@marver-design/marver 0.11.1 → 0.12.0

package/dist/{comments-CRqaO2MH.mjs → comments-pNxjTrGN.mjs}

@@ -1,7 +1,8 @@
 import { n as NAME } from "./cli.mjs";
-import { a as syncOnce, i as loadCollab, n as connectClaim, r as connectToken, s as replay, t as connect } from "./sync-DELGomPk.mjs";
+import { n as replay } from "./events-C9k-ceOj.mjs";
 import { i as readLog, r as listBoards, t as appendEvents } from "./comments-DZyobpxG.mjs";
-import { n as localProfile } from "./profile-DcsJyppw.mjs";
+import { a as syncOnce, i as loadCollab, n as connectClaim, r as connectToken, t as connect } from "./sync-WYxDN9IT.mjs";
+import { n as localProfile } from "./profile-ChpTPd-X.mjs";
 import { join } from "node:path";
 import { createInterface } from "node:readline";
 import { randomUUID } from "node:crypto";

package/dist/{daemon-DSmaS453.mjs → daemon-WjonKlPz.mjs}

@@ -1,7 +1,7 @@
-import { s as replay } from "./sync-DELGomPk.mjs";
+import { n as replay } from "./events-C9k-ceOj.mjs";
 import { i as readLog, r as listBoards, t as appendEvents } from "./comments-DZyobpxG.mjs";
-import { n as localProfile } from "./profile-DcsJyppw.mjs";
-import { i as toFrameId } from "./manifest-C2tzkNaC.mjs";
+import { n as localProfile } from "./profile-ChpTPd-X.mjs";
+import { i as toFrameId } from "./manifest-CS6krOTe.mjs";
 import { workActivity } from "./work-CLrmY-vQ.mjs";
 import { r as deviceId, t as has } from "./ledger-Bu0BjqIe.mjs";
 import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, watch, writeFileSync, writeSync } from "node:fs";

package/dist/{dev-BWIL2ewj.mjs → dev-BXq7yE1p.mjs}

@@ -1,6 +1,6 @@
 import { n as NAME, r as PKG } from "./cli.mjs";
-import { i as detectHost, n as loadConfig } from "./config-t9coJ-Pq.mjs";
-import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-DjBFxEQ7.mjs";
+import { l as detectHost, s as loadConfig } from "./manifest-CS6krOTe.mjs";
+import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-Boy7I_JH.mjs";
 import { realpathSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -247,7 +247,7 @@ async function dev(root, portFlag) {
 	console.log(`\n  ${NAME} · ${projectName} → http://localhost:${port}/\n`);
 	try {
 		const { staleManagedInstructions } = await import("./managed-HwHVNI3h.mjs");
-		const { installedVersion } = await import("./update-DuWDj5nR.mjs").then((n) => n.r);
+		const { installedVersion } = await import("./plugin-Boy7I_JH.mjs").then((n) => n.i);
 		const stale = staleManagedInstructions(root);
 		if (stale.length) {
 			const shown = stale.slice(0, 4).join(", ") + (stale.length > 4 ? `, +${stale.length - 4} more` : "");
@@ -255,7 +255,7 @@ async function dev(root, portFlag) {
 			console.log(`  instructions predate ${v ? NAME + " " + v : "the installed version"} (${shown}) - run: npx ${NAME} init\n`);
 		}
 	} catch {}
-	const { loadCollab, syncOnce } = await import("./sync-DELGomPk.mjs").then((n) => n.o);
+	const { loadCollab, syncOnce } = await import("./sync-WYxDN9IT.mjs").then((n) => n.o);
 	if (loadCollab(root)) console.log(`  comments: syncing with the published canvas\n`);
 	let syncing = false;
 	const tick = async () => {
@@ -285,7 +285,7 @@ async function dev(root, portFlag) {
 		});
 	}
 	if (config.jam) {
-		const { startJam } = await import("./daemon-DSmaS453.mjs");
+		const { startJam } = await import("./daemon-WjonKlPz.mjs");
 		const jam = startJam(root, config.jam, (m) => console.log(m), (board) => server.ws.send("sh:jam-comment", { board }));
 		if (jam) {
 			const close = server.close.bind(server);

