@mindful-web/marko-web-omeda-identity-x 1.85.5 → 1.87.0

package/README.md

@@ -18,7 +18,7 @@ All configuration data must be passed to the middleware when loaded (See [Middle
 | `clientKey` | No | The Omeda client key (such as `client_orgc`.) *Required if sending deployment optIns via the underlying omeda package!* [marko-web-omeda docs](../marko-web-omeda)
 | `appId` | **Yes** | The Omeda application API read token
 | `inputId` | **Yes** | The Omeda application API write token
-| `rapidIdentProductId` | **Yes** | The Omeda identifier for a Website product (ProductType=7).
+| `rapidIdentProductId` | No — **deprecated**, see [Website products](#website-products-do-not-use-rapididentproductid) | The Omeda identifier for a Website product (ProductType=7). Sends the product on **every** rapid identification, which cuts a duplicate Omeda order each time. Put the website product in the site's deduped opt-in hook instead. | _none_
 | `idxConfig` | **Yes** | An instance of the IdentityX configuration class (see [marko-web-identity-x#1](../marko-web-identity-x/config.js)) | _n/a_
 | `idxRouteTemplates` | **Yes** | An object containing the Marko templates to use for each IdentityX endpoint. (see [marko-web-identity-x#2](../marko-web-identity-x/index.js))
 | `omedaPromoCodeCookieName` | No | The name of the cookie to look for a persisted/original promo code. | `omeda_promo_code` |
@@ -38,6 +38,67 @@ All configuration data must be passed to the middleware when loaded (See [Middle
 | `appendPromoCodeToHook[].hook` | | The name of the hook, such as `onLoginLinkSent`
 | `appendPromoCodeToHook[].promoCode` || The Omeda Promo Code (`String`) to append.
 
+### Website products: do not use `rapidIdentProductId`
+
+`rapidIdentProductId` reads like site *identification* metadata, distinct from subscriptions. It
+isn't. It is forwarded as `productId` to the rapid identification call, and in the omeda GraphQL
+`rapidCustomerIdentification` resolver it is merged with `input.subscriptions` into a single
+`Products` array on Save Customer and Order:
+
+```js
+const productMap = new Map([...(input.productId ? [[input.productId, true]] : [])]);
+// …
+subscriptions.forEach(({ id, receive }) => {
+  subscriptionMap.set(id, receive);
+  if (!productMap.has(id)) productMap.set(id, receive);
+});
+// …
+Products: [...productMap].map(([OmedaProductId, Receive]) => ({ … }))
+```
+
+Omeda cuts an order for whatever lands in `Products`. So `rapidIdentProductId` orders the website
+product on **every** identification — every login-link send, auth success and profile update — which
+is a duplicate order per login, not a one-time attribution.
+
+**Do this instead.** Leave `rapidIdentProductId` unset and list the website product in the site's
+`identityXOptInHooks.onLoginLinkSent.productIds`. The site's `onLoginLinkSentFormatter` (in each
+repo's `packages/global/config/omeda-identity-x.js`) filters those ids through this package's
+[`getOmedaSubscriptionIds`](./omeda-data/get-omeda-subscription-ids.js) before building
+`payload.appendSubscriptions`, so the product is ordered once — when the customer doesn't already
+hold it — and every later identification is a no-op:
+
+```js
+// sites/<site>/config/identity-x-opt-in-hooks.js
+module.exports = {
+  onLoginLinkSent: {
+    productIds: [
+      15375, // <Site> Website — deduped against the live Omeda record; ordered only when missing
+    ],
+  },
+};
+```
+
+```js
+// sites/<site>/config/omeda-identity-x.js — no `rapidIdentProductId`
+module.exports = configure({ omedaConfig, idxConfig, websiteBehaviorAttributeId, omedaPromoCodePrefix });
+```
+
+The website product still belongs on the customer's record — it just needs to get there once. The
+field is retained for backwards compatibility and is optional in the Joi schema; it should not be
+set on new sites.
+
+History: the duplicate orders were found and fixed on allured (allured-business-media-websites#395,
+Oct 2025) and the placement was rolled out fleet-wide through Aug 2026 (ab-media-websites#539,
+ironmarkets-websites#993, cox-matthews-associates-websites#534, fusable-websites#1040,
+watt-global-media-websites#731, industrial-media-websites#623). This README previously listed the
+field as **required** and did not document the hook at all, which is what led two of those PRs to
+initially move the ids the wrong way.
+
+A related trap when reading site configs: some repos' `onAuthenticationSuccess.productIds` hold
+**deployment type** ids despite the key name, because that formatter matches
+`product.deploymentTypeId` and emits `deploymentTypes`. Check which formatter consumes a list before
+assuming its ids are products.
+
 ### Customer re-sync interval
 
