@mindful-web/marko-web-identity-x 1.79.6 → 1.79.8

package/CLAUDE.md

@@ -105,7 +105,55 @@ conflict-guarded; non-fatal via `config.get('onHookError')`) → `impersonateApp
 `onAuthenticationSuccess`, same order/hooks as email-link so Omeda rapid-identify + subscription
 sync run identically. `profile-gate` computes `requiresUserInput` by checking required fields are
 non-empty (deliberately not `forceProfileReVerification`). Responds `{ ok, requiresUserInput,
-redirectTo, user, entity, … }`; the client redirects to `/user/profile` when input is required.
+redirectTo, user, entity, additionalEventData, … }`; the client redirects to `/user/profile` when
+input is required.
+
+**`additionalEventData` and the auto-signup union.** Tenant Omeda formatters *assign*
+`additionalEventData.autoSignups` in place, and that object is the only channel by which the browser
+learns a subscription was created (see analytics below). Where they assign it varies, and three
+repos do it twice:
+
+| Writes `autoSignups` in | Repos |
+| --- | --- |
+| `onLoginLinkSentFormatter` only | ab-media, allured, encore360, pmmi |
+| `onAuthenticationSuccessFormatter` only | fusable, cox-matthews |
+| **Both** | industrial (both pkgs), ironmarkets, watt |
+
+So the route gives **each hook its own object** and merges the two afterwards, taking the union of
+`autoSignups` deduped by `productId`. Sharing one reference (the obvious move, and what
+`routes/authenticate.js` does — it only ever calls one hook) would let the second hook's assignment
+clobber the first, silently dropping a whole set of subscribe events on the both-hook repos. In the
+email-link flow those hooks fire on **separate requests** (login vs authenticate) and each reports
+its own set, so the union is what preserves existing behaviour. Do **not** "simplify" this back to a
+shared object.
+
+`requiresUserInput` goes to `onAuthenticationSuccess` **only**: the onLoginLinkSent formatters read a
+truthy value as "skip the Omeda subscription lookup" and then opt the user into every configured
+deployment type without deduping, firing a phantom auto-signup for an existing Omeda customer who
+merely lacks an idx required field. The email-link flow never exposes it there either —
+`routes/login.js` 400s before any hook runs.
+
+`idxAutoSignupCount` rides on the transaction attributes so "sign-in worked, Omeda updated, GA4
+recorded nothing" — the exact shape of the July 2026 bug — is a visible number rather than something
+a stakeholder finds in a report weeks later.
+
+**Analytics parity (`components/google-init.marko`).** The Vue flows get `dataLayer` + p1events for
+free from the EventBus bridge in `browser/index.js`; the One-Tap callback is plain inline JS on a
+`<script>` tag, so it has to emit the same events by hand. Three things it must keep in step with
+`browser/authenticate.vue` + `browser/mixins/*`:
+- **`identity-x-authenticated`** — payload mirrors `global-event-emitter.js`, which sets
+  `actionSource`, `loginSource` **and** `source` to the same value. GTM variables in the wild read
+  whichever one they were written against; emitting only `actionSource` silently breaks the rest.
+- **`identity-x-auto-signup`** — one event per `additionalEventData.autoSignups` entry, shape
+  `{ entity, ...autoSignup, event }` per `global-auto-signup-event-emitter.js`. **This — not
+  `identity-x-authenticated` — is what the sites' GA4 "subscribe" conversion triggers on.** The
+  Omeda opt-in happens server-side either way, so a missing event here looks like "One Tap doesn't
+  subscribe anyone" when the subscription exists and only the tracking is gone. Also mirrored to
+  p1events as `Subscription / Subscribe`.
+- **Navigation is deferred ~300ms** after the pushes. The email-link flow navigates in the same tick
+  but does so from a fully-loaded `/user/authenticate`; One Tap can resolve far earlier in a page's
+  life, before GTM has dispatched. `window.dataLayer` is also **assigned, not guarded** (`= … || []`)
+  so a sign-in that beats a deferred container still queues its events instead of dropping them.
 
 **Tags** (`components/marko.json`, config read from `req.identityX.config`):
 - `<marko-web-identity-x-google-init>` — loads the GSI client + defines `window.handleGoogleOneTapCredential`;
@@ -119,6 +167,35 @@ login/authenticate pages get the button with **no per-site edit**. For the site-
 document layout, gated on `!req.identityX.token`. The button tag can also be placed in a content
 meter / gate.
 
+**Telemetry.** Two seams. Neither needs site configuration:
+- `config.addRequestAttributes` — called with a flat object as the route progresses
+  (`idxGoogleStep`, `idxUserId`, `idxCreatedNewUser`, `idxRequiresUserInput`, `idxGoogleSurface`,
+  `idxGoogleMissingFieldsBehavior`, `idxAutoSignupCount`). **Defaults to `utils/add-custom-attributes.js`**, which tags
+  the current New Relic transaction, so the attributes ride on the `Transaction` *and* any
+  `TransactionError` it produces — a 500 says which step failed instead of being a bare GraphQL
+  message. That default resolves the agent **only if the app already loaded it** (checks
+  `require.cache`, never requires it cold — requiring `newrelic` would *start* an agent on sites
+  that don't use it), so it arrives fleet-wide on a dep bump and is inert everywhere else. Pass a
+  function to override, or a no-op to disable. Deliberately **not** `noticeError`: that records a
+  second error next to the one the error handler already captures and doubles the counts.
+- `config.onHookError` — non-fatal errors, now called as `(error, customAttributes)` to match
+  `newrelic.noticeError`. The Google `sub` linkage failures report through it with their step and
+  user id, which keeps them distinguishable from fatal errors on the same route (they arrive on a
+  200).
+
+Client-side, `fail()` fires a p1events `Identity / Authenticate Failed` event mirroring the success
+event. There is no New Relic Browser agent on the monorail sites, so without it a client-side
+failure reaches no backend at all. The originating surface (`button` | `prompt`, from GIS
+`select_by`) is posted to the route as `body.surface` — both surfaces otherwise share a route, a
+`loginSource` and an impersonation method, so nothing server-side could tell them apart.
+
+**Failure handling.** All client-side failures funnel through `fail()` in `google-init.marko`: it
+always `console.error`s, writes to `#google-sign-in-error` when that element is on the page (it is
+rendered by `google-sign-in-button.marko`, so it exists only where the button does), and otherwise
+— the site-wide floating prompt case — redirects to the login endpoint with `?redirectTo=`. Never
+let a failure be a silent no-op: GIS closes the prompt on its own, so the user reads "nothing
+happened" as success and only discovers they're anonymous on the next page load.
+
 **CSS.** `.google-sign-in` styles ship in `marko-web-theme-monorail/scss/components/_identity-x.scss`
 (with the rest of the auth CSS) — no separate import.
 

