@sneekin/sdk 1.1.0 → 1.1.2

package/dist/index.cjs

@@ -24,10 +24,37 @@ __export(src_exports, {
   SneekApiError: () => SneekApiError,
   SneekClient: () => SneekClient,
   SneekPayClient: () => SneekPayClient,
-  deriveKeys: () => deriveKeys
+  deriveKeys: () => deriveKeys,
+  isValidApiKey: () => isValidApiKey
 });
 module.exports = __toCommonJS(src_exports);
 
+// src/core/derive-keys.ts
+var import_node_crypto = require("crypto");
+var KEY_LABELS = {
+  qrSigningKey: "sneek-qr-v1",
+  webhookSigningKey: "sneek-webhook-v1",
+  proofKey: "sneek-proof-v1"
+};
+var API_KEY_PATTERN = /^sneek_[A-Za-z0-9_-]{43}$/;
+function isValidApiKey(apiKey) {
+  return API_KEY_PATTERN.test(apiKey);
+}
+function deriveKeys(apiKey) {
+  if (typeof apiKey !== "string" || !isValidApiKey(apiKey)) {
+    throw new TypeError("apiKey must use the sneek_ format with a 43-character secret");
+  }
+  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
+  const derive = (label) => Buffer.from(
+    (0, import_node_crypto.hkdfSync)("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
+  );
+  return {
+    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
+    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
+    proofKey: derive(KEY_LABELS.proofKey)
+  };
+}
+
 // src/core/client.ts
 var SneekApiError = class extends Error {
   constructor(status, type, title, detail) {
@@ -52,6 +79,7 @@ var SneekClient = class {
   constructor(options) {
     if (!options.apiUrl) throw new Error("apiUrl is required");
     if (!options.apiKey) throw new Error("apiKey is required");
+    if (!isValidApiKey(options.apiKey)) throw new Error("apiKey must use the sneek_ format with a 43-character secret");
     this.apiUrl = options.apiUrl.replace(/\/+$/, "");
     this.apiKey = options.apiKey;
     this.fetchImpl = options.fetch ?? fetch;
@@ -123,28 +151,6 @@ function asProblem(value) {
   };
 }
 
-// src/core/derive-keys.ts
-var import_node_crypto = require("crypto");
-var KEY_LABELS = {
-  qrSigningKey: "sneek-qr-v1",
-  webhookSigningKey: "sneek-webhook-v1",
-  proofKey: "sneek-proof-v1"
-};
-function deriveKeys(apiKey) {
-  if (typeof apiKey !== "string" || apiKey.length === 0) {
-    throw new TypeError("apiKey must be a nonempty string");
-  }
-  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
-  const derive = (label) => Buffer.from(
-    (0, import_node_crypto.hkdfSync)("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
-  );
-  return {
-    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
-    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
-    proofKey: derive(KEY_LABELS.proofKey)
-  };
-}
-
 // src/pay/payments.ts
 var SneekPayClient = class {
   client;
@@ -219,5 +225,6 @@ var OrdersClient = class {
   SneekApiError,
   SneekClient,
   SneekPayClient,
-  deriveKeys
+  deriveKeys,
+  isValidApiKey
 });

package/dist/index.js

@@ -1,3 +1,29 @@
+// src/core/derive-keys.ts
+import { hkdfSync } from "crypto";
+var KEY_LABELS = {
+  qrSigningKey: "sneek-qr-v1",
+  webhookSigningKey: "sneek-webhook-v1",
+  proofKey: "sneek-proof-v1"
+};
+var API_KEY_PATTERN = /^sneek_[A-Za-z0-9_-]{43}$/;
+function isValidApiKey(apiKey) {
+  return API_KEY_PATTERN.test(apiKey);
+}
+function deriveKeys(apiKey) {
+  if (typeof apiKey !== "string" || !isValidApiKey(apiKey)) {
+    throw new TypeError("apiKey must use the sneek_ format with a 43-character secret");
+  }
+  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
+  const derive = (label) => Buffer.from(
+    hkdfSync("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
+  );
+  return {
+    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
+    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
+    proofKey: derive(KEY_LABELS.proofKey)
+  };
+}
+
 // src/core/client.ts
 var SneekApiError = class extends Error {
   constructor(status, type, title, detail) {
@@ -22,6 +48,7 @@ var SneekClient = class {
   constructor(options) {
     if (!options.apiUrl) throw new Error("apiUrl is required");
     if (!options.apiKey) throw new Error("apiKey is required");
+    if (!isValidApiKey(options.apiKey)) throw new Error("apiKey must use the sneek_ format with a 43-character secret");
     this.apiUrl = options.apiUrl.replace(/\/+$/, "");
     this.apiKey = options.apiKey;
     this.fetchImpl = options.fetch ?? fetch;
@@ -93,28 +120,6 @@ function asProblem(value) {
   };
 }
 
