@mindful-web/marko-web-identity-x 1.85.4 → 1.87.0

package/CLAUDE.md

@@ -426,6 +426,22 @@ before the hooks run and essentially never rejects. An async failure is reported
 reach this field; `error` is a *synchronous* dispatch throw only. Deliberately **not** `onLoginLinkSent` / `onAuthenticationSuccess`: those drive
 auto-signup and the GA4 `subscribe` conversion, and this is not a registration.
 
+**The hook payload strips `customBooleanFieldAnswers` — load-bearing, do not "restore" it.**
+The omeda consumer (`marko-web-omeda-identity-x/rapid-identify.js`) maps *every* boolean answer on
+the user it receives into provider writes: product-namespace booleans become
+`subscriptions: [{ id, receive }]`, deployment-type booleans become opt-ins/opt-outs. idx-compat
+surfaces every email/**magazine** channel as a boolean field whose "answer" is the member's stored
+subscription state — `active: false` reads as an explicitly-answered no (`hasAnswered` is
+`answer != null`; channels have no unanswered state). This form cannot collect booleans
+(boot-validation forbids the rows), so any boolean reaching the hook is state the visitor never
+touched. Passing them through let a progressive submit overwrite Omeda subscription state
+wholesale: 18 of the first 48 production submitters on athleticbusiness had their print-magazine
+subscription killed (`Receive: 0`, "Controlled Kills") at their exact submit second — the
+2026-08-19 incident. The spec asserting the payload shape lives in
+`marko-web-omeda-identity-x/test/rapid-identify.spec.js`. The profile route (`routes/profile.js`)
+still passes booleans deliberately — its form renders the subscription checkboxes — but it shares
+the divergence exposure; see the incident follow-ups in the rollout doc.
+
 ### Bot protection — verify, then discard the write rather than the visitor
 
 The threat is concrete: `marko-web-omeda-identity-x/middleware/set-identity-cookie.js` mints

package/components/access.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.85.4/components/access.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.87.0/components/access.marko",
     marko_component = require("./access.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -53,7 +53,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.85.4/components/access.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.87.0/components/access.marko",
     component: "./access.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/comment-stream.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.85.4/components/comment-stream.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.87.0/components/comment-stream.marko",
     marko_component = require("./comment-stream.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -91,7 +91,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.85.4/components/comment-stream.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.87.0/components/comment-stream.marko",
     component: "./comment-stream.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/context.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.85.4/components/context.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.87.0/components/context.marko",
     marko_component = require("./context.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_dynamicTag = require("marko/dist/runtime/helpers/dynamic-tag"),
@@ -49,7 +49,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.85.4/components/context.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.87.0/components/context.marko",
     component: "./context.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/form-access.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.85.4/components/form-access.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.87.0/components/form-access.marko",
     marko_component = require("./form-access.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_defaultValue = require("@mindful-web/marko-core/utils/default-value"),
@@ -179,7 +179,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.85.4/components/form-access.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.87.0/components/form-access.marko",
     component: "./form-access.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-authenticate.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.85.4/components/form-authenticate.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.87.0/components/form-authenticate.marko",
     marko_component = require("./form-authenticate.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -81,7 +81,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.85.4/components/form-authenticate.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.87.0/components/form-authenticate.marko",
     component: "./form-authenticate.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-change-email.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.85.4/components/form-change-email.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.87.0/components/form-change-email.marko",
     marko_component = require("./form-change-email.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -59,7 +59,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.85.4/components/form-change-email.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.87.0/components/form-change-email.marko",
     component: "./form-change-email.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-login.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.85.4/components/form-login.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.87.0/components/form-login.marko",
     marko_component = require("./form-login.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -92,7 +92,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.85.4/components/form-login.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.87.0/components/form-login.marko",
     component: "./form-login.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-logout.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.85.4/components/form-logout.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.87.0/components/form-logout.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_defaultValue = require("@mindful-web/marko-core/utils/default-value"),
     defaultValue = module_defaultValue.default || module_defaultValue,
@@ -29,7 +29,7 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.85.4/components/form-logout.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.87.0/components/form-logout.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko"
     ]

