@scalemule/news-publication 0.0.70 → 0.0.73

package/dist/reader-sso-client.d.cts

@@ -0,0 +1,131 @@
+import * as React from 'react';
+
+type ReaderSsoProvider = "google" | "email";
+declare const READER_SSO_BOT_PATTERN: RegExp;
+/** Pages where a background navigation would be unwelcome or pointless. */
+declare const READER_SSO_PRIVATE_PATHS: RegExp[];
+/** One attempt per browser session window; the server's negative cache is the real guard. */
+declare const READER_SSO_ATTEMPT_WINDOW_MS: number;
+type SilentSignInEnvironment = {
+    enabled: boolean;
+    hasSession: boolean;
+    suppressed: boolean;
+    webdriver: boolean;
+    userAgent: string;
+    pathname: string;
+    search: string;
+    fieldFocused: boolean;
+    prerendering: boolean;
+    visibilityState: string;
+    framed: boolean;
+    lastAttemptAt: number | null;
+    now: number;
+    privatePaths?: RegExp[];
+};
+type SilentSignInDecision = {
+    attempt: true;
+} | {
+    attempt: false;
+    reason: string;
+};
+declare function silentSignInDecision(env: SilentSignInEnvironment): SilentSignInDecision;
+declare function silentSignInUrl(startPath: string, pathname: string, search: string): string;
+declare function isFormField(element: Element | null): boolean;
+/**
+ * Renders nothing. Once per page load, after `load` and an idle period, performs a
+ * top-level navigation to the silent sign-in start route when nothing argues
+ * against it. The server sets the negative-cache cookie on every silent negative,
+ * so this can never loop.
+ */
+declare function ReaderSsoBoot({ enabled, hasSession: hasSessionCookie, suppressed, startPath, sessionPath, privatePaths, idleDelayMs }: {
+    enabled?: boolean;
+    /** A reader session cookie is present (it may have been revoked elsewhere). */
+    hasSession: boolean;
+    suppressed: boolean;
+    startPath?: string;
+    /** Private, no-store endpoint that validates the cookie and clears it when stale. */
+    sessionPath?: string;
+    privatePaths?: RegExp[];
+    idleDelayMs?: number;
+}): null;
+type GreetingProfile = {
+    full_name?: string | null;
+    locale?: string | null;
+    time_zone?: string | null;
+};
+/** The first whitespace-separated token of a display name, Unicode-safe, at most 40 characters. */
+declare function firstName(fullName: string | null | undefined): string;
+declare function localHour(now: Date, timeZone?: string | null, locale?: string | null): number;
+declare function greetingWord(hour: number): "Good morning" | "Good afternoon" | "Good evening";
+declare function greetingText(profile: GreetingProfile, now?: Date, fallback?: string): string;
+type SessionSummaryResponse = {
+    authenticated: boolean;
+    full_name?: string;
+    locale?: string;
+    time_zone?: string;
+};
+declare function ReaderGreeting({ endpoint, className, fallback, as: Tag }: {
+    endpoint?: string;
+    className?: string;
+    fallback?: string;
+    as?: "span" | "p" | "div";
+}): React.JSX.Element | null;
+type ReaderSsoClassNames = {
+    wrapper?: string;
+    button?: string;
+    fine?: string;
+    error?: string;
+    form?: string;
+    secondary?: string;
+};
+declare const LEDVERY_BUTTON_LABELS: Record<ReaderSsoProvider, {
+    label: string;
+    busy: string;
+}>;
+declare function LedveryButton({ provider, subscribe, disabled, returnTo, startPath, label, busyLabel, description, classNames, onStart, }: {
+    provider?: ReaderSsoProvider;
