@gerege-systems/eid-mongolia-sdk 0.6.0 → 0.7.0

package/README.md

@@ -67,6 +67,51 @@ const sig = eid.validator.validateSign(result, digest); // digest-ийн эср
 console.log(sig.signatureValueB64, sig.subject);
 ```
 
+## 3a. Байгууллагын нэрийн өмнөөс гарын үсэг (onBehalfOf)
+
+Иргэн **өөрийн PIN2 гэрчилгээгээр** зурна; тухайн мөчид байгууллагыг төлөөлөх эрхтэйг eID **өөрийн бүртгэлээр**
+шалгана (Эстонийн загвар). Энэ нь **хувь хүний квалификацтай гарын үсэг** — байгууллагын гэрчилгээ, тамга (e-Seal) биш.
+e-Seal нь зөвхөн хүнгүй, автомат системийн баримтад. Урьдчилсан нөхцөл: байгууллага eID-д `ACTIVE` (захирал
+аппаараа ХУР-аар холбоно), зурагч нь `ADMIN` эсвэл PIN2-оор баталгаажуулсан `MANAGER`, RP-д `SIGN` эрх.
+Дэлгэрэнгүй: [developer.eidmongolia.mn](https://developer.eidmongolia.mn/).
+
+```ts
+import { ForbiddenError, ApiError, ON_BEHALF_ERROR_CODES } from "@gerege-systems/eid-mongolia-sdk";
+
+// 1. Иргэн сүүлийн 24 цагт танай RP-ээр нэвтэрсэн байх ёстой.
+const { representations } = await eid.organization.getRepresentations("PNOMN-12345678");
+// → [{ orgEtsi: "NTRMN-6235972", orgName: "Гэрэгэ Системс ХХК", role: "ceo", rightType: "ADMIN", … }]
+
+// 2. PDF (PAdES, CA угсарна) — санал болгох урсгал.
+try {
+  const s = await eid.pdf.prepare({
+    pdf: pdfBytes, fileName: "Гэрээ №12.pdf",
+    signer: { etsi: "PNOMN-12345678" }, flow: "notification",
+    onBehalfOf: "NTRMN-6235972",
+  });
+  showToUser(s.vc);
+  const r = await eid.session.waitForResult(s.sessionId);
+  // MUST: endResult OK, pdf.documentStatus READY, pdf.signer.onBehalfOf = хүссэн байгууллага,
+  // татсан файлын SHA-256 = pdf.outSha256, validation.indication "valid", ltv true.
+  if (r.pdf?.documentStatus !== "READY" || r.pdf.signer?.onBehalfOf !== "NTRMN-6235972") throw new Error("…");
+  const signed = await eid.pdf.document(s.sessionId);
+  console.log(r.pdf.signer.claimedRole); // "Гүйцэтгэх захирал, Гэрэгэ Системс ХХК (NTRMN-6235972)"
+} catch (e) {
+  if ((e instanceof ForbiddenError || e instanceof ApiError) && e.code) {
+    // REPRESENTATION_DENIED | REPRESENTATION_PENDING | REPRESENTATION_EXPIRED | ORG_NOT_ACTIVE |
+    // SIGNER_UNIDENTIFIED (403) · ORG_NOT_FOUND (404) · REPRESENTATION_REVOKED (403, document татах үед)
+  }
+  throw e;
+}
+
+// Raw digest гарын үсэгт ч мөн: eid.sign.digestByEtsi(id, digest, interactions, { onBehalfOf: "NTRMN-6235972" })
+// — CMS/PDF-ийг та угсардаг тул мэдүүлсэн үүргийг (signer-attributes-v2) өөрөө нэмнэ.
+```
+
+Олон талт гэрээ: А байгууллагын гаралтыг өөрчлөлтгүй Б-ийн `prepare`-д (`docID`, өөр `onBehalfOf`) илгээнэ.
+Session-ий `onBehalfOf` блок (`role`/`rightType`) нь хариу угсрах үеийн бүртгэл; `pdf.signer.onBehalfOf`/`claimedRole`
+нь баримтад бичигдсэн утга.
+
 ## 4. QR ба ижил төхөөрөмж — device link v3
 
 Иргэн өөр төхөөрөмжийн дэлгэц дээрх **QR**-ийг утсаараа уншина, эсвэл RP-ийн сайт/аппыг eID апптай **ижил
@@ -160,6 +205,9 @@ OK ирж болзошгүй. Иймд `ResponseValidator`:
 4. Гарын үсгийг иргэний public key-ээр шалгана:
    - **auth** → ACSP_V2 payload (`smart-id|ACSP_V2|serverRandom|rpChallenge|userChallenge|B64(rpName)|B64(brokeredRpName)|B64(SHA-256(interactions))|interactionTypeUsed|initialCallbackUrl|flowType`, hash = хүсэлтийн `hashAlgorithm`) дээр — `flowType`, `userChallenge`, `serverRandom` ба алгоритмын downgrade-ийг мөн шалгана;
      `expectedFlowType` өгвөл `flowType` эхлүүлсэн урсгалтай ЯГ таарах, Web2App/App2App-д `userChallengeVerifier` заавал
+     `initialCallbackUrl`-ийг хариуны `signature.initialCallbackUrl`-аас авна (CA урсгалаар шийднэ: QR/Notification →
+     `""`, Web2App/App2App → таны callback; шилжилтийн үед legacy `/dl` ба push-д таны callback) — зөвхөн `""` эсвэл
+     таны илгээсэн callback байхад, Web2App/App2App-д заавал таны callback; өөр утга → татгалзана
    - **sign** → RP-ийн өгсөн digest дээр
 
 Аль нэг алхам бүтэлгүйтвэл `ValidationError` шиднэ — хариунд **итгэхгүй**.
@@ -169,10 +217,10 @@ OK ирж болзошгүй. Иймд `ResponseValidator`:
 | Алдаа | Утга |
 |---|---|
 | `AuthenticationError` | 401 — API secret буруу/байхгүй |
-| `ForbiddenError` | 403 — IP allowlist / mTLS зөвшөөрөөгүй |
+| `ForbiddenError` | 403 — IP allowlist / mTLS / RP-ийн эрх; onBehalfOf татгалзвал `.code` (`OnBehalfErrorCode`) |
 | `SessionFailedError` | endResult ≠ OK (TIMEOUT, USER_REFUSED…) — `.endResult`-оор салга |
 | `ValidationError` | cert chain/signature/level шалгалт бүтэлгүйтсэн |
-| `ApiError` | бусад HTTP алдаа (`.status`, `.body`) |
+| `ApiError` | бусад HTTP алдаа (`.status`, `.body`, серверийн `.code` — ж: 404 `ORG_NOT_FOUND`) |
 | `NetworkError` | timeout/сүлжээ |
 | `DeviceLinkError` | device-link холбоос угсрах боломжгүй (`deviceLinkBase` https биш, token/secret/lang хэлбэр, төрөлд хэрэгтэй талбар дутуу) |
 

package/dist/{browser-PhjcbuAN.d.cts → browser-Db82DlYN.d.cts}

@@ -116,6 +116,12 @@ interface SessionResult {
     serverRandom: string | null;
     userChallenge: string | null;
     flowType: string | null;
+    /**
+     * ACSP_V2 payload-д гарын үсэг зурагдсан `initialCallbackUrl` (хариуны `signature.initialCallbackUrl`,
+     * eID нэмэлт). Smart-ID: QR/Notification → `""`, Web2App/App2App → RP-ийн илгээсэн URL. null = хариунд
+     * талбар алга (хуучин CA). Validator үүнийг зөвхөн `""` эсвэл RP-ийн өөрийн callback байхад л хүлээн авна.
+     */
+    initialCallbackUrl?: string | null;
     signatureAlgorithmParameters: SignatureAlgorithmParameters | null;
     interactionTypeUsed: string | null;
     /**
@@ -124,6 +130,61 @@ interface SessionResult {
      * RP энэ талбарыг л итгэж уншина (клиентийн сонголтод биш). docs/ORG_LOGIN.md.
      */
     onBehalfOf: OrgResult | null;
+    /**
+     * PAdES (`POST /pdf/sign/prepare`) session-ий `pdf` блок — PDF урсгал биш бол null (талбар алга = хуучин SDK-аар
+     * угсарсан объект). {@link PdfSessionBlock}.
