@scalemule/news-publication 0.0.90 → 0.0.92

package/dist/reader-sso.cjs

@@ -20,6 +20,7 @@ var READER_SSO_FLOW_SECONDS = 600;
 var READER_SSO_NEGATIVE_CACHE_SECONDS = 300;
 var READER_SSO_SIGNED_OUT_SECONDS = 86400;
 var READER_SSO_PENDING_SECONDS = 600;
+var READER_SSO_LINK_SECONDS = 600;
 var LEDVERY_ISSUER_ORIGIN = "https://api.ledvery.com";
 var SILENT_NEGATIVE_ERRORS = ["login_required", "consent_required", "interaction_required", "account_selection_required"];
 var COOKIE_PREFIX = /^__Host-[A-Za-z0-9_-]{1,60}$/;
@@ -35,7 +36,8 @@ function readerSsoCookieNames(prefix) {
     ssoChecked: `${prefix}-sso-checked`,
     signedOut: `${prefix}-signed-out`,
     pending: `${prefix}-sso-pending`,
-    linkCode: `${prefix}-link-code`
+    linkCode: `${prefix}-link-code`,
+    linkFlow: `${prefix}-sso-link`
   };
 }
 var readerSsoCookieOptions = { httpOnly: true, secure: true, sameSite: "lax", path: "/" };
@@ -160,6 +162,14 @@ function openReaderFlow(cookie, key, now = Date.now(), returnPath = (next) => lo
   const tx = typeof raw.tx === "string" && /^[a-f0-9]{1,64}$/.test(raw.tx) ? raw.tx : void 0;
   return { digest: raw.digest, subscribe: raw.subscribe && mode === "interactive", expires: raw.expires, returnTo, mode, provider, tx };
 }
+function sealLinkChallenge(challengeId, key, now = Date.now()) {
+  if (!CHALLENGE_ID.test(challengeId)) throw new Error("Invalid reader link challenge");
+  return seal("reader-link:v1", { challengeId, expires: now + READER_SSO_LINK_SECONDS * 1e3 }, key);
+}
+function openLinkChallenge(cookie, key, now = Date.now()) {
+  const raw = open("reader-link:v1", cookie, key);
+  return raw && typeof raw.challengeId === "string" && CHALLENGE_ID.test(raw.challengeId) && typeof raw.expires === "number" && Number.isFinite(raw.expires) && raw.expires > now ? raw.challengeId : null;
+}
 function sealPendingSession(pending, key, now = Date.now()) {
   return seal("reader-pending:v1", { ...pending, until: now + READER_SSO_PENDING_SECONDS * 1e3 }, key);
 }
@@ -215,7 +225,7 @@ async function startSignIn(config, input) {
     }
   }
   if (mode === "silent") {
-    if (input.cookies(c.names.signedOut) || input.cookies(c.names.ssoChecked) === "1") {
+    if (input.cookies(c.names.signedOut)) {
       return { ok: false, status: 204, error: "", reason: "suppressed", redirect, cookies: staleSession };
     }
   }
@@ -237,7 +247,7 @@ async function startSignIn(config, input) {
       ...staleSession,
       { name: c.names.flow, value: sealReaderFlow({ state: value.state, subscribe: input.subscribe === true && mode === "interactive", returnTo: next, mode, provider, tx }, c.key, c.now()), maxAge: READER_SSO_FLOW_SECONDS }
     ];
-    if (mode === "interactive") cookies.push(clear(c.names.signedOut), clear(c.names.ssoChecked));
+    if (mode === "interactive") cookies.push(clear(c.names.signedOut), clear(c.names.ssoChecked), clear(c.names.linkFlow), clear(c.names.linkCode));
     emit(c, { name: "reader_signin_started", properties: { method: provider ?? "unknown", mode, transaction: tx } });
     return { ok: true, url, tx, cookies };
   } catch {
@@ -326,6 +336,7 @@ async function completeSignIn(config, input) {
       if (hint) link.set("hint", hint);
       if (flow.returnTo) link.set("next", flow.returnTo);
       if (flow.subscribe) link.set("subscribe", "1");
