@gerege-systems/eid-mongolia-sdk 0.12.0 → 0.13.0

package/README.md

@@ -40,7 +40,24 @@ native апп дангаараа token endpoint-ийг дуудаж чадахг
 **Бүртгэл.** `client_id` = таны RP UUID (`relyingPartyUUID`), `client_secret` = RP API secret (`rp_sk_…`).
 RP-д `AUTH` эрх, OIDC асаалттай, `redirect_uri` (https, ≤ 10) бүртгэлтэй байна — authorize/token-ий `redirect_uri`
 бүртгэлтэйтэй **тэмдэгт бүрээрээ** таарах ёстой. Иргэний ETSI дугаар (`pnomn` claim) хэрэгтэй бол `PNOMN` эрх
-хүсэж, `scope: "openid pnomn"`. Token endpoint-д RP-ийн IP allowlist мөрдөгдөнө; `requireMtls` RP OIDC ашиглахгүй.
+хүсэж, `scope: "openid pnomn"`. Token endpoint-д RP-ийн IP allowlist мөрдөгдөнө.
+
+**mTLS-тэй RP (`require_mtls`).** `login.` хост mTLS хийдэггүй тул ийм RP-ийн code солих хүсэлт
+`login.eidmongolia.mn/oauth2/token` дээр `401 invalid_client` авна. Discovery-ийн `mtls_endpoint_aliases.token_endpoint`
+(RFC 8705 §5, `https://rp.eidmongolia.mn/oauth2/token`) руу RP-API-д хэрэглэдэг **ижил client cert**-ээр явуулна:
+`useMtlsEndpointAliases: true` + `dispatcher` (RP-API client-ийнхтэй ижил undici `Agent`). Discovery-д alias байхгүй
+бол `token_endpoint` руу буцна; alias https биш бол `discovery_failed`. mTLS-гүй RP флаг тавихгүй.
+
+```ts
+import { Agent } from "undici";
+const oidc = new EidOidcClient({
+  clientId: process.env.EID_RP_UUID!,
+  clientSecret: process.env.EID_SECRET!,
+  redirectUri: "https://bank.example.mn/auth/eid/callback",
+  dispatcher: new Agent({ connect: { cert: clientCertPem, key: clientKeyPem } }), // RP-API-ийн cert
+  useMtlsEndpointAliases: true, // token → https://rp.eidmongolia.mn/oauth2/token
+});
+```
 
 ```ts
 import { EidOidcClient, EidOidcError } from "@gerege-systems/eid-mongolia-sdk";
@@ -219,7 +236,7 @@ import { ForbiddenError, ApiError, ON_BEHALF_ERROR_CODES } from "@gerege-systems
 // 1. Иргэн сүүлийн 24 цагт танай RP-ээр нэвтэрсэн байх ёстой.
 const { representations } = await eid.organization.getRepresentations("PNOMN-12345678");
 // → [{ orgEtsi: "NTRMN-6235972", orgName: "Гэрэгэ Системс ХХК", role: "ceo", roleLabel: "Гүйцэтгэх захирал",
-//      rightType: "ADMIN", … }]
+//      rightType: "ADMIN", rightTypeLabel: "Админ", source: "REGISTRY", sourceLabel: "Улсын бүртгэл", … }]
 
 // 2. PDF (PAdES, CA угсарна) — санал болгох урсгал.
 try {
@@ -259,12 +276,14 @@ prepare 429 `PDF_PREPARE_BUSY`, 503 `LTV_UNAVAILABLE` / `TSA_UNAVAILABLE`; docum
 хүртэл уншина; хэтэрвэл `ResponseTooLargeError`. JSON хариу 4 MiB-ээс хэтэрвэл мөн `ResponseTooLargeError` (таслахгүй).
 `getRepresentations`-ийн `raw` — серверийн түүхий JSON.
