@mindful-web/marko-web-identity-x 1.92.0 → 1.98.0

package/CLAUDE.md

@@ -5,7 +5,8 @@ Web sites. Owns the whole authenticated-user surface: login / register / authent
 / profile / logout, content access + download gating, comments, and the server-side IdentityX API
 client. Add-ons layer on top: `marko-web-omeda-identity-x` (wraps this and adds Omeda hooks —
 how most sites install it), `marko-web-auth0-identity-x`, `marko-web-identity-x-mailchimp`. Google
-Sign-In (One-Tap + button) is **built in** here (see below).
+Sign-In (One-Tap + button) is **built in** here (see below). The opt-in Identity Bridge sync
+(`integrations/identity-bridge-sync`, see below) reports member events to Mindful Identity Bridge.
 
 ## Config model — the `IdentityXConfiguration` instance (`config.js`)
 
@@ -423,7 +424,10 @@ No coverage is lost: every field the fleet-wide impact analysis measured is a se
   `buildContentSource()`. **Definitions come from server config, never the body**, so a client
   cannot widen what gets written by posting extra rows. Drops an empty select rather than sending
   `optionIds: []`, which the writer reads as *unset* — the one way this feature could destroy data
-  despite the fill-blanks-only rule.
+  despite the fill-blanks-only rule. `buildContentSource()` sends `appContextId` (falling back to
+  the app id) as `websiteChannelId`, which is what Insights scopes submissions by. watt, cox and
+  industrial-media share one app across their sites with a context per site; sending the app id
+  there gave WATT's first 44 submissions a channel no site maps to, and Insights showed 0.
 - `routes/progressive-profile.js` — `POST /__idx/progressive-profile` (+ `/dismiss`). A thin proxy;
   it owns *trust*, not writes.
 - `components/progressive-profile-form.marko` (`<marko-web-identity-x-progressive-profile-form>`)
@@ -695,6 +699,52 @@ Submitted **answer values are never tracked** anywhere — `fieldKeys` and the m
    still exclude `custom-boolean` — no longer for the renderer bug, but because the gate forces
    required columns and a required checkbox can only submit `true` (see the boot-check table).
 
+## Identity Bridge sync (`integrations/identity-bridge-sync`) — added 2026-10
+
+Opt-in hook installer that reports member events to Mindful Identity Bridge's `POST /:tenantKey/sync`
+(`apis/identity-bridge` in mindful-reporting, tracked in parameter1/mindful-reporting#304). Identity
+Bridge decides which third-party providers act on each event (eMagazines today). **This package holds
+no provider logic, config or keys** — it replaced mindful-web#363, which ran eMagazines from here.
+
+```js
+const installIdentityBridgeSync = require('@mindful-web/marko-web-identity-x/integrations/identity-bridge-sync');
+installIdentityBridgeSync(idxConfig, { websiteId: process.env.SITE_ID });
+```
+
+| Hook | Event sent |
+|---|---|
+| `onAuthenticationSuccess` | `{ event: 'authenticated', websiteId, user, loginSource }` |
+| `onUserProfileUpdate` | `{ event: 'profile-updated', websiteId, user }` |
+| `onChangeEmailSuccess` | `{ event: 'email-changed', websiteId, user /* new email */, oldEmail }` |
+
+`user` is `{ id, email, givenName, familyName, street, city, regionCode, postalCode }` from the
+IdentityX app user.
+
+- **Send values as they are.** The server normalizes `null`/`''`/whitespace to unset and lowercases
+  emails. Don't clean them here.
+- **Don't filter here.** Every login is sent, `change-email` included (`change-email-confirm.js`
+  fires `onAuthenticationSuccess` right after `onChangeEmailSuccess`). The server skips those logins
+  and applies the website's `loginSources`. Adding a filter here would split one rule across two repos.
+- **All three hooks use `shouldAwait: false`.** The server runs synchronously and returns 502 when a
+  provider call fails, and the client throws on any non-2xx. So failures reach `onHookError` without
+  blocking the IdentityX request.
+- **The client comes from the request.** The hooks call `req.mindful.identityBridge.sync()`, which
+  the `@mindful-web/mindful` service middleware sets when given `identityBridge`
+  (`packages/mindful/identity-bridge.js`). Each hook throws a clear error when the client is missing.
+  ⚠️ The site must install that middleware **before** its IdentityX routes:
+
+  ```js
+  identityBridge: {
+    apiKey: process.env.MINDFUL_IDENTITY_BRIDGE_API_KEY,
+    tenantKey: 'allured', // the Mindful tenant key, NOT the site's TENANT_KEY (e.g. `indm_multi`)
+  },
+  ```
+
+- `websiteId` is the CMS website id (`SITE_ID`). The server returns 400 if that id doesn't belong to
+  the tenant. A website with no providers configured gets `{ data: [] }`.
+- Specs: `test/integrations/identity-bridge-sync.spec.js` (hooks) and `packages/mindful/test/` (client
+  + middleware).
+
 ## Fleet / rollout
 
