@scalemule/news-publication 0.0.70 → 0.0.73

package/dist/reader-sso.cjs

@@ -0,0 +1,506 @@
+'use strict';
+
+var crypto = require('crypto');
+
+// src/reader-sso.ts
+
+// src/reader-sso-events.ts
+var READER_SSO_EVENTS = {
+  reader_signin_started: { category: "engagement", source: "server" },
+  reader_signin_completed: { category: "conversion", source: "server" },
+  reader_signin_failed: { category: "system", source: "server" },
+  reader_sso_check: { category: "system", source: "server" },
+  reader_signed_out: { category: "engagement", source: "server" },
+  reader_account_linked: { category: "conversion", source: "server" }
+};
+var READER_SSO_PROPERTY_KEYS = ["method", "mode", "is_new", "reason", "outcome", "transaction"];
+
+// src/reader-sso.ts
+var READER_SSO_FLOW_SECONDS = 600;
+var READER_SSO_NEGATIVE_CACHE_SECONDS = 300;
+var READER_SSO_SIGNED_OUT_SECONDS = 86400;
+var READER_SSO_PENDING_SECONDS = 600;
+var LEDVERY_ISSUER_ORIGIN = "https://api.ledvery.com";
+var SILENT_NEGATIVE_ERRORS = ["login_required", "consent_required", "interaction_required", "account_selection_required"];
+var COOKIE_PREFIX = /^__Host-[A-Za-z0-9_-]{1,60}$/;
+var SESSION_TOKEN = /^[A-Za-z0-9._~-]{1,2048}$/;
+var CHALLENGE_ID = /^[A-Za-z0-9._:-]{1,128}$/;
+var HEX64 = /^[a-f0-9]{64}$/;
+function readerSsoCookieNames(prefix) {
+  if (!COOKIE_PREFIX.test(prefix)) throw new Error("Reader cookie prefix must be a short __Host- name");
+  return {
+    session: `${prefix}-reader`,
+    flow: `${prefix}-ledvery`,
+    newsletter: `${prefix}-newsletter`,
+    ssoChecked: `${prefix}-sso-checked`,
+    signedOut: `${prefix}-signed-out`,
+    pending: `${prefix}-sso-pending`
+  };
+}
+var readerSsoCookieOptions = { httpOnly: true, secure: true, sameSite: "lax", path: "/" };
+var clear = (name) => ({ name, value: "", maxAge: 0 });
+function applyCookies(jar, cookies) {
+  for (const cookie of cookies) {
+    jar.set(cookie.name, cookie.value, {
+      ...readerSsoCookieOptions,
+      ...cookie.maxAge !== void 0 ? { maxAge: cookie.maxAge } : {},
+      ...cookie.expires ? { expires: cookie.expires } : {}
+    });
+  }
+}
+function setCookieHeader(cookie) {
+  const parts = [`${cookie.name}=${cookie.value}`, "Path=/", "HttpOnly", "Secure", "SameSite=Lax"];
+  if (cookie.maxAge !== void 0) parts.push(`Max-Age=${cookie.maxAge}`);
+  if (cookie.expires) parts.push(`Expires=${cookie.expires.toUTCString()}`);
+  return parts.join("; ");
+}
+function cookieReader(header) {
+  const parts = (header || "").split(";").map((part) => part.trim());
+  return (name) => {
+    const values = parts.filter((part) => part.startsWith(name + "="));
+    return values.length === 1 ? values[0].slice(name.length + 1) : void 0;
+  };
+}
+function payload(response) {
+  const body = response.body;
+  const data = body && typeof body === "object" ? body.data : void 0;
+  return data && typeof data === "object" ? data : body && typeof body === "object" ? body : {};
+}
+function errorCode(response) {
+  const body = response.body;
+  const error = body && typeof body === "object" ? body.error : void 0;
+  const code = error && typeof error === "object" ? error.code : body && typeof body === "object" ? body.code : void 0;
+  return typeof code === "string" ? code : "";
+}
+function failed(response) {
+  const body = response.body;
+  return response.status < 200 || response.status >= 300 || Boolean(body && typeof body === "object" && body.success === false);
+}
+function localReturnPath(value) {
+  if (typeof value !== "string" || !value.startsWith("/") || value.startsWith("//") || value.length > 500) return "";
+  if (/[\\\r\n\u0000-\u001f]/.test(value) || value === "/api" || value.startsWith("/api/")) return "";
+  return value;
+}
+function resolve(config) {
+  const origin = new URL(config.origin);
+  if (origin.protocol !== "https:" || origin.origin !== config.origin) throw new Error("Reader SSO origin must be a bare https origin");
+  if (!config.key) throw new Error("Reader SSO key is required");
+  const accountPath = localReturnPath(config.accountPath ?? "/account") || "/account";
