@scalemule/news-publication 0.0.87 → 0.0.88

package/README.md

@@ -260,11 +260,11 @@ other than that key and the browser only ever sees host-only HttpOnly cookies.
 `sessionSummary` return cookie instructions and destinations; the site applies
 them with `applyCookies` and answers with private, no-store headers. Merge
 `READER_SSO_EVENTS` into the site's analytics registry and allow
-`READER_SSO_PROPERTY_KEYS` in its property sanitizer. `ReaderSsoBoot` performs at
-most one silent attempt per page load and never on private paths, for bots,
-while typing, in frames or in prerendered documents; the server's negative cache
-makes a loop impossible. `ReaderGreeting` is a client island that renders only a
-first name, in the reader's own time zone and locale, after loading.
+`READER_SSO_PROPERTY_KEYS` in its property sanitizer. `ReaderSsoBoot` is a
+no-op compatibility export: a rendered page never starts Ledvery authorization
+on a timer. The explicit sign-in routes still work. `ReaderGreeting` is a client
+island that renders only a first name, in the reader's own time zone and locale,
+after loading.
 
 ## Community pet sections
 

package/dist/reader-sso-client.cjs

@@ -4,46 +4,6 @@
 var react = require('react');
 var jsxRuntime = require('react/jsx-runtime');
 
-// src/reader-sso-scheduler.ts
-function mountReaderSsoScheduler({ document: doc, timers, eligible, attempt, idleDelayMs }) {
-  let active = true;
-  let attempted = false;
-  let idle;
-  let delay;
-  const cancelPending = () => {
-    if (idle !== void 0) timers.cancelIdleCallback?.(idle);
-    if (delay !== void 0) timers.clearTimeout(delay);
-    idle = delay = void 0;
-  };
-  const run = () => {
-    delay = void 0;
-    if (!active || attempted || !eligible()) return;
-    attempted = true;
-    attempt();
-  };
-  const defer = () => {
-    idle = void 0;
-    if (active && !attempted) delay = timers.setTimeout(run, idleDelayMs);
-  };
-  const schedule = () => {
-    if (!active || attempted) return;
-    cancelPending();
-    if (doc.readyState === "loading" || !eligible()) return;
-    if (timers.requestIdleCallback) idle = timers.requestIdleCallback(defer, { timeout: 4e3 });
-    else defer();
-  };
-  doc.addEventListener("DOMContentLoaded", schedule);
-  doc.addEventListener("visibilitychange", schedule);
-  doc.addEventListener("prerenderingchange", schedule);
-  schedule();
-  return () => {
-    active = false;
-    cancelPending();
-    doc.removeEventListener("DOMContentLoaded", schedule);
-    doc.removeEventListener("visibilitychange", schedule);
-    doc.removeEventListener("prerenderingchange", schedule);
-  };
-}
 var READER_SSO_BOT_PATTERN = /bot|crawl|spider|headless|lighthouse|pagespeed|preview|slurp|facebookexternalhit|embedly|python|curl|wget|phantom|puppeteer|playwright|selenium|prerender/i;
 var READER_SSO_PRIVATE_PATHS = [
   /^\/account(\/|$)/,
@@ -86,72 +46,7 @@ function isFormField(element) {
   const tag = focused.tagName;
   return tag === "INPUT" || tag === "TEXTAREA" || tag === "SELECT" || focused.isContentEditable === true;
 }
-var ATTEMPT_KEY = "reader-sso-attempt-v1";
-function readAttempt() {
-  try {
-    const raw = window.sessionStorage.getItem(ATTEMPT_KEY);
-    const value = raw ? Number(raw) : NaN;
-    return Number.isFinite(value) ? value : null;
-  } catch {
-    return null;
-  }
-}
-function writeAttempt(now) {
-  try {
-    window.sessionStorage.setItem(ATTEMPT_KEY, String(now));
-  } catch {
-  }
-}
-function browserEnvironment(flags) {
-  const doc = document;
-  let framed = false;
-  try {
-    framed = window.top !== window.self;
-  } catch {
-    framed = true;
-  }
-  return {
-    ...flags,
-    webdriver: navigator.webdriver === true,
-    userAgent: navigator.userAgent,
-    pathname: location.pathname,
-    search: location.search,
-    fieldFocused: isFormField(document.activeElement),
-    prerendering: doc.prerendering === true,
-    visibilityState: document.visibilityState,
-    framed,
-    lastAttemptAt: readAttempt(),
-    now: Date.now()
-  };
-}
-function ReaderSsoBoot({ enabled = true, hasSession: hasSessionCookie, suppressed, startPath = "/api/news/ledvery-start", sessionPath = "/api/news/session", privatePaths, idleDelayMs = 1500 }) {
-  const [staleCookie, setStaleCookie] = react.useState(false);
-  react.useEffect(() => {
-    if (!enabled || !hasSessionCookie || staleCookie) return;
-    let cancelled = false;
-    fetch(sessionPath, { credentials: "same-origin", cache: "no-store" }).then((response) => response.json()).then((body) => {
-      if (!cancelled && (body?.authenticated !== true || body.session_upgrade_required === true)) setStaleCookie(true);
-    }).catch(() => {
-    });
-    return () => {
-      cancelled = true;
-    };
-  }, [enabled, hasSessionCookie, staleCookie, sessionPath]);
-  const hasSession = hasSessionCookie && !staleCookie;
-  react.useEffect(() => {
-    const flags = { enabled, hasSession, suppressed, privatePaths };
-    return mountReaderSsoScheduler({
-      document,
-      timers: window,
-      idleDelayMs,
-      eligible: () => silentSignInDecision(browserEnvironment(flags)).attempt === true,
-      attempt: () => {
-        const env = browserEnvironment(flags);
-        writeAttempt(env.now);
-        window.location.assign(silentSignInUrl(startPath, env.pathname, env.search));
-      }
-    });
-  }, [enabled, hasSession, suppressed, startPath, privatePaths, idleDelayMs]);
+function ReaderSsoBoot(_props) {
   return null;
 }
 function firstName(fullName) {

