@scalemule/news-publication 0.0.88 → 0.0.90

package/README.md

@@ -249,7 +249,7 @@ The consent banner now offers a choice in every geography where optional measure
 ## Reader sign-in through Ledvery
 
 The `reader-sso` (server) and `reader-sso-client` entry points generalize the
-publications' Google sign-in into one Ledvery consumer flow with silent sign-in,
+publications' Google sign-in into one Ledvery consumer flow with click-driven handoff,
 explicit email sign-in, account linking, precedence between two accounts,
 RP-initiated sign-out and server-recorded telemetry. A site supplies its cookie
 prefix, canonical origin, Ledvery client id and a request adapter that performs
@@ -262,7 +262,13 @@ them with `applyCookies` and answers with private, no-store headers. Merge
 `READER_SSO_EVENTS` into the site's analytics registry and allow
 `READER_SSO_PROPERTY_KEYS` in its property sanitizer. `ReaderSsoBoot` is a
 no-op compatibility export: a rendered page never starts Ledvery authorization
-on a timer. The explicit sign-in routes still work. `ReaderGreeting` is a client
+on a timer. Ordinary explicit sign-in omits `prompt`; `select_account` is reserved
+for an explicit account-switch control and `prompt=none` for a sister-paper
+handoff. Handoff links carry no identity or session token, and
+`networkHandoffReturnPath` discards caller-selected destinations. The two
+initial canaries are listed by `getNetworkReaderHandoffUrl`; other papers
+remain plain links until their route and client registration are verified.
+`ReaderGreeting` is a client
 island that renders only a first name, in the reader's own time zone and locale,
 after loading.
 

package/dist/{chunk-Q77T2S7B.js → chunk-2E42LCN3.js}

@@ -1,5 +1,5 @@
 "use client";
-import { setupNetworkConsentDelegation, COOKIE_CONSENT_EVENT, listedPublications, decorateNetworkUrl } from './chunk-XWXPERLK.js';
+import { setupNetworkConsentDelegation, COOKIE_CONSENT_EVENT, listedPublications, decorateNetworkUrl } from './chunk-NNEY6VBX.js';
 import { useState, useId, useRef, useEffect } from 'react';
 import { jsx, jsxs } from 'react/jsx-runtime';
 

package/dist/{chunk-XSAVJJVW.js → chunk-D27NMCRK.js}

@@ -1,5 +1,5 @@
 "use client";
-import { hasConsented, rejectOptionalCookies, DEFAULT_CONSENT_HUB_URL, consentModel, isGpcActive, COOKIE_CONSENT_EVENT, acceptAllCookies, recordConsentToCompliance } from './chunk-XWXPERLK.js';
+import { hasConsented, rejectOptionalCookies, DEFAULT_CONSENT_HUB_URL, consentModel, isGpcActive, COOKIE_CONSENT_EVENT, acceptAllCookies, recordConsentToCompliance } from './chunk-NNEY6VBX.js';
 import { useState, useEffect } from 'react';
 import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
 

package/dist/{chunk-FWEYKWKP.js → chunk-FJ672GWO.js}

@@ -1,4 +1,4 @@
-import { NETWORK_PARENT } from './chunk-XWXPERLK.js';
+import { NETWORK_PARENT } from './chunk-NNEY6VBX.js';
 import { jsxs, jsx } from 'react/jsx-runtime';
 
 function NetworkCopyrightNotice({

package/dist/{chunk-XWXPERLK.js → chunk-NNEY6VBX.js}

@@ -368,6 +368,10 @@ function getNetworkPublicationUrl(slug) {
   if (!pub) return null;
   return decorateNetworkUrl(pub.url + "/");
 }
+function getNetworkReaderHandoffUrl(slug) {
+  const publication = findPublicationBySlug(slug);
+  return publication ? `${publication.url}/api/news/network-handoff` : null;
+}
 var NETWORK_HOSTNAMES = new Set(
   localPublications.map((p) => {
     try {
@@ -383,4 +387,4 @@ function isNetworkHostname(hostname) {
   return clean === "bayareanewsnetwork.com" || clean.endsWith(".bayareanewsnetwork.com") || NETWORK_HOSTNAMES.has(clean) || clean.endsWith(".bayareachronicle.com") || clean.endsWith(".napsite.com") || clean.endsWith(".site.scalemule.com");
 }
 
