@mindful-web/marko-web-identity-x 1.79.7 → 1.79.9

package/CLAUDE.md

@@ -105,7 +105,55 @@ conflict-guarded; non-fatal via `config.get('onHookError')`) → `impersonateApp
 `onAuthenticationSuccess`, same order/hooks as email-link so Omeda rapid-identify + subscription
 sync run identically. `profile-gate` computes `requiresUserInput` by checking required fields are
 non-empty (deliberately not `forceProfileReVerification`). Responds `{ ok, requiresUserInput,
-redirectTo, user, entity, … }`; the client redirects to `/user/profile` when input is required.
+redirectTo, user, entity, additionalEventData, … }`; the client redirects to `/user/profile` when
+input is required.
+
+**`additionalEventData` and the auto-signup union.** Tenant Omeda formatters *assign*
+`additionalEventData.autoSignups` in place, and that object is the only channel by which the browser
+learns a subscription was created (see analytics below). Where they assign it varies, and three
+repos do it twice:
+
+| Writes `autoSignups` in | Repos |
+| --- | --- |
+| `onLoginLinkSentFormatter` only | ab-media, allured, encore360, pmmi |
+| `onAuthenticationSuccessFormatter` only | fusable, cox-matthews |
+| **Both** | industrial (both pkgs), ironmarkets, watt |
+
+So the route gives **each hook its own object** and merges the two afterwards, taking the union of
+`autoSignups` deduped by `productId`. Sharing one reference (the obvious move, and what
+`routes/authenticate.js` does — it only ever calls one hook) would let the second hook's assignment
+clobber the first, silently dropping a whole set of subscribe events on the both-hook repos. In the
+email-link flow those hooks fire on **separate requests** (login vs authenticate) and each reports
+its own set, so the union is what preserves existing behaviour. Do **not** "simplify" this back to a
+shared object.
+
+`requiresUserInput` goes to `onAuthenticationSuccess` **only**: the onLoginLinkSent formatters read a
+truthy value as "skip the Omeda subscription lookup" and then opt the user into every configured
+deployment type without deduping, firing a phantom auto-signup for an existing Omeda customer who
+merely lacks an idx required field. The email-link flow never exposes it there either —
+`routes/login.js` 400s before any hook runs.
+
+`idxAutoSignupCount` rides on the transaction attributes so "sign-in worked, Omeda updated, GA4
+recorded nothing" — the exact shape of the July 2026 bug — is a visible number rather than something
+a stakeholder finds in a report weeks later.
+
+**Analytics parity (`components/google-init.marko`).** The Vue flows get `dataLayer` + p1events for
+free from the EventBus bridge in `browser/index.js`; the One-Tap callback is plain inline JS on a
+`<script>` tag, so it has to emit the same events by hand. Three things it must keep in step with
+`browser/authenticate.vue` + `browser/mixins/*`:
+- **`identity-x-authenticated`** — payload mirrors `global-event-emitter.js`, which sets
+  `actionSource`, `loginSource` **and** `source` to the same value. GTM variables in the wild read
+  whichever one they were written against; emitting only `actionSource` silently breaks the rest.
+- **`identity-x-auto-signup`** — one event per `additionalEventData.autoSignups` entry, shape
+  `{ entity, ...autoSignup, event }` per `global-auto-signup-event-emitter.js`. **This — not
+  `identity-x-authenticated` — is what the sites' GA4 "subscribe" conversion triggers on.** The
+  Omeda opt-in happens server-side either way, so a missing event here looks like "One Tap doesn't
+  subscribe anyone" when the subscription exists and only the tracking is gone. Also mirrored to
+  p1events as `Subscription / Subscribe`.
+- **Navigation is deferred ~300ms** after the pushes. The email-link flow navigates in the same tick
+  but does so from a fully-loaded `/user/authenticate`; One Tap can resolve far earlier in a page's
+  life, before GTM has dispatched. `window.dataLayer` is also **assigned, not guarded** (`= … || []`)
+  so a sign-in that beats a deferred container still queues its events instead of dropping them.
 