 `userResyncIntervalMs` is read from the **IdentityX** config (`idxConfig`), not from the properties

package/components/identify.marko.js

@@ -2,7 +2,7 @@
 "use strict";
 
 var marko_template = module.exports = require("marko/dist/html").t(__filename),
-    marko_componentType = "/@mindful-web/marko-web-omeda-identity-x$1.85.5/components/identify.marko",
+    marko_componentType = "/@mindful-web/marko-web-omeda-identity-x$1.87.0/components/identify.marko",
     marko_component = require("./identify.marko"),
     marko_renderer = require("marko/dist/runtime/components/renderer"),
     module_getCookieId = require("@mindful-web/marko-web-omeda-identity-x/utils/get-cookie-id"),
@@ -51,7 +51,7 @@ marko_template._ = marko_renderer(render, {
   }, marko_component);
 
 marko_template.meta = {
-    id: "/@mindful-web/marko-web-omeda-identity-x$1.85.5/components/identify.marko",
+    id: "/@mindful-web/marko-web-omeda-identity-x$1.87.0/components/identify.marko",
     component: "./identify.marko",
     tags: [
       "@mindful-web/marko-web-identity-x/components/identify.marko",

package/index.js

@@ -45,7 +45,11 @@ const schemas = require('./validation/schemas');
  * @prop {?Promise<object>} onLoginLinkSentFormatter
  * @prop {?Promise<object>} onAuthenticationSuccessFormatter
  * @prop {?Promise<object>} onUserProfileUpdateFormatter
- * @prop {number} rapidIdentProductId
+ * @prop {?number} rapidIdentProductId **Deprecated.** Sends this website product on _every_ rapid
+ *   identification, which cuts a duplicate Omeda order each time — the resolver merges it into the
+ *   same `Products` array as `subscriptions`. Leave unset and put the website product in the site's
+ *   `identityXOptInHooks.onLoginLinkSent.productIds`, which is deduped against the live customer
+ *   record via `getOmedaSubscriptionIds`. Retained for backwards compatibility only; see README.
  *
  * @typedef BehaviorSchema
  * @prop {number} logIn
@@ -194,6 +198,17 @@ module.exports = (app, params = {}) => {
     rapidIdentProductId: Joi.number(),
   }), params);
 
+  // `rapidIdentProductId` is deprecated: the omeda `rapidCustomerIdentification` resolver merges it
+  // into the same SCAO `Products` array as `subscriptions`, so setting it orders the website
+  // product on every identification rather than once. Deliberately `console.warn` over the `warn`
+  // util, matching `resolveDurationMS`: this needs to be visible in production, which is where a
+  // reintroduced value would quietly start cutting duplicate orders again. No fleet repo sets it as
+  // of Aug 2026, so this should never fire outside of a regression.
+  if (rapidIdentProductId != null) {
+    // eslint-disable-next-line no-console
+    console.warn(`[config] rapidIdentProductId (${rapidIdentProductId}) is deprecated for brand ${brandKey}: it orders this website product on EVERY rapid identification, creating duplicate Omeda orders. Move it to the site's identityXOptInHooks.onLoginLinkSent.productIds, which is deduped against the live customer record. See @mindful-web/marko-web-omeda-identity-x README.`);
+  }
+
   // strip `oly_enc_id` when identity-x user is logged-in
   app.use(stripOlyticsParam());
 