+     */
+    pdf?: PdfSessionBlock | null;
+}
+/** PDF баримтын төлөв: PENDING → READY (эсвэл FAILED / EXPIRED). */
+type PdfDocumentStatus = "PENDING" | "READY" | "FAILED" | "EXPIRED";
+/** PAdES гаралтын гарын үсэг зурагч. */
+interface PdfSigner {
+    etsi: string;
+    certSerial: string;
+    /** Байгууллагын нэрийн өмнөөс бол байгууллагын ETSI (`NTRMN-…`) — баримтад бичигдсэн утга. */
+    onBehalfOf?: string;
+    /** CMS signer-attributes-v2-д бичигдсэн мэдүүлсэн үүрэг: «<албан тушаал>, <нэр> (NTRMN-…)». */
+    claimedRole?: string;
+}
+/** GET /session/{id}-ийн `pdf` объект (PAdES, CA угсарна). */
+interface PdfSessionBlock {
+    docID: string;
+    documentStatus: PdfDocumentStatus | string;
+    /** FAILED үед — ж: `REPRESENTATION_REVOKED` (prepare-ээс хойш эрх хасагдсан, баримт үүсээгүй). */
+    errorCode?: string;
+    /** Гарын үсэгтэй PDF-ийн SHA-256 (hex) — татсан файлтай тулгана. */
+    outSha256?: string;
+    size?: number;
+    expiresAt?: string;
+    signatureLevel?: string;
+    signer?: PdfSigner;
+    validation?: {
+        indication: string;
+        ltv: boolean;
+        signatures: number;
+    };
+}
+/** Иргэний төлөөлж чадах нэг байгууллага (GET /organization/representations/etsi/{personEtsi}). */
+interface Representation {
+    /** `NTRMN-<бүртгэл>` — `onBehalfOf`-д өгөх утга. */
+    orgEtsi: string;
+    orgRegister: string;
+    orgName: string;
+    orgNameEn?: string;
+    /** Бүртгэлийн албан тушаал (ХУР-аас холбогдсонд `ceo` / `founder`, MANAGER-т ADMIN-ий бичсэн текст). */
+    role?: string;
+    rightType: "ADMIN" | "MANAGER" | string;
+    source: "REGISTRY" | "MANUAL" | string;
+    /** ISO 8601. */
+    validFrom: string;
+    /** ISO 8601; байхгүй = хугацаагүй. */
+    validTo?: string;
+}
+/** GET /organization/representations/etsi/{personEtsi} хариу. */
+interface RepresentationsResponse {
+    personEtsi: string;
+    representations: Representation[];
 }
 /** Session-ий байгууллагын блок — байгууллага + тухайн иргэний эрх (бүртгэлээс real-time). */
 interface OrgResult {
@@ -200,15 +261,37 @@ declare class EidError extends Error {
 /** HTTP 401 — API secret буруу/байхгүй. Тохиргооны (RP secret) алдаа. */
 declare class AuthenticationError extends EidError {
 }
-/** HTTP 403 — IP allowlist/mTLS зөвшөөрөөгүй. Танай серверийн IP бүртгэгдээгүй байж магадгүй. */
+/**
+ * HTTP 403 — IP allowlist/mTLS зөвшөөрөөгүй, RP-д эрх алга, эсвэл onBehalfOf-ийн төлөөлөл татгалзсан.
+ * Сервер `{"error","code"}` буцаасан бол `code` (ж: `REPRESENTATION_DENIED`) — салааллыг үүгээр хийнэ.
+ */
 declare class ForbiddenError extends EidError {
+    /** Серверийн тогтвортой алдааны код (`{"code"}`), байхгүй бол undefined. */
+    readonly code?: string | undefined;
+    constructor(message: string, 
+    /** Серверийн тогтвортой алдааны код (`{"code"}`), байхгүй бол undefined. */
+    code?: string | undefined);
 }
 /** RP-API-аас ирсэн бусад HTTP алдаа (4xx/5xx). status ба хариуны биеийг агуулна. */
 declare class ApiError extends EidError {
     readonly status: number;
     readonly body: string;
-    constructor(status: number, body: string);
+    /** Серверийн тогтвортой алдааны код (`{"error","code"}`-ийн `code`), байхгүй бол undefined. */
+    readonly code?: string | undefined;
+    constructor(status: number, body: string, 
+    /** Серверийн тогтвортой алдааны код (`{"error","code"}`-ийн `code`), байхгүй бол undefined. */
+    code?: string | undefined);
 }
+/**
+ * Байгууллагын нэрийн өмнөөс (`onBehalfOf`) урсгалын татгалзлын кодууд — `ForbiddenError.code` /
+ * `ApiError.code`-д ирнэ. 403: REPRESENTATION_DENIED (идэвхтэй төлөөлөгч биш), REPRESENTATION_PENDING (PIN2-оор
+ * баталгаажуулаагүй), REPRESENTATION_EXPIRED (хугацааны гадна), ORG_NOT_ACTIVE, SIGNER_UNIDENTIFIED (anonymous
+ * session); 404: ORG_NOT_FOUND; PDF баримт татахад 403 REPRESENTATION_REVOKED (prepare-ээс хойш эрх хасагдсан —
+ * баримт үүсээгүй).
+ */
+type OnBehalfErrorCode = "REPRESENTATION_DENIED" | "REPRESENTATION_PENDING" | "REPRESENTATION_EXPIRED" | "ORG_NOT_ACTIVE" | "SIGNER_UNIDENTIFIED" | "ORG_NOT_FOUND" | "REPRESENTATION_REVOKED";
+/** {@link OnBehalfErrorCode}-ийн бүх утга (runtime шалгалтад). */
+declare const ON_BEHALF_ERROR_CODES: readonly OnBehalfErrorCode[];
 /** Сүлжээ/timeout — upstream хариу өгсөнгүй. */
 declare class NetworkError extends EidError {
 }
@@ -234,4 +317,4 @@ declare class ValidationError extends EidError {
 declare class DeviceLinkError extends EidError {
 }
 
-export { type AcspContext as A, type CertificateLevel as C, type DeviceLinkSession as D, EidError as E, type FlowType as F, type HashAlgorithm as H, type Interaction as I, type NotificationSession as N, type OpenOrShowQROptions as O, type RpCredentials as R, type SignatureAlgorithm as S, ValidationError as V, type SessionResult as a, ApiError as b, AuthenticationError as c, DeviceLinkError as d, type DeviceLinkInput as e, type EndResult as f, ForbiddenError as g, type NavigatorLike as h, NetworkError as i, SessionFailedError as j, type SessionState as k, type SignatureAlgorithmParameters as l, type SignatureProtocol as m, deviceLink as n, isMobileUserAgent as o, openOrShowQR as p };
+export { type AcspContext as A, type CertificateLevel as C, type DeviceLinkSession as D, EidError as E, type FlowType as F, type HashAlgorithm as H, type Interaction as I, type NotificationSession as N, ON_BEHALF_ERROR_CODES as O, type PdfDocumentStatus as P, type RpCredentials as R, type SignatureAlgorithm as S, ValidationError as V, type SessionResult as a, type RepresentationsResponse as b, ApiError as c, AuthenticationError as d, DeviceLinkError as e, type DeviceLinkInput as f, type EndResult as g, ForbiddenError as h, type NavigatorLike as i, NetworkError as j, type OnBehalfErrorCode as k, type OpenOrShowQROptions as l, type OrgResult as m, type PdfSessionBlock as n, type PdfSigner as o, type Representation as p, SessionFailedError as q, type SessionState as r, type SignatureAlgorithmParameters as s, type SignatureProtocol as t, deviceLink as u, isMobileUserAgent as v, openOrShowQR as w };

package/dist/{browser-PhjcbuAN.d.ts → browser-Db82DlYN.d.ts}

@@ -116,6 +116,12 @@ interface SessionResult {
     serverRandom: string | null;
     userChallenge: string | null;
     flowType: string | null;
+    /**
+     * ACSP_V2 payload-д гарын үсэг зурагдсан `initialCallbackUrl` (хариуны `signature.initialCallbackUrl`,
+     * eID нэмэлт). Smart-ID: QR/Notification → `""`, Web2App/App2App → RP-ийн илгээсэн URL. null = хариунд
+     * талбар алга (хуучин CA). Validator үүнийг зөвхөн `""` эсвэл RP-ийн өөрийн callback байхад л хүлээн авна.
+     */
+    initialCallbackUrl?: string | null;
     signatureAlgorithmParameters: SignatureAlgorithmParameters | null;
     interactionTypeUsed: string | null;
     /**
@@ -124,6 +130,61 @@ interface SessionResult {
      * RP энэ талбарыг л итгэж уншина (клиентийн сонголтод биш). docs/ORG_LOGIN.md.
      */
     onBehalfOf: OrgResult | null;
+    /**
+     * PAdES (`POST /pdf/sign/prepare`) session-ий `pdf` блок — PDF урсгал биш бол null (талбар алга = хуучин SDK-аар
+     * угсарсан объект). {@link PdfSessionBlock}.
