+    fn ec_blocked_gdpr_without_storage_consent() {
         let ctx = ConsentContext {
             jurisdiction: Jurisdiction::Gdpr,
             tcf: Some(make_tcf_with_storage(false)),
@@ -913,13 +913,13 @@ mod tests {
             ..ConsentContext::default()
         };
         assert!(
-            !allows_ssc_creation(&ctx),
-            "GDPR + TCF Purpose 1 not consented should block SSC"
+            !allows_ec_creation(&ctx),
+            "GDPR + TCF Purpose 1 not consented should block EC"
         );
     }
 
     #[test]
-    fn ssc_blocked_gdpr_no_tcf_data() {
+    fn ec_blocked_gdpr_no_tcf_data() {
         let ctx = ConsentContext {
             jurisdiction: Jurisdiction::Gdpr,
             tcf: None,
@@ -928,13 +928,13 @@ mod tests {
             ..ConsentContext::default()
         };
         assert!(
-            !allows_ssc_creation(&ctx),
-            "GDPR with no TCF data should block SSC"
+            !allows_ec_creation(&ctx),
+            "GDPR with no TCF data should block EC"
         );
     }
 
     #[test]
-    fn ssc_allowed_gdpr_via_gpp_embedded_tcf() {
+    fn ec_allowed_gdpr_via_gpp_embedded_tcf() {
         let ctx = ConsentContext {
             jurisdiction: Jurisdiction::Gdpr,
             tcf: None,
@@ -947,13 +947,13 @@ mod tests {
             ..ConsentContext::default()
         };
         assert!(
-            allows_ssc_creation(&ctx),
-            "GDPR + GPP embedded TCF with P1 consent should allow SSC"
+            allows_ec_creation(&ctx),
+            "GDPR + GPP embedded TCF with P1 consent should allow EC"
         );
     }
 
     #[test]
-    fn ssc_allowed_us_state_no_optout() {
+    fn ec_allowed_us_state_no_optout() {
         let ctx = ConsentContext {
             jurisdiction: Jurisdiction::UsState("CA".to_owned()),
             us_privacy: Some(UsPrivacy {
@@ -965,13 +965,13 @@ mod tests {
             ..ConsentContext::default()
         };
         assert!(
-            allows_ssc_creation(&ctx),
-            "US state + no opt-out should allow SSC"
+            allows_ec_creation(&ctx),
+            "US state + no opt-out should allow EC"
         );
     }
 
     #[test]
-    fn ssc_blocked_us_state_opted_out() {
+    fn ec_blocked_us_state_opted_out() {
         let ctx = ConsentContext {
             jurisdiction: Jurisdiction::UsState("CA".to_owned()),
             us_privacy: Some(UsPrivacy {
@@ -983,13 +983,13 @@ mod tests {
             ..ConsentContext::default()
         };
         assert!(
-            !allows_ssc_creation(&ctx),
-            "US state + opt-out should block SSC"
+            !allows_ec_creation(&ctx),
+            "US state + opt-out should block EC"
         );
     }
 
     #[test]
-    fn ssc_blocked_us_state_gpc_implies_optout() {
+    fn ec_blocked_us_state_gpc_implies_optout() {
         let ctx = ConsentContext {
             jurisdiction: Jurisdiction::UsState("CA".to_owned()),
             us_privacy: None,
@@ -997,13 +997,13 @@ mod tests {
             ..ConsentContext::default()
         };
         assert!(
-            !allows_ssc_creation(&ctx),
-            "US state + GPC=true with no US Privacy string should block SSC"
+            !allows_ec_creation(&ctx),
+            "US state + GPC=true with no US Privacy string should block EC"
         );
     }
 
     #[test]
-    fn ssc_allowed_us_state_no_signals() {
+    fn ec_allowed_us_state_no_signals() {
         let ctx = ConsentContext {
             jurisdiction: Jurisdiction::UsState("CA".to_owned()),
             us_privacy: None,
@@ -1011,37 +1011,37 @@ mod tests {
             ..ConsentContext::default()
         };
         assert!(
-            allows_ssc_creation(&ctx),
-            "US state + no opt-out signals should allow SSC (opt-out model)"
+            allows_ec_creation(&ctx),
+            "US state + no opt-out signals should allow EC (opt-out model)"
         );
     }
 
     #[test]
-    fn ssc_allowed_non_regulated() {
+    fn ec_allowed_non_regulated() {
         let ctx = ConsentContext {
             jurisdiction: Jurisdiction::NonRegulated,
             ..ConsentContext::default()
         };
         assert!(
-            allows_ssc_creation(&ctx),
-            "non-regulated jurisdiction should always allow SSC"
+            allows_ec_creation(&ctx),
+            "non-regulated jurisdiction should always allow EC"
         );
     }
 
     #[test]
-    fn ssc_allowed_unknown_jurisdiction() {
+    fn ec_allowed_unknown_jurisdiction() {
         let ctx = ConsentContext {
             jurisdiction: Jurisdiction::Unknown,
             ..ConsentContext::default()
         };
         assert!(
-            allows_ssc_creation(&ctx),
-            "unknown jurisdiction should allow SSC (no geo data available)"
+            allows_ec_creation(&ctx),
+            "unknown jurisdiction should allow EC (no geo data available)"
         );
     }
 