package/components/access.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/access.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.8/components/access.marko",
     marko_component = require("./access.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -53,7 +53,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/access.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.8/components/access.marko",
     component: "./access.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/comment-stream.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/comment-stream.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.8/components/comment-stream.marko",
     marko_component = require("./comment-stream.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -91,7 +91,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/comment-stream.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.8/components/comment-stream.marko",
     component: "./comment-stream.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/context.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/context.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.8/components/context.marko",
     marko_component = require("./context.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_dynamicTag = require("marko/dist/runtime/helpers/dynamic-tag"),
@@ -49,7 +49,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/context.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.8/components/context.marko",
     component: "./context.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/form-access.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/form-access.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.8/components/form-access.marko",
     marko_component = require("./form-access.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_defaultValue = require("@mindful-web/marko-core/utils/default-value"),
@@ -179,7 +179,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/form-access.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.8/components/form-access.marko",
     component: "./form-access.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-authenticate.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/form-authenticate.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.8/components/form-authenticate.marko",
     marko_component = require("./form-authenticate.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -81,7 +81,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/form-authenticate.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.8/components/form-authenticate.marko",
     component: "./form-authenticate.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-change-email.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/form-change-email.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.8/components/form-change-email.marko",
     marko_component = require("./form-change-email.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -59,7 +59,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/form-change-email.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.8/components/form-change-email.marko",
     component: "./form-change-email.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-login.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/form-login.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.8/components/form-login.marko",
     marko_component = require("./form-login.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -92,7 +92,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/form-login.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.8/components/form-login.marko",
     component: "./form-login.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-logout.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/form-logout.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.8/components/form-logout.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_defaultValue = require("@mindful-web/marko-core/utils/default-value"),
     defaultValue = module_defaultValue.default || module_defaultValue,
@@ -29,7 +29,7 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/form-logout.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.8/components/form-logout.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko"
     ]

package/components/form-profile.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/form-profile.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.8/components/form-profile.marko",
     marko_component = require("./form-profile.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -84,7 +84,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/form-profile.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.8/components/form-profile.marko",
     component: "./form-profile.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-register.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/form-register.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.8/components/form-register.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_assign = require("marko/dist/runtime/helpers/assign"),
     marko_web_identity_x_form_login_template = require("./form-login.marko"),
@@ -25,7 +25,7 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/form-register.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.8/components/form-register.marko",
     tags: [
       "./form-login.marko"
     ]

package/components/google-init.marko

@@ -2,6 +2,7 @@ $ const { req } = out.global;
 $ const config = req.identityX && req.identityX.config;
 $ const { clientId, autoPrompt } = config ? config.getAsObject('googleAuth') : {};
 $ const callbackName = 'handleGoogleOneTapCredential';
+$ const loginUrl = config ? config.getEndpointFor('login') : '/user/login';
 $ const initScript = `
 (function() {
   window.${callbackName} = function(response) {
@@ -12,24 +13,97 @@ $ const initScript = `
     // GIS 'select_by' distinguishes the surface: a 'btn*' value means the
     // rendered "Sign in with Google" button, 'user*'/'auto' means the One-Tap
     // prompt. Used to label the p1events authentication event accordingly.
-    var eventLabel = String(response.select_by || '').indexOf('btn') === 0
-      ? 'Google Sign In'
-      : 'Google One Tap';
+    var isButton = String(response.select_by || '').indexOf('btn') === 0;
+    var eventLabel = isButton ? 'Google Sign In' : 'Google One Tap';
+
+    // Every failure path routes through here. The site-wide floating One-Tap
+    // prompt renders outside any form, so there is no '#google-sign-in-error'
+    // element on the page — previously that meant a failed sign-in did nothing
+    // at all: GIS closed the prompt, the user assumed success, and only found
+    // out they were still anonymous on the next page load. Always log, and
+    // fall back to the login page when there's nowhere to show the message.
+    var authenticated = false;
+    function fail(message, detail) {
+      if (window.console && window.console.error) {
+        window.console.error('[identity-x google-auth] ' + message, detail);
+      }
+      // There is no New Relic Browser agent on these sites, so a client-side
+      // failure reaches no backend at all unless we send one. p1events is
+      // already on every page -- mirror the success event so failed sign-ins
+      // are countable next to successful ones rather than invisible.
+      if (window.p1events) {
+        window.p1events('track', {
+          category: 'Identity',
+          action: 'Authenticate Failed',
+          label: eventLabel,
+          props: {
+            actionSource: 'google-one-tap',
+            surface: isButton ? 'button' : 'prompt',
+            message: message,
+            status: detail && detail.status ? detail.status : null,
+          },
+        });
+      }
+      // The session cookie is already set — a throw in the post-success
+      // analytics/redirect code must not bounce an authenticated user to login.
+      if (authenticated) return;
+      if (errorEl) {
+        errorEl.textContent = message;
+        errorEl.style.display = 'block';
+        return;
+      }
+      var returnTo = window.location.pathname + window.location.search;
+      window.location.href = ${JSON.stringify(loginUrl)} + '?redirectTo=' + encodeURIComponent(returnTo);
+    }
 