package/dist/events-C9k-ceOj.mjs

@@ -0,0 +1,101 @@
+//#region src/shared/events.ts
+/** Events the other side lacks, by id - the sync payload in either direction. */
+function diffEvents(mine, theirIds) {
+	const have = new Set(theirIds);
+	return mine.filter((e) => !have.has(e.id));
+}
+/** Replay a board's events into current thread state. Deterministic: replay order is
+*  (ts, id) so two stores holding the same event SET always derive the same state.
+*  TWO passes - creates first, then everything else - so a reply whose author's clock
+*  ran ahead of the creator's still lands instead of being dropped forever. */
+function replay(events) {
+	const ordered = [...events].sort((a, b) => a.ts - b.ts || (a.id < b.id ? -1 : 1));
+	const threads = /* @__PURE__ */ new Map();
+	for (const ev of ordered) {
+		if (ev.type !== "create") continue;
+		if (!ev.commentId || threads.has(ev.commentId)) continue;
+		threads.set(ev.commentId, {
+			id: ev.commentId,
+			board: ev.board,
+			nodeKey: ev.nodeKey,
+			frame: ev.frame,
+			anchor: ev.anchor,
+			author: ev.author,
+			body: ev.body,
+			ts: ev.ts,
+			resolved: false,
+			agent: ev.agent,
+			agentMeta: ev.agentMeta,
+			replies: [],
+			reactions: {}
+		});
+	}
+	for (const ev of ordered) switch (ev.type) {
+		case "reply": {
+			const t = ev.parentId ? threads.get(ev.parentId) : void 0;
+			if (!t || !ev.commentId || t.replies.some((r) => r.id === ev.commentId)) break;
+			t.replies.push({
+				id: ev.commentId,
+				author: ev.author,
+				body: ev.body,
+				ts: ev.ts,
+				agent: ev.agent,
+				agentMeta: ev.agentMeta
+			});
+			break;
+		}
+		case "edit": {
+			if (!ev.commentId || ev.body === void 0) break;
+			const t = threads.get(ev.commentId);
+			if (t) {
+				t.body = ev.body;
+				break;
+			}
+			for (const th of threads.values()) {
+				const r = th.replies.find((r) => r.id === ev.commentId);
+				if (r) {
+					r.body = ev.body;
+					break;
+				}
+			}
+			break;
+		}
+		case "resolve": {
+			const t = ev.commentId ? threads.get(ev.commentId) : void 0;
+			if (t) {
+				t.resolved = true;
+				if (ev.addressedIn) t.addressedIn = ev.addressedIn;
+			}
+			break;
+		}
+		case "reopen": {
+			const t = ev.commentId ? threads.get(ev.commentId) : void 0;
+			if (t) {
+				t.resolved = false;
+				t.addressedIn = void 0;
+			}
+			break;
+		}
+		case "reanchor": {
+			const t = ev.commentId ? threads.get(ev.commentId) : void 0;
+			if (t && ev.anchor != null) t.anchor = ev.anchor;
+			break;
+		}
+		case "react": {
+			const t = ev.commentId ? threads.get(ev.commentId) : void 0;
+			const who = ev.author?.id ?? ev.author?.email;
+			if (!t || !who || !ev.emoji) break;
+			const users = t.reactions[ev.emoji] ??= [];
+			const at = users.indexOf(who);
+			if (at === -1) users.push(who);
+			else {
+				users.splice(at, 1);
+				if (!users.length) delete t.reactions[ev.emoji];
+			}
+			break;
+		}
+	}
+	return [...threads.values()];
+}
+//#endregion
+export { replay as n, diffEvents as t };