     #[test]
-    fn ssc_us_privacy_not_applicable_allows_ssc() {
+    fn ec_us_privacy_not_applicable_allows_ec() {
         let ctx = ConsentContext {
             jurisdiction: Jurisdiction::UsState("VA".to_owned()),
             us_privacy: Some(UsPrivacy {
@@ -1053,8 +1053,8 @@ mod tests {
             ..ConsentContext::default()
         };
         assert!(
-            allows_ssc_creation(&ctx),
-            "US Privacy with opt_out=N/A should allow SSC"
+            allows_ec_creation(&ctx),
+            "US Privacy with opt_out=N/A should allow EC"
         );
     }
 }
diff --git a/crates/common/src/edge_cookie.rs b/crates/common/src/edge_cookie.rs
index 779f118a..8f669528 100644
--- a/crates/common/src/edge_cookie.rs
+++ b/crates/common/src/edge_cookie.rs
@@ -69,6 +69,8 @@ pub fn generate_ec_id(
     settings: &Settings,
     req: &Request,
 ) -> Result<String, Report<TrustedServerError>> {
+    // Fallback to "unknown" when client IP is unavailable (e.g., local testing).
+    // All such requests share the same HMAC base; the random suffix provides uniqueness.
     let client_ip = req
         .get_client_ip_addr()
         .map(normalize_ip)
@@ -232,7 +234,7 @@ mod tests {
         let req = create_test_request(vec![]);
 
         let ec_id = generate_ec_id(&settings, &req).expect("should generate EC ID");
-        log::info!("Generated EC ID: {}", ec_id);
+        log::debug!("Generated EC ID: {}", ec_id);
         assert!(
             is_ec_id_format(&ec_id),
             "should match EC ID format: {{64hex}}.{{6alnum}}"
diff --git a/crates/common/src/lib.rs b/crates/common/src/lib.rs
index a0d61705..c3ea53cc 100644
--- a/crates/common/src/lib.rs
+++ b/crates/common/src/lib.rs
@@ -16,7 +16,7 @@
 //! - [`privacy`]: Privacy utilities and helpers
 //! - [`settings`]: Configuration management and validation
 //! - [`streaming_replacer`]: Streaming URL replacement for large responses
-//! - [`ec`]: Edge Cookie (EC) ID generation using HMAC
+//! - [`edge_cookie`]: Edge Cookie (EC) ID generation using HMAC
 //! - [`test_support`]: Testing utilities and mocks
 //! - [`why`]: Debugging and introspection utilities
 
diff --git a/crates/common/src/openrtb.rs b/crates/common/src/openrtb.rs
index fc8f390c..04c46d30 100644
--- a/crates/common/src/openrtb.rs
+++ b/crates/common/src/openrtb.rs
@@ -49,6 +49,10 @@ pub struct UserExt {
     /// Gated by TCF Purpose 1 (storage) and Purpose 4 (personalized ads).
     #[serde(skip_serializing_if = "Option::is_none")]
     pub eids: Option<Vec<Eid>>,
+    /// Whether this EC ID was freshly generated for this request.
+    ///
+    /// **Breaking change:** this wire field was previously named `synthetic_fresh`.
+    /// Downstream PBS modules or analytics reading the old name must be updated.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub ec_fresh: Option<String>,
 }
diff --git a/crates/common/src/publisher.rs b/crates/common/src/publisher.rs
index 5b6787c5..d46b931c 100644
--- a/crates/common/src/publisher.rs
+++ b/crates/common/src/publisher.rs
@@ -3,7 +3,7 @@ use fastly::http::{header, StatusCode};
 use fastly::{Body, Request, Response};
 
 use crate::backend::BackendConfig;
-use crate::consent::{allows_ssc_creation, build_consent_context, ConsentPipelineInput};
+use crate::consent::{allows_ec_creation, build_consent_context, ConsentPipelineInput};
 use crate::constants::{COOKIE_TS_EC, HEADER_X_COMPRESS_HINT, HEADER_X_TS_EC};
 use crate::cookies::{expire_ec_cookie, handle_request_cookies, set_ec_cookie};
 use crate::edge_cookie::get_or_generate_ec_id;
@@ -264,7 +264,7 @@ pub fn handle_publisher_request(
         geo: geo.as_ref(),
         ec_id: Some(ec_id.as_str()),
     });
-    let ec_allowed = allows_ssc_creation(&consent_context);
+    let ec_allowed = allows_ec_creation(&consent_context);
     log::debug!("Proxy EC ID: {}, ec_allowed: {}", ec_id, ec_allowed,);
 
     let backend_name = BackendConfig::from_url(
diff --git a/crates/integration-tests/Cargo.lock b/crates/integration-tests/Cargo.lock
index 8c4edd8c..9b98a638 100644
--- a/crates/integration-tests/Cargo.lock
+++ b/crates/integration-tests/Cargo.lock
@@ -50,9 +50,9 @@ dependencies = [
 
 [[package]]
 name = "anstyle"
-version = "1.0.13"
+version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5192cca8006f1fd4f7237516f40fa183bb07f8fbdfedaa0036de5ea9b0b45e78"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
 
 [[package]]
 name = "anstyle-parse"
@@ -308,9 +308,9 @@ checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
 
 [[package]]
 name = "cc"
-version = "1.2.56"
+version = "1.2.57"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aebf35691d1bfb0ac386a69bac2fde4dd276fb618cf8bf4f5318fe285e821bb2"
+checksum = "7a0dd1ca384932ff3641c8718a02769f1698e7563dc6974ffd03346116310423"
 dependencies = [
  "find-msvc-tools",
  "shlex",
@@ -336,9 +336,18 @@ dependencies = [
 
