@mindful-web/marko-web-identity-x 1.79.9 → 1.80.1

package/CLAUDE.md

@@ -74,6 +74,34 @@ Server-side IdentityX GraphQL client (Apollo, idx-compat). Key methods: `loadAct
 `generateEntityId`, `sendLoginLink`, `checkContentAccess`, cookie helpers (`setToken`,
 `setIdentityCookie`, `getIdentity`). Org-scoped writes use `getOrgUserApiToken()`.
 
+**Request timeout (`utils/create-client.js`).** Every idx call is bounded at **15s** per request
+(`IDENTITYX_REQUEST_TIMEOUT_MS` to override; `linkConfig.fetchOptions.timeout` per client). This is
+not a tuning knob, it is a correctness fix — **do not remove it.** `node-fetch` v2 has no default
+timeout, so a stalled idx call previously hung the Express request forever: nothing threw, no
+response was written, no 500 was returned, and because the New Relic Node agent records
+`res.statusCode` — which defaults to **200** when nothing is ever written — the failure was logged as
+a *successful* request with no error event. It was undetectable by design.
+
+Found 2026-07 on `POST /__idx/google` (overdriveonline.com): 15 of 15 sign-ins that had just created
+the app user stalled inside the impersonation mutation at avg **53.1s**, max **60.018s** — the flat
+60s ceiling of an upstream idle timeout cutting a connection this process was still waiting on. Users
+saw a One-Tap prompt that did nothing and had to trigger it a second time; 13 of 16 never came back.
+Successful requests on the same route averaged 12.4s *total* across ~10 sequential idx calls, so a
+15s per-call budget has ample headroom. Every operation is also wrapped by
+`@mindful-web/utils` `instrumentApolloClient`, emitting a **`MindfulApiCall`** event
+(`api`, `operation`, `kind`, `ms`, `outcome` of `ok|http-error|timeout|error`) plus a named trace
+segment — a trace is the only place a call still *in flight* when its transaction dies leaves any
+record. Same treatment on the Omeda client in `marko-web-omeda/middleware/graphql-client.js`
+(20s, `OMEDA_REQUEST_TIMEOUT_MS`), which had the identical no-timeout defect and sits on the blocking
+path of authentication. To compare upstreams:
+`SELECT count(*), average(ms), percentile(ms, 95), max(ms) FROM MindfulApiCall FACET api, operation, outcome`.
+
+It wraps `client.query`/`client.mutate`, **not** `fetch` — `@parameter1/omeda-graphql-client` sets
+`fetch` *after* spreading the caller's `linkConfig`, so a wrapped transport cannot be injected from
+outside that package (`fetchOptions` does survive, which is why the timeout can be). An
+`ApolloLink(...).map()` was the other option and is worse: it only sees successful responses, so the
+slow-and-failing calls would be exactly the ones missing.
+
 ## Hooks (`hooks.js`)
 