 Not tracked in-repo. The Google-auth architecture change + fleet rollout plan lives outside the repo

package/README.md

@@ -264,3 +264,40 @@ The Google account id (JWT `sub`) is persisted as a supplementary idx external i
 `{ provider: 'google', tenant: 'oauth', type: 'account' }`; email stays the primary key.
 Non-fatal linkage errors report through the config's `onHookError`.
 | `identity-x-comment-stream-errored` | `{ label, message: '...', ...additionalEventData }`
+
+## Identity Bridge sync
+
+Opt-in, and **off until installed.** It reports logins, profile updates and email changes to Mindful
+Identity Bridge, which passes them on to the third-party providers configured for the website (e.g.
+eMagazines). Every decision is made server side. This package sends the events and nothing else.
+
+1. Give the Mindful service middleware an Identity Bridge client. Install it **before** the IdentityX
+   routes, because the hooks read `req.mindful.identityBridge`:
+
+   ```js
+   const mindfulService = require('@mindful-web/mindful/marko-web/middleware/service');
+
+   app.use(mindfulService({
+     namespace: '<tenant>/<site>',
+     identityBridge: {
+       apiKey: process.env.MINDFUL_IDENTITY_BRIDGE_API_KEY,
+       tenantKey: 'allured', // the Mindful tenant key, not the site's TENANT_KEY
+     },
+   }));
+   ```
+
+   `identityBridge` also takes `timeout` (ms, default 15000) and `url` (default
+   `https://apis.internal.mindfulcms.com/identity-bridge`). Without it, `req.mindful.identityBridge`
+   is `null`.
+
+2. Install the hooks on the IdentityX config:
+
+   ```js
+   const installIdentityBridgeSync = require('@mindful-web/marko-web-identity-x/integrations/identity-bridge-sync');
+
+   installIdentityBridgeSync(idxConfig, { websiteId: process.env.SITE_ID });
+   ```
+
+The `onAuthenticationSuccess`, `onUserProfileUpdate` and `onChangeEmailSuccess` hooks are not
+awaited. A failed sync, including a missing client on the request, is reported through the config's
+`onHookError`.