-// src/core/derive-keys.ts
-import { hkdfSync } from "crypto";
-var KEY_LABELS = {
-  qrSigningKey: "sneek-qr-v1",
-  webhookSigningKey: "sneek-webhook-v1",
-  proofKey: "sneek-proof-v1"
-};
-function deriveKeys(apiKey) {
-  if (typeof apiKey !== "string" || apiKey.length === 0) {
-    throw new TypeError("apiKey must be a nonempty string");
-  }
-  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
-  const derive = (label) => Buffer.from(
-    hkdfSync("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
-  );
-  return {
-    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
-    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
-    proofKey: derive(KEY_LABELS.proofKey)
-  };
-}
-
 // src/pay/payments.ts
 var SneekPayClient = class {
   client;
@@ -188,5 +193,6 @@ export {
   SneekApiError,
   SneekClient,
   SneekPayClient,
-  deriveKeys
+  deriveKeys,
+  isValidApiKey
 };

package/dist/messages/index.cjs

@@ -23,10 +23,37 @@ __export(messages_exports, {
   SneekApiError: () => SneekApiError,
   SneekClient: () => SneekClient,
   SneekMessagesClient: () => SneekMessagesClient,
-  deriveKeys: () => deriveKeys
+  deriveKeys: () => deriveKeys,
+  isValidApiKey: () => isValidApiKey
 });
 module.exports = __toCommonJS(messages_exports);
 
+// src/core/derive-keys.ts
+var import_node_crypto = require("crypto");
+var KEY_LABELS = {
+  qrSigningKey: "sneek-qr-v1",
+  webhookSigningKey: "sneek-webhook-v1",
+  proofKey: "sneek-proof-v1"
+};
+var API_KEY_PATTERN = /^sneek_[A-Za-z0-9_-]{43}$/;
+function isValidApiKey(apiKey) {
+  return API_KEY_PATTERN.test(apiKey);
+}
+function deriveKeys(apiKey) {
+  if (typeof apiKey !== "string" || !isValidApiKey(apiKey)) {
+    throw new TypeError("apiKey must use the sneek_ format with a 43-character secret");
+  }
+  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
+  const derive = (label) => Buffer.from(
+    (0, import_node_crypto.hkdfSync)("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
+  );
+  return {
+    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
+    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
+    proofKey: derive(KEY_LABELS.proofKey)
+  };
+}
+
 // src/core/client.ts
 var SneekApiError = class extends Error {
   constructor(status, type, title, detail) {
@@ -51,6 +78,7 @@ var SneekClient = class {
   constructor(options) {
     if (!options.apiUrl) throw new Error("apiUrl is required");
     if (!options.apiKey) throw new Error("apiKey is required");
+    if (!isValidApiKey(options.apiKey)) throw new Error("apiKey must use the sneek_ format with a 43-character secret");
     this.apiUrl = options.apiUrl.replace(/\/+$/, "");
     this.apiKey = options.apiKey;
     this.fetchImpl = options.fetch ?? fetch;
@@ -122,28 +150,6 @@ function asProblem(value) {
   };
 }
 