+      cookies.push({ name: c.names.linkFlow, value: sealLinkChallenge(challengeId, c.key, now), maxAge: READER_SSO_LINK_SECONDS });
       return redirect(`${c.accountPath}?${link}`, "link_required");
     }
     if (failed(exchange)) throw new Error("exchange");
@@ -410,7 +421,11 @@ async function linkAccount(config, input) {
   const c = resolve(config);
   const challengeId = typeof input.challenge_id === "string" && CHALLENGE_ID.test(input.challenge_id) ? input.challenge_id : "";
   const password = typeof input.password === "string" && input.password.length > 0 && input.password.length <= 1024 ? input.password : "";
-  if (!challengeId || !password) {
+  if (c.enabled === false || !challengeId || openLinkChallenge(input.cookies(c.names.linkFlow), c.key, c.now()) !== challengeId) {
+    emit(c, { name: "reader_signin_failed", properties: { reason: "link_invalid", mode: "interactive" } });
+    return { ok: false, status: 400, error: "Start sign-in again to connect your existing reader account.", cookies: [] };
+  }
+  if (!password) {
     emit(c, { name: "reader_signin_failed", properties: { reason: "link_invalid", mode: "interactive" } });
     return { ok: false, status: 400, error: "Enter the password of your existing reader account.", cookies: [] };
   }
@@ -439,7 +454,7 @@ async function linkAccount(config, input) {
     }
     const session = issuedSession(response, c.now());
     const flow = { digest: "", subscribe: input.subscribe === true, expires: 0, returnTo: next, mode: "interactive", provider: void 0 };
-    const result = await establish(c, { session, flow, method: "link", cookies: emailChallenge ? [clear(c.names.linkCode)] : [], input, negativeCache: { name: c.names.ssoChecked, value: "1", maxAge: READER_SSO_NEGATIVE_CACHE_SECONDS } });
+    const result = await establish(c, { session, flow, method: "link", cookies: [clear(c.names.linkFlow), ...emailChallenge ? [clear(c.names.linkCode)] : []], input, negativeCache: { name: c.names.ssoChecked, value: "1", maxAge: READER_SSO_NEGATIVE_CACHE_SECONDS } });
     if (result.kind === "signed-in") emit(c, { name: "reader_account_linked", properties: {} });
     return result.kind === "signed-in" ? { ok: true, switch: false, cookies: result.cookies, token: result.token, expiresAt: result.expiresAt, user: result.user, location: result.location } : { ok: true, switch: true, cookies: result.cookies, location: result.location };
   } catch {
@@ -507,6 +522,8 @@ async function signOut(config, input) {
       clear(c.names.newsletter),
       clear(c.names.pending),
       clear(c.names.ssoChecked),
+      clear(c.names.linkFlow),
+      clear(c.names.linkCode),
       { name: c.names.signedOut, value: "1", maxAge: READER_SSO_SIGNED_OUT_SECONDS },
       ...input.extraCookies ?? []
     ],
@@ -536,6 +553,7 @@ function readerSsoBootFlags(cookies, names) {
 exports.LEDVERY_ISSUER_ORIGIN = LEDVERY_ISSUER_ORIGIN;
 exports.READER_SSO_EVENTS = READER_SSO_EVENTS;
 exports.READER_SSO_FLOW_SECONDS = READER_SSO_FLOW_SECONDS;
+exports.READER_SSO_LINK_SECONDS = READER_SSO_LINK_SECONDS;
 exports.READER_SSO_NEGATIVE_CACHE_SECONDS = READER_SSO_NEGATIVE_CACHE_SECONDS;
 exports.READER_SSO_PENDING_SECONDS = READER_SSO_PENDING_SECONDS;
 exports.READER_SSO_PROPERTY_KEYS = READER_SSO_PROPERTY_KEYS;
@@ -549,6 +567,7 @@ exports.linkAccount = linkAccount;
 exports.linkFailureMessage = linkFailureMessage;
 exports.localReturnPath = localReturnPath;