+  const returnPath = config.returnPath ?? ((next) => localReturnPath(next));
+  return {
+    ...config,
+    names: readerSsoCookieNames(config.prefix),
+    callbackPath: localReturnPath(config.callbackPath ?? "/api/news/ledvery-callback") || "/api/news/ledvery-callback",
+    accountPath,
+    issuerOrigin: new URL(config.issuerOrigin ?? LEDVERY_ISSUER_ORIGIN).origin,
+    returnPath,
+    retryPath: config.retryPath ?? ((flow) => flow?.returnTo ? `${accountPath}?signin=retry&next=${encodeURIComponent(flow.returnTo)}` : `${accountPath}?signin=retry`),
+    now: config.now ?? (() => Date.now()),
+    random: config.random ?? (() => crypto.randomBytes(16).toString("hex"))
+  };
+}
+function emit(config, event) {
+  try {
+    config.record?.(event);
+  } catch {
+  }
+}
+function stateDigest(state) {
+  return crypto.createHash("sha256").update(state).digest("hex");
+}
+function validState(state, digest) {
+  if (!state || state.length > 2048 || !digest || !HEX64.test(digest)) return false;
+  return crypto.timingSafeEqual(Buffer.from(stateDigest(state), "hex"), Buffer.from(digest, "hex"));
+}
+function seal(label, body, key) {
+  const encoded = Buffer.from(JSON.stringify(body)).toString("base64url");
+  return encoded + "." + crypto.createHmac("sha256", key).update(`${label}:` + encoded).digest("hex");
+}
+function open(label, cookie, key) {
+  if (!key || !cookie || cookie.length > 4096) return null;
+  const [encoded, signature, extra] = cookie.split(".");
+  if (extra !== void 0 || !encoded || !signature || !HEX64.test(signature)) return null;
+  const expected = crypto.createHmac("sha256", key).update(`${label}:` + encoded).digest();
+  if (!crypto.timingSafeEqual(expected, Buffer.from(signature, "hex"))) return null;
+  try {
+    const value = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+    return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function sealReaderFlow(input, key, now = Date.now()) {
+  const body = {
+    digest: stateDigest(input.state),
+    subscribe: input.subscribe === true,
+    expires: now + READER_SSO_FLOW_SECONDS * 1e3,
+    returnTo: localReturnPath(input.returnTo ?? "")
+  };
+  if (input.mode) body.mode = input.mode;
+  if (input.provider) body.provider = input.provider;
+  if (input.tx) body.tx = input.tx;
+  return seal("reader-flow:v1", body, key);
+}
+function openReaderFlow(cookie, key, now = Date.now(), returnPath = (next) => localReturnPath(next)) {
+  const raw = open("reader-flow:v1", cookie, key);
+  if (!raw) return null;
+  const mode = raw.mode === "silent" ? "silent" : "interactive";
+  if (raw.mode !== void 0 && raw.mode !== "silent" && raw.mode !== "interactive") return null;
+  if (typeof raw.subscribe !== "boolean" || typeof raw.digest !== "string" || !HEX64.test(raw.digest)) return null;
+  if (typeof raw.expires !== "number" || !Number.isFinite(raw.expires) || raw.expires <= now) return null;
+  const returnTo = typeof raw.returnTo === "string" ? raw.returnTo : "";
+  if (returnTo && returnPath(returnTo, mode) !== returnTo) return null;
+  const provider = raw.provider === "google" || raw.provider === "email" ? raw.provider : void 0;
+  const tx = typeof raw.tx === "string" && /^[a-f0-9]{1,64}$/.test(raw.tx) ? raw.tx : void 0;
+  return { digest: raw.digest, subscribe: raw.subscribe && mode === "interactive", expires: raw.expires, returnTo, mode, provider, tx };
+}
+function sealPendingSession(pending, key, now = Date.now()) {
+  return seal("reader-pending:v1", { ...pending, until: now + READER_SSO_PENDING_SECONDS * 1e3 }, key);
+}
+function openPendingSession(cookie, key, now = Date.now()) {
+  const raw = open("reader-pending:v1", cookie, key);
+  if (!raw || typeof raw.until !== "number" || raw.until <= now) return null;
+  if (typeof raw.token !== "string" || !SESSION_TOKEN.test(raw.token) || typeof raw.expires !== "number" || raw.expires <= now) return null;
+  if (typeof raw.userId !== "string" || !raw.userId) return null;
+  return {
+    token: raw.token,
+    expires: raw.expires,
