@sneekin/sdk 1.0.0 → 1.1.1

package/dist/index.cjs

@@ -24,10 +24,37 @@ __export(src_exports, {
   SneekApiError: () => SneekApiError,
   SneekClient: () => SneekClient,
   SneekPayClient: () => SneekPayClient,
-  deriveKeys: () => deriveKeys
+  deriveKeys: () => deriveKeys,
+  isValidApiKey: () => isValidApiKey
 });
 module.exports = __toCommonJS(src_exports);
 
+// src/core/derive-keys.ts
+var import_node_crypto = require("crypto");
+var KEY_LABELS = {
+  qrSigningKey: "sneek-qr-v1",
+  webhookSigningKey: "sneek-webhook-v1",
+  proofKey: "sneek-proof-v1"
+};
+var API_KEY_PATTERN = /^sneek_[A-Za-z0-9_-]{43}$/;
+function isValidApiKey(apiKey) {
+  return API_KEY_PATTERN.test(apiKey);
+}
+function deriveKeys(apiKey) {
+  if (typeof apiKey !== "string" || !isValidApiKey(apiKey)) {
+    throw new TypeError("apiKey must use the sneek_ format with a 43-character secret");
+  }
+  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
+  const derive = (label) => Buffer.from(
+    (0, import_node_crypto.hkdfSync)("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
+  );
+  return {
+    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
+    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
+    proofKey: derive(KEY_LABELS.proofKey)
+  };
+}
+
 // src/core/client.ts
 var SneekApiError = class extends Error {
   constructor(status, type, title, detail) {
@@ -52,6 +79,7 @@ var SneekClient = class {
   constructor(options) {
     if (!options.apiUrl) throw new Error("apiUrl is required");
     if (!options.apiKey) throw new Error("apiKey is required");
+    if (!isValidApiKey(options.apiKey)) throw new Error("apiKey must use the sneek_ format with a 43-character secret");
     this.apiUrl = options.apiUrl.replace(/\/+$/, "");
     this.apiKey = options.apiKey;
     this.fetchImpl = options.fetch ?? fetch;
@@ -123,28 +151,6 @@ function asProblem(value) {
   };
 }
 
-// src/core/derive-keys.ts
-var import_node_crypto = require("crypto");
-var KEY_LABELS = {
-  qrSigningKey: "sneek-qr-v1",
-  webhookSigningKey: "sneek-webhook-v1",
-  proofKey: "sneek-proof-v1"
-};
-function deriveKeys(apiKey) {
-  if (typeof apiKey !== "string" || apiKey.length === 0) {
-    throw new TypeError("apiKey must be a nonempty string");
-  }
-  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
-  const derive = (label) => Buffer.from(
-    (0, import_node_crypto.hkdfSync)("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
-  );
-  return {
-    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
-    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
-    proofKey: derive(KEY_LABELS.proofKey)
-  };
-}
-
 // src/pay/payments.ts
 var SneekPayClient = class {
   client;
@@ -219,5 +225,6 @@ var OrdersClient = class {
   SneekApiError,
   SneekClient,
   SneekPayClient,
-  deriveKeys
+  deriveKeys,
+  isValidApiKey
 });

package/dist/index.js

@@ -1,3 +1,29 @@
+// src/core/derive-keys.ts
+import { hkdfSync } from "crypto";
+var KEY_LABELS = {
+  qrSigningKey: "sneek-qr-v1",
+  webhookSigningKey: "sneek-webhook-v1",
+  proofKey: "sneek-proof-v1"
+};
+var API_KEY_PATTERN = /^sneek_[A-Za-z0-9_-]{43}$/;
+function isValidApiKey(apiKey) {
+  return API_KEY_PATTERN.test(apiKey);
+}
+function deriveKeys(apiKey) {
+  if (typeof apiKey !== "string" || !isValidApiKey(apiKey)) {
+    throw new TypeError("apiKey must use the sneek_ format with a 43-character secret");
+  }
+  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
+  const derive = (label) => Buffer.from(
+    hkdfSync("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
+  );
+  return {
+    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
+    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
+    proofKey: derive(KEY_LABELS.proofKey)
+  };
+}
+
 // src/core/client.ts
 var SneekApiError = class extends Error {
   constructor(status, type, title, detail) {
@@ -22,6 +48,7 @@ var SneekClient = class {
   constructor(options) {
     if (!options.apiUrl) throw new Error("apiUrl is required");
     if (!options.apiKey) throw new Error("apiKey is required");
+    if (!isValidApiKey(options.apiKey)) throw new Error("apiKey must use the sneek_ format with a 43-character secret");
     this.apiUrl = options.apiUrl.replace(/\/+$/, "");
     this.apiKey = options.apiKey;
     this.fetchImpl = options.fetch ?? fetch;
@@ -93,28 +120,6 @@ function asProblem(value) {
   };
 }
 