package/dist/{init-BSclDg4I.mjs → init-BpitOqRQ.mjs}

@@ -1,6 +1,5 @@
 import { n as NAME } from "./cli.mjs";
-import { a as readJson, i as detectHost, r as detectAgent, t as DEFAULTS } from "./config-t9coJ-Pq.mjs";
-import { a as writeManifest, r as scanFrames } from "./manifest-C2tzkNaC.mjs";
+import { a as writeManifest, c as detectAgent, l as detectHost, o as DEFAULTS, r as scanFrames, u as readJson } from "./manifest-CS6krOTe.mjs";
 import { MANAGED_PREFIX, enumerateInstructionTemplates, hashBody, managedFile, pkgDir } from "./managed-HwHVNI3h.mjs";
 import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, relative } from "node:path";
@@ -144,7 +143,7 @@ function init(root, opts) {
 		refresh("providers.tsx", [providersTemplate(null, null), providersTemplate(null, host.toaster, host.routerPkg)], providersTemplate(host.router, host.toaster, host.routerPkg));
 		refresh("tsconfig.json", [STANDALONE_TSCONFIG], tsconfigNow());
 	}
-	write(".gitignore", ".local/\n.dist/\n");
+	write(".gitignore", ".local/\n.dist/\n.dist-seeds/\n");
 	write(".gitattributes", "comments/*.jsonl merge=union\n");
 	write("scenes/_layout.tsx", readFileSync(join(templates, "root-layout.tsx"), "utf8"));
 	if (!existsSync(join(design, "boards"))) {