+    subscribe?: boolean;
+    disabled?: boolean;
+    returnTo?: string;
+    startPath?: string;
+    label?: string;
+    busyLabel?: string;
+    description?: string;
+    classNames?: ReaderSsoClassNames;
+    onStart?: (provider: ReaderSsoProvider) => void;
+}): React.JSX.Element;
+type LinkResult = {
+    user?: {
+        id: string;
+        email?: string;
+        email_verified?: boolean;
+    };
+    switch?: boolean;
+    location?: string;
+};
+/** Password proof for an existing local account (HTTP 409 LINK_REQUIRED from the callback). */
+declare function AccountLinkForm({ challengeId, hint, endpoint, next, subscribe, classNames, onLinked, onCancel, }: {
+    challengeId: string;
+    hint?: string;
+    endpoint?: string;
+    next?: string;
+    subscribe?: boolean;
+    classNames?: ReaderSsoClassNames;
+    onLinked?: (result: LinkResult) => void;
+    onCancel?: () => void;
+}): React.JSX.Element;
+type SwitchChoice = "continue" | "stay";
+type SwitchResult = {
+    choice?: SwitchChoice;
+    location?: string;
+};
+/** ADR 3.2: Bob stays signed in until the reader explicitly chooses Alice. */
+declare function AccountSwitchPrompt({ currentName, pendingName, endpoint, classNames, onDone, }: {
+    currentName: string;
+    pendingName: string;
+    endpoint?: string;
+    classNames?: ReaderSsoClassNames;
+    onDone?: (result: SwitchResult) => void;
+}): React.JSX.Element;
+
+export { AccountLinkForm, AccountSwitchPrompt, type GreetingProfile, LEDVERY_BUTTON_LABELS, LedveryButton, type LinkResult, READER_SSO_ATTEMPT_WINDOW_MS, READER_SSO_BOT_PATTERN, READER_SSO_PRIVATE_PATHS, ReaderGreeting, ReaderSsoBoot, type ReaderSsoClassNames, type ReaderSsoProvider, type SessionSummaryResponse, type SilentSignInDecision, type SilentSignInEnvironment, type SwitchChoice, type SwitchResult, firstName, greetingText, greetingWord, isFormField, localHour, silentSignInDecision, silentSignInUrl };

package/dist/reader-sso-client.d.ts

@@ -0,0 +1,131 @@
+import * as React from 'react';
+
+type ReaderSsoProvider = "google" | "email";
+declare const READER_SSO_BOT_PATTERN: RegExp;
+/** Pages where a background navigation would be unwelcome or pointless. */
+declare const READER_SSO_PRIVATE_PATHS: RegExp[];
+/** One attempt per browser session window; the server's negative cache is the real guard. */
+declare const READER_SSO_ATTEMPT_WINDOW_MS: number;
+type SilentSignInEnvironment = {
+    enabled: boolean;
+    hasSession: boolean;
+    suppressed: boolean;
+    webdriver: boolean;
+    userAgent: string;
+    pathname: string;
+    search: string;
+    fieldFocused: boolean;
+    prerendering: boolean;
+    visibilityState: string;
+    framed: boolean;
+    lastAttemptAt: number | null;
+    now: number;
+    privatePaths?: RegExp[];
+};
+type SilentSignInDecision = {
+    attempt: true;
+} | {
+    attempt: false;
+    reason: string;
+};
+declare function silentSignInDecision(env: SilentSignInEnvironment): SilentSignInDecision;
+declare function silentSignInUrl(startPath: string, pathname: string, search: string): string;
+declare function isFormField(element: Element | null): boolean;
+/**
+ * Renders nothing. Once per page load, after `load` and an idle period, performs a
+ * top-level navigation to the silent sign-in start route when nothing argues
+ * against it. The server sets the negative-cache cookie on every silent negative,
+ * so this can never loop.