+     */
+    pdf?: PdfSessionBlock | null;
+}
+/** PDF баримтын төлөв: PENDING → READY (эсвэл FAILED / EXPIRED). */
+type PdfDocumentStatus = "PENDING" | "READY" | "FAILED" | "EXPIRED";
+/** PAdES гаралтын гарын үсэг зурагч. */
+interface PdfSigner {
+    etsi: string;
+    certSerial: string;
+    /** Байгууллагын нэрийн өмнөөс бол байгууллагын ETSI (`NTRMN-…`) — баримтад бичигдсэн утга. */
+    onBehalfOf?: string;
+    /** CMS signer-attributes-v2-д бичигдсэн мэдүүлсэн үүрэг: «<албан тушаал>, <нэр> (NTRMN-…)». */
+    claimedRole?: string;
+}
+/** GET /session/{id}-ийн `pdf` объект (PAdES, CA угсарна). */
+interface PdfSessionBlock {
+    docID: string;
+    documentStatus: PdfDocumentStatus | string;
+    /** FAILED үед — ж: `REPRESENTATION_REVOKED` (prepare-ээс хойш эрх хасагдсан, баримт үүсээгүй). */
+    errorCode?: string;
+    /** Гарын үсэгтэй PDF-ийн SHA-256 (hex) — татсан файлтай тулгана. */
+    outSha256?: string;
+    size?: number;
+    expiresAt?: string;
+    signatureLevel?: string;
+    signer?: PdfSigner;
+    validation?: {
+        indication: string;
+        ltv: boolean;
+        signatures: number;
+    };
+}
+/** Иргэний төлөөлж чадах нэг байгууллага (GET /organization/representations/etsi/{personEtsi}). */
+interface Representation {
+    /** `NTRMN-<бүртгэл>` — `onBehalfOf`-д өгөх утга. */
+    orgEtsi: string;
+    orgRegister: string;
+    orgName: string;
+    orgNameEn?: string;
+    /** Бүртгэлийн албан тушаал (ХУР-аас холбогдсонд `ceo` / `founder`, MANAGER-т ADMIN-ий бичсэн текст). */
+    role?: string;
+    rightType: "ADMIN" | "MANAGER" | string;
+    source: "REGISTRY" | "MANUAL" | string;
+    /** ISO 8601. */
+    validFrom: string;
+    /** ISO 8601; байхгүй = хугацаагүй. */
+    validTo?: string;
+}
+/** GET /organization/representations/etsi/{personEtsi} хариу. */
+interface RepresentationsResponse {
+    personEtsi: string;
+    representations: Representation[];
 }
 /** Session-ий байгууллагын блок — байгууллага + тухайн иргэний эрх (бүртгэлээс real-time). */
 interface OrgResult {
@@ -200,15 +261,37 @@ declare class EidError extends Error {
 /** HTTP 401 — API secret буруу/байхгүй. Тохиргооны (RP secret) алдаа. */
 declare class AuthenticationError extends EidError {
 }
-/** HTTP 403 — IP allowlist/mTLS зөвшөөрөөгүй. Танай серверийн IP бүртгэгдээгүй байж магадгүй. */
+/**
+ * HTTP 403 — IP allowlist/mTLS зөвшөөрөөгүй, RP-д эрх алга, эсвэл onBehalfOf-ийн төлөөлөл татгалзсан.
+ * Сервер `{"error","code"}` буцаасан бол `code` (ж: `REPRESENTATION_DENIED`) — салааллыг үүгээр хийнэ.
+ */
 declare class ForbiddenError extends EidError {
+    /** Серверийн тогтвортой алдааны код (`{"code"}`), байхгүй бол undefined. */
+    readonly code?: string | undefined;
+    constructor(message: string, 
+    /** Серверийн тогтвортой алдааны код (`{"code"}`), байхгүй бол undefined. */
+    code?: string | undefined);
 }
 /** RP-API-аас ирсэн бусад HTTP алдаа (4xx/5xx). status ба хариуны биеийг агуулна. */
 declare class ApiError extends EidError {
     readonly status: number;
     readonly body: string;
-    constructor(status: number, body: string);
+    /** Серверийн тогтвортой алдааны код (`{"error","code"}`-ийн `code`), байхгүй бол undefined. */
+    readonly code?: string | undefined;
+    constructor(status: number, body: string, 
+    /** Серверийн тогтвортой алдааны код (`{"error","code"}`-ийн `code`), байхгүй бол undefined. */
+    code?: string | undefined);
 }
+/**
+ * Байгууллагын нэрийн өмнөөс (`onBehalfOf`) урсгалын татгалзлын кодууд — `ForbiddenError.code` /
+ * `ApiError.code`-д ирнэ. 403: REPRESENTATION_DENIED (идэвхтэй төлөөлөгч биш), REPRESENTATION_PENDING (PIN2-оор
+ * баталгаажуулаагүй), REPRESENTATION_EXPIRED (хугацааны гадна), ORG_NOT_ACTIVE, SIGNER_UNIDENTIFIED (anonymous
+ * session); 404: ORG_NOT_FOUND; PDF баримт татахад 403 REPRESENTATION_REVOKED (prepare-ээс хойш эрх хасагдсан —
+ * баримт үүсээгүй).
+ */
+type OnBehalfErrorCode = "REPRESENTATION_DENIED" | "REPRESENTATION_PENDING" | "REPRESENTATION_EXPIRED" | "ORG_NOT_ACTIVE" | "SIGNER_UNIDENTIFIED" | "ORG_NOT_FOUND" | "REPRESENTATION_REVOKED";
+/** {@link OnBehalfErrorCode}-ийн бүх утга (runtime шалгалтад). */
+declare const ON_BEHALF_ERROR_CODES: readonly OnBehalfErrorCode[];
 /** Сүлжээ/timeout — upstream хариу өгсөнгүй. */
 declare class NetworkError extends EidError {
 }
@@ -234,4 +317,4 @@ declare class ValidationError extends EidError {
 declare class DeviceLinkError extends EidError {
 }
 
-export { type AcspContext as A, type CertificateLevel as C, type DeviceLinkSession as D, EidError as E, type FlowType as F, type HashAlgorithm as H, type Interaction as I, type NotificationSession as N, type OpenOrShowQROptions as O, type RpCredentials as R, type SignatureAlgorithm as S, ValidationError as V, type SessionResult as a, ApiError as b, AuthenticationError as c, DeviceLinkError as d, type DeviceLinkInput as e, type EndResult as f, ForbiddenError as g, type NavigatorLike as h, NetworkError as i, SessionFailedError as j, type SessionState as k, type SignatureAlgorithmParameters as l, type SignatureProtocol as m, deviceLink as n, isMobileUserAgent as o, openOrShowQR as p };
+export { type AcspContext as A, type CertificateLevel as C, type DeviceLinkSession as D, EidError as E, type FlowType as F, type HashAlgorithm as H, type Interaction as I, type NotificationSession as N, ON_BEHALF_ERROR_CODES as O, type PdfDocumentStatus as P, type RpCredentials as R, type SignatureAlgorithm as S, ValidationError as V, type SessionResult as a, type RepresentationsResponse as b, ApiError as c, AuthenticationError as d, DeviceLinkError as e, type DeviceLinkInput as f, type EndResult as g, ForbiddenError as h, type NavigatorLike as i, NetworkError as j, type OnBehalfErrorCode as k, type OpenOrShowQROptions as l, type OrgResult as m, type PdfSessionBlock as n, type PdfSigner as o, type Representation as p, SessionFailedError as q, type SessionState as r, type SignatureAlgorithmParameters as s, type SignatureProtocol as t, deviceLink as u, isMobileUserAgent as v, openOrShowQR as w };

package/dist/browser.d.cts

@@ -1 +1 @@
-export { d as DeviceLinkError, e as DeviceLinkInput, D as DeviceLinkSession, E as EidError, h as NavigatorLike, O as OpenOrShowQROptions, n as deviceLink, o as isMobileUserAgent, p as openOrShowQR } from './browser-PhjcbuAN.cjs';
+export { e as DeviceLinkError, f as DeviceLinkInput, D as DeviceLinkSession, E as EidError, i as NavigatorLike, l as OpenOrShowQROptions, u as deviceLink, v as isMobileUserAgent, w as openOrShowQR } from './browser-Db82DlYN.cjs';

package/dist/browser.d.ts

@@ -1 +1 @@
-export { d as DeviceLinkError, e as DeviceLinkInput, D as DeviceLinkSession, E as EidError, h as NavigatorLike, O as OpenOrShowQROptions, n as deviceLink, o as isMobileUserAgent, p as openOrShowQR } from './browser-PhjcbuAN.js';
+export { e as DeviceLinkError, f as DeviceLinkInput, D as DeviceLinkSession, E as EidError, i as NavigatorLike, l as OpenOrShowQROptions, u as deviceLink, v as isMobileUserAgent, w as openOrShowQR } from './browser-Db82DlYN.js';

package/dist/browser.js

@@ -4,7 +4,7 @@ import {
   deviceLink,
   isMobileUserAgent,
   openOrShowQR
-} from "./chunk-Q5TQMCJC.js";
+} from "./chunk-NXDKQZIW.js";
 export {
   DeviceLinkError,
   EidError,

package/dist/{chunk-Q5TQMCJC.js → chunk-NXDKQZIW.js}

@@ -8,16 +8,32 @@ var EidError = class extends Error {
 var AuthenticationError = class extends EidError {
 };
 var ForbiddenError = class extends EidError {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+  }
+  code;
 };
 var ApiError = class extends EidError {
-  constructor(status, body) {
+  constructor(status, body, code) {
     super(`RP-API ${status}: ${body}`);
     this.status = status;
     this.body = body;
+    this.code = code;
   }
   status;
   body;
+  code;
 };
+var ON_BEHALF_ERROR_CODES = [
+  "REPRESENTATION_DENIED",
+  "REPRESENTATION_PENDING",
+  "REPRESENTATION_EXPIRED",
+  "ORG_NOT_ACTIVE",
+  "SIGNER_UNIDENTIFIED",
+  "ORG_NOT_FOUND",
+  "REPRESENTATION_REVOKED"
+];
 var NetworkError = class extends EidError {
 };
 var SessionFailedError = class extends EidError {
@@ -79,6 +95,7 @@ export {
   AuthenticationError,
   ForbiddenError,
   ApiError,
+  ON_BEHALF_ERROR_CODES,
   NetworkError,
   SessionFailedError,
   ValidationError,

package/dist/index.cjs

@@ -30,6 +30,9 @@ __export(index_exports, {
