@scalemule/news-publication 0.0.86 → 0.0.88

package/README.md

@@ -260,11 +260,11 @@ other than that key and the browser only ever sees host-only HttpOnly cookies.
 `sessionSummary` return cookie instructions and destinations; the site applies
 them with `applyCookies` and answers with private, no-store headers. Merge
 `READER_SSO_EVENTS` into the site's analytics registry and allow
-`READER_SSO_PROPERTY_KEYS` in its property sanitizer. `ReaderSsoBoot` performs at
-most one silent attempt per page load and never on private paths, for bots,
-while typing, in frames or in prerendered documents; the server's negative cache
-makes a loop impossible. `ReaderGreeting` is a client island that renders only a
-first name, in the reader's own time zone and locale, after loading.
+`READER_SSO_PROPERTY_KEYS` in its property sanitizer. `ReaderSsoBoot` is a
+no-op compatibility export: a rendered page never starts Ledvery authorization
+on a timer. The explicit sign-in routes still work. `ReaderGreeting` is a client
+island that renders only a first name, in the reader's own time zone and locale,
+after loading.
 
 ## Community pet sections
 

package/dist/reader-sso-client.cjs

@@ -4,46 +4,6 @@
 var react = require('react');
 var jsxRuntime = require('react/jsx-runtime');
 
-// src/reader-sso-scheduler.ts
-function mountReaderSsoScheduler({ document: doc, timers, eligible, attempt, idleDelayMs }) {
-  let active = true;
-  let attempted = false;
-  let idle;
-  let delay;
-  const cancelPending = () => {
-    if (idle !== void 0) timers.cancelIdleCallback?.(idle);
-    if (delay !== void 0) timers.clearTimeout(delay);
-    idle = delay = void 0;
-  };
-  const run = () => {
-    delay = void 0;
-    if (!active || attempted || !eligible()) return;
-    attempted = true;
-    attempt();
-  };
-  const defer = () => {
-    idle = void 0;
-    if (active && !attempted) delay = timers.setTimeout(run, idleDelayMs);
-  };
-  const schedule = () => {
-    if (!active || attempted) return;
-    cancelPending();
-    if (doc.readyState === "loading" || !eligible()) return;
-    if (timers.requestIdleCallback) idle = timers.requestIdleCallback(defer, { timeout: 4e3 });
-    else defer();
-  };
-  doc.addEventListener("DOMContentLoaded", schedule);
-  doc.addEventListener("visibilitychange", schedule);
-  doc.addEventListener("prerenderingchange", schedule);
-  schedule();
-  return () => {
-    active = false;
-    cancelPending();
-    doc.removeEventListener("DOMContentLoaded", schedule);
-    doc.removeEventListener("visibilitychange", schedule);
-    doc.removeEventListener("prerenderingchange", schedule);
-  };
-}
 var READER_SSO_BOT_PATTERN = /bot|crawl|spider|headless|lighthouse|pagespeed|preview|slurp|facebookexternalhit|embedly|python|curl|wget|phantom|puppeteer|playwright|selenium|prerender/i;
 var READER_SSO_PRIVATE_PATHS = [
   /^\/account(\/|$)/,
@@ -86,72 +46,7 @@ function isFormField(element) {
   const tag = focused.tagName;
   return tag === "INPUT" || tag === "TEXTAREA" || tag === "SELECT" || focused.isContentEditable === true;
 }
-var ATTEMPT_KEY = "reader-sso-attempt-v1";
-function readAttempt() {
-  try {
-    const raw = window.sessionStorage.getItem(ATTEMPT_KEY);
-    const value = raw ? Number(raw) : NaN;
-    return Number.isFinite(value) ? value : null;
-  } catch {
-    return null;
-  }
-}
-function writeAttempt(now) {
-  try {
-    window.sessionStorage.setItem(ATTEMPT_KEY, String(now));
-  } catch {
-  }
-}
-function browserEnvironment(flags) {
-  const doc = document;
-  let framed = false;
-  try {
-    framed = window.top !== window.self;
-  } catch {
-    framed = true;
-  }
-  return {
-    ...flags,
-    webdriver: navigator.webdriver === true,
-    userAgent: navigator.userAgent,
-    pathname: location.pathname,
-    search: location.search,
-    fieldFocused: isFormField(document.activeElement),
-    prerendering: doc.prerendering === true,
-    visibilityState: document.visibilityState,
-    framed,
-    lastAttemptAt: readAttempt(),
-    now: Date.now()
-  };
-}
-function ReaderSsoBoot({ enabled = true, hasSession: hasSessionCookie, suppressed, startPath = "/api/news/ledvery-start", sessionPath = "/api/news/session", privatePaths, idleDelayMs = 1500 }) {
-  const [staleCookie, setStaleCookie] = react.useState(false);
-  react.useEffect(() => {
-    if (!enabled || !hasSessionCookie || staleCookie) return;
-    let cancelled = false;
-    fetch(sessionPath, { credentials: "same-origin", cache: "no-store" }).then((response) => response.json()).then((body) => {
-      if (!cancelled && (body?.authenticated !== true || body.session_upgrade_required === true)) setStaleCookie(true);
-    }).catch(() => {
-    });
-    return () => {
-      cancelled = true;
-    };
-  }, [enabled, hasSessionCookie, staleCookie, sessionPath]);
-  const hasSession = hasSessionCookie && !staleCookie;
-  react.useEffect(() => {
-    const flags = { enabled, hasSession, suppressed, privatePaths };
-    return mountReaderSsoScheduler({
-      document,
-      timers: window,
-      idleDelayMs,
-      eligible: () => silentSignInDecision(browserEnvironment(flags)).attempt === true,
-      attempt: () => {
-        const env = browserEnvironment(flags);
-        writeAttempt(env.now);
-        window.location.assign(silentSignInUrl(startPath, env.pathname, env.search));
-      }
-    });
-  }, [enabled, hasSession, suppressed, startPath, privatePaths, idleDelayMs]);
+function ReaderSsoBoot(_props) {
   return null;
 }
 function firstName(fullName) {
@@ -376,7 +271,7 @@ function AccountLinkForm({
           /* @__PURE__ */ jsxRuntime.jsx("input", { type: "password", autoComplete: "current-password", required: true, minLength: 1, maxLength: 1024, value: password, onChange: (e) => setPassword(e.target.value) })
         ] }),
         mfaRequired && /* @__PURE__ */ jsxRuntime.jsxs("label", { children: [
-          "Authentication code",
+          "Verification code",
           /* @__PURE__ */ jsxRuntime.jsx("input", { type: "text", inputMode: "numeric", autoComplete: "one-time-code", required: true, maxLength: 32, value: code, onChange: (e) => setCode(e.target.value) })
         ] }),
         /* @__PURE__ */ jsxRuntime.jsx("button", { className: classNames.button, disabled: busy || !password || mfaRequired && !code, children: busy ? "Connecting\u2026" : "Connect and sign in" }),