-export { COOKIE_CATEGORIES, EDITORIAL_PRINCIPLES, NETWORK_PARENT, communityPublications, findPublicationByHost, findPublicationBySlug, getNetworkPublicationUrl, isNetworkHostname, listedPublications, localPublications, recordConsentToCompliance, setupNetworkConsentDelegation, topicalPublications };
+export { COOKIE_CATEGORIES, EDITORIAL_PRINCIPLES, NETWORK_PARENT, communityPublications, findPublicationByHost, findPublicationBySlug, getNetworkPublicationUrl, getNetworkReaderHandoffUrl, isNetworkHostname, listedPublications, localPublications, recordConsentToCompliance, setupNetworkConsentDelegation, topicalPublications };

package/dist/{chunk-X7AU7DV6.js → chunk-PBRDIXQI.js}

@@ -1,5 +1,5 @@
 "use client";
-import { effectivePreferences, getCookieConsent, COOKIE_CATEGORIES, setCookieConsent, recordConsentToCompliance, DEFAULT_PREFERENCES_ACCEPTED, DEFAULT_PREFERENCES_REJECTED } from './chunk-XWXPERLK.js';
+import { effectivePreferences, getCookieConsent, COOKIE_CATEGORIES, setCookieConsent, recordConsentToCompliance, DEFAULT_PREFERENCES_ACCEPTED, DEFAULT_PREFERENCES_REJECTED } from './chunk-NNEY6VBX.js';
 import { useState, useEffect } from 'react';
 import { jsxs, jsx } from 'react/jsx-runtime';
 

package/dist/cookie-consent-banner.js

@@ -1,3 +1,3 @@
 "use client";
-export { CookieConsentBanner } from './chunk-XSAVJJVW.js';
-import './chunk-XWXPERLK.js';
+export { CookieConsentBanner } from './chunk-D27NMCRK.js';
+import './chunk-NNEY6VBX.js';

package/dist/cookie-settings-view.js

@@ -1,3 +1,3 @@
 "use client";
-export { CookieSettingsView } from './chunk-X7AU7DV6.js';
-import './chunk-XWXPERLK.js';
+export { CookieSettingsView } from './chunk-PBRDIXQI.js';
+import './chunk-NNEY6VBX.js';

package/dist/index.cjs

@@ -1477,6 +1477,10 @@ function getNetworkPublicationUrl(slug) {
   if (!pub) return null;
   return compliance.decorateNetworkUrl(pub.url + "/");
 }
+function getNetworkReaderHandoffUrl(slug) {
+  const publication = findPublicationBySlug(slug);
+  return publication ? `${publication.url}/api/news/network-handoff` : null;
+}
 var NETWORK_HOSTNAMES = new Set(
   localPublications.map((p) => {
     try {
@@ -4001,6 +4005,7 @@ exports.findPublicationBySlug = findPublicationBySlug;
 exports.formatArtworkCaption = formatArtworkCaption;
 exports.getArticleCards = getArticleCards;
 exports.getNetworkPublicationUrl = getNetworkPublicationUrl;
+exports.getNetworkReaderHandoffUrl = getNetworkReaderHandoffUrl;
 exports.getStoredTheme = getStoredTheme;
 exports.getSystemTheme = getSystemTheme;
 exports.inventoryCacheOptions = inventoryCacheOptions;

package/dist/index.d.cts

@@ -8,7 +8,7 @@ export { COOKIE_CONSENT_BACKUP_KEY, COOKIE_CONSENT_EVENT, COOKIE_CONSENT_KEY, CO
 export { CookieConsentBanner, CookieConsentBannerProps } from './cookie-consent-banner.cjs';
 export { CookieSettingsView, CookieSettingsViewProps } from './cookie-settings-view.cjs';
 export { ThemeToggle, ThemeToggleProps } from './theme-toggle.cjs';
-export { EDITORIAL_PRINCIPLES, EditorialPrinciple, NETWORK_PARENT, NetworkParent, PublicationNetworkItem, communityPublications, findPublicationByHost, findPublicationBySlug, getNetworkPublicationUrl, listedPublications, localPublications, topicalPublications } from './network.cjs';
+export { EDITORIAL_PRINCIPLES, EditorialPrinciple, NETWORK_PARENT, NetworkParent, PublicationNetworkItem, communityPublications, findPublicationByHost, findPublicationBySlug, getNetworkPublicationUrl, getNetworkReaderHandoffUrl, listedPublications, localPublications, topicalPublications } from './network.cjs';
 export { LocalNetworkBar, LocalNetworkBarProps } from './network-bar.cjs';
 export { NetworkCopyrightNotice, NetworkCopyrightNoticeProps } from './network-copyright.cjs';
 import * as React from 'react';

package/dist/index.d.ts

@@ -8,7 +8,7 @@ export { COOKIE_CONSENT_BACKUP_KEY, COOKIE_CONSENT_EVENT, COOKIE_CONSENT_KEY, CO
 export { CookieConsentBanner, CookieConsentBannerProps } from './cookie-consent-banner.js';
 export { CookieSettingsView, CookieSettingsViewProps } from './cookie-settings-view.js';
 export { ThemeToggle, ThemeToggleProps } from './theme-toggle.js';
-export { EDITORIAL_PRINCIPLES, EditorialPrinciple, NETWORK_PARENT, NetworkParent, PublicationNetworkItem, communityPublications, findPublicationByHost, findPublicationBySlug, getNetworkPublicationUrl, listedPublications, localPublications, topicalPublications } from './network.js';
+export { EDITORIAL_PRINCIPLES, EditorialPrinciple, NETWORK_PARENT, NetworkParent, PublicationNetworkItem, communityPublications, findPublicationByHost, findPublicationBySlug, getNetworkPublicationUrl, getNetworkReaderHandoffUrl, listedPublications, localPublications, topicalPublications } from './network.js';
 export { LocalNetworkBar, LocalNetworkBarProps } from './network-bar.js';
 export { NetworkCopyrightNotice, NetworkCopyrightNoticeProps } from './network-copyright.js';
 import * as React from 'react';