     fetch('/__idx/google', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ credential: response.credential, redirectTo: redirectTo }),
+      body: JSON.stringify({
+        credential: response.credential,
+        redirectTo: redirectTo,
+        // Lets the server tag its telemetry with the originating surface --
+        // both post here and are otherwise indistinguishable server-side.
+        surface: isButton ? 'button' : 'prompt',
+      }),
     })
-      .then(function(res) { return res.json(); })
-      .then(function(data) {
+      // Parse defensively: a 5xx from the idx router returns
+      // { error, status, message } (no 'ok'), and an upstream proxy can return
+      // HTML that would otherwise blow up res.json() into the generic catch.
+      .then(function(res) {
+        return res.text().then(function(text) {
+          var parsed = {};
+          try { parsed = JSON.parse(text); } catch (e) { /* non-JSON response */ }
+          return { status: res.status, redirected: res.redirected, url: res.url, data: parsed };
+        });
+      })
+      .then(function(result) {
+        var data = result.data;
         if (!data.ok) {
-          if (errorEl) {
-            errorEl.textContent = data.error || 'Google sign-in failed. Please try again.';
-            errorEl.style.display = 'block';
+          // A 301/302 on this POST (host canonicalization — apex -> www, or
+          // http -> https) is re-issued by the browser as a GET with the body
+          // dropped. The idx router only registers POST /__idx/google, so the
+          // redirected request falls through to a 404 and the sign-in is lost.
+          // Call that out by name rather than reporting a generic failure.
+          if (result.redirected) {
+            fail(
+              'Google sign-in failed: the request was redirected to ' + result.url
+                + ', which turns it into a GET and drops the credential. '
+                + 'Serve this page from the canonical host.',
+              { status: result.status }
+            );
+            return;
           }
+          fail(
+            data.error || data.message || 'Google sign-in failed. Please try again.',
+            { status: result.status }
+          );
           return;
         }
+        authenticated = true;
+        var eventData = data.additionalEventData || {};
+        var autoSignups = eventData.autoSignups || [];
+
         if (window.p1events) {
           // De-anonymize the session to the app user, then record the
           // authentication — mirrors the identity-x conversion events.
@@ -40,36 +114,92 @@ $ const initScript = `
             label: eventLabel,
             props: { idxEntity: data.entity, actionSource: 'google-one-tap' },
           });
+          // One 'Subscription / Subscribe' event per newsletter the server
+          // opted this user into, matching what browser/index.js emits for the
+          // 'identity-x-auto-signup' bus event in the email-link flow.
+          for (var pi = 0; pi < autoSignups.length; pi += 1) {
+            window.p1events('track', {
+              category: 'Subscription',
+              action: 'Subscribe',
+              props: {
+                idxEntity: data.entity,
+                actionSource: autoSignups[pi].actionSource || data.loginSource,
+                subscriptionEntity: autoSignups[pi].subscriptionEntity,
+              },
+            });
+          }
         }
-        // Push to dataLayer for GTM/GA4 integration, matching the shape
-        // produced by the standard email-link authenticate flow so existing
-        // GTM triggers/variables pick it up. The actionSource value
-        // ('google-one-tap') can be used to populate subscription_source
-        // or other conversion metadata in GA4.
-        if (window.dataLayer) {
-          window.dataLayer.push({
+
+        // Push to dataLayer for GTM/GA4. Assign rather than guard: GTM can be
+        // deferred behind the script loader, and a One-Tap sign-in that lands
+        // before the container initializes would otherwise drop its events
+        // silently. Pushing into a plain array is safe — GTM replays whatever
+        // is already there when it loads.
+        window.dataLayer = window.dataLayer || [];
+
+        // Mirror the payload the standard email-link authenticate flow builds
+        // (browser/authenticate.vue + mixins/global-event-emitter.js) so GTM
+        // triggers and dataLayer variables resolve identically. That flow sets
+        // actionSource, loginSource AND source to the same value; a variable
+        // reading any one of the three has to work here too.
+        var idxAuthPayload = {
+          event: 'identity-x-authenticated',
+          'identity-x': {
             event: 'identity-x-authenticated',
-            'identity-x': {
-              event: 'identity-x-authenticated',
-              id: data.user.id,
-              email: data.user.email,
-              entity: data.entity,
-              actionSource: data.loginSource,
-            },
+            ok: true,
+            applicationId: data.applicationId,
+            user: data.user,
+            id: data.user.id,
+            email: data.user.email,
+            verifiedCount: data.user.verifiedCount,
+            entity: data.entity,
+            requiresUserInput: data.requiresUserInput,
+            createdNewUser: eventData.createdNewUser,
+            additionalEventData: eventData,
+            actionSource: data.loginSource,
+            loginSource: data.loginSource,
+            source: data.loginSource,
+          },
+        };
+        window.dataLayer.push(idxAuthPayload);
+
+        // The 'subscribe' conversion keys off 'identity-x-auto-signup', not
+        // 'identity-x-authenticated' — one event per newsletter product the
+        // Omeda hook subscribed the user to. Shape matches
+        // mixins/global-auto-signup-event-emitter.js -> browser/index.js:
+        // { entity, ...autoSignup, event }.
+        for (var i = 0; i < autoSignups.length; i += 1) {
+          var signupData = { entity: data.entity };
+          var autoSignup = autoSignups[i];
+          for (var key in autoSignup) {
+            if (Object.prototype.hasOwnProperty.call(autoSignup, key)) {
+              signupData[key] = autoSignup[key];
+            }
+          }
+          signupData.event = 'identity-x-auto-signup';
+          window.dataLayer.push({
+            event: 'identity-x-auto-signup',
+            'identity-x': signupData,
           });
         }
+
+        var href;
         if (data.requiresUserInput) {
           var destination = data.redirectTo || window.location.pathname;
-          window.location.href = '/user/profile?returnTo=' + encodeURIComponent(destination);
+          href = '/user/profile?returnTo=' + encodeURIComponent(destination);
         } else {
-          window.location.href = data.redirectTo || window.location.href;
+          href = data.redirectTo || window.location.href;
         }
+        // Give GTM a moment to dispatch the tags above before tearing down the
+        // document. The email-link flow navigates in the same tick, but it does
+        // so from /user/authenticate after a full page load, where the container
+        // is long since warm; a One-Tap sign-in can resolve much earlier in a
+        // page's life. A short delay is imperceptible next to the sign-in
+        // round-trip and cheaper than losing the conversion.
+        window.setTimeout(function() { window.location.href = href; }, 300);
       })
-      .catch(function() {
-        if (errorEl) {
-          errorEl.textContent = 'An error occurred during Google sign-in. Please try again.';
-          errorEl.style.display = 'block';
-        }
+      .catch(function(e) {
+        fail('An error occurred during Google sign-in. Please try again.', e);
       });
   };
 })();