 `onLoadActiveContext`, `onLoginLinkSent`, `onAuthenticationSuccess`, `onLogout`,
@@ -104,7 +132,47 @@ conflict-guarded; non-fatal via `config.get('onHookError')`) → `impersonateApp
 → backfill given/family name only if absent → fire `onLoginLinkSent` **then** (re-fetch)
 `onAuthenticationSuccess`, same order/hooks as email-link so Omeda rapid-identify + subscription
 sync run identically. `profile-gate` computes `requiresUserInput` by checking required fields are
-non-empty (deliberately not `forceProfileReVerification`). Responds `{ ok, requiresUserInput,
+non-empty (deliberately not `forceProfileReVerification`). The impersonation mutation is **retried
+once** on transport failures only (`idxImpersonateAttempts` records how many it took): stalls
+correlated exactly with impersonating a user created milliseconds earlier — a read-after-write race on
+the idx API — and every user who retried by hand succeeded on the second go. GraphQL validation and
+authorization errors are deliberately *not* retried; they fail identically twice and only double the
+user's wait.
+
+**`onLoginLinkSent` is force-awaited here** (`callHooksFor(..., { forceAwait: true })`), because
+everything after it depends on its side effects and `shouldAwait.onLoginLinkSent` defaults to
+**false**. That default is right for email-link and wrong for One Tap, and the difference is
+structural: email-link fires `onLoginLinkSent` on the `/login` request when the link is *sent* and
+`onAuthenticationSuccess` on a separate request minutes later, so Omeda rapid-identify has long
+finished. One Tap collapses both into one request milliseconds apart — un-awaited, rapid-identify has
+usually not yet written the `encryptedCustomerId` external id when `appendSubscriptions` looks for it,
+so it bails, writes no `autoSignups`, and **no `subscribe` conversion is ever reported**. That is the
+`idxAutoSignupCount: 0` seen on every completed One Tap sign-in on overdriveonline.com. Safe to await
+only because the Omeda client now has a request timeout.
+
+**The name backfill is non-fatal, and must stay that way.** `GoogleSignInUpdateUser`
+(`updateOwnAppUser`) is the **only** call in this route authenticated as the *user* rather than the
+org — every other one passes `context: { apiToken: getOrgUserApiToken() }` — so it is the only one
+depending on the session token minted moments earlier already being readable. Production shows it
+returning *"The provided value is not a valid token"*, while the same token value works on the very
+next request arriving from the cookie: a read-after-write race on the idx token store. Retried once
+for that reason.
+
+Non-fatal matters more than the retry. It backfills a first and last name — cosmetic — but
+`tokenCookie.setTo` has **already run**, so the user is authenticated by the time it executes.
+Throwing turned a fully successful sign-in into a 500, and the client, seeing `!data.ok`, ran `fail()`
+and redirected a *logged-in* user to `/user/login`. A missing display name must never cost someone
+their session. Failures report through `onHookError` and the route continues.
+
+`FACET idxNameBackfill` (`ok` | `retried` | `failed`) distinguishes the two bugs that share this one
+error message: if `retried` dominates it is the race; if `failed` dominates the impersonation token
+simply cannot authorize this mutation, and the fix is to stop using it — backfill before impersonation
+via `setUnverifiedAppUserData` (org-token, but writes *unverified* data, so it is a semantic change
+worth deciding deliberately).
+
+`idxGoogleStepMs` records elapsed ms at the start of each step, making the route self-profiling:
+`FACET idxGoogleStep SELECT max(idxGoogleStepMs)` shows where the ~12s on a *successful* sign-in
+goes, and a request that dies mid-flight still reports how far it got. Responds `{ ok, requiresUserInput,
 redirectTo, user, entity, additionalEventData, … }`; the client redirects to `/user/profile` when
 input is required.
 
@@ -170,7 +238,8 @@ meter / gate.
 **Telemetry.** Two seams. Neither needs site configuration:
 - `config.addRequestAttributes` — called with a flat object as the route progresses
   (`idxGoogleStep`, `idxUserId`, `idxCreatedNewUser`, `idxRequiresUserInput`, `idxGoogleSurface`,
-  `idxGoogleMissingFieldsBehavior`, `idxAutoSignupCount`). **Defaults to `utils/add-custom-attributes.js`**, which tags
+  `idxGoogleMissingFieldsBehavior`, `idxAutoSignupCount`, `idxImpersonateAttempts`,
+  `idxNameBackfill`, `idxNameBackfillAttempts`). **Defaults to `utils/add-custom-attributes.js`**, which tags
   the current New Relic transaction, so the attributes ride on the `Transaction` *and* any
   `TransactionError` it produces — a 500 says which step failed instead of being a bare GraphQL
   message. That default resolves the agent **only if the app already loaded it** (checks

package/components/access.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/access.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/access.marko",
     marko_component = require("./access.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -53,7 +53,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/access.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/access.marko",
     component: "./access.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/comment-stream.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/comment-stream.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/comment-stream.marko",
     marko_component = require("./comment-stream.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -91,7 +91,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/comment-stream.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/comment-stream.marko",
     component: "./comment-stream.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/context.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/context.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/context.marko",
     marko_component = require("./context.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_dynamicTag = require("marko/dist/runtime/helpers/dynamic-tag"),
@@ -49,7 +49,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/context.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/context.marko",
     component: "./context.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/form-access.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/form-access.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/form-access.marko",
     marko_component = require("./form-access.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_defaultValue = require("@mindful-web/marko-core/utils/default-value"),
@@ -179,7 +179,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/form-access.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/form-access.marko",
     component: "./form-access.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-authenticate.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/form-authenticate.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/form-authenticate.marko",
     marko_component = require("./form-authenticate.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -81,7 +81,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/form-authenticate.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/form-authenticate.marko",
     component: "./form-authenticate.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-change-email.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/form-change-email.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/form-change-email.marko",
     marko_component = require("./form-change-email.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -59,7 +59,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/form-change-email.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/form-change-email.marko",
     component: "./form-change-email.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-login.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/form-login.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/form-login.marko",
     marko_component = require("./form-login.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -92,7 +92,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/form-login.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/form-login.marko",
     component: "./form-login.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-logout.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/form-logout.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/form-logout.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_defaultValue = require("@mindful-web/marko-core/utils/default-value"),
     defaultValue = module_defaultValue.default || module_defaultValue,
@@ -29,7 +29,7 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/form-logout.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/form-logout.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko"
     ]