package/dist/index.js

@@ -1,12 +1,12 @@
-export { LocalNetworkBar } from './chunk-Q77T2S7B.js';
-export { NetworkCopyrightNotice } from './chunk-FWEYKWKP.js';
+export { LocalNetworkBar } from './chunk-2E42LCN3.js';
+export { NetworkCopyrightNotice } from './chunk-FJ672GWO.js';
 export { CURATED_COMMUNITY_CARDS, VerifiedCardComponent, VerifiedCardSection, getArticleCards, isSafeActionUrl } from './chunk-KYUVXEJY.js';
 export { CLASSIFIED_CATEGORIES, JOB_EMPLOYMENT_TYPES, categoryLabel, classifiedPath, classifiedSearchPath, clipChars, dealDollars, dealGoPath, dealsFeedPath, employmentLabel, isClassifiedCategory, isEmploymentType, jobEmployerBody, jobOpeningBody, jobPostingBody, prepareClassified, prepareJobPost, publicJobPath, publicJobsPath } from './chunk-C7ZPLH2K.js';
 export { MEET_ACTIVITIES, activityLabel, canHostMeetup, isAdult, prepareMeetup, screenMessage } from './chunk-AMLVCZDP.js';
-export { CookieConsentBanner } from './chunk-XSAVJJVW.js';
-export { CookieSettingsView } from './chunk-X7AU7DV6.js';
-import { localPublications } from './chunk-XWXPERLK.js';
-export { COOKIE_CATEGORIES, COOKIE_CONSENT_BACKUP_KEY, COOKIE_CONSENT_EVENT, COOKIE_CONSENT_KEY, COOKIE_CONSENT_MAX_AGE_SECONDS, DEFAULT_CONSENT_HUB_URL, DEFAULT_PREFERENCES_ACCEPTED, DEFAULT_PREFERENCES_REJECTED, EDITORIAL_PRINCIPLES, EU_EEA_UK_COUNTRIES, NETWORK_CONSENT_STORAGE_KEY, NETWORK_PARENT, acceptAllCookies, checkUrlConsentBridge, clearCookieConsent, communityPublications, consentModel, decorateNetworkUrl, effectivePreferences, findPublicationByHost, findPublicationBySlug, getCookieConsent, getNetworkPublicationUrl, hasConsented, impliedPreferences, isCategoryAllowed, isGeoConsentRequired, listedPublications, localPublications, queryNetworkConsentHub, recordConsentToCompliance, rejectOptionalCookies, setCookieConsent, setNetworkConsentHub, topicalPublications } from './chunk-XWXPERLK.js';
+export { CookieConsentBanner } from './chunk-D27NMCRK.js';
+export { CookieSettingsView } from './chunk-PBRDIXQI.js';
+import { localPublications } from './chunk-NNEY6VBX.js';
+export { COOKIE_CATEGORIES, COOKIE_CONSENT_BACKUP_KEY, COOKIE_CONSENT_EVENT, COOKIE_CONSENT_KEY, COOKIE_CONSENT_MAX_AGE_SECONDS, DEFAULT_CONSENT_HUB_URL, DEFAULT_PREFERENCES_ACCEPTED, DEFAULT_PREFERENCES_REJECTED, EDITORIAL_PRINCIPLES, EU_EEA_UK_COUNTRIES, NETWORK_CONSENT_STORAGE_KEY, NETWORK_PARENT, acceptAllCookies, checkUrlConsentBridge, clearCookieConsent, communityPublications, consentModel, decorateNetworkUrl, effectivePreferences, findPublicationByHost, findPublicationBySlug, getCookieConsent, getNetworkPublicationUrl, getNetworkReaderHandoffUrl, hasConsented, impliedPreferences, isCategoryAllowed, isGeoConsentRequired, listedPublications, localPublications, queryNetworkConsentHub, recordConsentToCompliance, rejectOptionalCookies, setCookieConsent, setNetworkConsentHub, topicalPublications } from './chunk-NNEY6VBX.js';
 export { THEME_COOKIE, THEME_EVENT, THEME_MAX_AGE_SECONDS, THEME_STORAGE_KEY, ThemeToggle, applyTheme, clearTheme, getStoredTheme, getSystemTheme, resolveEffectiveTheme, setTheme, subscribeTheme, themeInitScript } from './chunk-NQD3M7ZY.js';
 export { communityMapEmbeds } from './chunk-IMYBSG7J.js';
 export { articleFormatLabel, articleHeroRatio, articlePresentation, formatArtworkCaption, parseDocumentBlocks, renderArticleBlocksToHtml, sanitizeInlineMarkdown } from './chunk-DN3TBZLK.js';

