@scalemule/news-publication 0.0.89 → 0.0.91

package/dist/{chunk-F6HV2HRP.js → chunk-2E42LCN3.js}

@@ -1,5 +1,5 @@
 "use client";
-import { setupNetworkConsentDelegation, COOKIE_CONSENT_EVENT, listedPublications, decorateNetworkUrl } from './chunk-CKTTYAZY.js';
+import { setupNetworkConsentDelegation, COOKIE_CONSENT_EVENT, listedPublications, decorateNetworkUrl } from './chunk-NNEY6VBX.js';
 import { useState, useId, useRef, useEffect } from 'react';
 import { jsx, jsxs } from 'react/jsx-runtime';
 

package/dist/{chunk-EPAFIBBS.js → chunk-D27NMCRK.js}

@@ -1,5 +1,5 @@
 "use client";
-import { hasConsented, rejectOptionalCookies, DEFAULT_CONSENT_HUB_URL, consentModel, isGpcActive, COOKIE_CONSENT_EVENT, acceptAllCookies, recordConsentToCompliance } from './chunk-CKTTYAZY.js';
+import { hasConsented, rejectOptionalCookies, DEFAULT_CONSENT_HUB_URL, consentModel, isGpcActive, COOKIE_CONSENT_EVENT, acceptAllCookies, recordConsentToCompliance } from './chunk-NNEY6VBX.js';
 import { useState, useEffect } from 'react';
 import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
 

package/dist/{chunk-RSKB5NNE.js → chunk-FJ672GWO.js}

@@ -1,4 +1,4 @@
-import { NETWORK_PARENT } from './chunk-CKTTYAZY.js';
+import { NETWORK_PARENT } from './chunk-NNEY6VBX.js';
 import { jsxs, jsx } from 'react/jsx-runtime';
 
 function NetworkCopyrightNotice({

package/dist/{chunk-CKTTYAZY.js → chunk-NNEY6VBX.js}

@@ -368,10 +368,9 @@ function getNetworkPublicationUrl(slug) {
   if (!pub) return null;
   return decorateNetworkUrl(pub.url + "/");
 }
-var readerHandoffReady = /* @__PURE__ */ new Set(["sanramontimes", "trivalleyweekly"]);
 function getNetworkReaderHandoffUrl(slug) {
   const publication = findPublicationBySlug(slug);
-  return publication && readerHandoffReady.has(slug) ? `${publication.url}/api/news/network-handoff` : null;
+  return publication ? `${publication.url}/api/news/network-handoff` : null;
 }
 var NETWORK_HOSTNAMES = new Set(
   localPublications.map((p) => {

package/dist/{chunk-R6WTBTXO.js → chunk-PBRDIXQI.js}

@@ -1,5 +1,5 @@
 "use client";
-import { effectivePreferences, getCookieConsent, COOKIE_CATEGORIES, setCookieConsent, recordConsentToCompliance, DEFAULT_PREFERENCES_ACCEPTED, DEFAULT_PREFERENCES_REJECTED } from './chunk-CKTTYAZY.js';
+import { effectivePreferences, getCookieConsent, COOKIE_CATEGORIES, setCookieConsent, recordConsentToCompliance, DEFAULT_PREFERENCES_ACCEPTED, DEFAULT_PREFERENCES_REJECTED } from './chunk-NNEY6VBX.js';
 import { useState, useEffect } from 'react';
 import { jsxs, jsx } from 'react/jsx-runtime';
 

package/dist/cookie-consent-banner.js

@@ -1,3 +1,3 @@
 "use client";
-export { CookieConsentBanner } from './chunk-EPAFIBBS.js';
-import './chunk-CKTTYAZY.js';
+export { CookieConsentBanner } from './chunk-D27NMCRK.js';
+import './chunk-NNEY6VBX.js';

package/dist/cookie-settings-view.js

@@ -1,3 +1,3 @@
 "use client";
-export { CookieSettingsView } from './chunk-R6WTBTXO.js';
-import './chunk-CKTTYAZY.js';
+export { CookieSettingsView } from './chunk-PBRDIXQI.js';
+import './chunk-NNEY6VBX.js';

package/dist/index.cjs

@@ -1477,10 +1477,9 @@ function getNetworkPublicationUrl(slug) {
   if (!pub) return null;
   return compliance.decorateNetworkUrl(pub.url + "/");
 }
-var readerHandoffReady = /* @__PURE__ */ new Set(["sanramontimes", "trivalleyweekly"]);
 function getNetworkReaderHandoffUrl(slug) {
   const publication = findPublicationBySlug(slug);
-  return publication && readerHandoffReady.has(slug) ? `${publication.url}/api/news/network-handoff` : null;
+  return publication ? `${publication.url}/api/news/network-handoff` : null;
 }
 var NETWORK_HOSTNAMES = new Set(
   localPublications.map((p) => {