   ForbiddenError: () => ForbiddenError,
   Http: () => Http,
   NetworkError: () => NetworkError,
+  ON_BEHALF_ERROR_CODES: () => ON_BEHALF_ERROR_CODES,
+  OrganizationApi: () => OrganizationApi,
+  PdfApi: () => PdfApi,
   ResponseValidator: () => ResponseValidator,
   SessionApi: () => SessionApi,
   SessionFailedError: () => SessionFailedError,
@@ -63,16 +66,32 @@ var EidError = class extends Error {
 var AuthenticationError = class extends EidError {
 };
 var ForbiddenError = class extends EidError {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+  }
+  code;
 };
 var ApiError = class extends EidError {
-  constructor(status, body) {
+  constructor(status, body, code) {
     super(`RP-API ${status}: ${body}`);
     this.status = status;
     this.body = body;
+    this.code = code;
   }
   status;
   body;
+  code;
 };
+var ON_BEHALF_ERROR_CODES = [
+  "REPRESENTATION_DENIED",
+  "REPRESENTATION_PENDING",
+  "REPRESENTATION_EXPIRED",
+  "ORG_NOT_ACTIVE",
+  "SIGNER_UNIDENTIFIED",
+  "ORG_NOT_FOUND",
+  "REPRESENTATION_REVOKED"
+];
 var NetworkError = class extends EidError {
 };
 var SessionFailedError = class extends EidError {
@@ -95,21 +114,35 @@ var Http = class {
   }
   cfg;
   post(path, body, timeoutMs) {
-    return this.request("POST", path, body, timeoutMs);
+    return this.json("POST", path, JSON.stringify(body), "application/json", timeoutMs);
   }
   get(path, timeoutMs) {
-    return this.request("GET", path, void 0, timeoutMs);
+    return this.json("GET", path, void 0, void 0, timeoutMs);
+  }
+  /** multipart/form-data POST (Content-Type-ийг boundary-тай нь fetch тавина). JSON хариу. */
+  postMultipart(path, form, timeoutMs) {
+    return this.json("POST", path, form, void 0, timeoutMs);
+  }
+  /** GET — хариуг байтаар (ж: гарын үсэгтэй PDF). */
+  async getBytes(path, timeoutMs) {
+    const res = await this.send("GET", path, void 0, void 0, timeoutMs);
+    return new Uint8Array(await res.arrayBuffer());
+  }
+  async json(method, path, body, contentType, timeoutMs) {
+    const res = await this.send(method, path, body, contentType, timeoutMs);
+    const text = await res.text();
+    return text ? JSON.parse(text) : {};
   }
-  async request(method, path, body, timeoutMs) {
+  async send(method, path, body, contentType, timeoutMs) {
     const f = this.cfg.fetchImpl ?? fetch;
     const url = this.cfg.baseUrl + path;
     const init = {
       method,
       headers: {
         Authorization: `Bearer ${this.cfg.apiSecret}`,
-        ...body !== void 0 ? { "Content-Type": "application/json" } : {}
+        ...contentType ? { "Content-Type": contentType } : {}
       },
-      body: body !== void 0 ? JSON.stringify(body) : void 0,
+      body,
       signal: AbortSignal.timeout(timeoutMs ?? this.cfg.timeoutMs ?? DEFAULT_TIMEOUT_MS)
     };
     if (this.cfg.dispatcher) init.dispatcher = this.cfg.dispatcher;
@@ -123,13 +156,32 @@ var Http = class {
       }
       throw new NetworkError(`\u0421\u04AF\u043B\u0436\u044D\u044D\u043D\u0438\u0439 \u0430\u043B\u0434\u0430\u0430 (${method} ${path}): ${err.message}`);
     }
+    if (res.status < 300) return res;
     const text = await res.text();
+    const { error, code } = errorBody(text);
     if (res.status === 401) throw new AuthenticationError("API secret \u0431\u0443\u0440\u0443\u0443 \u044D\u0441\u0432\u044D\u043B \u0431\u0430\u0439\u0445\u0433\u04AF\u0439 (401)");
-    if (res.status === 403) throw new ForbiddenError("IP allowlist \u044D\u0441\u0432\u044D\u043B mTLS \u0437\u04E9\u0432\u0448\u04E9\u04E9\u0440\u04E9\u04E9\u0433\u04AF\u0439 (403)");
-    if (res.status >= 300) throw new ApiError(res.status, text);
-    return text ? JSON.parse(text) : {};
+    if (res.status === 403) {
+      throw new ForbiddenError(
+        error ? `RP-API 403${code ? ` ${code}` : ""}: ${error}` : "IP allowlist \u044D\u0441\u0432\u044D\u043B mTLS \u0437\u04E9\u0432\u0448\u04E9\u04E9\u0440\u04E9\u04E9\u0433\u04AF\u0439 (403)",
+        code
+      );
+    }
+    throw new ApiError(res.status, text, code);
   }
 };
+function errorBody(text) {
+  try {
+    const v = JSON.parse(text);
+    if (!v || typeof v !== "object") return {};
+    const o = v;
+    return {
+      error: typeof o.error === "string" && o.error ? o.error : void 0,
+      code: typeof o.code === "string" && o.code ? o.code : void 0
+    };
+  } catch {
+    return {};
+  }
+}
 
 // src/crypto.ts
 var import_node_crypto = require("crypto");
@@ -336,11 +388,37 @@ function parseSessionResult(raw) {
     serverRandom: str(sig.serverRandom),
     userChallenge: str(sig.userChallenge),
     flowType: str(sig.flowType),
+    // CA-ийн eID нэмэлт (f59d14ee-оос): гарын үсэг зурагдсан ACSP_V2 initialCallbackUrl. "" нь утга —
+    // null/undefined-аас ялгана (талбар алга = хуучин CA).
+    initialCallbackUrl: typeof sig.initialCallbackUrl === "string" ? sig.initialCallbackUrl : null,
     signatureAlgorithmParameters: parseSigParams(sig.signatureAlgorithmParameters),
     interactionTypeUsed: str(r.interactionTypeUsed),
-    onBehalfOf: parseOrg(r.onBehalfOf)
+    onBehalfOf: parseOrg(r.onBehalfOf),
+    pdf: parsePdf(r.pdf)
   };
 }
+function parsePdf(raw) {
+  const p = asRecord(raw);
+  const docID = str(p.docID);
+  if (!docID) return null;
+  const out = { docID, documentStatus: String(p.documentStatus ?? "") };
+  if (p.errorCode != null) out.errorCode = String(p.errorCode);
+  if (p.outSha256 != null) out.outSha256 = String(p.outSha256);
+  if (p.size != null) out.size = Number(p.size);
+  if (p.expiresAt != null) out.expiresAt = String(p.expiresAt);
+  if (p.signatureLevel != null) out.signatureLevel = String(p.signatureLevel);
+  const sg = asRecord(p.signer);
+  if (sg.etsi != null) {
+    out.signer = { etsi: String(sg.etsi), certSerial: String(sg.certSerial ?? "") };
+    if (sg.onBehalfOf) out.signer.onBehalfOf = String(sg.onBehalfOf);
+    if (sg.claimedRole) out.signer.claimedRole = String(sg.claimedRole);
+  }
+  const v = asRecord(p.validation);
+  if (v.indication != null) {
+    out.validation = { indication: String(v.indication), ltv: v.ltv === true, signatures: Number(v.signatures ?? 0) };
+  }
+  return out;
+}
 function parseSigParams(raw) {
   const p = asRecord(raw);
   const hash = str(p.hashAlgorithm);
@@ -395,6 +473,76 @@ var SessionApi = class {
   }
 };
 
+// src/pdf.ts
+function rec3(v) {
+  return v && typeof v === "object" ? v : {};
+}
+var PdfApi = class {
+  constructor(http, creds, defaults) {
+    this.http = http;
+    this.creds = creds;
+    this.defaults = defaults;
+  }
+  http;
+  creds;
+  defaults;
+  /** POST /pdf/sign/prepare — multipart (`request` JSON + `pdf`). SIGN эрх шаардана. */
+  async prepare(input) {
+    const request = {
+      relyingPartyUUID: this.creds.rpUUID,
+      relyingPartyName: this.creds.rpName,
+      certificateLevel: input.certificateLevel ?? this.defaults.certificateLevel,
+      signer: input.signer,
+      flow: input.flow ?? "notification",
+      fileName: input.fileName
+    };
+    if (input.initialCallbackUrl?.trim()) request.initialCallbackUrl = input.initialCallbackUrl.trim();
+    if (input.docID?.trim()) request.docID = input.docID.trim();
+    if (input.onBehalfOf?.trim()) request.onBehalfOf = input.onBehalfOf.trim();
+    const form = new FormData();
+    form.append("request", new Blob([JSON.stringify(request)], { type: "application/json" }));
+    form.append("pdf", new Blob([input.pdf], { type: "application/pdf" }), input.fileName);
+    const r = rec3(await this.http.postMultipart("/pdf/sign/prepare", form, 6e4));
+    const receivedAt = Date.now();
+    const vc = rec3(r.vc).value;
+    const dl = rec3(r.deviceLink);
+    return {
+      sessionId: String(r.sessionID),
+      docId: String(r.docID),
+      vc: vc != null ? String(vc) : null,
+      deviceLink: dl.sessionToken ? {
+        sessionToken: String(dl.sessionToken),
+        sessionSecret: String(dl.sessionSecret),
+        deviceLinkBase: String(dl.deviceLinkBase),
+        digest: String(dl.digest),
+        interactions: String(dl.interactions)
+      } : null,
+      receivedAt
+    };
+  }
+  /**
+   * GET /pdf/sign/{sessionID}/document — гарын үсэгтэй PDF (READY-ээс хойш 30 мин). Татсан байтын SHA-256-ийг
+   * session-ий `pdf.outSha256`-тай тулга. Эрх хасагдсан бол `ForbiddenError` `.code = "REPRESENTATION_REVOKED"`.