 [[package]]
 name = "colorchoice"
-version = "1.0.4"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
+[[package]]
+name = "convert_case"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
+checksum = "633458d4ef8c78b72454de2d54fd6ab2e60f9e02be22f3c6104cdc8a4e0fceb9"
+dependencies = [
+ "unicode-segmentation",
+]
 
 [[package]]
 name = "core-foundation"
@@ -391,9 +400,9 @@ dependencies = [
 
 [[package]]
 name = "darling"
-version = "0.21.3"
+version = "0.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cdf337090841a411e2a7f3deb9187445851f91b309c0c0a29e05f74a00a48c0"
+checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d"
 dependencies = [
  "darling_core",
  "darling_macro",
@@ -401,11 +410,10 @@ dependencies = [
 
 [[package]]
 name = "darling_core"
-version = "0.21.3"
+version = "0.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1247195ecd7e3c85f83c8d2a366e4210d588e802133e1e355180a9870b517ea4"
+checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0"
 dependencies = [
- "fnv",
  "ident_case",
  "proc-macro2",
  "quote",
@@ -415,9 +423,9 @@ dependencies = [
 
 [[package]]
 name = "darling_macro"
-version = "0.21.3"
+version = "0.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d38308df82d1080de0afee5d069fa14b0326a88c14f15c5ccda35b4a6c414c81"
+checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
 dependencies = [
  "darling_core",
  "quote",
@@ -447,21 +455,23 @@ dependencies = [
 
 [[package]]
 name = "derive_more"
-version = "2.0.1"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "093242cf7570c207c83073cf82f79706fe7b8317e98620a47d5be7c3d8497678"
+checksum = "d751e9e49156b02b44f9c1815bcb94b984cdcc4396ecc32521c739452808b134"
 dependencies = [
  "derive_more-impl",
 ]
 
 [[package]]
 name = "derive_more-impl"
-version = "2.0.1"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bda628edc44c4bb645fbe0f758797143e4e07926f7ebf4e9bdfbd3d2ce621df3"
+checksum = "799a97264921d8623a957f6c3b9011f3b5492f557bbb7a5a19b7fa6d06ba8dcb"
 dependencies = [
+ "convert_case",
  "proc-macro2",
  "quote",
+ "rustc_version",
  "syn",
  "unicode-xid",
 ]
@@ -1207,7 +1217,7 @@ dependencies = [
 name = "integration-tests"
 version = "0.1.0"
 dependencies = [
- "derive_more 2.0.1",
+ "derive_more 2.1.1",
  "env_logger",
  "error-stack",
  "log",
@@ -1503,9 +1513,9 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.21.3"
+version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
 [[package]]
 name = "once_cell_polyfill"
@@ -1515,9 +1525,9 @@ checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
 
 [[package]]
 name = "openssl"
-version = "0.10.75"
+version = "0.10.76"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08838db121398ad17ab8531ce9de97b244589089e290a384c900cb9ff7434328"
+checksum = "951c002c75e16ea2c65b8c7e4d3d51d5530d8dfa7d060b4776828c88cfb18ecf"
 dependencies = [
  "bitflags",
  "cfg-if",
@@ -1547,9 +1557,9 @@ checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.111"
+version = "0.9.112"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82cab2d520aa75e3c58898289429321eb788c3106963d0dc886ec7a5f4adc321"
+checksum = "57d55af3b3e226502be1526dfdba67ab0e9c96fc293004e79576b2b9edb0dbdb"
 dependencies = [
  "cc",
  "libc",
@@ -1715,9 +1725,9 @@ checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
 
 [[package]]
 name = "portable-atomic-util"
-version = "0.2.5"
+version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a9db96d7fa8782dd8c15ce32ffe8680bbd1e978a43bf51a34d39483540495f5"
+checksum = "091397be61a01d4be58e7841595bd4bfedb15f1cd54977d79b8271e94ed799a3"
 dependencies = [
  "portable-atomic",
 ]
@@ -2258,9 +2268,9 @@ dependencies = [
 
 [[package]]
 name = "serde_with"
-version = "3.17.0"
+version = "3.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "381b283ce7bc6b476d903296fb59d0d36633652b633b27f64db4fb46dcbfc3b9"
+checksum = "dd5414fad8e6907dbdd5bc441a50ae8d6e26151a03b1de04d89a5576de61d01f"
 dependencies = [
  "base64 0.22.1",
  "chrono",
@@ -2277,9 +2287,9 @@ dependencies = [
 
 [[package]]
 name = "serde_with_macros"
-version = "3.17.0"
+version = "3.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6d4e30573c8cb306ed6ab1dca8423eec9a463ea0e155f45399455e0368b27e0"
+checksum = "d3db8978e608f1fe7357e211969fd9abdcae80bac1ba7a3369bb7eb6b404eb65"
 dependencies = [
  "darling",
  "proc-macro2",
@@ -2774,6 +2784,12 @@ version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
+[[package]]
+name = "unicode-segmentation"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
+
 [[package]]
 name = "unicode-width"
 version = "0.2.2"
diff --git a/docs/guide/first-party-proxy.md b/docs/guide/first-party-proxy.md
index 0a2e144c..6108d321 100644
--- a/docs/guide/first-party-proxy.md
+++ b/docs/guide/first-party-proxy.md
@@ -106,7 +106,7 @@ GET /first-party/click?tsurl=https://advertiser.com/landing&tstoken=signature
    - Whether parameters were present
    - Full reconstructed URL
    - Referer, User-Agent
-    - EC ID (if available)
+   - EC ID (if available)
 