package/dist/network-bar.js

@@ -1,2 +1,2 @@
-export { LocalNetworkBar } from './chunk-Q77T2S7B.js';
-import './chunk-XWXPERLK.js';
+export { LocalNetworkBar } from './chunk-2E42LCN3.js';
+import './chunk-NNEY6VBX.js';

package/dist/network-copyright.js

@@ -1,2 +1,2 @@
-export { NetworkCopyrightNotice } from './chunk-FWEYKWKP.js';
-import './chunk-XWXPERLK.js';
+export { NetworkCopyrightNotice } from './chunk-FJ672GWO.js';
+import './chunk-NNEY6VBX.js';

package/dist/network.cjs

@@ -245,6 +245,10 @@ function getNetworkPublicationUrl(slug) {
   if (!pub) return null;
   return compliance.decorateNetworkUrl(pub.url + "/");
 }
+function getNetworkReaderHandoffUrl(slug) {
+  const publication = findPublicationBySlug(slug);
+  return publication ? `${publication.url}/api/news/network-handoff` : null;
+}
 var NETWORK_HOSTNAMES = new Set(
   localPublications.map((p) => {
     try {
@@ -266,6 +270,7 @@ exports.communityPublications = communityPublications;
 exports.findPublicationByHost = findPublicationByHost;
 exports.findPublicationBySlug = findPublicationBySlug;
 exports.getNetworkPublicationUrl = getNetworkPublicationUrl;
+exports.getNetworkReaderHandoffUrl = getNetworkReaderHandoffUrl;
 exports.isNetworkHostname = isNetworkHostname;
 exports.listedPublications = listedPublications;
 exports.localPublications = localPublications;

package/dist/network.d.cts

@@ -58,7 +58,13 @@ declare function findPublicationBySlug(slug: string): PublicationNetworkItem | u
 declare function findPublicationByHost(host: string): PublicationNetworkItem | undefined;
 /** Get decorated URL for cross-domain navigation within the network with consent transfer. */
 declare function getNetworkPublicationUrl(slug: string): string | null;
+/**
+ * The fixed destination route for a publication in this reviewed network list.
+ * Sites only use it when their handoff switch is enabled after every destination
+ * has deployed the route. No identity or caller-selected return URL is carried.
+ */
+declare function getNetworkReaderHandoffUrl(slug: string): string | null;
 /** Check whether a given hostname belongs to any publication in the ScaleMule news network. */
 declare function isNetworkHostname(hostname: string): boolean;
 
-export { EDITORIAL_PRINCIPLES, type EditorialPrinciple, NETWORK_PARENT, type NetworkParent, type PublicationNetworkItem, communityPublications, findPublicationByHost, findPublicationBySlug, getNetworkPublicationUrl, isNetworkHostname, listedPublications, localPublications, topicalPublications };
+export { EDITORIAL_PRINCIPLES, type EditorialPrinciple, NETWORK_PARENT, type NetworkParent, type PublicationNetworkItem, communityPublications, findPublicationByHost, findPublicationBySlug, getNetworkPublicationUrl, getNetworkReaderHandoffUrl, isNetworkHostname, listedPublications, localPublications, topicalPublications };

package/dist/network.d.ts

@@ -58,7 +58,13 @@ declare function findPublicationBySlug(slug: string): PublicationNetworkItem | u
 declare function findPublicationByHost(host: string): PublicationNetworkItem | undefined;
 /** Get decorated URL for cross-domain navigation within the network with consent transfer. */
 declare function getNetworkPublicationUrl(slug: string): string | null;
+/**
+ * The fixed destination route for a publication in this reviewed network list.
+ * Sites only use it when their handoff switch is enabled after every destination
+ * has deployed the route. No identity or caller-selected return URL is carried.
+ */
+declare function getNetworkReaderHandoffUrl(slug: string): string | null;
 /** Check whether a given hostname belongs to any publication in the ScaleMule news network. */
 declare function isNetworkHostname(hostname: string): boolean;
 
-export { EDITORIAL_PRINCIPLES, type EditorialPrinciple, NETWORK_PARENT, type NetworkParent, type PublicationNetworkItem, communityPublications, findPublicationByHost, findPublicationBySlug, getNetworkPublicationUrl, isNetworkHostname, listedPublications, localPublications, topicalPublications };
+export { EDITORIAL_PRINCIPLES, type EditorialPrinciple, NETWORK_PARENT, type NetworkParent, type PublicationNetworkItem, communityPublications, findPublicationByHost, findPublicationBySlug, getNetworkPublicationUrl, getNetworkReaderHandoffUrl, isNetworkHostname, listedPublications, localPublications, topicalPublications };

