@scalemule/news-publication 0.0.69 → 0.0.72

package/dist/reader-sso.d.cts

@@ -0,0 +1,318 @@
+export { R as READER_SSO_EVENTS, a as READER_SSO_PROPERTY_KEYS, b as ReaderSsoEventDefinition, c as ReaderSsoEventName } from './reader-sso-events-DBw8pGSM.cjs';
+
+type ReaderSsoMode = "interactive" | "silent";
+type ReaderSsoProvider = "google" | "email";
+type ReaderSsoMethod = ReaderSsoProvider | "link" | "switch" | "unknown";
+declare const READER_SSO_FLOW_SECONDS = 600;
+declare const READER_SSO_NEGATIVE_CACHE_SECONDS = 300;
+declare const READER_SSO_SIGNED_OUT_SECONDS = 86400;
+declare const READER_SSO_PENDING_SECONDS = 600;
+declare const LEDVERY_ISSUER_ORIGIN = "https://api.ledvery.com";
+/** Ledvery results that mean "no silent session here"; never authentication failures. */
+declare const SILENT_NEGATIVE_ERRORS: readonly ["login_required", "consent_required", "interaction_required", "account_selection_required"];
+type ReaderSsoCookieNames = {
+    /** The reader's platform session token. */
+    session: string;
+    /** Sealed sign-in transaction (10 minutes). */
+    flow: string;
+    /** Newsletter consent carried through email verification. */
+    newsletter: string;
+    /** Negative cache: a silent check ran recently and found nothing. */
+    ssoChecked: string;
+    /** Explicit sign-out: silent sign-in stays off until an explicit sign-in. */
+    signedOut: string;
+    /** A verified session waiting for the reader to choose between two accounts. */
+    pending: string;
+};
+/** Cookie names derived from a `__Host-` prefix, e.g. `__Host-media` → `__Host-media-reader`. */
+declare function readerSsoCookieNames(prefix: string): ReaderSsoCookieNames;
+/** One Set-Cookie instruction. Every reader cookie is host-only, HttpOnly, Secure and Lax. */
+type CookieInstruction = {
+    name: string;
+    value: string;
+    maxAge?: number;
+    expires?: Date;
+};
+declare const readerSsoCookieOptions: {
+    httpOnly: boolean;
+    secure: boolean;
+    sameSite: "lax";
+    path: string;
+};
+/** Apply instructions to a Next.js `cookies()` jar (or anything with the same `set`). */
+declare function applyCookies(jar: {
+    set(name: string, value: string, options: typeof readerSsoCookieOptions & {
+        maxAge?: number;
+        expires?: Date;
+    }): unknown;
+}, cookies: CookieInstruction[]): void;
+/** The same instruction as a raw Set-Cookie header value. */
+declare function setCookieHeader(cookie: CookieInstruction): string;
+type CookieReader = (name: string) => string | undefined;
+/** Read a cookie from a Cookie header. A name sent twice is treated as absent. */
+declare function cookieReader(header: string | null | undefined): CookieReader;
+type ReaderSsoFailure = "cancelled" | "provider_error" | "state" | "exchange" | "unverified" | "session" | "unavailable" | "link_invalid" | "disabled" | "mfa_required";
+type ReaderSsoCheckOutcome = (typeof SILENT_NEGATIVE_ERRORS)[number] | "error" | "link_required" | "suppressed" | "switch_offered" | "switch_declined";
+type ReaderSsoEvent = {
+    name: "reader_signin_started";
+    properties: {
+        method: ReaderSsoMethod;
+        mode: ReaderSsoMode;
+        transaction: string;
+    };
+} | {
+    name: "reader_signin_completed";
+    properties: {
+        method: ReaderSsoMethod;
+        mode: ReaderSsoMode;
+        is_new: "true" | "false";
+        transaction?: string;
+    };
+} | {
+    name: "reader_signin_failed";
+    properties: {
+        reason: ReaderSsoFailure;
+        mode: ReaderSsoMode;
+        transaction?: string;
+    };
+} | {
+    name: "reader_sso_check";
+    properties: {
+        outcome: ReaderSsoCheckOutcome;
+        mode: ReaderSsoMode;
+        transaction?: string;