package/integration-hooks/on-authentication-success.js

@@ -2,6 +2,7 @@ const Joi = require('@parameter1/joi');
 const { validate } = require('@parameter1/joi/utils');
 const olyticsCookie = require('@mindful-web/marko-web-omeda/olytics/customer-cookie');
 const extractPromoCode = require('../utils/extract-promo-code');
+const getCreateFieldIds = require('../utils/get-create-field-ids');
 const findEncryptedId = require('../external-id/find-encrypted-customer-id');
 const props = require('../validation/props');
 const schemas = require('../validation/schemas');
@@ -25,6 +26,7 @@ module.exports = async (params = {}) => {
     promoCode: hookDataPromoCode,
     res,
     req,
+    service,
     user,
   } = validate(Joi.object({
     appendBehaviors: Joi.array().items(schemas.appendBehavior).default([]),
@@ -33,6 +35,7 @@ module.exports = async (params = {}) => {
     behavior: schemas.behavior.required(),
     brandKey: props.brandKey.required(),
     formatter: Joi.function().required(),
+    service: Joi.object().required(),
     user: Joi.object().required(),
     res: Joi.object().required(),
     req: Joi.object().required(),
@@ -60,5 +63,13 @@ module.exports = async (params = {}) => {
       appendPromoCodes,
     },
   });
-  await idxOmedaRapidIdentify(payload);
+  await idxOmedaRapidIdentify({
+    ...payload,
+    // Authenticating is not a general preference change: only answers for fields the
+    // registration/login form actually presents may become Omeda writes (this is where a
+    // brand-new user's registration checkbox choices land, post-verification). Everything else on
+    // the stored user — most dangerously idx-compat's channel-mirror booleans — is state, not a
+    // statement. Applied outside the formatter so no site-level formatter can drop it.
+    restrictAnswersToFieldIds: getCreateFieldIds(service.config),
+  });
 };

package/integration-hooks/on-login-link-sent.js

@@ -2,6 +2,7 @@ const Joi = require('@parameter1/joi');
 const { validate } = require('@parameter1/joi/utils');
 const generateRequiredFieldPayload = require('@mindful-web/marko-web-identity-x/utils/generate-required-field-payload');
 const extractPromoCode = require('../utils/extract-promo-code');
+const getCreateFieldIds = require('../utils/get-create-field-ids');
 const schemas = require('../validation/schemas');
 const {
   getAnsweredQuestionMap,
@@ -66,23 +67,30 @@ module.exports = async (params = {}) => {
 
   const [omedaLinkedFields, { encryptedCustomerId }] = await Promise.all([
     getOmedaLinkedFields({ identityX, brandKey }),
-    idxOmedaRapidIdentify(await formatter({
-      ...params, // Pass all params through to the formatter
-      req,
-      source,
-      payload: {
-        user: user.verified ? user : {
-          ...(requiredFieldKeys.reduce((obj, key) => ({ ...obj, [key]: user[key] }), {})),
-          id: user.id,
-          email: user.email,
+    idxOmedaRapidIdentify({
+      ...(await formatter({
+        ...params, // Pass all params through to the formatter
+        req,
+        source,
+        payload: {
+          user: user.verified ? user : {
+            ...(requiredFieldKeys.reduce((obj, key) => ({ ...obj, [key]: user[key] }), {})),
+            id: user.id,
+            email: user.email,
+          },
+          behavior,
+          promoCode,
+          appendBehaviors,
+          appendDemographics,
+          appendPromoCodes,
         },
-        behavior,
-        promoCode,
-        appendBehaviors,
-        appendDemographics,
-        appendPromoCodes,
-      },
-    })),
+      })),
+      // Sending a login link is not a general preference change: only answers for fields the
+      // registration/login form actually presents may become Omeda writes. Everything else on the
+      // stored user — most dangerously idx-compat's channel-mirror booleans — is state, not a
+      // statement. Applied outside the formatter so no site-level formatter can drop it.
+      restrictAnswersToFieldIds: getCreateFieldIds(identityX.config),
+    }),
   ]);
 
   const answers = getAnsweredQuestionMap(user);

package/integration-hooks/on-user-profile-update.js

@@ -20,6 +20,7 @@ module.exports = async (params = {}) => {
     omedaPromoCodeDefault,
     promoCode: hookDataPromoCode,
     req,
+    submittedFieldIds,
     user,
   } = validate(Joi.object({
     appendBehaviors: Joi.array().items(schemas.appendBehavior).default([]),
@@ -32,6 +33,10 @@ module.exports = async (params = {}) => {
     omedaPromoCodeDefault: Joi.string(),
     promoCode: Joi.string(),
     req: Joi.object().required(),
+    // The custom field ids the invoking route actually accepted from the submitted form
+    // (profile + progressive-profile routes provide it). Absent = an older/other invoker:
+    // no restriction, current behavior.
+    submittedFieldIds: Joi.array().items(Joi.string()),
     user: Joi.object().required(),
   }).unknown(), params);
 