package/dist/network.js

@@ -1 +1 @@
-export { EDITORIAL_PRINCIPLES, NETWORK_PARENT, communityPublications, findPublicationByHost, findPublicationBySlug, getNetworkPublicationUrl, isNetworkHostname, listedPublications, localPublications, topicalPublications } from './chunk-XWXPERLK.js';
+export { EDITORIAL_PRINCIPLES, NETWORK_PARENT, communityPublications, findPublicationByHost, findPublicationBySlug, getNetworkPublicationUrl, getNetworkReaderHandoffUrl, isNetworkHostname, listedPublications, localPublications, topicalPublications } from './chunk-NNEY6VBX.js';

package/dist/reader-sso.cjs

@@ -84,6 +84,9 @@ function localReturnPath(value) {
   if (/[\\\r\n\u0000-\u001f]/.test(value) || value === "/api" || value.startsWith("/api/")) return "";
   return value;
 }
+function networkHandoffReturnPath(query) {
+  return query.getAll("sm_consent").length === 1 && query.get("sm_consent") === "0" ? "/?sm_consent=0" : "/";
+}
 function resolve(config) {
   const origin = new URL(config.origin);
   if (origin.protocol !== "https:" || origin.origin !== config.origin) throw new Error("Reader SSO origin must be a bare https origin");
@@ -177,9 +180,17 @@ function openPendingSession(cookie, key, now = Date.now()) {
     tx: typeof raw.tx === "string" ? raw.tx : void 0
   };
 }
-function authorizeUrl(value, state, callback, mode, issuerOrigin = LEDVERY_ISSUER_ORIGIN) {
+function authorizeUrl(value, state, callback, mode, issuerOrigin = LEDVERY_ISSUER_ORIGIN, selectAccount = false, clientId) {
   const url = new URL(value);
-  if (url.protocol !== "https:" || url.origin !== new URL(issuerOrigin).origin || url.pathname !== "/authorize" || url.username || url.password || url.searchParams.get("state") !== state || url.searchParams.get("redirect_uri") !== callback || url.searchParams.get("code_challenge_method") !== "S256" || !url.searchParams.get("code_challenge") || mode === "silent" && url.searchParams.get("prompt") !== "none") throw new Error("Invalid Ledvery authorization response");
+  const prompts = url.searchParams.getAll("prompt");
+  const expectedPrompt = mode === "silent" ? "none" : selectAccount ? "select_account" : null;
+  const exactly = (key, expected) => {
+    const values = url.searchParams.getAll(key);
+    return values.length === 1 && values[0] === expected;
+  };
+  const scope = url.searchParams.getAll("scope");
+  const nonce = url.searchParams.getAll("nonce");
+  if (url.protocol !== "https:" || url.origin !== new URL(issuerOrigin).origin || url.pathname !== "/authorize" || url.username || url.password || url.hash || !exactly("state", state) || !exactly("redirect_uri", callback) || !exactly("response_type", "code") || clientId !== void 0 && !exactly("client_id", clientId) || scope.length !== 1 || !scope[0].split(/\s+/).includes("openid") || nonce.length !== 1 || !nonce[0] || !exactly("code_challenge_method", "S256") || url.searchParams.getAll("code_challenge").length !== 1 || !url.searchParams.get("code_challenge") || (expectedPrompt === null ? prompts.length !== 0 : prompts.length !== 1 || prompts[0] !== expectedPrompt)) throw new Error("Invalid Ledvery authorization response");
   return url.toString();
 }
 async function startSignIn(config, input) {
@@ -213,7 +224,7 @@ async function startSignIn(config, input) {
   const query = new URLSearchParams({ redirect_uri: callback });
   if (mode === "silent") query.set("prompt", "none");
   else {
-    query.set("prompt", "select_account");
+    if (input.selectAccount === true) query.set("prompt", "select_account");
     query.set("upstream", provider === "email" ? "scalemule_consumer" : "google");
   }
   try {
@@ -221,7 +232,7 @@ async function startSignIn(config, input) {
     if (failed(response)) throw new Error("authorize");
     const value = payload(response);
     if (typeof value.url !== "string" || typeof value.state !== "string" || !value.state) throw new Error("authorize");
-    const url = authorizeUrl(value.url, value.state, callback, mode, c.issuerOrigin);
+    const url = authorizeUrl(value.url, value.state, callback, mode, c.issuerOrigin, input.selectAccount === true, c.clientId);
     const cookies = [
       ...staleSession,
       { name: c.names.flow, value: sealReaderFlow({ state: value.state, subscribe: input.subscribe === true && mode === "interactive", returnTo: next, mode, provider, tx }, c.key, c.now()), maxAge: READER_SSO_FLOW_SECONDS }
@@ -537,6 +548,7 @@ exports.cookieReader = cookieReader;
 exports.linkAccount = linkAccount;
 exports.linkFailureMessage = linkFailureMessage;
 exports.localReturnPath = localReturnPath;
+exports.networkHandoffReturnPath = networkHandoffReturnPath;
 exports.openPendingSession = openPendingSession;
 exports.openReaderFlow = openReaderFlow;
 exports.pendingSwitch = pendingSwitch;