package/dist/reader-sso-client.d.cts

@@ -28,16 +28,18 @@ type SilentSignInDecision = {
     attempt: false;
     reason: string;
 };
+/** @deprecated No automatic reader sign-in should use this decision. */
 declare function silentSignInDecision(env: SilentSignInEnvironment): SilentSignInDecision;
+/** @deprecated Use an explicit, user-initiated handoff flow instead. */
 declare function silentSignInUrl(startPath: string, pathname: string, search: string): string;
 declare function isFormField(element: Element | null): boolean;
 /**
- * Renders nothing. Once per page load, after the DOM is usable and an idle period, performs a
- * top-level navigation to the silent sign-in start route when nothing argues
- * against it. The server sets the negative-cache cookie on every silent negative,
- * so this can never loop.
+ * Compatibility export for publications that still mount the old boot island.
+ * Reader identity is checked by the same-origin session UI; authentication
+ * must begin with an intentional click, never a timer or page-load navigation.
+ * @deprecated Remove this component from publication layouts.
  */
-declare function ReaderSsoBoot({ enabled, hasSession: hasSessionCookie, suppressed, startPath, sessionPath, privatePaths, idleDelayMs }: {
+declare function ReaderSsoBoot(_props: {
     enabled?: boolean;
     /** A reader session cookie is present (it may have been revoked elsewhere). */
     hasSession: boolean;