+   */
+  document(sessionId) {
+    return this.http.getBytes(`/pdf/sign/${encodeURIComponent(sessionId)}/document`, 6e4);
+  }
+};
+
+// src/organization.ts
+var OrganizationApi = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  /** GET /organization/representations/etsi/{personEtsi}. Сонголт нь итгэх эх биш — сервер дахин шалгана. */
+  async getRepresentations(personEtsi) {
+    const raw = await this.http.get(`/organization/representations/etsi/${encodeURIComponent(personEtsi)}`);
+    const list = Array.isArray(raw.representations) ? raw.representations : [];
+    return { personEtsi: String(raw.personEtsi ?? personEtsi), representations: list };
+  }
+};
+
 // src/validator.ts
 var import_node_crypto2 = require("crypto");
 var ResponseValidator = class {
@@ -447,7 +595,7 @@ var ResponseValidator = class {
       brokeredRpName: acsp.brokeredRpName,
       interactions: acsp.interactions,
       interactionTypeUsed,
-      initialCallbackUrl: acsp.initialCallbackUrl,
+      initialCallbackUrl: signedCallbackUrl(result.initialCallbackUrl, acsp.initialCallbackUrl, flowType),
       flowType
     });
     if (!verifyPayloadSignature(payload, result.signatureValueB64, leaf.publicKey, alg, hash)) {
@@ -584,6 +732,17 @@ var ResponseValidator = class {
     }
   }
 };
+function signedCallbackUrl(fromResponse, rpCallback, flowType) {
+  const rp = rpCallback ?? "";
+  if (fromResponse == null) return rp;
+  if (fromResponse !== "" && fromResponse !== rp) {
+    throw new ValidationError("signature.initialCallbackUrl \u043D\u044C \u0445\u043E\u043E\u0441\u043E\u043D \u0447 \u0431\u0438\u0448, \u0438\u043B\u0433\u044D\u044D\u0441\u044D\u043D callback \u0447 \u0431\u0438\u0448 (\u0445\u0443\u0443\u0440\u0430\u043C\u0447 \u0445\u0430\u0440\u0438\u0443 \u0431\u0430\u0439\u0436 \u0431\u043E\u043B\u0437\u043E\u0448\u0433\u04AF\u0439)");
+  }
+  if ((flowType === "Web2App" || flowType === "App2App") && fromResponse !== rp) {
+    throw new ValidationError(`${flowType} \u0443\u0440\u0441\u0433\u0430\u043B\u0434 signature.initialCallbackUrl \u043D\u044C \u0438\u043B\u0433\u044D\u044D\u0441\u044D\u043D callback \u0431\u0430\u0439\u0445 \u0451\u0441\u0442\u043E\u0439`);
+  }
+  return fromResponse;
+}
 function userChallengeOf(verifier) {
   return (0, import_node_crypto2.createHash)("sha256").update(verifier, "utf8").digest("base64url");
 }
@@ -738,6 +897,8 @@ function resolveBaseUrl(baseUrl) {
 var EidClient = class {
   auth;
   sign;
+  pdf;
+  organization;
   session;
   validator;
   constructor(cfg) {
@@ -753,6 +914,8 @@ var EidClient = class {
     const level = cfg.defaultCertificateLevel ?? "QUALIFIED";
     this.auth = new AuthApi(http, cfg.credentials, { certificateLevel: level });
     this.sign = new SignApi(http, cfg.credentials, { certificateLevel: level });
+    this.pdf = new PdfApi(http, cfg.credentials, { certificateLevel: level });
+    this.organization = new OrganizationApi(http);
     this.session = new SessionApi(http);
     this.validator = new ResponseValidator(cfg.trust ?? {});
   }
@@ -881,6 +1044,9 @@ function qrDeviceLinkTicker(input, onLink, opts) {
   ForbiddenError,
   Http,
   NetworkError,
+  ON_BEHALF_ERROR_CODES,
+  OrganizationApi,
+  PdfApi,
   ResponseValidator,
   SessionApi,
   SessionFailedError,

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { R as RpCredentials, C as CertificateLevel, I as Interaction, S as SignatureAlgorithm, H as HashAlgorithm, N as NotificationSession, D as DeviceLinkSession, a as SessionResult, A as AcspContext, F as FlowType } from './browser-PhjcbuAN.cjs';
-export { b as ApiError, c as AuthenticationError, d as DeviceLinkError, e as DeviceLinkInput, E as EidError, f as EndResult, g as ForbiddenError, h as NavigatorLike, i as NetworkError, O as OpenOrShowQROptions, j as SessionFailedError, k as SessionState, l as SignatureAlgorithmParameters, m as SignatureProtocol, V as ValidationError, n as deviceLink, o as isMobileUserAgent, p as openOrShowQR } from './browser-PhjcbuAN.cjs';
+import { R as RpCredentials, C as CertificateLevel, I as Interaction, S as SignatureAlgorithm, H as HashAlgorithm, N as NotificationSession, D as DeviceLinkSession, a as SessionResult, b as RepresentationsResponse, A as AcspContext, F as FlowType } from './browser-Db82DlYN.cjs';
+export { c as ApiError, d as AuthenticationError, e as DeviceLinkError, f as DeviceLinkInput, E as EidError, g as EndResult, h as ForbiddenError, i as NavigatorLike, j as NetworkError, O as ON_BEHALF_ERROR_CODES, k as OnBehalfErrorCode, l as OpenOrShowQROptions, m as OrgResult, P as PdfDocumentStatus, n as PdfSessionBlock, o as PdfSigner, p as Representation, q as SessionFailedError, r as SessionState, s as SignatureAlgorithmParameters, t as SignatureProtocol, V as ValidationError, u as deviceLink, v as isMobileUserAgent, w as openOrShowQR } from './browser-Db82DlYN.cjs';
 import { X509Certificate, KeyObject } from 'node:crypto';
 
 interface HttpConfig {
@@ -23,7 +23,12 @@ declare class Http {
     constructor(cfg: HttpConfig);
     post(path: string, body: unknown, timeoutMs?: number): Promise<unknown>;
     get(path: string, timeoutMs?: number): Promise<unknown>;
-    private request;
+    /** multipart/form-data POST (Content-Type-ийг boundary-тай нь fetch тавина). JSON хариу. */
+    postMultipart(path: string, form: FormData, timeoutMs?: number): Promise<unknown>;
+    /** GET — хариуг байтаар (ж: гарын үсэгтэй PDF). */
+    getBytes(path: string, timeoutMs?: number): Promise<Uint8Array>;
+    private json;
+    private send;
 }
 
 interface AuthDefaults {
@@ -131,6 +136,73 @@ declare class SessionApi {
     }): Promise<SessionResult>;
 }
 
+interface PdfDefaults {
+    certificateLevel: CertificateLevel;
+}
+/** Гарын үсэг зурагч — яг нэг нь. */
+type PdfSignerRef = {
+    etsi: string;
+} | {
+    documentNumber: string;
+} | {
+    certificateChoiceSessionId: string;
+};
+interface PdfPrepareInput {
+    /** Эх PDF (≤ 10 223 616 байт — `/.well-known/eid` `pdfSigning.maxInputBytes`). */
+    pdf: Uint8Array;
+    /** Баримтын нэр (≤ 120 тэмдэгт) — /verify хуудас, иргэний түүхэнд харагдана. */
+    fileName: string;
+    signer: PdfSignerRef;
+    /** `notification` (push) эсвэл `device-link` (QR/Web2App/App2App). Анхдагч notification. */
+    flow?: "notification" | "device-link";
+    certificateLevel?: CertificateLevel;
+    /** device-link Web2App/App2App буцах URL. */
+    initialCallbackUrl?: string;
+    /** Олон гарын үсэгтэй баримтад хүлээж буй docID (заавал биш — CA өөрөө олно). */
+    docID?: string;
+    /**
+     * Байгууллагын нэрийн өмнөөс: байгууллагын ETSI (`NTRMN-<бүртгэл>`). Сервер төлөөллийг prepare-д ба баримт
+     * угсрахын өмнө дахин шалгана; татгалзвал `ForbiddenError`/`ApiError` `.code` ({@link OnBehalfErrorCode}).