+ */
+declare function ReaderSsoBoot({ enabled, hasSession: hasSessionCookie, suppressed, startPath, sessionPath, privatePaths, idleDelayMs }: {
+    enabled?: boolean;
+    /** A reader session cookie is present (it may have been revoked elsewhere). */
+    hasSession: boolean;
+    suppressed: boolean;
+    startPath?: string;
+    /** Private, no-store endpoint that validates the cookie and clears it when stale. */
+    sessionPath?: string;
+    privatePaths?: RegExp[];
+    idleDelayMs?: number;
+}): null;
+type GreetingProfile = {
+    full_name?: string | null;
+    locale?: string | null;
+    time_zone?: string | null;
+};
+/** The first whitespace-separated token of a display name, Unicode-safe, at most 40 characters. */
+declare function firstName(fullName: string | null | undefined): string;
+declare function localHour(now: Date, timeZone?: string | null, locale?: string | null): number;
+declare function greetingWord(hour: number): "Good morning" | "Good afternoon" | "Good evening";
+declare function greetingText(profile: GreetingProfile, now?: Date, fallback?: string): string;
+type SessionSummaryResponse = {
+    authenticated: boolean;
+    full_name?: string;
+    locale?: string;
+    time_zone?: string;
+};
+declare function ReaderGreeting({ endpoint, className, fallback, as: Tag }: {
+    endpoint?: string;
+    className?: string;
+    fallback?: string;
+    as?: "span" | "p" | "div";
+}): React.JSX.Element | null;
+type ReaderSsoClassNames = {
+    wrapper?: string;
+    button?: string;
+    fine?: string;
+    error?: string;
+    form?: string;
+    secondary?: string;
+};
+declare const LEDVERY_BUTTON_LABELS: Record<ReaderSsoProvider, {
+    label: string;
+    busy: string;
+}>;
+declare function LedveryButton({ provider, subscribe, disabled, returnTo, startPath, label, busyLabel, description, classNames, onStart, }: {
+    provider?: ReaderSsoProvider;
+    subscribe?: boolean;
+    disabled?: boolean;
+    returnTo?: string;
+    startPath?: string;
+    label?: string;
+    busyLabel?: string;
+    description?: string;
+    classNames?: ReaderSsoClassNames;
+    onStart?: (provider: ReaderSsoProvider) => void;
+}): React.JSX.Element;
+type LinkResult = {
+    user?: {
+        id: string;
+        email?: string;
+        email_verified?: boolean;
+    };
+    switch?: boolean;
+    location?: string;
+};
+/** Password proof for an existing local account (HTTP 409 LINK_REQUIRED from the callback). */
+declare function AccountLinkForm({ challengeId, hint, endpoint, next, subscribe, classNames, onLinked, onCancel, }: {
+    challengeId: string;
+    hint?: string;
+    endpoint?: string;
+    next?: string;
+    subscribe?: boolean;
+    classNames?: ReaderSsoClassNames;
+    onLinked?: (result: LinkResult) => void;
+    onCancel?: () => void;
+}): React.JSX.Element;
+type SwitchChoice = "continue" | "stay";
+type SwitchResult = {
+    choice?: SwitchChoice;
+    location?: string;
+};
+/** ADR 3.2: Bob stays signed in until the reader explicitly chooses Alice. */
+declare function AccountSwitchPrompt({ currentName, pendingName, endpoint, classNames, onDone, }: {
+    currentName: string;
+    pendingName: string;
+    endpoint?: string;
+    classNames?: ReaderSsoClassNames;
+    onDone?: (result: SwitchResult) => void;
+}): React.JSX.Element;
+
+export { AccountLinkForm, AccountSwitchPrompt, type GreetingProfile, LEDVERY_BUTTON_LABELS, LedveryButton, type LinkResult, READER_SSO_ATTEMPT_WINDOW_MS, READER_SSO_BOT_PATTERN, READER_SSO_PRIVATE_PATHS, ReaderGreeting, ReaderSsoBoot, type ReaderSsoClassNames, type ReaderSsoProvider, type SessionSummaryResponse, type SilentSignInDecision, type SilentSignInEnvironment, type SwitchChoice, type SwitchResult, firstName, greetingText, greetingWord, isFormField, localHour, silentSignInDecision, silentSignInUrl };

