@gerege-systems/eid-mongolia-sdk 0.15.0 → 0.15.2

package/dist/index.cjs

@@ -52,12 +52,14 @@ __export(index_exports, {
   buildDeviceLink: () => buildDeviceLink,
   buildRegisterBody: () => buildRegisterBody,
   createEidLogin: () => createEidLogin,
+  defaultRateLimit: () => defaultRateLimit,
   deviceLink: () => deviceLink,
   deviceLinkInput: () => deviceLinkInput,
   forwardedClientIp: () => forwardedClientIp,
   interactionsToBase64: () => interactionsToBase64,
   isMobileUserAgent: () => isMobileUserAgent,
   memoryLoginStore: () => memoryLoginStore,
+  ocspRevocationChecker: () => ocspRevocationChecker,
   openOrShowQR: () => openOrShowQR,
   parseExpiresAt: () => parseExpiresAt,
   parseRetryAfter: () => parseRetryAfter,
@@ -223,6 +225,13 @@ var Http = class {
   post(path, body, timeoutMs) {
     return this.json("POST", path, JSON.stringify(body), "application/json", timeoutMs);
   }
+  /** {@link post} + HTTP статус (201 / 200-г ялгах: `POST /pdf/signatures`). */
+  async postWithStatus(path, body, timeoutMs) {
+    const op = `POST ${maskPath(path)}`;
+    const res = await this.send("POST", path, JSON.stringify(body), "application/json", timeoutMs);
+    const text = new TextDecoder().decode(await readLimited(res, MAX_JSON_BYTES, op));
+    return { status: res.status, body: text ? JSON.parse(text) : {} };
+  }
   get(path, timeoutMs) {
     return this.json("GET", path, void 0, void 0, timeoutMs);
   }
@@ -536,12 +545,32 @@ function registrationFromCompleted(done, extra) {
   if (extra.medium) out.medium = extra.medium;
   if (extra.sessionID) out.sessionID = extra.sessionID;
   if (done.hasPage && done.pageSha256) out.pageSha256 = done.pageSha256;
-  if (done.priorCmsSha256.length) out.priorCmsSha256 = done.priorCmsSha256;
-  if (extra.priorRevisionSha256?.length) out.priorRevisionSha256 = extra.priorRevisionSha256;
+  if (extra.priorRevisionSha256?.length) {
+    if (done.priorCmsSha256.length) out.priorCmsSha256 = done.priorCmsSha256;
+    out.priorRevisionSha256 = extra.priorRevisionSha256;
+  } else if (done.priorCmsSha256.length) {
+    out.priorCmsSha256 = done.priorCmsSha256;
+    const rev = done.priorRevisionSha256 ?? [];
+    if (rev.length === done.priorCmsSha256.length) {
+      out.priorSignatures = done.priorCmsSha256.map((c, i) => ({ cmsSha256: c, revisionSha256: rev[i] }));
+    }
+  }
   if (extra.onBehalfOf) out.onBehalfOf = extra.onBehalfOf;
   if (extra.signerEtsi) out.signerEtsi = extra.signerEtsi;
   return out;
 }
+function priorSplits(n) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (let k = 1; k <= n; k++) {
+    seen.add((1 << k) - 1);
+    out.push(Array.from({ length: n }, (_, i) => i < k));
+  }
+  if (n <= 4) {
+    for (let m = 1; m < 1 << n; m++) if (!seen.has(m)) out.push(Array.from({ length: n }, (_, i) => (m & 1 << i) !== 0));
+  }
+  return out;
+}
 var HEX64 = /^[0-9a-f]{64}$/;
 var MAX_CMS_BYTES = 28672;
 function buildRegisterBody(input) {
@@ -695,7 +724,7 @@ var SignApi = class {
    * (base64 → байт) `complete(state, signature)`-д.
    */
   async pdfDigest(input) {
-    const digest = dtbsBase64(input.dtbs);
+    const digest2 = dtbsBase64(input.dtbs);
     const fileName = input.fileName?.trim() ?? "";
     if (!fileName || Array.from(fileName).length > PDF_MAX_FILE_NAME) {
       throw new ValidationError(`pdfDigest: fileName \u0437\u0430\u0430\u0432\u0430\u043B, \u2264 ${PDF_MAX_FILE_NAME} \u0442\u044D\u043C\u0434\u044D\u0433\u0442`);
@@ -713,7 +742,7 @@ var SignApi = class {
       certificateLevel: input.certificateLevel ?? this.defaults.certificateLevel,
       signatureProtocol: "RAW_DIGEST_SIGNATURE",
       signatureProtocolParameters: {
-        digest,
+        digest: digest2,
         signatureAlgorithm: "sha256WithRSAEncryption",
         signatureAlgorithmParameters: { hashAlgorithm: "SHA-256" }
       },
@@ -733,7 +762,7 @@ var SignApi = class {
       }
       dl = { sessionToken: String(r.sessionToken), sessionSecret: String(r.sessionSecret), deviceLinkBase: String(r.deviceLinkBase) };
     }
-    return { sessionId: String(r.sessionID), vc: vc != null ? String(vc) : null, digest, interactions, deviceLink: dl, receivedAt };
+    return { sessionId: String(r.sessionID), vc: vc != null ? String(vc) : null, digest: digest2, interactions, deviceLink: dl, receivedAt };
   }
   /**
    * `POST /pdf/signatures` — `pades.complete()`-ийн дараа CMS-ийг CA-д бүртгэнэ (`/verify/{docID}`, иргэний түүх). PDF
@@ -743,16 +772,38 @@ var SignApi = class {
    * `/verify` «бүртгэлгүй» гэнэ.
    */
   async registerSignature(input) {
-    return this.registerBody(buildRegisterBody(input));
+    const body = buildRegisterBody(input);
+    const prior = input.priorSignatures ?? [];
+    if (input.priorRevisionSha256?.length || prior.length === 0 || prior.length !== input.revIndex - 1) return this.registerBody(body);
+    try {
+      return await this.registerBody(body);
+    } catch (first) {
+      if (!(first instanceof ApiError && first.code === "PRIOR_MISMATCH")) throw first;
+      for (const asRevision of priorSplits(prior.length)) {
+        const next = {
+          ...input,
+          priorSignatures: void 0,
+          priorCmsSha256: prior.filter((_, i) => !asRevision[i]).map((p) => p.cmsSha256),
+          priorRevisionSha256: prior.filter((_, i) => asRevision[i]).map((p) => p.revisionSha256)
+        };
+        try {
+          return await this.registerBody(buildRegisterBody(next));
+        } catch (e) {
+          if (!(e instanceof ApiError && e.code === "PRIOR_MISMATCH")) throw e;
+        }
+      }
+      throw first;
+    }
   }
   async registerBody(body) {
-    const raw = await this.http.post(routePath(RP_ROUTES.pdfSignatures), body);
+    const { status, body: raw } = await this.http.postWithStatus(routePath(RP_ROUTES.pdfSignatures), body);
     const r = rec2(raw);
     return {
       docID: String(r.docID ?? body.docID),
       revIndex: Number(r.revIndex ?? 0),
       registeredAt: typeof r.registeredAt === "string" ? r.registeredAt : "",
       verifyUrl: String(r.verifyUrl ?? ""),
+      created: status === 201,
       raw
     };
   }
@@ -1112,11 +1163,11 @@ function parseSubject(cert) {