 **Tags** (`components/marko.json`, config read from `req.identityX.config`):
 - `<marko-web-identity-x-google-init>` — loads the GSI client + defines `window.handleGoogleOneTapCredential`;
@@ -122,7 +170,7 @@ meter / gate.
 **Telemetry.** Two seams. Neither needs site configuration:
 - `config.addRequestAttributes` — called with a flat object as the route progresses
   (`idxGoogleStep`, `idxUserId`, `idxCreatedNewUser`, `idxRequiresUserInput`, `idxGoogleSurface`,
-  `idxGoogleMissingFieldsBehavior`). **Defaults to `utils/add-custom-attributes.js`**, which tags
+  `idxGoogleMissingFieldsBehavior`, `idxAutoSignupCount`). **Defaults to `utils/add-custom-attributes.js`**, which tags
   the current New Relic transaction, so the attributes ride on the `Transaction` *and* any
   `TransactionError` it produces — a 500 says which step failed instead of being a bare GraphQL
   message. That default resolves the agent **only if the app already loaded it** (checks

package/components/access.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/access.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/access.marko",
     marko_component = require("./access.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -53,7 +53,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/access.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/access.marko",
     component: "./access.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/comment-stream.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/comment-stream.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/comment-stream.marko",
     marko_component = require("./comment-stream.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -91,7 +91,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/comment-stream.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/comment-stream.marko",
     component: "./comment-stream.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/context.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/context.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/context.marko",
     marko_component = require("./context.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_dynamicTag = require("marko/dist/runtime/helpers/dynamic-tag"),
@@ -49,7 +49,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/context.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/context.marko",
     component: "./context.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/form-access.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/form-access.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/form-access.marko",
     marko_component = require("./form-access.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_defaultValue = require("@mindful-web/marko-core/utils/default-value"),
@@ -179,7 +179,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/form-access.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/form-access.marko",
     component: "./form-access.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-authenticate.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/form-authenticate.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/form-authenticate.marko",
     marko_component = require("./form-authenticate.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -81,7 +81,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/form-authenticate.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/form-authenticate.marko",
     component: "./form-authenticate.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-change-email.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/form-change-email.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/form-change-email.marko",
     marko_component = require("./form-change-email.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -59,7 +59,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/form-change-email.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/form-change-email.marko",
     component: "./form-change-email.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-login.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/form-login.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/form-login.marko",
     marko_component = require("./form-login.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -92,7 +92,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/form-login.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/form-login.marko",
     component: "./form-login.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-logout.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/form-logout.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/form-logout.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_defaultValue = require("@mindful-web/marko-core/utils/default-value"),
     defaultValue = module_defaultValue.default || module_defaultValue,
@@ -29,7 +29,7 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/form-logout.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/form-logout.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko"
     ]

package/components/form-profile.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/form-profile.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/form-profile.marko",
     marko_component = require("./form-profile.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -84,7 +84,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/form-profile.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/form-profile.marko",
     component: "./form-profile.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-register.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/form-register.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/form-register.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_assign = require("marko/dist/runtime/helpers/assign"),
     marko_web_identity_x_form_login_template = require("./form-login.marko"),
@@ -25,7 +25,7 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/form-register.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/form-register.marko",
     tags: [
       "./form-login.marko"
     ]