package/dist/reader-sso-client.js

@@ -0,0 +1,347 @@
+"use client";
+import { useState, useEffect, useId } from 'react';
+import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
+
+var READER_SSO_BOT_PATTERN = /bot|crawl|spider|headless|lighthouse|pagespeed|preview|slurp|facebookexternalhit|embedly|python|curl|wget|phantom|puppeteer|playwright|selenium|prerender/i;
+var READER_SSO_PRIVATE_PATHS = [
+  /^\/account(\/|$)/,
+  /^\/api(\/|$)/,
+  /^\/review(\/|$)/,
+  /^\/reset-password(\/|$)/,
+  /^\/verify-email(\/|$)/,
+  /^\/claim(\/|$)/,
+  /^\/tip(\/|$)/,
+  /^\/news\/unsubscribe(\/|$)/,
+  /^\/pets\/account(\/|$)/,
+  /^\/newsletter(\/|$)/
+];
+var FLOW_QUERY = ["signin", "signed_out", "switch", "link", "subscription", "code", "state", "error"];
+var READER_SSO_ATTEMPT_WINDOW_MS = 5 * 6e4;
+function silentSignInDecision(env) {
+  if (!env.enabled) return { attempt: false, reason: "disabled" };
+  if (env.hasSession) return { attempt: false, reason: "session" };
+  if (env.suppressed) return { attempt: false, reason: "suppressed" };
+  if (env.webdriver) return { attempt: false, reason: "webdriver" };
+  if (!env.userAgent || READER_SSO_BOT_PATTERN.test(env.userAgent)) return { attempt: false, reason: "bot" };
+  if (env.framed) return { attempt: false, reason: "framed" };
+  if (env.prerendering || env.visibilityState !== "visible") return { attempt: false, reason: "hidden" };
+  if ((env.privatePaths ?? READER_SSO_PRIVATE_PATHS).some((pattern) => pattern.test(env.pathname))) return { attempt: false, reason: "private" };
+  const params = new URLSearchParams(env.search);
+  if (FLOW_QUERY.some((key) => params.has(key))) return { attempt: false, reason: "flow" };
+  if (env.fieldFocused) return { attempt: false, reason: "typing" };
+  if (env.lastAttemptAt !== null && env.now - env.lastAttemptAt < READER_SSO_ATTEMPT_WINDOW_MS) return { attempt: false, reason: "recent" };
+  return { attempt: true };
+}
+function silentSignInUrl(startPath, pathname, search) {
+  return `${startPath}?${new URLSearchParams({ mode: "silent", next: pathname + search })}`;
+}
+function isFormField(element) {
+  if (!element) return false;
+  const tag = element.tagName;
+  return tag === "INPUT" || tag === "TEXTAREA" || tag === "SELECT" || element.isContentEditable === true;
+}
+var ATTEMPT_KEY = "reader-sso-attempt-v1";
+function readAttempt() {
+  try {
+    const raw = window.sessionStorage.getItem(ATTEMPT_KEY);
+    const value = raw ? Number(raw) : NaN;
+    return Number.isFinite(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function writeAttempt(now) {
+  try {
+    window.sessionStorage.setItem(ATTEMPT_KEY, String(now));
+  } catch {
+  }
+}
+function browserEnvironment(flags) {
+  const doc = document;
+  let framed = false;
+  try {
+    framed = window.top !== window.self;
+  } catch {
+    framed = true;
+  }
+  return {
+    ...flags,
+    webdriver: navigator.webdriver === true,
+    userAgent: navigator.userAgent,
+    pathname: location.pathname,
+    search: location.search,
+    fieldFocused: isFormField(document.activeElement),
+    prerendering: doc.prerendering === true,
+    visibilityState: document.visibilityState,
+    framed,
+    lastAttemptAt: readAttempt(),
+    now: Date.now()
+  };
+}
+function ReaderSsoBoot({ enabled = true, hasSession: hasSessionCookie, suppressed, startPath = "/api/news/ledvery-start", sessionPath = "/api/news/session", privatePaths, idleDelayMs = 1500 }) {
+  const [staleCookie, setStaleCookie] = useState(false);
+  useEffect(() => {
+    if (!enabled || !hasSessionCookie || staleCookie) return;
+    let cancelled = false;
+    fetch(sessionPath, { credentials: "same-origin", cache: "no-store" }).then((response) => response.json()).then((body) => {