 
-**Албан тушаал харуулахдаа `roleLabel` ашигла** (representations болон session-ий `onBehalfOf`) — `role` нь машин
-утга (`ceo` / `founder` / `stakeholder` эсвэл MANAGER-т бичсэн текст), өөрөө орчуулахгүй. Хэл: `new EidClient({ …,
-language: "en" })` → дуудлага бүрд `Accept-Language`; анхдагч илгээхгүй (сервер mn). Хуучин CA-д `roleLabel` байхгүй.
+**Хүнд харуулахдаа `roleLabel` / `rightTypeLabel` / `sourceLabel` ашигла** (representations болон session-ий
+`onBehalfOf`; `onBehalfOf`-д `source` байхгүй тул зөвхөн `roleLabel` / `rightTypeLabel`) — `role` (`ceo` / `founder` /
+`stakeholder` эсвэл MANAGER-т бичсэн текст), `rightType` (`ADMIN` | `MANAGER`), `source` (`REGISTRY` | `MANUAL`) нь
+машин утга, өөрөө орчуулахгүй. Хэл: `new EidClient({ …, language: "en" })` → дуудлага бүрд `Accept-Language`; анхдагч
+илгээхгүй (сервер mn). Хуучин CA-д эдгээр талбар байхгүй.
 
 Олон талт гэрээ: А байгууллагын гаралтыг өөрчлөлтгүй Б-ийн `prepare`-д (`docID`, өөр `onBehalfOf`) илгээнэ.
-Session-ий `onBehalfOf` блок (`role`/`roleLabel`/`rightType`) нь хариу угсрах үеийн бүртгэл; `pdf.signer.onBehalfOf`/`claimedRole`
+Session-ий `onBehalfOf` блок (`role`/`roleLabel`/`rightType`/`rightTypeLabel`) нь хариу угсрах үеийн бүртгэл; `pdf.signer.onBehalfOf`/`claimedRole`
 нь баримтад бичигдсэн утга.
 
 ## 3b. Иргэний PKI самбар (`PKI_READ` эрх)

package/dist/{browser-B_xuB7Rt.d.cts → browser-C6JHm0lR.d.cts}

@@ -223,7 +223,11 @@ interface Representation {
      */
     roleLabel?: string;
     rightType: "ADMIN" | "MANAGER" | string;
+    /** Эрхийн төрлийн хүнд харуулах нэр (ADMIN → «Админ», MANAGER → «Гарын үсэг зурагч»; хэл нь `roleLabel`-тэй ижил). Хуучин CA-д байхгүй. */
+    rightTypeLabel?: string;
     source: "REGISTRY" | "MANUAL" | string;
+    /** Эх үүсвэрийн хүнд харуулах нэр (REGISTRY → «Улсын бүртгэл», MANUAL → «Захирал нэмсэн»; хэл нь `roleLabel`-тэй ижил). Хуучин CA-д байхгүй. */
+    sourceLabel?: string;
     /** ISO 8601. */
     validFrom: string;
     /** ISO 8601; байхгүй = хугацаагүй. */
@@ -247,6 +251,8 @@ interface OrgResult {
     roleLabel?: string;
     /** ADMIN | MANAGER. Эрх хураагдсан бол null. */
     rightType: string | null;
+    /** Эрхийн төрлийн хүнд харуулах нэр ({@link Representation.rightTypeLabel}). Эрх хураагдсан / хуучин CA бол байхгүй. */
+    rightTypeLabel?: string;
 }
 /** RP-ийн нэвтрэх мэдээлэл — бүх дуудлагад хэрэгтэй таних тэмдэг + secret. */
 interface RpCredentials {

package/dist/{browser-B_xuB7Rt.d.ts → browser-C6JHm0lR.d.ts}

@@ -223,7 +223,11 @@ interface Representation {
      */
     roleLabel?: string;
     rightType: "ADMIN" | "MANAGER" | string;
+    /** Эрхийн төрлийн хүнд харуулах нэр (ADMIN → «Админ», MANAGER → «Гарын үсэг зурагч»; хэл нь `roleLabel`-тэй ижил). Хуучин CA-д байхгүй. */
+    rightTypeLabel?: string;
     source: "REGISTRY" | "MANUAL" | string;
+    /** Эх үүсвэрийн хүнд харуулах нэр (REGISTRY → «Улсын бүртгэл», MANUAL → «Захирал нэмсэн»; хэл нь `roleLabel`-тэй ижил). Хуучин CA-д байхгүй. */
+    sourceLabel?: string;
     /** ISO 8601. */
     validFrom: string;
     /** ISO 8601; байхгүй = хугацаагүй. */
@@ -247,6 +251,8 @@ interface OrgResult {
     roleLabel?: string;