@@ -55,5 +60,11 @@ module.exports = async (params = {}) => {
     },
   });
 
-  return idxOmedaRapidIdentify(payload);
+  return idxOmedaRapidIdentify({
+    ...payload,
+    // A profile-style save syncs only the answers its form submitted; everything else on the
+    // stored user is state, not a statement. Applied outside the formatter so no site-level
+    // formatter can drop it. Absent submittedFieldIds (an older/other invoker) = unrestricted.
+    ...(submittedFieldIds && { restrictAnswersToFieldIds: submittedFieldIds }),
+  });
 };

package/middleware/rapid-identify.js

@@ -20,6 +20,7 @@ module.exports = ({
     const handler = async ({
       user,
       promoCode,
+      restrictAnswersToFieldIds,
       deploymentTypes,
       appendBehaviors,
       appendDemographics,
@@ -30,6 +31,7 @@ module.exports = ({
       brandKey,
       productId,
       appUser: user,
+      restrictAnswersToFieldIds,
       promoCode: extractPromoCode({
         promoCode,
         omedaPromoCodeCookieName,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindful-web/marko-web-omeda-identity-x",
-  "version": "1.85.5",
+  "version": "1.87.0",
   "description": "Marko Omeda+IdentityX integration tools",
   "repository": "https://github.com/parameter1/mindful-web/tree/main/packages/marko-web-omeda-identity-x",
   "author": "Josh Worden <josh@parameter1.com>",
@@ -13,7 +13,7 @@
     "test": "yarn compile --no-clean && yarn lint && mocha --reporter spec"
   },
   "dependencies": {
-    "@mindful-web/marko-web-identity-x": "^1.85.5",
+    "@mindful-web/marko-web-identity-x": "^1.87.0",
     "@mindful-web/marko-web-omeda": "^1.85.0",
     "@mindful-web/object-path": "^1.83.1",
     "@mindful-web/utils": "^1.83.1",
@@ -33,5 +33,5 @@
     "chai": "^4.3.7",
     "mocha": "^6.2.3"
   },
-  "gitHead": "26553d897cb2c39e798031e4e2727a81123b1402"
+  "gitHead": "ff4b26653f19375680d94b56997484a7dab24f05"
 }

package/rapid-identify.js

@@ -1,8 +1,12 @@
 const gql = require('graphql-tag');
+const Joi = require('@parameter1/joi');
+const { validate } = require('@parameter1/joi/utils');
 const { get, getAsArray } = require('@mindful-web/object-path');
 const isOmedaDemographicId = require('./external-id/is-demographic-id');
 const isDeploymentTypeId = require('./external-id/is-deployment-type-id');
 const isProductId = require('./external-id/is-product-id');
+const props = require('./validation/props');
+const schemas = require('./validation/schemas');
 