+      if (!cancelled && body?.authenticated !== true) setStaleCookie(true);
+    }).catch(() => {
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [enabled, hasSessionCookie, staleCookie, sessionPath]);
+  const hasSession = hasSessionCookie && !staleCookie;
+  useEffect(() => {
+    if (silentSignInDecision(browserEnvironment({ enabled, hasSession, suppressed, privatePaths })).attempt !== true) return;
+    let cancelled = false;
+    let idle;
+    const go = () => {
+      if (cancelled) return;
+      const env = browserEnvironment({ enabled, hasSession, suppressed, privatePaths });
+      if (silentSignInDecision(env).attempt !== true) return;
+      writeAttempt(env.now);
+      window.location.assign(silentSignInUrl(startPath, env.pathname, env.search));
+    };
+    const whenIdle = () => {
+      const w = window;
+      if (typeof w.requestIdleCallback === "function") idle = w.requestIdleCallback(() => {
+        idle = window.setTimeout(go, idleDelayMs);
+      }, { timeout: 4e3 });
+      else idle = window.setTimeout(go, idleDelayMs);
+    };
+    if (document.readyState === "complete") whenIdle();
+    else window.addEventListener("load", whenIdle, { once: true });
+    return () => {
+      cancelled = true;
+      window.removeEventListener("load", whenIdle);
+      if (idle !== void 0) window.clearTimeout(idle);
+    };
+  }, [enabled, hasSession, suppressed, startPath, privatePaths, idleDelayMs]);
+  return null;
+}
+function firstName(fullName) {
+  if (typeof fullName !== "string") return "";
+  const token = fullName.replace(/[\u0000-\u001f\u007f]/g, " ").trim().split(/\s+/u)[0] ?? "";
+  return Array.from(token).slice(0, 40).join("");
+}
+function localHour(now, timeZone, locale) {
+  const options = { hour: "numeric", hourCycle: "h23" };
+  const attempts = [[locale ?? void 0, timeZone ?? void 0], [void 0, timeZone ?? void 0], [void 0, void 0]];
+  for (const [loc, tz] of attempts) {
+    try {
+      const part = new Intl.DateTimeFormat(loc, { ...options, ...tz ? { timeZone: tz } : {} }).formatToParts(now).find((p) => p.type === "hour");
+      const hour = part ? Number(part.value) : NaN;
+      if (Number.isInteger(hour) && hour >= 0 && hour < 24) return hour;
+    } catch {
+    }
+  }
+  return now.getHours();
+}
+function greetingWord(hour) {
+  if (hour >= 5 && hour < 12) return "Good morning";
+  if (hour >= 12 && hour < 18) return "Good afternoon";
+  return "Good evening";
+}
+function greetingText(profile, now = /* @__PURE__ */ new Date(), fallback = "Welcome back") {
+  const name = firstName(profile.full_name);
+  if (!name) return fallback;
+  return `${greetingWord(localHour(now, profile.time_zone, profile.locale))}, ${name}`;
+}
+function ReaderGreeting({ endpoint = "/api/news/session", className, fallback = "Welcome back", as: Tag = "span" }) {
+  const [text, setText] = useState(null);
+  useEffect(() => {
+    let alive = true;
+    const controller = new AbortController();
+    fetch(endpoint, { credentials: "same-origin", cache: "no-store", signal: controller.signal }).then((response) => response.ok ? response.json() : null).then((summary) => {
+      if (!alive || !summary || summary.authenticated !== true) return;
+      setText(greetingText(summary, /* @__PURE__ */ new Date(), fallback));
+    }).catch(() => {
+    });
+    return () => {
+      alive = false;
+      controller.abort();
+    };
+  }, [endpoint, fallback]);
+  if (text === null) return null;
+  return /* @__PURE__ */ jsx(Tag, { className, "data-reader-greeting": "", children: text });
+}
+async function postJson(endpoint, body, timeoutMs = 3e4) {
+  const response = await fetch(endpoint, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+    credentials: "same-origin",
+    signal: AbortSignal.timeout(timeoutMs)
+  });