package/components/access.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.92.0/components/access.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.98.0/components/access.marko",
     marko_component = require("./access.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -53,7 +53,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.92.0/components/access.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.98.0/components/access.marko",
     component: "./access.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/comment-stream.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.92.0/components/comment-stream.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.98.0/components/comment-stream.marko",
     marko_component = require("./comment-stream.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -91,7 +91,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.92.0/components/comment-stream.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.98.0/components/comment-stream.marko",
     component: "./comment-stream.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/context.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.92.0/components/context.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.98.0/components/context.marko",
     marko_component = require("./context.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_dynamicTag = require("marko/dist/runtime/helpers/dynamic-tag"),
@@ -49,7 +49,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.92.0/components/context.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.98.0/components/context.marko",
     component: "./context.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/form-access.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.92.0/components/form-access.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.98.0/components/form-access.marko",
     marko_component = require("./form-access.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_defaultValue = require("@mindful-web/marko-core/utils/default-value"),
@@ -179,7 +179,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.92.0/components/form-access.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.98.0/components/form-access.marko",
     component: "./form-access.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-authenticate.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.92.0/components/form-authenticate.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.98.0/components/form-authenticate.marko",
     marko_component = require("./form-authenticate.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -81,7 +81,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.92.0/components/form-authenticate.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.98.0/components/form-authenticate.marko",
     component: "./form-authenticate.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-change-email.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.92.0/components/form-change-email.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.98.0/components/form-change-email.marko",
     marko_component = require("./form-change-email.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -59,7 +59,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.92.0/components/form-change-email.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.98.0/components/form-change-email.marko",
     component: "./form-change-email.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-login.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.92.0/components/form-login.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.98.0/components/form-login.marko",
     marko_component = require("./form-login.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -92,7 +92,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.92.0/components/form-login.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.98.0/components/form-login.marko",
     component: "./form-login.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-logout.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.92.0/components/form-logout.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.98.0/components/form-logout.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_defaultValue = require("@mindful-web/marko-core/utils/default-value"),
     defaultValue = module_defaultValue.default || module_defaultValue,
@@ -29,7 +29,7 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.92.0/components/form-logout.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.98.0/components/form-logout.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko"
     ]

package/components/form-profile.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.92.0/components/form-profile.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.98.0/components/form-profile.marko",
     marko_component = require("./form-profile.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -84,7 +84,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.92.0/components/form-profile.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.98.0/components/form-profile.marko",
     component: "./form-profile.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/form-register.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.92.0/components/form-register.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.98.0/components/form-register.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_assign = require("marko/dist/runtime/helpers/assign"),
     marko_web_identity_x_form_login_template = require("./form-login.marko"),
@@ -25,7 +25,7 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.92.0/components/form-register.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.98.0/components/form-register.marko",
     tags: [
       "./form-login.marko"
     ]

package/components/google-init.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.92.0/components/google-init.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.98.0/components/google-init.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_attr = require("marko/dist/runtime/html/helpers/attr"),
     marko_str = require("marko/dist/runtime/helpers/to-string");
@@ -239,5 +239,5 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.92.0/components/google-init.marko"
+    id: "/@mindful-web/marko-web-identity-x$1.98.0/components/google-init.marko"
   };

package/components/google-sign-in-button.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.92.0/components/google-sign-in-button.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.98.0/components/google-sign-in-button.marko",
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     helpers_escape_xml = require("marko/dist/runtime/html/helpers/escape-xml"),
     marko_escapeXml = helpers_escape_xml.x,
@@ -40,5 +40,5 @@ marko_template._ = marko_renderer(render, {
   });
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.92.0/components/google-sign-in-button.marko"
+    id: "/@mindful-web/marko-web-identity-x$1.98.0/components/google-sign-in-button.marko"
   };

package/components/identify.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.92.0/components/identify.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.98.0/components/identify.marko",
     marko_component = require("./identify.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -50,7 +50,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.92.0/components/identify.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.98.0/components/identify.marko",
     component: "./identify.marko",
     tags: [
       "@mindful-web/marko-web-gtm/components/push.marko",

package/components/non-auth-identify.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.92.0/components/non-auth-identify.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.98.0/components/non-auth-identify.marko",
     marko_component = require("./non-auth-identify.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     marko_dynamicTag = require("marko/dist/runtime/helpers/dynamic-tag"),
@@ -45,7 +45,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.92.0/components/non-auth-identify.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.98.0/components/non-auth-identify.marko",
     component: "./non-auth-identify.marko",
     tags: [
       "@mindful-web/marko-core/components/resolve.marko"

package/components/progressive-profile-form.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.92.0/components/progressive-profile-form.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.98.0/components/progressive-profile-form.marko",
     marko_component = require("./progressive-profile-form.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_defaultValue = require("@mindful-web/marko-core/utils/default-value"),
@@ -137,7 +137,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.92.0/components/progressive-profile-form.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.98.0/components/progressive-profile-form.marko",
     component: "./progressive-profile-form.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/components/subscribe.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-identity-x$1.92.0/components/subscribe.marko",
+    marko_componentType = "/@mindful-web/marko-web-identity-x$1.98.0/components/subscribe.marko",
     marko_component = require("./subscribe.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_objectPath_module = require("@mindful-web/object-path"),
@@ -73,7 +73,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-identity-x$1.92.0/components/subscribe.marko",
+    id: "/@mindful-web/marko-web-identity-x$1.98.0/components/subscribe.marko",
     component: "./subscribe.marko",
     tags: [
       "@mindful-web/marko-web/components/browser-component.marko",

