@gerege-systems/eid-mongolia-sdk 0.14.1 → 0.14.2

package/README.md

@@ -272,10 +272,16 @@ RAW_DIGEST_SIGNATURE-д `flowType` гарын үсэгт ордоггүй (зө
 холбоосыг backend-д `buildDeviceLink(deviceLinkInput(s, "QR", "mon"))` (auth/cert session-д ч мөн). `s.sign`
 (`SignContext`: digest, hash, алгоритм, interactions, callback)-ийг session-тэй хамт серверт хадгал.
 
-**`expiresAt`** (ms epoch) — sign / certificate-choice session-ий *тооцоолсон* дуусах мөч: CA session start хариунд
-хугацаа буцаадаггүй (зөвхөн `sessionID`), CA-ийн анхдагч 600с (`DEFAULT_SIGN_SESSION_TTL_MS`; CA админ 60–1800с болгож
-болно → `signSessionTtlMs`). Хүсэлтээс өмнөх цагаас тооцдог тул CA-ийнхаас хойно хэзээ ч биш; эцсийн үнэн нь
-`GET /session` (`TIMEOUT`).
+**`expiresAt`** (ms epoch) — session дуусах мөч: CA-ийн session start хариуны `expiresAt` (RFC 3339; auth / sign /
+certificate-choice бүгдэд, 2026-10-14-өөс). Хуучин CA (талбаргүй) үед sign / certificate-choice-д SDK тооцоолно — CA-ийн
+анхдагч 600с (`DEFAULT_SIGN_SESSION_TTL_MS`; CA админ 60–1800с болгож болно → `signSessionTtlMs`), auth-д undefined.
+Эцсийн үнэн нь `GET /session` (`TIMEOUT`).
+
+**Session эхлэх алдаа** (`ApiError`-ийн дэд анги, `.code`-той): `NoSigningCertificateError` — 409
+`NO_SIGNING_CERTIFICATE` (sign / certificate-choice start, `/pdf/sign/prepare`: иргэнд идэвхтэй төхөөрөмж / хүчинтэй
+гарын үсгийн гэрчилгээ алга, session үүсээгүй); `CertChoiceInvalidError` — 409 `CERT_CHOICE_INVALID` (linked sign-ийн
+certificate-choice хүчингүй / хуучирсан / ашиглагдсан → cert-choice-ийг дахин эхлүүл); `RequestInvalidError` — 400
+`REQUEST_INVALID` (ж: linked-д `linkedSessionID` дутуу).
 
 ### 3.1. Гэрчилгээг урьдчилж мэдэх (client-side PAdES / CMS)
 
@@ -522,6 +528,9 @@ OK ирж болзошгүй. Иймд `ResponseValidator`:
 | `ForbiddenError` | 403 — IP allowlist / mTLS / RP-ийн эрх; onBehalfOf татгалзвал `.code` (`OnBehalfErrorCode`) |
 | `SessionFailedError` | endResult ≠ OK (TIMEOUT, USER_REFUSED…) — `.endResult`-оор салга |
 | `ValidationError` | cert chain/signature/level шалгалт бүтэлгүйтсэн |
+| `NoSigningCertificateError` | 409 `NO_SIGNING_CERTIFICATE` — гарын үсгийн гэрчилгээ / төхөөрөмж алга (sign, cert-choice start, PDF prepare); `ApiError`-ийн дэд анги |
+| `CertChoiceInvalidError` | 409 `CERT_CHOICE_INVALID` — linked sign-ийн certificate-choice хүчингүй; `ApiError`-ийн дэд анги |
+| `RequestInvalidError` | 400 `REQUEST_INVALID` — хүсэлт буруу (ж: `linkedSessionID` дутуу); `ApiError`-ийн дэд анги |
 | `ApiError` | бусад HTTP алдаа (`.status`, `.body`, серверийн `.code`, `.retryAfterMs`, `.headers`, `.retryable` — ж: 404 `ORG_NOT_FOUND`) |
 | `ResponseTooLargeError` | хариу SDK-ийн хязгаараас их (JSON 4 MiB, PDF `pdfMaxBytes`) — `.op`, `.limit` |
 | `NetworkError` | timeout/сүлжээ (`.op` — таних тэмдэггүй зам, `.timeout`) |