package/components/form-profile.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.85.4/components/form-profile.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.87.0/components/form-profile.marko",
     marko_component = require("./form-profile.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -84,7 +84,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.85.4/components/form-profile.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.87.0/components/form-profile.marko",
     component: "./form-profile.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-register.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.85.4/components/form-register.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.87.0/components/form-register.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_assign = require("marko/dist/runtime/helpers/assign"),
     marko_web_identity_x_form_login_template = require("./form-login.marko"),
@@ -25,7 +25,7 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.85.4/components/form-register.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.87.0/components/form-register.marko",
     tags: [
       "./form-login.marko"
     ]

package/components/google-init.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.85.4/components/google-init.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.87.0/components/google-init.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_attr = require("marko/dist/runtime/html/helpers/attr"),
     marko_str = require("marko/dist/runtime/helpers/to-string");
@@ -239,5 +239,5 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.85.4/components/google-init.marko"
+    id: "/@mindful-web/marko-web-identity-x$1.87.0/components/google-init.marko"
   };

package/components/google-sign-in-button.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.85.4/components/google-sign-in-button.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.87.0/components/google-sign-in-button.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     helpers_escape_xml = require("marko/dist/runtime/html/helpers/escape-xml"),
     marko_escapeXml = helpers_escape_xml.x,
@@ -40,5 +40,5 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.85.4/components/google-sign-in-button.marko"
+    id: "/@mindful-web/marko-web-identity-x$1.87.0/components/google-sign-in-button.marko"
   };

package/components/identify.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.85.4/components/identify.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.87.0/components/identify.marko",
     marko_component = require("./identify.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -50,7 +50,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.85.4/components/identify.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.87.0/components/identify.marko",
     component: "./identify.marko",
     tags: [
       "@mindful-web/marko-web-gtm/components/push.marko",

package/components/non-auth-identify.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.85.4/components/non-auth-identify.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.87.0/components/non-auth-identify.marko",
     marko_component = require("./non-auth-identify.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_dynamicTag = require("marko/dist/runtime/helpers/dynamic-tag"),
@@ -45,7 +45,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.85.4/components/non-auth-identify.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.87.0/components/non-auth-identify.marko",
     component: "./non-auth-identify.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/progressive-profile-form.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.85.4/components/progressive-profile-form.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.87.0/components/progressive-profile-form.marko",
     marko_component = require("./progressive-profile-form.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_defaultValue = require("@mindful-web/marko-core/utils/default-value"),
@@ -137,7 +137,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.85.4/components/progressive-profile-form.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.87.0/components/progressive-profile-form.marko",
     component: "./progressive-profile-form.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/subscribe.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.85.4/components/subscribe.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.87.0/components/subscribe.marko",
     marko_component = require("./subscribe.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -73,7 +73,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.85.4/components/subscribe.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.87.0/components/subscribe.marko",
     component: "./subscribe.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindful-web/marko-web-identity-x",
-  "version": "1.85.4",
+  "version": "1.87.0",
   "description": "Marko Wrapper for IdentityX",
   "repository": "https://github.com/parameter1/mindful-web/tree/main/packages/marko-web-identity-x",
   "author": "Josh Worden <josh@parameter1.com>",
@@ -43,5 +43,5 @@
     "chai": "^4.3.7",
     "mocha": "^6.2.3"
   },
-  "gitHead": "e793692becf12f650680a93a12f36f227aaace30"
+  "gitHead": "ff4b26653f19375680d94b56997484a7dab24f05"
 }

package/routes/profile.js

@@ -114,6 +114,12 @@ module.exports = asyncRoute(async (req, res) => {
     await identityX.client.mutate({ mutation: consentAnswers, variables: { input: { answers } } });
   }
 