 exports.networkHandoffReturnPath = networkHandoffReturnPath;
+exports.openLinkChallenge = openLinkChallenge;
 exports.openPendingSession = openPendingSession;
 exports.openReaderFlow = openReaderFlow;
 exports.pendingSwitch = pendingSwitch;
@@ -556,6 +575,7 @@ exports.precedence = precedence;
 exports.readerSsoBootFlags = readerSsoBootFlags;
 exports.readerSsoCookieNames = readerSsoCookieNames;
 exports.readerSsoCookieOptions = readerSsoCookieOptions;
+exports.sealLinkChallenge = sealLinkChallenge;
 exports.sealPendingSession = sealPendingSession;
 exports.sealReaderFlow = sealReaderFlow;
 exports.sessionSummary = sessionSummary;

package/dist/reader-sso.d.cts

@@ -7,6 +7,7 @@ declare const READER_SSO_FLOW_SECONDS = 600;
 declare const READER_SSO_NEGATIVE_CACHE_SECONDS = 300;
 declare const READER_SSO_SIGNED_OUT_SECONDS = 86400;
 declare const READER_SSO_PENDING_SECONDS = 600;
+declare const READER_SSO_LINK_SECONDS = 600;
 declare const LEDVERY_ISSUER_ORIGIN = "https://api.ledvery.com";
 /** Ledvery results that mean "no silent session here"; never authentication failures. */
 declare const SILENT_NEGATIVE_ERRORS: readonly ["login_required", "consent_required", "interaction_required", "account_selection_required"];
@@ -25,6 +26,8 @@ type ReaderSsoCookieNames = {
     pending: string;
     /** Linking onto an unconfirmed account: the platform's emailed-code challenge token (10 minutes). */
     linkCode: string;
+    /** Signed proof that this browser received the account-link challenge from our callback. */
+    linkFlow: string;
 };
 /** Cookie names derived from a `__Host-` prefix, e.g. `__Host-media` → `__Host-media-reader`. */
 declare function readerSsoCookieNames(prefix: string): ReaderSsoCookieNames;
@@ -158,6 +161,9 @@ declare function sealReaderFlow(input: {
     tx?: string;
 }, key: string, now?: number): string;
 declare function openReaderFlow(cookie: string | undefined, key: string, now?: number, returnPath?: (next: string, mode: ReaderSsoMode) => string): ReaderSsoFlow | null;
+/** A URL's challenge ID is not enough to start linking an existing account. */
+declare function sealLinkChallenge(challengeId: string, key: string, now?: number): string;
+declare function openLinkChallenge(cookie: string | undefined, key: string, now?: number): string | null;
 /** A verified session the reader has not yet chosen over their current one. */
 type PendingSession = {
     token: string;
@@ -327,4 +333,4 @@ declare function readerSsoBootFlags(cookies: CookieReader, names: ReaderSsoCooki
     suppressed: boolean;
 };
 
-export { type CompleteSignInInput, type CompleteSignInResult, type CookieInstruction, type CookieReader, LEDVERY_ISSUER_ORIGIN, type LinkAccountInput, type LinkAccountResult, type PendingSession, READER_SSO_FLOW_SECONDS, READER_SSO_NEGATIVE_CACHE_SECONDS, READER_SSO_PENDING_SECONDS, READER_SSO_SIGNED_OUT_SECONDS, type ReaderSsoCheckOutcome, type ReaderSsoConfig, type ReaderSsoCookieNames, type ReaderSsoEvent, type ReaderSsoFailure, type ReaderSsoFlow, type ReaderSsoMethod, type ReaderSsoMode, type ReaderSsoProvider, type ReaderSsoRequest, type ReaderSsoResponse, SILENT_NEGATIVE_ERRORS, type SessionSummary, type SessionUser, type SignOutResult, type StartSignInInput, type StartSignInResult, type SwitchAccountResult, applyCookies, authorizeUrl, completeSignIn, cookieReader, linkAccount, linkFailureMessage, localReturnPath, networkHandoffReturnPath, openPendingSession, openReaderFlow, pendingSwitch, precedence, readerSsoBootFlags, readerSsoCookieNames, readerSsoCookieOptions, sealPendingSession, sealReaderFlow, sessionSummary, sessionSummaryWithCookies, setCookieHeader, signOut, startSignIn, stateDigest, switchAccount, validState };