+    };
+} | {
+    name: "reader_signed_out";
+    properties: {
+        method: "explicit";
+    };
+} | {
+    name: "reader_account_linked";
+    properties: {
+        transaction?: string;
+    };
+};
+
+type ReaderSsoResponse = {
+    status: number;
+    body: unknown;
+};
+type ReaderSsoRequest = (path: string, init: {
+    method: "GET" | "POST";
+    body?: unknown;
+    token?: string;
+}) => Promise<ReaderSsoResponse>;
+type ReaderSsoConfig = {
+    /** `__Host-media` on most papers; `__Host-trivalley` on Tri-Valley Weekly. */
+    prefix: string;
+    /** HMAC key for sealed cookies. The site's API key is used today; never sent to the browser. */
+    key: string;
+    /** Canonical https origin of the publication, e.g. `https://sanramontimes.com`. */
+    origin: string;
+    /** Ledvery OIDC client id for this publication (env LEDVERY_CLIENT_ID, default `napsite-<slug>`). */
+    clientId: string;
+    request: ReaderSsoRequest;
+    record?: (event: ReaderSsoEvent) => void;
+    callbackPath?: string;
+    accountPath?: string;
+    issuerOrigin?: string;
+    /** Explicit email sign-in through Ledvery (env LEDVERY_EMAIL_SIGNIN); off by default. */
+    emailSignIn?: boolean;
+    /** Emergency off switch for all Ledvery sign-in. */
+    enabled?: boolean;
+    /** Validates a local return path per mode; returns "" when the path is not allowed. */
+    returnPath?: (next: string, mode: ReaderSsoMode) => string;
+    /** Where an interactive failure sends the reader; defaults to `/account?signin=retry[&next=]`. */
+    retryPath?: (flow: ReaderSsoFlow | null) => string;
+    now?: () => number;
+    random?: () => string;
+};
+/** Any same-site path: no protocol-relative URLs, control characters or API routes. */
+declare function localReturnPath(value: unknown): string;
+declare function stateDigest(state: string): string;
+declare function validState(state: string | null | undefined, digest: string | undefined): boolean;
+type ReaderSsoFlow = {
+    digest: string;
+    subscribe: boolean;
+    expires: number;
+    returnTo: string;
+    mode: ReaderSsoMode;
+    provider?: ReaderSsoProvider;
+    tx?: string;
+};
+declare function sealReaderFlow(input: {
+    state: string;
+    subscribe?: boolean;
+    returnTo?: string;
+    mode?: ReaderSsoMode;
+    provider?: ReaderSsoProvider;
+    tx?: string;
+}, key: string, now?: number): string;
+declare function openReaderFlow(cookie: string | undefined, key: string, now?: number, returnPath?: (next: string, mode: ReaderSsoMode) => string): ReaderSsoFlow | null;
+/** A verified session the reader has not yet chosen over their current one. */
+type PendingSession = {
+    token: string;
+    expires: number;
+    userId: string;
+    name: string;
+    mode: ReaderSsoMode;
+    method: ReaderSsoMethod;
+    returnTo: string;
+    subscribe: boolean;
+    tx?: string;
+};
+declare function sealPendingSession(pending: PendingSession, key: string, now?: number): string;
+declare function openPendingSession(cookie: string | undefined, key: string, now?: number): PendingSession | null;
+declare function authorizeUrl(value: string, state: string, callback: string, mode: ReaderSsoMode, issuerOrigin?: string): string;
+type StartSignInInput = {
+    mode: ReaderSsoMode;
+    provider?: ReaderSsoProvider;
+    subscribe?: boolean;
+    next?: string;
+    cookies: CookieReader;
+};
+type StartSignInResult = {
+    ok: true;
+    url: string;
+    tx: string;
+    cookies: CookieInstruction[];
+} | {
+    ok: false;
+    status: number;
+    error: string;
+    reason: "disabled" | "suppressed" | "session" | "unavailable" | "provider";
+    redirect: string;
+    cookies: CookieInstruction[];