       if (atv.tag !== 48) throw new ValidationError("subject: AttributeTypeAndValue SEQUENCE \u0431\u0438\u0448");
       const oidT = tlv(der, atv.start, atv.end);
       const valT = tlv(der, oidT.end, atv.end);
-      const oid = oidOf(der, oidT);
+      const oid2 = oidOf(der, oidT);
       const value = stringOf(der, valT);
-      if (value !== void 0 && !(oid in out.attributes)) {
-        out.attributes[oid] = value;
-        const key = OIDS[oid];
+      if (value !== void 0 && !(oid2 in out.attributes)) {
+        out.attributes[oid2] = value;
+        const key = OIDS[oid2];
         if (key) out[key] = value;
       }
       ap = atv.end;
@@ -1127,8 +1178,8 @@ function parseSubject(cert) {
   out.name = full || out.commonName || null;
   return out;
 }
-function certExtension(der, oid) {
-  return certExtensions(der).find((e) => e.oid === oid)?.value;
+function certExtension(der, oid2) {
+  return certExtensions(der).find((e) => e.oid === oid2)?.value;
 }
 function certExtensions(der) {
   const out = [];
@@ -1140,9 +1191,9 @@ function certExtensions(der) {
   for (let pos = f.end; pos < tbs.end; ) {
     const t = tlv(der, pos, tbs.end);
     if (t.tag === 163) {
-      const seq = tlv(der, t.start, t.end);
-      for (let ep = seq.start; ep < seq.end; ) {
-        const ext = tlv(der, ep, seq.end);
+      const seq2 = tlv(der, t.start, t.end);
+      for (let ep = seq2.start; ep < seq2.end; ) {
+        const ext = tlv(der, ep, seq2.end);
         const id = tlv(der, ext.start, ext.end);
         let v = tlv(der, id.end, ext.end);
         let critical = false;
@@ -1431,10 +1482,10 @@ var ResponseValidator = class {
         `\u0413\u044D\u0440\u0447\u0438\u043B\u0433\u044D\u044D certificate-choice-\u043E\u043E\u0440 \u0441\u043E\u043D\u0433\u043E\u0441\u043E\u043D\u0442\u043E\u0439 \u0442\u0430\u0430\u0440\u0430\u0445\u0433\u04AF\u0439 (serial ${leaf.serialNumber} \u2260 ${o.expectedCertificate.serialNumber})`
       );
     }
-    const digest = Buffer.from(digestB64, "base64");
+    const digest2 = Buffer.from(digestB64, "base64");
     const { alg, hash } = this.algorithmOf(result, leaf, o.expectedAlgorithm ?? null, hashAlgorithm);
-    if (digest.length !== hashLen(hash)) throw new ValidationError("digest \u0443\u0440\u0442 hashAlgorithm-\u0442\u0430\u0439 \u0442\u0430\u0430\u0440\u0430\u0445\u0433\u04AF\u0439");
-    if (!verifyPrehashedSignature(digest, result.signatureValueB64, leaf.publicKey, alg, hash)) {
+    if (digest2.length !== hashLen(hash)) throw new ValidationError("digest \u0443\u0440\u0442 hashAlgorithm-\u0442\u0430\u0439 \u0442\u0430\u0430\u0440\u0430\u0445\u0433\u04AF\u0439");
+    if (!verifyPrehashedSignature(digest2, result.signatureValueB64, leaf.publicKey, alg, hash)) {
       throw new ValidationError("\u0413\u0430\u0440\u044B\u043D \u04AF\u0441\u044D\u0433 \u04E9\u0433\u0441\u04E9\u043D digest-\u0442\u044D\u0439 \u0442\u0430\u0430\u0440\u0441\u0430\u043D\u0433\u04AF\u0439");
     }
     return {
@@ -1640,13 +1691,20 @@ var ResponseValidator = class {
    * "skipped" (hook алга). "revoked", мөн hard-fail горимд "unknown" → ValidationError; hook-ийн алдаа дамжина.
    */
   async checkRevocationStatus(cert) {
-    if (!this.revocation) return "skipped";
-    const status = await this.revocation(cert, this.findIssuer(cert));
+    return this.checkRevocationWith(cert, this.revocation, this.revocationMode);
+  }
+  /**
+   * {@link checkRevocationStatus}-тэй ижил, гэхдээ TrustConfig-ийн биш өгсөн checker ба горимоор (issuer-ийг trust
+   * pool-оос олно). checker алга бол "skipped"; горим анхдагч "hard-fail".
+   */
+  async checkRevocationWith(cert, checker, mode = "hard-fail") {
+    if (!checker) return "skipped";
+    const status = await checker(cert, this.findIssuer(cert));
     if (status === "good") return "good";
     if (status === "revoked") {
       throw new ValidationError("\u0413\u044D\u0440\u0447\u0438\u043B\u0433\u044D\u044D \u0446\u0443\u0446\u043B\u0430\u0433\u0434\u0441\u0430\u043D (revoked)");
     }
-    if (this.revocationMode === "hard-fail") {
+    if (mode === "hard-fail") {
       throw new ValidationError("\u0413\u044D\u0440\u0447\u0438\u043B\u0433\u044D\u044D\u043D\u0438\u0439 revocation \u0442\u04E9\u043B\u04E9\u0432 \u0442\u043E\u0433\u0442\u043E\u043E\u0433\u0434\u0441\u043E\u043D\u0433\u04AF\u0439 (hard-fail)");
     }
     return "unchecked";
@@ -1675,9 +1733,9 @@ function verifyPayloadSignature(payload, sigB64, key, alg, hash) {
   if (alg === "ecdsa-with-SHA256") return (0, import_node_crypto4.verify)(h, payload, { key, dsaEncoding: "der" }, sig);
   return (0, import_node_crypto4.verify)(h, payload, { key, padding: import_node_crypto4.constants.RSA_PKCS1_PADDING }, sig);
 }
-function verifyPrehashedSignature(digest, sigB64, key, alg, hash) {
+function verifyPrehashedSignature(digest2, sigB64, key, alg, hash) {
   const sig = Buffer.from(sigB64, "base64");
-  if (alg === "ecdsa-with-SHA256") return ecdsaP256VerifyPrehashed(digest, sig, key);
+  if (alg === "ecdsa-with-SHA256") return ecdsaP256VerifyPrehashed(digest2, sig, key);
   const modBits = key.asymmetricKeyDetails?.modulusLength ?? 0;
   if (!modBits || sig.length !== Math.ceil(modBits / 8)) return false;
   let em;
@@ -1686,10 +1744,10 @@ function verifyPrehashedSignature(digest, sigB64, key, alg, hash) {
   } catch {
     return false;
   }
-  if (alg === "rsassa-pss") return emsaPssVerify(digest, em, modBits - 1, hash);
+  if (alg === "rsassa-pss") return emsaPssVerify(digest2, em, modBits - 1, hash);
   const prefix = DIGEST_INFO[hash];
   if (!prefix) return false;
-  const t = Buffer.concat([prefix, digest]);
+  const t = Buffer.concat([prefix, digest2]);
   const expected = Buffer.concat([Buffer.from([0, 1]), Buffer.alloc(em.length - t.length - 3, 255), Buffer.from([0]), t]);
   return em.length === expected.length && em.equals(expected);
 }
@@ -1740,7 +1798,7 @@ function derInts(sig) {
   }
   return i === sig.length ? [out[0], out[1]] : null;
 }
-function ecdsaP256VerifyPrehashed(digest, sig, key) {
+function ecdsaP256VerifyPrehashed(digest2, sig, key) {
   if (key.asymmetricKeyDetails?.namedCurve !== "prime256v1") return false;
   const jwk = key.export({ format: "jwk" });