+export { type CompleteSignInInput, type CompleteSignInResult, type CookieInstruction, type CookieReader, LEDVERY_ISSUER_ORIGIN, type LinkAccountInput, type LinkAccountResult, type PendingSession, READER_SSO_FLOW_SECONDS, READER_SSO_LINK_SECONDS, READER_SSO_NEGATIVE_CACHE_SECONDS, READER_SSO_PENDING_SECONDS, READER_SSO_SIGNED_OUT_SECONDS, type ReaderSsoCheckOutcome, type ReaderSsoConfig, type ReaderSsoCookieNames, type ReaderSsoEvent, type ReaderSsoFailure, type ReaderSsoFlow, type ReaderSsoMethod, type ReaderSsoMode, type ReaderSsoProvider, type ReaderSsoRequest, type ReaderSsoResponse, SILENT_NEGATIVE_ERRORS, type SessionSummary, type SessionUser, type SignOutResult, type StartSignInInput, type StartSignInResult, type SwitchAccountResult, applyCookies, authorizeUrl, completeSignIn, cookieReader, linkAccount, linkFailureMessage, localReturnPath, networkHandoffReturnPath, openLinkChallenge, openPendingSession, openReaderFlow, pendingSwitch, precedence, readerSsoBootFlags, readerSsoCookieNames, readerSsoCookieOptions, sealLinkChallenge, sealPendingSession, sealReaderFlow, sessionSummary, sessionSummaryWithCookies, setCookieHeader, signOut, startSignIn, stateDigest, switchAccount, validState };

package/dist/reader-sso.d.ts

@@ -7,6 +7,7 @@ declare const READER_SSO_FLOW_SECONDS = 600;
 declare const READER_SSO_NEGATIVE_CACHE_SECONDS = 300;
 declare const READER_SSO_SIGNED_OUT_SECONDS = 86400;
 declare const READER_SSO_PENDING_SECONDS = 600;
+declare const READER_SSO_LINK_SECONDS = 600;
 declare const LEDVERY_ISSUER_ORIGIN = "https://api.ledvery.com";
 /** Ledvery results that mean "no silent session here"; never authentication failures. */
 declare const SILENT_NEGATIVE_ERRORS: readonly ["login_required", "consent_required", "interaction_required", "account_selection_required"];
@@ -25,6 +26,8 @@ type ReaderSsoCookieNames = {
     pending: string;
     /** Linking onto an unconfirmed account: the platform's emailed-code challenge token (10 minutes). */
     linkCode: string;
+    /** Signed proof that this browser received the account-link challenge from our callback. */
+    linkFlow: string;
 };
 /** Cookie names derived from a `__Host-` prefix, e.g. `__Host-media` → `__Host-media-reader`. */
 declare function readerSsoCookieNames(prefix: string): ReaderSsoCookieNames;
@@ -158,6 +161,9 @@ declare function sealReaderFlow(input: {
     tx?: string;
 }, key: string, now?: number): string;
 declare function openReaderFlow(cookie: string | undefined, key: string, now?: number, returnPath?: (next: string, mode: ReaderSsoMode) => string): ReaderSsoFlow | null;
+/** A URL's challenge ID is not enough to start linking an existing account. */
+declare function sealLinkChallenge(challengeId: string, key: string, now?: number): string;
+declare function openLinkChallenge(cookie: string | undefined, key: string, now?: number): string | null;
 /** A verified session the reader has not yet chosen over their current one. */
 type PendingSession = {
     token: string;
@@ -327,4 +333,4 @@ declare function readerSsoBootFlags(cookies: CookieReader, names: ReaderSsoCooki