+    userId: raw.userId,
+    name: typeof raw.name === "string" ? raw.name : "",
+    mode: raw.mode === "silent" ? "silent" : "interactive",
+    method: raw.method === "google" || raw.method === "email" || raw.method === "link" ? raw.method : "unknown",
+    returnTo: localReturnPath(raw.returnTo),
+    subscribe: raw.subscribe === true,
+    tx: typeof raw.tx === "string" ? raw.tx : void 0
+  };
+}
+function authorizeUrl(value, state, callback, mode, issuerOrigin = LEDVERY_ISSUER_ORIGIN) {
+  const url = new URL(value);
+  if (url.protocol !== "https:" || url.origin !== new URL(issuerOrigin).origin || url.pathname !== "/authorize" || url.username || url.password || url.searchParams.get("state") !== state || url.searchParams.get("redirect_uri") !== callback || url.searchParams.get("code_challenge_method") !== "S256" || !url.searchParams.get("code_challenge") || mode === "silent" && url.searchParams.get("prompt") !== "none") throw new Error("Invalid Ledvery authorization response");
+  return url.toString();
+}
+async function startSignIn(config, input) {
+  const c = resolve(config);
+  const mode = input.mode === "silent" ? "silent" : "interactive";
+  const next = c.returnPath(input.next ?? "", mode);
+  const redirect = next || (mode === "silent" ? "/" : c.accountPath);
+  const provider = mode === "silent" ? void 0 : input.provider === "email" ? "email" : "google";
+  if (c.enabled === false) {
+    return { ok: false, status: 503, error: "Sign-in is temporarily unavailable. Please try again shortly.", reason: "disabled", redirect, cookies: [] };
+  }
+  if (provider === "email" && !c.emailSignIn) {
+    return { ok: false, status: 404, error: "Email sign-in is not available on this publication yet.", reason: "provider", redirect, cookies: [] };
+  }
+  const staleSession = [];
+  if (input.cookies(c.names.session)) {
+    const current = await currentUser(c, input.cookies(c.names.session));
+    if (current && current.email_verified) {
+      if (mode === "silent") return { ok: false, status: 204, error: "", reason: "session", redirect, cookies: [] };
+    } else {
+      staleSession.push(clear(c.names.session), clear(c.names.pending));
+    }
+  }
+  if (mode === "silent") {
+    if (input.cookies(c.names.signedOut) || input.cookies(c.names.ssoChecked)) {
+      return { ok: false, status: 204, error: "", reason: "suppressed", redirect, cookies: staleSession };
+    }
+  }
+  const tx = c.random();
+  const callback = c.origin + c.callbackPath;
+  const query = new URLSearchParams({ redirect_uri: callback });
+  if (mode === "silent") query.set("prompt", "none");
+  else {
+    query.set("prompt", "select_account");
+    query.set("upstream", provider === "email" ? "scalemule_consumer" : "google");
+  }
+  try {
+    const response = await c.request(`/v1/auth/oauth/ledvery/authorize?${query}`, { method: "GET" });
+    if (failed(response)) throw new Error("authorize");
+    const value = payload(response);
+    if (typeof value.url !== "string" || typeof value.state !== "string" || !value.state) throw new Error("authorize");
+    const url = authorizeUrl(value.url, value.state, callback, mode, c.issuerOrigin);
+    const cookies = [
+      ...staleSession,
+      { name: c.names.flow, value: sealReaderFlow({ state: value.state, subscribe: input.subscribe === true && mode === "interactive", returnTo: next, mode, provider, tx }, c.key, c.now()), maxAge: READER_SSO_FLOW_SECONDS }
+    ];
+    if (mode === "interactive") cookies.push(clear(c.names.signedOut), clear(c.names.ssoChecked));
+    emit(c, { name: "reader_signin_started", properties: { method: provider ?? "unknown", mode, transaction: tx } });
+    return { ok: true, url, tx, cookies };
+  } catch {
+    if (mode === "silent") {
+      emit(c, { name: "reader_sso_check", properties: { outcome: "error", mode, transaction: tx } });
+      return { ok: false, status: 503, error: "", reason: "unavailable", redirect, cookies: [...staleSession, { name: c.names.ssoChecked, value: "1", maxAge: READER_SSO_NEGATIVE_CACHE_SECONDS }] };
+    }