package/components/google-init.marko

@@ -101,6 +101,9 @@ $ const initScript = `
           return;
         }
         authenticated = true;
+        var eventData = data.additionalEventData || {};
+        var autoSignups = eventData.autoSignups || [];
+
         if (window.p1events) {
           // De-anonymize the session to the app user, then record the
           // authentication — mirrors the identity-x conversion events.
@@ -111,30 +114,89 @@ $ const initScript = `
             label: eventLabel,
             props: { idxEntity: data.entity, actionSource: 'google-one-tap' },
           });
+          // One 'Subscription / Subscribe' event per newsletter the server
+          // opted this user into, matching what browser/index.js emits for the
+          // 'identity-x-auto-signup' bus event in the email-link flow.
+          for (var pi = 0; pi < autoSignups.length; pi += 1) {
+            window.p1events('track', {
+              category: 'Subscription',
+              action: 'Subscribe',
+              props: {
+                idxEntity: data.entity,
+                actionSource: autoSignups[pi].actionSource || data.loginSource,
+                subscriptionEntity: autoSignups[pi].subscriptionEntity,
+              },
+            });
+          }
         }
-        // Push to dataLayer for GTM/GA4 integration, matching the shape
-        // produced by the standard email-link authenticate flow so existing
-        // GTM triggers/variables pick it up. The actionSource value
-        // ('google-one-tap') can be used to populate subscription_source
-        // or other conversion metadata in GA4.
-        if (window.dataLayer) {
-          window.dataLayer.push({
+
+        // Push to dataLayer for GTM/GA4. Assign rather than guard: GTM can be
+        // deferred behind the script loader, and a One-Tap sign-in that lands
+        // before the container initializes would otherwise drop its events
+        // silently. Pushing into a plain array is safe — GTM replays whatever
+        // is already there when it loads.
+        window.dataLayer = window.dataLayer || [];
+
+        // Mirror the payload the standard email-link authenticate flow builds
+        // (browser/authenticate.vue + mixins/global-event-emitter.js) so GTM
+        // triggers and dataLayer variables resolve identically. That flow sets
+        // actionSource, loginSource AND source to the same value; a variable
+        // reading any one of the three has to work here too.
+        var idxAuthPayload = {
+          event: 'identity-x-authenticated',
+          'identity-x': {
             event: 'identity-x-authenticated',
-            'identity-x': {
-              event: 'identity-x-authenticated',
-              id: data.user.id,
-              email: data.user.email,
-              entity: data.entity,
-              actionSource: data.loginSource,
-            },
+            ok: true,
+            applicationId: data.applicationId,
+            user: data.user,
+            id: data.user.id,
+            email: data.user.email,
+            verifiedCount: data.user.verifiedCount,
+            entity: data.entity,
+            requiresUserInput: data.requiresUserInput,
+            createdNewUser: eventData.createdNewUser,
+            additionalEventData: eventData,
+            actionSource: data.loginSource,
+            loginSource: data.loginSource,
+            source: data.loginSource,
+          },
+        };
+        window.dataLayer.push(idxAuthPayload);
+
+        // The 'subscribe' conversion keys off 'identity-x-auto-signup', not
+        // 'identity-x-authenticated' — one event per newsletter product the
+        // Omeda hook subscribed the user to. Shape matches
+        // mixins/global-auto-signup-event-emitter.js -> browser/index.js:
+        // { entity, ...autoSignup, event }.
+        for (var i = 0; i < autoSignups.length; i += 1) {
+          var signupData = { entity: data.entity };
+          var autoSignup = autoSignups[i];
+          for (var key in autoSignup) {
+            if (Object.prototype.hasOwnProperty.call(autoSignup, key)) {
+              signupData[key] = autoSignup[key];
+            }
+          }
+          signupData.event = 'identity-x-auto-signup';
+          window.dataLayer.push({
+            event: 'identity-x-auto-signup',
+            'identity-x': signupData,
           });
         }
+
+        var href;
         if (data.requiresUserInput) {
           var destination = data.redirectTo || window.location.pathname;
-          window.location.href = '/user/profile?returnTo=' + encodeURIComponent(destination);
+          href = '/user/profile?returnTo=' + encodeURIComponent(destination);
         } else {
-          window.location.href = data.redirectTo || window.location.href;
+          href = data.redirectTo || window.location.href;
         }
+        // Give GTM a moment to dispatch the tags above before tearing down the
+        // document. The email-link flow navigates in the same tick, but it does
+        // so from /user/authenticate after a full page load, where the container
+        // is long since warm; a One-Tap sign-in can resolve much earlier in a
+        // page's life. A short delay is imperceptible next to the sign-in
+        // round-trip and cheaper than losing the conversion.
+        window.setTimeout(function() { window.location.href = href; }, 300);
       })
       .catch(function(e) {
         fail('An error occurred during Google sign-in. Please try again.', e);