     suppressed: boolean;
 };
 
-export { type CompleteSignInInput, type CompleteSignInResult, type CookieInstruction, type CookieReader, LEDVERY_ISSUER_ORIGIN, type LinkAccountInput, type LinkAccountResult, type PendingSession, READER_SSO_FLOW_SECONDS, READER_SSO_NEGATIVE_CACHE_SECONDS, READER_SSO_PENDING_SECONDS, READER_SSO_SIGNED_OUT_SECONDS, type ReaderSsoCheckOutcome, type ReaderSsoConfig, type ReaderSsoCookieNames, type ReaderSsoEvent, type ReaderSsoFailure, type ReaderSsoFlow, type ReaderSsoMethod, type ReaderSsoMode, type ReaderSsoProvider, type ReaderSsoRequest, type ReaderSsoResponse, SILENT_NEGATIVE_ERRORS, type SessionSummary, type SessionUser, type SignOutResult, type StartSignInInput, type StartSignInResult, type SwitchAccountResult, applyCookies, authorizeUrl, completeSignIn, cookieReader, linkAccount, linkFailureMessage, localReturnPath, networkHandoffReturnPath, openPendingSession, openReaderFlow, pendingSwitch, precedence, readerSsoBootFlags, readerSsoCookieNames, readerSsoCookieOptions, sealPendingSession, sealReaderFlow, sessionSummary, sessionSummaryWithCookies, setCookieHeader, signOut, startSignIn, stateDigest, switchAccount, validState };
+export { type CompleteSignInInput, type CompleteSignInResult, type CookieInstruction, type CookieReader, LEDVERY_ISSUER_ORIGIN, type LinkAccountInput, type LinkAccountResult, type PendingSession, READER_SSO_FLOW_SECONDS, READER_SSO_LINK_SECONDS, READER_SSO_NEGATIVE_CACHE_SECONDS, READER_SSO_PENDING_SECONDS, READER_SSO_SIGNED_OUT_SECONDS, type ReaderSsoCheckOutcome, type ReaderSsoConfig, type ReaderSsoCookieNames, type ReaderSsoEvent, type ReaderSsoFailure, type ReaderSsoFlow, type ReaderSsoMethod, type ReaderSsoMode, type ReaderSsoProvider, type ReaderSsoRequest, type ReaderSsoResponse, SILENT_NEGATIVE_ERRORS, type SessionSummary, type SessionUser, type SignOutResult, type StartSignInInput, type StartSignInResult, type SwitchAccountResult, applyCookies, authorizeUrl, completeSignIn, cookieReader, linkAccount, linkFailureMessage, localReturnPath, networkHandoffReturnPath, openLinkChallenge, openPendingSession, openReaderFlow, pendingSwitch, precedence, readerSsoBootFlags, readerSsoCookieNames, readerSsoCookieOptions, sealLinkChallenge, sealPendingSession, sealReaderFlow, sessionSummary, sessionSummaryWithCookies, setCookieHeader, signOut, startSignIn, stateDigest, switchAccount, validState };

package/dist/reader-sso.js

@@ -5,6 +5,7 @@ var READER_SSO_FLOW_SECONDS = 600;
 var READER_SSO_NEGATIVE_CACHE_SECONDS = 300;
 var READER_SSO_SIGNED_OUT_SECONDS = 86400;
 var READER_SSO_PENDING_SECONDS = 600;
+var READER_SSO_LINK_SECONDS = 600;
 var LEDVERY_ISSUER_ORIGIN = "https://api.ledvery.com";
 var SILENT_NEGATIVE_ERRORS = ["login_required", "consent_required", "interaction_required", "account_selection_required"];
 var COOKIE_PREFIX = /^__Host-[A-Za-z0-9_-]{1,60}$/;
@@ -20,7 +21,8 @@ function readerSsoCookieNames(prefix) {
     ssoChecked: `${prefix}-sso-checked`,
     signedOut: `${prefix}-signed-out`,
     pending: `${prefix}-sso-pending`,
-    linkCode: `${prefix}-link-code`
+    linkCode: `${prefix}-link-code`,
+    linkFlow: `${prefix}-sso-link`
   };
 }
 var readerSsoCookieOptions = { httpOnly: true, secure: true, sameSite: "lax", path: "/" };
@@ -145,6 +147,14 @@ function openReaderFlow(cookie, key, now = Date.now(), returnPath = (next) => lo