-// src/core/derive-keys.ts
-import { hkdfSync } from "crypto";
-var KEY_LABELS = {
-  qrSigningKey: "sneek-qr-v1",
-  webhookSigningKey: "sneek-webhook-v1",
-  proofKey: "sneek-proof-v1"
-};
-function deriveKeys(apiKey) {
-  if (typeof apiKey !== "string" || apiKey.length === 0) {
-    throw new TypeError("apiKey must be a nonempty string");
-  }
-  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
-  const derive = (label) => Buffer.from(
-    hkdfSync("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
-  );
-  return {
-    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
-    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
-    proofKey: derive(KEY_LABELS.proofKey)
-  };
-}
-
 // src/pay/payments.ts
 var SneekPayClient = class {
   client;
@@ -188,5 +193,6 @@ export {
   SneekApiError,
   SneekClient,
   SneekPayClient,
-  deriveKeys
+  deriveKeys,
+  isValidApiKey
 };

package/dist/messages/client.d.ts

@@ -0,0 +1,15 @@
+import type { GetMessageResponse, SendMessage, SendMessageResponse } from '../core/generated/api.js';
+import { SneekApiError, type SneekClientOptions } from '../core/index.js';
+export type SneekMessagesClientOptions = SneekClientOptions;
+export interface SendMessageOptions {
+    idempotencyKey?: string;
+}
+/** Typed access to the Sneek message send and delivery-status APIs. */
+export declare class SneekMessagesClient {
+    private readonly client;
+    constructor(options: SneekMessagesClientOptions);
+    send(input: SendMessage, options?: SendMessageOptions): Promise<SendMessageResponse>;
+    get(id: string): Promise<GetMessageResponse>;
+}
+export { SneekApiError };
+export default SneekMessagesClient;

package/dist/messages/index.cjs

@@ -22,10 +22,38 @@ var messages_exports = {};
 __export(messages_exports, {
   SneekApiError: () => SneekApiError,
   SneekClient: () => SneekClient,
-  deriveKeys: () => deriveKeys
+  SneekMessagesClient: () => SneekMessagesClient,
+  deriveKeys: () => deriveKeys,
+  isValidApiKey: () => isValidApiKey
 });
 module.exports = __toCommonJS(messages_exports);
 
+// src/core/derive-keys.ts
+var import_node_crypto = require("crypto");
+var KEY_LABELS = {
+  qrSigningKey: "sneek-qr-v1",
+  webhookSigningKey: "sneek-webhook-v1",
+  proofKey: "sneek-proof-v1"
+};
+var API_KEY_PATTERN = /^sneek_[A-Za-z0-9_-]{43}$/;
+function isValidApiKey(apiKey) {
+  return API_KEY_PATTERN.test(apiKey);
+}
+function deriveKeys(apiKey) {
+  if (typeof apiKey !== "string" || !isValidApiKey(apiKey)) {
+    throw new TypeError("apiKey must use the sneek_ format with a 43-character secret");
+  }
+  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
+  const derive = (label) => Buffer.from(
+    (0, import_node_crypto.hkdfSync)("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
+  );
+  return {
+    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
+    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
+    proofKey: derive(KEY_LABELS.proofKey)
+  };
+}
+
 // src/core/client.ts
 var SneekApiError = class extends Error {
   constructor(status, type, title, detail) {
@@ -50,6 +78,7 @@ var SneekClient = class {
   constructor(options) {
     if (!options.apiUrl) throw new Error("apiUrl is required");
     if (!options.apiKey) throw new Error("apiKey is required");
+    if (!isValidApiKey(options.apiKey)) throw new Error("apiKey must use the sneek_ format with a 43-character secret");
     this.apiUrl = options.apiUrl.replace(/\/+$/, "");
     this.apiKey = options.apiKey;
     this.fetchImpl = options.fetch ?? fetch;
@@ -121,30 +150,28 @@ function asProblem(value) {
   };
 }
 
