@gerege-systems/eid-mongolia-sdk 0.6.1 → 0.8.0

package/dist/index.cjs

@@ -25,11 +25,19 @@ __export(index_exports, {
   AuthenticationError: () => AuthenticationError,
   DEFAULT_BASE_URL: () => DEFAULT_BASE_URL,
   DeviceLinkError: () => DeviceLinkError,
+  EID_ACR_ADVANCED: () => EID_ACR_ADVANCED,
+  EID_ACR_QUALIFIED: () => EID_ACR_QUALIFIED,
+  EID_OIDC_ISSUER: () => EID_OIDC_ISSUER,
   EidClient: () => EidClient,
   EidError: () => EidError,
+  EidOidcClient: () => EidOidcClient,
+  EidOidcError: () => EidOidcError,
   ForbiddenError: () => ForbiddenError,
   Http: () => Http,
   NetworkError: () => NetworkError,
+  ON_BEHALF_ERROR_CODES: () => ON_BEHALF_ERROR_CODES,
+  OrganizationApi: () => OrganizationApi,
+  PdfApi: () => PdfApi,
   ResponseValidator: () => ResponseValidator,
   SessionApi: () => SessionApi,
   SessionFailedError: () => SessionFailedError,
@@ -43,6 +51,7 @@ __export(index_exports, {
   isMobileUserAgent: () => isMobileUserAgent,
   openOrShowQR: () => openOrShowQR,
   parseSessionResult: () => parseSessionResult,
+  pkceChallenge: () => pkceChallenge,
   qrDeviceLinkTicker: () => qrDeviceLinkTicker,
   randomChallenge: () => randomChallenge,
   resolveBaseUrl: () => resolveBaseUrl,
@@ -63,16 +72,32 @@ var EidError = class extends Error {
 var AuthenticationError = class extends EidError {
 };
 var ForbiddenError = class extends EidError {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+  }
+  code;
 };
 var ApiError = class extends EidError {
-  constructor(status, body) {
+  constructor(status, body, code) {
     super(`RP-API ${status}: ${body}`);
     this.status = status;
     this.body = body;
+    this.code = code;
   }
   status;
   body;
+  code;
 };
+var ON_BEHALF_ERROR_CODES = [
+  "REPRESENTATION_DENIED",
+  "REPRESENTATION_PENDING",
+  "REPRESENTATION_EXPIRED",
+  "ORG_NOT_ACTIVE",
+  "SIGNER_UNIDENTIFIED",
+  "ORG_NOT_FOUND",
+  "REPRESENTATION_REVOKED"
+];
 var NetworkError = class extends EidError {
 };
 var SessionFailedError = class extends EidError {
@@ -95,21 +120,35 @@ var Http = class {
   }
   cfg;
   post(path, body, timeoutMs) {
-    return this.request("POST", path, body, timeoutMs);
+    return this.json("POST", path, JSON.stringify(body), "application/json", timeoutMs);
   }
   get(path, timeoutMs) {
-    return this.request("GET", path, void 0, timeoutMs);
+    return this.json("GET", path, void 0, void 0, timeoutMs);
+  }
+  /** multipart/form-data POST (Content-Type-ийг boundary-тай нь fetch тавина). JSON хариу. */
+  postMultipart(path, form, timeoutMs) {
+    return this.json("POST", path, form, void 0, timeoutMs);
+  }
+  /** GET — хариуг байтаар (ж: гарын үсэгтэй PDF). */
+  async getBytes(path, timeoutMs) {
+    const res = await this.send("GET", path, void 0, void 0, timeoutMs);
+    return new Uint8Array(await res.arrayBuffer());
   }
-  async request(method, path, body, timeoutMs) {
+  async json(method, path, body, contentType, timeoutMs) {
+    const res = await this.send(method, path, body, contentType, timeoutMs);
+    const text = await res.text();
+    return text ? JSON.parse(text) : {};
+  }
+  async send(method, path, body, contentType, timeoutMs) {
     const f = this.cfg.fetchImpl ?? fetch;
     const url = this.cfg.baseUrl + path;
     const init = {
       method,
       headers: {