 const ALPHA3_CODE = gql`
   query GetAlpha3Code($alpha2: String!) {
@@ -26,28 +30,60 @@ const getAlpha3CodeFor = async (alpha2, identityX) => {
  * @param {object} params.appUser The IdentityX user
  * @param {string} [params.promoCode] An optional code to send to Omeda for tracking the
  *                                    acquisition source
+ * @param {Array<string|number>} [params.restrictAnswersToFieldIds] When provided, custom field
+ *                                    answers (select, text, boolean) are mapped into the Omeda
+ *                                    payload ONLY for fields whose id is in this set — i.e. the
+ *                                    fields the current interaction's form actually presents.
+ *                                    Set on the login paths (link-sent, authentication) to the
+ *                                    site's create-field rows: idx-compat surfaces every
+ *                                    email/magazine channel as an always-answered boolean whose
+ *                                    "answer" mirrors stored subscription state, so pushing the
+ *                                    full stored user unsubscribed Omeda customers on every login
+ *                                    (the 2026-08 incident). Registration-form fields still flow
+ *                                    with their real values — including an explicit `false`
+ *                                    checkbox. Contact fields, behaviors, and append* hook data
+ *                                    are never restricted. Omit (or pass null) for
+ *                                    form-submitting callers (profile), whose payload is already
+ *                                    scoped by their route.
  * @param {IdentityX} params.identityX The Marko web IdentityX service
  * @param {function} params.omedaRapidIdentify The Omeda rapid identifcation action
  */
-module.exports = async ({
-  brandKey,
-  productId,
-  appUser,
-
-  promoCode,
-
-  deploymentTypes = [],
-
-  appendBehaviors,
-  appendDemographics,
-  appendPromoCodes,
-  appendSubscriptions,
-
-  behavior,
-
-  identityX,
-  omedaRapidIdentify,
-} = {}) => {
+module.exports = async (params = {}) => {
+  // The payload contract is enforced here — the single choke point every rapid identification
+  // flows through — so an inconsistent payload (a mistyped key, a Set where an array belongs, a
+  // malformed append entry) fails loudly instead of silently widening or narrowing what gets
+  // written to Omeda. Unknown keys are rejected: the middleware handler passes an explicit key
+  // list, so anything else arriving here is a wiring bug.
+  const {
+    brandKey,
+    productId,
+    appUser,
+    promoCode,
+    restrictAnswersToFieldIds,
+    deploymentTypes,
+    appendBehaviors,
+    appendDemographics,
+    appendPromoCodes,
+    appendSubscriptions,
+    behavior,
+    identityX,
+    omedaRapidIdentify,
+  } = validate(Joi.object({
+    brandKey: props.brandKey.required(),
+    productId: Joi.number(),
+    appUser: Joi.object({ email: Joi.string().required() }).unknown(true).required(),
+    promoCode: Joi.string().allow('', null),
+    restrictAnswersToFieldIds: Joi.array()
+      .items(Joi.alternatives().try(Joi.string(), Joi.number())).allow(null),
+    deploymentTypes: Joi.array().items(schemas.deploymentType).default([]),
+    appendBehaviors: Joi.array().items(schemas.appendBehavior),
+    appendDemographics: Joi.array().items(schemas.appendDemographic),
+    appendPromoCodes: Joi.array().items(schemas.appendPromoCode),
+    appendSubscriptions: Joi.array().items(schemas.appendSubscription),
+    behavior: schemas.behavior,
+    identityX: Joi.object().required(),
+    omedaRapidIdentify: Joi.function().required(),
+  }), params);
   const {
     givenName,
     familyName,
@@ -70,9 +106,18 @@ module.exports = async ({
   }
 
   const behaviors = (behavior) ? [{ id: behavior.id, attributes: getAsArray(behavior, 'attributes') }] : [];
+
+  // Fields the current interaction's form presents. Answers for anything else are stored state,
+  // not something the user just said — never rebroadcast them as writes.
+  const allowedFieldIds = restrictAnswersToFieldIds == null
+    ? null
+    : new Set([...restrictAnswersToFieldIds].map((id) => `${id}`));
+  const isFieldAllowed = (field) => !allowedFieldIds || allowedFieldIds.has(`${field.id}`);
+
   const demographics = getAsArray(appUser, 'customSelectFieldAnswers').filter((select) => {
     const { field, hasAnswered } = select;
     if (!field.active || !field.externalId || !hasAnswered) return false;
+    if (!isFieldAllowed(field)) return false;
     return isOmedaDemographicId({ externalId: field.externalId, brandKey })
       && select.answers.some((answer) => answer.externalIdentifier);
   }).map((select) => {
@@ -90,6 +135,7 @@ module.exports = async ({
     const { field, hasAnswered } = text;
     const { externalId } = field;
     if (!field.active || !externalId || !hasAnswered) return;
+    if (!isFieldAllowed(field)) return;
 