   if (!jwk.x || !jwk.y) return false;
@@ -1750,7 +1808,7 @@ function ecdsaP256VerifyPrehashed(digest, sig, key) {
   const [r, sv] = rs;
   const { n } = P256;
   if (r <= 0n || r >= n || sv <= 0n || sv >= n) return false;
-  const z = BigInt("0x" + digest.subarray(0, 32).toString("hex"));
+  const z = BigInt("0x" + digest2.subarray(0, 32).toString("hex"));
   const w = inv(sv, n);
   const R = ptAdd(ptMul(mod(z * w, n), [P256.gx, P256.gy]), ptMul(mod(r * w, n), Q));
   return R !== null && mod(R[0], n) === r;
@@ -1803,10 +1861,10 @@ function keyUsageBits(cert) {
 function extKeyUsage(cert) {
   const v = certExtension(cert.raw, "2.5.29.37");
   if (!v) return [];
-  const seq = tlv(v, 0, v.length);
+  const seq2 = tlv(v, 0, v.length);
   const out = [];
-  for (let p = seq.start; p < seq.end; ) {
-    const t = tlv(v, p, seq.end);
+  for (let p = seq2.start; p < seq2.end; ) {
+    const t = tlv(v, p, seq2.end);
     out.push(oidOf(v, t));
     p = t.end;
   }
@@ -1821,9 +1879,9 @@ function subjectKeyId(cert) {
 function authorityKeyId(cert) {
   const v = certExtension(cert.raw, "2.5.29.35");
   if (!v) return void 0;
-  const seq = tlv(v, 0, v.length);
-  if (seq.start >= seq.end) return void 0;
-  const k = tlv(v, seq.start, seq.end);
+  const seq2 = tlv(v, 0, v.length);
+  if (seq2.start >= seq2.end) return void 0;
+  const k = tlv(v, seq2.start, seq2.end);
   return k.tag === 128 && k.end > k.start ? Buffer.from(v.subarray(k.start, k.end)).toString("hex") : void 0;
 }
 function isCa(cert) {
@@ -1889,9 +1947,9 @@ function caReason(ca, below, now, usage) {
 function basicConstraintsPathLen(cert) {
   const v = certExtension(cert.raw, "2.5.29.19");
   if (!v) return void 0;
-  const seq = tlv(v, 0, v.length);
-  for (let p = seq.start; p < seq.end; ) {
-    const t = tlv(v, p, seq.end);
+  const seq2 = tlv(v, 0, v.length);
+  for (let p = seq2.start; p < seq2.end; ) {
+    const t = tlv(v, p, seq2.end);
     if (t.tag === 2) {
       if (t.end - t.start > 4 || (v[t.start] & 128) !== 0) throw new ValidationError("basicConstraints: pathLen \u0431\u0443\u0440\u0443\u0443");
       let n = 0;
@@ -1962,6 +2020,614 @@ var EidClient = class {
   }
 };
 
+// src/ocsp.ts
+var import_node_crypto5 = require("crypto");
+
+// src/pades/bytes.ts
+var enc = new TextEncoder();
+function concat(parts) {
+  let n = 0;
+  for (const p of parts) n += p.length;
+  const out = new Uint8Array(n);
+  let o = 0;
+  for (const p of parts) {
+    out.set(p, o);
+    o += p.length;
+  }
+  return out;
+}
+function equal(a, b) {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;
+  return true;
+}
+
+// src/pades/asn1.ts
+var Asn1Error = class extends Error {
+};
+var TAG = {
+  BOOLEAN: 1,
+  INTEGER: 2,
+  BIT_STRING: 3,
+  OCTET_STRING: 4,
+  NULL: 5,
+  OID: 6,
+  ENUMERATED: 10,
+  UTF8String: 12,
+  SEQUENCE: 48,
+  SET: 49,
+  PrintableString: 19,
+  IA5String: 22,
+  UTCTime: 23,
+  GeneralizedTime: 24
+};
+function readNode(b, off = 0) {
+  if (off + 2 > b.length) throw new Asn1Error("asn1: \u0434\u0443\u0442\u0443\u0443");
+  const tag = b[off];
+  if ((tag & 31) === 31) throw new Asn1Error("asn1: \u043E\u043B\u043E\u043D \u0431\u0430\u0439\u0442 tag \u0434\u044D\u043C\u0436\u0438\u0433\u0434\u044D\u0445\u0433\u04AF\u0439");
+  let len = b[off + 1];
+  let p = off + 2;
+  if (len & 128) {
+    const n = len & 127;
+    if (n === 0 || n > 4) throw new Asn1Error("asn1: \u0443\u0440\u0442 \u0431\u0443\u0440\u0443\u0443");
+    if (p + n > b.length) throw new Asn1Error("asn1: \u0434\u0443\u0442\u0443\u0443");
+    if (b[p] === 0) throw new Asn1Error("asn1: \u0443\u0440\u0442 minimal \u0431\u0438\u0448");
+    len = 0;
+    for (let i = 0; i < n; i++) len = len * 256 + b[p + i];
+    if (len < 128) throw new Asn1Error("asn1: \u0443\u0440\u0442 minimal \u0431\u0438\u0448");
+    p += n;
+  }
+  if (p + len > b.length) throw new Asn1Error("asn1: \u0434\u0443\u0442\u0443\u0443");
+  return { tag, raw: b.subarray(off, p + len), value: b.subarray(p, p + len) };
+}
+function parseOne(b) {
+  const n = readNode(b, 0);
+  if (n.raw.length !== b.length) throw new Asn1Error("asn1: \u0438\u043B\u04AF\u04AF \u04E9\u0433\u04E9\u0433\u0434\u04E9\u043B");
+  return n;
+}
+function children(n) {
+  const v = n instanceof Uint8Array ? n : n.value;
+  const out = [];
+  for (let p = 0; p < v.length; ) {
+    const c = readNode(v, p);
+    out.push(c);
+    p += c.raw.length;
+  }
+  return out;
+}
+function expect(n, tag, what) {
+  if (!n || n.tag !== tag) throw new Asn1Error(`asn1: ${what} \u0445\u04AF\u043B\u044D\u044D\u0441\u044D\u043D`);
+  return n;
+}
+function lenBytes(n) {
+  if (n < 128) return Uint8Array.of(n);
+  const out = [];
+  for (let x = n; x > 0; x = Math.floor(x / 256)) out.unshift(x & 255);
+  return Uint8Array.from([128 | out.length, ...out]);
+}
+function tlv2(tag, ...content) {
+  const v = concat(content);
+  return concat([Uint8Array.of(tag), lenBytes(v.length), v]);
+}
+var seq = (...c) => tlv2(TAG.SEQUENCE, ...c);
+var octet = (b) => tlv2(TAG.OCTET_STRING, b);
+var nullDer = () => Uint8Array.of(5, 0);
+function oid(s) {
+  const parts = s.split(".").map((x) => BigInt(x));
+  const body = [];
+  const enc2 = (v) => {
+    const tmp = [Number(v & 0x7fn)];
+    for (v >>= 7n; v > 0n; v >>= 7n) tmp.unshift(Number(v & 0x7fn) | 128);
+    body.push(...tmp);
+  };
+  enc2(parts[0] * 40n + parts[1]);
+  for (const p of parts.slice(2)) enc2(p);
+  return tlv2(TAG.OID, Uint8Array.from(body));
+}
+function oidString(v) {
+  const out = [];
+  let cur = 0n;
+  for (const b of v) {
+    cur = cur << 7n | BigInt(b & 127);
+    if (!(b & 128)) {
+      out.push(cur);
+      cur = 0n;
+    }
+  }
+  if (out.length === 0) return "";
+  const first = out[0];
+  const a = first < 40n ? 0n : first < 80n ? 1n : 2n;
+  return [a, first - a * 40n, ...out.slice(1)].join(".");
+}
+function bigFromBytes(b) {
+  let v = 0n;
+  for (const x of b) v = v << 8n | BigInt(x);
+  return v;
+}
+function intValue(v) {
+  if (v.length === 0) throw new Asn1Error("asn1: \u0445\u043E\u043E\u0441\u043E\u043D INTEGER");
+  let x = bigFromBytes(v);
+  if (v[0] & 128) x -= 1n << BigInt(v.length * 8);
+  return x;
+}
+function parseTime(n) {