package/dist/reader-sso.d.cts

@@ -132,6 +132,12 @@ type ReaderSsoConfig = {
 };
 /** Any same-site path: no protocol-relative URLs, control characters or API routes. */
 declare function localReturnPath(value: unknown): string;
+/**
+ * A network-bar handoff always lands on this paper's home page. The only
+ * transferable query value is the existing refusal of optional cookies.
+ * Identity, callback and return destinations never come from the link.
+ */
+declare function networkHandoffReturnPath(query: URLSearchParams): string;
 declare function stateDigest(state: string): string;
 declare function validState(state: string | null | undefined, digest: string | undefined): boolean;
 type ReaderSsoFlow = {
@@ -166,10 +172,12 @@ type PendingSession = {
 };
 declare function sealPendingSession(pending: PendingSession, key: string, now?: number): string;
 declare function openPendingSession(cookie: string | undefined, key: string, now?: number): PendingSession | null;
-declare function authorizeUrl(value: string, state: string, callback: string, mode: ReaderSsoMode, issuerOrigin?: string): string;
+declare function authorizeUrl(value: string, state: string, callback: string, mode: ReaderSsoMode, issuerOrigin?: string, selectAccount?: boolean, clientId?: string): string;
 type StartSignInInput = {
     mode: ReaderSsoMode;
     provider?: ReaderSsoProvider;
+    /** Only an explicit Switch account control may request the account chooser. */
+    selectAccount?: boolean;
     subscribe?: boolean;
     next?: string;
     cookies: CookieReader;
@@ -319,4 +327,4 @@ declare function readerSsoBootFlags(cookies: CookieReader, names: ReaderSsoCooki
     suppressed: boolean;
 };
 
-export { type CompleteSignInInput, type CompleteSignInResult, type CookieInstruction, type CookieReader, LEDVERY_ISSUER_ORIGIN, type LinkAccountInput, type LinkAccountResult, type PendingSession, READER_SSO_FLOW_SECONDS, READER_SSO_NEGATIVE_CACHE_SECONDS, READER_SSO_PENDING_SECONDS, READER_SSO_SIGNED_OUT_SECONDS, type ReaderSsoCheckOutcome, type ReaderSsoConfig, type ReaderSsoCookieNames, type ReaderSsoEvent, type ReaderSsoFailure, type ReaderSsoFlow, type ReaderSsoMethod, type ReaderSsoMode, type ReaderSsoProvider, type ReaderSsoRequest, type ReaderSsoResponse, SILENT_NEGATIVE_ERRORS, type SessionSummary, type SessionUser, type SignOutResult, type StartSignInInput, type StartSignInResult, type SwitchAccountResult, applyCookies, authorizeUrl, completeSignIn, cookieReader, linkAccount, linkFailureMessage, localReturnPath, openPendingSession, openReaderFlow, pendingSwitch, precedence, readerSsoBootFlags, readerSsoCookieNames, readerSsoCookieOptions, sealPendingSession, sealReaderFlow, sessionSummary, sessionSummaryWithCookies, setCookieHeader, signOut, startSignIn, stateDigest, switchAccount, validState };
+export { type CompleteSignInInput, type CompleteSignInResult, type CookieInstruction, type CookieReader, LEDVERY_ISSUER_ORIGIN, type LinkAccountInput, type LinkAccountResult, type PendingSession, READER_SSO_FLOW_SECONDS, READER_SSO_NEGATIVE_CACHE_SECONDS, READER_SSO_PENDING_SECONDS, READER_SSO_SIGNED_OUT_SECONDS, type ReaderSsoCheckOutcome, type ReaderSsoConfig, type ReaderSsoCookieNames, type ReaderSsoEvent, type ReaderSsoFailure, type ReaderSsoFlow, type ReaderSsoMethod, type ReaderSsoMode, type ReaderSsoProvider, type ReaderSsoRequest, type ReaderSsoResponse, SILENT_NEGATIVE_ERRORS, type SessionSummary, type SessionUser, type SignOutResult, type StartSignInInput, type StartSignInResult, type SwitchAccountResult, applyCookies, authorizeUrl, completeSignIn, cookieReader, linkAccount, linkFailureMessage, localReturnPath, networkHandoffReturnPath, openPendingSession, openReaderFlow, pendingSwitch, precedence, readerSsoBootFlags, readerSsoCookieNames, readerSsoCookieOptions, sealPendingSession, sealReaderFlow, sessionSummary, sessionSummaryWithCookies, setCookieHeader, signOut, startSignIn, stateDigest, switchAccount, validState };