package/dist/reader-sso-client.d.ts

@@ -28,16 +28,18 @@ type SilentSignInDecision = {
     attempt: false;
     reason: string;
 };
+/** @deprecated No automatic reader sign-in should use this decision. */
 declare function silentSignInDecision(env: SilentSignInEnvironment): SilentSignInDecision;
+/** @deprecated Use an explicit, user-initiated handoff flow instead. */
 declare function silentSignInUrl(startPath: string, pathname: string, search: string): string;
 declare function isFormField(element: Element | null): boolean;
 /**
- * Renders nothing. Once per page load, after the DOM is usable and an idle period, performs a
- * top-level navigation to the silent sign-in start route when nothing argues
- * against it. The server sets the negative-cache cookie on every silent negative,
- * so this can never loop.
+ * Compatibility export for publications that still mount the old boot island.
+ * Reader identity is checked by the same-origin session UI; authentication
+ * must begin with an intentional click, never a timer or page-load navigation.
+ * @deprecated Remove this component from publication layouts.
  */
-declare function ReaderSsoBoot({ enabled, hasSession: hasSessionCookie, suppressed, startPath, sessionPath, privatePaths, idleDelayMs }: {
+declare function ReaderSsoBoot(_props: {
     enabled?: boolean;
     /** A reader session cookie is present (it may have been revoked elsewhere). */
     hasSession: boolean;

package/dist/reader-sso-client.js

@@ -2,46 +2,6 @@
 import { useState, useEffect, useId } from 'react';
 import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
 
-// src/reader-sso-scheduler.ts
-function mountReaderSsoScheduler({ document: doc, timers, eligible, attempt, idleDelayMs }) {
-  let active = true;
-  let attempted = false;
-  let idle;
-  let delay;
-  const cancelPending = () => {
-    if (idle !== void 0) timers.cancelIdleCallback?.(idle);
-    if (delay !== void 0) timers.clearTimeout(delay);
-    idle = delay = void 0;
-  };
-  const run = () => {
-    delay = void 0;
-    if (!active || attempted || !eligible()) return;
-    attempted = true;
-    attempt();
-  };
-  const defer = () => {
-    idle = void 0;
-    if (active && !attempted) delay = timers.setTimeout(run, idleDelayMs);
-  };
-  const schedule = () => {
-    if (!active || attempted) return;
-    cancelPending();
-    if (doc.readyState === "loading" || !eligible()) return;
-    if (timers.requestIdleCallback) idle = timers.requestIdleCallback(defer, { timeout: 4e3 });
-    else defer();
-  };
-  doc.addEventListener("DOMContentLoaded", schedule);
-  doc.addEventListener("visibilitychange", schedule);
-  doc.addEventListener("prerenderingchange", schedule);
-  schedule();
-  return () => {
-    active = false;
-    cancelPending();
-    doc.removeEventListener("DOMContentLoaded", schedule);
-    doc.removeEventListener("visibilitychange", schedule);
-    doc.removeEventListener("prerenderingchange", schedule);
-  };
-}
 var READER_SSO_BOT_PATTERN = /bot|crawl|spider|headless|lighthouse|pagespeed|preview|slurp|facebookexternalhit|embedly|python|curl|wget|phantom|puppeteer|playwright|selenium|prerender/i;
 var READER_SSO_PRIVATE_PATHS = [
   /^\/account(\/|$)/,
@@ -84,72 +44,7 @@ function isFormField(element) {
   const tag = focused.tagName;