+};
+declare function startSignIn(config: ReaderSsoConfig, input: StartSignInInput): Promise<StartSignInResult>;
+type SessionUser = {
+    id: string;
+    email_verified: boolean;
+    full_name: string;
+    locale?: string;
+    time_zone?: string;
+};
+/** ADR 3.2: an active session for Bob is never replaced by Alice without an explicit choice. */
+declare function precedence(current: SessionUser | null, incoming: SessionUser): "replace" | "renew" | "switch";
+type CompleteSignInInput = {
+    url: string | URL;
+    cookies: CookieReader;
+};
+type CompleteSignInResult = {
+    kind: "redirect";
+    location: string;
+    cookies: CookieInstruction[];
+    outcome: ReaderSsoCheckOutcome | ReaderSsoFailure;
+    flow: ReaderSsoFlow | null;
+} | {
+    kind: "signed-in";
+    location: string;
+    cookies: CookieInstruction[];
+    token: string;
+    expiresAt: Date;
+    user: SessionUser;
+    flow: ReaderSsoFlow;
+    isNew: boolean;
+};
+/**
+ * Finish a transaction that Ledvery returned to the callback. Produces cookies and
+ * a destination; the caller subscribes to the newsletter (interactive consent only)
+ * and performs the redirect with private, no-store headers.
+ */
+declare function completeSignIn(config: ReaderSsoConfig, input: CompleteSignInInput): Promise<CompleteSignInResult>;
+type LinkAccountInput = {
+    challenge_id: unknown;
+    password: unknown;
+    mfa_code?: unknown;
+    cookies: CookieReader;
+    next?: string;
+    subscribe?: boolean;
+};
+type LinkAccountResult = {
+    ok: true;
+    switch: false;
+    cookies: CookieInstruction[];
+    token: string;
+    expiresAt: Date;
+    user: SessionUser;
+    location: string;
+} | {
+    ok: true;
+    switch: true;
+    cookies: CookieInstruction[];
+    location: string;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+    cookies: CookieInstruction[];
+    mfaRequired?: boolean;
+};
+/** Platform answers to an ownership proof that are not a plain "wrong details". */
+declare function linkFailureMessage(code: string): {
+    error: string;
+    mfaRequired?: boolean;
+} | null;
+declare function linkAccount(config: ReaderSsoConfig, input: LinkAccountInput): Promise<LinkAccountResult>;
+type SwitchAccountResult = {
+    ok: true;
+    choice: "continue";
+    cookies: CookieInstruction[];
+    token: string;
+    location: string;
+    subscribe: boolean;
+} | {
+    ok: true;
+    choice: "stay";
+    cookies: CookieInstruction[];
+    location: string;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+    cookies: CookieInstruction[];
+};
+/** Names shown on the switch prompt. Nothing here is ever an email address. */
+declare function pendingSwitch(config: ReaderSsoConfig, cookies: CookieReader): Promise<{
+    current: string;
+    pending: string;
+} | null>;
+declare function switchAccount(config: ReaderSsoConfig, input: {
+    choice: unknown;
+    cookies: CookieReader;
+}): Promise<SwitchAccountResult>;
+type SignOutResult = {
+    cookies: CookieInstruction[];
+    endSessionUrl: string;
+    state: string;
+};
+declare function signOut(config: ReaderSsoConfig, input: {
+    cookies: CookieReader;
+    extraCookies?: CookieInstruction[];
+}): Promise<SignOutResult>;
+type SessionSummary = {
+    authenticated: false;
+} | {
+    authenticated: true;
+    full_name: string;
+    locale?: string;
+    time_zone?: string;
+};
+declare function sessionSummary(config: ReaderSsoConfig, cookies: CookieReader): Promise<SessionSummary>;
+/**
+ * Session summary plus the cookies to clear when a present session cookie no
+ * longer validates (revoked elsewhere). The site's session route applies them
+ * so a stale cookie stops suppressing sign-in (release review R5).