package/dist/index.js

@@ -1,12 +1,12 @@
-export { LocalNetworkBar } from './chunk-F6HV2HRP.js';
-export { NetworkCopyrightNotice } from './chunk-RSKB5NNE.js';
+export { LocalNetworkBar } from './chunk-2E42LCN3.js';
+export { NetworkCopyrightNotice } from './chunk-FJ672GWO.js';
 export { CURATED_COMMUNITY_CARDS, VerifiedCardComponent, VerifiedCardSection, getArticleCards, isSafeActionUrl } from './chunk-KYUVXEJY.js';
 export { CLASSIFIED_CATEGORIES, JOB_EMPLOYMENT_TYPES, categoryLabel, classifiedPath, classifiedSearchPath, clipChars, dealDollars, dealGoPath, dealsFeedPath, employmentLabel, isClassifiedCategory, isEmploymentType, jobEmployerBody, jobOpeningBody, jobPostingBody, prepareClassified, prepareJobPost, publicJobPath, publicJobsPath } from './chunk-C7ZPLH2K.js';
 export { MEET_ACTIVITIES, activityLabel, canHostMeetup, isAdult, prepareMeetup, screenMessage } from './chunk-AMLVCZDP.js';
-export { CookieConsentBanner } from './chunk-EPAFIBBS.js';
-export { CookieSettingsView } from './chunk-R6WTBTXO.js';
-import { localPublications } from './chunk-CKTTYAZY.js';
-export { COOKIE_CATEGORIES, COOKIE_CONSENT_BACKUP_KEY, COOKIE_CONSENT_EVENT, COOKIE_CONSENT_KEY, COOKIE_CONSENT_MAX_AGE_SECONDS, DEFAULT_CONSENT_HUB_URL, DEFAULT_PREFERENCES_ACCEPTED, DEFAULT_PREFERENCES_REJECTED, EDITORIAL_PRINCIPLES, EU_EEA_UK_COUNTRIES, NETWORK_CONSENT_STORAGE_KEY, NETWORK_PARENT, acceptAllCookies, checkUrlConsentBridge, clearCookieConsent, communityPublications, consentModel, decorateNetworkUrl, effectivePreferences, findPublicationByHost, findPublicationBySlug, getCookieConsent, getNetworkPublicationUrl, getNetworkReaderHandoffUrl, hasConsented, impliedPreferences, isCategoryAllowed, isGeoConsentRequired, listedPublications, localPublications, queryNetworkConsentHub, recordConsentToCompliance, rejectOptionalCookies, setCookieConsent, setNetworkConsentHub, topicalPublications } from './chunk-CKTTYAZY.js';
+export { CookieConsentBanner } from './chunk-D27NMCRK.js';
+export { CookieSettingsView } from './chunk-PBRDIXQI.js';
+import { localPublications } from './chunk-NNEY6VBX.js';
+export { COOKIE_CATEGORIES, COOKIE_CONSENT_BACKUP_KEY, COOKIE_CONSENT_EVENT, COOKIE_CONSENT_KEY, COOKIE_CONSENT_MAX_AGE_SECONDS, DEFAULT_CONSENT_HUB_URL, DEFAULT_PREFERENCES_ACCEPTED, DEFAULT_PREFERENCES_REJECTED, EDITORIAL_PRINCIPLES, EU_EEA_UK_COUNTRIES, NETWORK_CONSENT_STORAGE_KEY, NETWORK_PARENT, acceptAllCookies, checkUrlConsentBridge, clearCookieConsent, communityPublications, consentModel, decorateNetworkUrl, effectivePreferences, findPublicationByHost, findPublicationBySlug, getCookieConsent, getNetworkPublicationUrl, getNetworkReaderHandoffUrl, hasConsented, impliedPreferences, isCategoryAllowed, isGeoConsentRequired, listedPublications, localPublications, queryNetworkConsentHub, recordConsentToCompliance, rejectOptionalCookies, setCookieConsent, setNetworkConsentHub, topicalPublications } from './chunk-NNEY6VBX.js';
 export { THEME_COOKIE, THEME_EVENT, THEME_MAX_AGE_SECONDS, THEME_STORAGE_KEY, ThemeToggle, applyTheme, clearTheme, getStoredTheme, getSystemTheme, resolveEffectiveTheme, setTheme, subscribeTheme, themeInitScript } from './chunk-NQD3M7ZY.js';
 export { communityMapEmbeds } from './chunk-IMYBSG7J.js';
 export { articleFormatLabel, articleHeroRatio, articlePresentation, formatArtworkCaption, parseDocumentBlocks, renderArticleBlocksToHtml, sanitizeInlineMarkdown } from './chunk-DN3TBZLK.js';

package/dist/network-bar.js

@@ -1,2 +1,2 @@
-export { LocalNetworkBar } from './chunk-F6HV2HRP.js';
-import './chunk-CKTTYAZY.js';
+export { LocalNetworkBar } from './chunk-2E42LCN3.js';
+import './chunk-NNEY6VBX.js';

package/dist/network-copyright.js

@@ -1,2 +1,2 @@
-export { NetworkCopyrightNotice } from './chunk-RSKB5NNE.js';
-import './chunk-CKTTYAZY.js';
+export { NetworkCopyrightNotice } from './chunk-FJ672GWO.js';
+import './chunk-NNEY6VBX.js';