-// src/core/derive-keys.ts
-var import_node_crypto = require("crypto");
-var KEY_LABELS = {
-  qrSigningKey: "sneek-qr-v1",
-  webhookSigningKey: "sneek-webhook-v1",
-  proofKey: "sneek-proof-v1"
-};
-function deriveKeys(apiKey) {
-  if (typeof apiKey !== "string" || apiKey.length === 0) {
-    throw new TypeError("apiKey must be a nonempty string");
+// src/messages/client.ts
+var SneekMessagesClient = class {
+  client;
+  constructor(options) {
+    this.client = new SneekClient(options);
   }
-  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
-  const derive = (label) => Buffer.from(
-    (0, import_node_crypto.hkdfSync)("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
-  );
-  return {
-    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
-    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
-    proofKey: derive(KEY_LABELS.proofKey)
-  };
-}
+  send(input, options = {}) {
+    const headers = options.idempotencyKey ? { "Idempotency-Key": options.idempotencyKey } : void 0;
+    return this.client.request("POST", "/api/messages/send", input, headers);
+  }
+  get(id) {
+    return this.client.request(
+      "GET",
+      `/api/messages/${encodeURIComponent(id)}`
+    );
+  }
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   SneekApiError,
   SneekClient,
-  deriveKeys
+  SneekMessagesClient,
+  deriveKeys,
+  isValidApiKey
 });

package/dist/messages/index.d.ts

@@ -1 +1,2 @@
 export * from '../core/index.js';
+export * from './client.js';

package/dist/messages/index.js

@@ -1,3 +1,29 @@
+// src/core/derive-keys.ts
+import { hkdfSync } from "crypto";
+var KEY_LABELS = {
+  qrSigningKey: "sneek-qr-v1",
+  webhookSigningKey: "sneek-webhook-v1",
+  proofKey: "sneek-proof-v1"
+};
+var API_KEY_PATTERN = /^sneek_[A-Za-z0-9_-]{43}$/;
+function isValidApiKey(apiKey) {
+  return API_KEY_PATTERN.test(apiKey);
+}
+function deriveKeys(apiKey) {
+  if (typeof apiKey !== "string" || !isValidApiKey(apiKey)) {
+    throw new TypeError("apiKey must use the sneek_ format with a 43-character secret");
+  }
+  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
+  const derive = (label) => Buffer.from(
+    hkdfSync("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
+  );
+  return {
+    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
+    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
+    proofKey: derive(KEY_LABELS.proofKey)
+  };
+}
+
 // src/core/client.ts
 var SneekApiError = class extends Error {
   constructor(status, type, title, detail) {
@@ -22,6 +48,7 @@ var SneekClient = class {
   constructor(options) {
     if (!options.apiUrl) throw new Error("apiUrl is required");
     if (!options.apiKey) throw new Error("apiKey is required");
+    if (!isValidApiKey(options.apiKey)) throw new Error("apiKey must use the sneek_ format with a 43-character secret");
     this.apiUrl = options.apiUrl.replace(/\/+$/, "");
     this.apiKey = options.apiKey;
     this.fetchImpl = options.fetch ?? fetch;
@@ -93,29 +120,27 @@ function asProblem(value) {
   };
 }
 