   return tag === "INPUT" || tag === "TEXTAREA" || tag === "SELECT" || focused.isContentEditable === true;
 }
-var ATTEMPT_KEY = "reader-sso-attempt-v1";
-function readAttempt() {
-  try {
-    const raw = window.sessionStorage.getItem(ATTEMPT_KEY);
-    const value = raw ? Number(raw) : NaN;
-    return Number.isFinite(value) ? value : null;
-  } catch {
-    return null;
-  }
-}
-function writeAttempt(now) {
-  try {
-    window.sessionStorage.setItem(ATTEMPT_KEY, String(now));
-  } catch {
-  }
-}
-function browserEnvironment(flags) {
-  const doc = document;
-  let framed = false;
-  try {
-    framed = window.top !== window.self;
-  } catch {
-    framed = true;
-  }
-  return {
-    ...flags,
-    webdriver: navigator.webdriver === true,
-    userAgent: navigator.userAgent,
-    pathname: location.pathname,
-    search: location.search,
-    fieldFocused: isFormField(document.activeElement),
-    prerendering: doc.prerendering === true,
-    visibilityState: document.visibilityState,
-    framed,
-    lastAttemptAt: readAttempt(),
-    now: Date.now()
-  };
-}
-function ReaderSsoBoot({ enabled = true, hasSession: hasSessionCookie, suppressed, startPath = "/api/news/ledvery-start", sessionPath = "/api/news/session", privatePaths, idleDelayMs = 1500 }) {
-  const [staleCookie, setStaleCookie] = useState(false);
-  useEffect(() => {
-    if (!enabled || !hasSessionCookie || staleCookie) return;
-    let cancelled = false;
-    fetch(sessionPath, { credentials: "same-origin", cache: "no-store" }).then((response) => response.json()).then((body) => {
-      if (!cancelled && (body?.authenticated !== true || body.session_upgrade_required === true)) setStaleCookie(true);
-    }).catch(() => {
-    });
-    return () => {
-      cancelled = true;
-    };
-  }, [enabled, hasSessionCookie, staleCookie, sessionPath]);
-  const hasSession = hasSessionCookie && !staleCookie;
-  useEffect(() => {
-    const flags = { enabled, hasSession, suppressed, privatePaths };
-    return mountReaderSsoScheduler({
-      document,
-      timers: window,
-      idleDelayMs,
-      eligible: () => silentSignInDecision(browserEnvironment(flags)).attempt === true,
-      attempt: () => {
-        const env = browserEnvironment(flags);
-        writeAttempt(env.now);
-        window.location.assign(silentSignInUrl(startPath, env.pathname, env.search));
-      }
-    });
-  }, [enabled, hasSession, suppressed, startPath, privatePaths, idleDelayMs]);
+function ReaderSsoBoot(_props) {
   return null;
 }
 function firstName(fullName) {
@@ -374,7 +269,7 @@ function AccountLinkForm({
           /* @__PURE__ */ jsx("input", { type: "password", autoComplete: "current-password", required: true, minLength: 1, maxLength: 1024, value: password, onChange: (e) => setPassword(e.target.value) })
         ] }),
         mfaRequired && /* @__PURE__ */ jsxs("label", { children: [
-          "Authentication code",
+          "Verification code",
           /* @__PURE__ */ jsx("input", { type: "text", inputMode: "numeric", autoComplete: "one-time-code", required: true, maxLength: 32, value: code, onChange: (e) => setCode(e.target.value) })
         ] }),
         /* @__PURE__ */ jsx("button", { className: classNames.button, disabled: busy || !password || mfaRequired && !code, children: busy ? "Connecting\u2026" : "Connect and sign in" }),