package/dist/{config-t9coJ-Pq.mjs → manifest-CS6krOTe.mjs}

@@ -1,6 +1,8 @@
-import { accessSync, constants, existsSync, readFileSync, statSync } from "node:fs";
-import { delimiter, isAbsolute, join } from "node:path";
+import { r as PKG, t as CONTENT_WIDTH } from "./cli.mjs";
+import { accessSync, constants, existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import { delimiter, isAbsolute, join, relative, sep } from "node:path";
 import { pathToFileURL } from "node:url";
+import { createHash } from "node:crypto";
 //#region src/server/detect.ts
 function readJson(file) {
 	try {
@@ -262,7 +264,9 @@ async function loadConfig(root) {
 			share: {
 				branding: user.share?.branding !== false,
 				name: typeof user.share?.name === "string" ? user.share.name : void 0,
-				logo: typeof user.share?.logo === "string" ? user.share.logo : void 0
+				logo: typeof user.share?.logo === "string" ? user.share.logo : void 0,
+				frontDoor: user.share?.frontDoor !== false && user.share?.front_door !== false,
+				notify: user.share?.notify !== false
 			},
 			...jamFields(user.jam)
 		};
@@ -366,4 +370,232 @@ function validViewports(v) {
 	return Object.keys(out).length ? out : null;
 }
 //#endregion
-export { readJson as a, detectHost as i, loadConfig as n, detectAgent as r, DEFAULTS as t };
+//#region src/server/manifest.ts
+const FRAME_EXT = /\.(tsx|jsx|html)$/;
+const RESERVED_SCENES = /* @__PURE__ */ new Set(["components", "screens"]);
+/** Extract `export const meta = {...}` with literal string values only. Anything else is silently omitted. */
+function extractMeta(src) {
+	const m = /export\s+const\s+meta\s*=\s*\{([\s\S]*?)\}/.exec(src);
+	if (!m) return {};
+	const body = m[1];
+	const pick = (key) => {
+		const r = new RegExp(`(?:^|[{,])\\s*${key}\\s*:\\s*(['"\`])([^'"\`]*)\\1`).exec(body);
+		return r ? r[2] : void 0;
+	};
+	const out = {};
+	const title = pick("title");
+	if (title) out.title = title;
+	const viewport = pick("viewport");
+	if (viewport) out.viewport = viewport;
+	const theme = pick("theme");
+	if (theme) out.theme = theme;
+	const of = pick("of");
+	if (of) out.of = of;
+	const variant = pick("variant");
+	if (variant) out.variant = variant;
+	const intent = pick("intent");
+	if (intent) out.intent = intent;
+	return out;
+}
+/** Content-frame detection: LEXICAL by convention - the frame file
+*  itself imports PKG/content (an import specifier scan, so "<Diagram" inside a
+*  string in a UI frame can never misbadge it; barrels/re-exports are not
+*  detected - meta.intent is the taught path and always works). Returns the
+*  inferred intent + natural width, or null for UI frames. */
+const CONTENT_IMPORT = new RegExp(`from\\s+['"]${PKG}/content['"]`);
+const WIDE_DOC = /<Doc\b[^>]*\blayout\s*=\s*["']wide["']/;
+const contentWidthOf = (src) => WIDE_DOC.test(src) ? CONTENT_WIDTH.wide : CONTENT_WIDTH.document;
+function contentScan(src) {
+	if (!CONTENT_IMPORT.test(src)) return null;
+	const count = (re) => (src.match(re) ?? []).length;
+	const diagrams = count(/<Diagram[\s>/]/g);
+	const imgs = count(/<Img[\s>/]/g);
+	const mds = count(/<Md[\s>/]/g);
+	return {
+		intent: diagrams > 0 ? "diagram" : imgs > mds ? "moodboard" : "spec",
+		width: contentWidthOf(src)
+	};
+}
+/** id = path relative to design/, extension dropped, `scenes/` prefix dropped. Always `/`-separated. */
+function toFrameId(designRelPath) {
+	const noExt = designRelPath.split(sep).join("/").replace(FRAME_EXT, "");
+	return noExt.startsWith("scenes/") ? noExt.slice(7) : noExt;
+}
+/**
+* A7: which frames does a changed `design/**` file affect? Manifest + directory conventions,
+* NOT a module-graph walk (deterministic, cheap, may over-reload but never misses a
+* conventionally-affected frame). Returns:
+*   null  -> uncontrolled: leave to default Vite HMR (src/** deps, theme.css, config, assets)
+*   []    -> controlled but affects no current frame (e.g. a layout in an empty dir)
+*   [ids] -> controlled: the shell drives a rev-stamped reload of these frames
+*/
+function affectedFrameIds(absFile, root, manifest) {
+	const design = join(root, "design");
+	if (absFile !== design && !absFile.startsWith(design + sep)) return null;
+	const rel = relative(design, absFile).split(sep).join("/");
+	const name = rel.split("/").pop() ?? rel;
+	const designRel = `design/${rel}`;
+	const tsxFrames = manifest.frames.filter((f) => f.kind === "tsx");
+	if (name === "theme.css") return null;
+	if (rel === "providers.tsx" || rel === "providers.jsx") return tsxFrames.map((f) => f.id);
+	if (/(^|\/)(_layout\.(tsx|jsx)|_fixtures\.(ts|tsx|js|jsx|json))$/.test(rel)) {
+		const prefix = `design/${rel.slice(0, rel.length - name.length)}`;
+		return tsxFrames.filter((f) => f.file.startsWith(prefix)).map((f) => f.id);
+	}
+	const direct = manifest.frames.find((f) => f.file === designRel);
+	if (direct) return [direct.id];
+	return null;
+}
+function walk(dir, out = []) {
+	if (!existsSync(dir)) return out;
+	for (const e of readdirSync(dir, { withFileTypes: true })) {
+		if (e.name.startsWith(".")) continue;
+		const p = join(dir, e.name);
+		if (e.isDirectory()) walk(p, out);
+		else out.push(p);
+	}
+	return out;
+}
+function scanFrames(root) {
+	const design = join(root, "design");
+	const frames = [];