         Authorization: `Bearer ${this.cfg.apiSecret}`,
-        ...body !== void 0 ? { "Content-Type": "application/json" } : {}
+        ...contentType ? { "Content-Type": contentType } : {}
       },
-      body: body !== void 0 ? JSON.stringify(body) : void 0,
+      body,
       signal: AbortSignal.timeout(timeoutMs ?? this.cfg.timeoutMs ?? DEFAULT_TIMEOUT_MS)
     };
     if (this.cfg.dispatcher) init.dispatcher = this.cfg.dispatcher;
@@ -123,13 +162,32 @@ var Http = class {
       }
       throw new NetworkError(`\u0421\u04AF\u043B\u0436\u044D\u044D\u043D\u0438\u0439 \u0430\u043B\u0434\u0430\u0430 (${method} ${path}): ${err.message}`);
     }
+    if (res.status < 300) return res;
     const text = await res.text();
+    const { error, code } = errorBody(text);
     if (res.status === 401) throw new AuthenticationError("API secret \u0431\u0443\u0440\u0443\u0443 \u044D\u0441\u0432\u044D\u043B \u0431\u0430\u0439\u0445\u0433\u04AF\u0439 (401)");
-    if (res.status === 403) throw new ForbiddenError("IP allowlist \u044D\u0441\u0432\u044D\u043B mTLS \u0437\u04E9\u0432\u0448\u04E9\u04E9\u0440\u04E9\u04E9\u0433\u04AF\u0439 (403)");
-    if (res.status >= 300) throw new ApiError(res.status, text);
-    return text ? JSON.parse(text) : {};
+    if (res.status === 403) {
+      throw new ForbiddenError(
+        error ? `RP-API 403${code ? ` ${code}` : ""}: ${error}` : "IP allowlist \u044D\u0441\u0432\u044D\u043B mTLS \u0437\u04E9\u0432\u0448\u04E9\u04E9\u0440\u04E9\u04E9\u0433\u04AF\u0439 (403)",
+        code
+      );
+    }
+    throw new ApiError(res.status, text, code);
   }
 };
+function errorBody(text) {
+  try {
+    const v = JSON.parse(text);
+    if (!v || typeof v !== "object") return {};
+    const o = v;
+    return {
+      error: typeof o.error === "string" && o.error ? o.error : void 0,
+      code: typeof o.code === "string" && o.code ? o.code : void 0
+    };
+  } catch {
+    return {};
+  }
+}
 
 // src/crypto.ts
 var import_node_crypto = require("crypto");
@@ -341,9 +399,32 @@ function parseSessionResult(raw) {
     initialCallbackUrl: typeof sig.initialCallbackUrl === "string" ? sig.initialCallbackUrl : null,
     signatureAlgorithmParameters: parseSigParams(sig.signatureAlgorithmParameters),
     interactionTypeUsed: str(r.interactionTypeUsed),
-    onBehalfOf: parseOrg(r.onBehalfOf)
+    onBehalfOf: parseOrg(r.onBehalfOf),
+    pdf: parsePdf(r.pdf)
   };
 }
+function parsePdf(raw) {
+  const p = asRecord(raw);
+  const docID = str(p.docID);
+  if (!docID) return null;
+  const out = { docID, documentStatus: String(p.documentStatus ?? "") };
+  if (p.errorCode != null) out.errorCode = String(p.errorCode);
+  if (p.outSha256 != null) out.outSha256 = String(p.outSha256);
+  if (p.size != null) out.size = Number(p.size);
+  if (p.expiresAt != null) out.expiresAt = String(p.expiresAt);
+  if (p.signatureLevel != null) out.signatureLevel = String(p.signatureLevel);
+  const sg = asRecord(p.signer);
+  if (sg.etsi != null) {
+    out.signer = { etsi: String(sg.etsi), certSerial: String(sg.certSerial ?? "") };
+    if (sg.onBehalfOf) out.signer.onBehalfOf = String(sg.onBehalfOf);
+    if (sg.claimedRole) out.signer.claimedRole = String(sg.claimedRole);
+  }
+  const v = asRecord(p.validation);
+  if (v.indication != null) {