 **Example**:
 
diff --git a/docs/guide/onboarding.md b/docs/guide/onboarding.md
index d7be8d31..37e67b8d 100644
--- a/docs/guide/onboarding.md
+++ b/docs/guide/onboarding.md
@@ -40,7 +40,7 @@ Welcome to the Trusted Server project! This guide keeps internal onboarding note
 | `crates/fastly/src/main.rs`                  | Request routing entry point      |
 | `crates/common/src/publisher.rs`             | Publisher origin handling        |
 | `crates/common/src/proxy.rs`                 | First-party proxy implementation |
-| `crates/common/src/edge_cookie.rs`            | EC ID generation                 |
+| `crates/common/src/edge_cookie.rs`           | EC ID generation                 |
 | `crates/common/src/integrations/registry.rs` | Integration module pattern       |
 | `trusted-server.toml`                        | Application configuration        |
 
diff --git a/docs/guide/testing.md b/docs/guide/testing.md
index 3fe1c36e..bec625cb 100644
--- a/docs/guide/testing.md
+++ b/docs/guide/testing.md
@@ -323,7 +323,6 @@ k6 run load-test.js
 5. **Use test helpers** - `create_test_settings()`, `create_test_request()`
 6. **Assert specific values** - Not just `assert!(result.is_ok())`
 
-
 ## Next Steps
 
 - Review [Architecture](/guide/architecture) for system design

From bfaa8a6d3d6b8d1c69d6eb972c3cd57aa51bcb83 Mon Sep 17 00:00:00 2001
From: Christian <christianpavilonis@outlook.com>
Date: Wed, 18 Mar 2026 14:46:15 -0500
Subject: [PATCH 3/5] =?UTF-8?q?Fix=20integration=20test=20env=20var=20SYNT?=
 =?UTF-8?q?HETIC=20=E2=86=92=20EC=20and=20remaining=20stale=20references?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Rename TRUSTED_SERVER__SYNTHETIC__SECRET_KEY to TRUSTED_SERVER__EC__SECRET_KEY
  in CI action and local integration test scripts (root cause of CI failure:
  Viceroy could not start without the EC secret key)
- Update stale doc reference synthetic.secret_key → ec.secret_key
- Update stale comments in consent_config.rs and consent/types.rs
---
 .github/actions/setup-integration-test-env/action.yml | 2 +-
 crates/common/src/consent/types.rs                    | 2 +-
 crates/common/src/consent_config.rs                   | 2 +-
 docs/guide/configuration.md                           | 2 +-
 scripts/integration-tests-browser.sh                  | 2 +-
 scripts/integration-tests.sh                          | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/actions/setup-integration-test-env/action.yml b/.github/actions/setup-integration-test-env/action.yml
index b7656a8f..87900edc 100644
--- a/.github/actions/setup-integration-test-env/action.yml
+++ b/.github/actions/setup-integration-test-env/action.yml
@@ -71,7 +71,7 @@ runs:
       env:
         TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:${{ inputs.origin-port }}
         TRUSTED_SERVER__PUBLISHER__PROXY_SECRET: integration-test-proxy-secret
-        TRUSTED_SERVER__SYNTHETIC__SECRET_KEY: integration-test-secret-key
+        TRUSTED_SERVER__EC__SECRET_KEY: integration-test-secret-key
         TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
       run: cargo build --bin trusted-server-fastly --release --target wasm32-wasip1
 
diff --git a/crates/common/src/consent/types.rs b/crates/common/src/consent/types.rs
index c289cfe7..a68eda9a 100644
--- a/crates/common/src/consent/types.rs
+++ b/crates/common/src/consent/types.rs
@@ -377,7 +377,7 @@ impl fmt::Display for UsPrivacy {
 pub enum ConsentSource {
     /// Read from cookies on the incoming request.
     Cookie,
-    /// Loaded from KV store via `SyntheticID` lookup.
+    /// Loaded from KV store via Edge Cookie (EC) ID lookup.
     KvStore,
     /// Applied from explicit publisher policy defaults.
     PolicyDefault,
diff --git a/crates/common/src/consent_config.rs b/crates/common/src/consent_config.rs
index 34f66020..e2074c48 100644
--- a/crates/common/src/consent_config.rs
+++ b/crates/common/src/consent_config.rs
@@ -75,7 +75,7 @@ pub struct ConsentConfig {
 
     /// Name of the KV Store used for consent persistence.
     ///
-    /// When set, consent data is persisted per Synthetic ID so that
+    /// When set, consent data is persisted per Edge Cookie (EC) ID so that
     /// returning users without consent cookies can still have their
     /// consent preferences applied. Set to `None` to disable.
     #[serde(default, skip_serializing_if = "Option::is_none")]
diff --git a/docs/guide/configuration.md b/docs/guide/configuration.md
index c61b6865..ff0e5a32 100644
--- a/docs/guide/configuration.md
+++ b/docs/guide/configuration.md
@@ -990,7 +990,7 @@ trusted-server.dev.toml      # Development overrides
 