package/components/google-init.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/google-init.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.8/components/google-init.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_attr = require("marko/dist/runtime/html/helpers/attr"),
     marko_str = require("marko/dist/runtime/helpers/to-string");
@@ -18,6 +18,8 @@ function render(input, out, __component, component, state) {
 
   const callbackName = 'handleGoogleOneTapCredential';
 
+  const loginUrl = config ? config.getEndpointFor('login') : '/user/login';
+
   const initScript = `
 (function() {
   window.${callbackName} = function(response) {
@@ -28,24 +30,97 @@ function render(input, out, __component, component, state) {
     // GIS 'select_by' distinguishes the surface: a 'btn*' value means the
     // rendered "Sign in with Google" button, 'user*'/'auto' means the One-Tap
     // prompt. Used to label the p1events authentication event accordingly.
-    var eventLabel = String(response.select_by || '').indexOf('btn') === 0
-      ? 'Google Sign In'
-      : 'Google One Tap';
+    var isButton = String(response.select_by || '').indexOf('btn') === 0;
+    var eventLabel = isButton ? 'Google Sign In' : 'Google One Tap';
+
+    // Every failure path routes through here. The site-wide floating One-Tap
+    // prompt renders outside any form, so there is no '#google-sign-in-error'
+    // element on the page — previously that meant a failed sign-in did nothing
+    // at all: GIS closed the prompt, the user assumed success, and only found
+    // out they were still anonymous on the next page load. Always log, and
+    // fall back to the login page when there's nowhere to show the message.
+    var authenticated = false;
+    function fail(message, detail) {
+      if (window.console && window.console.error) {
+        window.console.error('[identity-x google-auth] ' + message, detail);
+      }
+      // There is no New Relic Browser agent on these sites, so a client-side
+      // failure reaches no backend at all unless we send one. p1events is
+      // already on every page -- mirror the success event so failed sign-ins
+      // are countable next to successful ones rather than invisible.
+      if (window.p1events) {
+        window.p1events('track', {
+          category: 'Identity',
+          action: 'Authenticate Failed',
+          label: eventLabel,
+          props: {
+            actionSource: 'google-one-tap',
+            surface: isButton ? 'button' : 'prompt',
+            message: message,
+            status: detail && detail.status ? detail.status : null,
+          },
+        });
+      }
+      // The session cookie is already set — a throw in the post-success
+      // analytics/redirect code must not bounce an authenticated user to login.
+      if (authenticated) return;
+      if (errorEl) {
+        errorEl.textContent = message;
+        errorEl.style.display = 'block';
+        return;
+      }
+      var returnTo = window.location.pathname + window.location.search;
+      window.location.href = ${JSON.stringify(loginUrl)} + '?redirectTo=' + encodeURIComponent(returnTo);
+    }
 