package/components/form-profile.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/form-profile.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/form-profile.marko",
     marko_component = require("./form-profile.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -84,7 +84,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/form-profile.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/form-profile.marko",
     component: "./form-profile.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-register.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/form-register.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/form-register.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_assign = require("marko/dist/runtime/helpers/assign"),
     marko_web_identity_x_form_login_template = require("./form-login.marko"),
@@ -25,7 +25,7 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/form-register.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/form-register.marko",
     tags: [
       "./form-login.marko"
     ]

package/components/google-init.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/google-init.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/google-init.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_attr = require("marko/dist/runtime/html/helpers/attr"),
     marko_str = require("marko/dist/runtime/helpers/to-string");
@@ -239,5 +239,5 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/google-init.marko"
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/google-init.marko"
   };

package/components/google-sign-in-button.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/google-sign-in-button.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/google-sign-in-button.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     helpers_escape_xml = require("marko/dist/runtime/html/helpers/escape-xml"),
     marko_escapeXml = helpers_escape_xml.x,
@@ -40,5 +40,5 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/google-sign-in-button.marko"
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/google-sign-in-button.marko"
   };

package/components/identify.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/identify.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/identify.marko",
     marko_component = require("./identify.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -50,7 +50,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/identify.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/identify.marko",
     component: "./identify.marko",
     tags: [
       "@mindful-web/marko-web-gtm/components/push.marko",

package/components/non-auth-identify.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/non-auth-identify.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/non-auth-identify.marko",
     marko_component = require("./non-auth-identify.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_dynamicTag = require("marko/dist/runtime/helpers/dynamic-tag"),
@@ -45,7 +45,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/non-auth-identify.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/non-auth-identify.marko",
     component: "./non-auth-identify.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/subscribe.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.79.9/components/subscribe.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.80.1/components/subscribe.marko",
     marko_component = require("./subscribe.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -73,7 +73,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.79.9/components/subscribe.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.80.1/components/subscribe.marko",
     component: "./subscribe.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindful-web/marko-web-identity-x",
-  "version": "1.79.9",
+  "version": "1.80.1",
   "description": "Marko Wrapper for IdentityX",
   "repository": "https://github.com/parameter1/mindful-web/tree/main/packages/marko-web-identity-x",
   "author": "Josh Worden <josh@parameter1.com>",
@@ -13,9 +13,9 @@
     "test": "yarn compile --no-clean && yarn lint"
   },
   "dependencies": {
-    "@mindful-web/marko-web-gtm": "^1.57.0",
-    "@mindful-web/object-path": "^1.57.0",
-    "@mindful-web/utils": "^1.57.0",
+    "@mindful-web/marko-web-gtm": "^1.80.0",
+    "@mindful-web/object-path": "^1.80.0",
+    "@mindful-web/utils": "^1.80.0",
     "apollo-cache-inmemory": "^1.6.6",
     "apollo-client": "^2.6.10",
     "apollo-link-context": "^1.0.20",
@@ -38,5 +38,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "450cfb4efb7f30564f3230912fce04b5fc574a1a"
+  "gitHead": "956e3462d636f6e7785c1e82b99d66b4c410e9df"
 }

package/routes/google.js

@@ -1,6 +1,6 @@
 const gql = require('graphql-tag');
 const { OAuth2Client } = require('google-auth-library');
-const { asArray, asyncRoute } = require('@mindful-web/utils');
+const { asArray, asyncRoute, sleep } = require('@mindful-web/utils');
 const IMPERSONATE_APP_USER = require('../api/mutations/impersonate-app-user');
 const tokenCookie = require('../utils/token-cookie');
 const contextCookie = require('../utils/context-cookie');
@@ -26,6 +26,47 @@ const getOAuthClient = (clientId) => {
 
 const LOGIN_SOURCE = 'google-one-tap';
 