 **"Configuration field '...' is set to a known placeholder value"**:
 
-- `synthetic.secret_key` cannot be `"secret-key"`, `"secret_key"`, or `"trusted-server"` (case-insensitive)
+- `ec.secret_key` cannot be `"secret-key"`, `"secret_key"`, or `"trusted-server"` (case-insensitive)
 - `publisher.proxy_secret` cannot be `"change-me-proxy-secret"` (case-insensitive)
 - Must be non-empty
 - Change to a secure random value (see generation commands above)
diff --git a/scripts/integration-tests-browser.sh b/scripts/integration-tests-browser.sh
index 900a305a..d0fedd63 100755
--- a/scripts/integration-tests-browser.sh
+++ b/scripts/integration-tests-browser.sh
@@ -32,7 +32,7 @@ echo "==> Validating shared integration-test dependency versions..."
 echo "==> Building WASM binary (origin=http://127.0.0.1:$ORIGIN_PORT)..."
 TRUSTED_SERVER__PUBLISHER__ORIGIN_URL="http://127.0.0.1:$ORIGIN_PORT" \
 TRUSTED_SERVER__PUBLISHER__PROXY_SECRET="integration-test-proxy-secret" \
-TRUSTED_SERVER__SYNTHETIC__SECRET_KEY="integration-test-secret-key" \
+TRUSTED_SERVER__EC__SECRET_KEY="integration-test-secret-key" \
 TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK=false \
     cargo build --bin trusted-server-fastly --release --target wasm32-wasip1
 
diff --git a/scripts/integration-tests.sh b/scripts/integration-tests.sh
index 566521f7..01077ba3 100755
--- a/scripts/integration-tests.sh
+++ b/scripts/integration-tests.sh
@@ -53,7 +53,7 @@ fi
 echo "==> Building WASM binary (origin=http://127.0.0.1:$ORIGIN_PORT)..."
 TRUSTED_SERVER__PUBLISHER__ORIGIN_URL="http://127.0.0.1:$ORIGIN_PORT" \
 TRUSTED_SERVER__PUBLISHER__PROXY_SECRET="integration-test-proxy-secret" \
-TRUSTED_SERVER__SYNTHETIC__SECRET_KEY="integration-test-secret-key" \
+TRUSTED_SERVER__EC__SECRET_KEY="integration-test-secret-key" \
 TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK=false \
     cargo build --bin trusted-server-fastly --release --target wasm32-wasip1
 

From 1183ef085a4f403653f74251ed3910dfedf1770b Mon Sep 17 00:00:00 2001
From: Christian <christianpavilonis@outlook.com>
Date: Wed, 18 Mar 2026 14:54:11 -0500
Subject: [PATCH 4/5] =?UTF-8?q?Rename=20config=20section=20[ec]=20?=
 =?UTF-8?q?=E2=86=92=20[edge=5Fcookie]=20for=20clarity?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Rename struct Ec → EdgeCookie, field settings.ec → settings.edge_cookie
- Add serde alias "ec" for backward compatibility with existing configs
- Update all TOML configs, env vars, CI actions, scripts, and docs
- TRUSTED_SERVER__EC__* env vars → TRUSTED_SERVER__EDGE_COOKIE__*
- Validation messages now reference edge_cookie.secret_key
---
 .../setup-integration-test-env/action.yml     |  2 +-
 crates/common/src/edge_cookie.rs              |  6 ++--
 .../src/integrations/google_tag_manager.rs    |  4 +--
 crates/common/src/integrations/prebid.rs      |  2 +-
 crates/common/src/settings.rs                 | 34 +++++++++----------
 crates/common/src/settings_data.rs            |  8 ++---
 crates/common/src/test_support.rs             |  2 +-
 docs/guide/configuration.md                   | 22 ++++++------
 docs/guide/error-reference.md                 |  4 +--
 scripts/integration-tests-browser.sh          |  2 +-
 scripts/integration-tests.sh                  |  2 +-
 trusted-server.toml                           |  2 +-
 12 files changed, 45 insertions(+), 45 deletions(-)

diff --git a/.github/actions/setup-integration-test-env/action.yml b/.github/actions/setup-integration-test-env/action.yml
index 87900edc..a6a92031 100644
--- a/.github/actions/setup-integration-test-env/action.yml
+++ b/.github/actions/setup-integration-test-env/action.yml
@@ -71,7 +71,7 @@ runs:
       env:
         TRUSTED_SERVER__PUBLISHER__ORIGIN_URL: http://127.0.0.1:${{ inputs.origin-port }}
         TRUSTED_SERVER__PUBLISHER__PROXY_SECRET: integration-test-proxy-secret
-        TRUSTED_SERVER__EC__SECRET_KEY: integration-test-secret-key
+        TRUSTED_SERVER__EDGE_COOKIE__SECRET_KEY: integration-test-secret-key
         TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK: "false"
       run: cargo build --bin trusted-server-fastly --release --target wasm32-wasip1
 
diff --git a/crates/common/src/edge_cookie.rs b/crates/common/src/edge_cookie.rs
index 8f669528..e963bbf3 100644
--- a/crates/common/src/edge_cookie.rs
+++ b/crates/common/src/edge_cookie.rs
@@ -78,10 +78,10 @@ pub fn generate_ec_id(
 
     log::debug!("Input for fresh EC ID: client_ip={}", client_ip);
 
-    let mut mac = HmacSha256::new_from_slice(settings.ec.secret_key.expose().as_bytes())
+    let mut mac = HmacSha256::new_from_slice(settings.edge_cookie.secret_key.expose().as_bytes())
         .change_context(TrustedServerError::Ec {
-            message: "Failed to create HMAC instance".to_string(),
-        })?;
+        message: "Failed to create HMAC instance".to_string(),
+    })?;
     mac.update(client_ip.as_bytes());
     let hmac_hash = hex::encode(mac.finalize().into_bytes());
 
diff --git a/crates/common/src/integrations/google_tag_manager.rs b/crates/common/src/integrations/google_tag_manager.rs
index 2f6f338e..3857545a 100644
--- a/crates/common/src/integrations/google_tag_manager.rs
+++ b/crates/common/src/integrations/google_tag_manager.rs
@@ -1308,7 +1308,7 @@ cookie_domain = ".test-publisher.com"
 origin_url = "https://origin.test-publisher.com"
 proxy_secret = "test-secret"
 