     /** ADMIN | MANAGER. Эрх хураагдсан бол null. */
     rightType: string | null;
+    /** Эрхийн төрлийн хүнд харуулах нэр ({@link Representation.rightTypeLabel}). Эрх хураагдсан / хуучин CA бол байхгүй. */
+    rightTypeLabel?: string;
 }
 /** RP-ийн нэвтрэх мэдээлэл — бүх дуудлагад хэрэгтэй таних тэмдэг + secret. */
 interface RpCredentials {

package/dist/browser.d.cts

@@ -1 +1 @@
-export { f as DeviceLinkError, g as DeviceLinkInput, D as DeviceLinkSession, E as EidError, k as NavigatorLike, n as OpenOrShowQROptions, B as deviceLink, G as isMobileUserAgent, J as openOrShowQR } from './browser-B_xuB7Rt.cjs';
+export { f as DeviceLinkError, g as DeviceLinkInput, D as DeviceLinkSession, E as EidError, k as NavigatorLike, n as OpenOrShowQROptions, B as deviceLink, G as isMobileUserAgent, J as openOrShowQR } from './browser-C6JHm0lR.cjs';

package/dist/browser.d.ts

@@ -1 +1 @@
-export { f as DeviceLinkError, g as DeviceLinkInput, D as DeviceLinkSession, E as EidError, k as NavigatorLike, n as OpenOrShowQROptions, B as deviceLink, G as isMobileUserAgent, J as openOrShowQR } from './browser-B_xuB7Rt.js';
+export { f as DeviceLinkError, g as DeviceLinkInput, D as DeviceLinkSession, E as EidError, k as NavigatorLike, n as OpenOrShowQROptions, B as deviceLink, G as isMobileUserAgent, J as openOrShowQR } from './browser-C6JHm0lR.js';

package/dist/index.cjs

@@ -647,12 +647,14 @@ function parseOrg(raw) {
   const etsi = str(o.orgEtsi);
   if (!etsi) return null;
   const roleLabel = str(o.roleLabel);
+  const rightTypeLabel = str(o.rightTypeLabel);
   return {
     orgEtsi: etsi,
     orgName: str(o.orgName),
     role: str(o.role),
     ...roleLabel ? { roleLabel } : {},
-    rightType: str(o.rightType)
+    rightType: str(o.rightType),
+    ...rightTypeLabel ? { rightTypeLabel } : {}
   };
 }
 var SessionApi = class {
@@ -2032,7 +2034,7 @@ var EidOidcClient = class {
   async exchangeCode(code, codeVerifier) {
     const d = await this.discover();
     const basic = Buffer.from(formEncode(this.cfg.clientId) + ":" + formEncode(this.cfg.clientSecret)).toString("base64");
-    const res = await this.fetch(d.token_endpoint, {
+    const res = await this.fetch(this.tokenEndpoint(d), {
       method: "POST",
       headers: {
         Authorization: "Basic " + basic,
@@ -2064,6 +2066,16 @@ var EidOidcClient = class {
     }
     return j.id_token;
   }
+  /** Code солих endpoint: `useMtlsEndpointAliases` + alias байвал alias (RFC 8705 §5), эс бөгөөс `token_endpoint`. */
+  tokenEndpoint(d) {
+    if (!this.cfg.useMtlsEndpointAliases) return d.token_endpoint;
+    const alias = d.mtls_endpoint_aliases?.token_endpoint;
+    if (alias === void 0) return d.token_endpoint;
+    if (typeof alias !== "string" || !alias.startsWith("https://")) {
+      throw new EidOidcError("discovery_failed", "OIDC discovery: mtls_endpoint_aliases.token_endpoint \u0431\u0443\u0440\u0443\u0443");
+    }
+    return alias;
+  }
   /**
    * id_token шалгана: JWKS (`kid`, cache; танихгүй kid → нэг удаа дахин татна) ES256 гарын үсэг, `iss`, `aud`
    * (= clientId; олон aud бол `azp`), `exp`/`iat` (±60 сек), `nonce`. Амжилтгүй бол `invalid_id_token`.