+ */
+declare function sessionSummaryWithCookies(config: ReaderSsoConfig, cookies: CookieReader): Promise<{
+    summary: SessionSummary;
+    cookies: CookieInstruction[];
+}>;
+/** Flags the layout passes to `ReaderSsoBoot`; the cookies themselves are HttpOnly. */
+declare function readerSsoBootFlags(cookies: CookieReader, names: ReaderSsoCookieNames): {
+    hasSession: boolean;
+    suppressed: boolean;
+};
+
+export { type CompleteSignInInput, type CompleteSignInResult, type CookieInstruction, type CookieReader, LEDVERY_ISSUER_ORIGIN, type LinkAccountInput, type LinkAccountResult, type PendingSession, READER_SSO_FLOW_SECONDS, READER_SSO_NEGATIVE_CACHE_SECONDS, READER_SSO_PENDING_SECONDS, READER_SSO_SIGNED_OUT_SECONDS, type ReaderSsoCheckOutcome, type ReaderSsoConfig, type ReaderSsoCookieNames, type ReaderSsoEvent, type ReaderSsoFailure, type ReaderSsoFlow, type ReaderSsoMethod, type ReaderSsoMode, type ReaderSsoProvider, type ReaderSsoRequest, type ReaderSsoResponse, SILENT_NEGATIVE_ERRORS, type SessionSummary, type SessionUser, type SignOutResult, type StartSignInInput, type StartSignInResult, type SwitchAccountResult, applyCookies, authorizeUrl, completeSignIn, cookieReader, linkAccount, linkFailureMessage, localReturnPath, openPendingSession, openReaderFlow, pendingSwitch, precedence, readerSsoBootFlags, readerSsoCookieNames, readerSsoCookieOptions, sealPendingSession, sealReaderFlow, sessionSummary, sessionSummaryWithCookies, setCookieHeader, signOut, startSignIn, stateDigest, switchAccount, validState };

package/dist/reader-sso.d.ts

@@ -0,0 +1,318 @@
+export { R as READER_SSO_EVENTS, a as READER_SSO_PROPERTY_KEYS, b as ReaderSsoEventDefinition, c as ReaderSsoEventName } from './reader-sso-events-DBw8pGSM.js';
+
+type ReaderSsoMode = "interactive" | "silent";
+type ReaderSsoProvider = "google" | "email";
+type ReaderSsoMethod = ReaderSsoProvider | "link" | "switch" | "unknown";
+declare const READER_SSO_FLOW_SECONDS = 600;
+declare const READER_SSO_NEGATIVE_CACHE_SECONDS = 300;
+declare const READER_SSO_SIGNED_OUT_SECONDS = 86400;
+declare const READER_SSO_PENDING_SECONDS = 600;
+declare const LEDVERY_ISSUER_ORIGIN = "https://api.ledvery.com";
+/** Ledvery results that mean "no silent session here"; never authentication failures. */
+declare const SILENT_NEGATIVE_ERRORS: readonly ["login_required", "consent_required", "interaction_required", "account_selection_required"];
+type ReaderSsoCookieNames = {
+    /** The reader's platform session token. */
+    session: string;
+    /** Sealed sign-in transaction (10 minutes). */
+    flow: string;
+    /** Newsletter consent carried through email verification. */
+    newsletter: string;
+    /** Negative cache: a silent check ran recently and found nothing. */
+    ssoChecked: string;
+    /** Explicit sign-out: silent sign-in stays off until an explicit sign-in. */
+    signedOut: string;
+    /** A verified session waiting for the reader to choose between two accounts. */
+    pending: string;
+};
+/** Cookie names derived from a `__Host-` prefix, e.g. `__Host-media` → `__Host-media-reader`. */
+declare function readerSsoCookieNames(prefix: string): ReaderSsoCookieNames;
+/** One Set-Cookie instruction. Every reader cookie is host-only, HttpOnly, Secure and Lax. */
+type CookieInstruction = {
+    name: string;
+    value: string;
+    maxAge?: number;
+    expires?: Date;