-[ec]
+[edge_cookie]
 counter_store = "test-counter-store"
 opid_store = "test-opid-store"
 secret_key = "test-secret-key"
@@ -1343,7 +1343,7 @@ cookie_domain = ".test-publisher.com"
 origin_url = "https://origin.test-publisher.com"
 proxy_secret = "test-secret"
 
-[ec]
+[edge_cookie]
 counter_store = "test-counter-store"
 opid_store = "test-opid-store"
 secret_key = "test-secret-key"
diff --git a/crates/common/src/integrations/prebid.rs b/crates/common/src/integrations/prebid.rs
index 0c37c786..45901469 100644
--- a/crates/common/src/integrations/prebid.rs
+++ b/crates/common/src/integrations/prebid.rs
@@ -1412,7 +1412,7 @@ cookie_domain = ".test-publisher.com"
 origin_url = "https://origin.test-publisher.com"
 proxy_secret = "test-secret"
 
-[ec]
+[edge_cookie]
 counter_store = "test-counter-store"
 opid_store = "test-opid-store"
 secret_key = "test-secret-key"
diff --git a/crates/common/src/settings.rs b/crates/common/src/settings.rs
index 0ca69fc5..7036b6f8 100644
--- a/crates/common/src/settings.rs
+++ b/crates/common/src/settings.rs
@@ -191,17 +191,17 @@ impl DerefMut for IntegrationSettings {
     }
 }
 
-/// Edge Cookie (EC) configuration.
+/// Edge Cookie configuration.
 #[allow(unused)]
 #[derive(Debug, Default, Clone, Deserialize, Serialize, Validate)]
-pub struct Ec {
+pub struct EdgeCookie {
     pub counter_store: String,
     pub opid_store: String,
-    #[validate(custom(function = Ec::validate_secret_key))]
+    #[validate(custom(function = EdgeCookie::validate_secret_key))]
     pub secret_key: Redacted<String>,
 }
 
-impl Ec {
+impl EdgeCookie {
     /// Known placeholder values that must not be used in production.
     pub const SECRET_KEY_PLACEHOLDERS: &[&str] = &["secret-key", "secret_key", "trusted-server"];
 
@@ -330,9 +330,9 @@ impl Default for Proxy {
 pub struct Settings {
     #[validate(nested)]
     pub publisher: Publisher,
-    #[serde(default)]
+    #[serde(default, alias = "ec")]
     #[validate(nested)]
-    pub ec: Ec,
+    pub edge_cookie: EdgeCookie,
     #[serde(default)]
     pub integrations: IntegrationSettings,
     #[serde(default, deserialize_with = "vec_from_seq_or_map")]
@@ -428,8 +428,8 @@ impl Settings {
     pub fn reject_placeholder_secrets(&self) -> Result<(), Report<TrustedServerError>> {
         let mut insecure_fields: Vec<&str> = Vec::new();
 
-        if Ec::is_placeholder_secret_key(self.ec.secret_key.expose()) {
-            insecure_fields.push("ec.secret_key");
+        if EdgeCookie::is_placeholder_secret_key(self.edge_cookie.secret_key.expose()) {
+            insecure_fields.push("edge_cookie.secret_key");
         }
         if Publisher::is_placeholder_proxy_secret(self.publisher.proxy_secret.expose()) {
             insecure_fields.push("publisher.proxy_secret");
@@ -706,9 +706,9 @@ mod tests {
             settings.publisher.origin_url,
             "https://origin.test-publisher.com"
         );
-        assert_eq!(settings.ec.counter_store, "test-counter-store");
-        assert_eq!(settings.ec.opid_store, "test-opid-store");
-        assert_eq!(settings.ec.secret_key.expose(), "test-secret-key");
+        assert_eq!(settings.edge_cookie.counter_store, "test-counter-store");
+        assert_eq!(settings.edge_cookie.opid_store, "test-opid-store");
+        assert_eq!(settings.edge_cookie.secret_key.expose(), "test-secret-key");
 
         settings.validate().expect("Failed to validate settings");
     }
@@ -744,9 +744,9 @@ mod tests {
 
     #[test]
     fn is_placeholder_secret_key_rejects_all_known_placeholders() {
-        for placeholder in Ec::SECRET_KEY_PLACEHOLDERS {
+        for placeholder in EdgeCookie::SECRET_KEY_PLACEHOLDERS {
             assert!(
-                Ec::is_placeholder_secret_key(placeholder),
+                EdgeCookie::is_placeholder_secret_key(placeholder),
                 "should detect placeholder secret_key '{placeholder}'"
             );
         }
@@ -755,11 +755,11 @@ mod tests {
     #[test]
     fn is_placeholder_secret_key_is_case_insensitive() {
         assert!(
-            Ec::is_placeholder_secret_key("SECRET-KEY"),
+            EdgeCookie::is_placeholder_secret_key("SECRET-KEY"),
             "should detect case-insensitive placeholder secret_key"
         );
         assert!(
-            Ec::is_placeholder_secret_key("Trusted-Server"),
+            EdgeCookie::is_placeholder_secret_key("Trusted-Server"),
             "should detect mixed-case placeholder secret_key"
         );
     }
@@ -767,7 +767,7 @@ mod tests {
     #[test]
     fn is_placeholder_secret_key_accepts_non_placeholder() {
         assert!(
-            !Ec::is_placeholder_secret_key("test-secret-key"),
+            !EdgeCookie::is_placeholder_secret_key("test-secret-key"),
             "should accept non-placeholder secret_key"
         );
     }
@@ -1384,7 +1384,7 @@ mod tests {
             origin_url = "https://origin.test-publisher.com"
             proxy_secret = "unit-test-proxy-secret"
 