@@ -2140,12 +2152,14 @@ var EidOidcClient = class {
   }
   async fetch(url, init) {
     const f = this.cfg.fetchImpl ?? fetch;
+    const req = {
+      ...init,
+      redirect: "error",
+      signal: AbortSignal.timeout(this.cfg.timeoutMs ?? DEFAULT_TIMEOUT_MS2)
+    };
+    if (this.cfg.dispatcher) req.dispatcher = this.cfg.dispatcher;
     try {
-      return await f(url, {
-        ...init,
-        redirect: "error",
-        signal: AbortSignal.timeout(this.cfg.timeoutMs ?? DEFAULT_TIMEOUT_MS2)
-      });
+      return await f(url, req);
     } catch (e) {
       const err = e;
       if (err.name === "TimeoutError" || err.name === "AbortError") {

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { R as RpCredentials, C as CertificateLevel, I as Interaction, S as SignatureAlgorithm, H as HashAlgorithm, N as NotificationSession, D as DeviceLinkSession, a as SessionResult, P as PersonBlock, b as PdfSessionBlock, c as RepresentationsResponse, A as AcspContext, F as FlowType, E as EidError } from './browser-B_xuB7Rt.cjs';
-export { d as ApiError, e as AuthenticationError, f as DeviceLinkError, g as DeviceLinkInput, h as EndResult, i as ForbiddenError, j as HttpErrorInit, k as NavigatorLike, l as NetworkError, O as ON_BEHALF_ERROR_CODES, m as OnBehalfErrorCode, n as OpenOrShowQROptions, o as OrgResult, p as PdfDocumentStatus, q as PdfSigner, r as RETRYABLE_ERROR_CODES, s as Representation, t as ResponseTooLargeError, u as RetryableErrorCode, v as SessionFailedError, w as SessionState, x as SignatureAlgorithmParameters, y as SignatureProtocol, T as TokenCertSessionBlock, z as TokenCertStatus, V as ValidationError, B as deviceLink, G as isMobileUserAgent, J as openOrShowQR, K as parseRetryAfter } from './browser-B_xuB7Rt.cjs';
+import { R as RpCredentials, C as CertificateLevel, I as Interaction, S as SignatureAlgorithm, H as HashAlgorithm, N as NotificationSession, D as DeviceLinkSession, a as SessionResult, P as PersonBlock, b as PdfSessionBlock, c as RepresentationsResponse, A as AcspContext, F as FlowType, E as EidError } from './browser-C6JHm0lR.cjs';
+export { d as ApiError, e as AuthenticationError, f as DeviceLinkError, g as DeviceLinkInput, h as EndResult, i as ForbiddenError, j as HttpErrorInit, k as NavigatorLike, l as NetworkError, O as ON_BEHALF_ERROR_CODES, m as OnBehalfErrorCode, n as OpenOrShowQROptions, o as OrgResult, p as PdfDocumentStatus, q as PdfSigner, r as RETRYABLE_ERROR_CODES, s as Representation, t as ResponseTooLargeError, u as RetryableErrorCode, v as SessionFailedError, w as SessionState, x as SignatureAlgorithmParameters, y as SignatureProtocol, T as TokenCertSessionBlock, z as TokenCertStatus, V as ValidationError, B as deviceLink, G as isMobileUserAgent, J as openOrShowQR, K as parseRetryAfter } from './browser-C6JHm0lR.cjs';
 import { X509Certificate, KeyObject } from 'node:crypto';
 
 interface HttpConfig {
@@ -965,6 +965,17 @@ interface EidOidcClientConfig {
     scope?: string;
     /** HTTP timeout (мс), анхдагч 10000. */
     timeoutMs?: number;
+    /**
+     * undici Dispatcher (mTLS client cert) — RP-API client-ийн `dispatcher`-тэй ижил:
+     * `new Agent({ connect: { cert, key } })`. Дамжуулсан бол OIDC-ийн бүх fetch-д хэрэглэнэ. Зөвхөн Node орчинд.