package/dist/{browser-CuMH5IVG.d.cts → browser-CSZjH9Xs.d.cts}

@@ -94,8 +94,9 @@ interface SignContext {
 }
 /**
  * CA-ийн SIGNATURE ба CERTIFICATE_CHOICE session-ий анхдагч хүчинтэй хугацаа (мс; `EID_SIGN_SESSION_TTL_SECONDS` = 600).
- * CA-ийн админ «Системийн тохиргоо»-нд 60–1800 секундэд өөрчилж болно; session start хариунд CA хугацааг буцаадаггүй
- * (зөвхөн `sessionID`) тул SDK үүнийг `ClientConfig.signSessionTtlMs`-ээр тооцоолно.
+ * CA-ийн админ «Системийн тохиргоо»-нд 60–1800 секундэд өөрчилж болно. CA 2026-10-14-өөс session start хариунд
+ * `expiresAt` (RFC 3339) буцаадаг — SDK түүнийг ашиглана; хуучин CA (талбаргүй) үед л `ClientConfig.signSessionTtlMs`-ээр
+ * тооцоолно ({@link startExpiry}).
  */
 declare const DEFAULT_SIGN_SESSION_TTL_MS = 600000;
 /**
@@ -104,6 +105,10 @@ declare const DEFAULT_SIGN_SESSION_TTL_MS = 600000;
  * эхлүүлэх» шийдвэрт л — эцсийн үнэн нь `GET /session` (`TIMEOUT`).
  */
 declare function sessionExpiry(sentAtMs: number, ttlMs?: number): number;
+/** CA-ийн `expiresAt` (RFC 3339) → ms epoch; байхгүй / задрахгүй бол undefined. */
+declare function parseExpiresAt(v: unknown): number | undefined;
+/** Session start-ын дуусах мөч: CA-ийн `expiresAt` байвал түүнийг, үгүй бол {@link sessionExpiry} (тооцоолол). */
+declare function startExpiry(raw: unknown, sentAtMs: number, ttlMs?: number): number;
 /**
  * Device-link (QR/Web2App/App2App) session. Иргэн QR уншиж эсвэл товч дарж нэгдэнэ.
  * `sessionToken`, `sessionSecret`-ийг ЗӨВХӨН backend-д хадгална — браузер руу бүү гарга.
@@ -136,7 +141,10 @@ interface DeviceLinkSession {
     sign?: SignContext;
     /** Certificate-choice session-ий хүсэлтэд илгээсэн нэр (cert холбоосын authCode-д). */
     relyingPartyName?: string;
-    /** Sign / certificate-choice session-ий ТООЦООЛСОН дуусах мөч (ms epoch, {@link sessionExpiry}); auth-д undefined. */
+    /**
+     * Session дуусах мөч (ms epoch): CA-ийн start хариуны `expiresAt`; хуучин CA-д sign / certificate-choice-д тооцоолсон
+     * ({@link startExpiry}), auth-д undefined.
+     */
     expiresAt?: number;
 }
 /** Session poll-ийн нэгтгэсэн үр дүн (validator-т орох түүхий материал). */
@@ -418,6 +426,23 @@ declare class ApiError extends EidError {
      */
     get retryable(): boolean;
 }
+/**
+ * 409 `NO_SIGNING_CERTIFICATE` — иргэнд (баримтад) идэвхтэй төхөөрөмж / SIGN credential / хүчинтэй гарын үсгийн
+ * гэрчилгээ алга: sign ба certificate-choice session start, `/pdf/sign/prepare`. Session үүсээгүй. Танихгүй
+ * лавлагаанд ч ижил хариу (бүртгэл задлахгүй) — хэрэглэгчид «eID гарын үсгийн гэрчилгээгүй» гэж харуулна.
+ */
+declare class NoSigningCertificateError extends ApiError {
+}
+/**
+ * 409 `CERT_CHOICE_INVALID` — linked sign-ийн `linkedSessionID` (certificate-choice) хүчингүй: өөр RP, COMPLETE+OK биш,
+ * өөр documentNumber, 5 минутаас хуучин, гэрчилгээ солигдсон, эсвэл аль хэдийн ашиглагдсан. Certificate-choice-ийг
+ * дахин эхлүүлнэ.
+ */
+declare class CertChoiceInvalidError extends ApiError {
+}
+/** 400 `REQUEST_INVALID` — хүсэлтийн бие/талбар буруу (ж: linked sign-д `linkedSessionID` дутуу). Програмын алдаа. */
+declare class RequestInvalidError extends ApiError {
+}
 /**
  * CA-ийн түр (давтаж болох) алдааны кодууд — `ApiError.code`. PDF_PREPARE_BUSY (429 prepare, Retry-After 5),
  * DOCUMENT_PENDING (503 document, 5), TSA_UNAVAILABLE (503, 30), LTV_UNAVAILABLE (503, 60), RATE_LIMITED (429 токен),
@@ -483,4 +508,4 @@ declare class ValidationError extends EidError {
 declare class DeviceLinkError extends EidError {
 }
 
-export { type AcspContext as A, type SignatureProtocol as B, type CertificateLevel as C, type DeviceLinkSession as D, EidError as E, type FlowType as F, type TokenCertStatus as G, type HashAlgorithm as H, type Interaction as I, deviceLink as J, isMobileUserAgent as K, openOrShowQR as L, parseRetryAfter as M, type NotificationSession as N, ON_BEHALF_ERROR_CODES as O, type PersonBlock as P, sessionExpiry as Q, type RpCredentials as R, type SignatureAlgorithm as S, type TokenCertSessionBlock as T, ValidationError as V, type SessionResult as a, type PdfSessionBlock as b, type RepresentationsResponse as c, ApiError as d, AuthenticationError as e, DEFAULT_SIGN_SESSION_TTL_MS as f, DeviceLinkError as g, type DeviceLinkInput as h, type EndResult as i, ForbiddenError as j, type HttpErrorInit as k, type NavigatorLike as l, NetworkError as m, type OnBehalfErrorCode as n, type OpenOrShowQROptions as o, type OrgResult as p, type PdfDocumentStatus as q, type PdfSigner as r, RETRYABLE_ERROR_CODES as s, type Representation as t, ResponseTooLargeError as u, type RetryableErrorCode as v, SessionFailedError as w, type SessionState as x, type SignContext as y, type SignatureAlgorithmParameters as z };
+export { type AcspContext as A, type SessionState as B, type CertificateLevel as C, type DeviceLinkSession as D, EidError as E, type FlowType as F, type SignContext as G, type HashAlgorithm as H, type Interaction as I, type SignatureAlgorithmParameters as J, type SignatureProtocol as K, type TokenCertStatus as L, deviceLink as M, type NotificationSession as N, ON_BEHALF_ERROR_CODES as O, type PersonBlock as P, isMobileUserAgent as Q, type RpCredentials as R, type SignatureAlgorithm as S, type TokenCertSessionBlock as T, openOrShowQR as U, ValidationError as V, parseExpiresAt as W, parseRetryAfter as X, sessionExpiry as Y, startExpiry as Z, type SessionResult as a, type PdfSessionBlock as b, type RepresentationsResponse as c, ApiError as d, AuthenticationError as e, CertChoiceInvalidError as f, DEFAULT_SIGN_SESSION_TTL_MS as g, DeviceLinkError as h, type DeviceLinkInput as i, type EndResult as j, ForbiddenError as k, type HttpErrorInit as l, type NavigatorLike as m, NetworkError as n, NoSigningCertificateError as o, type OnBehalfErrorCode as p, type OpenOrShowQROptions as q, type OrgResult as r, type PdfDocumentStatus as s, type PdfSigner as t, RETRYABLE_ERROR_CODES as u, type Representation as v, RequestInvalidError as w, ResponseTooLargeError as x, type RetryableErrorCode as y, SessionFailedError as z };