     fetch('/__idx/google', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ credential: response.credential, redirectTo: redirectTo }),
+      body: JSON.stringify({
+        credential: response.credential,
+        redirectTo: redirectTo,
+        // Lets the server tag its telemetry with the originating surface --
+        // both post here and are otherwise indistinguishable server-side.
+        surface: isButton ? 'button' : 'prompt',
+      }),
     })
-      .then(function(res) { return res.json(); })
-      .then(function(data) {
+      // Parse defensively: a 5xx from the idx router returns
+      // { error, status, message } (no 'ok'), and an upstream proxy can return
+      // HTML that would otherwise blow up res.json() into the generic catch.
+      .then(function(res) {
+        return res.text().then(function(text) {
+          var parsed = {};
+          try { parsed = JSON.parse(text); } catch (e) { /* non-JSON response */ }
+          return { status: res.status, redirected: res.redirected, url: res.url, data: parsed };
+        });
+      })
+      .then(function(result) {
+        var data = result.data;
         if (!data.ok) {
-          if (errorEl) {
-            errorEl.textContent = data.error || 'Google sign-in failed. Please try again.';
-            errorEl.style.display = 'block';
+          // A 301/302 on this POST (host canonicalization — apex -> www, or
+          // http -> https) is re-issued by the browser as a GET with the body
+          // dropped. The idx router only registers POST /__idx/google, so the
+          // redirected request falls through to a 404 and the sign-in is lost.
+          // Call that out by name rather than reporting a generic failure.
+          if (result.redirected) {
+            fail(
+              'Google sign-in failed: the request was redirected to ' + result.url
+                + ', which turns it into a GET and drops the credential. '
+                + 'Serve this page from the canonical host.',
+              { status: result.status }
+            );
+            return;
           }
+          fail(
+            data.error || data.message || 'Google sign-in failed. Please try again.',
+            { status: result.status }
+          );
           return;
         }
+        authenticated = true;
+        var eventData = data.additionalEventData || {};
+        var autoSignups = eventData.autoSignups || [];
+
         if (window.p1events) {
           // De-anonymize the session to the app user, then record the
           // authentication — mirrors the identity-x conversion events.
@@ -56,36 +131,92 @@ function render(input, out, __component, component, state) {
             label: eventLabel,
             props: { idxEntity: data.entity, actionSource: 'google-one-tap' },
           });
+          // One 'Subscription / Subscribe' event per newsletter the server
+          // opted this user into, matching what browser/index.js emits for the
+          // 'identity-x-auto-signup' bus event in the email-link flow.
+          for (var pi = 0; pi < autoSignups.length; pi += 1) {
+            window.p1events('track', {
+              category: 'Subscription',
+              action: 'Subscribe',
+              props: {
+                idxEntity: data.entity,
+                actionSource: autoSignups[pi].actionSource || data.loginSource,
+                subscriptionEntity: autoSignups[pi].subscriptionEntity,
+              },
+            });
+          }
         }
-        // Push to dataLayer for GTM/GA4 integration, matching the shape
-        // produced by the standard email-link authenticate flow so existing
-        // GTM triggers/variables pick it up. The actionSource value
-        // ('google-one-tap') can be used to populate subscription_source
-        // or other conversion metadata in GA4.
-        if (window.dataLayer) {
-          window.dataLayer.push({
+
+        // Push to dataLayer for GTM/GA4. Assign rather than guard: GTM can be
+        // deferred behind the script loader, and a One-Tap sign-in that lands
+        // before the container initializes would otherwise drop its events
+        // silently. Pushing into a plain array is safe — GTM replays whatever
+        // is already there when it loads.
+        window.dataLayer = window.dataLayer || [];
+
+        // Mirror the payload the standard email-link authenticate flow builds
+        // (browser/authenticate.vue + mixins/global-event-emitter.js) so GTM
+        // triggers and dataLayer variables resolve identically. That flow sets
+        // actionSource, loginSource AND source to the same value; a variable
+        // reading any one of the three has to work here too.
+        var idxAuthPayload = {
+          event: 'identity-x-authenticated',
+          'identity-x': {
             event: 'identity-x-authenticated',
-            'identity-x': {
-              event: 'identity-x-authenticated',
-              id: data.user.id,
-              email: data.user.email,
-              entity: data.entity,
-              actionSource: data.loginSource,
-            },
+            ok: true,
+            applicationId: data.applicationId,
+            user: data.user,
+            id: data.user.id,
+            email: data.user.email,
+            verifiedCount: data.user.verifiedCount,
+            entity: data.entity,
+            requiresUserInput: data.requiresUserInput,
+            createdNewUser: eventData.createdNewUser,
+            additionalEventData: eventData,
+            actionSource: data.loginSource,
+            loginSource: data.loginSource,
+            source: data.loginSource,
+          },
+        };
+        window.dataLayer.push(idxAuthPayload);
+
+        // The 'subscribe' conversion keys off 'identity-x-auto-signup', not
+        // 'identity-x-authenticated' — one event per newsletter product the
+        // Omeda hook subscribed the user to. Shape matches
+        // mixins/global-auto-signup-event-emitter.js -> browser/index.js:
+        // { entity, ...autoSignup, event }.
+        for (var i = 0; i < autoSignups.length; i += 1) {
+          var signupData = { entity: data.entity };
+          var autoSignup = autoSignups[i];
+          for (var key in autoSignup) {
+            if (Object.prototype.hasOwnProperty.call(autoSignup, key)) {
+              signupData[key] = autoSignup[key];
+            }
+          }
+          signupData.event = 'identity-x-auto-signup';
+          window.dataLayer.push({
+            event: 'identity-x-auto-signup',
+            'identity-x': signupData,
           });
         }
+
+        var href;
         if (data.requiresUserInput) {
           var destination = data.redirectTo || window.location.pathname;
-          window.location.href = '/user/profile?returnTo=' + encodeURIComponent(destination);
+          href = '/user/profile?returnTo=' + encodeURIComponent(destination);
         } else {
-          window.location.href = data.redirectTo || window.location.href;
+          href = data.redirectTo || window.location.href;
         }
+        // Give GTM a moment to dispatch the tags above before tearing down the
+        // document. The email-link flow navigates in the same tick, but it does
+        // so from /user/authenticate after a full page load, where the container
+        // is long since warm; a One-Tap sign-in can resolve much earlier in a
+        // page's life. A short delay is imperceptible next to the sign-in
+        // round-trip and cheaper than losing the conversion.
+        window.setTimeout(function() { window.location.href = href; }, 300);
       })
-      .catch(function() {
-        if (errorEl) {
-          errorEl.textContent = 'An error occurred during Google sign-in. Please try again.';
-          errorEl.style.display = 'block';
-        }
+      .catch(function(e) {
+        fail('An error occurred during Google sign-in. Please try again.', e);
       });
   };
 })();
@@ -108,5 +239,5 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/google-init.marko"
+    id: "/@mindful-web/marko-web-identity-x$1.79.8/components/google-init.marko"
   };

package/components/google-sign-in-button.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/google-sign-in-button.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.8/components/google-sign-in-button.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     helpers_escape_xml = require("marko/dist/runtime/html/helpers/escape-xml"),
     marko_escapeXml = helpers_escape_xml.x,
@@ -40,5 +40,5 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/google-sign-in-button.marko"
+    id: "/@mindful-web/marko-web-identity-x$1.79.8/components/google-sign-in-button.marko"
   };

package/components/identify.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/identify.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.8/components/identify.marko",
     marko_component = require("./identify.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -50,7 +50,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/identify.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.8/components/identify.marko",
     component: "./identify.marko",
     tags: [
       "@mindful-web/marko-web-gtm/components/push.marko",

package/components/non-auth-identify.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/non-auth-identify.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.8/components/non-auth-identify.marko",
     marko_component = require("./non-auth-identify.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_dynamicTag = require("marko/dist/runtime/helpers/dynamic-tag"),
@@ -45,7 +45,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/non-auth-identify.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.8/components/non-auth-identify.marko",
     component: "./non-auth-identify.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/subscribe.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.6/components/subscribe.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.8/components/subscribe.marko",
     marko_component = require("./subscribe.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -73,7 +73,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.6/components/subscribe.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.8/components/subscribe.marko",
     component: "./subscribe.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/config.js