-// src/core/derive-keys.ts
-var import_node_crypto = require("crypto");
-var KEY_LABELS = {
-  qrSigningKey: "sneek-qr-v1",
-  webhookSigningKey: "sneek-webhook-v1",
-  proofKey: "sneek-proof-v1"
-};
-function deriveKeys(apiKey) {
-  if (typeof apiKey !== "string" || apiKey.length === 0) {
-    throw new TypeError("apiKey must be a nonempty string");
-  }
-  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
-  const derive = (label) => Buffer.from(
-    (0, import_node_crypto.hkdfSync)("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
-  );
-  return {
-    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
-    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
-    proofKey: derive(KEY_LABELS.proofKey)
-  };
-}
-
 // src/messages/client.ts
 var SneekMessagesClient = class {
   client;
@@ -166,5 +172,6 @@ var SneekMessagesClient = class {
   SneekApiError,
   SneekClient,
   SneekMessagesClient,
-  deriveKeys
+  deriveKeys,
+  isValidApiKey
 });

package/dist/messages/index.js

@@ -1,3 +1,29 @@
+// src/core/derive-keys.ts
+import { hkdfSync } from "crypto";
+var KEY_LABELS = {
+  qrSigningKey: "sneek-qr-v1",
+  webhookSigningKey: "sneek-webhook-v1",
+  proofKey: "sneek-proof-v1"
+};
+var API_KEY_PATTERN = /^sneek_[A-Za-z0-9_-]{43}$/;
+function isValidApiKey(apiKey) {
+  return API_KEY_PATTERN.test(apiKey);
+}
+function deriveKeys(apiKey) {
+  if (typeof apiKey !== "string" || !isValidApiKey(apiKey)) {
+    throw new TypeError("apiKey must use the sneek_ format with a 43-character secret");
+  }
+  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
+  const derive = (label) => Buffer.from(
+    hkdfSync("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
+  );
+  return {
+    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
+    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
+    proofKey: derive(KEY_LABELS.proofKey)
+  };
+}
+
 // src/core/client.ts
 var SneekApiError = class extends Error {
   constructor(status, type, title, detail) {
@@ -22,6 +48,7 @@ var SneekClient = class {
   constructor(options) {
     if (!options.apiUrl) throw new Error("apiUrl is required");
     if (!options.apiKey) throw new Error("apiKey is required");
+    if (!isValidApiKey(options.apiKey)) throw new Error("apiKey must use the sneek_ format with a 43-character secret");
     this.apiUrl = options.apiUrl.replace(/\/+$/, "");
     this.apiKey = options.apiKey;
     this.fetchImpl = options.fetch ?? fetch;
@@ -93,28 +120,6 @@ function asProblem(value) {
   };
 }
 
-// src/core/derive-keys.ts
-import { hkdfSync } from "crypto";
-var KEY_LABELS = {
-  qrSigningKey: "sneek-qr-v1",
-  webhookSigningKey: "sneek-webhook-v1",
-  proofKey: "sneek-proof-v1"
-};
-function deriveKeys(apiKey) {
-  if (typeof apiKey !== "string" || apiKey.length === 0) {
-    throw new TypeError("apiKey must be a nonempty string");
-  }
-  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
-  const derive = (label) => Buffer.from(
-    hkdfSync("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
-  );
-  return {
-    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
-    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
-    proofKey: derive(KEY_LABELS.proofKey)
-  };
-}
-
 // src/messages/client.ts
 var SneekMessagesClient = class {
   client;
@@ -136,5 +141,6 @@ export {
   SneekApiError,
   SneekClient,
   SneekMessagesClient,
-  deriveKeys
+  deriveKeys,
+  isValidApiKey
 };

package/dist/pay/index.cjs

@@ -24,10 +24,37 @@ __export(pay_exports, {
   SneekApiError: () => SneekApiError,
   SneekClient: () => SneekClient,
   SneekPayClient: () => SneekPayClient,
-  deriveKeys: () => deriveKeys
+  deriveKeys: () => deriveKeys,
+  isValidApiKey: () => isValidApiKey
 });
 module.exports = __toCommonJS(pay_exports);
 