package/dist/{browser-CuMH5IVG.d.ts → browser-CSZjH9Xs.d.ts}

@@ -94,8 +94,9 @@ interface SignContext {
 }
 /**
  * CA-ийн SIGNATURE ба CERTIFICATE_CHOICE session-ий анхдагч хүчинтэй хугацаа (мс; `EID_SIGN_SESSION_TTL_SECONDS` = 600).
- * CA-ийн админ «Системийн тохиргоо»-нд 60–1800 секундэд өөрчилж болно; session start хариунд CA хугацааг буцаадаггүй
- * (зөвхөн `sessionID`) тул SDK үүнийг `ClientConfig.signSessionTtlMs`-ээр тооцоолно.
+ * CA-ийн админ «Системийн тохиргоо»-нд 60–1800 секундэд өөрчилж болно. CA 2026-10-14-өөс session start хариунд
+ * `expiresAt` (RFC 3339) буцаадаг — SDK түүнийг ашиглана; хуучин CA (талбаргүй) үед л `ClientConfig.signSessionTtlMs`-ээр
+ * тооцоолно ({@link startExpiry}).
  */
 declare const DEFAULT_SIGN_SESSION_TTL_MS = 600000;
 /**
@@ -104,6 +105,10 @@ declare const DEFAULT_SIGN_SESSION_TTL_MS = 600000;
  * эхлүүлэх» шийдвэрт л — эцсийн үнэн нь `GET /session` (`TIMEOUT`).
  */
 declare function sessionExpiry(sentAtMs: number, ttlMs?: number): number;
+/** CA-ийн `expiresAt` (RFC 3339) → ms epoch; байхгүй / задрахгүй бол undefined. */
+declare function parseExpiresAt(v: unknown): number | undefined;
+/** Session start-ын дуусах мөч: CA-ийн `expiresAt` байвал түүнийг, үгүй бол {@link sessionExpiry} (тооцоолол). */
+declare function startExpiry(raw: unknown, sentAtMs: number, ttlMs?: number): number;
 /**
  * Device-link (QR/Web2App/App2App) session. Иргэн QR уншиж эсвэл товч дарж нэгдэнэ.
  * `sessionToken`, `sessionSecret`-ийг ЗӨВХӨН backend-д хадгална — браузер руу бүү гарга.
@@ -136,7 +141,10 @@ interface DeviceLinkSession {
     sign?: SignContext;
     /** Certificate-choice session-ий хүсэлтэд илгээсэн нэр (cert холбоосын authCode-д). */
     relyingPartyName?: string;
-    /** Sign / certificate-choice session-ий ТООЦООЛСОН дуусах мөч (ms epoch, {@link sessionExpiry}); auth-д undefined. */
+    /**
+     * Session дуусах мөч (ms epoch): CA-ийн start хариуны `expiresAt`; хуучин CA-д sign / certificate-choice-д тооцоолсон
+     * ({@link startExpiry}), auth-д undefined.
+     */
     expiresAt?: number;
 }
 /** Session poll-ийн нэгтгэсэн үр дүн (validator-т орох түүхий материал). */
@@ -418,6 +426,23 @@ declare class ApiError extends EidError {
      */
     get retryable(): boolean;
 }
+/**
+ * 409 `NO_SIGNING_CERTIFICATE` — иргэнд (баримтад) идэвхтэй төхөөрөмж / SIGN credential / хүчинтэй гарын үсгийн
+ * гэрчилгээ алга: sign ба certificate-choice session start, `/pdf/sign/prepare`. Session үүсээгүй. Танихгүй
+ * лавлагаанд ч ижил хариу (бүртгэл задлахгүй) — хэрэглэгчид «eID гарын үсгийн гэрчилгээгүй» гэж харуулна.
+ */
+declare class NoSigningCertificateError extends ApiError {
+}
+/**
+ * 409 `CERT_CHOICE_INVALID` — linked sign-ийн `linkedSessionID` (certificate-choice) хүчингүй: өөр RP, COMPLETE+OK биш,
+ * өөр documentNumber, 5 минутаас хуучин, гэрчилгээ солигдсон, эсвэл аль хэдийн ашиглагдсан. Certificate-choice-ийг
+ * дахин эхлүүлнэ.
+ */
+declare class CertChoiceInvalidError extends ApiError {
+}
+/** 400 `REQUEST_INVALID` — хүсэлтийн бие/талбар буруу (ж: linked sign-д `linkedSessionID` дутуу). Програмын алдаа. */
+declare class RequestInvalidError extends ApiError {
+}
 /**
  * CA-ийн түр (давтаж болох) алдааны кодууд — `ApiError.code`. PDF_PREPARE_BUSY (429 prepare, Retry-After 5),
  * DOCUMENT_PENDING (503 document, 5), TSA_UNAVAILABLE (503, 30), LTV_UNAVAILABLE (503, 60), RATE_LIMITED (429 токен),
@@ -483,4 +508,4 @@ declare class ValidationError extends EidError {
 declare class DeviceLinkError extends EidError {
 }
 