-// src/core/derive-keys.ts
-import { hkdfSync } from "crypto";
-var KEY_LABELS = {
-  qrSigningKey: "sneek-qr-v1",
-  webhookSigningKey: "sneek-webhook-v1",
-  proofKey: "sneek-proof-v1"
-};
-function deriveKeys(apiKey) {
-  if (typeof apiKey !== "string" || apiKey.length === 0) {
-    throw new TypeError("apiKey must be a nonempty string");
+// src/messages/client.ts
+var SneekMessagesClient = class {
+  client;
+  constructor(options) {
+    this.client = new SneekClient(options);
   }
-  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
-  const derive = (label) => Buffer.from(
-    hkdfSync("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
-  );
-  return {
-    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
-    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
-    proofKey: derive(KEY_LABELS.proofKey)
-  };
-}
+  send(input, options = {}) {
+    const headers = options.idempotencyKey ? { "Idempotency-Key": options.idempotencyKey } : void 0;
+    return this.client.request("POST", "/api/messages/send", input, headers);
+  }
+  get(id) {
+    return this.client.request(
+      "GET",
+      `/api/messages/${encodeURIComponent(id)}`
+    );
+  }
+};
 export {
   SneekApiError,
   SneekClient,
-  deriveKeys
+  SneekMessagesClient,
+  deriveKeys,
+  isValidApiKey
 };

package/dist/pay/index.cjs

@@ -24,10 +24,37 @@ __export(pay_exports, {
   SneekApiError: () => SneekApiError,
   SneekClient: () => SneekClient,
   SneekPayClient: () => SneekPayClient,
-  deriveKeys: () => deriveKeys
+  deriveKeys: () => deriveKeys,
+  isValidApiKey: () => isValidApiKey
 });
 module.exports = __toCommonJS(pay_exports);
 
+// src/core/derive-keys.ts
+var import_node_crypto = require("crypto");
+var KEY_LABELS = {
+  qrSigningKey: "sneek-qr-v1",
+  webhookSigningKey: "sneek-webhook-v1",
+  proofKey: "sneek-proof-v1"
+};
+var API_KEY_PATTERN = /^sneek_[A-Za-z0-9_-]{43}$/;
+function isValidApiKey(apiKey) {
+  return API_KEY_PATTERN.test(apiKey);
+}
+function deriveKeys(apiKey) {
+  if (typeof apiKey !== "string" || !isValidApiKey(apiKey)) {
+    throw new TypeError("apiKey must use the sneek_ format with a 43-character secret");
+  }
+  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
+  const derive = (label) => Buffer.from(
+    (0, import_node_crypto.hkdfSync)("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
+  );
+  return {
+    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
+    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
+    proofKey: derive(KEY_LABELS.proofKey)
+  };
+}
+
 // src/core/client.ts
 var SneekApiError = class extends Error {
   constructor(status, type, title, detail) {
@@ -52,6 +79,7 @@ var SneekClient = class {
   constructor(options) {
     if (!options.apiUrl) throw new Error("apiUrl is required");
     if (!options.apiKey) throw new Error("apiKey is required");
+    if (!isValidApiKey(options.apiKey)) throw new Error("apiKey must use the sneek_ format with a 43-character secret");
     this.apiUrl = options.apiUrl.replace(/\/+$/, "");
     this.apiKey = options.apiKey;
     this.fetchImpl = options.fetch ?? fetch;
@@ -123,28 +151,6 @@ function asProblem(value) {
   };
 }
 
-// src/core/derive-keys.ts
-var import_node_crypto = require("crypto");
-var KEY_LABELS = {
-  qrSigningKey: "sneek-qr-v1",
-  webhookSigningKey: "sneek-webhook-v1",
-  proofKey: "sneek-proof-v1"
-};
-function deriveKeys(apiKey) {
-  if (typeof apiKey !== "string" || apiKey.length === 0) {
-    throw new TypeError("apiKey must be a nonempty string");
-  }
-  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
-  const derive = (label) => Buffer.from(
-    (0, import_node_crypto.hkdfSync)("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
-  );
-  return {
-    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
-    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
-    proofKey: derive(KEY_LABELS.proofKey)
-  };
-}
-
 // src/pay/payments.ts
 var SneekPayClient = class {
   client;
@@ -219,5 +225,6 @@ var OrdersClient = class {
   SneekApiError,
   SneekClient,
   SneekPayClient,
-  deriveKeys
+  deriveKeys,
+  isValidApiKey
 });