package/dist/reader-sso.cjs

@@ -34,7 +34,8 @@ function readerSsoCookieNames(prefix) {
     newsletter: `${prefix}-newsletter`,
     ssoChecked: `${prefix}-sso-checked`,
     signedOut: `${prefix}-signed-out`,
-    pending: `${prefix}-sso-pending`
+    pending: `${prefix}-sso-pending`,
+    linkCode: `${prefix}-link-code`
   };
 }
 var readerSsoCookieOptions = { httpOnly: true, secure: true, sameSite: "lax", path: "/" };
@@ -365,6 +366,35 @@ function linkFailureMessage(code) {
       return null;
   }
 }
+function linkEmailCodeFailure(code, response, cookieName) {
+  switch (code) {
+    case "LOGIN_CHALLENGE_REQUIRED": {
+      const body = response.body;
+      let token = "";
+      try {
+        const parsed = JSON.parse(typeof body?.error?.message === "string" ? body.error.message : "{}");
+        token = typeof parsed.challenge_token === "string" && parsed.challenge_token.length <= 256 ? parsed.challenge_token : "";
+      } catch {
+        token = "";
+      }
+      if (!token) return null;
+      return {
+        status: 401,
+        mfaRequired: true,
+        error: "We emailed a 6-digit code to your reader account's address. Enter it to finish connecting your sign-in.",
+        cookies: [{ name: cookieName, value: token, maxAge: 600 }]
+      };
+    }
+    case "LOGIN_CHALLENGE_INVALID":
+      return { status: 401, mfaRequired: true, error: "That code is incorrect or expired. Check the most recent email, or start over for a new code.", cookies: [] };
+    case "CHALLENGE_RATE_LIMITED":
+      return { status: 429, mfaRequired: true, error: "Please wait a minute before asking for another code.", cookies: [] };
+    case "LOGIN_CHALLENGE_LOCKED":
+      return { status: 429, error: "Too many incorrect codes. Reset your reader account password to continue.", cookies: [{ name: cookieName, value: "", maxAge: 0 }] };
+    default:
+      return null;
+  }
+}
 async function linkAccount(config, input) {
   const c = resolve(config);
   const challengeId = typeof input.challenge_id === "string" && CHALLENGE_ID.test(input.challenge_id) ? input.challenge_id : "";
@@ -378,9 +408,16 @@ async function linkAccount(config, input) {
   if (mfaCode && (mfaCode.length > 32 || !/^[A-Za-z0-9-]+$/.test(mfaCode))) {
     return { ok: false, status: 400, error: "Enter the code exactly as your authenticator app shows it.", cookies: [], mfaRequired: true };
   }
+  const emailChallenge = input.cookies(c.names.linkCode) || "";
+  const linkBody = emailChallenge && mfaCode ? { challenge_id: challengeId, password, challenge_token: emailChallenge, challenge_code: mfaCode } : { challenge_id: challengeId, password, ...mfaCode ? { mfa_code: mfaCode } : {} };
   try {
-    const response = await c.request("/v1/auth/oauth/ledvery/link", { method: "POST", body: { challenge_id: challengeId, password, ...mfaCode ? { mfa_code: mfaCode } : {} } });
+    const response = await c.request("/v1/auth/oauth/ledvery/link", { method: "POST", body: linkBody });
     if (failed(response)) {
+      const emailCode = linkEmailCodeFailure(errorCode(response), response, c.names.linkCode);
+      if (emailCode) {
+        emit(c, { name: "reader_signin_failed", properties: { reason: "mfa_required", mode: "interactive" } });
+        return { ok: false, ...emailCode };
+      }
       const specific = linkFailureMessage(errorCode(response));
       if (specific) {
         emit(c, { name: "reader_signin_failed", properties: { reason: specific.mfaRequired ? "mfa_required" : "link_invalid", mode: "interactive" } });
@@ -391,7 +428,7 @@ async function linkAccount(config, input) {
     }
     const session = issuedSession(response, c.now());
     const flow = { digest: "", subscribe: input.subscribe === true, expires: 0, returnTo: next, mode: "interactive", provider: void 0 };
-    const result = await establish(c, { session, flow, method: "link", cookies: [], input, negativeCache: { name: c.names.ssoChecked, value: "1", maxAge: READER_SSO_NEGATIVE_CACHE_SECONDS } });
+    const result = await establish(c, { session, flow, method: "link", cookies: emailChallenge ? [clear(c.names.linkCode)] : [], input, negativeCache: { name: c.names.ssoChecked, value: "1", maxAge: READER_SSO_NEGATIVE_CACHE_SECONDS } });
     if (result.kind === "signed-in") emit(c, { name: "reader_account_linked", properties: {} });
     return result.kind === "signed-in" ? { ok: true, switch: false, cookies: result.cookies, token: result.token, expiresAt: result.expiresAt, user: result.user, location: result.location } : { ok: true, switch: true, cookies: result.cookies, location: result.location };
   } catch {

package/dist/reader-sso.d.cts

@@ -23,6 +23,8 @@ type ReaderSsoCookieNames = {
     signedOut: string;
     /** A verified session waiting for the reader to choose between two accounts. */
     pending: string;
+    /** Linking onto an unconfirmed account: the platform's emailed-code challenge token (10 minutes). */
+    linkCode: string;
 };
 /** Cookie names derived from a `__Host-` prefix, e.g. `__Host-media` → `__Host-media-reader`. */
 declare function readerSsoCookieNames(prefix: string): ReaderSsoCookieNames;

package/dist/reader-sso.d.ts

@@ -23,6 +23,8 @@ type ReaderSsoCookieNames = {
     signedOut: string;
     /** A verified session waiting for the reader to choose between two accounts. */
     pending: string;
+    /** Linking onto an unconfirmed account: the platform's emailed-code challenge token (10 minutes). */
+    linkCode: string;
 };
 /** Cookie names derived from a `__Host-` prefix, e.g. `__Host-media` → `__Host-media-reader`. */
 declare function readerSsoCookieNames(prefix: string): ReaderSsoCookieNames;