-            [ec]
+            [edge_cookie]
             counter_store = "test-counter-store"
             opid_store = "test-opid-store"
             secret_key = "test-secret-key"
diff --git a/crates/common/src/settings_data.rs b/crates/common/src/settings_data.rs
index 094f6c4c..0901d8a7 100644
--- a/crates/common/src/settings_data.rs
+++ b/crates/common/src/settings_data.rs
@@ -88,8 +88,8 @@ mod tests {
             .expect_err("should reject placeholder secret_key");
         let root = err.current_context();
         assert!(
-            matches!(root, TrustedServerError::InsecureDefault { field } if field.contains("ec.secret_key")),
-            "error should mention ec.secret_key, got: {root}"
+            matches!(root, TrustedServerError::InsecureDefault { field } if field.contains("edge_cookie.secret_key")),
+            "error should mention edge_cookie.secret_key, got: {root}"
         );
     }
 
@@ -118,8 +118,8 @@ mod tests {
         match root {
             TrustedServerError::InsecureDefault { field } => {
                 assert!(
-                    field.contains("ec.secret_key"),
-                    "error should mention ec.secret_key, got: {field}"
+                    field.contains("edge_cookie.secret_key"),
+                    "error should mention edge_cookie.secret_key, got: {field}"
                 );
                 assert!(
                     field.contains("publisher.proxy_secret"),
diff --git a/crates/common/src/test_support.rs b/crates/common/src/test_support.rs
index 2d29ec77..de5382b8 100644
--- a/crates/common/src/test_support.rs
+++ b/crates/common/src/test_support.rs
@@ -30,7 +30,7 @@ pub mod tests {
             enabled = false
             rewrite_attributes = ["href", "link", "url"]
 
-            [ec]
+            [edge_cookie]
             counter_store = "test-counter-store"
             opid_store = "test-opid-store"
             secret_key = "test-secret-key"
diff --git a/docs/guide/configuration.md b/docs/guide/configuration.md
index ff0e5a32..a5502566 100644
--- a/docs/guide/configuration.md
+++ b/docs/guide/configuration.md
@@ -23,7 +23,7 @@ cookie_domain = ".publisher.com"
 origin_url = "https://origin.publisher.com"
 proxy_secret = "your-secure-secret-here"
 
-[ec]
+[edge_cookie]
 counter_store = "counter_store"
 opid_store = "opid_store"
 secret_key = "your-hmac-secret"
@@ -39,7 +39,7 @@ at runtime.
 # Format: TRUSTED_SERVER__SECTION__FIELD
 export TRUSTED_SERVER__PUBLISHER__DOMAIN=publisher.com
 export TRUSTED_SERVER__PUBLISHER__ORIGIN_URL=https://origin.publisher.com
-export TRUSTED_SERVER__EC__SECRET_KEY=your-secret
+export TRUSTED_SERVER__EDGE_COOKIE__SECRET_KEY=your-secret
 ```
 
 ### Generate Secure Secrets
@@ -62,7 +62,7 @@ openssl rand -base64 32
 | Section             | Purpose                                      |
 | ------------------- | -------------------------------------------- |
 | `[publisher]`       | Domain, origin, proxy settings               |
-| `[ec]`              | Edge Cookie (EC) ID generation               |
+| `[edge_cookie]`     | Edge Cookie (EC) ID generation               |
 | `[request_signing]` | Ed25519 request signing                      |
 | `[auction]`         | Auction orchestration                        |
 | `[integrations.*]`  | Partner integrations (Prebid, Next.js, etc.) |
@@ -76,7 +76,7 @@ cookie_domain = ".publisher.com"
 origin_url = "https://origin.publisher.com"
 proxy_secret = "change-me-to-secure-value"
 
-[ec]
+[edge_cookie]
 counter_store = "counter_store"
 opid_store = "opid_store"
 secret_key = "your-hmac-secret-key"
@@ -269,7 +269,7 @@ Changing `proxy_secret` invalidates all existing signed URLs. Plan rotations car
 
 Settings for generating privacy-preserving Edge Cookie identifiers.
 
-### `[ec]`
+### `[edge_cookie]`
 
 | Field           | Type   | Required | Description                                    |
 | --------------- | ------ | -------- | ---------------------------------------------- |
@@ -280,7 +280,7 @@ Settings for generating privacy-preserving Edge Cookie identifiers.
 **Example**:
 
 ```toml
-[ec]
+[edge_cookie]
 counter_store = "counter_store"
 opid_store = "opid_store"
 secret_key = "your-secure-hmac-secret"
@@ -289,9 +289,9 @@ secret_key = "your-secure-hmac-secret"
 **Environment Override**:
 
 ```bash
-TRUSTED_SERVER__EC__COUNTER_STORE=counter_store
-TRUSTED_SERVER__EC__OPID_STORE=opid_store
-TRUSTED_SERVER__EC__SECRET_KEY=your-secret
+TRUSTED_SERVER__EDGE_COOKIE__COUNTER_STORE=counter_store
+TRUSTED_SERVER__EDGE_COOKIE__OPID_STORE=opid_store
+TRUSTED_SERVER__EDGE_COOKIE__SECRET_KEY=your-secret
 ```
 