package/dist/reader-sso.d.ts

@@ -132,6 +132,12 @@ type ReaderSsoConfig = {
 };
 /** Any same-site path: no protocol-relative URLs, control characters or API routes. */
 declare function localReturnPath(value: unknown): string;
+/**
+ * A network-bar handoff always lands on this paper's home page. The only
+ * transferable query value is the existing refusal of optional cookies.
+ * Identity, callback and return destinations never come from the link.
+ */
+declare function networkHandoffReturnPath(query: URLSearchParams): string;
 declare function stateDigest(state: string): string;
 declare function validState(state: string | null | undefined, digest: string | undefined): boolean;
 type ReaderSsoFlow = {
@@ -166,10 +172,12 @@ type PendingSession = {
 };
 declare function sealPendingSession(pending: PendingSession, key: string, now?: number): string;
 declare function openPendingSession(cookie: string | undefined, key: string, now?: number): PendingSession | null;
-declare function authorizeUrl(value: string, state: string, callback: string, mode: ReaderSsoMode, issuerOrigin?: string): string;
+declare function authorizeUrl(value: string, state: string, callback: string, mode: ReaderSsoMode, issuerOrigin?: string, selectAccount?: boolean, clientId?: string): string;
 type StartSignInInput = {
     mode: ReaderSsoMode;
     provider?: ReaderSsoProvider;
+    /** Only an explicit Switch account control may request the account chooser. */
+    selectAccount?: boolean;
     subscribe?: boolean;
     next?: string;
     cookies: CookieReader;
@@ -319,4 +327,4 @@ declare function readerSsoBootFlags(cookies: CookieReader, names: ReaderSsoCooki
     suppressed: boolean;
 };
 
-export { type CompleteSignInInput, type CompleteSignInResult, type CookieInstruction, type CookieReader, LEDVERY_ISSUER_ORIGIN, type LinkAccountInput, type LinkAccountResult, type PendingSession, READER_SSO_FLOW_SECONDS, READER_SSO_NEGATIVE_CACHE_SECONDS, READER_SSO_PENDING_SECONDS, READER_SSO_SIGNED_OUT_SECONDS, type ReaderSsoCheckOutcome, type ReaderSsoConfig, type ReaderSsoCookieNames, type ReaderSsoEvent, type ReaderSsoFailure, type ReaderSsoFlow, type ReaderSsoMethod, type ReaderSsoMode, type ReaderSsoProvider, type ReaderSsoRequest, type ReaderSsoResponse, SILENT_NEGATIVE_ERRORS, type SessionSummary, type SessionUser, type SignOutResult, type StartSignInInput, type StartSignInResult, type SwitchAccountResult, applyCookies, authorizeUrl, completeSignIn, cookieReader, linkAccount, linkFailureMessage, localReturnPath, openPendingSession, openReaderFlow, pendingSwitch, precedence, readerSsoBootFlags, readerSsoCookieNames, readerSsoCookieOptions, sealPendingSession, sealReaderFlow, sessionSummary, sessionSummaryWithCookies, setCookieHeader, signOut, startSignIn, stateDigest, switchAccount, validState };
+export { type CompleteSignInInput, type CompleteSignInResult, type CookieInstruction, type CookieReader, LEDVERY_ISSUER_ORIGIN, type LinkAccountInput, type LinkAccountResult, type PendingSession, READER_SSO_FLOW_SECONDS, READER_SSO_NEGATIVE_CACHE_SECONDS, READER_SSO_PENDING_SECONDS, READER_SSO_SIGNED_OUT_SECONDS, type ReaderSsoCheckOutcome, type ReaderSsoConfig, type ReaderSsoCookieNames, type ReaderSsoEvent, type ReaderSsoFailure, type ReaderSsoFlow, type ReaderSsoMethod, type ReaderSsoMode, type ReaderSsoProvider, type ReaderSsoRequest, type ReaderSsoResponse, SILENT_NEGATIVE_ERRORS, type SessionSummary, type SessionUser, type SignOutResult, type StartSignInInput, type StartSignInResult, type SwitchAccountResult, applyCookies, authorizeUrl, completeSignIn, cookieReader, linkAccount, linkFailureMessage, localReturnPath, networkHandoffReturnPath, openPendingSession, openReaderFlow, pendingSwitch, precedence, readerSsoBootFlags, readerSsoCookieNames, readerSsoCookieOptions, sealPendingSession, sealReaderFlow, sessionSummary, sessionSummaryWithCookies, setCookieHeader, signOut, startSignIn, stateDigest, switchAccount, validState };