+  const s = String.fromCharCode(...n.value);
+  let m;
+  if (n.tag === TAG.UTCTime) {
+    m = /^(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})?(Z|[+-]\d{4})$/.exec(s);
+    if (!m) throw new Asn1Error("asn1: UTCTime \u0431\u0443\u0440\u0443\u0443");
+    let y = Number(m[1]);
+    y += y < 50 ? 2e3 : 1900;
+    return mkDate(y, m[2], m[3], m[4], m[5], m[6] ?? "00", "", m[7]);
+  }
+  if (n.tag === TAG.GeneralizedTime) {
+    m = /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\.\d+)?(Z|[+-]\d{4})$/.exec(s);
+    if (!m) throw new Asn1Error("asn1: GeneralizedTime \u0431\u0443\u0440\u0443\u0443");
+    return mkDate(Number(m[1]), m[2], m[3], m[4], m[5], m[6], m[7] ?? "", m[8]);
+  }
+  throw new Asn1Error("asn1: \u0446\u0430\u0433 \u0445\u04AF\u043B\u044D\u044D\u0441\u044D\u043D");
+}
+function parsePreciseTime(n) {
+  const date = parseTime(n);
+  const m = /\.(\d+)/.exec(String.fromCharCode(...n.value));
+  const nanos = m ? Number((m[1] + "000000000").slice(0, 9)) : 0;
+  return { date, nanos };
+}
+function mkDate(y, mo, d, h, mi, s, frac, z) {
+  let t = Date.UTC(y, Number(mo) - 1, Number(d), Number(h), Number(mi), Number(s));
+  if (frac) t += Math.floor(Number("0" + frac) * 1e3);
+  if (z !== "Z") {
+    const off = (Number(z.slice(1, 3)) * 60 + Number(z.slice(3, 5))) * 6e4;
+    t += z[0] === "+" ? -off : off;
+  }
+  return new Date(t);
+}
+
+// src/pades/crypto.ts
+var subtlePromise;
+var nodeImport = (m) => import(
+  /* @vite-ignore */
+  /* webpackIgnore: true */
+  m
+);
+async function webcrypto() {
+  const g = globalThis.crypto;
+  if (g?.subtle) return g;
+  const m = await nodeImport("node:crypto");
+  if (!m.webcrypto) throw new Error("Web Crypto \u0430\u043B\u0433\u0430");
+  return m.webcrypto;
+}
+function subtle() {
+  subtlePromise ??= webcrypto().then((c) => c.subtle);
+  return subtlePromise;
+}
+async function sha1(b) {
+  return new Uint8Array(await (await subtle()).digest("SHA-1", b));
+}
+
+// src/pades/x509.ts
+var OID = {
+  rsaEncryption: "1.2.840.113549.1.1.1",
+  rsaPSS: "1.2.840.113549.1.1.10",
+  sha256WithRSA: "1.2.840.113549.1.1.11",
+  sha384WithRSA: "1.2.840.113549.1.1.12",
+  sha512WithRSA: "1.2.840.113549.1.1.13",
+  ecPublicKey: "1.2.840.10045.2.1",
+  ecdsaSHA256: "1.2.840.10045.4.3.2",
+  ecdsaSHA384: "1.2.840.10045.4.3.3",
+  ecdsaSHA512: "1.2.840.10045.4.3.4",
+  p256: "1.2.840.10045.3.1.7",
+  p384: "1.3.132.0.34",
+  p521: "1.3.132.0.35",
+  sha1: "1.3.14.3.2.26",
+  sha256: "2.16.840.1.101.3.4.2.1",
+  sha384: "2.16.840.1.101.3.4.2.2",
+  sha512: "2.16.840.1.101.3.4.2.3",
+  commonName: "2.5.4.3",
+  surname: "2.5.4.4",
+  givenName: "2.5.4.42",
+  extKeyUsage: "2.5.29.37",
+  keyUsage: "2.5.29.15",
+  basicConstraints: "2.5.29.19",
+  crlDP: "2.5.29.31",
+  aia: "1.3.6.1.5.5.7.1.1",
+  ocspMethod: "1.3.6.1.5.5.7.48.1",
+  kpTimeStamping: "1.3.6.1.5.5.7.3.8",
+  kpOCSPSigning: "1.3.6.1.5.5.7.3.9",
+  kpAny: "2.5.29.37.0"
+};
+var CertError = class extends Error {
+};
+function bitString(n) {
+  expect(n, TAG.BIT_STRING, "BIT STRING");
+  if (n.value.length === 0) throw new Asn1Error("BIT STRING \u0445\u043E\u043E\u0441\u043E\u043D");
+  return n.value.subarray(1);
+}
+function decodeDirString(n) {
+  if (n.tag === 30) {
+    let s = "";
+    for (let i = 0; i + 1 < n.value.length; i += 2) s += String.fromCharCode(n.value[i] << 8 | n.value[i + 1]);
+    return s;
+  }
+  if (n.tag === TAG.UTF8String) return new TextDecoder().decode(n.value);
+  return String.fromCharCode(...n.value);
+}
+function nameAttrs(name) {
+  const out = [];
+  for (const rdn of children(name)) {
+    for (const atv of children(rdn)) {
+      const [t, v] = children(atv);
+      if (!t || !v) continue;
+      out.push([oidString(t.value), decodeDirString(v)]);
+    }
+  }
+  return out;
+}
+function parseCertificate(der) {
+  try {
+    const top = parseOne(der);
+    expect(top, TAG.SEQUENCE, "Certificate");
+    const [tbsN, sigAlg, sigN] = children(top);
+    const tbs = expect(tbsN, TAG.SEQUENCE, "TBSCertificate");
+    const f = children(tbs);
+    let i = 0;
+    let version = 1;
+    if (f[0]?.tag === 160) {
+      const v = expect(children(f[0])[0], TAG.INTEGER, "version");
+      version = v.value[0] + 1;
+      i++;
+    }
+    const serial = expect(f[i++], TAG.INTEGER, "serial").value;
+    i++;
+    const issuer = expect(f[i++], TAG.SEQUENCE, "issuer");
+    const validity = children(expect(f[i++], TAG.SEQUENCE, "validity"));
+    const subject = expect(f[i++], TAG.SEQUENCE, "subject");
+    const spki = expect(f[i++], TAG.SEQUENCE, "SPKI");
+    const [algN, pkN] = children(spki);
+    const algParts = children(expect(algN, TAG.SEQUENCE, "AlgorithmIdentifier"));
+    const keyAlg = oidString(expect(algParts[0], TAG.OID, "alg").value);
+    const curve = keyAlg === OID.ecPublicKey && algParts[1]?.tag === TAG.OID ? oidString(algParts[1].value) : void 0;
+    const extensions = [];
+    for (; i < f.length; i++) {
+      if (f[i].tag !== 163) continue;
+      for (const e of children(expect(children(f[i])[0], TAG.SEQUENCE, "extensions"))) {
+        const p = children(e);
+        const o = oidString(expect(p[0], TAG.OID, "ext oid").value);
+        let critical = false;
+        let val = p[1];
+        if (val?.tag === TAG.BOOLEAN) {
+          critical = val.value[0] !== 0;
+          val = p[2];
+        }
+        extensions.push({ oid: o, critical, value: expect(val, TAG.OCTET_STRING, "ext value").value });
+      }
+    }
+    const subj = nameAttrs(subject);
+    const iss = nameAttrs(issuer);
+    const last = (a, o) => a.filter(([k]) => k === o).map(([, v]) => v).pop() ?? "";
+    const cert = {
+      raw: top.raw,
+      tbs: tbs.raw,
+      version,
+      serial,
+      sigAlg: expect(sigAlg, TAG.SEQUENCE, "sigAlg"),
+      signature: bitString(sigN),
+      rawIssuer: issuer.raw,
+      rawSubject: subject.raw,
+      spki: spki.raw,
+      keyAlg,
+      curve,
+      publicKey: bitString(pkN),
+      notBefore: parseTime(validity[0]),
+      notAfter: parseTime(validity[1]),
+      extensions,
+      subjectCN: last(subj, OID.commonName),
+      issuerCN: last(iss, OID.commonName),
+      // Go SignerDisplayName: Subject.Names-ийн давталтын сүүлийн утга.