package/dist/pay/index.js

@@ -1,3 +1,29 @@
+// src/core/derive-keys.ts
+import { hkdfSync } from "crypto";
+var KEY_LABELS = {
+  qrSigningKey: "sneek-qr-v1",
+  webhookSigningKey: "sneek-webhook-v1",
+  proofKey: "sneek-proof-v1"
+};
+var API_KEY_PATTERN = /^sneek_[A-Za-z0-9_-]{43}$/;
+function isValidApiKey(apiKey) {
+  return API_KEY_PATTERN.test(apiKey);
+}
+function deriveKeys(apiKey) {
+  if (typeof apiKey !== "string" || !isValidApiKey(apiKey)) {
+    throw new TypeError("apiKey must use the sneek_ format with a 43-character secret");
+  }
+  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
+  const derive = (label) => Buffer.from(
+    hkdfSync("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
+  );
+  return {
+    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
+    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
+    proofKey: derive(KEY_LABELS.proofKey)
+  };
+}
+
 // src/core/client.ts
 var SneekApiError = class extends Error {
   constructor(status, type, title, detail) {
@@ -22,6 +48,7 @@ var SneekClient = class {
   constructor(options) {
     if (!options.apiUrl) throw new Error("apiUrl is required");
     if (!options.apiKey) throw new Error("apiKey is required");
+    if (!isValidApiKey(options.apiKey)) throw new Error("apiKey must use the sneek_ format with a 43-character secret");
     this.apiUrl = options.apiUrl.replace(/\/+$/, "");
     this.apiKey = options.apiKey;
     this.fetchImpl = options.fetch ?? fetch;
@@ -93,28 +120,6 @@ function asProblem(value) {
   };
 }
 
-// src/core/derive-keys.ts
-import { hkdfSync } from "crypto";
-var KEY_LABELS = {
-  qrSigningKey: "sneek-qr-v1",
-  webhookSigningKey: "sneek-webhook-v1",
-  proofKey: "sneek-proof-v1"
-};
-function deriveKeys(apiKey) {
-  if (typeof apiKey !== "string" || apiKey.length === 0) {
-    throw new TypeError("apiKey must be a nonempty string");
-  }
-  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
-  const derive = (label) => Buffer.from(
-    hkdfSync("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
-  );
-  return {
-    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
-    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
-    proofKey: derive(KEY_LABELS.proofKey)
-  };
-}
-
 // src/pay/payments.ts
 var SneekPayClient = class {
   client;
@@ -188,5 +193,6 @@ export {
   SneekApiError,
   SneekClient,
   SneekPayClient,
-  deriveKeys
+  deriveKeys,
+  isValidApiKey
 };

package/dist/verify/approval-store.d.ts

@@ -0,0 +1,22 @@
+export interface SneekQrSession {
+    ref: string;
+    applicationId: string;
+    origin: string;
+    bindingProofHash: string;
+    expiresAt: number;
+    requestId?: string;
+}
+export interface SneekQrApprovalEvent {
+    type: 'qr.approved';
+    applicationId: string;
+    ref: string;
+    requestId: string;
+}
+export interface SneekApprovalStore {
+    createQrSession(session: SneekQrSession): Promise<void>;
+    /** Atomically attach only the first matching approval to a live QR session. */
+    recordQrApproval(event: SneekQrApprovalEvent, now: number): Promise<'recorded' | 'duplicate' | 'missing'>;
+    readQrSession(ref: string): Promise<SneekQrSession | null>;
+    /** Atomically claim a token jti until its exp time; false means replay. */
+    claimJti(jti: string, expiresAt: number): Promise<boolean>;
+}