     const { identifier } = field.externalId;
     const id = parseInt(identifier.value, 10);
@@ -103,6 +149,10 @@ module.exports = async ({
     const { field, hasAnswered } = boolean;
     const { externalId } = field;
     if (!field.active || !externalId || !hasAnswered) return;
+    // Channel-mirror booleans (idx-compat surfaces every email/magazine channel as an
+    // always-answered boolean of stored subscription state) are never form fields, so on scoped
+    // calls they can never become deployment opt-outs or `Receive: 0` subscription writes.
+    if (!isFieldAllowed(field)) return;
 
     const { identifier } = field.externalId;
     const id = parseInt(identifier.value, 10);

package/test/integration-hooks.spec.js

@@ -0,0 +1,82 @@
+const { describe, it } = require('mocha');
+const { expect } = require('chai');
+const onAuthenticationSuccess = require('../integration-hooks/on-authentication-success');
+const onUserProfileUpdate = require('../integration-hooks/on-user-profile-update');
+
+const BRAND = 'athlcd';
+
+const encryptedExternalId = () => ({
+  identifier: { type: 'encrypted', value: '0240G4865912F6U' },
+  namespace: { provider: 'omeda', tenant: BRAND, type: 'customer' },
+});
+
+const res = () => ({
+  cookie: () => {},
+  req: { cookies: {}, hostname: 'www.example.com', get: () => 'www.example.com' },
+});
+
+// The registration form presents one custom boolean (a watt-style login checkbox) and one
+// custom select; built-ins never contribute to the answer scope.
+const service = () => ({
+  config: {
+    getRequiredCreateFieldRows: () => [
+      [{ type: 'custom-boolean', id: 'form-newsletter-optin' }, { type: 'built-in', key: 'givenName', required: true }],
+      [{ type: 'custom-select', id: 'form-job-function' }],
+    ],
+  },
+});
+
+describe('integration-hooks/on-authentication-success', () => {
+  it('scopes answers to the create-form field ids, outside the formatter', async () => {
+    let captured;
+    await onAuthenticationSuccess({
+      behavior: { id: 9 },
+      brandKey: BRAND,
+      // A formatter that rebuilds the payload from scratch must not be able to drop the scope.
+      formatter: async () => ({ user: { email: 'someone@example.com' } }),
+      idxOmedaRapidIdentify: async (payload) => { captured = payload; },
+      omedaPromoCodeCookieName: 'omeda_promo_code',
+      res: res(),
+      req: {},
+      service: service(),
+      user: { verified: true, email: 'someone@example.com', externalIds: [encryptedExternalId()] },
+    });
+    expect([...captured.restrictAnswersToFieldIds].sort())
+      .to.deep.equal(['form-job-function', 'form-newsletter-optin']);
+    expect(captured.user).to.deep.equal({ email: 'someone@example.com' });
+  });
+});
+
+describe('integration-hooks/on-user-profile-update', () => {
+  const harness = () => {
+    let captured;
+    return {
+      params: {
+        behavior: { id: 10 },
+        // A formatter that rebuilds the payload from scratch must not be able to drop the scope.
+        formatter: async () => ({ user: { email: 'someone@example.com' } }),
+        idxOmedaRapidIdentify: async (payload) => { captured = payload; },
+        omedaPromoCodeCookieName: 'omeda_promo_code',
+        req: { cookies: {} },
+        user: { email: 'someone@example.com' },
+      },
+      captured: () => captured,
+    };
+  };
+
+  it('forwards the route-provided submittedFieldIds as the answer scope, outside the formatter', async () => {
+    const h = harness();
+    await onUserProfileUpdate({
+      ...h.params,
+      submittedFieldIds: ['form-job-function', 'chan-ab-magazine'],
+    });
+    expect(h.captured().restrictAnswersToFieldIds)
+      .to.deep.equal(['form-job-function', 'chan-ab-magazine']);
+  });
+
+  it('applies no restriction when the invoker provides none (back-compat)', async () => {
+    const h = harness();
+    await onUserProfileUpdate(h.params);
+    expect(h.captured()).to.not.have.property('restrictAnswersToFieldIds');
+  });
+});

package/test/rapid-identify.spec.js

@@ -38,7 +38,24 @@ const deploymentBooleanAnswer = ({ id = 'chan-2', deploymentTypeId = 17, answer
   },
 });
 