+      givenName: last(subj, OID.givenName),
+      surname: last(subj, OID.surname),
+      ocspServers: [],
+      crlDPs: [],
+      isCA: false,
+      basicConstraintsValid: false,
+      keyUsage: 0,
+      extKeyUsage: []
+    };
+    for (const e of extensions) parseExtension(cert, e);
+    return cert;
+  } catch (e) {
+    throw new CertError(`\u0433\u044D\u0440\u0447\u0438\u043B\u0433\u044D\u044D \u0437\u0430\u0434\u0430\u0440\u0441\u0430\u043D\u0433\u04AF\u0439: ${e instanceof Error ? e.message : String(e)}`);
+  }
+}
+function parseExtension(c, e) {
+  const n = parseOne(e.value);
+  switch (e.oid) {
+    case OID.basicConstraints: {
+      c.basicConstraintsValid = true;
+      const p = children(n);
+      c.isCA = p[0]?.tag === TAG.BOOLEAN && p[0].value[0] !== 0;
+      break;
+    }
+    case OID.keyUsage: {
+      const bs = n.value;
+      let ku = 0;
+      for (let i = 1; i < bs.length; i++) {
+        for (let b = 0; b < 8; b++) if (bs[i] & 128 >> b) ku |= 1 << (i - 1) * 8 + b;
+      }
+      c.keyUsage = ku;
+      break;
+    }
+    case OID.extKeyUsage:
+      c.extKeyUsage = children(n).map((x) => oidString(x.value));
+      break;
+    case OID.aia:
+      for (const ad of children(n)) {
+        const [m, loc] = children(ad);
+        if (m && loc && oidString(m.value) === OID.ocspMethod && loc.tag === 134) c.ocspServers.push(String.fromCharCode(...loc.value));
+      }
+      break;
+    case OID.crlDP:
+      for (const dp of children(n)) {
+        for (const f of children(dp)) {
+          if (f.tag !== 160) continue;
+          for (const fn of children(f)) {
+            if (fn.tag !== 160) continue;
+            for (const gn of children(fn)) if (gn.tag === 134) c.crlDPs.push(String.fromCharCode(...gn.value));
+          }
+        }
+      }
+      break;
+  }
+}
+var HASH_BY_OID = {
+  [OID.sha1]: "SHA-1",
+  [OID.sha256]: "SHA-256",
+  [OID.sha384]: "SHA-384",
+  [OID.sha512]: "SHA-512"
+};
+function schemeFor(alg) {
+  const p = children(alg);
+  const o = oidString(expect(p[0], TAG.OID, "sigAlg").value);
+  switch (o) {
+    case "1.2.840.113549.1.1.5":
+      return { kind: "rsa", hash: "SHA-1" };
+    case OID.sha256WithRSA:
+      return { kind: "rsa", hash: "SHA-256" };
+    case OID.sha384WithRSA:
+      return { kind: "rsa", hash: "SHA-384" };
+    case OID.sha512WithRSA:
+      return { kind: "rsa", hash: "SHA-512" };
+    case OID.ecdsaSHA256:
+      return { kind: "ecdsa", hash: "SHA-256" };
+    case OID.ecdsaSHA384:
+      return { kind: "ecdsa", hash: "SHA-384" };
+    case OID.ecdsaSHA512:
+      return { kind: "ecdsa", hash: "SHA-512" };
+    case OID.rsaPSS: {
+      let hash = "SHA-1";
+      let salt = 20;
+      for (const f of p[1] ? children(p[1]) : []) {
+        if (f.tag === 160) hash = HASH_BY_OID[oidString(children(children(f)[0])[0].value)] ?? hash;
+        if (f.tag === 162) salt = Number(children(f)[0].value[0]);
+      }
+      return { kind: "pss", hash, saltLength: salt };
+    }
+  }
+  throw new CertError(`\u0433\u0430\u0440\u044B\u043D \u04AF\u0441\u0433\u0438\u0439\u043D \u0430\u043B\u0433\u043E\u0440\u0438\u0442\u043C \u0434\u044D\u043C\u0436\u0438\u0433\u0434\u044D\u0445\u0433\u04AF\u0439: ${o}`);
+}
+var CURVES = {
+  [OID.p256]: { name: "P-256", size: 32 },
+  [OID.p384]: { name: "P-384", size: 48 },
+  [OID.p521]: { name: "P-521", size: 66 }
+};
+function ecdsaDerToRaw(der, size) {
+  const [r, s] = children(parseOne(der));
+  const out = new Uint8Array(2 * size);
+  const put = (v, at) => {
+    let x = v;
+    while (x.length > 0 && x[0] === 0) x = x.subarray(1);
+    if (x.length > size) throw new CertError("ECDSA \u0443\u0442\u0433\u0430 \u0445\u044D\u0442 \u0443\u0440\u0442");
+    out.set(x, at + size - x.length);
+  };
+  put(expect(r, TAG.INTEGER, "r").value, 0);
+  put(expect(s, TAG.INTEGER, "s").value, size);
+  return out;
+}
+async function verifySignature(pub, alg, data, sig) {
+  const sch = schemeFor(alg);
+  return verifyWith(pub, sch, data, sig);
+}
+async function verifyWith(pub, sch, data, sig) {
+  const s = await subtle();
+  try {
+    if (sch.kind === "ecdsa") {
+      if (pub.keyAlg !== OID.ecPublicKey) return false;
+      const c = CURVES[pub.curve ?? ""];
+      if (!c) return false;
+      const key2 = await s.importKey("spki", pub.spki, { name: "ECDSA", namedCurve: c.name }, false, ["verify"]);
+      return await s.verify({ name: "ECDSA", hash: sch.hash }, key2, ecdsaDerToRaw(sig, c.size), data);
+    }
+    if (pub.keyAlg !== OID.rsaEncryption) return false;
+    if (sch.kind === "pss") {
+      const key2 = await s.importKey("spki", pub.spki, { name: "RSA-PSS", hash: sch.hash }, false, ["verify"]);
+      return await s.verify({ name: "RSA-PSS", saltLength: sch.saltLength ?? 32 }, key2, sig, data);
+    }
+    const key = await s.importKey("spki", pub.spki, { name: "RSASSA-PKCS1-v1_5", hash: sch.hash }, false, ["verify"]);
+    return await s.verify({ name: "RSASSA-PKCS1-v1_5" }, key, sig, data);
+  } catch {
+    return false;
+  }
+}
+function checkSignature(parent, alg, signed, sig) {
+  return verifySignature(parent, alg, signed, sig);
+}
+var HANDLED = /* @__PURE__ */ new Set([
+  OID.keyUsage,
+  OID.extKeyUsage,
+  OID.basicConstraints,
+  "2.5.29.17",
+  // SAN
+  "2.5.29.30",
+  // name constraints
+  "2.5.29.32",
+  // policies
+  OID.crlDP,
+  OID.aia,
+  "2.5.29.14",
+  "2.5.29.35"
+]);
+
+// src/pades/cms.ts
+var HASHES2 = {
+  [OID.sha1]: "SHA-1",
+  [OID.sha256]: "SHA-256",
+  [OID.sha384]: "SHA-384",
+  [OID.sha512]: "SHA-512"
+};
+
+// src/pades/ltv.ts
+var MAX_TSA_SKEW_MS = 10 * 6e4;
+async function ocspRequest(c, issuer) {
+  const keyHash = await sha1(issuer.publicKey);
+  const nameHash = await sha1(issuer.rawSubject);
+  const certID = seq(seq(oid(OID.sha1), nullDer()), octet(nameHash), octet(keyHash), Uint8Array.of(TAG.INTEGER, ...lenOf(c.serial.length), ...c.serial));
+  return seq(seq(seq(seq(certID))));
+}
+function lenOf(n) {
+  if (n < 128) return [n];
+  const out = [];
+  for (let x = n; x > 0; x = Math.floor(x / 256)) out.unshift(x & 255);
+  return [128 | out.length, ...out];
+}
+var OID_OCSP_BASIC = "1.3.6.1.5.5.7.48.1.1";
+async function parseOCSPForCert(der, c, issuer) {
+  const top = children(expect(parseOne(der), TAG.SEQUENCE, "OCSPResponse"));
+  if (expect(top[0], TAG.ENUMERATED, "status").value[0] !== 0) throw new Error("OCSP response status");
+  const rb = children(expect(children(expect(top[1], 160, "responseBytes"))[0], TAG.SEQUENCE, "ResponseBytes"));
+  if (oidString(expect(rb[0], TAG.OID, "responseType").value) !== OID_OCSP_BASIC) throw new Error("bad OCSP response type");
+  const basic = children(expect(parseOne(expect(rb[1], TAG.OCTET_STRING, "response").value), TAG.SEQUENCE, "BasicOCSPResponse"));
+  const tbs = expect(basic[0], TAG.SEQUENCE, "tbsResponseData");
+  const sigAlg = expect(basic[1], TAG.SEQUENCE, "sigAlg");
+  const sigBits = expect(basic[2], TAG.BIT_STRING, "signature").value.subarray(1);
+  const tf = children(tbs);
+  let i = 0;
+  if (tf[0]?.tag === 160) i++;
+  const rid = tf[i++];
+  if (rid.tag !== 161 && rid.tag !== 162) throw new Error("invalid responder id tag");
+  i++;
+  const responses = children(expect(tf[i], TAG.SEQUENCE, "responses"));
+  if (responses.length === 0) throw new Error("OCSP response contains bad number of responses");