+     */
+    onBehalfOf?: string;
+}
+/** prepare-ийн хариу. device-link-д `deviceLink` (digest/interactions-ийг authCode-д ЯГ ХЭВЭЭР). */
+interface PdfPrepareSession {
+    sessionId: string;
+    docId: string;
+    /** Иргэнд ХАРУУЛАХ баталгаажуулах код (ПИН биш). */
+    vc: string | null;
+    deviceLink: {
+        sessionToken: string;
+        sessionSecret: string;
+        deviceLinkBase: string;
+        digest: string;
+        interactions: string;
+    } | null;
+    /** SDK хариу хүлээн авсан мөч (ms epoch) — QR-ийн `receivedAt` ({@link buildDeviceLink}). */
+    receivedAt: number;
+}
+declare class PdfApi {
+    private readonly http;
+    private readonly creds;
+    private readonly defaults;
+    constructor(http: Http, creds: RpCredentials, defaults: PdfDefaults);
+    /** POST /pdf/sign/prepare — multipart (`request` JSON + `pdf`). SIGN эрх шаардана. */
+    prepare(input: PdfPrepareInput): Promise<PdfPrepareSession>;
+    /**
+     * GET /pdf/sign/{sessionID}/document — гарын үсэгтэй PDF (READY-ээс хойш 30 мин). Татсан байтын SHA-256-ийг
+     * session-ий `pdf.outSha256`-тай тулга. Эрх хасагдсан бол `ForbiddenError` `.code = "REPRESENTATION_REVOKED"`.
+     */
+    document(sessionId: string): Promise<Uint8Array>;
+}
+
+declare class OrganizationApi {
+    private readonly http;
+    constructor(http: Http);
+    /** GET /organization/representations/etsi/{personEtsi}. Сонголт нь итгэх эх биш — сервер дахин шалгана. */
+    getRepresentations(personEtsi: string): Promise<RepresentationsResponse>;
+}
+
 /**
  * validateAuth-ийн нэмэлт шалгалт — RP ЯМАР урсгал эхлүүлснээ мэддэг тул түүнийг тулгана
  * (device-link relay хаалт).
@@ -283,6 +355,8 @@ declare function resolveBaseUrl(baseUrl: string | undefined): string;
 declare class EidClient {
     readonly auth: AuthApi;
     readonly sign: SignApi;
+    readonly pdf: PdfApi;
+    readonly organization: OrganizationApi;
     readonly session: SessionApi;
     readonly validator: ResponseValidator;
     constructor(cfg: ClientConfig);
@@ -383,4 +457,4 @@ interface QrDeviceLinkTickerOptions {
  */
 declare function qrDeviceLinkTicker(input: Omit<BuildDeviceLinkInput, "deviceLinkType" | "now">, onLink: (link: string) => void, opts?: QrDeviceLinkTickerOptions): () => void;
 
-export { AcspContext, type AcspV2Params, AuthApi, type AuthDefaults, type AuthOptions, type BuildDeviceLinkInput, CertificateLevel, type ClientConfig, DEFAULT_BASE_URL, DeviceLinkSession, type DeviceLinkSessionType, type DeviceLinkType, EidClient, FlowType, HashAlgorithm, Http, type HttpConfig, Interaction, NotificationSession, type QrDeviceLinkTickerOptions, ResponseValidator, type RevocationChecker, type RevocationStatus, RpCredentials, SessionApi, SessionResult, SignApi, type SignDefaults, type SignOptions, SignatureAlgorithm, type TrustConfig, type ValidateAuthOptions, type VerifiedIdentity, type VerifiedSignature, acspV2Digest, buildAcspV2Payload, buildDeviceLink, interactionsToBase64, parseSessionResult, qrDeviceLinkTicker, randomChallenge, resolveBaseUrl, sha256Base64, userChallengeOf, verifyPayloadSignature, verifyPrehashedSignature };
+export { AcspContext, type AcspV2Params, AuthApi, type AuthDefaults, type AuthOptions, type BuildDeviceLinkInput, CertificateLevel, type ClientConfig, DEFAULT_BASE_URL, DeviceLinkSession, type DeviceLinkSessionType, type DeviceLinkType, EidClient, FlowType, HashAlgorithm, Http, type HttpConfig, Interaction, NotificationSession, OrganizationApi, PdfApi, type PdfDefaults, type PdfPrepareInput, type PdfPrepareSession, type PdfSignerRef, type QrDeviceLinkTickerOptions, RepresentationsResponse, ResponseValidator, type RevocationChecker, type RevocationStatus, RpCredentials, SessionApi, SessionResult, SignApi, type SignDefaults, type SignOptions, SignatureAlgorithm, type TrustConfig, type ValidateAuthOptions, type VerifiedIdentity, type VerifiedSignature, acspV2Digest, buildAcspV2Payload, buildDeviceLink, interactionsToBase64, parseSessionResult, qrDeviceLinkTicker, randomChallenge, resolveBaseUrl, sha256Base64, userChallengeOf, verifyPayloadSignature, verifyPrehashedSignature };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { R as RpCredentials, C as CertificateLevel, I as Interaction, S as SignatureAlgorithm, H as HashAlgorithm, N as NotificationSession, D as DeviceLinkSession, a as SessionResult, A as AcspContext, F as FlowType } from './browser-PhjcbuAN.js';
-export { b as ApiError, c as AuthenticationError, d as DeviceLinkError, e as DeviceLinkInput, E as EidError, f as EndResult, g as ForbiddenError, h as NavigatorLike, i as NetworkError, O as OpenOrShowQROptions, j as SessionFailedError, k as SessionState, l as SignatureAlgorithmParameters, m as SignatureProtocol, V as ValidationError, n as deviceLink, o as isMobileUserAgent, p as openOrShowQR } from './browser-PhjcbuAN.js';
+import { R as RpCredentials, C as CertificateLevel, I as Interaction, S as SignatureAlgorithm, H as HashAlgorithm, N as NotificationSession, D as DeviceLinkSession, a as SessionResult, b as RepresentationsResponse, A as AcspContext, F as FlowType } from './browser-Db82DlYN.js';
+export { c as ApiError, d as AuthenticationError, e as DeviceLinkError, f as DeviceLinkInput, E as EidError, g as EndResult, h as ForbiddenError, i as NavigatorLike, j as NetworkError, O as ON_BEHALF_ERROR_CODES, k as OnBehalfErrorCode, l as OpenOrShowQROptions, m as OrgResult, P as PdfDocumentStatus, n as PdfSessionBlock, o as PdfSigner, p as Representation, q as SessionFailedError, r as SessionState, s as SignatureAlgorithmParameters, t as SignatureProtocol, V as ValidationError, u as deviceLink, v as isMobileUserAgent, w as openOrShowQR } from './browser-Db82DlYN.js';
 import { X509Certificate, KeyObject } from 'node:crypto';
 
 interface HttpConfig {
@@ -23,7 +23,12 @@ declare class Http {
     constructor(cfg: HttpConfig);
     post(path: string, body: unknown, timeoutMs?: number): Promise<unknown>;
     get(path: string, timeoutMs?: number): Promise<unknown>;
-    private request;
+    /** multipart/form-data POST (Content-Type-ийг boundary-тай нь fetch тавина). JSON хариу. */
+    postMultipart(path: string, form: FormData, timeoutMs?: number): Promise<unknown>;
+    /** GET — хариуг байтаар (ж: гарын үсэгтэй PDF). */
+    getBytes(path: string, timeoutMs?: number): Promise<Uint8Array>;
+    private json;
+    private send;
 }
 
 interface AuthDefaults {
@@ -131,6 +136,73 @@ declare class SessionApi {
     }): Promise<SessionResult>;
 }
 
+interface PdfDefaults {
+    certificateLevel: CertificateLevel;
+}
+/** Гарын үсэг зурагч — яг нэг нь. */
+type PdfSignerRef = {
+    etsi: string;
+} | {
+    documentNumber: string;
+} | {
+    certificateChoiceSessionId: string;
+};
+interface PdfPrepareInput {
+    /** Эх PDF (≤ 10 223 616 байт — `/.well-known/eid` `pdfSigning.maxInputBytes`). */
+    pdf: Uint8Array;
+    /** Баримтын нэр (≤ 120 тэмдэгт) — /verify хуудас, иргэний түүхэнд харагдана. */
+    fileName: string;
+    signer: PdfSignerRef;
+    /** `notification` (push) эсвэл `device-link` (QR/Web2App/App2App). Анхдагч notification. */
+    flow?: "notification" | "device-link";
+    certificateLevel?: CertificateLevel;
+    /** device-link Web2App/App2App буцах URL. */
+    initialCallbackUrl?: string;
+    /** Олон гарын үсэгтэй баримтад хүлээж буй docID (заавал биш — CA өөрөө олно). */
+    docID?: string;
+    /**
+     * Байгууллагын нэрийн өмнөөс: байгууллагын ETSI (`NTRMN-<бүртгэл>`). Сервер төлөөллийг prepare-д ба баримт
+     * угсрахын өмнө дахин шалгана; татгалзвал `ForbiddenError`/`ApiError` `.code` ({@link OnBehalfErrorCode}).