+    emit(c, { name: "reader_signin_failed", properties: { reason: "unavailable", mode, transaction: tx } });
+    return { ok: false, status: 503, error: "Ledvery sign-in is temporarily unavailable. Please try again shortly or use your existing reader account.", reason: "unavailable", redirect, cookies: [] };
+  }
+}
+async function currentUser(c, token) {
+  if (!token || !SESSION_TOKEN.test(token)) return null;
+  const response = await c.request("/v1/auth/me", { method: "GET", token });
+  if (failed(response)) return null;
+  const me = payload(response);
+  if (typeof me.id !== "string" || !me.id) return null;
+  return {
+    id: me.id,
+    email_verified: me.email_verified === true,
+    full_name: typeof me.full_name === "string" ? me.full_name.trim().slice(0, 150) : "",
+    locale: typeof me.locale === "string" && me.locale.length <= 35 ? me.locale : void 0,
+    time_zone: typeof me.time_zone === "string" && me.time_zone.length <= 64 ? me.time_zone : void 0
+  };
+}
+function issuedSession(response, now) {
+  const value = payload(response);
+  const token = typeof value.session_token === "string" ? value.session_token : "";
+  const expiresAt = new Date(typeof value.expires_at === "string" || typeof value.expires_at === "number" ? value.expires_at : NaN);
+  if (!SESSION_TOKEN.test(token) || !Number.isFinite(expiresAt.getTime()) || expiresAt.getTime() <= now) throw new Error("Invalid reader session");
+  return { token, expiresAt, isNew: value.is_new_user === true };
+}
+function precedence(current, incoming) {
+  if (!current) return "replace";
+  return current.id === incoming.id ? "renew" : "switch";
+}
+async function completeSignIn(config, input) {
+  const c = resolve(config);
+  const now = c.now();
+  const query = new URL(String(input.url), c.origin).searchParams;
+  const state = query.get("state");
+  const code = query.get("code");
+  const error = query.get("error");
+  const flow = openReaderFlow(input.cookies(c.names.flow), c.key, now, c.returnPath);
+  const cookies = [clear(c.names.flow)];
+  const negativeCache = { name: c.names.ssoChecked, value: "1", maxAge: READER_SSO_NEGATIVE_CACHE_SECONDS };
+  const redirect = (location, outcome) => ({ kind: "redirect", location, cookies, outcome, flow });
+  if (!flow || !validState(state, flow.digest)) {
+    cookies.push(negativeCache);
+    emit(c, { name: "reader_signin_failed", properties: { reason: "state", mode: flow?.mode ?? "interactive", transaction: flow?.tx } });
+    return redirect(c.retryPath(flow), "state");
+  }
+  const silent = flow.mode === "silent";
+  const quiet = flow.returnTo || "/";
+  const method = flow.provider ?? "unknown";
+  if (error !== null) {
+    if (silent) {
+      const outcome = SILENT_NEGATIVE_ERRORS.includes(error) ? error : "error";
+      cookies.push(negativeCache);
+      emit(c, { name: "reader_sso_check", properties: { outcome, mode: "silent", transaction: flow.tx } });
+      return redirect(quiet, outcome);
+    }
+    const reason = error === "access_denied" ? "cancelled" : "provider_error";
+    emit(c, { name: "reader_signin_failed", properties: { reason, mode: "interactive", transaction: flow.tx } });
+    return redirect(c.retryPath(flow), reason);
+  }
+  if (!code || code.length > 4096) {
+    if (silent) cookies.push(negativeCache);
+    emit(c, { name: "reader_signin_failed", properties: { reason: "state", mode: flow.mode, transaction: flow.tx } });
+    return redirect(silent ? quiet : c.retryPath(flow), "state");
+  }
+  try {
+    const exchange = await c.request(`/v1/auth/oauth/ledvery/callback?${new URLSearchParams({ code, state })}`, { method: "GET" });
+    if (exchange.status === 409 && errorCode(exchange) === "LINK_REQUIRED") {
+      const challenge = payload(exchange);
+      const challengeId = typeof challenge.challenge_id === "string" && CHALLENGE_ID.test(challenge.challenge_id) ? challenge.challenge_id : "";
+      const hint = typeof challenge.email_hint === "string" && challenge.email_hint.length <= 254 ? challenge.email_hint : "";
+      if (silent || !challengeId) {