-export { type AcspContext as A, type SignatureProtocol as B, type CertificateLevel as C, type DeviceLinkSession as D, EidError as E, type FlowType as F, type TokenCertStatus as G, type HashAlgorithm as H, type Interaction as I, deviceLink as J, isMobileUserAgent as K, openOrShowQR as L, parseRetryAfter as M, type NotificationSession as N, ON_BEHALF_ERROR_CODES as O, type PersonBlock as P, sessionExpiry as Q, type RpCredentials as R, type SignatureAlgorithm as S, type TokenCertSessionBlock as T, ValidationError as V, type SessionResult as a, type PdfSessionBlock as b, type RepresentationsResponse as c, ApiError as d, AuthenticationError as e, DEFAULT_SIGN_SESSION_TTL_MS as f, DeviceLinkError as g, type DeviceLinkInput as h, type EndResult as i, ForbiddenError as j, type HttpErrorInit as k, type NavigatorLike as l, NetworkError as m, type OnBehalfErrorCode as n, type OpenOrShowQROptions as o, type OrgResult as p, type PdfDocumentStatus as q, type PdfSigner as r, RETRYABLE_ERROR_CODES as s, type Representation as t, ResponseTooLargeError as u, type RetryableErrorCode as v, SessionFailedError as w, type SessionState as x, type SignContext as y, type SignatureAlgorithmParameters as z };
+export { type AcspContext as A, type SessionState as B, type CertificateLevel as C, type DeviceLinkSession as D, EidError as E, type FlowType as F, type SignContext as G, type HashAlgorithm as H, type Interaction as I, type SignatureAlgorithmParameters as J, type SignatureProtocol as K, type TokenCertStatus as L, deviceLink as M, type NotificationSession as N, ON_BEHALF_ERROR_CODES as O, type PersonBlock as P, isMobileUserAgent as Q, type RpCredentials as R, type SignatureAlgorithm as S, type TokenCertSessionBlock as T, openOrShowQR as U, ValidationError as V, parseExpiresAt as W, parseRetryAfter as X, sessionExpiry as Y, startExpiry as Z, type SessionResult as a, type PdfSessionBlock as b, type RepresentationsResponse as c, ApiError as d, AuthenticationError as e, CertChoiceInvalidError as f, DEFAULT_SIGN_SESSION_TTL_MS as g, DeviceLinkError as h, type DeviceLinkInput as i, type EndResult as j, ForbiddenError as k, type HttpErrorInit as l, type NavigatorLike as m, NetworkError as n, NoSigningCertificateError as o, type OnBehalfErrorCode as p, type OpenOrShowQROptions as q, type OrgResult as r, type PdfDocumentStatus as s, type PdfSigner as t, RETRYABLE_ERROR_CODES as u, type Representation as v, RequestInvalidError as w, ResponseTooLargeError as x, type RetryableErrorCode as y, SessionFailedError as z };

package/dist/browser.d.cts

@@ -1 +1 @@
-export { g as DeviceLinkError, h as DeviceLinkInput, D as DeviceLinkSession, E as EidError, l as NavigatorLike, o as OpenOrShowQROptions, J as deviceLink, K as isMobileUserAgent, L as openOrShowQR } from './browser-CuMH5IVG.cjs';
+export { h as DeviceLinkError, i as DeviceLinkInput, D as DeviceLinkSession, E as EidError, m as NavigatorLike, q as OpenOrShowQROptions, M as deviceLink, Q as isMobileUserAgent, U as openOrShowQR } from './browser-CSZjH9Xs.cjs';

package/dist/browser.d.ts

@@ -1 +1 @@
-export { g as DeviceLinkError, h as DeviceLinkInput, D as DeviceLinkSession, E as EidError, l as NavigatorLike, o as OpenOrShowQROptions, J as deviceLink, K as isMobileUserAgent, L as openOrShowQR } from './browser-CuMH5IVG.js';
+export { h as DeviceLinkError, i as DeviceLinkInput, D as DeviceLinkSession, E as EidError, m as NavigatorLike, q as OpenOrShowQROptions, M as deviceLink, Q as isMobileUserAgent, U as openOrShowQR } from './browser-CSZjH9Xs.js';

package/dist/browser.js

@@ -4,7 +4,7 @@ import {
   deviceLink,
   isMobileUserAgent,
   openOrShowQR
-} from "./chunk-QPJDZLHR.js";
+} from "./chunk-DXVHOZO7.js";
 export {
   DeviceLinkError,
   EidError,

package/dist/{chunk-QPJDZLHR.js → chunk-DXVHOZO7.js}

@@ -60,6 +60,12 @@ var ApiError = class extends EidError {
     return (this.status === 429 || this.status === 503) && (this.retryAfterMs ?? 0) > 0;
   }
 };
+var NoSigningCertificateError = class extends ApiError {
+};
+var CertChoiceInvalidError = class extends ApiError {
+};
+var RequestInvalidError = class extends ApiError {
+};
 var RETRYABLE_ERROR_CODES = [
   "PDF_PREPARE_BUSY",
   "DOCUMENT_PENDING",
@@ -170,6 +176,9 @@ export {
   AuthenticationError,
   ForbiddenError,
   ApiError,
+  NoSigningCertificateError,
+  CertChoiceInvalidError,
+  RequestInvalidError,
   RETRYABLE_ERROR_CODES,
   parseRetryAfter,
   ON_BEHALF_ERROR_CODES,