package/dist/reader-sso-client.d.cts

@@ -28,16 +28,18 @@ type SilentSignInDecision = {
     attempt: false;
     reason: string;
 };
+/** @deprecated No automatic reader sign-in should use this decision. */
 declare function silentSignInDecision(env: SilentSignInEnvironment): SilentSignInDecision;
+/** @deprecated Use an explicit, user-initiated handoff flow instead. */
 declare function silentSignInUrl(startPath: string, pathname: string, search: string): string;
 declare function isFormField(element: Element | null): boolean;
 /**
- * Renders nothing. Once per page load, after the DOM is usable and an idle period, performs a
- * top-level navigation to the silent sign-in start route when nothing argues
- * against it. The server sets the negative-cache cookie on every silent negative,
- * so this can never loop.
+ * Compatibility export for publications that still mount the old boot island.
+ * Reader identity is checked by the same-origin session UI; authentication
+ * must begin with an intentional click, never a timer or page-load navigation.
+ * @deprecated Remove this component from publication layouts.
  */
-declare function ReaderSsoBoot({ enabled, hasSession: hasSessionCookie, suppressed, startPath, sessionPath, privatePaths, idleDelayMs }: {
+declare function ReaderSsoBoot(_props: {
     enabled?: boolean;
     /** A reader session cookie is present (it may have been revoked elsewhere). */
     hasSession: boolean;

package/dist/reader-sso-client.d.ts

@@ -28,16 +28,18 @@ type SilentSignInDecision = {
     attempt: false;
     reason: string;
 };
+/** @deprecated No automatic reader sign-in should use this decision. */
 declare function silentSignInDecision(env: SilentSignInEnvironment): SilentSignInDecision;
+/** @deprecated Use an explicit, user-initiated handoff flow instead. */
 declare function silentSignInUrl(startPath: string, pathname: string, search: string): string;
 declare function isFormField(element: Element | null): boolean;
 /**
- * Renders nothing. Once per page load, after the DOM is usable and an idle period, performs a
- * top-level navigation to the silent sign-in start route when nothing argues
- * against it. The server sets the negative-cache cookie on every silent negative,
- * so this can never loop.
+ * Compatibility export for publications that still mount the old boot island.
+ * Reader identity is checked by the same-origin session UI; authentication
+ * must begin with an intentional click, never a timer or page-load navigation.
+ * @deprecated Remove this component from publication layouts.
  */
-declare function ReaderSsoBoot({ enabled, hasSession: hasSessionCookie, suppressed, startPath, sessionPath, privatePaths, idleDelayMs }: {
+declare function ReaderSsoBoot(_props: {
     enabled?: boolean;
     /** A reader session cookie is present (it may have been revoked elsewhere). */
     hasSession: boolean;

package/dist/reader-sso-client.js

@@ -2,46 +2,6 @@
 import { useState, useEffect, useId } from 'react';
 import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
 