+        cookies.push(negativeCache);
+        emit(c, { name: "reader_sso_check", properties: { outcome: "link_required", mode: flow.mode, transaction: flow.tx } });
+        return redirect(silent ? quiet : c.retryPath(flow), "link_required");
+      }
+      emit(c, { name: "reader_sso_check", properties: { outcome: "link_required", mode: "interactive", transaction: flow.tx } });
+      const link = new URLSearchParams({ link: challengeId });
+      if (hint) link.set("hint", hint);
+      if (flow.returnTo) link.set("next", flow.returnTo);
+      if (flow.subscribe) link.set("subscribe", "1");
+      return redirect(`${c.accountPath}?${link}`, "link_required");
+    }
+    if (failed(exchange)) throw new Error("exchange");
+    const session = issuedSession(exchange, now);
+    return await establish(c, { session, flow, method, cookies, input, negativeCache });
+  } catch (e) {
+    const reason = e instanceof Error && e.message === "unverified" ? "unverified" : "exchange";
+    if (silent) cookies.push(negativeCache);
+    emit(c, { name: "reader_signin_failed", properties: { reason, mode: flow.mode, transaction: flow.tx } });
+    return redirect(silent ? quiet : c.retryPath(flow), reason);
+  }
+}
+async function establish(c, args) {
+  const { session, flow, method, cookies } = args;
+  const user = await currentUser(c, session.token);
+  if (!user || !user.email_verified) throw new Error("unverified");
+  const current = await currentUser(c, args.input.cookies(c.names.session));
+  const decision = precedence(current, user);
+  if (decision === "switch") {
+    cookies.push({
+      name: c.names.pending,
+      value: sealPendingSession({ token: session.token, expires: session.expiresAt.getTime(), userId: user.id, name: user.full_name, mode: flow.mode, method, returnTo: flow.returnTo, subscribe: flow.subscribe, tx: flow.tx }, c.key, c.now()),
+      maxAge: READER_SSO_PENDING_SECONDS
+    });
+    if (flow.mode === "silent") cookies.push(args.negativeCache);
+    emit(c, { name: "reader_sso_check", properties: { outcome: "switch_offered", mode: flow.mode, transaction: flow.tx } });
+    return { kind: "redirect", location: `${c.accountPath}?switch=1`, cookies, outcome: "switch_offered", flow };
+  }
+  cookies.push({ name: c.names.session, value: session.token, expires: session.expiresAt }, clear(c.names.signedOut), clear(c.names.ssoChecked), clear(c.names.pending));
+  emit(c, { name: "reader_signin_completed", properties: { method, mode: flow.mode, is_new: session.isNew ? "true" : "false", transaction: flow.tx } });
+  return { kind: "signed-in", location: flow.returnTo || c.accountPath, cookies, token: session.token, expiresAt: session.expiresAt, user, flow, isNew: session.isNew };
+}
+function linkFailureMessage(code) {
+  switch (code) {
+    case "MFA_REQUIRED":
+      return { error: "Enter the code from your authenticator app (or a backup code) to finish connecting your account.", mfaRequired: true };
+    case "MFA_SETUP_REQUIRED":
+      return { error: "Your existing account requires two-step verification. Set it up from your account page, then try again." };
+    case "MFA_METHOD_UNSUPPORTED":
+      return { error: "Your account's verification method can't be used here. Sign in with your password first, then connect from your account page." };
+    case "IDENTITY_ALREADY_BOUND":
+      return { error: "That account already signs in with a different identity. Sign in the way you did before." };
+    default:
+      return null;
+  }
+}
+async function linkAccount(config, input) {
+  const c = resolve(config);
+  const challengeId = typeof input.challenge_id === "string" && CHALLENGE_ID.test(input.challenge_id) ? input.challenge_id : "";
+  const password = typeof input.password === "string" && input.password.length > 0 && input.password.length <= 1024 ? input.password : "";
+  if (!challengeId || !password) {
+    emit(c, { name: "reader_signin_failed", properties: { reason: "link_invalid", mode: "interactive" } });