package/integrations/identity-bridge-sync/index.js

@@ -0,0 +1,77 @@
+/**
+ * Maps an IdentityX app user to the Identity Bridge `user`. Values are sent as they are: the server
+ * normalizes `null`/empty fields and lowercases the email.
+ *
+ * @param {object} user The IdentityX app user
+ */
+const toSyncUser = (user) => ({
+  id: user.id,
+  email: user.email,
+  givenName: user.givenName,
+  familyName: user.familyName,
+  street: user.street,
+  city: user.city,
+  regionCode: user.regionCode,
+  postalCode: user.postalCode,
+});
+
+/**
+ * @param {import('express').Request} req
+ */
+const getClient = (req) => {
+  const client = req && req.mindful && req.mindful.identityBridge;
+  if (!client) throw new Error('No Identity Bridge client on the request. Pass `identityBridge` to the Mindful service middleware.');
+  return client;
+};
+
+/**
+ * Reports IdentityX member events to Mindful Identity Bridge (`POST /:tenantKey/sync`), which
+ * decides which third-party providers act on them. Nothing provider-specific lives here: login
+ * source filtering, `change-email` logins and subscription checks are all handled server side.
+ *
+ * Requires the `@mindful-web/mindful` service middleware, configured with `identityBridge`, to run
+ * before the IdentityX routes so `req.mindful.identityBridge` is set.
+ *
+ * None of the hooks are awaited, so a slow or failed sync never blocks the IdentityX request.
+ * Failures are reported through the config's `onHookError`.
+ *
+ * @param {import("../../config")} idxConfig
+ * @param {object} options
+ * @param {string} options.websiteId The site's CMS website ID (`SITE_ID`)
+ */
+module.exports = (idxConfig, { websiteId } = {}) => {
+  if (!idxConfig || !idxConfig.addHook) throw new Error('Unable to install the Identity Bridge sync hooks.');
+  if (!websiteId) throw new Error('A websiteId is required to install the Identity Bridge sync hooks.');
+
+  idxConfig.addHook({
+    name: 'onAuthenticationSuccess',
+    shouldAwait: false,
+    fn: async ({ req, user, loginSource }) => getClient(req).sync({
+      event: 'authenticated',
+      websiteId,
+      loginSource,
+      user: toSyncUser(user),
+    }),
+  });
+
+  idxConfig.addHook({
+    name: 'onUserProfileUpdate',
+    shouldAwait: false,
+    fn: async ({ req, user }) => getClient(req).sync({
+      event: 'profile-updated',
+      websiteId,
+      user: toSyncUser(user),
+    }),
+  });
+
+  idxConfig.addHook({
+    name: 'onChangeEmailSuccess',
+    shouldAwait: false,
+    fn: async ({ req, user, oldEmail }) => getClient(req).sync({
+      event: 'email-changed',
+      websiteId,
+      oldEmail,
+      user: toSyncUser(user),
+    }),
+  });
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindful-web/marko-web-identity-x",
-  "version": "1.92.0",
+  "version": "1.98.0",
   "description": "Marko Wrapper for IdentityX",
   "repository": "https://github.com/parameter1/mindful-web/tree/main/packages/marko-web-identity-x",
   "author": "Josh Worden <josh@parameter1.com>",
@@ -43,5 +43,5 @@
     "chai": "^4.3.7",
     "mocha": "^6.2.3"
   },
-  "gitHead": "1a2c523f3c3cfa5ff4a18d3900a31a7260a39b9e"
+  "gitHead": "606c85315b404db6d84a08cb0a0ae7a059ae1fa4"
 }