package/dist/network.cjs

@@ -245,10 +245,9 @@ function getNetworkPublicationUrl(slug) {
   if (!pub) return null;
   return compliance.decorateNetworkUrl(pub.url + "/");
 }
-var readerHandoffReady = /* @__PURE__ */ new Set(["sanramontimes", "trivalleyweekly"]);
 function getNetworkReaderHandoffUrl(slug) {
   const publication = findPublicationBySlug(slug);
-  return publication && readerHandoffReady.has(slug) ? `${publication.url}/api/news/network-handoff` : null;
+  return publication ? `${publication.url}/api/news/network-handoff` : null;
 }
 var NETWORK_HOSTNAMES = new Set(
   localPublications.map((p) => {

package/dist/network.d.cts

@@ -58,7 +58,11 @@ declare function findPublicationBySlug(slug: string): PublicationNetworkItem | u
 declare function findPublicationByHost(host: string): PublicationNetworkItem | undefined;
 /** Get decorated URL for cross-domain navigation within the network with consent transfer. */
 declare function getNetworkPublicationUrl(slug: string): string | null;
-/** The fixed destination route; no identity or caller-selected return URL is carried. */
+/**
+ * The fixed destination route for a publication in this reviewed network list.
+ * Sites only use it when their handoff switch is enabled after every destination
+ * has deployed the route. No identity or caller-selected return URL is carried.
+ */
 declare function getNetworkReaderHandoffUrl(slug: string): string | null;
 /** Check whether a given hostname belongs to any publication in the ScaleMule news network. */
 declare function isNetworkHostname(hostname: string): boolean;

package/dist/network.d.ts

@@ -58,7 +58,11 @@ declare function findPublicationBySlug(slug: string): PublicationNetworkItem | u
 declare function findPublicationByHost(host: string): PublicationNetworkItem | undefined;
 /** Get decorated URL for cross-domain navigation within the network with consent transfer. */
 declare function getNetworkPublicationUrl(slug: string): string | null;
-/** The fixed destination route; no identity or caller-selected return URL is carried. */
+/**
+ * The fixed destination route for a publication in this reviewed network list.
+ * Sites only use it when their handoff switch is enabled after every destination
+ * has deployed the route. No identity or caller-selected return URL is carried.
+ */
 declare function getNetworkReaderHandoffUrl(slug: string): string | null;
 /** Check whether a given hostname belongs to any publication in the ScaleMule news network. */
 declare function isNetworkHostname(hostname: string): boolean;

package/dist/network.js

@@ -1 +1 @@
-export { EDITORIAL_PRINCIPLES, NETWORK_PARENT, communityPublications, findPublicationByHost, findPublicationBySlug, getNetworkPublicationUrl, getNetworkReaderHandoffUrl, isNetworkHostname, listedPublications, localPublications, topicalPublications } from './chunk-CKTTYAZY.js';
+export { EDITORIAL_PRINCIPLES, NETWORK_PARENT, communityPublications, findPublicationByHost, findPublicationBySlug, getNetworkPublicationUrl, getNetworkReaderHandoffUrl, isNetworkHostname, listedPublications, localPublications, topicalPublications } from './chunk-NNEY6VBX.js';