+// One retry, not more: the failure mode this addresses is a read-after-write
+// race that clears on the next attempt, and each attempt costs a full request
+// timeout. Three attempts would put a failing sign-in past the upstream 60s
+// budget we are trying to stay inside.
+const IMPERSONATE_MAX_ATTEMPTS = 2;
+const IMPERSONATE_RETRY_DELAY_MS = 250;
+
+// Same shape as the impersonation retry, and for the same suspected cause: a
+// read-after-write race, this time on the token the previous step just minted.
+const NAME_BACKFILL_MAX_ATTEMPTS = 2;
+const NAME_BACKFILL_RETRY_DELAY_MS = 250;
+
+/**
+ * A session token that the idx API does not (yet) recognise.
+ *
+ * Apollo exposes GraphQL errors both individually on `graphQLErrors` and folded
+ * into `error.message` as "GraphQL error: <message>"; check both so this does not
+ * depend on which shape the caller happens to see.
+ */
+const isFreshTokenError = (e) => {
+  if (!e) return false;
+  const messages = [e.message, ...asArray(e.graphQLErrors).map((g) => g && g.message)];
+  return messages.some((m) => /not a valid token|invalid token|token was not found/i.test(String(m)));
+};
+
+/**
+ * Transport-level failures only — a timeout, reset or DNS blip is worth
+ * repeating; a GraphQL validation or authorization error is not, and repeating
+ * it only doubles the user's wait before the identical 500.
+ *
+ * Apollo wraps transport failures as `networkError`; `node-fetch` raises its own
+ * timeout as a `FetchError` reading "network timeout at: <uri>".
+ */
+const isRetryableIdxError = (e) => {
+  if (!e) return false;
+  if (e.networkError) return true;
+  if (e.name === 'FetchError' || e.type === 'request-timeout') return true;
+  return /network timeout|ETIMEDOUT|ECONNRESET|ECONNREFUSED|EAI_AGAIN|socket hang up/i
+    .test(String(e.message));
+};
+
 // Namespace under which the Google account id (the JWT `sub`) is stored as an
 // idx external id, mirroring the Omeda { provider, tenant, type } convention.
 // These values must remain stable — changing them orphans existing links.
@@ -63,8 +104,19 @@ module.exports = asyncRoute(async (req, res) => {
   // Tag the transaction as the route progresses. Whatever step is recorded when
   // the request dies is the step that failed, so an error arrives already
   // localized instead of being a bare GraphQL message to reverse-engineer.
+  //
+  // `idxGoogleStepMs` is the elapsed time when each step *began*, which makes the
+  // route self-profiling: `FACET idxGoogleStep` with `max(idxGoogleStepMs)` shows
+  // where the time goes, and a request that dies mid-flight still reports how far
+  // it got and when. Sign-ins here average ~12s even when they succeed, and
+  // without this there is no way to tell which of the ~10 sequential upstream
+  // calls owns that.
+  const startedAt = Date.now();
   const addAttrs = config.get('addRequestAttributes') || (() => {});
-  const setStep = (step) => addAttrs({ idxGoogleStep: step });
+  const setStep = (step) => addAttrs({
+    idxGoogleStep: step,
+    idxGoogleStepMs: Date.now() - startedAt,
+  });
 