+    out.validation = { indication: String(v.indication), ltv: v.ltv === true, signatures: Number(v.signatures ?? 0) };
+  }
+  return out;
+}
 function parseSigParams(raw) {
   const p = asRecord(raw);
   const hash = str(p.hashAlgorithm);
@@ -398,6 +479,76 @@ var SessionApi = class {
   }
 };
 
+// src/pdf.ts
+function rec3(v) {
+  return v && typeof v === "object" ? v : {};
+}
+var PdfApi = class {
+  constructor(http, creds, defaults) {
+    this.http = http;
+    this.creds = creds;
+    this.defaults = defaults;
+  }
+  http;
+  creds;
+  defaults;
+  /** POST /pdf/sign/prepare — multipart (`request` JSON + `pdf`). SIGN эрх шаардана. */
+  async prepare(input) {
+    const request = {
+      relyingPartyUUID: this.creds.rpUUID,
+      relyingPartyName: this.creds.rpName,
+      certificateLevel: input.certificateLevel ?? this.defaults.certificateLevel,
+      signer: input.signer,
+      flow: input.flow ?? "notification",
+      fileName: input.fileName
+    };
+    if (input.initialCallbackUrl?.trim()) request.initialCallbackUrl = input.initialCallbackUrl.trim();
+    if (input.docID?.trim()) request.docID = input.docID.trim();
+    if (input.onBehalfOf?.trim()) request.onBehalfOf = input.onBehalfOf.trim();
+    const form = new FormData();
+    form.append("request", new Blob([JSON.stringify(request)], { type: "application/json" }));
+    form.append("pdf", new Blob([input.pdf], { type: "application/pdf" }), input.fileName);
+    const r = rec3(await this.http.postMultipart("/pdf/sign/prepare", form, 6e4));
+    const receivedAt = Date.now();
+    const vc = rec3(r.vc).value;
+    const dl = rec3(r.deviceLink);
+    return {
+      sessionId: String(r.sessionID),
+      docId: String(r.docID),
+      vc: vc != null ? String(vc) : null,
+      deviceLink: dl.sessionToken ? {
+        sessionToken: String(dl.sessionToken),
+        sessionSecret: String(dl.sessionSecret),
+        deviceLinkBase: String(dl.deviceLinkBase),
+        digest: String(dl.digest),
+        interactions: String(dl.interactions)
+      } : null,
+      receivedAt
+    };
+  }
+  /**
+   * GET /pdf/sign/{sessionID}/document — гарын үсэгтэй PDF (READY-ээс хойш 30 мин). Татсан байтын SHA-256-ийг
+   * session-ий `pdf.outSha256`-тай тулга. Эрх хасагдсан бол `ForbiddenError` `.code = "REPRESENTATION_REVOKED"`.
+   */
+  document(sessionId) {
+    return this.http.getBytes(`/pdf/sign/${encodeURIComponent(sessionId)}/document`, 6e4);
+  }
+};
+
+// src/organization.ts
+var OrganizationApi = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  /** GET /organization/representations/etsi/{personEtsi}. Сонголт нь итгэх эх биш — сервер дахин шалгана. */
+  async getRepresentations(personEtsi) {
+    const raw = await this.http.get(`/organization/representations/etsi/${encodeURIComponent(personEtsi)}`);
+    const list = Array.isArray(raw.representations) ? raw.representations : [];
+    return { personEtsi: String(raw.personEtsi ?? personEtsi), representations: list };
+  }
+};
+
 // src/validator.ts
 var import_node_crypto2 = require("crypto");
 var ResponseValidator = class {
@@ -752,6 +903,8 @@ function resolveBaseUrl(baseUrl) {
 var EidClient = class {
   auth;
   sign;
+  pdf;
+  organization;
   session;
   validator;
   constructor(cfg) {
@@ -767,6 +920,8 @@ var EidClient = class {
     const level = cfg.defaultCertificateLevel ?? "QUALIFIED";