package/dist/reader-sso.cjs

@@ -20,6 +20,7 @@ var READER_SSO_FLOW_SECONDS = 600;
 var READER_SSO_NEGATIVE_CACHE_SECONDS = 300;
 var READER_SSO_SIGNED_OUT_SECONDS = 86400;
 var READER_SSO_PENDING_SECONDS = 600;
+var READER_SSO_LINK_SECONDS = 600;
 var LEDVERY_ISSUER_ORIGIN = "https://api.ledvery.com";
 var SILENT_NEGATIVE_ERRORS = ["login_required", "consent_required", "interaction_required", "account_selection_required"];
 var COOKIE_PREFIX = /^__Host-[A-Za-z0-9_-]{1,60}$/;
@@ -35,7 +36,8 @@ function readerSsoCookieNames(prefix) {
     ssoChecked: `${prefix}-sso-checked`,
     signedOut: `${prefix}-signed-out`,
     pending: `${prefix}-sso-pending`,
-    linkCode: `${prefix}-link-code`
+    linkCode: `${prefix}-link-code`,
+    linkFlow: `${prefix}-sso-link`
   };
 }
 var readerSsoCookieOptions = { httpOnly: true, secure: true, sameSite: "lax", path: "/" };
@@ -160,6 +162,14 @@ function openReaderFlow(cookie, key, now = Date.now(), returnPath = (next) => lo
   const tx = typeof raw.tx === "string" && /^[a-f0-9]{1,64}$/.test(raw.tx) ? raw.tx : void 0;
   return { digest: raw.digest, subscribe: raw.subscribe && mode === "interactive", expires: raw.expires, returnTo, mode, provider, tx };
 }
+function sealLinkChallenge(challengeId, key, now = Date.now()) {
+  if (!CHALLENGE_ID.test(challengeId)) throw new Error("Invalid reader link challenge");
+  return seal("reader-link:v1", { challengeId, expires: now + READER_SSO_LINK_SECONDS * 1e3 }, key);
+}
+function openLinkChallenge(cookie, key, now = Date.now()) {
+  const raw = open("reader-link:v1", cookie, key);
+  return raw && typeof raw.challengeId === "string" && CHALLENGE_ID.test(raw.challengeId) && typeof raw.expires === "number" && Number.isFinite(raw.expires) && raw.expires > now ? raw.challengeId : null;
+}
 function sealPendingSession(pending, key, now = Date.now()) {
   return seal("reader-pending:v1", { ...pending, until: now + READER_SSO_PENDING_SECONDS * 1e3 }, key);
 }
@@ -237,7 +247,7 @@ async function startSignIn(config, input) {
       ...staleSession,
       { name: c.names.flow, value: sealReaderFlow({ state: value.state, subscribe: input.subscribe === true && mode === "interactive", returnTo: next, mode, provider, tx }, c.key, c.now()), maxAge: READER_SSO_FLOW_SECONDS }
     ];
-    if (mode === "interactive") cookies.push(clear(c.names.signedOut), clear(c.names.ssoChecked));
+    if (mode === "interactive") cookies.push(clear(c.names.signedOut), clear(c.names.ssoChecked), clear(c.names.linkFlow), clear(c.names.linkCode));
     emit(c, { name: "reader_signin_started", properties: { method: provider ?? "unknown", mode, transaction: tx } });
     return { ok: true, url, tx, cookies };
   } catch {
@@ -326,6 +336,7 @@ async function completeSignIn(config, input) {
       if (hint) link.set("hint", hint);
       if (flow.returnTo) link.set("next", flow.returnTo);
       if (flow.subscribe) link.set("subscribe", "1");
+      cookies.push({ name: c.names.linkFlow, value: sealLinkChallenge(challengeId, c.key, now), maxAge: READER_SSO_LINK_SECONDS });
       return redirect(`${c.accountPath}?${link}`, "link_required");
     }
     if (failed(exchange)) throw new Error("exchange");
@@ -410,7 +421,11 @@ async function linkAccount(config, input) {
   const c = resolve(config);
   const challengeId = typeof input.challenge_id === "string" && CHALLENGE_ID.test(input.challenge_id) ? input.challenge_id : "";
   const password = typeof input.password === "string" && input.password.length > 0 && input.password.length <= 1024 ? input.password : "";
-  if (!challengeId || !password) {
+  if (c.enabled === false || !challengeId || openLinkChallenge(input.cookies(c.names.linkFlow), c.key, c.now()) !== challengeId) {
+    emit(c, { name: "reader_signin_failed", properties: { reason: "link_invalid", mode: "interactive" } });
+    return { ok: false, status: 400, error: "Start sign-in again to connect your existing reader account.", cookies: [] };
+  }
+  if (!password) {
     emit(c, { name: "reader_signin_failed", properties: { reason: "link_invalid", mode: "interactive" } });
     return { ok: false, status: 400, error: "Enter the password of your existing reader account.", cookies: [] };
   }
@@ -439,7 +454,7 @@ async function linkAccount(config, input) {
     }
     const session = issuedSession(response, c.now());
     const flow = { digest: "", subscribe: input.subscribe === true, expires: 0, returnTo: next, mode: "interactive", provider: void 0 };
-    const result = await establish(c, { session, flow, method: "link", cookies: emailChallenge ? [clear(c.names.linkCode)] : [], input, negativeCache: { name: c.names.ssoChecked, value: "1", maxAge: READER_SSO_NEGATIVE_CACHE_SECONDS } });
+    const result = await establish(c, { session, flow, method: "link", cookies: [clear(c.names.linkFlow), ...emailChallenge ? [clear(c.names.linkCode)] : []], input, negativeCache: { name: c.names.ssoChecked, value: "1", maxAge: READER_SSO_NEGATIVE_CACHE_SECONDS } });
     if (result.kind === "signed-in") emit(c, { name: "reader_account_linked", properties: {} });
     return result.kind === "signed-in" ? { ok: true, switch: false, cookies: result.cookies, token: result.token, expiresAt: result.expiresAt, user: result.user, location: result.location } : { ok: true, switch: true, cookies: result.cookies, location: result.location };
   } catch {
@@ -507,6 +522,8 @@ async function signOut(config, input) {
       clear(c.names.newsletter),
       clear(c.names.pending),
       clear(c.names.ssoChecked),
+      clear(c.names.linkFlow),
+      clear(c.names.linkCode),
       { name: c.names.signedOut, value: "1", maxAge: READER_SSO_SIGNED_OUT_SECONDS },
       ...input.extraCookies ?? []
     ],
@@ -536,6 +553,7 @@ function readerSsoBootFlags(cookies, names) {
 exports.LEDVERY_ISSUER_ORIGIN = LEDVERY_ISSUER_ORIGIN;
 exports.READER_SSO_EVENTS = READER_SSO_EVENTS;
 exports.READER_SSO_FLOW_SECONDS = READER_SSO_FLOW_SECONDS;
+exports.READER_SSO_LINK_SECONDS = READER_SSO_LINK_SECONDS;
 exports.READER_SSO_NEGATIVE_CACHE_SECONDS = READER_SSO_NEGATIVE_CACHE_SECONDS;
 exports.READER_SSO_PENDING_SECONDS = READER_SSO_PENDING_SECONDS;
 exports.READER_SSO_PROPERTY_KEYS = READER_SSO_PROPERTY_KEYS;
@@ -549,6 +567,7 @@ exports.linkAccount = linkAccount;
 exports.linkFailureMessage = linkFailureMessage;
 exports.localReturnPath = localReturnPath;
 exports.networkHandoffReturnPath = networkHandoffReturnPath;
+exports.openLinkChallenge = openLinkChallenge;
 exports.openPendingSession = openPendingSession;
 exports.openReaderFlow = openReaderFlow;
 exports.pendingSwitch = pendingSwitch;
@@ -556,6 +575,7 @@ exports.precedence = precedence;
 exports.readerSsoBootFlags = readerSsoBootFlags;
 exports.readerSsoCookieNames = readerSsoCookieNames;
 exports.readerSsoCookieOptions = readerSsoCookieOptions;
+exports.sealLinkChallenge = sealLinkChallenge;
 exports.sealPendingSession = sealPendingSession;
 exports.sealReaderFlow = sealReaderFlow;
 exports.sessionSummary = sessionSummary;