package/dist/index.cjs

@@ -24,6 +24,7 @@ __export(index_exports, {
   AuthApi: () => AuthApi,
   AuthenticationError: () => AuthenticationError,
   CITIZEN_ISSUING_CA_SKI: () => CITIZEN_ISSUING_CA_SKI,
+  CertChoiceInvalidError: () => CertChoiceInvalidError,
   DEFAULT_BASE_URL: () => DEFAULT_BASE_URL,
   DEFAULT_PDF_MAX_BYTES: () => DEFAULT_PDF_MAX_BYTES,
   DEFAULT_PDF_TIMEOUT_MS: () => DEFAULT_PDF_TIMEOUT_MS,
@@ -34,11 +35,13 @@ __export(index_exports, {
   ForbiddenError: () => ForbiddenError,
   Http: () => Http,
   NetworkError: () => NetworkError,
+  NoSigningCertificateError: () => NoSigningCertificateError,
   ON_BEHALF_ERROR_CODES: () => ON_BEHALF_ERROR_CODES,
   OrganizationApi: () => OrganizationApi,
   PdfApi: () => PdfApi,
   PersonApi: () => PersonApi,
   RETRYABLE_ERROR_CODES: () => RETRYABLE_ERROR_CODES,
+  RequestInvalidError: () => RequestInvalidError,
   ResponseTooLargeError: () => ResponseTooLargeError,
   ResponseValidator: () => ResponseValidator,
   SessionApi: () => SessionApi,
@@ -57,6 +60,7 @@ __export(index_exports, {
   isMobileUserAgent: () => isMobileUserAgent,
   memoryLoginStore: () => memoryLoginStore,
   openOrShowQR: () => openOrShowQR,
+  parseExpiresAt: () => parseExpiresAt,
   parseRetryAfter: () => parseRetryAfter,
   parseSessionResult: () => parseSessionResult,
   parseSubject: () => parseSubject,
@@ -66,6 +70,7 @@ __export(index_exports, {
   resolveBaseUrl: () => resolveBaseUrl,
   sessionExpiry: () => sessionExpiry,
   sha256Base64: () => sha256Base64,
+  startExpiry: () => startExpiry,
   tokenAuthDigest: () => tokenAuthDigest,
   tokenLimitOf: () => tokenLimitOf,
   userChallengeOf: () => userChallengeOf,
@@ -138,6 +143,12 @@ var ApiError = class extends EidError {
     return (this.status === 429 || this.status === 503) && (this.retryAfterMs ?? 0) > 0;
   }
 };
+var NoSigningCertificateError = class extends ApiError {
+};
+var CertChoiceInvalidError = class extends ApiError {
+};
+var RequestInvalidError = class extends ApiError {
+};
 var RETRYABLE_ERROR_CODES = [
   "PDF_PREPARE_BUSY",
   "DOCUMENT_PENDING",
@@ -269,7 +280,8 @@ var Http = class {
         { headers, retryAfterMs }
       );
     }
-    throw new ApiError(res.status, text, code, { headers, retryAfterMs });
+    const Typed = code === "NO_SIGNING_CERTIFICATE" ? NoSigningCertificateError : code === "CERT_CHOICE_INVALID" ? CertChoiceInvalidError : code === "REQUEST_INVALID" ? RequestInvalidError : ApiError;
+    throw new Typed(res.status, text, code, { headers, retryAfterMs });
   }
 };
 async function readLimited(res, limit, op) {
@@ -395,6 +407,21 @@ function acspV2Digest(p, hashAlgorithm) {
   return (0, import_node_crypto.createHash)(nodeHash(hashAlgorithm)).update(buildAcspV2Payload(p)).digest();
 }
 
+// src/types.ts
+var DEFAULT_SIGN_SESSION_TTL_MS = 6e5;
+function sessionExpiry(sentAtMs, ttlMs) {
+  return sentAtMs + (ttlMs && ttlMs > 0 ? ttlMs : DEFAULT_SIGN_SESSION_TTL_MS);
+}
+function parseExpiresAt(v) {
+  if (typeof v !== "string" || !/^\d{4}-\d{2}-\d{2}T/.test(v)) return void 0;
+  const t = Date.parse(v);
+  return Number.isFinite(t) ? t : void 0;
+}
+function startExpiry(raw, sentAtMs, ttlMs) {
+  const r = raw && typeof raw === "object" ? raw : {};
+  return parseExpiresAt(r.expiresAt) ?? sessionExpiry(sentAtMs, ttlMs);
+}
+
 // src/auth.ts
 function rec(v) {
   return v && typeof v === "object" ? v : {};
@@ -440,11 +467,19 @@ var AuthApi = class {
   parseNotification(raw, acsp) {
     const r = rec(raw);
     const vc = rec(r.vc).value;
-    return { sessionId: String(r.sessionID), vc: vc != null ? String(vc) : null, rpChallenge: acsp.rpChallenge, acsp };
+    const expiresAt = parseExpiresAt(r.expiresAt);
+    return {
+      sessionId: String(r.sessionID),
+      vc: vc != null ? String(vc) : null,
+      rpChallenge: acsp.rpChallenge,
+      acsp,
+      ...expiresAt !== void 0 ? { expiresAt } : {}
+    };
   }
   parseDeviceLink(raw, acsp) {
     const r = rec(raw);
     const vc = typeof r.vc === "object" && r.vc !== null ? rec(r.vc).value : r.vc;
+    const expiresAt = parseExpiresAt(r.expiresAt);
     return {
       sessionId: String(r.sessionID),
       sessionToken: r.sessionToken != null ? String(r.sessionToken) : null,
@@ -454,7 +489,8 @@ var AuthApi = class {
       rpChallenge: acsp.rpChallenge,
       acsp,
       receivedAt: Date.now(),
-      sessionType: "auth"
+      sessionType: "auth",
+      ...expiresAt !== void 0 ? { expiresAt } : {}
     };
   }
   /** Push — РД/иргэний дугаар/ETSI-ээр (сервер төрлийг таьна). Иргэний утас руу мэдэгдэл очно. */
@@ -483,12 +519,6 @@ var AuthApi = class {
   }
 };
 