+// src/core/derive-keys.ts
+var import_node_crypto = require("crypto");
+var KEY_LABELS = {
+  qrSigningKey: "sneek-qr-v1",
+  webhookSigningKey: "sneek-webhook-v1",
+  proofKey: "sneek-proof-v1"
+};
+var API_KEY_PATTERN = /^sneek_[A-Za-z0-9_-]{43}$/;
+function isValidApiKey(apiKey) {
+  return API_KEY_PATTERN.test(apiKey);
+}
+function deriveKeys(apiKey) {
+  if (typeof apiKey !== "string" || !isValidApiKey(apiKey)) {
+    throw new TypeError("apiKey must use the sneek_ format with a 43-character secret");
+  }
+  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
+  const derive = (label) => Buffer.from(
+    (0, import_node_crypto.hkdfSync)("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
+  );
+  return {
+    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
+    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
+    proofKey: derive(KEY_LABELS.proofKey)
+  };
+}
+
 // src/core/client.ts
 var SneekApiError = class extends Error {
   constructor(status, type, title, detail) {
@@ -52,6 +79,7 @@ var SneekClient = class {
   constructor(options) {
     if (!options.apiUrl) throw new Error("apiUrl is required");
     if (!options.apiKey) throw new Error("apiKey is required");
+    if (!isValidApiKey(options.apiKey)) throw new Error("apiKey must use the sneek_ format with a 43-character secret");
     this.apiUrl = options.apiUrl.replace(/\/+$/, "");
     this.apiKey = options.apiKey;
     this.fetchImpl = options.fetch ?? fetch;
@@ -123,28 +151,6 @@ function asProblem(value) {
   };
 }
 
-// src/core/derive-keys.ts
-var import_node_crypto = require("crypto");
-var KEY_LABELS = {
-  qrSigningKey: "sneek-qr-v1",
-  webhookSigningKey: "sneek-webhook-v1",
-  proofKey: "sneek-proof-v1"
-};
-function deriveKeys(apiKey) {
-  if (typeof apiKey !== "string" || apiKey.length === 0) {
-    throw new TypeError("apiKey must be a nonempty string");
-  }
-  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
-  const derive = (label) => Buffer.from(
-    (0, import_node_crypto.hkdfSync)("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
-  );
-  return {
-    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
-    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
-    proofKey: derive(KEY_LABELS.proofKey)
-  };
-}
-
 // src/pay/payments.ts
 var SneekPayClient = class {
   client;
@@ -219,5 +225,6 @@ var OrdersClient = class {
   SneekApiError,
   SneekClient,
   SneekPayClient,
-  deriveKeys
+  deriveKeys,
+  isValidApiKey
 });

package/dist/pay/index.js

@@ -1,3 +1,29 @@
+// src/core/derive-keys.ts
+import { hkdfSync } from "crypto";
+var KEY_LABELS = {
+  qrSigningKey: "sneek-qr-v1",
+  webhookSigningKey: "sneek-webhook-v1",
+  proofKey: "sneek-proof-v1"
+};
+var API_KEY_PATTERN = /^sneek_[A-Za-z0-9_-]{43}$/;
+function isValidApiKey(apiKey) {
+  return API_KEY_PATTERN.test(apiKey);
+}
+function deriveKeys(apiKey) {
+  if (typeof apiKey !== "string" || !isValidApiKey(apiKey)) {
+    throw new TypeError("apiKey must use the sneek_ format with a 43-character secret");
+  }
+  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
+  const derive = (label) => Buffer.from(
+    hkdfSync("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
+  );
+  return {
+    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
+    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
+    proofKey: derive(KEY_LABELS.proofKey)
+  };
+}
+
 // src/core/client.ts
 var SneekApiError = class extends Error {
   constructor(status, type, title, detail) {
@@ -22,6 +48,7 @@ var SneekClient = class {
   constructor(options) {
     if (!options.apiUrl) throw new Error("apiUrl is required");
     if (!options.apiKey) throw new Error("apiKey is required");
+    if (!isValidApiKey(options.apiKey)) throw new Error("apiKey must use the sneek_ format with a 43-character secret");
     this.apiUrl = options.apiUrl.replace(/\/+$/, "");
     this.apiKey = options.apiKey;
     this.fetchImpl = options.fetch ?? fetch;
@@ -93,28 +120,6 @@ function asProblem(value) {
   };
 }
 