     this.auth = new AuthApi(http, cfg.credentials, { certificateLevel: level });
     this.sign = new SignApi(http, cfg.credentials, { certificateLevel: level });
+    this.pdf = new PdfApi(http, cfg.credentials, { certificateLevel: level });
+    this.organization = new OrganizationApi(http);
     this.session = new SessionApi(http);
     this.validator = new ResponseValidator(cfg.trust ?? {});
   }
@@ -883,6 +1038,283 @@ function qrDeviceLinkTicker(input, onLink, opts) {
   t.unref?.();
   return () => clearInterval(t);
 }
+
+// src/oidc.ts
+var import_node_crypto4 = require("crypto");
+var EID_OIDC_ISSUER = "https://login.eidmongolia.mn";
+var EID_ACR_QUALIFIED = "urn:eidmongolia:loa:qualified";
+var EID_ACR_ADVANCED = "urn:eidmongolia:loa:advanced";
+var CLOCK_SKEW_S = 60;
+var CACHE_MS = 60 * 60 * 1e3;
+var DEFAULT_TIMEOUT_MS2 = 1e4;
+var KNOWN_CODES = /* @__PURE__ */ new Set([
+  "access_denied",
+  "login_required",
+  "invalid_request",
+  "invalid_scope",
+  "unauthorized_client",
+  "unsupported_response_type",
+  "request_not_supported",
+  "temporarily_unavailable",
+  "server_error",
+  "invalid_client",
+  "invalid_grant",
+  "unsupported_grant_type"
+]);
+var EidOidcError = class extends EidError {
+  constructor(code, message, description) {
+    super(message);
+    this.code = code;
+    this.description = description;
+  }
+  code;
+  description;
+};
+var EidOidcClient = class {
+  constructor(cfg) {
+    this.cfg = cfg;
+    if (!cfg.clientId) throw new EidError("EidOidcClient: clientId \u0445\u043E\u043E\u0441\u043E\u043D");
+    if (!cfg.clientSecret) throw new EidError("EidOidcClient: clientSecret \u0445\u043E\u043E\u0441\u043E\u043D");
+    if (!/^https:\/\//.test(cfg.redirectUri ?? "")) throw new EidError("EidOidcClient: redirectUri https:// \u0431\u0430\u0439\u0445 \u0451\u0441\u0442\u043E\u0439");
+    this.issuer = (cfg.issuer ?? EID_OIDC_ISSUER).replace(/\/+$/, "");
+    this.scope = cfg.scope ?? "openid";
+  }
+  cfg;
+  issuer;
+  scope;
+  discovery;
+  jwks;
+  /** Discovery document (1 цаг cache). `issuer` нь тохиргоотой яг таарах ёстой (OIDC Discovery §4.3). */
+  discover() {
+    const c = this.discovery;
+    if (c && Date.now() - c.at < CACHE_MS) return c.d;
+    const d = this.fetchDiscovery();
+    this.discovery = { at: Date.now(), d };
+    d.catch(() => {
+      if (this.discovery?.d === d) this.discovery = void 0;
+    });
+    return d;
+  }
+  async fetchDiscovery() {
+    const d = await this.getJson(this.issuer + "/.well-known/openid-configuration");
+    if (!d || d.issuer !== this.issuer) {
+      throw new EidOidcError("discovery_failed", `OIDC discovery-\u0438\u0439\u043D issuer \u0442\u0430\u0430\u0440\u0430\u0445\u0433\u04AF\u0439 (\u0445\u04AF\u043B\u044D\u044D\u0441\u044D\u043D ${this.issuer})`);
+    }
+    for (const k of ["authorization_endpoint", "token_endpoint", "jwks_uri"]) {
+      if (typeof d[k] !== "string" || !d[k].startsWith("https://")) {
+        throw new EidOidcError("discovery_failed", `OIDC discovery: ${k} \u0431\u0443\u0440\u0443\u0443`);
+      }
+    }
+    return d;
+  }
+  /**
+   * Authorize URL + санамсаргүй state / nonce / PKCE codeVerifier. RP буцаасан `state`, `nonce`, `codeVerifier`-ийг
+   * хөтчийн session-тэй холбож (httpOnly cookie эсвэл server session) хадгалаад хөтчийг `url` руу 302 хийнэ.