-// src/types.ts
-var DEFAULT_SIGN_SESSION_TTL_MS = 6e5;
-function sessionExpiry(sentAtMs, ttlMs) {
-  return sentAtMs + (ttlMs && ttlMs > 0 ? ttlMs : DEFAULT_SIGN_SESSION_TTL_MS);
-}
-
 // src/sign.ts
 function rec2(v) {
   return v && typeof v === "object" ? v : {};
@@ -540,7 +570,7 @@ var SignApi = class {
       vc: vcOf(r),
       rpChallenge: "",
       ...sign ? { sign } : {},
-      expiresAt: sessionExpiry(sent, this.defaults.sessionTtlMs)
+      expiresAt: startExpiry(r, sent, this.defaults.sessionTtlMs)
     };
   }
   async deviceLink(path, body, extra) {
@@ -555,7 +585,7 @@ var SignApi = class {
       rpChallenge: "",
       receivedAt: Date.now(),
       ...extra,
-      expiresAt: sessionExpiry(sent, this.defaults.sessionTtlMs)
+      expiresAt: startExpiry(r, sent, this.defaults.sessionTtlMs)
     };
   }
   /**
@@ -2491,6 +2521,7 @@ function createEidLogin(opts) {
   AuthApi,
   AuthenticationError,
   CITIZEN_ISSUING_CA_SKI,
+  CertChoiceInvalidError,
   DEFAULT_BASE_URL,
   DEFAULT_PDF_MAX_BYTES,
   DEFAULT_PDF_TIMEOUT_MS,
@@ -2501,11 +2532,13 @@ function createEidLogin(opts) {
   ForbiddenError,
   Http,
   NetworkError,
+  NoSigningCertificateError,
   ON_BEHALF_ERROR_CODES,
   OrganizationApi,
   PdfApi,
   PersonApi,
   RETRYABLE_ERROR_CODES,
+  RequestInvalidError,
   ResponseTooLargeError,
   ResponseValidator,
   SessionApi,
@@ -2524,6 +2557,7 @@ function createEidLogin(opts) {
   isMobileUserAgent,
   memoryLoginStore,
   openOrShowQR,
+  parseExpiresAt,
   parseRetryAfter,
   parseSessionResult,
   parseSubject,
@@ -2533,6 +2567,7 @@ function createEidLogin(opts) {
   resolveBaseUrl,
   sessionExpiry,
   sha256Base64,
+  startExpiry,
   tokenAuthDigest,
   tokenLimitOf,
   userChallengeOf,

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { R as RpCredentials, C as CertificateLevel, I as Interaction, S as SignatureAlgorithm, H as HashAlgorithm, N as NotificationSession, D as DeviceLinkSession, a as SessionResult, P as PersonBlock, b as PdfSessionBlock, c as RepresentationsResponse, A as AcspContext, F as FlowType } from './browser-CuMH5IVG.cjs';
-export { d as ApiError, e as AuthenticationError, f as DEFAULT_SIGN_SESSION_TTL_MS, g as DeviceLinkError, h as DeviceLinkInput, E as EidError, i as EndResult, j as ForbiddenError, k as HttpErrorInit, l as NavigatorLike, m as NetworkError, O as ON_BEHALF_ERROR_CODES, n as OnBehalfErrorCode, o as OpenOrShowQROptions, p as OrgResult, q as PdfDocumentStatus, r as PdfSigner, s as RETRYABLE_ERROR_CODES, t as Representation, u as ResponseTooLargeError, v as RetryableErrorCode, w as SessionFailedError, x as SessionState, y as SignContext, z as SignatureAlgorithmParameters, B as SignatureProtocol, T as TokenCertSessionBlock, G as TokenCertStatus, V as ValidationError, J as deviceLink, K as isMobileUserAgent, L as openOrShowQR, M as parseRetryAfter, Q as sessionExpiry } from './browser-CuMH5IVG.cjs';
+import { R as RpCredentials, C as CertificateLevel, I as Interaction, S as SignatureAlgorithm, H as HashAlgorithm, N as NotificationSession, D as DeviceLinkSession, a as SessionResult, P as PersonBlock, b as PdfSessionBlock, c as RepresentationsResponse, A as AcspContext, F as FlowType } from './browser-CSZjH9Xs.cjs';
+export { d as ApiError, e as AuthenticationError, f as CertChoiceInvalidError, g as DEFAULT_SIGN_SESSION_TTL_MS, h as DeviceLinkError, i as DeviceLinkInput, E as EidError, j as EndResult, k as ForbiddenError, l as HttpErrorInit, m as NavigatorLike, n as NetworkError, o as NoSigningCertificateError, O as ON_BEHALF_ERROR_CODES, p as OnBehalfErrorCode, q as OpenOrShowQROptions, r as OrgResult, s as PdfDocumentStatus, t as PdfSigner, u as RETRYABLE_ERROR_CODES, v as Representation, w as RequestInvalidError, x as ResponseTooLargeError, y as RetryableErrorCode, z as SessionFailedError, B as SessionState, G as SignContext, J as SignatureAlgorithmParameters, K as SignatureProtocol, T as TokenCertSessionBlock, L as TokenCertStatus, V as ValidationError, M as deviceLink, Q as isMobileUserAgent, U as openOrShowQR, W as parseExpiresAt, X as parseRetryAfter, Y as sessionExpiry, Z as startExpiry } from './browser-CSZjH9Xs.cjs';
 import { X509Certificate, KeyObject } from 'node:crypto';
 