@@ -1,6 +1,7 @@
 const { get, getAsArray, getAsObject } = require('@mindful-web/object-path');
 const { isFunction: isFn } = require('@mindful-web/utils');
 const validHooks = require('./hooks');
+const defaultAddRequestAttributes = require('./utils/add-custom-attributes');
 
 const { log } = console;
 
@@ -15,7 +16,17 @@ class IdentityXConfiguration {
    * @param {string[]} [options.requiredCreateFieldRows] Required fields, when creating a new user.
    * @param {string[]} [options.activeCustomFieldIds] Limit displayed custom fields, if present.
    * @param {string[]} [options.hiddenFields] The fields to hide from the profile.
-   * @param {function} [options.onHookError]
+   * @param {function} [options.onHookError] Reporter for non-fatal errors. Called as
+   *   `(error, customAttributes)` — matches `newrelic.noticeError`.
+   * @param {function} [options.addRequestAttributes] Sink for per-request telemetry,
+   *   called with a flat object of primitives. **Defaults to tagging the current New
+   *   Relic transaction** when the app has already loaded the agent (every marko-web
+   *   site does, at boot) — so the attributes ride on both the `Transaction` and any
+   *   `TransactionError` it produces, and a 500 arrives already saying which step
+   *   failed and for whom. No site configuration required; inert without New Relic.
+   *   Deliberately not `noticeError` — that would record a second error alongside the
+   *   one the error handler already captures, and double the counts. Pass your own
+   *   function to override, or a no-op to disable.
    * @param {object} [options.googleAuth] Google Sign-In config. When `clientId` is
    *   set, the One-Tap prompt / "Sign in with Google" button render in the auth
    *   templates and `POST /__idx/google` accepts credentials. Dormant otherwise.
@@ -40,6 +51,7 @@ class IdentityXConfiguration {
     gtmUserFields = {},
     googleAuth = {},
     onHookError,
+    addRequestAttributes,
     ...rest
   } = {}) {
     if (!appId) throw new Error('Unable to configure IdentityX: no Application ID was provided.');
@@ -58,13 +70,18 @@ class IdentityXConfiguration {
       booleanQuestionsLabel,
       gtmUserFields,
       googleAuth,
-      onHookError: (e) => {
+      // Extra args are forwarded so callers can pass structured context —
+      // `newrelic.noticeError(error, customAttributes)` takes it natively.
+      onHookError: (e, ...args) => {
         if (process.env.NODE_ENV === 'development') {
-          log('ERROR IN IDENTITY-X HOOK', e);
+          log('ERROR IN IDENTITY-X HOOK', e, ...args);
           if (e.networkError) log('Network Error', get(e, 'networkError.result.errors.0'));
         }
-        if (isFn(onHookError)) onHookError(e);
+        if (isFn(onHookError)) onHookError(e, ...args);
       },
+      addRequestAttributes: isFn(addRequestAttributes)
+        ? addRequestAttributes
+        : defaultAddRequestAttributes,
       ...rest,
     };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindful-web/marko-web-identity-x",
-  "version": "1.79.6",
+  "version": "1.79.8",
   "description": "Marko Wrapper for IdentityX",
   "repository": "https://github.com/parameter1/mindful-web/tree/main/packages/marko-web-identity-x",
   "author": "Josh Worden <josh@parameter1.com>",
@@ -38,5 +38,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "ffb05490d900bcdc2d3a2230c6e41da40f9f07ce"
+  "gitHead": "aafeaa99860062c3faa70b67bab0e69b49d13632"
 }

package/routes/google.js

@@ -1,6 +1,6 @@
 const gql = require('graphql-tag');
 const { OAuth2Client } = require('google-auth-library');
-const { asyncRoute } = require('@mindful-web/utils');
+const { asArray, asyncRoute } = require('@mindful-web/utils');
 const IMPERSONATE_APP_USER = require('../api/mutations/impersonate-app-user');
 const tokenCookie = require('../utils/token-cookie');
 const contextCookie = require('../utils/context-cookie');
@@ -14,6 +14,16 @@ const UPDATE_OWN_APP_USER = gql`
 
 const isEmpty = (v) => v == null || v === '';
 
+// Cache one OAuth2Client per client id. `verifyIdToken` fetches (and caches on
+// the *instance*) Google's public signing certs, so constructing a client per
+// request re-fetched them on every sign-in — turning a transient network blip
+// or rate-limit at Google into a failed sign-in.
+const oauthClients = new Map();
+const getOAuthClient = (clientId) => {
+  if (!oauthClients.has(clientId)) oauthClients.set(clientId, new OAuth2Client(clientId));
+  return oauthClients.get(clientId);
+};
+
 const LOGIN_SOURCE = 'google-one-tap';
 
 // Namespace under which the Google account id (the JWT `sub`) is stored as an
@@ -50,7 +60,21 @@ module.exports = asyncRoute(async (req, res) => {
   const { config } = identityX;
   const onError = config.get('onHookError') || defaultOnError;
 