package/dist/reader-sso.js

@@ -19,7 +19,8 @@ function readerSsoCookieNames(prefix) {
     newsletter: `${prefix}-newsletter`,
     ssoChecked: `${prefix}-sso-checked`,
     signedOut: `${prefix}-signed-out`,
-    pending: `${prefix}-sso-pending`
+    pending: `${prefix}-sso-pending`,
+    linkCode: `${prefix}-link-code`
   };
 }
 var readerSsoCookieOptions = { httpOnly: true, secure: true, sameSite: "lax", path: "/" };
@@ -350,6 +351,35 @@ function linkFailureMessage(code) {
       return null;
   }
 }
+function linkEmailCodeFailure(code, response, cookieName) {
+  switch (code) {
+    case "LOGIN_CHALLENGE_REQUIRED": {
+      const body = response.body;
+      let token = "";
+      try {
+        const parsed = JSON.parse(typeof body?.error?.message === "string" ? body.error.message : "{}");
+        token = typeof parsed.challenge_token === "string" && parsed.challenge_token.length <= 256 ? parsed.challenge_token : "";
+      } catch {
+        token = "";
+      }
+      if (!token) return null;
+      return {
+        status: 401,
+        mfaRequired: true,
+        error: "We emailed a 6-digit code to your reader account's address. Enter it to finish connecting your sign-in.",
+        cookies: [{ name: cookieName, value: token, maxAge: 600 }]
+      };
+    }
+    case "LOGIN_CHALLENGE_INVALID":
+      return { status: 401, mfaRequired: true, error: "That code is incorrect or expired. Check the most recent email, or start over for a new code.", cookies: [] };
+    case "CHALLENGE_RATE_LIMITED":
+      return { status: 429, mfaRequired: true, error: "Please wait a minute before asking for another code.", cookies: [] };
+    case "LOGIN_CHALLENGE_LOCKED":
+      return { status: 429, error: "Too many incorrect codes. Reset your reader account password to continue.", cookies: [{ name: cookieName, value: "", maxAge: 0 }] };
+    default:
+      return null;
+  }
+}
 async function linkAccount(config, input) {
   const c = resolve(config);
   const challengeId = typeof input.challenge_id === "string" && CHALLENGE_ID.test(input.challenge_id) ? input.challenge_id : "";
@@ -363,9 +393,16 @@ async function linkAccount(config, input) {
   if (mfaCode && (mfaCode.length > 32 || !/^[A-Za-z0-9-]+$/.test(mfaCode))) {
     return { ok: false, status: 400, error: "Enter the code exactly as your authenticator app shows it.", cookies: [], mfaRequired: true };
   }
+  const emailChallenge = input.cookies(c.names.linkCode) || "";
+  const linkBody = emailChallenge && mfaCode ? { challenge_id: challengeId, password, challenge_token: emailChallenge, challenge_code: mfaCode } : { challenge_id: challengeId, password, ...mfaCode ? { mfa_code: mfaCode } : {} };
   try {
-    const response = await c.request("/v1/auth/oauth/ledvery/link", { method: "POST", body: { challenge_id: challengeId, password, ...mfaCode ? { mfa_code: mfaCode } : {} } });
+    const response = await c.request("/v1/auth/oauth/ledvery/link", { method: "POST", body: linkBody });
     if (failed(response)) {
+      const emailCode = linkEmailCodeFailure(errorCode(response), response, c.names.linkCode);
+      if (emailCode) {
+        emit(c, { name: "reader_signin_failed", properties: { reason: "mfa_required", mode: "interactive" } });
+        return { ok: false, ...emailCode };
+      }
       const specific = linkFailureMessage(errorCode(response));
       if (specific) {
         emit(c, { name: "reader_signin_failed", properties: { reason: specific.mfaRequired ? "mfa_required" : "link_invalid", mode: "interactive" } });
@@ -376,7 +413,7 @@ async function linkAccount(config, input) {
     }
     const session = issuedSession(response, c.now());
     const flow = { digest: "", subscribe: input.subscribe === true, expires: 0, returnTo: next, mode: "interactive", provider: void 0 };
-    const result = await establish(c, { session, flow, method: "link", cookies: [], input, negativeCache: { name: c.names.ssoChecked, value: "1", maxAge: READER_SSO_NEGATIVE_CACHE_SECONDS } });
+    const result = await establish(c, { session, flow, method: "link", cookies: emailChallenge ? [clear(c.names.linkCode)] : [], input, negativeCache: { name: c.names.ssoChecked, value: "1", maxAge: READER_SSO_NEGATIVE_CACHE_SECONDS } });
     if (result.kind === "signed-in") emit(c, { name: "reader_account_linked", properties: {} });
     return result.kind === "signed-in" ? { ok: true, switch: false, cookies: result.cookies, token: result.token, expiresAt: result.expiresAt, user: result.user, location: result.location } : { ok: true, switch: true, cookies: result.cookies, location: result.location };
   } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scalemule/news-publication",
-  "version": "0.0.86",
+  "version": "0.0.88",
   "description": "Shared server framework for ScaleMule local news publications. Walnut Creek Times is the broadsheet default; each paper supplies its own identity and feature flags.",
   "type": "module",
   "bin": {