   const { clientId, missingFieldsBehavior = 'profile-gate' } = config.getAsObject('googleAuth');
   // `surface` is the GIS `select_by` bucket ('button' | 'prompt'), sent by the
@@ -153,18 +205,60 @@ module.exports = asyncRoute(async (req, res) => {
   setStep('impersonate-app-user');
   // Impersonate the user with verify: true — marks them as verified and returns
   // a session token, bypassing the normal email-link flow.
-  const { data: impersonateData } = await identityX.client.mutate({
-    mutation: IMPERSONATE_APP_USER,
-    variables: {
-      input: {
-        id: appUser.id,
-        method: 'GOOGLE_ONE_TAP',
-        verify: true,
-      },
-    },
-    context: { apiToken: identityX.getOrgUserApiToken() },
-  });
-  const { token: authToken } = impersonateData.impersonateAppUser;
+  //
+  // Retried once, because this is precisely where new-user sign-ins were
+  // observed to die. On overdriveonline.com in 2026-07, 15 of 15 requests that
+  // had just created the app user stalled inside this mutation (avg 53.1s, max
+  // 60.018s — an upstream 60s idle timeout) and never wrote a response, so the
+  // browser showed nothing at all and the user had to trigger One Tap a second
+  // time. Every hand-retry then succeeded, with `createdNewUser: false`. That
+  // correlation — stalls only when impersonating a user created milliseconds
+  // earlier — points at a read-after-write race on the idx API, which is
+  // exactly the shape a single retry fixes.
+  //
+  // `create-client.js` now bounds each call, so the stall arrives as a
+  // FetchError in ~15s rather than hanging; worst case here is two attempts and
+  // then a 500 the client can actually surface, instead of a 60s silent no-op.
+  let impersonateData;
+  let impersonateAttempts = 0;
+  for (;;) {
+    impersonateAttempts += 1;
+    try {
+      // eslint-disable-next-line no-await-in-loop
+      ({ data: impersonateData } = await identityX.client.mutate({
+        mutation: IMPERSONATE_APP_USER,
+        variables: {
+          input: {
+            id: appUser.id,
+            method: 'GOOGLE_ONE_TAP',
+            verify: true,
+          },
+        },
+        context: { apiToken: identityX.getOrgUserApiToken() },
+      }));
+      break;
+    } catch (e) {
+      // Only transport failures are worth repeating. A GraphQL validation or
+      // authorization error fails identically every time, so retrying it just
+      // doubles the user's wait before the same 500.
+      if (impersonateAttempts >= IMPERSONATE_MAX_ATTEMPTS || !isRetryableIdxError(e)) {
+        addAttrs({ idxImpersonateAttempts: impersonateAttempts });
+        throw e;
+      }
+      setStep('impersonate-app-user-retry');
+      // eslint-disable-next-line no-await-in-loop
+      await sleep(IMPERSONATE_RETRY_DELAY_MS);
+    }
+  }
+  addAttrs({ idxImpersonateAttempts: impersonateAttempts });
+
+  // Guard the destructure: a null payload here previously became an opaque
+  // "cannot destructure" TypeError several frames from the real cause.
+  const impersonated = impersonateData && impersonateData.impersonateAppUser;
+  if (!impersonated || !impersonated.token) {
+    throw new Error('Google sign-in could not establish a session: impersonation returned no token.');
+  }
+  const { token: authToken } = impersonated;
 
   tokenCookie.setTo(res, authToken.value);
   contextCookie.setTo(res, { loginSource: LOGIN_SOURCE });
@@ -190,10 +284,55 @@ module.exports = asyncRoute(async (req, res) => {
   if (familyName && !appUser.familyName) nameInput.familyName = familyName;
   if (Object.keys(nameInput).length) {
     setStep('update-own-app-user');
-    await identityX.client.mutate({
-      mutation: UPDATE_OWN_APP_USER,
-      variables: { input: nameInput },
-    });
+    // This is the ONLY call in the route authenticated as the *user* rather than
+    // the org — every other one passes `context: { apiToken: getOrgUserApiToken() }`
+    // — so it is the only one that depends on the session token minted moments
+    // earlier already being readable. That is exactly why it is the only
+    // operation reported failing: production shows `GoogleSignInUpdateUser`
+    // returning "The provided value is not a valid token".
+    //
+    // The same token value works on the *next* request, arriving from the cookie
+    // set above — which is what makes a read-after-write race on the idx token
+    // store the leading explanation, so retry once.
+    //
+    // Non-fatal regardless of the cause, which matters more than the retry. This
+    // backfills a first and last name; it is cosmetic. But `tokenCookie.setTo`
+    // has already run, so the user IS authenticated by the time we get here —
+    // throwing turned a fully successful sign-in into a 500, and the client, on
+    // seeing `!data.ok`, ran `fail()` and redirected a logged-in user to
+    // /user/login. A missing display name must never cost someone their session.
+    let backfill = 'ok';
+    let attempts = 0;
+    for (;;) {
+      attempts += 1;
+      try {
+        // eslint-disable-next-line no-await-in-loop
+        await identityX.client.mutate({
+          mutation: UPDATE_OWN_APP_USER,
+          variables: { input: nameInput },
+        });
+        break;
+      } catch (e) {
+        const retryable = attempts < NAME_BACKFILL_MAX_ATTEMPTS
+          && (isFreshTokenError(e) || isRetryableIdxError(e));
+        if (!retryable) {
+          backfill = 'failed';
+          onError(e, {
+            idxGoogleStep: 'update-own-app-user',
+            idxUserId: appUser.id,
+            idxNameBackfillAttempts: attempts,
+          });
+          break;
+        }
+        backfill = 'retried';
+        // eslint-disable-next-line no-await-in-loop
+        await sleep(NAME_BACKFILL_RETRY_DELAY_MS);
+      }
+    }
+    // Measurable: `FACET idxNameBackfill` separates "the retry rescues it" (a
+    // race) from "it always fails" (an impersonation token that simply cannot
+    // authorize this mutation) — two different bugs with one error message.
+    addAttrs({ idxNameBackfill: backfill, idxNameBackfillAttempts: attempts });
   }
 