+  // Tag the transaction as the route progresses. Whatever step is recorded when
+  // the request dies is the step that failed, so an error arrives already
+  // localized instead of being a bare GraphQL message to reverse-engineer.
+  const addAttrs = config.get('addRequestAttributes') || (() => {});
+  const setStep = (step) => addAttrs({ idxGoogleStep: step });
+
   const { clientId, missingFieldsBehavior = 'profile-gate' } = config.getAsObject('googleAuth');
+  // `surface` is the GIS `select_by` bucket ('button' | 'prompt'), sent by the
+  // client. Both surfaces share a route, a loginSource and an impersonation
+  // method, so without it there is no way to tell from the server whether the
+  // rendered button works independently of the One-Tap prompt.
+  addAttrs({
+    idxGoogleSurface: body.surface === 'button' ? 'button' : 'prompt',
+    idxGoogleMissingFieldsBehavior: missingFieldsBehavior,
+  });
 
   if (!clientId) {
     res.status(400).json({ ok: false, error: 'Google Sign-In is not configured for this site.' });
@@ -62,7 +86,8 @@ module.exports = asyncRoute(async (req, res) => {
   }
 
   // Verify the Google JWT and extract user info.
-  const oauthClient = new OAuth2Client(clientId);
+  setStep('verify-credential');
+  const oauthClient = getOAuthClient(clientId);
   const ticket = await oauthClient.verifyIdToken({ idToken: credential, audience: clientId });
   const googlePayload = ticket.getPayload();
   const {
@@ -75,11 +100,14 @@ module.exports = asyncRoute(async (req, res) => {
   if (!email) throw new Error('Google credential did not include an email address.');
 
   // Find or create the identity-x user.
+  setStep('load-app-user');
   let appUser = await identityX.loadAppUserByEmail(email);
   const createdNewUser = !appUser;
   if (!appUser) {
+    setStep('create-app-user');
     appUser = await identityX.createAppUser({ email });
   }
+  addAttrs({ idxUserId: appUser.id, idxCreatedNewUser: createdNewUser });
 
   // Persist the Google account id (the JWT `sub`) as an idx external id so the
   // user is linked to its Google identity. Email stays the primary key; this is
@@ -92,6 +120,7 @@ module.exports = asyncRoute(async (req, res) => {
       && extId.identifier.value === googleSub
     ));
     if (!alreadyLinked) {
+      setStep('link-google-sub');
       try {
         // If this sub is already attached to a different user (e.g. the Google
         // account's email changed and a new user was created under it), report
@@ -104,7 +133,7 @@ module.exports = asyncRoute(async (req, res) => {
         if (existing && existing.id !== appUser.id) {
           onError(new Error(
             `Google sub already linked to idx user ${existing.id}, not ${appUser.id}`,
-          ));
+          ), { idxGoogleStep: 'link-google-sub', idxUserId: appUser.id, idxConflictUserId: existing.id });
         } else {
           await identityX.addExternalUserId({
             userId: appUser.id,
@@ -114,11 +143,14 @@ module.exports = asyncRoute(async (req, res) => {
         }
       } catch (e) {
         // Supplementary linkage — never block authentication on a failure here.
-        onError(e);
+        // Reported with context so these stay distinguishable from fatal errors
+        // on the same route (they arrive on a 200).
+        onError(e, { idxGoogleStep: 'link-google-sub', idxUserId: appUser.id });
       }
     }
   }
 
+  setStep('impersonate-app-user');
   // Impersonate the user with verify: true — marks them as verified and returns
   // a session token, bypassing the normal email-link flow.
   const { data: impersonateData } = await identityX.client.mutate({
@@ -140,9 +172,13 @@ module.exports = asyncRoute(async (req, res) => {
 
   // Re-init the Apollo client with the user's own session token so that
   // updateOwnAppUser is authenticated as this user (not as the org admin).
-  identityX.setToken(authToken);
+  // `setToken` takes the token *string* — passing the `{ id, value }` object
+  // produced an `AppUser [object Object]` authorization header, which failed
+  // every subsequent user-authenticated call (see updateOwnAppUser below).
+  identityX.setToken(authToken.value);
 
   // Set name fields from Google as verified data if not already present.
+  setStep('update-own-app-user');
   const needsNameUpdate = !appUser.givenName || !appUser.familyName;
   if (needsNameUpdate && (givenName || familyName)) {
     const nameInput = {};
@@ -155,6 +191,7 @@ module.exports = asyncRoute(async (req, res) => {
   }
 
   // Load the refreshed user so hooks and field checks have up-to-date data.
+  setStep('load-refreshed-user');
   const user = await identityX.findUserById(appUser.id);
   const entity = await identityX.generateEntityId({ userId: appUser.id });
 
@@ -169,31 +206,96 @@ module.exports = asyncRoute(async (req, res) => {
     ];
     requiresUserInput = requiredFields.some((key) => isEmpty(user[key]));
   }
+  addAttrs({ idxRequiresUserInput: requiresUserInput });
+
+  // Tenant Omeda formatters write `autoSignups` into their `additionalEventData`
+  // in place — one entry per newsletter product they opt the user into — and
+  // that object is what goes out in the response body. It is the only channel by
+  // which the browser learns a subscription was created; without it no
+  // `identity-x-auto-signup` event reaches GTM/GA4 (the "subscribe" conversion)
+  // or p1events, and One Tap looks like it subscribes nobody even though the
+  // Omeda opt-in ran fine.
+  //
+  // Give each hook its OWN object and merge after, rather than sharing one
+  // reference, because tenants disagree about where the write lives AND several
+  // write in both places:
+  //   onLoginLinkSentFormatter only ....... ab-media, allured, encore360, pmmi
+  //   onAuthenticationSuccessFormatter only fusable, cox-matthews
+  //   BOTH ................................ industrial, ironmarkets, watt
+  // Every tenant *assigns* `autoSignups` rather than appending, so a shared
+  // reference would let the second hook clobber the first — silently dropping a
+  // whole set of subscribe events for the three both-hook repos. In the
+  // email-link flow the two hooks fire on separate requests (login vs
+  // authenticate) and each reports its own set, so the union is what preserves
+  // existing behaviour here.
+  const linkSentEventData = { createdNewUser };
 