+  const data = await response.json().catch(() => ({}));
+  if (!response.ok) throw Object.assign(new Error(data.error || "Please try again."), { mfaRequired: data.mfa_required === true });
+  return data;
+}
+function GoogleMark() {
+  return /* @__PURE__ */ jsxs("svg", { width: "20", height: "20", viewBox: "0 0 24 24", "aria-hidden": "true", children: [
+    /* @__PURE__ */ jsx("path", { d: "M21.805 10.023H12.24v3.955h5.483c-.237 1.273-.958 2.352-2.042 3.073v2.552h3.305c1.936-1.782 3.05-4.41 3.05-7.603 0-.676-.06-1.326-.171-1.977Z", fill: "#4285F4" }),
+    /* @__PURE__ */ jsx("path", { d: "M12.24 22c2.745 0 5.047-.909 6.73-2.447l-3.305-2.552c-.918.615-2.094.978-3.425.978-2.636 0-4.87-1.78-5.67-4.173H3.154v2.632A10.16 10.16 0 0 0 12.24 22Z", fill: "#34A853" }),
+    /* @__PURE__ */ jsx("path", { d: "M6.57 13.806A6.112 6.112 0 0 1 6.253 12c0-.627.109-1.235.317-1.806V7.562H3.154A10.157 10.157 0 0 0 2 12c0 1.633.39 3.177 1.154 4.438l3.416-2.632Z", fill: "#FBBC04" }),
+    /* @__PURE__ */ jsx("path", { d: "M12.24 6.02c1.493 0 2.833.514 3.888 1.523l2.913-2.913C17.281 2.998 14.979 2 12.24 2A10.16 10.16 0 0 0 3.154 7.562l3.416 2.632c.8-2.393 3.034-4.174 5.67-4.174Z", fill: "#EA4335" })
+  ] });
+}
+function MailMark() {
+  return /* @__PURE__ */ jsxs("svg", { width: "20", height: "20", viewBox: "0 0 24 24", "aria-hidden": "true", fill: "none", stroke: "currentColor", strokeWidth: "1.8", strokeLinecap: "round", strokeLinejoin: "round", children: [
+    /* @__PURE__ */ jsx("rect", { x: "3", y: "5", width: "18", height: "14", rx: "2" }),
+    /* @__PURE__ */ jsx("path", { d: "m3 7 9 6 9-6" })
+  ] });
+}
+var LEDVERY_BUTTON_LABELS = {
+  google: { label: "Continue with Google", busy: "Opening Google\u2026" },
+  email: { label: "Continue with email", busy: "Opening sign-in\u2026" }
+};
+function LedveryButton({
+  provider = "google",
+  subscribe = false,
+  disabled = false,
+  returnTo = "",
+  startPath = "/api/news/ledvery-start",
+  label,
+  busyLabel,
+  description,
+  classNames = {},
+  onStart
+}) {
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState("");
+  const descriptionId = useId();
+  const labels = LEDVERY_BUTTON_LABELS[provider];
+  return /* @__PURE__ */ jsxs("div", { className: classNames.wrapper, "data-reader-signin": provider, children: [
+    /* @__PURE__ */ jsxs(
+      "button",
+      {
+        type: "button",
+        className: classNames.button,
+        disabled: busy || disabled,
+        "aria-describedby": description ? descriptionId : void 0,
+        onClick: async () => {
+          setBusy(true);
+          setError("");
+          try {
+            onStart?.(provider);
+          } catch {
+          }
+          try {
+            const data = await postJson(startPath, { provider, subscribe, consent: subscribe, returnTo });
+            if (!data.url) throw new Error("Sign-in is temporarily unavailable. Please try again.");
+            window.location.assign(data.url);
+          } catch (e) {
+            setError(e instanceof Error ? e.message : "Please try again.");
+            setBusy(false);
+          }
+        },
+        children: [
+          provider === "google" ? /* @__PURE__ */ jsx(GoogleMark, {}) : /* @__PURE__ */ jsx(MailMark, {}),
+          /* @__PURE__ */ jsx("span", { children: busy ? busyLabel ?? labels.busy : label ?? labels.label })
+        ]
+      }
+    ),
+    description && /* @__PURE__ */ jsx("p", { id: descriptionId, className: classNames.fine, children: description }),
+    error && /* @__PURE__ */ jsx("p", { role: "alert", className: classNames.error, children: error })
+  ] });
+}
+function AccountLinkForm({
+  challengeId,
+  hint = "",
+  endpoint = "/api/news/ledvery-link",
+  next = "",
+  subscribe = false,
+  classNames = {},
+  onLinked,
+  onCancel
+}) {