+     */
+    dispatcher?: unknown;
+    /**
+     * RFC 8705 §5: `true` бол code солих хүсэлт discovery-ийн `mtls_endpoint_aliases.token_endpoint` руу явна
+     * (`require_mtls`-тэй RP — `dispatcher`-т RP-ийн client cert заавал). Discovery-д alias байхгүй бол
+     * `token_endpoint` руу буцна; alias https биш бол `discovery_failed`. Анхдагч `false`.
+     */
+    useMtlsEndpointAliases?: boolean;
     /** fetch орлуулагч (тест). */
     fetchImpl?: typeof fetch;
 }
@@ -973,6 +984,8 @@ interface EidOidcDiscovery {
     authorization_endpoint: string;
     token_endpoint: string;
     jwks_uri: string;
+    /** RFC 8705 §5 — mTLS-тэй client-ийн endpoint-ууд (ж: `token_endpoint` → `https://rp.eidmongolia.mn/oauth2/token`). */
+    mtls_endpoint_aliases?: Record<string, string>;
     [k: string]: unknown;
 }
 interface CreateAuthorizationOptions {
@@ -1050,6 +1063,8 @@ declare class EidOidcClient {
     handleCallback(input: string | URL | URLSearchParams, checks: EidCallbackChecks): Promise<EidCallbackResult>;
     /** `POST token_endpoint` (client_secret_basic, RFC 6749 §2.3.1) → id_token. */
     private exchangeCode;
+    /** Code солих endpoint: `useMtlsEndpointAliases` + alias байвал alias (RFC 8705 §5), эс бөгөөс `token_endpoint`. */
+    private tokenEndpoint;
     /**
      * id_token шалгана: JWKS (`kid`, cache; танихгүй kid → нэг удаа дахин татна) ES256 гарын үсэг, `iss`, `aud`
      * (= clientId; олон aud бол `azp`), `exp`/`iat` (±60 сек), `nonce`. Амжилтгүй бол `invalid_id_token`.