+};
+declare const readerSsoCookieOptions: {
+    httpOnly: boolean;
+    secure: boolean;
+    sameSite: "lax";
+    path: string;
+};
+/** Apply instructions to a Next.js `cookies()` jar (or anything with the same `set`). */
+declare function applyCookies(jar: {
+    set(name: string, value: string, options: typeof readerSsoCookieOptions & {
+        maxAge?: number;
+        expires?: Date;
+    }): unknown;
+}, cookies: CookieInstruction[]): void;
+/** The same instruction as a raw Set-Cookie header value. */
+declare function setCookieHeader(cookie: CookieInstruction): string;
+type CookieReader = (name: string) => string | undefined;
+/** Read a cookie from a Cookie header. A name sent twice is treated as absent. */
+declare function cookieReader(header: string | null | undefined): CookieReader;
+type ReaderSsoFailure = "cancelled" | "provider_error" | "state" | "exchange" | "unverified" | "session" | "unavailable" | "link_invalid" | "disabled" | "mfa_required";
+type ReaderSsoCheckOutcome = (typeof SILENT_NEGATIVE_ERRORS)[number] | "error" | "link_required" | "suppressed" | "switch_offered" | "switch_declined";
+type ReaderSsoEvent = {
+    name: "reader_signin_started";
+    properties: {
+        method: ReaderSsoMethod;
+        mode: ReaderSsoMode;
+        transaction: string;
+    };
+} | {
+    name: "reader_signin_completed";
+    properties: {
+        method: ReaderSsoMethod;
+        mode: ReaderSsoMode;
+        is_new: "true" | "false";
+        transaction?: string;
+    };
+} | {
+    name: "reader_signin_failed";
+    properties: {
+        reason: ReaderSsoFailure;
+        mode: ReaderSsoMode;
+        transaction?: string;
+    };
+} | {
+    name: "reader_sso_check";
+    properties: {
+        outcome: ReaderSsoCheckOutcome;
+        mode: ReaderSsoMode;
+        transaction?: string;
+    };
+} | {
+    name: "reader_signed_out";
+    properties: {
+        method: "explicit";
+    };
+} | {
+    name: "reader_account_linked";
+    properties: {
+        transaction?: string;
+    };
+};
+
+type ReaderSsoResponse = {
+    status: number;
+    body: unknown;
+};
+type ReaderSsoRequest = (path: string, init: {
+    method: "GET" | "POST";
+    body?: unknown;
+    token?: string;
+}) => Promise<ReaderSsoResponse>;
+type ReaderSsoConfig = {
+    /** `__Host-media` on most papers; `__Host-trivalley` on Tri-Valley Weekly. */
+    prefix: string;
+    /** HMAC key for sealed cookies. The site's API key is used today; never sent to the browser. */
+    key: string;
+    /** Canonical https origin of the publication, e.g. `https://sanramontimes.com`. */
+    origin: string;
+    /** Ledvery OIDC client id for this publication (env LEDVERY_CLIENT_ID, default `napsite-<slug>`). */
+    clientId: string;
+    request: ReaderSsoRequest;
+    record?: (event: ReaderSsoEvent) => void;
+    callbackPath?: string;
+    accountPath?: string;
+    issuerOrigin?: string;
+    /** Explicit email sign-in through Ledvery (env LEDVERY_EMAIL_SIGNIN); off by default. */
+    emailSignIn?: boolean;
+    /** Emergency off switch for all Ledvery sign-in. */
+    enabled?: boolean;
+    /** Validates a local return path per mode; returns "" when the path is not allowed. */
+    returnPath?: (next: string, mode: ReaderSsoMode) => string;
+    /** Where an interactive failure sends the reader; defaults to `/account?signin=retry[&next=]`. */