+     */
+    onBehalfOf?: string;
+}
+/** prepare-ийн хариу. device-link-д `deviceLink` (digest/interactions-ийг authCode-д ЯГ ХЭВЭЭР). */
+interface PdfPrepareSession {
+    sessionId: string;
+    docId: string;
+    /** Иргэнд ХАРУУЛАХ баталгаажуулах код (ПИН биш). */
+    vc: string | null;
+    deviceLink: {
+        sessionToken: string;
+        sessionSecret: string;
+        deviceLinkBase: string;
+        digest: string;
+        interactions: string;
+    } | null;
+    /** SDK хариу хүлээн авсан мөч (ms epoch) — QR-ийн `receivedAt` ({@link buildDeviceLink}). */
+    receivedAt: number;
+}
+declare class PdfApi {
+    private readonly http;
+    private readonly creds;
+    private readonly defaults;
+    constructor(http: Http, creds: RpCredentials, defaults: PdfDefaults);
+    /** POST /pdf/sign/prepare — multipart (`request` JSON + `pdf`). SIGN эрх шаардана. */
+    prepare(input: PdfPrepareInput): Promise<PdfPrepareSession>;
+    /**
+     * GET /pdf/sign/{sessionID}/document — гарын үсэгтэй PDF (READY-ээс хойш 30 мин). Татсан байтын SHA-256-ийг
+     * session-ий `pdf.outSha256`-тай тулга. Эрх хасагдсан бол `ForbiddenError` `.code = "REPRESENTATION_REVOKED"`.
+     */
+    document(sessionId: string): Promise<Uint8Array>;
+}
+
+declare class OrganizationApi {
+    private readonly http;
+    constructor(http: Http);
+    /** GET /organization/representations/etsi/{personEtsi}. Сонголт нь итгэх эх биш — сервер дахин шалгана. */
+    getRepresentations(personEtsi: string): Promise<RepresentationsResponse>;
+}
+
 /**
  * validateAuth-ийн нэмэлт шалгалт — RP ЯМАР урсгал эхлүүлснээ мэддэг тул түүнийг тулгана
  * (device-link relay хаалт).
@@ -283,6 +355,8 @@ declare function resolveBaseUrl(baseUrl: string | undefined): string;
 declare class EidClient {
     readonly auth: AuthApi;
     readonly sign: SignApi;
+    readonly pdf: PdfApi;
+    readonly organization: OrganizationApi;
     readonly session: SessionApi;
     readonly validator: ResponseValidator;
     constructor(cfg: ClientConfig);
@@ -383,4 +457,4 @@ interface QrDeviceLinkTickerOptions {
  */
 declare function qrDeviceLinkTicker(input: Omit<BuildDeviceLinkInput, "deviceLinkType" | "now">, onLink: (link: string) => void, opts?: QrDeviceLinkTickerOptions): () => void;
 
-export { AcspContext, type AcspV2Params, AuthApi, type AuthDefaults, type AuthOptions, type BuildDeviceLinkInput, CertificateLevel, type ClientConfig, DEFAULT_BASE_URL, DeviceLinkSession, type DeviceLinkSessionType, type DeviceLinkType, EidClient, FlowType, HashAlgorithm, Http, type HttpConfig, Interaction, NotificationSession, type QrDeviceLinkTickerOptions, ResponseValidator, type RevocationChecker, type RevocationStatus, RpCredentials, SessionApi, SessionResult, SignApi, type SignDefaults, type SignOptions, SignatureAlgorithm, type TrustConfig, type ValidateAuthOptions, type VerifiedIdentity, type VerifiedSignature, acspV2Digest, buildAcspV2Payload, buildDeviceLink, interactionsToBase64, parseSessionResult, qrDeviceLinkTicker, randomChallenge, resolveBaseUrl, sha256Base64, userChallengeOf, verifyPayloadSignature, verifyPrehashedSignature };
+export { AcspContext, type AcspV2Params, AuthApi, type AuthDefaults, type AuthOptions, type BuildDeviceLinkInput, CertificateLevel, type ClientConfig, DEFAULT_BASE_URL, DeviceLinkSession, type DeviceLinkSessionType, type DeviceLinkType, EidClient, FlowType, HashAlgorithm, Http, type HttpConfig, Interaction, NotificationSession, OrganizationApi, PdfApi, type PdfDefaults, type PdfPrepareInput, type PdfPrepareSession, type PdfSignerRef, type QrDeviceLinkTickerOptions, RepresentationsResponse, ResponseValidator, type RevocationChecker, type RevocationStatus, RpCredentials, SessionApi, SessionResult, SignApi, type SignDefaults, type SignOptions, SignatureAlgorithm, type TrustConfig, type ValidateAuthOptions, type VerifiedIdentity, type VerifiedSignature, acspV2Digest, buildAcspV2Payload, buildDeviceLink, interactionsToBase64, parseSessionResult, qrDeviceLinkTicker, randomChallenge, resolveBaseUrl, sha256Base64, userChallengeOf, verifyPayloadSignature, verifyPrehashedSignature };

package/dist/index.js

@@ -5,12 +5,13 @@ import {
   EidError,
   ForbiddenError,
   NetworkError,
+  ON_BEHALF_ERROR_CODES,
   SessionFailedError,
   ValidationError,
   deviceLink,
   isMobileUserAgent,
   openOrShowQR
-} from "./chunk-Q5TQMCJC.js";
+} from "./chunk-NXDKQZIW.js";
 
 // src/http.ts
 var DEFAULT_TIMEOUT_MS = 15e3;
@@ -20,21 +21,35 @@ var Http = class {
   }
   cfg;
   post(path, body, timeoutMs) {
-    return this.request("POST", path, body, timeoutMs);
+    return this.json("POST", path, JSON.stringify(body), "application/json", timeoutMs);
   }
   get(path, timeoutMs) {
-    return this.request("GET", path, void 0, timeoutMs);
+    return this.json("GET", path, void 0, void 0, timeoutMs);
   }
-  async request(method, path, body, timeoutMs) {
+  /** multipart/form-data POST (Content-Type-ийг boundary-тай нь fetch тавина). JSON хариу. */
+  postMultipart(path, form, timeoutMs) {
+    return this.json("POST", path, form, void 0, timeoutMs);
+  }
+  /** GET — хариуг байтаар (ж: гарын үсэгтэй PDF). */
+  async getBytes(path, timeoutMs) {
+    const res = await this.send("GET", path, void 0, void 0, timeoutMs);
+    return new Uint8Array(await res.arrayBuffer());
+  }
+  async json(method, path, body, contentType, timeoutMs) {
+    const res = await this.send(method, path, body, contentType, timeoutMs);
+    const text = await res.text();
+    return text ? JSON.parse(text) : {};
+  }
+  async send(method, path, body, contentType, timeoutMs) {
     const f = this.cfg.fetchImpl ?? fetch;
     const url = this.cfg.baseUrl + path;
     const init = {
       method,
       headers: {
         Authorization: `Bearer ${this.cfg.apiSecret}`,
-        ...body !== void 0 ? { "Content-Type": "application/json" } : {}
+        ...contentType ? { "Content-Type": contentType } : {}
       },
-      body: body !== void 0 ? JSON.stringify(body) : void 0,
+      body,
       signal: AbortSignal.timeout(timeoutMs ?? this.cfg.timeoutMs ?? DEFAULT_TIMEOUT_MS)
     };
     if (this.cfg.dispatcher) init.dispatcher = this.cfg.dispatcher;
@@ -48,13 +63,32 @@ var Http = class {
       }
       throw new NetworkError(`\u0421\u04AF\u043B\u0436\u044D\u044D\u043D\u0438\u0439 \u0430\u043B\u0434\u0430\u0430 (${method} ${path}): ${err.message}`);
     }
+    if (res.status < 300) return res;
     const text = await res.text();
+    const { error, code } = errorBody(text);
     if (res.status === 401) throw new AuthenticationError("API secret \u0431\u0443\u0440\u0443\u0443 \u044D\u0441\u0432\u044D\u043B \u0431\u0430\u0439\u0445\u0433\u04AF\u0439 (401)");
-    if (res.status === 403) throw new ForbiddenError("IP allowlist \u044D\u0441\u0432\u044D\u043B mTLS \u0437\u04E9\u0432\u0448\u04E9\u04E9\u0440\u04E9\u04E9\u0433\u04AF\u0439 (403)");
-    if (res.status >= 300) throw new ApiError(res.status, text);
-    return text ? JSON.parse(text) : {};
+    if (res.status === 403) {
+      throw new ForbiddenError(
+        error ? `RP-API 403${code ? ` ${code}` : ""}: ${error}` : "IP allowlist \u044D\u0441\u0432\u044D\u043B mTLS \u0437\u04E9\u0432\u0448\u04E9\u04E9\u0440\u04E9\u04E9\u0433\u04AF\u0439 (403)",
+        code
+      );
+    }
+    throw new ApiError(res.status, text, code);
   }
 };
+function errorBody(text) {
+  try {
+    const v = JSON.parse(text);
+    if (!v || typeof v !== "object") return {};
+    const o = v;
+    return {
+      error: typeof o.error === "string" && o.error ? o.error : void 0,
+      code: typeof o.code === "string" && o.code ? o.code : void 0
+    };
+  } catch {
+    return {};
+  }
+}
 
 // src/crypto.ts
 import { createHash, randomBytes } from "crypto";
@@ -261,11 +295,37 @@ function parseSessionResult(raw) {
     serverRandom: str(sig.serverRandom),
     userChallenge: str(sig.userChallenge),
     flowType: str(sig.flowType),
+    // CA-ийн eID нэмэлт (f59d14ee-оос): гарын үсэг зурагдсан ACSP_V2 initialCallbackUrl. "" нь утга —
+    // null/undefined-аас ялгана (талбар алга = хуучин CA).