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState("");
+  const [password, setPassword] = useState("");
+  const [mfaRequired, setMfaRequired] = useState(false);
+  const [code, setCode] = useState("");
+  return /* @__PURE__ */ jsxs(
+    "form",
+    {
+      className: classNames.form,
+      "data-reader-link": "",
+      onSubmit: (event) => {
+        event.preventDefault();
+        setBusy(true);
+        setError("");
+        postJson(endpoint, { challenge_id: challengeId, password, next, subscribe, ...mfaRequired && code ? { mfa_code: code } : {} }).then((result) => {
+          setPassword("");
+          setCode("");
+          if (onLinked) onLinked(result);
+          else window.location.assign(result.location || "/account");
+        }).catch((e) => {
+          if (e?.mfaRequired) setMfaRequired(true);
+          setCode("");
+          setError(e instanceof Error ? e.message : "Please try again.");
+          setBusy(false);
+        });
+      },
+      children: [
+        /* @__PURE__ */ jsx("h2", { children: "You already have a reader account" }),
+        /* @__PURE__ */ jsxs("p", { className: classNames.fine, children: [
+          hint ? /* @__PURE__ */ jsxs(Fragment, { children: [
+            "An account for ",
+            /* @__PURE__ */ jsx("strong", { children: hint }),
+            " already exists. "
+          ] }) : null,
+          "Enter its password once to connect your sign-in. Your preferences and subscriptions stay as they are."
+        ] }),
+        /* @__PURE__ */ jsxs("label", { children: [
+          "Reader account password",
+          /* @__PURE__ */ jsx("input", { type: "password", autoComplete: "current-password", required: true, minLength: 1, maxLength: 1024, value: password, onChange: (e) => setPassword(e.target.value) })
+        ] }),
+        mfaRequired && /* @__PURE__ */ jsxs("label", { children: [
+          "Authentication code",
+          /* @__PURE__ */ jsx("input", { type: "text", inputMode: "numeric", autoComplete: "one-time-code", required: true, maxLength: 32, value: code, onChange: (e) => setCode(e.target.value) })
+        ] }),
+        /* @__PURE__ */ jsx("button", { className: classNames.button, disabled: busy || !password || mfaRequired && !code, children: busy ? "Connecting\u2026" : "Connect and sign in" }),
+        onCancel && /* @__PURE__ */ jsx("button", { type: "button", className: classNames.secondary, disabled: busy, onClick: onCancel, children: "Start over" }),
+        error && /* @__PURE__ */ jsx("p", { role: "alert", className: classNames.error, children: error })
+      ]
+    }
+  );
+}
+function AccountSwitchPrompt({
+  currentName,
+  pendingName,
+  endpoint = "/api/news/switch-account",
+  classNames = {},
+  onDone
+}) {
+  const [busy, setBusy] = useState(null);
+  const [error, setError] = useState("");
+  const current = firstName(currentName) || "your current account";
+  const pending = firstName(pendingName) || "the new account";
+  const choose = (choice) => {
+    setBusy(choice);
+    setError("");
+    postJson(endpoint, { choice }).then((result) => {
+      if (onDone) onDone({ ...result, choice });
+      else window.location.assign(result.location || "/account");
+    }).catch((e) => {
+      setError(e instanceof Error ? e.message : "Please try again.");
+      setBusy(null);
+    });
+  };
+  return /* @__PURE__ */ jsxs("div", { className: classNames.wrapper, "data-reader-switch": "", role: "group", "aria-label": "Choose an account", children: [
+    /* @__PURE__ */ jsx("h2", { children: "Which account would you like to use?" }),
+    /* @__PURE__ */ jsxs("p", { className: classNames.fine, children: [
+      "You are signed in as ",
+      current,
+      ". A different account, ",
+      pending,
+      ", just signed in through Ledvery."