   const tx = typeof raw.tx === "string" && /^[a-f0-9]{1,64}$/.test(raw.tx) ? raw.tx : void 0;
   return { digest: raw.digest, subscribe: raw.subscribe && mode === "interactive", expires: raw.expires, returnTo, mode, provider, tx };
 }
+function sealLinkChallenge(challengeId, key, now = Date.now()) {
+  if (!CHALLENGE_ID.test(challengeId)) throw new Error("Invalid reader link challenge");
+  return seal("reader-link:v1", { challengeId, expires: now + READER_SSO_LINK_SECONDS * 1e3 }, key);
+}
+function openLinkChallenge(cookie, key, now = Date.now()) {
+  const raw = open("reader-link:v1", cookie, key);
+  return raw && typeof raw.challengeId === "string" && CHALLENGE_ID.test(raw.challengeId) && typeof raw.expires === "number" && Number.isFinite(raw.expires) && raw.expires > now ? raw.challengeId : null;
+}
 function sealPendingSession(pending, key, now = Date.now()) {
   return seal("reader-pending:v1", { ...pending, until: now + READER_SSO_PENDING_SECONDS * 1e3 }, key);
 }
@@ -200,7 +210,7 @@ async function startSignIn(config, input) {
     }
   }
   if (mode === "silent") {
-    if (input.cookies(c.names.signedOut) || input.cookies(c.names.ssoChecked) === "1") {
+    if (input.cookies(c.names.signedOut)) {
       return { ok: false, status: 204, error: "", reason: "suppressed", redirect, cookies: staleSession };
     }
   }
@@ -222,7 +232,7 @@ async function startSignIn(config, input) {
       ...staleSession,
       { name: c.names.flow, value: sealReaderFlow({ state: value.state, subscribe: input.subscribe === true && mode === "interactive", returnTo: next, mode, provider, tx }, c.key, c.now()), maxAge: READER_SSO_FLOW_SECONDS }
     ];
-    if (mode === "interactive") cookies.push(clear(c.names.signedOut), clear(c.names.ssoChecked));
+    if (mode === "interactive") cookies.push(clear(c.names.signedOut), clear(c.names.ssoChecked), clear(c.names.linkFlow), clear(c.names.linkCode));
     emit(c, { name: "reader_signin_started", properties: { method: provider ?? "unknown", mode, transaction: tx } });
     return { ok: true, url, tx, cookies };
   } catch {
@@ -311,6 +321,7 @@ async function completeSignIn(config, input) {
       if (hint) link.set("hint", hint);
       if (flow.returnTo) link.set("next", flow.returnTo);
       if (flow.subscribe) link.set("subscribe", "1");
+      cookies.push({ name: c.names.linkFlow, value: sealLinkChallenge(challengeId, c.key, now), maxAge: READER_SSO_LINK_SECONDS });
       return redirect(`${c.accountPath}?${link}`, "link_required");
     }
     if (failed(exchange)) throw new Error("exchange");
@@ -395,7 +406,11 @@ async function linkAccount(config, input) {
   const c = resolve(config);
   const challengeId = typeof input.challenge_id === "string" && CHALLENGE_ID.test(input.challenge_id) ? input.challenge_id : "";
   const password = typeof input.password === "string" && input.password.length > 0 && input.password.length <= 1024 ? input.password : "";
-  if (!challengeId || !password) {
+  if (c.enabled === false || !challengeId || openLinkChallenge(input.cookies(c.names.linkFlow), c.key, c.now()) !== challengeId) {
+    emit(c, { name: "reader_signin_failed", properties: { reason: "link_invalid", mode: "interactive" } });
+    return { ok: false, status: 400, error: "Start sign-in again to connect your existing reader account.", cookies: [] };
+  }
+  if (!password) {