+    initialCallbackUrl: typeof sig.initialCallbackUrl === "string" ? sig.initialCallbackUrl : null,
     signatureAlgorithmParameters: parseSigParams(sig.signatureAlgorithmParameters),
     interactionTypeUsed: str(r.interactionTypeUsed),
-    onBehalfOf: parseOrg(r.onBehalfOf)
+    onBehalfOf: parseOrg(r.onBehalfOf),
+    pdf: parsePdf(r.pdf)
   };
 }
+function parsePdf(raw) {
+  const p = asRecord(raw);
+  const docID = str(p.docID);
+  if (!docID) return null;
+  const out = { docID, documentStatus: String(p.documentStatus ?? "") };
+  if (p.errorCode != null) out.errorCode = String(p.errorCode);
+  if (p.outSha256 != null) out.outSha256 = String(p.outSha256);
+  if (p.size != null) out.size = Number(p.size);
+  if (p.expiresAt != null) out.expiresAt = String(p.expiresAt);
+  if (p.signatureLevel != null) out.signatureLevel = String(p.signatureLevel);
+  const sg = asRecord(p.signer);
+  if (sg.etsi != null) {
+    out.signer = { etsi: String(sg.etsi), certSerial: String(sg.certSerial ?? "") };
+    if (sg.onBehalfOf) out.signer.onBehalfOf = String(sg.onBehalfOf);
+    if (sg.claimedRole) out.signer.claimedRole = String(sg.claimedRole);
+  }
+  const v = asRecord(p.validation);
+  if (v.indication != null) {
+    out.validation = { indication: String(v.indication), ltv: v.ltv === true, signatures: Number(v.signatures ?? 0) };
+  }
+  return out;
+}
 function parseSigParams(raw) {
   const p = asRecord(raw);
   const hash = str(p.hashAlgorithm);
@@ -320,6 +380,76 @@ var SessionApi = class {
   }
 };
 
+// src/pdf.ts
+function rec3(v) {
+  return v && typeof v === "object" ? v : {};
+}
+var PdfApi = class {
+  constructor(http, creds, defaults) {
+    this.http = http;
+    this.creds = creds;
+    this.defaults = defaults;
+  }
+  http;
+  creds;
+  defaults;
+  /** POST /pdf/sign/prepare — multipart (`request` JSON + `pdf`). SIGN эрх шаардана. */
+  async prepare(input) {
+    const request = {
+      relyingPartyUUID: this.creds.rpUUID,
+      relyingPartyName: this.creds.rpName,
+      certificateLevel: input.certificateLevel ?? this.defaults.certificateLevel,
+      signer: input.signer,
+      flow: input.flow ?? "notification",
+      fileName: input.fileName
+    };
+    if (input.initialCallbackUrl?.trim()) request.initialCallbackUrl = input.initialCallbackUrl.trim();
+    if (input.docID?.trim()) request.docID = input.docID.trim();
+    if (input.onBehalfOf?.trim()) request.onBehalfOf = input.onBehalfOf.trim();
+    const form = new FormData();
+    form.append("request", new Blob([JSON.stringify(request)], { type: "application/json" }));
+    form.append("pdf", new Blob([input.pdf], { type: "application/pdf" }), input.fileName);
+    const r = rec3(await this.http.postMultipart("/pdf/sign/prepare", form, 6e4));
+    const receivedAt = Date.now();
+    const vc = rec3(r.vc).value;
+    const dl = rec3(r.deviceLink);
+    return {
+      sessionId: String(r.sessionID),
+      docId: String(r.docID),
+      vc: vc != null ? String(vc) : null,
+      deviceLink: dl.sessionToken ? {
+        sessionToken: String(dl.sessionToken),
+        sessionSecret: String(dl.sessionSecret),
+        deviceLinkBase: String(dl.deviceLinkBase),
+        digest: String(dl.digest),
+        interactions: String(dl.interactions)
+      } : null,
+      receivedAt
+    };
+  }
+  /**
+   * GET /pdf/sign/{sessionID}/document — гарын үсэгтэй PDF (READY-ээс хойш 30 мин). Татсан байтын SHA-256-ийг
+   * session-ий `pdf.outSha256`-тай тулга. Эрх хасагдсан бол `ForbiddenError` `.code = "REPRESENTATION_REVOKED"`.
+   */
+  document(sessionId) {
+    return this.http.getBytes(`/pdf/sign/${encodeURIComponent(sessionId)}/document`, 6e4);
+  }
+};
+
+// src/organization.ts
+var OrganizationApi = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  /** GET /organization/representations/etsi/{personEtsi}. Сонголт нь итгэх эх биш — сервер дахин шалгана. */
+  async getRepresentations(personEtsi) {
+    const raw = await this.http.get(`/organization/representations/etsi/${encodeURIComponent(personEtsi)}`);
+    const list = Array.isArray(raw.representations) ? raw.representations : [];
+    return { personEtsi: String(raw.personEtsi ?? personEtsi), representations: list };
+  }
+};
+
 // src/validator.ts
 import { X509Certificate, constants, createHash as createHash2, publicDecrypt, verify } from "crypto";
 var ResponseValidator = class {
@@ -372,7 +502,7 @@ var ResponseValidator = class {
       brokeredRpName: acsp.brokeredRpName,
       interactions: acsp.interactions,
       interactionTypeUsed,
-      initialCallbackUrl: acsp.initialCallbackUrl,
+      initialCallbackUrl: signedCallbackUrl(result.initialCallbackUrl, acsp.initialCallbackUrl, flowType),
       flowType
     });
     if (!verifyPayloadSignature(payload, result.signatureValueB64, leaf.publicKey, alg, hash)) {
@@ -509,6 +639,17 @@ var ResponseValidator = class {
     }
   }
 };
+function signedCallbackUrl(fromResponse, rpCallback, flowType) {
+  const rp = rpCallback ?? "";
+  if (fromResponse == null) return rp;
+  if (fromResponse !== "" && fromResponse !== rp) {
+    throw new ValidationError("signature.initialCallbackUrl \u043D\u044C \u0445\u043E\u043E\u0441\u043E\u043D \u0447 \u0431\u0438\u0448, \u0438\u043B\u0433\u044D\u044D\u0441\u044D\u043D callback \u0447 \u0431\u0438\u0448 (\u0445\u0443\u0443\u0440\u0430\u043C\u0447 \u0445\u0430\u0440\u0438\u0443 \u0431\u0430\u0439\u0436 \u0431\u043E\u043B\u0437\u043E\u0448\u0433\u04AF\u0439)");
+  }
+  if ((flowType === "Web2App" || flowType === "App2App") && fromResponse !== rp) {
+    throw new ValidationError(`${flowType} \u0443\u0440\u0441\u0433\u0430\u043B\u0434 signature.initialCallbackUrl \u043D\u044C \u0438\u043B\u0433\u044D\u044D\u0441\u044D\u043D callback \u0431\u0430\u0439\u0445 \u0451\u0441\u0442\u043E\u0439`);
+  }
+  return fromResponse;
+}
 function userChallengeOf(verifier) {
   return createHash2("sha256").update(verifier, "utf8").digest("base64url");
 }
@@ -663,6 +804,8 @@ function resolveBaseUrl(baseUrl) {
 var EidClient = class {
   auth;
   sign;
+  pdf;
+  organization;
   session;
   validator;
   constructor(cfg) {
@@ -678,6 +821,8 @@ var EidClient = class {
     const level = cfg.defaultCertificateLevel ?? "QUALIFIED";
     this.auth = new AuthApi(http, cfg.credentials, { certificateLevel: level });
     this.sign = new SignApi(http, cfg.credentials, { certificateLevel: level });
+    this.pdf = new PdfApi(http, cfg.credentials, { certificateLevel: level });
+    this.organization = new OrganizationApi(http);
     this.session = new SessionApi(http);
     this.validator = new ResponseValidator(cfg.trust ?? {});
   }
@@ -763,6 +908,9 @@ export {
   ForbiddenError,
   Http,
   NetworkError,
+  ON_BEHALF_ERROR_CODES,
+  OrganizationApi,
+  PdfApi,
   ResponseValidator,
   SessionApi,
   SessionFailedError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gerege-systems/eid-mongolia-sdk",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "e-ID Mongolia Relying Party SDK — иргэнээр утсаар нь нэвтрэлт ба хууль ёсны цахим гарын үсэг (RP-API v3, Smart-ID нийцтэй).",
   "license": "MIT",
   "type": "module",