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { R as RpCredentials, C as CertificateLevel, I as Interaction, S as SignatureAlgorithm, H as HashAlgorithm, N as NotificationSession, D as DeviceLinkSession, a as SessionResult, P as PersonBlock, b as PdfSessionBlock, c as RepresentationsResponse, A as AcspContext, F as FlowType, E as EidError } from './browser-B_xuB7Rt.js';
-export { d as ApiError, e as AuthenticationError, f as DeviceLinkError, g as DeviceLinkInput, h as EndResult, i as ForbiddenError, j as HttpErrorInit, k as NavigatorLike, l as NetworkError, O as ON_BEHALF_ERROR_CODES, m as OnBehalfErrorCode, n as OpenOrShowQROptions, o as OrgResult, p as PdfDocumentStatus, q as PdfSigner, r as RETRYABLE_ERROR_CODES, s as Representation, t as ResponseTooLargeError, u as RetryableErrorCode, v as SessionFailedError, w as SessionState, x as SignatureAlgorithmParameters, y as SignatureProtocol, T as TokenCertSessionBlock, z as TokenCertStatus, V as ValidationError, B as deviceLink, G as isMobileUserAgent, J as openOrShowQR, K as parseRetryAfter } from './browser-B_xuB7Rt.js';
+import { R as RpCredentials, C as CertificateLevel, I as Interaction, S as SignatureAlgorithm, H as HashAlgorithm, N as NotificationSession, D as DeviceLinkSession, a as SessionResult, P as PersonBlock, b as PdfSessionBlock, c as RepresentationsResponse, A as AcspContext, F as FlowType, E as EidError } from './browser-C6JHm0lR.js';
+export { d as ApiError, e as AuthenticationError, f as DeviceLinkError, g as DeviceLinkInput, h as EndResult, i as ForbiddenError, j as HttpErrorInit, k as NavigatorLike, l as NetworkError, O as ON_BEHALF_ERROR_CODES, m as OnBehalfErrorCode, n as OpenOrShowQROptions, o as OrgResult, p as PdfDocumentStatus, q as PdfSigner, r as RETRYABLE_ERROR_CODES, s as Representation, t as ResponseTooLargeError, u as RetryableErrorCode, v as SessionFailedError, w as SessionState, x as SignatureAlgorithmParameters, y as SignatureProtocol, T as TokenCertSessionBlock, z as TokenCertStatus, V as ValidationError, B as deviceLink, G as isMobileUserAgent, J as openOrShowQR, K as parseRetryAfter } from './browser-C6JHm0lR.js';
 import { X509Certificate, KeyObject } from 'node:crypto';
 
 interface HttpConfig {
@@ -965,6 +965,17 @@ interface EidOidcClientConfig {
     scope?: string;
     /** HTTP timeout (мс), анхдагч 10000. */
     timeoutMs?: number;
+    /**
+     * undici Dispatcher (mTLS client cert) — RP-API client-ийн `dispatcher`-тэй ижил:
+     * `new Agent({ connect: { cert, key } })`. Дамжуулсан бол OIDC-ийн бүх fetch-д хэрэглэнэ. Зөвхөн Node орчинд.
+     */
+    dispatcher?: unknown;
+    /**
+     * RFC 8705 §5: `true` бол code солих хүсэлт discovery-ийн `mtls_endpoint_aliases.token_endpoint` руу явна
+     * (`require_mtls`-тэй RP — `dispatcher`-т RP-ийн client cert заавал). Discovery-д alias байхгүй бол
+     * `token_endpoint` руу буцна; alias https биш бол `discovery_failed`. Анхдагч `false`.
+     */
+    useMtlsEndpointAliases?: boolean;
     /** fetch орлуулагч (тест). */
     fetchImpl?: typeof fetch;
 }
@@ -973,6 +984,8 @@ interface EidOidcDiscovery {
     authorization_endpoint: string;
     token_endpoint: string;
     jwks_uri: string;
+    /** RFC 8705 §5 — mTLS-тэй client-ийн endpoint-ууд (ж: `token_endpoint` → `https://rp.eidmongolia.mn/oauth2/token`). */
+    mtls_endpoint_aliases?: Record<string, string>;
     [k: string]: unknown;
 }
 interface CreateAuthorizationOptions {
@@ -1050,6 +1063,8 @@ declare class EidOidcClient {
     handleCallback(input: string | URL | URLSearchParams, checks: EidCallbackChecks): Promise<EidCallbackResult>;
     /** `POST token_endpoint` (client_secret_basic, RFC 6749 §2.3.1) → id_token. */
     private exchangeCode;
+    /** Code солих endpoint: `useMtlsEndpointAliases` + alias байвал alias (RFC 8705 §5), эс бөгөөс `token_endpoint`. */
+    private tokenEndpoint;
     /**
      * id_token шалгана: JWKS (`kid`, cache; танихгүй kid → нэг удаа дахин татна) ES256 гарын үсэг, `iss`, `aud`
      * (= clientId; олон aud бол `azp`), `exp`/`iat` (±60 сек), `nonce`. Амжилтгүй бол `invalid_id_token`.