+	for (const base of ["scenes", "components"]) for (const abs of walk(join(design, base))) {
+		const name = abs.split(sep).pop();
+		if (name.startsWith("_") || !FRAME_EXT.test(name)) continue;
+		const rel = relative(design, abs).split(sep).join("/");
+		const id = toFrameId(rel);
+		const scene = id.includes("/") ? id.split("/")[0] : "";
+		if (base === "scenes" && RESERVED_SCENES.has(scene)) {
+			console.error(`[marver] scene "${scene}" is a reserved name - "${rel}" skipped. Rename the scene.`);
+			continue;
+		}
+		const kind = name.endsWith(".html") ? "html" : "tsx";
+		const entry = {
+			id,
+			file: `design/${rel}`,
+			kind,
+			scene
+		};
+		if (kind === "tsx") {
+			const src = readFileSync(abs, "utf8");
+			const meta = extractMeta(src);
+			if (meta.title) entry.title = meta.title;
+			if (meta.viewport) entry.viewport = meta.viewport;
+			if (meta.theme) entry.theme = meta.theme;
+			if (meta.of) entry.variantGroup = meta.of;
+			if (meta.variant) entry.variant = meta.variant;
+			const content = contentScan(src);
+			if (content || meta.intent) {
+				entry.intent = meta.intent ?? content.intent;
+				entry.contentWidth = content?.width ?? contentWidthOf(src);
+			}
+		}
+		frames.push(entry);
+	}
+	const extRank = (file) => file.endsWith(".tsx") ? 0 : file.endsWith(".jsx") ? 1 : 2;
+	frames.sort((a, b) => a.id.localeCompare(b.id) || extRank(a.file) - extRank(b.file) || a.file.localeCompare(b.file));
+	const seen = /* @__PURE__ */ new Map();
+	const deduped = frames.filter((f) => {
+		const prev = seen.get(f.id);
+		if (prev) {
+			console.error(`[marver] duplicate frame id "${f.id}" (${prev} vs ${f.file}) - keeping ${prev}.`);
+			return false;
+		}
+		seen.set(f.id, f.file);
+		return true;
+	});
+	frames.length = 0;
+	frames.push(...deduped);
+	inferVariantGroups(frames);
+	const sceneCounts = /* @__PURE__ */ new Map();
+	for (const f of frames) sceneCounts.set(f.scene, (sceneCounts.get(f.scene) ?? 0) + 1);
+	return {
+		frames,
+		scenes: [...sceneCounts.entries()].map(([name, n]) => ({
+			name,
+			frames: n
+		})).sort((a, b) => a.name.localeCompare(b.name))
+	};
+}
+/** Variant groups. A group = 2+ frames in one DIRECTORY whose basenames
+*  are letter-prefixed (`a-terminal`), or frames declaring `meta.of`. Group id = the
+*  directory's id prefix (or meta.of); variant key = the letter (or meta.variant).
+*  Nested directories scope alternatives inside a busy scene (checkout/payment/a-card).
+*  States (empty.tsx, error.tsx) never letter-prefix, so they never misgroup.
+*  Mutates entries in place: only frames whose group materializes keep the fields. */
+function inferVariantGroups(frames) {
+	const dirOf = (id) => {
+		const i = id.lastIndexOf("/");
+		return i >= 0 ? id.slice(0, i) : "";
+	};
+	const candidates = /* @__PURE__ */ new Map();
+	for (const f of frames) {
+		if (f.kind !== "tsx") {
+			delete f.variantGroup;
+			delete f.variant;
+			continue;
+		}
+		let group = f.variantGroup;
+		let key = f.variant;
+		if (!group) {
+			const base = f.id.slice(f.id.lastIndexOf("/") + 1);
+			const m = /^([a-z])-.+$/.exec(base);
+			if (!m) continue;
+			group = dirOf(f.id);
+			if (!group) continue;
+			key = key ?? m[1];
+		} else if (!key) {
+			const m = /^([a-z])-.+$/.exec(f.id.slice(f.id.lastIndexOf("/") + 1));
+			if (!m) {
+				console.warn(`[marver] ${f.file} declares of:"${group}" but no variant key (add meta.variant or a letter prefix) - not grouped.`);
+				delete f.variantGroup;
+				delete f.variant;
+				continue;
+			}
+			key = m[1];
+		}
+		f.variantGroup = group;
+		f.variant = key;
+		candidates.set(group, [...candidates.get(group) ?? [], f]);
+	}
+	for (const [group, members] of candidates) {
+		if (new Set(members.map((m) => dirOf(m.id))).size > 1) {
+			console.warn(`[marver] group "${group}" spans directories - variants must be siblings; not grouped.`);
+			for (const m of members) {
+				delete m.variantGroup;
+				delete m.variant;
+			}
+			continue;
+		}
+		const seen = /* @__PURE__ */ new Set();
+		const kept = [];
+		for (const m of members.sort((a, b) => (a.variant ?? "").localeCompare(b.variant ?? ""))) {
+			if (seen.has(m.variant)) {
+				console.warn(`[marver] duplicate variant "${m.variant}" in group "${group}" (${m.file}) - not grouped.`);
+				delete m.variantGroup;
+				delete m.variant;
+				continue;
+			}
+			seen.add(m.variant);
+			kept.push(m);
+		}
+		if (kept.length < 2) for (const m of kept) {
+			delete m.variantGroup;
+			delete m.variant;
+		}
+	}
+	for (const f of frames) if (f.variant && !f.variantGroup) delete f.variant;
+}
+/** Write design/manifest.json only when content changed. Returns the manifest either way. */
+function writeManifest(root, manifest) {
+	const file = join(root, "design", "manifest.json");
+	const next = JSON.stringify(manifest, null, 2) + "\n";
+	const prev = existsSync(file) ? readFileSync(file, "utf8") : "";
+	if (hash(prev) === hash(next)) return false;
+	mkdirSync(join(root, "design"), { recursive: true });
+	writeFileSync(file, next);
+	return true;
+}
+const hash = (s) => createHash("sha256").update(s).digest("hex");
+//#endregion
+export { writeManifest as a, detectAgent as c, toFrameId as i, detectHost as l, hash as n, DEFAULTS as o, scanFrames as r, loadConfig as s, affectedFrameIds as t, readJson as u };