+    return { ok: false, status: 400, error: "Enter the password of your existing reader account.", cookies: [] };
+  }
+  const next = c.returnPath(input.next ?? "", "interactive");
+  const mfaCode = typeof input.mfa_code === "string" ? input.mfa_code.trim() : "";
+  if (mfaCode && (mfaCode.length > 32 || !/^[A-Za-z0-9-]+$/.test(mfaCode))) {
+    return { ok: false, status: 400, error: "Enter the code exactly as your authenticator app shows it.", cookies: [], mfaRequired: true };
+  }
+  try {
+    const response = await c.request("/v1/auth/oauth/ledvery/link", { method: "POST", body: { challenge_id: challengeId, password, ...mfaCode ? { mfa_code: mfaCode } : {} } });
+    if (failed(response)) {
+      const specific = linkFailureMessage(errorCode(response));
+      if (specific) {
+        emit(c, { name: "reader_signin_failed", properties: { reason: specific.mfaRequired ? "mfa_required" : "link_invalid", mode: "interactive" } });
+        return { ok: false, status: specific.mfaRequired ? 401 : 409, cookies: [], ...specific };
+      }
+      emit(c, { name: "reader_signin_failed", properties: { reason: response.status >= 500 ? "unavailable" : "link_invalid", mode: "interactive" } });
+      return response.status >= 500 ? { ok: false, status: 503, error: "The publication is temporarily unavailable. Please try again.", cookies: [] } : { ok: false, status: 400, error: "We couldn\u2019t link the accounts with those details. Check the password or start the sign-in again.", cookies: [] };
+    }
+    const session = issuedSession(response, c.now());
+    const flow = { digest: "", subscribe: input.subscribe === true, expires: 0, returnTo: next, mode: "interactive", provider: void 0 };
+    const result = await establish(c, { session, flow, method: "link", cookies: [], input, negativeCache: { name: c.names.ssoChecked, value: "1", maxAge: READER_SSO_NEGATIVE_CACHE_SECONDS } });
+    if (result.kind === "signed-in") emit(c, { name: "reader_account_linked", properties: {} });
+    return result.kind === "signed-in" ? { ok: true, switch: false, cookies: result.cookies, token: result.token, expiresAt: result.expiresAt, user: result.user, location: result.location } : { ok: true, switch: true, cookies: result.cookies, location: result.location };
+  } catch {
+    emit(c, { name: "reader_signin_failed", properties: { reason: "exchange", mode: "interactive" } });
+    return { ok: false, status: 503, error: "Sign-in could not be completed. Please start again.", cookies: [] };
+  }
+}
+async function pendingSwitch(config, cookies) {
+  const c = resolve(config);
+  const pending = openPendingSession(cookies(c.names.pending), c.key, c.now());
+  if (!pending) return null;
+  const current = await currentUser(c, cookies(c.names.session));
+  return { current: current?.full_name ?? "", pending: pending.name };
+}
+async function switchAccount(config, input) {
+  const c = resolve(config);
+  const pending = openPendingSession(input.cookies(c.names.pending), c.key, c.now());
+  const cookies = [clear(c.names.pending)];
+  if (!pending) return { ok: false, status: 410, error: "That sign-in has expired. Please start again.", cookies };
+  const logout = async (token) => {
+    if (!token || !SESSION_TOKEN.test(token)) return;
+    try {
+      await c.request("/v1/auth/logout", { method: "POST", body: { session_token: token }, token });
+    } catch {
+    }
+  };
+  if (input.choice === "stay") {
+    await logout(pending.token);
+    emit(c, { name: "reader_sso_check", properties: { outcome: "switch_declined", mode: pending.mode, transaction: pending.tx } });
+    return { ok: true, choice: "stay", cookies, location: pending.returnTo || c.accountPath };
+  }
+  if (input.choice !== "continue") return { ok: false, status: 400, error: "Choose which account to continue with.", cookies: [] };
+  const user = await currentUser(c, pending.token);
+  if (!user || !user.email_verified || user.id !== pending.userId) {
+    emit(c, { name: "reader_signin_failed", properties: { reason: "session", mode: pending.mode, transaction: pending.tx } });