+    retryPath?: (flow: ReaderSsoFlow | null) => string;
+    now?: () => number;
+    random?: () => string;
+};
+/** Any same-site path: no protocol-relative URLs, control characters or API routes. */
+declare function localReturnPath(value: unknown): string;
+declare function stateDigest(state: string): string;
+declare function validState(state: string | null | undefined, digest: string | undefined): boolean;
+type ReaderSsoFlow = {
+    digest: string;
+    subscribe: boolean;
+    expires: number;
+    returnTo: string;
+    mode: ReaderSsoMode;
+    provider?: ReaderSsoProvider;
+    tx?: string;
+};
+declare function sealReaderFlow(input: {
+    state: string;
+    subscribe?: boolean;
+    returnTo?: string;
+    mode?: ReaderSsoMode;
+    provider?: ReaderSsoProvider;
+    tx?: string;
+}, key: string, now?: number): string;
+declare function openReaderFlow(cookie: string | undefined, key: string, now?: number, returnPath?: (next: string, mode: ReaderSsoMode) => string): ReaderSsoFlow | null;
+/** A verified session the reader has not yet chosen over their current one. */
+type PendingSession = {
+    token: string;
+    expires: number;
+    userId: string;
+    name: string;
+    mode: ReaderSsoMode;
+    method: ReaderSsoMethod;
+    returnTo: string;
+    subscribe: boolean;
+    tx?: string;
+};
+declare function sealPendingSession(pending: PendingSession, key: string, now?: number): string;
+declare function openPendingSession(cookie: string | undefined, key: string, now?: number): PendingSession | null;
+declare function authorizeUrl(value: string, state: string, callback: string, mode: ReaderSsoMode, issuerOrigin?: string): string;
+type StartSignInInput = {
+    mode: ReaderSsoMode;
+    provider?: ReaderSsoProvider;
+    subscribe?: boolean;
+    next?: string;
+    cookies: CookieReader;
+};
+type StartSignInResult = {
+    ok: true;
+    url: string;
+    tx: string;
+    cookies: CookieInstruction[];
+} | {
+    ok: false;
+    status: number;
+    error: string;
+    reason: "disabled" | "suppressed" | "session" | "unavailable" | "provider";
+    redirect: string;
+    cookies: CookieInstruction[];
+};
+declare function startSignIn(config: ReaderSsoConfig, input: StartSignInInput): Promise<StartSignInResult>;
+type SessionUser = {
+    id: string;
+    email_verified: boolean;
+    full_name: string;
+    locale?: string;
+    time_zone?: string;
+};
+/** ADR 3.2: an active session for Bob is never replaced by Alice without an explicit choice. */
+declare function precedence(current: SessionUser | null, incoming: SessionUser): "replace" | "renew" | "switch";
+type CompleteSignInInput = {
+    url: string | URL;
+    cookies: CookieReader;
+};
+type CompleteSignInResult = {
+    kind: "redirect";
+    location: string;
+    cookies: CookieInstruction[];
+    outcome: ReaderSsoCheckOutcome | ReaderSsoFailure;
+    flow: ReaderSsoFlow | null;
+} | {
+    kind: "signed-in";
+    location: string;
+    cookies: CookieInstruction[];
+    token: string;
+    expiresAt: Date;
+    user: SessionUser;
+    flow: ReaderSsoFlow;
+    isNew: boolean;
+};
+/**
+ * Finish a transaction that Ledvery returned to the callback. Produces cookies and
+ * a destination; the caller subscribes to the newsletter (interactive consent only)
+ * and performs the redirect with private, no-store headers.