-// src/core/derive-keys.ts
-import { hkdfSync } from "crypto";
-var KEY_LABELS = {
-  qrSigningKey: "sneek-qr-v1",
-  webhookSigningKey: "sneek-webhook-v1",
-  proofKey: "sneek-proof-v1"
-};
-function deriveKeys(apiKey) {
-  if (typeof apiKey !== "string" || apiKey.length === 0) {
-    throw new TypeError("apiKey must be a nonempty string");
-  }
-  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
-  const derive = (label) => Buffer.from(
-    hkdfSync("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
-  );
-  return {
-    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
-    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
-    proofKey: derive(KEY_LABELS.proofKey)
-  };
-}
-
 // src/pay/payments.ts
 var SneekPayClient = class {
   client;
@@ -188,5 +193,6 @@ export {
   SneekApiError,
   SneekClient,
   SneekPayClient,
-  deriveKeys
+  deriveKeys,
+  isValidApiKey
 };

package/dist/verify/auth-schema.d.ts

@@ -38,12 +38,12 @@ export declare const SneekVerifyActionSchema: z.ZodUnion<[z.ZodObject<{
 }, "strict", z.ZodTypeAny, {
     action: "switch";
     requestId: string;
-    channel: "email" | "sms" | "whatsapp" | "push";
+    channel: "sms" | "whatsapp" | "email" | "push";
     proof: string;
 }, {
     action: "switch";
     requestId: string;
-    channel: "email" | "sms" | "whatsapp" | "push";
+    channel: "sms" | "whatsapp" | "email" | "push";
     proof: string;
 }>, z.ZodObject<{
     action: z.ZodLiteral<"verify">;

package/dist/verify/index.cjs

@@ -23,10 +23,37 @@ __export(verify_exports, {
   SneekApiError: () => SneekApiError,
   SneekClient: () => SneekClient,
   SneekVerifyHandler: () => SneekVerifyHandler,
-  deriveKeys: () => deriveKeys
+  deriveKeys: () => deriveKeys,
+  isValidApiKey: () => isValidApiKey
 });
 module.exports = __toCommonJS(verify_exports);
 
+// src/core/derive-keys.ts
+var import_node_crypto = require("crypto");
+var KEY_LABELS = {
+  qrSigningKey: "sneek-qr-v1",
+  webhookSigningKey: "sneek-webhook-v1",
+  proofKey: "sneek-proof-v1"
+};
+var API_KEY_PATTERN = /^sneek_[A-Za-z0-9_-]{43}$/;
+function isValidApiKey(apiKey) {
+  return API_KEY_PATTERN.test(apiKey);
+}
+function deriveKeys(apiKey) {
+  if (typeof apiKey !== "string" || !isValidApiKey(apiKey)) {
+    throw new TypeError("apiKey must use the sneek_ format with a 43-character secret");
+  }
+  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
+  const derive = (label) => Buffer.from(
+    (0, import_node_crypto.hkdfSync)("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
+  );
+  return {
+    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
+    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
+    proofKey: derive(KEY_LABELS.proofKey)
+  };
+}
+
 // src/core/client.ts
 var SneekApiError = class extends Error {
   constructor(status, type, title, detail) {
@@ -51,6 +78,7 @@ var SneekClient = class {
   constructor(options) {
     if (!options.apiUrl) throw new Error("apiUrl is required");
     if (!options.apiKey) throw new Error("apiKey is required");
+    if (!isValidApiKey(options.apiKey)) throw new Error("apiKey must use the sneek_ format with a 43-character secret");
     this.apiUrl = options.apiUrl.replace(/\/+$/, "");
     this.apiKey = options.apiKey;
     this.fetchImpl = options.fetch ?? fetch;
@@ -122,28 +150,6 @@ function asProblem(value) {
   };
 }
 