+  // The custom field ids this request actually submitted AND was allowed to write (the same
+  // filtered sets the mutations below receive). Passed to the profile-update hooks so provider
+  // syncs (Omeda rapid-identify) scope their answer payload to what the form displayed — stored
+  // answers for fields this form never rendered must not be rebroadcast as writes.
+  const submittedFieldIds = [];
+
   if (customBooleanFieldAnswers.length) {
     // only update custom questions when there some :)
     const customBooleanFieldsInput = customBooleanFieldAnswers.map((fieldAnswer) => ({
@@ -126,6 +132,7 @@ module.exports = asyncRoute(async (req, res) => {
         ? ({ fieldId }) => customFieldIds.includes(fieldId)
         : () => true,
     );
+    submittedFieldIds.push(...customBooleanFieldsInput.map(({ fieldId }) => fieldId));
     await identityX.client.mutate({
       mutation: customBooleanFieldsMutation,
       variables: { input: { answers: customBooleanFieldsInput } },
@@ -146,6 +153,7 @@ module.exports = asyncRoute(async (req, res) => {
         ? ({ fieldId }) => customFieldIds.includes(fieldId)
         : () => true,
     );
+    submittedFieldIds.push(...customSelectFieldsInput.map(({ fieldId }) => fieldId));
     await identityX.client.mutate({
       mutation: customSelectFieldsMutation,
       variables: { input: { answers: customSelectFieldsInput } },
@@ -163,6 +171,7 @@ module.exports = asyncRoute(async (req, res) => {
         ? ({ fieldId }) => customFieldIds.includes(fieldId)
         : () => true,
     );
+    submittedFieldIds.push(...customTextFieldsInput.map(({ fieldId }) => fieldId));
     await identityX.client.mutate({
       mutation: customTextFieldsMutation,
       variables: { input: { answers: customTextFieldsInput } },
@@ -176,6 +185,7 @@ module.exports = asyncRoute(async (req, res) => {
     ...(additionalEventData || {}),
     req,
     user,
+    submittedFieldIds,
   });
   const entity = await identityX.generateEntityId({ userId: user.id });
   res.json({

package/routes/progressive-profile.js

@@ -240,7 +240,26 @@ const submit = asyncRoute(async (req, res) => {
       try {
         await callHooksFor(identityX, 'onUserProfileUpdate', {
           req,
-          user: appUser,
+          // Boolean answers are stripped, deliberately and load-bearingly. The omeda hook maps
+          // EVERY boolean answer on the user it receives into provider writes -- product booleans
+          // become `subscriptions: [{ id, receive }]`, deployment-type booleans become opt-ins/
+          // opt-outs -- and idx-compat surfaces every email/magazine *channel* as a boolean whose
+          // "answer" is the member's stored subscription state (`active: false` reads as an
+          // explicitly-answered no; channels have no unanswered state). This form cannot collect
+          // booleans (boot-validation forbids the rows), so any boolean here is by definition
+          // state the visitor never touched -- and passing it through let a progressive submit
+          // overwrite Omeda subscription state wholesale, unsubscribing magazine subscribers
+          // whose idx state had diverged (2026-08-19 incident, athleticbusiness).
+          user: { ...appUser, customBooleanFieldAnswers: [] },
+          // The fields THIS submit wrote (definition-filtered, same sets the mutation received).
+          // Provider syncs scope their answer payload to these ids, so a progressive submit can
+          // never rebroadcast stored answers for questions it did not ask. Belt to the boolean
+          // strip's suspenders — selects/texts get the same protection booleans already had.
+          submittedFieldIds: [
+            ...selectAnswers.map(({ fieldId }) => fieldId),
+            ...booleanAnswers.map(({ fieldId }) => fieldId),
+            ...textAnswers.map(({ fieldId }) => fieldId),
+          ],
           additionalEventData: { actionSource: ACTION_SOURCE },
           actionSource: ACTION_SOURCE,
         });