 ### Field Details
@@ -936,7 +936,7 @@ TRUSTED_SERVER__PUBLISHER__PROXY_SECRET=$(cat /run/secrets/proxy_secret_staging)
 ```bash
 # All secrets from environment
 TRUSTED_SERVER__PUBLISHER__PROXY_SECRET=$(cat /run/secrets/proxy_secret)
-TRUSTED_SERVER__EC__SECRET_KEY=$(cat /run/secrets/ec_secret)
+TRUSTED_SERVER__EDGE_COOKIE__SECRET_KEY=$(cat /run/secrets/ec_secret)
 TRUSTED_SERVER__HANDLERS__0__PASSWORD=$(cat /run/secrets/admin_password)
 ```
 
@@ -990,7 +990,7 @@ trusted-server.dev.toml      # Development overrides
 
 **"Configuration field '...' is set to a known placeholder value"**:
 
-- `ec.secret_key` cannot be `"secret-key"`, `"secret_key"`, or `"trusted-server"` (case-insensitive)
+- `edge_cookie.secret_key` cannot be `"secret-key"`, `"secret_key"`, or `"trusted-server"` (case-insensitive)
 - `publisher.proxy_secret` cannot be `"change-me-proxy-secret"` (case-insensitive)
 - Must be non-empty
 - Change to a secure random value (see generation commands above)
diff --git a/docs/guide/error-reference.md b/docs/guide/error-reference.md
index dc7b434a..fec3ce23 100644
--- a/docs/guide/error-reference.md
+++ b/docs/guide/error-reference.md
@@ -69,7 +69,7 @@ proxy_secret = "change-me-to-random-string"
 - `publisher.domain`
 - `publisher.origin_url`
 - `publisher.proxy_secret`
-- `ec.secret_key`
+- `edge_cookie.secret_key`
 
 ---
 
@@ -146,7 +146,7 @@ Failed to generate EC ID: KV store not available
 3. Update `trusted-server.toml`:
 
 ```toml
-[ec]
+[edge_cookie]
 counter_store = "counter_store"  # Must match Fastly KV store name
 opid_store = "opid_store"
 ```
diff --git a/scripts/integration-tests-browser.sh b/scripts/integration-tests-browser.sh
index d0fedd63..a5f860ef 100755
--- a/scripts/integration-tests-browser.sh
+++ b/scripts/integration-tests-browser.sh
@@ -32,7 +32,7 @@ echo "==> Validating shared integration-test dependency versions..."
 echo "==> Building WASM binary (origin=http://127.0.0.1:$ORIGIN_PORT)..."
 TRUSTED_SERVER__PUBLISHER__ORIGIN_URL="http://127.0.0.1:$ORIGIN_PORT" \
 TRUSTED_SERVER__PUBLISHER__PROXY_SECRET="integration-test-proxy-secret" \
-TRUSTED_SERVER__EC__SECRET_KEY="integration-test-secret-key" \
+TRUSTED_SERVER__EDGE_COOKIE__SECRET_KEY="integration-test-secret-key" \
 TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK=false \
     cargo build --bin trusted-server-fastly --release --target wasm32-wasip1
 
diff --git a/scripts/integration-tests.sh b/scripts/integration-tests.sh
index 01077ba3..11158b2b 100755
--- a/scripts/integration-tests.sh
+++ b/scripts/integration-tests.sh
@@ -53,7 +53,7 @@ fi
 echo "==> Building WASM binary (origin=http://127.0.0.1:$ORIGIN_PORT)..."
 TRUSTED_SERVER__PUBLISHER__ORIGIN_URL="http://127.0.0.1:$ORIGIN_PORT" \
 TRUSTED_SERVER__PUBLISHER__PROXY_SECRET="integration-test-proxy-secret" \
-TRUSTED_SERVER__EC__SECRET_KEY="integration-test-secret-key" \
+TRUSTED_SERVER__EDGE_COOKIE__SECRET_KEY="integration-test-secret-key" \
 TRUSTED_SERVER__PROXY__CERTIFICATE_CHECK=false \
     cargo build --bin trusted-server-fastly --release --target wasm32-wasip1
 
diff --git a/trusted-server.toml b/trusted-server.toml
index ccfa8397..8a13d409 100644
--- a/trusted-server.toml
+++ b/trusted-server.toml
@@ -14,7 +14,7 @@ cookie_domain = ".test-publisher.com"
 origin_url = "https://origin.test-publisher.com"
 proxy_secret = "change-me-proxy-secret"
 
-[ec]
+[edge_cookie]
 counter_store = "counter_store"
 opid_store = "opid_store"
 secret_key = "trusted-server"

From 3d65decda90fd05449f6172ed6f206956755495d Mon Sep 17 00:00:00 2001
From: Christian <christianpavilonis@outlook.com>
Date: Wed, 18 Mar 2026 15:11:14 -0500
Subject: [PATCH 5/5] Remove unnecessary serde alias for edge_cookie config
 section

---
 crates/common/src/settings.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crates/common/src/settings.rs b/crates/common/src/settings.rs
index 7036b6f8..7726cd1e 100644
--- a/crates/common/src/settings.rs
+++ b/crates/common/src/settings.rs
@@ -330,7 +330,7 @@ impl Default for Proxy {
 pub struct Settings {
     #[validate(nested)]
     pub publisher: Publisher,
-    #[serde(default, alias = "ec")]
+    #[serde(default)]
     #[validate(nested)]
     pub edge_cookie: EdgeCookie,
     #[serde(default)]