+    return { ok: false, status: 410, error: "That sign-in is no longer valid. Please start again.", cookies };
+  }
+  await logout(input.cookies(c.names.session));
+  cookies.push({ name: c.names.session, value: pending.token, expires: new Date(pending.expires) }, clear(c.names.signedOut), clear(c.names.ssoChecked));
+  emit(c, { name: "reader_signin_completed", properties: { method: "switch", mode: pending.mode, is_new: "false", transaction: pending.tx } });
+  return { ok: true, choice: "continue", cookies, token: pending.token, location: pending.returnTo || c.accountPath, subscribe: pending.subscribe && pending.mode === "interactive" };
+}
+async function signOut(config, input) {
+  const c = resolve(config);
+  const token = input.cookies(c.names.session);
+  try {
+    if (token && SESSION_TOKEN.test(token)) await c.request("/v1/auth/logout", { method: "POST", body: { session_token: token }, token });
+  } catch {
+  }
+  const state = c.random();
+  const endSession = new URL("/end-session", c.issuerOrigin);
+  endSession.searchParams.set("client_id", c.clientId);
+  endSession.searchParams.set("post_logout_redirect_uri", `${c.origin}${c.accountPath}?signed_out=1`);
+  endSession.searchParams.set("state", state);
+  emit(c, { name: "reader_signed_out", properties: { method: "explicit" } });
+  return {
+    cookies: [
+      clear(c.names.session),
+      clear(c.names.flow),
+      clear(c.names.newsletter),
+      clear(c.names.pending),
+      clear(c.names.ssoChecked),
+      { name: c.names.signedOut, value: "1", maxAge: READER_SSO_SIGNED_OUT_SECONDS },
+      ...input.extraCookies ?? []
+    ],
+    endSessionUrl: endSession.toString(),
+    state
+  };
+}
+async function sessionSummary(config, cookies) {
+  const c = resolve(config);
+  const user = await currentUser(c, cookies(c.names.session));
+  if (!user || !user.email_verified) return { authenticated: false };
+  return { authenticated: true, full_name: user.full_name, locale: user.locale, time_zone: user.time_zone };
+}
+async function sessionSummaryWithCookies(config, cookies) {
+  const c = resolve(config);
+  const present = cookies(c.names.session);
+  const summary = await sessionSummary(config, cookies);
+  return { summary, cookies: present && !summary.authenticated ? [clear(c.names.session), clear(c.names.pending)] : [] };
+}
+function readerSsoBootFlags(cookies, names) {
+  return {
+    hasSession: Boolean(cookies(names.session)),
+    suppressed: Boolean(cookies(names.signedOut) || cookies(names.ssoChecked) || cookies(names.pending))
+  };
+}
+
+exports.LEDVERY_ISSUER_ORIGIN = LEDVERY_ISSUER_ORIGIN;
+exports.READER_SSO_EVENTS = READER_SSO_EVENTS;
+exports.READER_SSO_FLOW_SECONDS = READER_SSO_FLOW_SECONDS;
+exports.READER_SSO_NEGATIVE_CACHE_SECONDS = READER_SSO_NEGATIVE_CACHE_SECONDS;
+exports.READER_SSO_PENDING_SECONDS = READER_SSO_PENDING_SECONDS;
+exports.READER_SSO_PROPERTY_KEYS = READER_SSO_PROPERTY_KEYS;
+exports.READER_SSO_SIGNED_OUT_SECONDS = READER_SSO_SIGNED_OUT_SECONDS;
+exports.SILENT_NEGATIVE_ERRORS = SILENT_NEGATIVE_ERRORS;
+exports.applyCookies = applyCookies;
+exports.authorizeUrl = authorizeUrl;
+exports.completeSignIn = completeSignIn;
+exports.cookieReader = cookieReader;
+exports.linkAccount = linkAccount;
+exports.linkFailureMessage = linkFailureMessage;
+exports.localReturnPath = localReturnPath;
+exports.openPendingSession = openPendingSession;
+exports.openReaderFlow = openReaderFlow;
+exports.pendingSwitch = pendingSwitch;
+exports.precedence = precedence;
+exports.readerSsoBootFlags = readerSsoBootFlags;
+exports.readerSsoCookieNames = readerSsoCookieNames;
+exports.readerSsoCookieOptions = readerSsoCookieOptions;
+exports.sealPendingSession = sealPendingSession;
+exports.sealReaderFlow = sealReaderFlow;
+exports.sessionSummary = sessionSummary;
+exports.sessionSummaryWithCookies = sessionSummaryWithCookies;
+exports.setCookieHeader = setCookieHeader;
+exports.signOut = signOut;
+exports.startSignIn = startSignIn;
+exports.stateDigest = stateDigest;
+exports.switchAccount = switchAccount;
+exports.validState = validState;