   // Load the refreshed user so hooks and field checks have up-to-date data.
@@ -241,13 +380,33 @@ module.exports = asyncRoute(async (req, res) => {
   // the same way they do for email-link users.  This also populates
   // user.externalIds with the Omeda encryptedCustomerId so the subsequent
   // onAuthenticationSuccess hook can set oly_enc_id in the response.
+  //
+  // `forceAwait` because everything below *depends* on this hook's side effects,
+  // and `shouldAwait.onLoginLinkSent` defaults to FALSE — so by default these
+  // hooks were fire-and-forget and the dependency was a race this route lost
+  // most of the time.
+  //
+  // That default is correct for the email-link flow and wrong here, because the
+  // two flows have different shapes. Email-link fires onLoginLinkSent on the
+  // `/login` request when the link is *sent*, and onAuthenticationSuccess on a
+  // separate request minutes later when the user clicks it — rapid-identify has
+  // long since finished, so not awaiting it costs nothing. One Tap collapses both
+  // into a single request milliseconds apart. Un-awaited, Omeda rapid-identify
+  // has usually not yet written the `encryptedCustomerId` external id when
+  // `appendSubscriptions` looks for it, so it bails, produces no `autoSignups`,
+  // and no `subscribe` conversion is ever reported — the exact symptom seen on
+  // overdriveonline.com, where every completed One Tap sign-in recorded
+  // `idxAutoSignupCount: 0`.
+  //
+  // Bounded by the Omeda client's own request timeout, so awaiting cannot hang
+  // the route the way it could before that existed.
   setStep('hooks-login-link-sent');
   await callHooksFor(identityX, 'onLoginLinkSent', {
     req,
     source: LOGIN_SOURCE,
     user,
     additionalEventData: linkSentEventData,
-  });
+  }, { forceAwait: true });
 
   // Re-fetch so onAuthenticationSuccess sees the externalIds written by
   // the onLoginLinkSent hook (Omeda rapid-identify).

package/utils/call-hooks-for.js

@@ -7,22 +7,36 @@ const { isFunction: isFn } = require('@mindful-web/utils');
  * @param {IdentityX} service The IdentityX service instance.
  * @param {string} name The hook queue name
  * @param {object} params Parameters to send to the hook function
+ * @param {object} [options]
+ * @param {boolean} [options.forceAwait=false] Await every hook, ignoring each
+ *   hook's own `shouldAwait`. For callers that depend on a hook's side effects
+ *   *within the same request* — where fire-and-forget is a race, not an
+ *   optimisation. See `routes/google.js`.
  */
-module.exports = async (service, name, params = {}) => {
+module.exports = async (service, name, params = {}, { forceAwait = false } = {}) => {
   const { error } = console;
   const onError = service.config.get('onHookError');
   const onHookError = isFn(onError) ? onError : (e) => error(e);
   const promises = { wait: [], skip: [] };
   getAsArray(service, `config.hooks.${name}`).forEach(({ fn, shouldAwait }) => {
-    const key = shouldAwait ? 'wait' : 'skip';
+    const key = shouldAwait || forceAwait ? 'wait' : 'skip';
     const additionalEventData = params.additionalEventData || {};
     const maybePromise = fn({
       ...params,
       additionalEventData,
       service,
     });
-    if (maybePromise.catch) maybePromise.catch(onHookError);
-    promises[key].push(maybePromise);
+    // Push the *handled* promise, not the raw one. Previously a failing awaited
+    // hook was reported twice — once by this per-promise catch and again by the
+    // `Promise.all` catch below — which doubled the count everywhere
+    // `onHookError` is wired to `newrelic.noticeError`. Attaching the handler
+    // here and awaiting the result keeps every rejection reported exactly once
+    // while still ensuring none goes unhandled (`Promise.all` only surfaces the
+    // first rejection, so the raw promises cannot be awaited directly).
+    const handled = maybePromise && isFn(maybePromise.catch)
+      ? maybePromise.catch(onHookError)
+      : maybePromise;
+    promises[key].push(handled);
   });
-  if (promises.wait.length) await Promise.all(promises.wait).catch(onHookError);
+  if (promises.wait.length) await Promise.all(promises.wait);
 };