-const run = async (appUser) => {
+const demographicBooleanAnswer = ({ id = 'demo-1', demographicId = 55, answer = false } = {}) => ({
+  id,
+  hasAnswered: true,
+  answer,
+  value: answer,
+  field: {
+    id,
+    label: 'Do you purchase?',
+    active: true,
+    externalId: {
+      id: `omeda.demographic.${BRAND}*${demographicId}`,
+      namespace: { provider: 'omeda', tenant: BRAND, type: 'demographic' },
+      identifier: { value: `${demographicId}`, type: null },
+    },
+  },
+});
+
+const run = async (appUser, opts = {}) => {
   let captured;
   await idxOmedaRapidIdentify({
     brandKey: BRAND,
@@ -46,6 +63,7 @@ const run = async (appUser) => {
     appUser: { email: 'someone@example.com', ...appUser },
     identityX: { addExternalUserId: async () => ({}) },
     omedaRapidIdentify: async (payload) => { captured = payload; return { id: 1, encryptedCustomerId: 'x' }; },
+    ...opts,
   });
   return captured;
 };
@@ -79,4 +97,117 @@ describe('rapid-identify (idx → omeda payload)', () => {
     expect(payload).to.not.have.property('subscriptions');
     expect(payload).to.not.have.property('deploymentTypes');
   });
+
+  describe('with restrictAnswersToFieldIds (form-scoped answers)', () => {
+    it('drops answers — true AND false — for fields outside the scope (channel-mirror booleans)', async () => {
+      await Promise.all([false, true].map(async (answer) => {
+        const payload = await run({
+          customBooleanFieldAnswers: [
+            productBooleanAnswer({ id: 'chan-1', answer }),
+            deploymentBooleanAnswer({ id: 'chan-2', answer }),
+          ],
+        }, { restrictAnswersToFieldIds: ['some-form-field'] });
+        expect(payload).to.not.have.property('subscriptions');
+        expect(payload).to.not.have.property('deploymentTypes');
+      }));
+    });
+
+    it('keeps in-scope boolean answers with their real value — an explicit false checkbox flows', async () => {
+      const payload = await run({
+        customBooleanFieldAnswers: [
+          productBooleanAnswer({ id: 'form-product', answer: false }),
+          deploymentBooleanAnswer({ id: 'form-newsletter', answer: true }),
+        ],
+      }, { restrictAnswersToFieldIds: ['form-product', 'form-newsletter'] });
+      expect(payload.subscriptions).to.deep.equal([{ id: 28, receive: false }]);
+      expect(payload.deploymentTypes).to.deep.equal([{ id: 17, optedIn: true }]);
+    });
+
+    it('scopes boolean demographics too, but an in-scope false demographic still writes', async () => {
+      const payload = await run({
+        customBooleanFieldAnswers: [
+          demographicBooleanAnswer({ id: 'form-demo', answer: false }),
+          demographicBooleanAnswer({ id: 'other-demo', demographicId: 56, answer: true }),
+        ],
+      }, { restrictAnswersToFieldIds: ['form-demo'] });
+      expect(payload.demographics).to.deep.equal([{ id: 55, values: ['false'] }]);
+    });
+
+    it('scopes select answers: in-scope maps to demographics, out-of-scope is dropped', async () => {
+      const selectAnswer = (fieldId, demographicId, valueId) => ({
+        id: fieldId,
+        hasAnswered: true,
+        answers: [{ id: `opt-${valueId}`, externalIdentifier: `${valueId}` }],
+        field: {
+          id: fieldId,
+          active: true,
+          externalId: {
+            id: `omeda.demographic.${BRAND}*${demographicId}`,
+            namespace: { provider: 'omeda', tenant: BRAND, type: 'demographic' },
+            identifier: { value: `${demographicId}`, type: null },
+          },
+        },
+      });
+      const payload = await run({
+        customSelectFieldAnswers: [
+          selectAnswer('form-select', 68, 361),
+          selectAnswer('profile-only-select', 69, 374),
+        ],
+      }, { restrictAnswersToFieldIds: ['form-select'] });
+      expect(payload.demographics).to.deep.equal([{ id: 68, values: ['361'] }]);
+    });
+
+    it('applies no restriction when omitted or null (back-compat for form-submitting callers)', async () => {
+      await Promise.all([{}, { restrictAnswersToFieldIds: null }].map(async (opts) => {
+        const payload = await run({
+          customBooleanFieldAnswers: [productBooleanAnswer({ answer: false })],
+        }, opts);
+        expect(payload.subscriptions).to.deep.equal([{ id: 28, receive: false }]);
+      }));
+    });
+
+    it('compares ids as strings (numeric config ids match string field ids)', async () => {
+      const payload = await run({
+        customBooleanFieldAnswers: [productBooleanAnswer({ id: '123', answer: true })],
+      }, { restrictAnswersToFieldIds: [123] });
+      expect(payload.subscriptions).to.deep.equal([{ id: 28, receive: true }]);
+    });
+  });
+
+  describe('payload validation (the contract is enforced, not assumed)', () => {
+    const expectRejects = async (opts, match) => {
+      try {
+        await run({}, opts);
+      } catch (e) {
+        expect(e.message).to.match(match);
+        return;
+      }
+      throw new Error('expected the payload to be rejected');
+    };
+
+    it('rejects unknown keys — a mistyped restriction key must fail loudly, not mean "unrestricted"', async () => {
+      await expectRejects({ restrictAnswerToFieldIds: ['x'] }, /restrictAnswerToFieldIds/);
+    });
+
+    it('rejects a Set for restrictAnswersToFieldIds (the contract is array-only)', async () => {
+      await expectRejects({ restrictAnswersToFieldIds: new Set(['x']) }, /restrictAnswersToFieldIds/);
+    });
+
+    it('rejects malformed append entries', async () => {
+      await expectRejects({ appendSubscriptions: [{ id: 28 }] }, /receive/);
+    });
+
+    it('requires appUser.email and the identifier function', async () => {
+      let threw = false;
+      try {
+        await idxOmedaRapidIdentify({
+          brandKey: BRAND,
+          appUser: {},
+          identityX: {},
+          omedaRapidIdentify: async () => ({}),
+        });
+      } catch (e) { threw = true; }
+      expect(threw).to.equal(true);
+    });
+  });
 });