package/dist/index.js

@@ -464,12 +464,14 @@ function parseOrg(raw) {
   const etsi = str(o.orgEtsi);
   if (!etsi) return null;
   const roleLabel = str(o.roleLabel);
+  const rightTypeLabel = str(o.rightTypeLabel);
   return {
     orgEtsi: etsi,
     orgName: str(o.orgName),
     role: str(o.role),
     ...roleLabel ? { roleLabel } : {},
-    rightType: str(o.rightType)
+    rightType: str(o.rightType),
+    ...rightTypeLabel ? { rightTypeLabel } : {}
   };
 }
 var SessionApi = class {
@@ -1807,7 +1809,7 @@ var EidOidcClient = class {
   async exchangeCode(code, codeVerifier) {
     const d = await this.discover();
     const basic = Buffer.from(formEncode(this.cfg.clientId) + ":" + formEncode(this.cfg.clientSecret)).toString("base64");
-    const res = await this.fetch(d.token_endpoint, {
+    const res = await this.fetch(this.tokenEndpoint(d), {
       method: "POST",
       headers: {
         Authorization: "Basic " + basic,
@@ -1839,6 +1841,16 @@ var EidOidcClient = class {
     }
     return j.id_token;
   }
+  /** Code солих endpoint: `useMtlsEndpointAliases` + alias байвал alias (RFC 8705 §5), эс бөгөөс `token_endpoint`. */
+  tokenEndpoint(d) {
+    if (!this.cfg.useMtlsEndpointAliases) return d.token_endpoint;
+    const alias = d.mtls_endpoint_aliases?.token_endpoint;
+    if (alias === void 0) return d.token_endpoint;
+    if (typeof alias !== "string" || !alias.startsWith("https://")) {
+      throw new EidOidcError("discovery_failed", "OIDC discovery: mtls_endpoint_aliases.token_endpoint \u0431\u0443\u0440\u0443\u0443");
+    }
+    return alias;
+  }
   /**
    * id_token шалгана: JWKS (`kid`, cache; танихгүй kid → нэг удаа дахин татна) ES256 гарын үсэг, `iss`, `aud`
    * (= clientId; олон aud бол `azp`), `exp`/`iat` (±60 сек), `nonce`. Амжилтгүй бол `invalid_id_token`.
@@ -1915,12 +1927,14 @@ var EidOidcClient = class {
   }
   async fetch(url, init) {
     const f = this.cfg.fetchImpl ?? fetch;
+    const req = {
+      ...init,
+      redirect: "error",
+      signal: AbortSignal.timeout(this.cfg.timeoutMs ?? DEFAULT_TIMEOUT_MS2)
+    };
+    if (this.cfg.dispatcher) req.dispatcher = this.cfg.dispatcher;
     try {
-      return await f(url, {
-        ...init,
-        redirect: "error",
-        signal: AbortSignal.timeout(this.cfg.timeoutMs ?? DEFAULT_TIMEOUT_MS2)
-      });
+      return await f(url, req);
     } catch (e) {
       const err = e;
       if (err.name === "TimeoutError" || err.name === "AbortError") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gerege-systems/eid-mongolia-sdk",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "e-ID Mongolia Relying Party SDK — иргэнээр утсаар нь нэвтрэлт ба хууль ёсны цахим гарын үсэг (RP-API v3, Smart-ID нийцтэй).",
   "license": "MIT",
   "type": "module",