package/dist/reader-sso.js

@@ -69,6 +69,9 @@ function localReturnPath(value) {
   if (/[\\\r\n\u0000-\u001f]/.test(value) || value === "/api" || value.startsWith("/api/")) return "";
   return value;
 }
+function networkHandoffReturnPath(query) {
+  return query.getAll("sm_consent").length === 1 && query.get("sm_consent") === "0" ? "/?sm_consent=0" : "/";
+}
 function resolve(config) {
   const origin = new URL(config.origin);
   if (origin.protocol !== "https:" || origin.origin !== config.origin) throw new Error("Reader SSO origin must be a bare https origin");
@@ -162,9 +165,17 @@ function openPendingSession(cookie, key, now = Date.now()) {
     tx: typeof raw.tx === "string" ? raw.tx : void 0
   };
 }
-function authorizeUrl(value, state, callback, mode, issuerOrigin = LEDVERY_ISSUER_ORIGIN) {
+function authorizeUrl(value, state, callback, mode, issuerOrigin = LEDVERY_ISSUER_ORIGIN, selectAccount = false, clientId) {
   const url = new URL(value);
-  if (url.protocol !== "https:" || url.origin !== new URL(issuerOrigin).origin || url.pathname !== "/authorize" || url.username || url.password || url.searchParams.get("state") !== state || url.searchParams.get("redirect_uri") !== callback || url.searchParams.get("code_challenge_method") !== "S256" || !url.searchParams.get("code_challenge") || mode === "silent" && url.searchParams.get("prompt") !== "none") throw new Error("Invalid Ledvery authorization response");
+  const prompts = url.searchParams.getAll("prompt");
+  const expectedPrompt = mode === "silent" ? "none" : selectAccount ? "select_account" : null;
+  const exactly = (key, expected) => {
+    const values = url.searchParams.getAll(key);
+    return values.length === 1 && values[0] === expected;
+  };
+  const scope = url.searchParams.getAll("scope");
+  const nonce = url.searchParams.getAll("nonce");
+  if (url.protocol !== "https:" || url.origin !== new URL(issuerOrigin).origin || url.pathname !== "/authorize" || url.username || url.password || url.hash || !exactly("state", state) || !exactly("redirect_uri", callback) || !exactly("response_type", "code") || clientId !== void 0 && !exactly("client_id", clientId) || scope.length !== 1 || !scope[0].split(/\s+/).includes("openid") || nonce.length !== 1 || !nonce[0] || !exactly("code_challenge_method", "S256") || url.searchParams.getAll("code_challenge").length !== 1 || !url.searchParams.get("code_challenge") || (expectedPrompt === null ? prompts.length !== 0 : prompts.length !== 1 || prompts[0] !== expectedPrompt)) throw new Error("Invalid Ledvery authorization response");
   return url.toString();
 }
 async function startSignIn(config, input) {
@@ -198,7 +209,7 @@ async function startSignIn(config, input) {
   const query = new URLSearchParams({ redirect_uri: callback });
   if (mode === "silent") query.set("prompt", "none");
   else {
-    query.set("prompt", "select_account");
+    if (input.selectAccount === true) query.set("prompt", "select_account");
     query.set("upstream", provider === "email" ? "scalemule_consumer" : "google");
   }
   try {
@@ -206,7 +217,7 @@ async function startSignIn(config, input) {
     if (failed(response)) throw new Error("authorize");
     const value = payload(response);
     if (typeof value.url !== "string" || typeof value.state !== "string" || !value.state) throw new Error("authorize");
-    const url = authorizeUrl(value.url, value.state, callback, mode, c.issuerOrigin);
+    const url = authorizeUrl(value.url, value.state, callback, mode, c.issuerOrigin, input.selectAccount === true, c.clientId);
     const cookies = [
       ...staleSession,
       { name: c.names.flow, value: sealReaderFlow({ state: value.state, subscribe: input.subscribe === true && mode === "interactive", returnTo: next, mode, provider, tx }, c.key, c.now()), maxAge: READER_SSO_FLOW_SECONDS }
@@ -507,4 +518,4 @@ function readerSsoBootFlags(cookies, names) {
   };
 }
 
-export { LEDVERY_ISSUER_ORIGIN, READER_SSO_FLOW_SECONDS, READER_SSO_NEGATIVE_CACHE_SECONDS, READER_SSO_PENDING_SECONDS, READER_SSO_SIGNED_OUT_SECONDS, SILENT_NEGATIVE_ERRORS, applyCookies, authorizeUrl, completeSignIn, cookieReader, linkAccount, linkFailureMessage, localReturnPath, openPendingSession, openReaderFlow, pendingSwitch, precedence, readerSsoBootFlags, readerSsoCookieNames, readerSsoCookieOptions, sealPendingSession, sealReaderFlow, sessionSummary, sessionSummaryWithCookies, setCookieHeader, signOut, startSignIn, stateDigest, switchAccount, validState };
+export { LEDVERY_ISSUER_ORIGIN, READER_SSO_FLOW_SECONDS, READER_SSO_NEGATIVE_CACHE_SECONDS, READER_SSO_PENDING_SECONDS, READER_SSO_SIGNED_OUT_SECONDS, SILENT_NEGATIVE_ERRORS, applyCookies, authorizeUrl, completeSignIn, cookieReader, linkAccount, linkFailureMessage, localReturnPath, networkHandoffReturnPath, openPendingSession, openReaderFlow, pendingSwitch, precedence, readerSsoBootFlags, readerSsoCookieNames, readerSsoCookieOptions, sealPendingSession, sealReaderFlow, sessionSummary, sessionSummaryWithCookies, setCookieHeader, signOut, startSignIn, stateDigest, switchAccount, validState };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scalemule/news-publication",
-  "version": "0.0.88",
+  "version": "0.0.90",
   "description": "Shared server framework for ScaleMule local news publications. Walnut Creek Times is the broadsheet default; each paper supplies its own identity and feature flags.",
   "type": "module",
   "bin": {