package/components/google-init.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/google-init.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/google-init.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_attr = require("marko/dist/runtime/html/helpers/attr"),
     marko_str = require("marko/dist/runtime/helpers/to-string");
@@ -118,6 +118,9 @@ function render(input, out, __component, component, state) {
           return;
         }
         authenticated = true;
+        var eventData = data.additionalEventData || {};
+        var autoSignups = eventData.autoSignups || [];
+
         if (window.p1events) {
           // De-anonymize the session to the app user, then record the
           // authentication — mirrors the identity-x conversion events.
@@ -128,30 +131,89 @@ function render(input, out, __component, component, state) {
             label: eventLabel,
             props: { idxEntity: data.entity, actionSource: 'google-one-tap' },
           });
+          // One 'Subscription / Subscribe' event per newsletter the server
+          // opted this user into, matching what browser/index.js emits for the
+          // 'identity-x-auto-signup' bus event in the email-link flow.
+          for (var pi = 0; pi < autoSignups.length; pi += 1) {
+            window.p1events('track', {
+              category: 'Subscription',
+              action: 'Subscribe',
+              props: {
+                idxEntity: data.entity,
+                actionSource: autoSignups[pi].actionSource || data.loginSource,
+                subscriptionEntity: autoSignups[pi].subscriptionEntity,
+              },
+            });
+          }
         }
-        // Push to dataLayer for GTM/GA4 integration, matching the shape
-        // produced by the standard email-link authenticate flow so existing
-        // GTM triggers/variables pick it up. The actionSource value
-        // ('google-one-tap') can be used to populate subscription_source
-        // or other conversion metadata in GA4.
-        if (window.dataLayer) {
-          window.dataLayer.push({
+
+        // Push to dataLayer for GTM/GA4. Assign rather than guard: GTM can be
+        // deferred behind the script loader, and a One-Tap sign-in that lands
+        // before the container initializes would otherwise drop its events
+        // silently. Pushing into a plain array is safe — GTM replays whatever
+        // is already there when it loads.
+        window.dataLayer = window.dataLayer || [];
+
+        // Mirror the payload the standard email-link authenticate flow builds
+        // (browser/authenticate.vue + mixins/global-event-emitter.js) so GTM
+        // triggers and dataLayer variables resolve identically. That flow sets
+        // actionSource, loginSource AND source to the same value; a variable
+        // reading any one of the three has to work here too.
+        var idxAuthPayload = {
+          event: 'identity-x-authenticated',
+          'identity-x': {
             event: 'identity-x-authenticated',
-            'identity-x': {
-              event: 'identity-x-authenticated',
-              id: data.user.id,
-              email: data.user.email,
-              entity: data.entity,
-              actionSource: data.loginSource,
-            },
+            ok: true,
+            applicationId: data.applicationId,
+            user: data.user,
+            id: data.user.id,
+            email: data.user.email,
+            verifiedCount: data.user.verifiedCount,
+            entity: data.entity,
+            requiresUserInput: data.requiresUserInput,
+            createdNewUser: eventData.createdNewUser,
+            additionalEventData: eventData,
+            actionSource: data.loginSource,
+            loginSource: data.loginSource,
+            source: data.loginSource,
+          },
+        };
+        window.dataLayer.push(idxAuthPayload);
+
+        // The 'subscribe' conversion keys off 'identity-x-auto-signup', not
+        // 'identity-x-authenticated' — one event per newsletter product the
+        // Omeda hook subscribed the user to. Shape matches
+        // mixins/global-auto-signup-event-emitter.js -> browser/index.js:
+        // { entity, ...autoSignup, event }.
+        for (var i = 0; i < autoSignups.length; i += 1) {
+          var signupData = { entity: data.entity };
+          var autoSignup = autoSignups[i];
+          for (var key in autoSignup) {
+            if (Object.prototype.hasOwnProperty.call(autoSignup, key)) {
+              signupData[key] = autoSignup[key];
+            }
+          }
+          signupData.event = 'identity-x-auto-signup';
+          window.dataLayer.push({
+            event: 'identity-x-auto-signup',
+            'identity-x': signupData,
           });
         }
+
+        var href;
         if (data.requiresUserInput) {
           var destination = data.redirectTo || window.location.pathname;
-          window.location.href = '/user/profile?returnTo=' + encodeURIComponent(destination);
+          href = '/user/profile?returnTo=' + encodeURIComponent(destination);
         } else {
-          window.location.href = data.redirectTo || window.location.href;
+          href = data.redirectTo || window.location.href;
         }
+        // Give GTM a moment to dispatch the tags above before tearing down the
+        // document. The email-link flow navigates in the same tick, but it does
+        // so from /user/authenticate after a full page load, where the container
+        // is long since warm; a One-Tap sign-in can resolve much earlier in a
+        // page's life. A short delay is imperceptible next to the sign-in
+        // round-trip and cheaper than losing the conversion.
+        window.setTimeout(function() { window.location.href = href; }, 300);
       })
       .catch(function(e) {
         fail('An error occurred during Google sign-in. Please try again.', e);
@@ -177,5 +239,5 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/google-init.marko"
+    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/google-init.marko"
   };