package/dist/reader-sso.d.cts

@@ -7,6 +7,7 @@ declare const READER_SSO_FLOW_SECONDS = 600;
 declare const READER_SSO_NEGATIVE_CACHE_SECONDS = 300;
 declare const READER_SSO_SIGNED_OUT_SECONDS = 86400;
 declare const READER_SSO_PENDING_SECONDS = 600;
+declare const READER_SSO_LINK_SECONDS = 600;
 declare const LEDVERY_ISSUER_ORIGIN = "https://api.ledvery.com";
 /** Ledvery results that mean "no silent session here"; never authentication failures. */
 declare const SILENT_NEGATIVE_ERRORS: readonly ["login_required", "consent_required", "interaction_required", "account_selection_required"];
@@ -25,6 +26,8 @@ type ReaderSsoCookieNames = {
     pending: string;
     /** Linking onto an unconfirmed account: the platform's emailed-code challenge token (10 minutes). */
     linkCode: string;
+    /** Signed proof that this browser received the account-link challenge from our callback. */
+    linkFlow: string;
 };
 /** Cookie names derived from a `__Host-` prefix, e.g. `__Host-media` → `__Host-media-reader`. */
 declare function readerSsoCookieNames(prefix: string): ReaderSsoCookieNames;
@@ -158,6 +161,9 @@ declare function sealReaderFlow(input: {
     tx?: string;
 }, key: string, now?: number): string;
 declare function openReaderFlow(cookie: string | undefined, key: string, now?: number, returnPath?: (next: string, mode: ReaderSsoMode) => string): ReaderSsoFlow | null;
+/** A URL's challenge ID is not enough to start linking an existing account. */
+declare function sealLinkChallenge(challengeId: string, key: string, now?: number): string;
+declare function openLinkChallenge(cookie: string | undefined, key: string, now?: number): string | null;
 /** A verified session the reader has not yet chosen over their current one. */
 type PendingSession = {
     token: string;
@@ -327,4 +333,4 @@ declare function readerSsoBootFlags(cookies: CookieReader, names: ReaderSsoCooki
     suppressed: boolean;
 };
 
-export { type CompleteSignInInput, type CompleteSignInResult, type CookieInstruction, type CookieReader, LEDVERY_ISSUER_ORIGIN, type LinkAccountInput, type LinkAccountResult, type PendingSession, READER_SSO_FLOW_SECONDS, READER_SSO_NEGATIVE_CACHE_SECONDS, READER_SSO_PENDING_SECONDS, READER_SSO_SIGNED_OUT_SECONDS, type ReaderSsoCheckOutcome, type ReaderSsoConfig, type ReaderSsoCookieNames, type ReaderSsoEvent, type ReaderSsoFailure, type ReaderSsoFlow, type ReaderSsoMethod, type ReaderSsoMode, type ReaderSsoProvider, type ReaderSsoRequest, type ReaderSsoResponse, SILENT_NEGATIVE_ERRORS, type SessionSummary, type SessionUser, type SignOutResult, type StartSignInInput, type StartSignInResult, type SwitchAccountResult, applyCookies, authorizeUrl, completeSignIn, cookieReader, linkAccount, linkFailureMessage, localReturnPath, networkHandoffReturnPath, openPendingSession, openReaderFlow, pendingSwitch, precedence, readerSsoBootFlags, readerSsoCookieNames, readerSsoCookieOptions, sealPendingSession, sealReaderFlow, sessionSummary, sessionSummaryWithCookies, setCookieHeader, signOut, startSignIn, stateDigest, switchAccount, validState };
+export { type CompleteSignInInput, type CompleteSignInResult, type CookieInstruction, type CookieReader, LEDVERY_ISSUER_ORIGIN, type LinkAccountInput, type LinkAccountResult, type PendingSession, READER_SSO_FLOW_SECONDS, READER_SSO_LINK_SECONDS, READER_SSO_NEGATIVE_CACHE_SECONDS, READER_SSO_PENDING_SECONDS, READER_SSO_SIGNED_OUT_SECONDS, type ReaderSsoCheckOutcome, type ReaderSsoConfig, type ReaderSsoCookieNames, type ReaderSsoEvent, type ReaderSsoFailure, type ReaderSsoFlow, type ReaderSsoMethod, type ReaderSsoMode, type ReaderSsoProvider, type ReaderSsoRequest, type ReaderSsoResponse, SILENT_NEGATIVE_ERRORS, type SessionSummary, type SessionUser, type SignOutResult, type StartSignInInput, type StartSignInResult, type SwitchAccountResult, applyCookies, authorizeUrl, completeSignIn, cookieReader, linkAccount, linkFailureMessage, localReturnPath, networkHandoffReturnPath, openLinkChallenge, openPendingSession, openReaderFlow, pendingSwitch, precedence, readerSsoBootFlags, readerSsoCookieNames, readerSsoCookieOptions, sealLinkChallenge, sealPendingSession, sealReaderFlow, sessionSummary, sessionSummaryWithCookies, setCookieHeader, signOut, startSignIn, stateDigest, switchAccount, validState };