 interface HttpConfig {

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { R as RpCredentials, C as CertificateLevel, I as Interaction, S as SignatureAlgorithm, H as HashAlgorithm, N as NotificationSession, D as DeviceLinkSession, a as SessionResult, P as PersonBlock, b as PdfSessionBlock, c as RepresentationsResponse, A as AcspContext, F as FlowType } from './browser-CuMH5IVG.js';
-export { d as ApiError, e as AuthenticationError, f as DEFAULT_SIGN_SESSION_TTL_MS, g as DeviceLinkError, h as DeviceLinkInput, E as EidError, i as EndResult, j as ForbiddenError, k as HttpErrorInit, l as NavigatorLike, m as NetworkError, O as ON_BEHALF_ERROR_CODES, n as OnBehalfErrorCode, o as OpenOrShowQROptions, p as OrgResult, q as PdfDocumentStatus, r as PdfSigner, s as RETRYABLE_ERROR_CODES, t as Representation, u as ResponseTooLargeError, v as RetryableErrorCode, w as SessionFailedError, x as SessionState, y as SignContext, z as SignatureAlgorithmParameters, B as SignatureProtocol, T as TokenCertSessionBlock, G as TokenCertStatus, V as ValidationError, J as deviceLink, K as isMobileUserAgent, L as openOrShowQR, M as parseRetryAfter, Q as sessionExpiry } from './browser-CuMH5IVG.js';
+import { R as RpCredentials, C as CertificateLevel, I as Interaction, S as SignatureAlgorithm, H as HashAlgorithm, N as NotificationSession, D as DeviceLinkSession, a as SessionResult, P as PersonBlock, b as PdfSessionBlock, c as RepresentationsResponse, A as AcspContext, F as FlowType } from './browser-CSZjH9Xs.js';
+export { d as ApiError, e as AuthenticationError, f as CertChoiceInvalidError, g as DEFAULT_SIGN_SESSION_TTL_MS, h as DeviceLinkError, i as DeviceLinkInput, E as EidError, j as EndResult, k as ForbiddenError, l as HttpErrorInit, m as NavigatorLike, n as NetworkError, o as NoSigningCertificateError, O as ON_BEHALF_ERROR_CODES, p as OnBehalfErrorCode, q as OpenOrShowQROptions, r as OrgResult, s as PdfDocumentStatus, t as PdfSigner, u as RETRYABLE_ERROR_CODES, v as Representation, w as RequestInvalidError, x as ResponseTooLargeError, y as RetryableErrorCode, z as SessionFailedError, B as SessionState, G as SignContext, J as SignatureAlgorithmParameters, K as SignatureProtocol, T as TokenCertSessionBlock, L as TokenCertStatus, V as ValidationError, M as deviceLink, Q as isMobileUserAgent, U as openOrShowQR, W as parseExpiresAt, X as parseRetryAfter, Y as sessionExpiry, Z as startExpiry } from './browser-CSZjH9Xs.js';
 import { X509Certificate, KeyObject } from 'node:crypto';
 
 interface HttpConfig {

package/dist/index.js

@@ -1,12 +1,15 @@
 import {
   ApiError,
   AuthenticationError,
+  CertChoiceInvalidError,
   DeviceLinkError,
   EidError,
   ForbiddenError,
   NetworkError,
+  NoSigningCertificateError,
   ON_BEHALF_ERROR_CODES,
   RETRYABLE_ERROR_CODES,
+  RequestInvalidError,
   ResponseTooLargeError,
   SessionFailedError,
   ValidationError,
@@ -15,7 +18,7 @@ import {
   maskPath,
   openOrShowQR,
   parseRetryAfter
-} from "./chunk-QPJDZLHR.js";
+} from "./chunk-DXVHOZO7.js";
 
 // src/http.ts
 var DEFAULT_TIMEOUT_MS = 15e3;
@@ -85,7 +88,8 @@ var Http = class {
         { headers, retryAfterMs }
       );
     }
-    throw new ApiError(res.status, text, code, { headers, retryAfterMs });
+    const Typed = code === "NO_SIGNING_CERTIFICATE" ? NoSigningCertificateError : code === "CERT_CHOICE_INVALID" ? CertChoiceInvalidError : code === "REQUEST_INVALID" ? RequestInvalidError : ApiError;
+    throw new Typed(res.status, text, code, { headers, retryAfterMs });
   }
 };
 async function readLimited(res, limit, op) {
@@ -211,6 +215,21 @@ function acspV2Digest(p, hashAlgorithm) {
   return createHash(nodeHash(hashAlgorithm)).update(buildAcspV2Payload(p)).digest();
 }
 