+  const serial = intValue(c.serial);
+  let single;
+  for (const r of responses) {
+    const f = children(r);
+    const cid2 = children(f[0]);
+    if (intValue(expect(cid2[3], TAG.INTEGER, "serial").value) === serial) {
+      single = f;
+      break;
+    }
+  }
+  if (!single) throw new Error("no response matching the supplied certificate");
+  let certificate;
+  if (basic[3]?.tag === 160) {
+    const certs = children(expect(children(basic[3])[0], TAG.SEQUENCE, "certs"));
+    if (certs[0]) certificate = parseCertificate(certs[0].raw);
+  }
+  if (certificate) {
+    if (!await verifySignature(certificate, sigAlg, tbs.raw, sigBits)) throw new Error("bad signature on embedded certificate");
+    if (!await checkSignature(issuer, certificate.sigAlg, certificate.tbs, certificate.signature)) throw new Error("bad OCSP signature");
+  } else if (!await verifySignature(issuer, sigAlg, tbs.raw, sigBits)) {
+    throw new Error("bad OCSP signature");
+  }
+  const cid = children(single[0]);
+  const hashAlg = oidString(children(cid[0])[0].value);
+  if (![OID.sha1, OID.sha256, OID.sha384, OID.sha512].includes(hashAlg)) throw new Error("unsupported issuer hash algorithm");
+  const st = single[1];
+  const status = st.tag === 128 ? "good" : st.tag === 161 ? "revoked" : st.tag === 130 ? "unknown" : void 0;
+  if (!status) throw new Error("OCSP certStatus");
+  const thisUpdate = parsePreciseTime(expect(single[2], TAG.GeneralizedTime, "thisUpdate"));
+  let nextUpdate;
+  for (const x of single.slice(3)) {
+    if (x.tag === 160) nextUpdate = parsePreciseTime(children(x)[0]).date;
+    if (x.tag === 161) {
+      for (const ext of children(children(x)[0])) {
+        const e = children(ext);
+        if (e[1]?.tag === TAG.BOOLEAN && e[1].value[0] !== 0) throw new Error("unsupported critical extension");
+      }
+    }
+  }
+  return { status, thisUpdate, nextUpdate, certificate };
+}
+
+// src/ocsp.ts
+var CACHE_TTL_MS = 5 * 6e4;
+var CACHE_MAX = 1024;
+var MAX_BYTES = 16 << 10;
+var CLOCK_SKEW_MS = 5 * 6e4;
+var MAX_AGE_MS = 48 * 36e5;
+function ocspRevocationChecker(opts = {}) {
+  const doFetch = opts.fetchImpl ?? globalThis.fetch;
+  const timeoutMs = opts.timeoutMs ?? 2e3;
+  const totalMs = Math.max(timeoutMs, 3e3);
+  const now = opts.now ?? Date.now;
+  const cache = /* @__PURE__ */ new Map();
+  async function ask(leaf, issuer) {
+    const body = await ocspRequest(leaf, issuer);
+    const deadline = Date.now() + totalMs;
+    for (const raw of leaf.ocspServers) {
+      const left = deadline - Date.now();
+      if (left <= 0) break;
+      try {
+        const u = new URL(raw);
+        if (u.protocol !== "http:" && u.protocol !== "https:") continue;
+        const res = await doFetch(u.toString(), {
+          method: "POST",
+          headers: { "Content-Type": "application/ocsp-request", Accept: "application/ocsp-response" },
+          body,
+          redirect: "manual",
+          signal: AbortSignal.timeout(Math.min(timeoutMs, left))
+        });
+        if (res.status !== 200) continue;
+        const der = new Uint8Array(await res.arrayBuffer());
+        if (der.length > MAX_BYTES) continue;
+        const resp = await parseOCSPForCert(der, leaf, issuer);
+        const t = now();
+        const rc = resp.certificate;
+        if (rc && !equal(rc.raw, issuer.raw)) {
+          if (!rc.extKeyUsage.includes(OID.kpOCSPSigning)) continue;
+          if (t < rc.notBefore.getTime() || t > rc.notAfter.getTime()) continue;
+        }
+        const tu = resp.thisUpdate.date.getTime();
+        if (tu > t + CLOCK_SKEW_MS || tu < t - MAX_AGE_MS) continue;
+        if (resp.nextUpdate && resp.nextUpdate.getTime() < t) continue;
+        return resp.status === "good" ? "good" : "revoked";
+      } catch {
+      }
+    }
+    return void 0;
+  }
+  return async (cert, issuer) => {
+    if (!issuer) return "unknown";
+    let leaf, iss;
+    try {
+      leaf = parseCertificate(new Uint8Array(cert.raw));
+      iss = parseCertificate(new Uint8Array(issuer.raw));
+    } catch {
+      return "unknown";
+    }
+    const key = (0, import_node_crypto5.createHash)("sha256").update(issuer.raw).digest("hex").slice(0, 16) + ":" + cert.serialNumber;
+    const exp = cache.get(key);
+    if (exp !== void 0 && now() < exp) return "good";
+    const status = await ask(leaf, iss);
+    if (!status) return "unknown";
+    if (status === "good") {
+      if (cache.size >= CACHE_MAX) cache.clear();
+      cache.set(key, now() + CACHE_TTL_MS);
+    }
+    return status;
+  };
+}
+
 // src/devicelink.ts
 var SESSION_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 var VC_RE = /^[0-9]{5}$/;
@@ -2005,7 +2671,7 @@ function openOrShowQR(session, opts) {
 }
 
 // src/devicelinkv3.ts
-var import_node_crypto5 = require("crypto");
+var import_node_crypto6 = require("crypto");
 var TYPES = ["QR", "Web2App", "App2App"];
 var PROTOCOL = { auth: "ACSP_V2", sign: "RAW_DIGEST_SIGNATURE", cert: "" };
 var TOKEN_RE = /^[A-Za-z0-9_-]+$/;
@@ -2062,7 +2728,7 @@ function buildDeviceLink(p) {
     callback,
     unprotected
   ].join("|");
-  const authCode = (0, import_node_crypto5.createHmac)("sha256", Buffer.from(p.sessionSecret, "base64")).update(payload, "utf8").digest("base64url");
+  const authCode = (0, import_node_crypto6.createHmac)("sha256", Buffer.from(p.sessionSecret, "base64")).update(payload, "utf8").digest("base64url");
   return `${unprotected}&authCode=${authCode}`;
 }
 function deviceLinkInput(s, deviceLinkType, lang) {
@@ -2106,7 +2772,7 @@ function qrDeviceLinkTicker(input, onLink, opts) {
 }
 
 // src/login.ts
-var import_node_crypto6 = require("crypto");
+var import_node_crypto7 = require("crypto");
 function memoryLoginStore() {
   const m = /* @__PURE__ */ new Map();
   return {
@@ -2131,6 +2797,51 @@ function memoryLoginStore() {
     }
   };
 }
+var defaultRateLimit = Object.freeze({
+  push: Object.freeze({ limit: 3, windowMs: 6e4 })
+});
+var RATE_KINDS = ["start", "push"];
+function windowLimiter(limit, windowMs) {
+  const hits = /* @__PURE__ */ new Map();
+  return (key) => {
+    const now = Date.now();
+    const h = (hits.get(key) ?? []).filter((t) => now - t < windowMs);
+    if (hits.size > 1e4) hits.clear();
+    if (h.length >= limit) {
+      hits.set(key, h);
+      return false;
+    }
+    h.push(now);
+    hits.set(key, h);
+    return true;
+  };
+}
+function buildRateLimit(opt) {
+  const extra = typeof opt === "function" ? opt : void 0;
+  const user = opt && typeof opt === "object" ? opt : {};
+  for (const k of Object.keys(user)) {
+    if (!RATE_KINDS.includes(k)) throw new Error(`createEidLogin: rateLimit.${k} \u2014 \u0437\u04E9\u0432\u0445\u04E9\u043D start | push`);
+  }
+  const merged = { ...defaultRateLimit, ...user };
+  const perKind = /* @__PURE__ */ new Map();
+  for (const k of RATE_KINDS) {
+    const r = merged[k];
+    if (r === void 0 || r === false) continue;
+    if (typeof r === "function") {
+      perKind.set(k, r);
+      continue;
+    }
+    if (!(Number.isInteger(r.limit) && r.limit > 0 && r.windowMs > 0)) {
+      throw new Error(`createEidLogin: rateLimit.${k} \u2014 limit (\u0431\u04AF\u0445\u044D\u043B > 0), windowMs (> 0)`);
+    }
+    perKind.set(k, windowLimiter(r.limit, r.windowMs));