package/dist/reader-sso.d.ts

@@ -7,6 +7,7 @@ declare const READER_SSO_FLOW_SECONDS = 600;
 declare const READER_SSO_NEGATIVE_CACHE_SECONDS = 300;
 declare const READER_SSO_SIGNED_OUT_SECONDS = 86400;
 declare const READER_SSO_PENDING_SECONDS = 600;
+declare const READER_SSO_LINK_SECONDS = 600;
 declare const LEDVERY_ISSUER_ORIGIN = "https://api.ledvery.com";
 /** Ledvery results that mean "no silent session here"; never authentication failures. */
 declare const SILENT_NEGATIVE_ERRORS: readonly ["login_required", "consent_required", "interaction_required", "account_selection_required"];
@@ -25,6 +26,8 @@ type ReaderSsoCookieNames = {
     pending: string;
     /** Linking onto an unconfirmed account: the platform's emailed-code challenge token (10 minutes). */
     linkCode: string;
+    /** Signed proof that this browser received the account-link challenge from our callback. */
+    linkFlow: string;
 };
 /** Cookie names derived from a `__Host-` prefix, e.g. `__Host-media` → `__Host-media-reader`. */
 declare function readerSsoCookieNames(prefix: string): ReaderSsoCookieNames;
@@ -158,6 +161,9 @@ declare function sealReaderFlow(input: {
     tx?: string;
 }, key: string, now?: number): string;
 declare function openReaderFlow(cookie: string | undefined, key: string, now?: number, returnPath?: (next: string, mode: ReaderSsoMode) => string): ReaderSsoFlow | null;
+/** A URL's challenge ID is not enough to start linking an existing account. */
+declare function sealLinkChallenge(challengeId: string, key: string, now?: number): string;
+declare function openLinkChallenge(cookie: string | undefined, key: string, now?: number): string | null;
 /** A verified session the reader has not yet chosen over their current one. */
 type PendingSession = {
     token: string;
@@ -327,4 +333,4 @@ declare function readerSsoBootFlags(cookies: CookieReader, names: ReaderSsoCooki
     suppressed: boolean;
 };
 