package/test/integrations/identity-bridge-sync.spec.js

@@ -0,0 +1,162 @@
+const { describe, it } = require('mocha');
+const { expect } = require('chai');
+const install = require('../../integrations/identity-bridge-sync');
+
+/**
+ * Installs the hooks against a stub config and returns them by name.
+ */
+const installHooks = (options = { websiteId: 'website-1' }) => {
+  const hooks = [];
+  install({ addHook: (hook) => hooks.push(hook) }, options);
+  return hooks.reduce((o, hook) => ({ ...o, [hook.name]: hook }), {});
+};
+
+/**
+ * A request carrying a stubbed Identity Bridge client that records every event.
+ */
+const buildReq = () => {
+  const events = [];
+  const identityBridge = {
+    sync: async (event) => {
+      events.push(event);
+      return [];
+    },
+  };
+  return { req: { mindful: { identityBridge } }, events };
+};
+
+const rejectionOf = async (promise) => {
+  try {
+    await promise;
+  } catch (e) {
+    return e;
+  }
+  return null;
+};
+
+const user = {
+  id: 'user-1',
+  email: 'jane@example.com',
+  givenName: 'Jane',
+  familyName: null,
+  street: '',
+  city: 'Chicago',
+  regionCode: 'US-IL',
+  postalCode: '60601',
+  verified: true,
+  customAttributes: { foo: 'bar' },
+};
+
+// Sent as IdentityX has it, `null` and `''` included; the server normalizes them.
+const syncUser = {
+  id: 'user-1',
+  email: 'jane@example.com',
+  givenName: 'Jane',
+  familyName: null,
+  street: '',
+  city: 'Chicago',
+  regionCode: 'US-IL',
+  postalCode: '60601',
+};
+
+describe('integrations/identity-bridge-sync', () => {
+  describe('install', () => {
+    it('registers non-awaited login, profile update and email change hooks', () => {
+      const hooks = [];
+      install({ addHook: (hook) => hooks.push(hook) }, { websiteId: 'website-1' });
+      expect(hooks.map(({ name }) => name)).to.deep.equal([
+        'onAuthenticationSuccess',
+        'onUserProfileUpdate',
+        'onChangeEmailSuccess',
+      ]);
+      hooks.forEach((hook) => expect(hook.shouldAwait).to.equal(false));
+    });
+
+    it('throws without an IdentityX config', () => {
+      expect(() => install()).to.throw('Unable to install the Identity Bridge sync hooks.');
+    });
+
+    it('throws without a website id', () => {
+      expect(() => installHooks({})).to.throw('A websiteId is required to install the Identity Bridge sync hooks.');
+    });
+  });
+
+  describe('onAuthenticationSuccess', () => {
+    it('sends an authenticated event with the login source', async () => {
+      const { req, events } = buildReq();
+      await installHooks().onAuthenticationSuccess.fn({ req, user, loginSource: 'contentGate' });
+      expect(events).to.deep.equal([{
+        event: 'authenticated',
+        websiteId: 'website-1',
+        loginSource: 'contentGate',
+        user: syncUser,
+      }]);
+    });
+
+    it('sends every login source, including change-email, for the server to filter', async () => {
+      const { req, events } = buildReq();
+      await installHooks().onAuthenticationSuccess.fn({ req, user, loginSource: 'change-email' });
+      expect(events).to.have.lengthOf(1);
+      expect(events[0].loginSource).to.equal('change-email');
+    });
+  });
+
+  describe('onUserProfileUpdate', () => {
+    it('sends a profile-updated event', async () => {
+      const { req, events } = buildReq();
+      await installHooks().onUserProfileUpdate.fn({ req, user, actionSource: 'profile' });
+      expect(events).to.deep.equal([{
+        event: 'profile-updated',
+        websiteId: 'website-1',
+        user: syncUser,
+      }]);
+    });
+  });
+
+  describe('onChangeEmailSuccess', () => {
+    it('sends an email-changed event with the new email on the user', async () => {
+      const { req, events } = buildReq();
+      await installHooks().onChangeEmailSuccess.fn({
+        req,
+        user: { ...user, email: 'jane.new@example.com' },
+        oldEmail: 'jane@example.com',
+      });
+      expect(events).to.deep.equal([{
+        event: 'email-changed',
+        websiteId: 'website-1',
+        oldEmail: 'jane@example.com',
+        user: { ...syncUser, email: 'jane.new@example.com' },
+      }]);
+    });
+  });
+
+  describe('without a client on the request', () => {
+    ['onAuthenticationSuccess', 'onUserProfileUpdate', 'onChangeEmailSuccess'].forEach((name) => {
+      it(`${name} throws a clear error`, async () => {
+        const hooks = installHooks();
+        const reqs = [{}, { mindful: {} }, { mindful: { identityBridge: null } }];
+        const errors = await Promise.all(reqs.map((req) => rejectionOf(hooks[name].fn({
+          req,
+          user,
+          oldEmail: 'jane@example.com',
+        }))));
+        errors.forEach((error) => {
+          expect(error).to.be.an('error');
+          expect(error.message).to.equal('No Identity Bridge client on the request. Pass `identityBridge` to the Mindful service middleware.');
+        });
+      });
+    });
+  });
+
+  it('passes on a failed sync so onHookError reports it', async () => {
+    const req = {
+      mindful: {
+        identityBridge: {
+          sync: async () => { throw new Error('Identity Bridge sync failed (502): emagazines'); },
+        },
+      },
+    };
+    const error = await rejectionOf(installHooks().onUserProfileUpdate.fn({ req, user }));
+    expect(error.message).to.equal('Identity Bridge sync failed (502): emagazines');
+  });
+});