package/components/google-sign-in-button.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/google-sign-in-button.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/google-sign-in-button.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     helpers_escape_xml = require("marko/dist/runtime/html/helpers/escape-xml"),
     marko_escapeXml = helpers_escape_xml.x,
@@ -40,5 +40,5 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/google-sign-in-button.marko"
+    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/google-sign-in-button.marko"
   };

package/components/identify.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/identify.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/identify.marko",
     marko_component = require("./identify.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -50,7 +50,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/identify.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/identify.marko",
     component: "./identify.marko",
     tags: [
       "@mindful-web/marko-web-gtm/components/push.marko",

package/components/non-auth-identify.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/non-auth-identify.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/non-auth-identify.marko",
     marko_component = require("./non-auth-identify.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_dynamicTag = require("marko/dist/runtime/helpers/dynamic-tag"),
@@ -45,7 +45,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/non-auth-identify.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/non-auth-identify.marko",
     component: "./non-auth-identify.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/subscribe.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.7/components/subscribe.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/subscribe.marko",
     marko_component = require("./subscribe.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -73,7 +73,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.7/components/subscribe.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/subscribe.marko",
     component: "./subscribe.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindful-web/marko-web-identity-x",
-  "version": "1.79.7",
+  "version": "1.79.9",
   "description": "Marko Wrapper for IdentityX",
   "repository": "https://github.com/parameter1/mindful-web/tree/main/packages/marko-web-identity-x",
   "author": "Josh Worden <josh@parameter1.com>",
@@ -38,5 +38,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "cd09a3d725bbcb04b8a1ffae70164981bbe1305e"
+  "gitHead": "450cfb4efb7f30564f3230912fce04b5fc574a1a"
 }

package/routes/google.js

@@ -1,6 +1,6 @@
 const gql = require('graphql-tag');
 const { OAuth2Client } = require('google-auth-library');
-const { asyncRoute } = require('@mindful-web/utils');
+const { asArray, asyncRoute } = require('@mindful-web/utils');
 const IMPERSONATE_APP_USER = require('../api/mutations/impersonate-app-user');
 const tokenCookie = require('../utils/token-cookie');
 const contextCookie = require('../utils/context-cookie');
@@ -177,13 +177,19 @@ module.exports = asyncRoute(async (req, res) => {
   // every subsequent user-authenticated call (see updateOwnAppUser below).
   identityX.setToken(authToken.value);
 
-  // Set name fields from Google as verified data if not already present.
-  setStep('update-own-app-user');
-  const needsNameUpdate = !appUser.givenName || !appUser.familyName;
-  if (needsNameUpdate && (givenName || familyName)) {
-    const nameInput = {};
-    if (givenName && !appUser.givenName) nameInput.givenName = givenName;
-    if (familyName && !appUser.familyName) nameInput.familyName = familyName;
+  // Backfill name fields from Google as verified data — blanks only, never
+  // overwriting a value the user already has.
+  //
+  // Building the payload first and gating on it subsumes the previous
+  // `needsNameUpdate && (givenName || familyName)` guard, which was satisfiable
+  // without either field qualifying: a record holding a given name but no
+  // family name, signing in with a Google profile that returns `given_name`
+  // and no `family_name`, passed both halves and then sent `input: {}`.
+  const nameInput = {};
+  if (givenName && !appUser.givenName) nameInput.givenName = givenName;
+  if (familyName && !appUser.familyName) nameInput.familyName = familyName;
+  if (Object.keys(nameInput).length) {
+    setStep('update-own-app-user');
     await identityX.client.mutate({
       mutation: UPDATE_OWN_APP_USER,
       variables: { input: nameInput },
@@ -208,6 +214,28 @@ module.exports = asyncRoute(async (req, res) => {
   }
   addAttrs({ idxRequiresUserInput: requiresUserInput });
 