+  }
+  return async (key) => {
+    const fn = perKind.get(key.slice(0, key.indexOf(":")));
+    if (fn && !await fn(key)) return false;
+    return extra ? extra(key) : true;
+  };
+}
 var CALLBACK_PATH = "/auth/eid/callback";
 function forwardedClientIp(headers, trustProxy) {
   if (trustProxy === false || trustProxy === 0) return void 0;
@@ -2187,13 +2898,43 @@ function readCookie(h, name) {
   }
   return "";
 }
-var sha256hex = (s) => (0, import_node_crypto6.createHash)("sha256").update(s).digest("hex");
+var sha256hex = (s) => (0, import_node_crypto7.createHash)("sha256").update(s).digest("hex");
 function safeEqualHex(a, b) {
   const x = Buffer.from(a, "hex");
   const y = Buffer.from(b, "hex");
-  return x.length === y.length && x.length > 0 && (0, import_node_crypto6.timingSafeEqual)(x, y);
+  return x.length === y.length && x.length > 0 && (0, import_node_crypto7.timingSafeEqual)(x, y);
+}
+function sleep(ms2, signal) {
+  return new Promise((resolve) => {
+    if (ms2 <= 0 || signal?.aborted) return resolve();
+    const done = () => {
+      clearTimeout(t);
+      signal?.removeEventListener("abort", done);
+      resolve();
+    };
+    const t = setTimeout(done, ms2);
+    signal?.addEventListener("abort", done, { once: true });
+  });
+}
+function isRefusal(e) {
+  if (!(e instanceof ApiError) || e.status < 400 || e.status >= 500 || e.status === 401 || e.status === 403 || e.status === 429) {
+    return false;
+  }
+  try {
+    JSON.parse(e.body);
+    return true;
+  } catch {
+    return false;
+  }
 }
-function toIdentity(sessionId, r, v, flowType) {
+var RevocationFailure = class extends ValidationError {
+  constructor(message, revoked) {
+    super(message);
+    this.revoked = revoked;
+  }
+  revoked;
+};
+function toIdentity(sessionId, r, v, flowType, revocation) {
   const s = v.parsedSubject;
   const etsi = s.serialNumber ?? "";
   const m = /^PNOMN-([0-9]+)$/.exec(etsi);
@@ -2209,7 +2950,8 @@ function toIdentity(sessionId, r, v, flowType) {
     certificateLevel: v.certificateLevel,
     certificateDerB64: r.certificateDerB64 ?? "",
     flowType,
-    person: personMatchesCertificate(r.person, s) ? r.person ?? null : null
+    person: personMatchesCertificate(r.person, s) ? r.person ?? null : null,
+    revocation
   };
 }
 function createEidLogin(opts) {
@@ -2230,17 +2972,29 @@ function createEidLogin(opts) {
   const successRedirect = opts.successRedirect ?? "/";
   const failureRedirect = opts.failureRedirect ?? "/";
   const onError = opts.onError ?? ((e) => console.error("eid-login:", e instanceof Error ? e.message : e));
-  const pushHits = /* @__PURE__ */ new Map();
-  const rateLimit = opts.rateLimit ?? ((key) => {
-    if (!key.startsWith("push:")) return true;
-    const now = Date.now();
-    const hits = (pushHits.get(key) ?? []).filter((t) => now - t < 6e4);
-    if (pushHits.size > 1e4) pushHits.clear();
-    if (hits.length >= 3) return false;
-    hits.push(now);
-    pushHits.set(key, hits);
-    return true;
-  });
+  const rateLimit = buildRateLimit(opts.rateLimit);
+  const decoyOn = opts.decoy !== false;
+  const pushFloorMs = opts.pushFloorMs ?? 1e3;
+  const revocation = opts.revocation === false ? void 0 : opts.revocation ?? ocspRevocationChecker();
+  const revocationMode = opts.revocationMode ?? "soft-fail";
+  const auditKey = opts.auditKey ?? (0, import_node_crypto7.randomBytes)(32);
+  const pushKey = (idCode) => (0, import_node_crypto7.createHmac)("sha256", auditKey).update(`eid-push-audit:${idCode}`).digest("hex").slice(0, 32);
+  async function emit(kind, sessionId, meta, ctx2) {
+    if (!opts.onEvent) return;
+    try {
+      await opts.onEvent({ kind, sessionId, meta });
+    } catch (e) {
+      onError(e, ctx2);
+    }
+  }
+  function endEvent(tx, endResult, ctx2) {
+    const kind = endResult?.startsWith("USER_REFUSED") ? "refused" : endResult === "TIMEOUT" ? "expired" : "failed";
+    return emit(kind, tx.sessionId, { mode: tx.mode, endResult: endResult ?? "UNKNOWN" }, ctx2);
+  }
+  function unverified(tx, e, ctx2) {
+    const reason = e instanceof RevocationFailure ? e.revoked ? "revoked" : "revocation_unavailable" : "validation";
+    return emit("unverified", tx.sessionId, { mode: tx.mode, reason }, ctx2);
+  }
   const displayText = (opts.displayText ?? `${client.rpName}-\u0434 \u043D\u044D\u0432\u0442\u0440\u044D\u0445`).slice(0, 60);
   const interactions = [{ type: "displayTextAndPIN", displayText60: displayText }];
   const json = (status2, body, extra = {}) => ({
@@ -2331,11 +3085,18 @@ function createEidLogin(opts) {
         });
       }
     }
-    const binding = (0, import_node_crypto6.randomBytes)(32).toString("base64url");
+    return { ...await save(tx), appLink };
+  }
+  async function save(tx) {
+    const binding = (0, import_node_crypto7.randomBytes)(32).toString("base64url");
     const full = { ...tx, bindingHash: sha256hex(binding), expiresAt: Date.now() + ttl };
     await store.set(full.sessionId, full, ttl);
     const setCookie = `${cookieName}=${full.sessionId}.${binding}; ${cookieAttrs(Math.ceil(ttl / 1e3))}`;
-    return { tx: full, setCookie, appLink };
+    return { tx: full, setCookie, appLink: void 0 };
+  }
+  function startDecoy() {
+    const acsp = void 0;
+    return save({ sessionId: (0, import_node_crypto7.randomUUID)(), mode: "push", vc: String((0, import_node_crypto7.randomInt)(1e5)).padStart(5, "0"), acsp, decoy: true });
   }
   async function start(req) {
     const url = new URL(req.url, "http://x");
@@ -2361,22 +3122,40 @@ function createEidLogin(opts) {
     const mode = body.mode;
     if (mode !== "qr" && mode !== "push" && mode !== "web2app") return json(400, { error: "invalid_mode" });
     const lang = body.lang === "en" ? "eng" : "mon";
-    const ctx = { request: req, mode };
+    const ctx2 = { request: req, mode };
     if (mode === "web2app" && !opts.callbackUrl) return json(400, { error: "web2app_not_configured" });
     const idCode = typeof body.idCode === "string" ? body.idCode.replace(/\s+/g, "").toUpperCase() : "";
     if (mode === "push" && !ID_RE.test(idCode)) return json(400, { error: "invalid_id" });
-    const limited = () => json(429, { error: "rate_limited" }, { "Retry-After": "60" });
+    const limited = async () => {
+      if (mode === "push") await emit("push_limited", null, { mode, pushKey: pushKey(idCode) }, ctx2);
+      return json(429, { error: "rate_limited" }, { "Retry-After": "60" });
+    };
     const ip = req.ip || (opts.trustProxy ? forwardedClientIp(req.headers, opts.trustProxy) : void 0);
     if (ip && !await rateLimit(`start:${ip}`)) return limited();
     if (mode === "push" && !await rateLimit(`push:${idCode}`)) return limited();
+    const began = Date.now();
     let r;
+    let err;
+    let decoy = false;
     try {
       r = await begin(req, mode, idCode, lang);
     } catch (e) {
-      onError(e, ctx);
-      const status2 = e instanceof ApiError && e.status === 429 ? 429 : 502;
-      return json(status2, { error: status2 === 429 ? "rate_limited" : "eid_unavailable" });
+      err = e;
+    }
+    if (err !== void 0 && mode === "push" && decoyOn && isRefusal(err)) {
+      const ae = err;