-// src/reader-sso-scheduler.ts
-function mountReaderSsoScheduler({ document: doc, timers, eligible, attempt, idleDelayMs }) {
-  let active = true;
-  let attempted = false;
-  let idle;
-  let delay;
-  const cancelPending = () => {
-    if (idle !== void 0) timers.cancelIdleCallback?.(idle);
-    if (delay !== void 0) timers.clearTimeout(delay);
-    idle = delay = void 0;
-  };
-  const run = () => {
-    delay = void 0;
-    if (!active || attempted || !eligible()) return;
-    attempted = true;
-    attempt();
-  };
-  const defer = () => {
-    idle = void 0;
-    if (active && !attempted) delay = timers.setTimeout(run, idleDelayMs);
-  };
-  const schedule = () => {
-    if (!active || attempted) return;
-    cancelPending();
-    if (doc.readyState === "loading" || !eligible()) return;
-    if (timers.requestIdleCallback) idle = timers.requestIdleCallback(defer, { timeout: 4e3 });
-    else defer();
-  };
-  doc.addEventListener("DOMContentLoaded", schedule);
-  doc.addEventListener("visibilitychange", schedule);
-  doc.addEventListener("prerenderingchange", schedule);
-  schedule();
-  return () => {
-    active = false;
-    cancelPending();
-    doc.removeEventListener("DOMContentLoaded", schedule);
-    doc.removeEventListener("visibilitychange", schedule);
-    doc.removeEventListener("prerenderingchange", schedule);
-  };
-}
 var READER_SSO_BOT_PATTERN = /bot|crawl|spider|headless|lighthouse|pagespeed|preview|slurp|facebookexternalhit|embedly|python|curl|wget|phantom|puppeteer|playwright|selenium|prerender/i;
 var READER_SSO_PRIVATE_PATHS = [
   /^\/account(\/|$)/,
@@ -84,72 +44,7 @@ function isFormField(element) {
   const tag = focused.tagName;
   return tag === "INPUT" || tag === "TEXTAREA" || tag === "SELECT" || focused.isContentEditable === true;
 }
-var ATTEMPT_KEY = "reader-sso-attempt-v1";
-function readAttempt() {
-  try {
-    const raw = window.sessionStorage.getItem(ATTEMPT_KEY);
-    const value = raw ? Number(raw) : NaN;
-    return Number.isFinite(value) ? value : null;
-  } catch {
-    return null;
-  }
-}
-function writeAttempt(now) {
-  try {
-    window.sessionStorage.setItem(ATTEMPT_KEY, String(now));
-  } catch {
-  }
-}
-function browserEnvironment(flags) {
-  const doc = document;
-  let framed = false;
-  try {
-    framed = window.top !== window.self;
-  } catch {
-    framed = true;
-  }
-  return {
-    ...flags,
-    webdriver: navigator.webdriver === true,
-    userAgent: navigator.userAgent,
-    pathname: location.pathname,
-    search: location.search,
-    fieldFocused: isFormField(document.activeElement),
-    prerendering: doc.prerendering === true,
-    visibilityState: document.visibilityState,
-    framed,
-    lastAttemptAt: readAttempt(),
-    now: Date.now()
-  };
-}
-function ReaderSsoBoot({ enabled = true, hasSession: hasSessionCookie, suppressed, startPath = "/api/news/ledvery-start", sessionPath = "/api/news/session", privatePaths, idleDelayMs = 1500 }) {
-  const [staleCookie, setStaleCookie] = useState(false);
-  useEffect(() => {
-    if (!enabled || !hasSessionCookie || staleCookie) return;
-    let cancelled = false;
-    fetch(sessionPath, { credentials: "same-origin", cache: "no-store" }).then((response) => response.json()).then((body) => {
-      if (!cancelled && (body?.authenticated !== true || body.session_upgrade_required === true)) setStaleCookie(true);
-    }).catch(() => {
-    });
-    return () => {
-      cancelled = true;
-    };
-  }, [enabled, hasSessionCookie, staleCookie, sessionPath]);
-  const hasSession = hasSessionCookie && !staleCookie;
-  useEffect(() => {
-    const flags = { enabled, hasSession, suppressed, privatePaths };
-    return mountReaderSsoScheduler({
-      document,
-      timers: window,
-      idleDelayMs,
-      eligible: () => silentSignInDecision(browserEnvironment(flags)).attempt === true,
-      attempt: () => {
-        const env = browserEnvironment(flags);
-        writeAttempt(env.now);
-        window.location.assign(silentSignInUrl(startPath, env.pathname, env.search));
-      }
-    });
-  }, [enabled, hasSession, suppressed, startPath, privatePaths, idleDelayMs]);
+function ReaderSsoBoot(_props) {
   return null;
 }
 function firstName(fullName) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scalemule/news-publication",
-  "version": "0.0.87",
+  "version": "0.0.88",
   "description": "Shared server framework for ScaleMule local news publications. Walnut Creek Times is the broadsheet default; each paper supplies its own identity and feature flags.",
   "type": "module",
   "bin": {