package/utils/create-client.js

@@ -1,4 +1,5 @@
 const fetch = require('node-fetch');
+const { instrumentApolloClient } = require('@mindful-web/utils');
 const { ApolloClient } = require('apollo-client');
 const { InMemoryCache, IntrospectionFragmentMatcher } = require('apollo-cache-inmemory');
 const { createHttpLink } = require('apollo-link-http');
@@ -10,6 +11,33 @@ const rootConfig = {
   ssrMode: true,
 };
 
+/**
+ * Per-request timeout for idx API calls.
+ *
+ * `node-fetch` v2 has NO default timeout, so before this a stalled call to the
+ * idx API hung the Express request indefinitely: nothing threw, no response was
+ * written, no 500 was returned, and — because the Node agent records
+ * `res.statusCode`, which defaults to 200 when nothing is ever written — New
+ * Relic logged a *successful* 200 with no error event. The user saw a One-Tap
+ * prompt that silently did nothing.
+ *
+ * Measured on `POST /__idx/google` (overdriveonline.com, 2026-07): 15 of 15
+ * new-user sign-ins stalled inside the impersonation mutation at avg 53.1s /
+ * max 60.018s — the flat 60s ceiling of an upstream idle timeout cutting the
+ * connection while this process was still waiting. Successful requests on the
+ * same route averaged 12.4s total across ~10 sequential idx calls, so a 15s
+ * *per-call* budget leaves ample headroom while turning an indefinite hang into
+ * a fast, attributable `FetchError` -> 500 -> a real New Relic error event.
+ *
+ * Tunable without a deploy via `IDENTITYX_REQUEST_TIMEOUT_MS`; a caller can
+ * still override per client through `linkConfig.fetchOptions.timeout`.
+ */
+const DEFAULT_TIMEOUT_MS = 15000;
+const getTimeoutMs = () => {
+  const configured = Number.parseInt(process.env.IDENTITYX_REQUEST_TIMEOUT_MS, 10);
+  return Number.isFinite(configured) && configured > 0 ? configured : DEFAULT_TIMEOUT_MS;
+};
+
 module.exports = ({
   req,
   token,
@@ -32,17 +60,24 @@ module.exports = ({
     uri: process.env.IDENTITYX_GRAPHQL_URI || 'https://apis.mindfulcms.com/graphql/idx-compat',
     fetch,
     headers,
+    // Spread the caller's options last so an explicit per-client timeout wins.
+    fetchOptions: { timeout: getTimeoutMs(), ...linkConfig.fetchOptions },
   });
   const contextLink = setContext((_, { apiToken }) => ({
     headers: { ...(apiToken && { authorization: `OrgUserApiToken ${apiToken}` }) },
   }));
 
-  return new ApolloClient({
-    ...config,
-    ...rootConfig,
-    link: contextLink.concat(httpLink),
-    cache: new InMemoryCache({
-      fragmentMatcher: new IntrospectionFragmentMatcher({ introspectionQueryResultData }),
+  // Per-operation timing + trace segments. Paired with the timeout above: the
+  // timeout stops a stall being invisible, this says which operation stalled.
+  return instrumentApolloClient({
+    api: 'idx',
+    client: new ApolloClient({
+      ...config,
+      ...rootConfig,
+      link: contextLink.concat(httpLink),
+      cache: new InMemoryCache({
+        fragmentMatcher: new IntrospectionFragmentMatcher({ introspectionQueryResultData }),
+      }),
     }),
   });
 };