   // Fire onLoginLinkSent before onAuthenticationSuccess so that hooks wired to
   // it (e.g. Omeda rapid-identify and subscription sync) run for Google users
   // the same way they do for email-link users.  This also populates
   // user.externalIds with the Omeda encryptedCustomerId so the subsequent
   // onAuthenticationSuccess hook can set oly_enc_id in the response.
+  setStep('hooks-login-link-sent');
   await callHooksFor(identityX, 'onLoginLinkSent', {
     req,
     source: LOGIN_SOURCE,
     user,
+    additionalEventData: linkSentEventData,
   });
 
   // Re-fetch so onAuthenticationSuccess sees the externalIds written by
   // the onLoginLinkSent hook (Omeda rapid-identify).
   const userAfterLinkSent = await identityX.findUserById(appUser.id);
 
+  // `requiresUserInput` is exposed to this hook only. The onLoginLinkSent
+  // formatters read a truthy value as "skip the Omeda subscription lookup" and
+  // then opt the user into every configured deployment type without deduping
+  // against what they already hold — a phantom auto-signup, and an inflated GA4
+  // subscribe count, for an existing Omeda customer who merely lacks an idx
+  // required field. The email-link flow never exposes it there either:
+  // `routes/login.js` 400s with `requiresUserInput` before any hook runs.
+  const authEventData = { createdNewUser, requiresUserInput };
+
+  setStep('hooks-authentication-success');
   await callHooksFor(identityX, 'onAuthenticationSuccess', {
     req,
     res,
     user: userAfterLinkSent,
     authToken,
     loginSource: LOGIN_SOURCE,
-    additionalEventData: { createdNewUser, requiresUserInput },
+    additionalEventData: authEventData,
   });
 
+  // Union of both hooks' auto-signups, deduped by product so a tenant that
+  // opts into the same newsletter from both hooks yields one subscribe event,
+  // not two.
+  const seenProducts = new Set();
+  const autoSignups = [
+    ...asArray(linkSentEventData.autoSignups),
+    ...asArray(authEventData.autoSignups),
+  ]
+    .filter((signup) => {
+      const key = signup.productId != null
+        ? `product:${signup.productId}`
+        : `entity:${signup.subscriptionEntity}`;
+      if (seenProducts.has(key)) return false;
+      seenProducts.add(key);
+      return true;
+    });
+
+  const additionalEventData = {
+    ...linkSentEventData,
+    ...authEventData,
+    ...(autoSignups.length && { autoSignups }),
+  };
+
+  // A new user with zero auto-signups is the shape this whole bug had: the
+  // sign-in succeeds, Omeda is updated, and GA4 records no conversion. Surface
+  // the count so a regression is a visible number on the transaction rather
+  // than something a stakeholder notices in a report weeks later.
+  addAttrs({ idxAutoSignupCount: autoSignups.length });
+
+  setStep('complete');
   res.json({
     ok: true,
     requiresUserInput,
@@ -201,6 +303,7 @@ module.exports = asyncRoute(async (req, res) => {
     applicationId: config.getAppId(),
     user: userAfterLinkSent,
     loginSource: LOGIN_SOURCE,
+    additionalEventData,
     entity,
   });
 });

package/service.js

@@ -355,8 +355,9 @@ class IdentityX {
   }
 
   /**
+   * Sets the active app-user token and re-inits the Apollo client with it.
    *
-   * @param {*} param0
+   * @param {String} token The token *value* (not the `{ id, value }` object).
    */
   setToken(token) {
     this.token = token;
@@ -379,7 +380,11 @@ class IdentityX {
     });
     const { token } = data.impersonateAppUser;
     tokenCookie.setTo(this.res, token.value);
-    this.setToken(token);
+    // `setToken` expects the token string (as the constructor supplies from the
+    // cookie) — passing the `{ id, value }` object here produced an
+    // `AppUser [object Object]` authorization header on the re-inited client,
+    // and left `this.token` as an object for `logoutAppUser`.
+    this.setToken(token.value);
   }
 
   async logoutAppUser() {

package/utils/add-custom-attributes.js

@@ -0,0 +1,50 @@
+/**
+ * Default sink for `config.addRequestAttributes` — tags the current New Relic
+ * transaction, with no configuration and no New Relic dependency.
+ *
+ * The agent is used **only when the application has already loaded it**. Every
+ * marko-web site requires its `newrelic.js` at boot, so by the time a request
+ * is served the module is in `require.cache` and `require('newrelic')` returns
+ * that same initialized singleton. Requiring it unconditionally would instead
+ * *start* an agent on sites that don't use New Relic, which is why this checks
+ * the cache rather than just try/catching the require.
+ *
+ * Net effect: attributes appear fleet-wide on a dependency bump alone, and the
+ * whole thing is inert on any site without New Relic. A site can still pass its
+ * own `addRequestAttributes` to override.
+ */
+
+let resolvedPath;
+let lookupFailed = false;
+let agent = null;
+
+const getAgent = () => {
+  if (agent) return agent;
+  if (lookupFailed) return null;
+  if (!resolvedPath) {
+    try {
+      resolvedPath = require.resolve('newrelic');
+    } catch (e) {
+      // Not installed — nothing to report to.
+      lookupFailed = true;
+      return null;
+    }
+  }
+  // `newrelic` is intentionally NOT a dependency of this package: declaring it
+  // would install it on every monorail site, and requiring an uninitialized
+  // agent starts one. We only ever pick up an instance the host app already
+  // created, which is why the cache check above guards this require.
+  // eslint-disable-next-line global-require, import/no-extraneous-dependencies
+  if (require.cache[resolvedPath]) agent = require('newrelic');
+  return agent;
+};
+
+module.exports = (attributes) => {
+  const nr = getAgent();
+  if (!nr || typeof nr.addCustomAttributes !== 'function') return;
+  try {
+    nr.addCustomAttributes(attributes);
+  } catch (e) {
+    // Telemetry must never break a request.
+  }
+};