package/dist/{marver-id-B8-3WiHk.mjs → marver-id-CVCoaMGI.mjs}

@@ -365,6 +365,111 @@ async function verifySignature(parts, kid, issuer) {
 	}, signature);
 }
 /**
+* Verify a short-lived bearer JWT the identity service minted for a NON-gate
+* purpose (the front door's summary token, 04-solution §9.1). Same trust root
+* and JWKS as the assertion path, but a distinct `typ` - so neither token can
+* ever be replayed at the other door - and no nonce: the token is not a
+* sign-in, it is a capability that expires in seconds.
+*/
+async function verifyBearerJwt(opts) {
+	const { token, origin, issuer, typ } = opts;
+	if (!token || token.length > MAX_TOKEN_BYTES) return {
+		ok: false,
+		reason: "token size"
+	};
+	const parts = token.split(".");
+	if (parts.length !== 3) return {
+		ok: false,
+		reason: "not a jws"
+	};
+	let header;
+	let claims;
+	try {
+		const h = JSON.parse(Buffer.from(parts[0], "base64url").toString("utf8"));
+		const c = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+		if (!isPlainObject(h) || !isPlainObject(c)) return {
+			ok: false,
+			reason: "malformed json"
+		};
+		header = h;
+		claims = c;
+	} catch {
+		return {
+			ok: false,
+			reason: "malformed json"
+		};
+	}
+	if (header.alg !== "ES256") return {
+		ok: false,
+		reason: "alg"
+	};
+	if (header.typ !== typ) return {
+		ok: false,
+		reason: "typ"
+	};
+	if ("jku" in header || "x5u" in header || "jwk" in header) return {
+		ok: false,
+		reason: "header injection"
+	};
+	const kid = typeof header.kid === "string" ? header.kid : null;
+	if (!kid || kid.length > 128) return {
+		ok: false,
+		reason: "kid"
+	};
+	if (claims.iss !== issuer) return {
+		ok: false,
+		reason: "iss"
+	};
+	if (claims.aud !== origin) return {
+		ok: false,
+		reason: "aud"
+	};
+	if (opts.azp && claims.azp !== opts.azp) return {
+		ok: false,
+		reason: "azp"
+	};
+	const sub = typeof claims.sub === "string" ? claims.sub : "";
+	const email = typeof claims.email === "string" ? claims.email : "";
+	if (!sub || !email) return {
+		ok: false,
+		reason: "missing claims"
+	};
+	const now = Math.floor(Date.now() / 1e3);
+	const exp = typeof claims.exp === "number" ? claims.exp : 0;
+	const iat = typeof claims.iat === "number" ? claims.iat : 0;
+	if (!exp || exp + CLOCK_TOLERANCE_S < now) return {
+		ok: false,
+		reason: "expired"
+	};
+	if (!iat || iat - CLOCK_TOLERANCE_S > now) return {
+		ok: false,
+		reason: "issued in the future"
+	};
+	if (opts.maxAgeS && exp - iat > opts.maxAgeS) return {
+		ok: false,
+		reason: "lifetime"
+	};
+	let verified = false;
+	try {
+		verified = await verifySignature(parts, kid, issuer);
+	} catch {
+		return {
+			ok: false,
+			reason: "key fetch failed"
+		};
+	}
+	if (!verified) return {
+		ok: false,
+		reason: "signature"
+	};
+	return {
+		ok: true,
+		sub,
+		email,
+		claims
+	};
+}
+/**
 * The optional display claims, taken only if they are the right shape.
 *
 * Deliberately forgiving: a malformed name or picture drops that ONE field and
@@ -408,4 +513,4 @@ function browserBinding(cookieValue) {
 	return createHash("sha256").update(cookieValue).digest("base64url");
 }
 //#endregion
-export { TransactionStore, browserBinding, normalizeIssuer, verifyAssertion };
+export { TransactionStore, browserBinding, normalizeIssuer, verifyAssertion, verifyBearerJwt };