+// src/types.ts
+var DEFAULT_SIGN_SESSION_TTL_MS = 6e5;
+function sessionExpiry(sentAtMs, ttlMs) {
+  return sentAtMs + (ttlMs && ttlMs > 0 ? ttlMs : DEFAULT_SIGN_SESSION_TTL_MS);
+}
+function parseExpiresAt(v) {
+  if (typeof v !== "string" || !/^\d{4}-\d{2}-\d{2}T/.test(v)) return void 0;
+  const t = Date.parse(v);
+  return Number.isFinite(t) ? t : void 0;
+}
+function startExpiry(raw, sentAtMs, ttlMs) {
+  const r = raw && typeof raw === "object" ? raw : {};
+  return parseExpiresAt(r.expiresAt) ?? sessionExpiry(sentAtMs, ttlMs);
+}
+
 // src/auth.ts
 function rec(v) {
   return v && typeof v === "object" ? v : {};
@@ -256,11 +275,19 @@ var AuthApi = class {
   parseNotification(raw, acsp) {
     const r = rec(raw);
     const vc = rec(r.vc).value;
-    return { sessionId: String(r.sessionID), vc: vc != null ? String(vc) : null, rpChallenge: acsp.rpChallenge, acsp };
+    const expiresAt = parseExpiresAt(r.expiresAt);
+    return {
+      sessionId: String(r.sessionID),
+      vc: vc != null ? String(vc) : null,
+      rpChallenge: acsp.rpChallenge,
+      acsp,
+      ...expiresAt !== void 0 ? { expiresAt } : {}
+    };
   }
   parseDeviceLink(raw, acsp) {
     const r = rec(raw);
     const vc = typeof r.vc === "object" && r.vc !== null ? rec(r.vc).value : r.vc;
+    const expiresAt = parseExpiresAt(r.expiresAt);
     return {
       sessionId: String(r.sessionID),
       sessionToken: r.sessionToken != null ? String(r.sessionToken) : null,
@@ -270,7 +297,8 @@ var AuthApi = class {
       rpChallenge: acsp.rpChallenge,
       acsp,
       receivedAt: Date.now(),
-      sessionType: "auth"
+      sessionType: "auth",
+      ...expiresAt !== void 0 ? { expiresAt } : {}
     };
   }
   /** Push — РД/иргэний дугаар/ETSI-ээр (сервер төрлийг таьна). Иргэний утас руу мэдэгдэл очно. */
@@ -299,12 +327,6 @@ var AuthApi = class {
   }
 };
 
-// src/types.ts
-var DEFAULT_SIGN_SESSION_TTL_MS = 6e5;
-function sessionExpiry(sentAtMs, ttlMs) {
-  return sentAtMs + (ttlMs && ttlMs > 0 ? ttlMs : DEFAULT_SIGN_SESSION_TTL_MS);
-}
-
 // src/sign.ts
 function rec2(v) {
   return v && typeof v === "object" ? v : {};
@@ -356,7 +378,7 @@ var SignApi = class {
       vc: vcOf(r),
       rpChallenge: "",
       ...sign ? { sign } : {},
-      expiresAt: sessionExpiry(sent, this.defaults.sessionTtlMs)
+      expiresAt: startExpiry(r, sent, this.defaults.sessionTtlMs)
     };
   }
   async deviceLink(path, body, extra) {
@@ -371,7 +393,7 @@ var SignApi = class {
       rpChallenge: "",
       receivedAt: Date.now(),
       ...extra,
-      expiresAt: sessionExpiry(sent, this.defaults.sessionTtlMs)
+      expiresAt: startExpiry(r, sent, this.defaults.sessionTtlMs)
     };
   }
   /**
@@ -2264,6 +2286,7 @@ export {
   AuthApi,
   AuthenticationError,
   CITIZEN_ISSUING_CA_SKI,
+  CertChoiceInvalidError,
   DEFAULT_BASE_URL,
   DEFAULT_PDF_MAX_BYTES,
   DEFAULT_PDF_TIMEOUT_MS,
@@ -2274,11 +2297,13 @@ export {
   ForbiddenError,
   Http,
   NetworkError,
+  NoSigningCertificateError,
   ON_BEHALF_ERROR_CODES,
   OrganizationApi,
   PdfApi,
   PersonApi,
   RETRYABLE_ERROR_CODES,
+  RequestInvalidError,
   ResponseTooLargeError,
   ResponseValidator,
   SessionApi,
@@ -2297,6 +2322,7 @@ export {
   isMobileUserAgent,
   memoryLoginStore,
   openOrShowQR,
+  parseExpiresAt,
   parseRetryAfter,
   parseSessionResult,
   parseSubject,
@@ -2306,6 +2332,7 @@ export {
   resolveBaseUrl,
   sessionExpiry,
   sha256Base64,
+  startExpiry,
   tokenAuthDigest,
   tokenLimitOf,
   userChallengeOf,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gerege-systems/eid-mongolia-sdk",
-  "version": "0.14.1",
+  "version": "0.14.2",
   "description": "e-ID Mongolia Relying Party SDK — иргэнээр утсаар нь нэвтрэлт ба хууль ёсны цахим гарын үсэг (RP-API v3, Smart-ID нийцтэй).",
   "license": "MIT",
   "type": "module",
@@ -34,7 +34,7 @@
   },
   "scripts": {
     "build": "tsup src/index.ts src/browser.ts --format esm,cjs --dts --clean && tsup src/button.ts --format esm,cjs --dts --tsconfig tsconfig.button.json",
-    "test": "npm run build && node --test --experimental-strip-types test/sdk.test.ts test/portal-gaps.test.ts test/chain.test.ts test/qr.test.ts test/login.test.ts test/button.test.ts test/sign-gaps.test.ts",
+    "test": "npm run build && node --test --experimental-strip-types test/sdk.test.ts test/portal-gaps.test.ts test/chain.test.ts test/qr.test.ts test/login.test.ts test/button.test.ts test/sign-gaps.test.ts test/session-start.test.ts",
     "test:contract": "npm run build && node --experimental-strip-types test/contract.test.ts",
     "lint": "tsc --noEmit && tsc --noEmit -p tsconfig.button.json"
   },