+      onError(new Error(`eid-login: eID push-\u0438\u0439\u0433 \u0442\u0430\u0442\u0433\u0430\u043B\u0437\u0430\u0432 (${ae.status}${ae.code ? ` ${ae.code}` : ""}); decoy session-\u043E\u043E\u0440 \u0445\u0430\u0440\u0438\u0443\u043B\u0430\u0432`), ctx2);
+      err = void 0;
+      r = await startDecoy();
+      decoy = true;
+    }
+    if (mode === "push" && pushFloorMs > 0) await sleep(began + pushFloorMs - Date.now(), req.signal);
+    if (err !== void 0 || !r) {
+      onError(err, ctx2);
+      if (err instanceof ApiError && err.status === 429) return limited();
+      return json(502, { error: "eid_unavailable" });
     }
+    if (mode === "push") await emit("push_sent", r.tx.sessionId, { mode, pushKey: pushKey(idCode), decoy }, ctx2);
     if (mode === "web2app") {
       return { status: 302, headers: { Location: r.appLink, "Cache-Control": "no-store", "Referrer-Policy": "no-referrer", "Set-Cookie": r.setCookie }, body: "" };
     }
@@ -2388,30 +3167,49 @@ function createEidLogin(opts) {
   }
   async function finish(req, tx, r, flow, verifier) {
     const v = client.validator.validateAuth(r, tx.acsp, { expectedFlowType: flow, userChallengeVerifier: verifier });
+    const ctx2 = { request: req, mode: tx.mode };
+    let rev;
+    let status2;
+    const checker = revocation && (async (c, i) => status2 = await revocation(c, i));
+    try {
+      rev = await client.validator.checkRevocationWith(v.certificate, checker, revocationMode);
+    } catch (e) {
+      throw new RevocationFailure(`revocation: ${e instanceof Error ? e.message : String(e)}`, status2 === "revoked");
+    }
+    if (rev === "unchecked") onError(new Error("eid-login: OCSP \u0445\u0430\u0440\u0438\u0443\u0433\u04AF\u0439 \u2014 \u0446\u0443\u0446\u043B\u0430\u043B\u0442 \u0448\u0430\u043B\u0433\u0430\u043B\u0433\u04AF\u0439 \u0437\u04E9\u0432\u0448\u04E9\u04E9\u0440\u04E9\u0432 (soft-fail)"), ctx2);
     if (!await store.delete(tx.sessionId)) return void 0;
-    const out = await opts.onSuccess(toIdentity(tx.sessionId, r, v, flow), { request: req, mode: tx.mode }) ?? {};
+    const out = await opts.onSuccess(toIdentity(tx.sessionId, r, v, flow, rev), ctx2) ?? {};
+    await emit("success", tx.sessionId, { mode: tx.mode, flow, revocation: rev }, ctx2);
     return out;
   }
   async function status(req) {
     if (req.method !== "GET") return json(405, { error: "method_not_allowed" });
     const tx = await loadTx(req);
     if (!tx) return json(200, { state: "EXPIRED" }, { "Set-Cookie": clearCookie });
-    const ctx = { request: req, mode: tx.mode };
+    const ctx2 = { request: req, mode: tx.mode };
     let r;
-    try {
-      r = await client.session.poll(tx.sessionId, pollMs);
-    } catch (e) {
-      if (e instanceof ApiError && e.status === 404) {
-        await store.delete(tx.sessionId);
-        return json(200, { state: "EXPIRED" }, { "Set-Cookie": clearCookie });
+    if (tx.decoy) {
+      await sleep(pollMs, req.signal);
+      r = { state: "RUNNING" };
+    } else {
+      try {
+        r = await client.session.poll(tx.sessionId, pollMs);
+      } catch (e) {
+        if (e instanceof ApiError && e.status === 404) {
+          await store.delete(tx.sessionId);
+          await emit("expired", tx.sessionId, { mode: tx.mode }, ctx2);
+          return json(200, { state: "EXPIRED" }, { "Set-Cookie": clearCookie });
+        }
+        onError(e, ctx2);
+        return json(502, { error: "eid_unavailable" });
       }
-      onError(e, ctx);
-      return json(502, { error: "eid_unavailable" });
     }
     const expiresIn = Math.max(0, Math.ceil((tx.expiresAt - Date.now()) / 1e3));
     if (r.state !== "COMPLETE") return json(200, { state: "PENDING", qr: qrLink(tx), vc: tx.vc, expiresIn });
     if (r.endResult !== "OK") {
       await store.delete(tx.sessionId);
+      await endEvent(tx, r.endResult, ctx2);
+      if (tx.mode === "push" && r.endResult === "TIMEOUT") return json(200, { state: "EXPIRED" }, { "Set-Cookie": clearCookie });
       return json(200, { state: "FAILED", error: r.endResult ?? "UNKNOWN" }, { "Set-Cookie": clearCookie });
     }
     if (tx.mode === "web2app") return json(200, { state: "WAIT_CALLBACK" });
@@ -2420,9 +3218,10 @@ function createEidLogin(opts) {
       if (!out) return json(200, { state: "EXPIRED" }, { "Set-Cookie": clearCookie });
       return json(200, { state: "OK", redirect: out.redirect, data: out.data }, mergeHeaders({ "Set-Cookie": clearCookie }, out.headers));
     } catch (e) {
-      onError(e, ctx);
+      onError(e, ctx2);
       if (!(e instanceof ValidationError || e instanceof SessionFailedError)) return json(500, { error: "internal" });
       await store.delete(tx.sessionId);
+      await unverified(tx, e, ctx2);
       return json(200, { state: "FAILED", error: "VALIDATION" }, { "Set-Cookie": clearCookie });
     }
   }
@@ -2433,19 +3232,23 @@ function createEidLogin(opts) {
     const verifier = q.get("userChallengeVerifier") ?? "";
     const fail2 = (code) => redirect(failTo(code), { "Set-Cookie": clearCookie });
     const tx = await loadTx(req);
-    if (!tx || tx.sessionId !== sid || tx.mode !== "web2app") return fail2(tx ? "unbound" : "expired");
-    if (!verifier) return fail2("unbound");
-    const ctx = { request: req, mode: tx.mode };
+    if (!tx) return fail2("expired");
+    const ctx2 = { request: req, mode: tx.mode };
+    if (tx.sessionId !== sid || tx.mode !== "web2app" || !verifier) {
+      await emit("flow_refused", tx.sessionId, { mode: tx.mode, reason: "unbound" }, ctx2);
+      return fail2("unbound");
+    }
     let r;
     try {
       r = await client.session.poll(tx.sessionId, 1e4);
     } catch (e) {
-      onError(e, ctx);
+      onError(e, ctx2);
       return fail2("eid_unavailable");
     }
     if (r.state !== "COMPLETE") return fail2("not_complete");
     if (r.endResult !== "OK") {
       await store.delete(tx.sessionId);
+      await endEvent(tx, r.endResult, ctx2);
       return fail2(r.endResult ?? "UNKNOWN");
     }
     try {
@@ -2453,9 +3256,10 @@ function createEidLogin(opts) {
       if (!out) return fail2("expired");
       return redirect(out.redirect ?? successRedirect, mergeHeaders({ "Set-Cookie": clearCookie }, out.headers));
     } catch (e) {
-      onError(e, ctx);
+      onError(e, ctx2);
       if (!(e instanceof ValidationError || e instanceof SessionFailedError)) return fail2("internal");
       await store.delete(tx.sessionId);
+      await unverified(tx, e, ctx2);
       return fail2("VALIDATION");
     }
   }
@@ -2485,7 +3289,7 @@ function createEidLogin(opts) {
         mode: "qr"
       });
     }
-    const r = await handleRequest({ method: req.method, url: req.url, headers, body, ip });
+    const r = await handleRequest({ method: req.method, url: req.url, headers, body, ip, signal: req.signal });
     const h = new Headers();
     for (const [k, v] of Object.entries(r.headers)) for (const x of [v].flat()) h.append(k, x);
     return new Response(r.status === 302 || r.status === 303 || r.body === "" ? null : r.body, { status: r.status, headers: h });
@@ -2526,12 +3330,14 @@ function createEidLogin(opts) {
   buildDeviceLink,
   buildRegisterBody,
   createEidLogin,
+  defaultRateLimit,
   deviceLink,
   deviceLinkInput,
   forwardedClientIp,
   interactionsToBase64,
   isMobileUserAgent,
   memoryLoginStore,
+  ocspRevocationChecker,
   openOrShowQR,
   parseExpiresAt,
   parseRetryAfter,