+ */
+declare function completeSignIn(config: ReaderSsoConfig, input: CompleteSignInInput): Promise<CompleteSignInResult>;
+type LinkAccountInput = {
+    challenge_id: unknown;
+    password: unknown;
+    mfa_code?: unknown;
+    cookies: CookieReader;
+    next?: string;
+    subscribe?: boolean;
+};
+type LinkAccountResult = {
+    ok: true;
+    switch: false;
+    cookies: CookieInstruction[];
+    token: string;
+    expiresAt: Date;
+    user: SessionUser;
+    location: string;
+} | {
+    ok: true;
+    switch: true;
+    cookies: CookieInstruction[];
+    location: string;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+    cookies: CookieInstruction[];
+    mfaRequired?: boolean;
+};
+/** Platform answers to an ownership proof that are not a plain "wrong details". */
+declare function linkFailureMessage(code: string): {
+    error: string;
+    mfaRequired?: boolean;
+} | null;
+declare function linkAccount(config: ReaderSsoConfig, input: LinkAccountInput): Promise<LinkAccountResult>;
+type SwitchAccountResult = {
+    ok: true;
+    choice: "continue";
+    cookies: CookieInstruction[];
+    token: string;
+    location: string;
+    subscribe: boolean;
+} | {
+    ok: true;
+    choice: "stay";
+    cookies: CookieInstruction[];
+    location: string;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+    cookies: CookieInstruction[];
+};
+/** Names shown on the switch prompt. Nothing here is ever an email address. */
+declare function pendingSwitch(config: ReaderSsoConfig, cookies: CookieReader): Promise<{
+    current: string;
+    pending: string;
+} | null>;
+declare function switchAccount(config: ReaderSsoConfig, input: {
+    choice: unknown;
+    cookies: CookieReader;
+}): Promise<SwitchAccountResult>;
+type SignOutResult = {
+    cookies: CookieInstruction[];
+    endSessionUrl: string;
+    state: string;
+};
+declare function signOut(config: ReaderSsoConfig, input: {
+    cookies: CookieReader;
+    extraCookies?: CookieInstruction[];
+}): Promise<SignOutResult>;
+type SessionSummary = {
+    authenticated: false;
+} | {
+    authenticated: true;
+    full_name: string;
+    locale?: string;
+    time_zone?: string;
+};
+declare function sessionSummary(config: ReaderSsoConfig, cookies: CookieReader): Promise<SessionSummary>;
+/**
+ * Session summary plus the cookies to clear when a present session cookie no
+ * longer validates (revoked elsewhere). The site's session route applies them
+ * so a stale cookie stops suppressing sign-in (release review R5).
+ */
+declare function sessionSummaryWithCookies(config: ReaderSsoConfig, cookies: CookieReader): Promise<{
+    summary: SessionSummary;
+    cookies: CookieInstruction[];
+}>;
+/** Flags the layout passes to `ReaderSsoBoot`; the cookies themselves are HttpOnly. */
+declare function readerSsoBootFlags(cookies: CookieReader, names: ReaderSsoCookieNames): {
+    hasSession: boolean;
+    suppressed: boolean;
+};
+
+export { type CompleteSignInInput, type CompleteSignInResult, type CookieInstruction, type CookieReader, LEDVERY_ISSUER_ORIGIN, type LinkAccountInput, type LinkAccountResult, type PendingSession, READER_SSO_FLOW_SECONDS, READER_SSO_NEGATIVE_CACHE_SECONDS, READER_SSO_PENDING_SECONDS, READER_SSO_SIGNED_OUT_SECONDS, type ReaderSsoCheckOutcome, type ReaderSsoConfig, type ReaderSsoCookieNames, type ReaderSsoEvent, type ReaderSsoFailure, type ReaderSsoFlow, type ReaderSsoMethod, type ReaderSsoMode, type ReaderSsoProvider, type ReaderSsoRequest, type ReaderSsoResponse, SILENT_NEGATIVE_ERRORS, type SessionSummary, type SessionUser, type SignOutResult, type StartSignInInput, type StartSignInResult, type SwitchAccountResult, applyCookies, authorizeUrl, completeSignIn, cookieReader, linkAccount, linkFailureMessage, localReturnPath, openPendingSession, openReaderFlow, pendingSwitch, precedence, readerSsoBootFlags, readerSsoCookieNames, readerSsoCookieOptions, sealPendingSession, sealReaderFlow, sessionSummary, sessionSummaryWithCookies, setCookieHeader, signOut, startSignIn, stateDigest, switchAccount, validState };