-// src/core/derive-keys.ts
-var import_node_crypto = require("crypto");
-var KEY_LABELS = {
-  qrSigningKey: "sneek-qr-v1",
-  webhookSigningKey: "sneek-webhook-v1",
-  proofKey: "sneek-proof-v1"
-};
-function deriveKeys(apiKey) {
-  if (typeof apiKey !== "string" || apiKey.length === 0) {
-    throw new TypeError("apiKey must be a nonempty string");
-  }
-  const inputKeyMaterial = Buffer.from(apiKey, "utf8");
-  const derive = (label) => Buffer.from(
-    (0, import_node_crypto.hkdfSync)("sha256", inputKeyMaterial, Buffer.alloc(0), label, 32)
-  );
-  return {
-    qrSigningKey: derive(KEY_LABELS.qrSigningKey),
-    webhookSigningKey: derive(KEY_LABELS.webhookSigningKey),
-    proofKey: derive(KEY_LABELS.proofKey)
-  };
-}
-
 // src/verify/handler.ts
 var import_node_crypto2 = require("crypto");
 var import_jose = require("jose");
@@ -334,8 +340,16 @@ var SneekVerifyHandler = class {
     const partner = await this.client.request("GET", "/api/verify/qr/partner-config");
     let payload;
     try {
-      const jwks = this.jwksByIssuer.get(partner.issuer) ?? (0, import_jose.createRemoteJWKSet)(new URL("/oauth/jwks", partner.issuer));
-      this.jwksByIssuer.set(partner.issuer, jwks);
+      let jwks = this.jwksByIssuer.get(partner.issuer);
+      if (!jwks) {
+        try {
+          const localJwksData = await this.client.request("GET", "/oauth/jwks");
+          jwks = (0, import_jose.createLocalJWKSet)(localJwksData);
+        } catch {
+          jwks = (0, import_jose.createRemoteJWKSet)(new URL("/oauth/jwks", partner.issuer));
+        }
+        this.jwksByIssuer.set(partner.issuer, jwks);
+      }
       ({ payload } = await (0, import_jose.jwtVerify)(result.idToken, jwks, {
         issuer: partner.issuer,
         audience: partner.clientId
@@ -419,11 +433,11 @@ var SneekVerifyHandler = class {
     const partner = await this.partnerConfig();
     if (!partner.origins.includes(origin)) return jsonResponse({ error: "Origin is not registered for QR verification" }, 403);
     const nonce = (0, import_node_crypto2.randomBytes)(32).toString("hex");
-    const ref = (0, import_node_crypto2.createHash)("sha256").update(nonce).digest("hex");
+    const ref = (0, import_node_crypto2.createHash)("sha256").update(Buffer.from(nonce, "hex")).digest("hex");
     const issuedAt = Math.floor(Date.now() / 1e3);
     const expiresAt = (issuedAt + partner.qrTtlSeconds) * 1e3;
     const bindingProof = (0, import_node_crypto2.randomBytes)(32).toString("base64url");
-    const signature = (0, import_node_crypto2.createHmac)("sha256", this.keys.qrSigningKey).update(["sneek-qr-v1", partner.applicationId, nonce, origin, String(issuedAt)].join("\n")).digest().subarray(0, 16).toString("base64url");
+    const signature = (0, import_node_crypto2.createHmac)("sha256", this.keys.qrSigningKey).update(["sneek-qr-v1", partner.applicationId, partner.kid, nonce, origin, String(issuedAt)].join("\n")).digest().subarray(0, 16).toString("base64url");
     await this.approvalStore.createQrSession({
       ref,
       applicationId: partner.applicationId,
@@ -431,7 +445,7 @@ var SneekVerifyHandler = class {
       bindingProofHash: this.hash(bindingProof),
       expiresAt
     });
-    return jsonResponse({ ref, nonce, issuedAt, expiresAt, signature, bindingProof }, 200);
+    return jsonResponse({ ref, nonce, issuedAt, expiresAt, kid: partner.kid, signature, bindingProof }, 200);
   }
   async qrStatus(ref, bindingProof, origin) {
     const session = await this.qrSession(ref, bindingProof, origin);
@@ -467,5 +481,6 @@ function jsonResponse(body, status) {
   SneekApiError,
   SneekClient,
   SneekVerifyHandler,
-  deriveKeys
+  deriveKeys,
+  isValidApiKey
 });