-export { type CompleteSignInInput, type CompleteSignInResult, type CookieInstruction, type CookieReader, LEDVERY_ISSUER_ORIGIN, type LinkAccountInput, type LinkAccountResult, type PendingSession, READER_SSO_FLOW_SECONDS, READER_SSO_NEGATIVE_CACHE_SECONDS, READER_SSO_PENDING_SECONDS, READER_SSO_SIGNED_OUT_SECONDS, type ReaderSsoCheckOutcome, type ReaderSsoConfig, type ReaderSsoCookieNames, type ReaderSsoEvent, type ReaderSsoFailure, type ReaderSsoFlow, type ReaderSsoMethod, type ReaderSsoMode, type ReaderSsoProvider, type ReaderSsoRequest, type ReaderSsoResponse, SILENT_NEGATIVE_ERRORS, type SessionSummary, type SessionUser, type SignOutResult, type StartSignInInput, type StartSignInResult, type SwitchAccountResult, applyCookies, authorizeUrl, completeSignIn, cookieReader, linkAccount, linkFailureMessage, localReturnPath, networkHandoffReturnPath, openPendingSession, openReaderFlow, pendingSwitch, precedence, readerSsoBootFlags, readerSsoCookieNames, readerSsoCookieOptions, sealPendingSession, sealReaderFlow, sessionSummary, sessionSummaryWithCookies, setCookieHeader, signOut, startSignIn, stateDigest, switchAccount, validState };
+export { type CompleteSignInInput, type CompleteSignInResult, type CookieInstruction, type CookieReader, LEDVERY_ISSUER_ORIGIN, type LinkAccountInput, type LinkAccountResult, type PendingSession, READER_SSO_FLOW_SECONDS, READER_SSO_LINK_SECONDS, READER_SSO_NEGATIVE_CACHE_SECONDS, READER_SSO_PENDING_SECONDS, READER_SSO_SIGNED_OUT_SECONDS, type ReaderSsoCheckOutcome, type ReaderSsoConfig, type ReaderSsoCookieNames, type ReaderSsoEvent, type ReaderSsoFailure, type ReaderSsoFlow, type ReaderSsoMethod, type ReaderSsoMode, type ReaderSsoProvider, type ReaderSsoRequest, type ReaderSsoResponse, SILENT_NEGATIVE_ERRORS, type SessionSummary, type SessionUser, type SignOutResult, type StartSignInInput, type StartSignInResult, type SwitchAccountResult, applyCookies, authorizeUrl, completeSignIn, cookieReader, linkAccount, linkFailureMessage, localReturnPath, networkHandoffReturnPath, openLinkChallenge, openPendingSession, openReaderFlow, pendingSwitch, precedence, readerSsoBootFlags, readerSsoCookieNames, readerSsoCookieOptions, sealLinkChallenge, sealPendingSession, sealReaderFlow, sessionSummary, sessionSummaryWithCookies, setCookieHeader, signOut, startSignIn, stateDigest, switchAccount, validState };

package/dist/reader-sso.js

@@ -5,6 +5,7 @@ var READER_SSO_FLOW_SECONDS = 600;
 var READER_SSO_NEGATIVE_CACHE_SECONDS = 300;
 var READER_SSO_SIGNED_OUT_SECONDS = 86400;
 var READER_SSO_PENDING_SECONDS = 600;
+var READER_SSO_LINK_SECONDS = 600;
 var LEDVERY_ISSUER_ORIGIN = "https://api.ledvery.com";
 var SILENT_NEGATIVE_ERRORS = ["login_required", "consent_required", "interaction_required", "account_selection_required"];
 var COOKIE_PREFIX = /^__Host-[A-Za-z0-9_-]{1,60}$/;
@@ -20,7 +21,8 @@ function readerSsoCookieNames(prefix) {
     ssoChecked: `${prefix}-sso-checked`,
     signedOut: `${prefix}-signed-out`,
     pending: `${prefix}-sso-pending`,
-    linkCode: `${prefix}-link-code`
+    linkCode: `${prefix}-link-code`,
+    linkFlow: `${prefix}-sso-link`
   };
 }
 var readerSsoCookieOptions = { httpOnly: true, secure: true, sameSite: "lax", path: "/" };
@@ -145,6 +147,14 @@ function openReaderFlow(cookie, key, now = Date.now(), returnPath = (next) => lo
   const tx = typeof raw.tx === "string" && /^[a-f0-9]{1,64}$/.test(raw.tx) ? raw.tx : void 0;
   return { digest: raw.digest, subscribe: raw.subscribe && mode === "interactive", expires: raw.expires, returnTo, mode, provider, tx };
 }
+function sealLinkChallenge(challengeId, key, now = Date.now()) {
+  if (!CHALLENGE_ID.test(challengeId)) throw new Error("Invalid reader link challenge");
+  return seal("reader-link:v1", { challengeId, expires: now + READER_SSO_LINK_SECONDS * 1e3 }, key);
+}
+function openLinkChallenge(cookie, key, now = Date.now()) {
+  const raw = open("reader-link:v1", cookie, key);
+  return raw && typeof raw.challengeId === "string" && CHALLENGE_ID.test(raw.challengeId) && typeof raw.expires === "number" && Number.isFinite(raw.expires) && raw.expires > now ? raw.challengeId : null;
+}
 function sealPendingSession(pending, key, now = Date.now()) {
   return seal("reader-pending:v1", { ...pending, until: now + READER_SSO_PENDING_SECONDS * 1e3 }, key);
 }
@@ -222,7 +232,7 @@ async function startSignIn(config, input) {
       ...staleSession,
       { name: c.names.flow, value: sealReaderFlow({ state: value.state, subscribe: input.subscribe === true && mode === "interactive", returnTo: next, mode, provider, tx }, c.key, c.now()), maxAge: READER_SSO_FLOW_SECONDS }
     ];
-    if (mode === "interactive") cookies.push(clear(c.names.signedOut), clear(c.names.ssoChecked));
+    if (mode === "interactive") cookies.push(clear(c.names.signedOut), clear(c.names.ssoChecked), clear(c.names.linkFlow), clear(c.names.linkCode));
     emit(c, { name: "reader_signin_started", properties: { method: provider ?? "unknown", mode, transaction: tx } });
     return { ok: true, url, tx, cookies };
   } catch {
@@ -311,6 +321,7 @@ async function completeSignIn(config, input) {
       if (hint) link.set("hint", hint);
       if (flow.returnTo) link.set("next", flow.returnTo);
       if (flow.subscribe) link.set("subscribe", "1");
+      cookies.push({ name: c.names.linkFlow, value: sealLinkChallenge(challengeId, c.key, now), maxAge: READER_SSO_LINK_SECONDS });
       return redirect(`${c.accountPath}?${link}`, "link_required");
     }
     if (failed(exchange)) throw new Error("exchange");
@@ -395,7 +406,11 @@ async function linkAccount(config, input) {
   const c = resolve(config);
   const challengeId = typeof input.challenge_id === "string" && CHALLENGE_ID.test(input.challenge_id) ? input.challenge_id : "";
   const password = typeof input.password === "string" && input.password.length > 0 && input.password.length <= 1024 ? input.password : "";
-  if (!challengeId || !password) {
+  if (c.enabled === false || !challengeId || openLinkChallenge(input.cookies(c.names.linkFlow), c.key, c.now()) !== challengeId) {
+    emit(c, { name: "reader_signin_failed", properties: { reason: "link_invalid", mode: "interactive" } });
+    return { ok: false, status: 400, error: "Start sign-in again to connect your existing reader account.", cookies: [] };
+  }
+  if (!password) {
     emit(c, { name: "reader_signin_failed", properties: { reason: "link_invalid", mode: "interactive" } });
     return { ok: false, status: 400, error: "Enter the password of your existing reader account.", cookies: [] };
   }
@@ -424,7 +439,7 @@ async function linkAccount(config, input) {
     }
     const session = issuedSession(response, c.now());
     const flow = { digest: "", subscribe: input.subscribe === true, expires: 0, returnTo: next, mode: "interactive", provider: void 0 };
-    const result = await establish(c, { session, flow, method: "link", cookies: emailChallenge ? [clear(c.names.linkCode)] : [], input, negativeCache: { name: c.names.ssoChecked, value: "1", maxAge: READER_SSO_NEGATIVE_CACHE_SECONDS } });
+    const result = await establish(c, { session, flow, method: "link", cookies: [clear(c.names.linkFlow), ...emailChallenge ? [clear(c.names.linkCode)] : []], input, negativeCache: { name: c.names.ssoChecked, value: "1", maxAge: READER_SSO_NEGATIVE_CACHE_SECONDS } });
     if (result.kind === "signed-in") emit(c, { name: "reader_account_linked", properties: {} });
     return result.kind === "signed-in" ? { ok: true, switch: false, cookies: result.cookies, token: result.token, expiresAt: result.expiresAt, user: result.user, location: result.location } : { ok: true, switch: true, cookies: result.cookies, location: result.location };
   } catch {
@@ -492,6 +507,8 @@ async function signOut(config, input) {
       clear(c.names.newsletter),
       clear(c.names.pending),
       clear(c.names.ssoChecked),
+      clear(c.names.linkFlow),
+      clear(c.names.linkCode),
       { name: c.names.signedOut, value: "1", maxAge: READER_SSO_SIGNED_OUT_SECONDS },
       ...input.extraCookies ?? []
     ],
@@ -518,4 +535,4 @@ function readerSsoBootFlags(cookies, names) {
   };
 }
 