+  // Tenant Omeda formatters write `autoSignups` into their `additionalEventData`
+  // in place — one entry per newsletter product they opt the user into — and
+  // that object is what goes out in the response body. It is the only channel by
+  // which the browser learns a subscription was created; without it no
+  // `identity-x-auto-signup` event reaches GTM/GA4 (the "subscribe" conversion)
+  // or p1events, and One Tap looks like it subscribes nobody even though the
+  // Omeda opt-in ran fine.
+  //
+  // Give each hook its OWN object and merge after, rather than sharing one
+  // reference, because tenants disagree about where the write lives AND several
+  // write in both places:
+  //   onLoginLinkSentFormatter only ....... ab-media, allured, encore360, pmmi
+  //   onAuthenticationSuccessFormatter only fusable, cox-matthews
+  //   BOTH ................................ industrial, ironmarkets, watt
+  // Every tenant *assigns* `autoSignups` rather than appending, so a shared
+  // reference would let the second hook clobber the first — silently dropping a
+  // whole set of subscribe events for the three both-hook repos. In the
+  // email-link flow the two hooks fire on separate requests (login vs
+  // authenticate) and each reports its own set, so the union is what preserves
+  // existing behaviour here.
+  const linkSentEventData = { createdNewUser };
+
   // Fire onLoginLinkSent before onAuthenticationSuccess so that hooks wired to
   // it (e.g. Omeda rapid-identify and subscription sync) run for Google users
   // the same way they do for email-link users.  This also populates
@@ -218,12 +246,22 @@ module.exports = asyncRoute(async (req, res) => {
     req,
     source: LOGIN_SOURCE,
     user,
+    additionalEventData: linkSentEventData,
   });
 
   // Re-fetch so onAuthenticationSuccess sees the externalIds written by
   // the onLoginLinkSent hook (Omeda rapid-identify).
   const userAfterLinkSent = await identityX.findUserById(appUser.id);
 
+  // `requiresUserInput` is exposed to this hook only. The onLoginLinkSent
+  // formatters read a truthy value as "skip the Omeda subscription lookup" and
+  // then opt the user into every configured deployment type without deduping
+  // against what they already hold — a phantom auto-signup, and an inflated GA4
+  // subscribe count, for an existing Omeda customer who merely lacks an idx
+  // required field. The email-link flow never exposes it there either:
+  // `routes/login.js` 400s with `requiresUserInput` before any hook runs.
+  const authEventData = { createdNewUser, requiresUserInput };
+
   setStep('hooks-authentication-success');
   await callHooksFor(identityX, 'onAuthenticationSuccess', {
     req,
@@ -231,9 +269,38 @@ module.exports = asyncRoute(async (req, res) => {
     user: userAfterLinkSent,
     authToken,
     loginSource: LOGIN_SOURCE,
-    additionalEventData: { createdNewUser, requiresUserInput },
+    additionalEventData: authEventData,
   });
 
+  // Union of both hooks' auto-signups, deduped by product so a tenant that
+  // opts into the same newsletter from both hooks yields one subscribe event,
+  // not two.
+  const seenProducts = new Set();
+  const autoSignups = [
+    ...asArray(linkSentEventData.autoSignups),
+    ...asArray(authEventData.autoSignups),
+  ]
+    .filter((signup) => {
+      const key = signup.productId != null
+        ? `product:${signup.productId}`
+        : `entity:${signup.subscriptionEntity}`;
+      if (seenProducts.has(key)) return false;
+      seenProducts.add(key);
+      return true;
+    });
+
+  const additionalEventData = {
+    ...linkSentEventData,
+    ...authEventData,
+    ...(autoSignups.length && { autoSignups }),
+  };
+
+  // A new user with zero auto-signups is the shape this whole bug had: the
+  // sign-in succeeds, Omeda is updated, and GA4 records no conversion. Surface
+  // the count so a regression is a visible number on the transaction rather
+  // than something a stakeholder notices in a report weeks later.
+  addAttrs({ idxAutoSignupCount: autoSignups.length });
+
   setStep('complete');
   res.json({
     ok: true,
@@ -242,6 +309,7 @@ module.exports = asyncRoute(async (req, res) => {
     applicationId: config.getAppId(),
     user: userAfterLinkSent,
     loginSource: LOGIN_SOURCE,
+    additionalEventData,
     entity,
   });
 });