package/dist/verify/auth-schema.d.ts

@@ -0,0 +1,97 @@
+import { z } from 'zod';
+export declare const QrWebhookEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"qr.approved">;
+    applicationId: z.ZodString;
+    ref: z.ZodString;
+    requestId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    type: "qr.approved";
+    requestId: string;
+    ref: string;
+    applicationId: string;
+}, {
+    type: "qr.approved";
+    requestId: string;
+    ref: string;
+    applicationId: string;
+}>;
+export declare const SneekVerifyActionSchema: z.ZodUnion<[z.ZodObject<{
+    action: z.ZodLiteral<"config">;
+}, "strict", z.ZodTypeAny, {
+    action: "config";
+}, {
+    action: "config";
+}>, z.ZodObject<{
+    action: z.ZodLiteral<"request">;
+    identifier: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    action: "request";
+    identifier: string;
+}, {
+    action: "request";
+    identifier: string;
+}>, z.ZodObject<{
+    action: z.ZodLiteral<"switch">;
+    requestId: z.ZodString;
+    channel: z.ZodEnum<["sms", "whatsapp", "email", "push"]>;
+    proof: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    action: "switch";
+    requestId: string;
+    channel: "sms" | "whatsapp" | "email" | "push";
+    proof: string;
+}, {
+    action: "switch";
+    requestId: string;
+    channel: "sms" | "whatsapp" | "email" | "push";
+    proof: string;
+}>, z.ZodObject<{
+    action: z.ZodLiteral<"verify">;
+    requestId: z.ZodString;
+    code: z.ZodOptional<z.ZodString>;
+    proof: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    action: "verify";
+    requestId: string;
+    proof: string;
+    code?: string | undefined;
+}, {
+    action: "verify";
+    requestId: string;
+    proof: string;
+    code?: string | undefined;
+}>, z.ZodObject<{
+    action: z.ZodLiteral<"verify">;
+    requestId: z.ZodString;
+    ref: z.ZodString;
+    bindingProof: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    action: "verify";
+    requestId: string;
+    ref: string;
+    bindingProof: string;
+}, {
+    action: "verify";
+    requestId: string;
+    ref: string;
+    bindingProof: string;
+}>, z.ZodObject<{
+    action: z.ZodLiteral<"create">;
+}, "strict", z.ZodTypeAny, {
+    action: "create";
+}, {
+    action: "create";
+}>, z.ZodObject<{
+    action: z.ZodLiteral<"status">;
+    ref: z.ZodString;
+    bindingProof: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    action: "status";
+    ref: string;
+    bindingProof: string;
+}, {
+    action: "status";
+    ref: string;
+    bindingProof: string;
+}>]>;
+export type SneekVerifyAction = z.infer<typeof SneekVerifyActionSchema>;

package/dist/verify/handler.d.ts

@@ -0,0 +1,41 @@
+import type { SneekApprovalStore } from './approval-store.js';
+export interface SneekVerifyHandlerOptions {
+    apiUrl: string;
+    apiKey: string;
+    allowedOrigins: string[];
+    approvalStore: SneekApprovalStore;
+    onVerified: (result: {
+        identifier: string;
+        kind: 'email' | 'mobile';
+        method: string;
+        verifiedAt: string;
+        requestId: string;
+    }) => void | Promise<void>;
+    fetch?: typeof fetch;
+}
+export declare class SneekVerifyHandler {
+    private readonly client;
+    private readonly allowedOrigins;
+    private readonly keys;
+    private readonly approvalStore;
+    private readonly onVerified;
+    private readonly jwksByIssuer;
+    constructor(options: SneekVerifyHandlerOptions);
+    handle(request: Request): Promise<Response>;
+    handleWebhook(request: Request): Promise<Response>;
+    private getAllowedOrigin;
+    private config;
+    private startVerification;
+    private switchVerification;
+    private verify;
+    private verifiedClaims;
+    private startResponse;
+    private createProof;
+    private isValidProof;
+    private createQr;
+    private qrStatus;
+    private qrSession;
+    private partnerConfig;
+    private isValidWebhookSignature;
+    private hash;
+}