     emit(c, { name: "reader_signin_failed", properties: { reason: "link_invalid", mode: "interactive" } });
     return { ok: false, status: 400, error: "Enter the password of your existing reader account.", cookies: [] };
   }
@@ -424,7 +439,7 @@ async function linkAccount(config, input) {
     }
     const session = issuedSession(response, c.now());
     const flow = { digest: "", subscribe: input.subscribe === true, expires: 0, returnTo: next, mode: "interactive", provider: void 0 };
-    const result = await establish(c, { session, flow, method: "link", cookies: emailChallenge ? [clear(c.names.linkCode)] : [], input, negativeCache: { name: c.names.ssoChecked, value: "1", maxAge: READER_SSO_NEGATIVE_CACHE_SECONDS } });
+    const result = await establish(c, { session, flow, method: "link", cookies: [clear(c.names.linkFlow), ...emailChallenge ? [clear(c.names.linkCode)] : []], input, negativeCache: { name: c.names.ssoChecked, value: "1", maxAge: READER_SSO_NEGATIVE_CACHE_SECONDS } });
     if (result.kind === "signed-in") emit(c, { name: "reader_account_linked", properties: {} });
     return result.kind === "signed-in" ? { ok: true, switch: false, cookies: result.cookies, token: result.token, expiresAt: result.expiresAt, user: result.user, location: result.location } : { ok: true, switch: true, cookies: result.cookies, location: result.location };
   } catch {
@@ -492,6 +507,8 @@ async function signOut(config, input) {
       clear(c.names.newsletter),
       clear(c.names.pending),
       clear(c.names.ssoChecked),
+      clear(c.names.linkFlow),
+      clear(c.names.linkCode),
       { name: c.names.signedOut, value: "1", maxAge: READER_SSO_SIGNED_OUT_SECONDS },
       ...input.extraCookies ?? []
     ],
@@ -518,4 +535,4 @@ function readerSsoBootFlags(cookies, names) {
   };
 }
 
-export { LEDVERY_ISSUER_ORIGIN, READER_SSO_FLOW_SECONDS, READER_SSO_NEGATIVE_CACHE_SECONDS, READER_SSO_PENDING_SECONDS, READER_SSO_SIGNED_OUT_SECONDS, SILENT_NEGATIVE_ERRORS, applyCookies, authorizeUrl, completeSignIn, cookieReader, linkAccount, linkFailureMessage, localReturnPath, networkHandoffReturnPath, openPendingSession, openReaderFlow, pendingSwitch, precedence, readerSsoBootFlags, readerSsoCookieNames, readerSsoCookieOptions, sealPendingSession, sealReaderFlow, sessionSummary, sessionSummaryWithCookies, setCookieHeader, signOut, startSignIn, stateDigest, switchAccount, validState };
+export { LEDVERY_ISSUER_ORIGIN, READER_SSO_FLOW_SECONDS, READER_SSO_LINK_SECONDS, READER_SSO_NEGATIVE_CACHE_SECONDS, READER_SSO_PENDING_SECONDS, READER_SSO_SIGNED_OUT_SECONDS, SILENT_NEGATIVE_ERRORS, applyCookies, authorizeUrl, completeSignIn, cookieReader, linkAccount, linkFailureMessage, localReturnPath, networkHandoffReturnPath, openLinkChallenge, openPendingSession, openReaderFlow, pendingSwitch, precedence, readerSsoBootFlags, readerSsoCookieNames, readerSsoCookieOptions, sealLinkChallenge, sealPendingSession, sealReaderFlow, sessionSummary, sessionSummaryWithCookies, setCookieHeader, signOut, startSignIn, stateDigest, switchAccount, validState };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scalemule/news-publication",
-  "version": "0.0.90",
+  "version": "0.0.92",
   "description": "Shared server framework for ScaleMule local news publications. Walnut Creek Times is the broadsheet default; each paper supplies its own identity and feature flags.",
   "type": "module",
   "bin": {