+    ] }),
+    /* @__PURE__ */ jsx("button", { type: "button", className: classNames.button, disabled: busy !== null, onClick: () => choose("continue"), children: busy === "continue" ? "Switching\u2026" : `Continue as ${pending}` }),
+    /* @__PURE__ */ jsx("button", { type: "button", className: classNames.secondary, disabled: busy !== null, onClick: () => choose("stay"), children: busy === "stay" ? "One moment\u2026" : `Stay as ${current}` }),
+    error && /* @__PURE__ */ jsx("p", { role: "alert", className: classNames.error, children: error })
+  ] });
+}
+
+export { AccountLinkForm, AccountSwitchPrompt, LEDVERY_BUTTON_LABELS, LedveryButton, READER_SSO_ATTEMPT_WINDOW_MS, READER_SSO_BOT_PATTERN, READER_SSO_PRIVATE_PATHS, ReaderGreeting, ReaderSsoBoot, firstName, greetingText, greetingWord, isFormField, localHour, silentSignInDecision, silentSignInUrl };

package/dist/reader-sso-events-DBw8pGSM.d.cts

@@ -0,0 +1,16 @@
+/**
+ * Reader sign-in telemetry registry (ADR-2026-10-19 section 8). Isomorphic on
+ * purpose: a site's analytics schema is shared with its browser bundle, so this
+ * fragment must not import anything server-only.
+ */
+type ReaderSsoEventName = "reader_signin_started" | "reader_signin_completed" | "reader_signin_failed" | "reader_sso_check" | "reader_signed_out" | "reader_account_linked";
+type ReaderSsoEventDefinition = {
+    category: "navigation" | "engagement" | "content" | "conversion" | "system";
+    source: "server";
+};
+/** Merge into the site's EVENTS registry: `{ ...EVENTS, ...READER_SSO_EVENTS }`. Server-recorded only. */
+declare const READER_SSO_EVENTS: Record<ReaderSsoEventName, ReaderSsoEventDefinition>;
+/** Property keys the site's analytics sanitizer must allow for these events (bounded short tokens). */
+declare const READER_SSO_PROPERTY_KEYS: readonly ["method", "mode", "is_new", "reason", "outcome", "transaction"];
+
+export { READER_SSO_EVENTS as R, READER_SSO_PROPERTY_KEYS as a, type ReaderSsoEventDefinition as b, type ReaderSsoEventName as c };

package/dist/reader-sso-events-DBw8pGSM.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Reader sign-in telemetry registry (ADR-2026-10-19 section 8). Isomorphic on
+ * purpose: a site's analytics schema is shared with its browser bundle, so this
+ * fragment must not import anything server-only.
+ */
+type ReaderSsoEventName = "reader_signin_started" | "reader_signin_completed" | "reader_signin_failed" | "reader_sso_check" | "reader_signed_out" | "reader_account_linked";
+type ReaderSsoEventDefinition = {
+    category: "navigation" | "engagement" | "content" | "conversion" | "system";
+    source: "server";
+};
+/** Merge into the site's EVENTS registry: `{ ...EVENTS, ...READER_SSO_EVENTS }`. Server-recorded only. */
+declare const READER_SSO_EVENTS: Record<ReaderSsoEventName, ReaderSsoEventDefinition>;
+/** Property keys the site's analytics sanitizer must allow for these events (bounded short tokens). */
+declare const READER_SSO_PROPERTY_KEYS: readonly ["method", "mode", "is_new", "reason", "outcome", "transaction"];
+
+export { READER_SSO_EVENTS as R, READER_SSO_PROPERTY_KEYS as a, type ReaderSsoEventDefinition as b, type ReaderSsoEventName as c };