package/test/utils/build-progressive-profile-payload.spec.js

@@ -0,0 +1,29 @@
+const { describe, it } = require('mocha');
+const { expect } = require('chai');
+const { buildContentSource } = require('../../utils/build-progressive-profile-payload');
+
+const config = ({ appId, appContextId } = {}) => ({
+  getAppId: () => appId,
+  get: (path) => (path === 'appContextId' ? appContextId : undefined),
+});
+
+describe('utils/build-progressive-profile-payload buildContentSource', () => {
+  it('uses the app id as the website channel on a single-app tenant', () => {
+    const source = buildContentSource({ config: config({ appId: 'app-1' }), contentId: '15836353' });
+    expect(source.websiteChannelId).to.equal('app-1');
+  });
+
+  it('uses the app context id when the site has one', () => {
+    // A tenant whose sites share one app (watt): the shared app id is no site's channel.
+    const source = buildContentSource({
+      config: config({ appId: 'shared-app', appContextId: 'site-context' }),
+      contentId: '15836353',
+    });
+    expect(source.websiteChannelId).to.equal('site-context');
+  });
+
+  it('parses the content id as an integer', () => {
+    const source = buildContentSource({ config: config({ appId: 'app-1' }), contentId: '15836353' });
+    expect(source.integerId).to.equal(15836353);
+  });
+});

package/utils/build-progressive-profile-payload.js

@@ -99,8 +99,10 @@ module.exports = ({ body, definitions = [] } = {}) => {
  * digits (true of all 442 content routes across the 18 website repos). A mismatch therefore
  * surfaces as a `UserInputError` rather than silently recording a wrong `postId`.
  *
- * `websiteChannelId` is the idx app id: the two are the same value, confirmed against the tenancy
- * `websites` map and the audience `attributes.websiteChannelIds` data.
+ * `websiteChannelId` is the site's audience website channel. On a single-app tenant that is the idx
+ * app id. A tenant whose sites share one app (watt, cox, industrial-media) gives each site its own
+ * app context instead, and the context id is the channel: sending the shared app id there stamps
+ * every site's submissions with a channel no site maps to, so Insights counts zero.
  *
  * @param {object} params
  * @param {import('../config')} params.config
@@ -112,6 +114,6 @@ module.exports.buildContentSource = ({ config, contentId, actionSource } = {}) =
   // `website.tenant`.
   legacyTenantKey: process.env.TENANT_KEY,
   integerId: Number.parseInt(contentId, 10),
-  websiteChannelId: config.getAppId(),
+  websiteChannelId: config.get('appContextId') || config.getAppId(),
   ...(actionSource && { actionSource }),
 });