package/utils/get-create-field-ids.js

@@ -0,0 +1,15 @@
+/**
+ * Returns the custom field ids the site's registration/login form presents — the
+ * `requiredCreateFieldRows` on the IdentityX configuration. This is the answer scope for the
+ * login-path rapid identifications: an answer for any other field is stored state (most
+ * dangerously idx-compat's channel-mirror booleans), not something the user said on this form.
+ *
+ * @param {import('@mindful-web/marko-web-identity-x/config')} idxConfig
+ * @returns {string[]} deduped, sorted (rapid-identify's payload contract is array-only)
+ */
+module.exports = (idxConfig) => [...new Set(
+  (idxConfig.getRequiredCreateFieldRows() || [])
+    .flat()
+    .filter((def) => def && typeof def.type === 'string' && def.type.startsWith('custom-') && def.id)
+    .map((def) => `${def.id}`),
+)].sort();

package/validation/schemas/append-subscription.js

@@ -0,0 +1,7 @@
+const Joi = require('@parameter1/joi');
+
+module.exports = Joi.object({
+  id: Joi.number().required(),
+  receive: Joi.boolean().required(),
+  requestedVersion: Joi.string(),
+});

package/validation/schemas/deployment-type.js

@@ -0,0 +1,6 @@
+const Joi = require('@parameter1/joi');
+
+module.exports = Joi.object({
+  id: Joi.number().required(),
+  optedIn: Joi.boolean().required(),
+});

package/validation/schemas/index.js

@@ -1,7 +1,9 @@
 const appendBehavior = require('./append-behavior');
 const appendDemographic = require('./append-demographic');
 const appendPromoCode = require('./append-promo-code');
+const appendSubscription = require('./append-subscription');
 const behavior = require('./behavior');
+const deploymentType = require('./deployment-type');
 const hookBehavior = require('./hook-behavior');
 const hookDemographic = require('./hook-demographic');
 const hookPromoCode = require('./hook-promo-code');
@@ -11,7 +13,9 @@ module.exports = {
   appendBehavior,
   appendDemographic,
   appendPromoCode,
+  appendSubscription,
   behavior,
+  deploymentType,
   hookBehavior,
   hookDemographic,
   hookPromoCode,