-export { LEDVERY_ISSUER_ORIGIN, READER_SSO_FLOW_SECONDS, READER_SSO_NEGATIVE_CACHE_SECONDS, READER_SSO_PENDING_SECONDS, READER_SSO_SIGNED_OUT_SECONDS, SILENT_NEGATIVE_ERRORS, applyCookies, authorizeUrl, completeSignIn, cookieReader, linkAccount, linkFailureMessage, localReturnPath, networkHandoffReturnPath, openPendingSession, openReaderFlow, pendingSwitch, precedence, readerSsoBootFlags, readerSsoCookieNames, readerSsoCookieOptions, sealPendingSession, sealReaderFlow, sessionSummary, sessionSummaryWithCookies, setCookieHeader, signOut, startSignIn, stateDigest, switchAccount, validState };
+export { LEDVERY_ISSUER_ORIGIN, READER_SSO_FLOW_SECONDS, READER_SSO_LINK_SECONDS, READER_SSO_NEGATIVE_CACHE_SECONDS, READER_SSO_PENDING_SECONDS, READER_SSO_SIGNED_OUT_SECONDS, SILENT_NEGATIVE_ERRORS, applyCookies, authorizeUrl, completeSignIn, cookieReader, linkAccount, linkFailureMessage, localReturnPath, networkHandoffReturnPath, openLinkChallenge, openPendingSession, openReaderFlow, pendingSwitch, precedence, readerSsoBootFlags, readerSsoCookieNames, readerSsoCookieOptions, sealLinkChallenge, sealPendingSession, sealReaderFlow, sessionSummary, sessionSummaryWithCookies, setCookieHeader, signOut, startSignIn, stateDigest, switchAccount, validState };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scalemule/news-publication",
-  "version": "0.0.89",
+  "version": "0.0.91",
   "description": "Shared server framework for ScaleMule local news publications. Walnut Creek Times is the broadsheet default; each paper supplies its own identity and feature flags.",
   "type": "module",
   "bin": {