+   */
+  async createAuthorization(opts = {}) {
+    const d = await this.discover();
+    const state = randomB64url(32);
+    const nonce = randomB64url(32);
+    const codeVerifier = randomB64url(32);
+    const u = new URL(d.authorization_endpoint);
+    const p = new URLSearchParams({
+      response_type: "code",
+      client_id: this.cfg.clientId,
+      redirect_uri: this.cfg.redirectUri,
+      scope: opts.scope ?? this.scope,
+      state,
+      nonce,
+      code_challenge: await pkceChallenge(codeVerifier),
+      code_challenge_method: "S256"
+    });
+    if (opts.display) p.set("display", opts.display);
+    u.search = p.toString();
+    return { url: u.toString(), state, nonce, codeVerifier };
+  }
+  /**
+   * redirect_uri руу ирсэн callback-ийг шийднэ: state тулгах → `error` бол {@link EidOidcError} → code солих →
+   * id_token шалгах. `input` — бүтэн callback URL, харьцангуй зам (`/cb?code=…`) эсвэл query (`URLSearchParams` / `code=…&state=…`); зөвхөн query-г уншина.
+   * Амжилтгүй бүх тохиолдолд {@link EidOidcError} (эсвэл {@link NetworkError}) шиднэ.
+   */
+  async handleCallback(input, checks) {
+    const q = callbackParams(input);
+    const state = q.get("state") ?? "";
+    if (!checks.state || !timingSafeEqualStr(state, checks.state)) {
+      throw new EidOidcError("state_mismatch", "OIDC state \u0442\u0430\u0430\u0440\u0441\u0430\u043D\u0433\u04AF\u0439 \u2014 \u043D\u044D\u0432\u0442\u0440\u044D\u043B\u0442\u0438\u0439\u0433 \u0434\u0430\u0445\u0438\u043D \u044D\u0445\u043B\u04AF\u04AF\u043B\u043D\u044D \u04AF\u04AF");
+    }
+    const iss = q.get("iss");
+    if (iss !== null && iss !== this.issuer) {
+      throw new EidOidcError("invalid_callback", "OIDC callback-\u0438\u0439\u043D iss \u0442\u0430\u0430\u0440\u0430\u0445\u0433\u04AF\u0439");
+    }
+    const err = q.get("error");
+    if (err) {
+      const code2 = KNOWN_CODES.has(err) ? err : "server_error";
+      throw new EidOidcError(code2, `eID \u043D\u044D\u0432\u0442\u0440\u044D\u043B\u0442 \u0430\u043C\u0436\u0438\u043B\u0442\u0433\u04AF\u0439: ${code2}`, q.get("error_description") ?? void 0);
+    }
+    const code = q.get("code") ?? "";
+    if (code === "" || code.length > 512) throw new EidOidcError("invalid_callback", "OIDC callback-\u0434 code \u0430\u043B\u0433\u0430");
+    const idToken = await this.exchangeCode(code, checks.codeVerifier);
+    const claims = await this.verifyIdToken(idToken, { nonce: checks.nonce });
+    return { claims, idToken };
+  }
+  /** `POST token_endpoint` (client_secret_basic, RFC 6749 §2.3.1) → id_token. */
+  async exchangeCode(code, codeVerifier) {
+    const d = await this.discover();
+    const basic = Buffer.from(formEncode(this.cfg.clientId) + ":" + formEncode(this.cfg.clientSecret)).toString("base64");
+    const res = await this.fetch(d.token_endpoint, {
+      method: "POST",
+      headers: {
+        Authorization: "Basic " + basic,
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json"
+      },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: this.cfg.redirectUri,
+        code_verifier: codeVerifier
+      }).toString()
+    });
+    let j = {};
+    try {
+      j = await res.json();
+    } catch {
+    }
+    if (!res.ok) {
+      const e = typeof j.error === "string" && KNOWN_CODES.has(j.error) ? j.error : "server_error";
+      throw new EidOidcError(
+        e,
+        `OIDC token ${res.status}: ${e}`,
+        typeof j.error_description === "string" ? j.error_description : void 0
+      );
+    }
+    if (typeof j.id_token !== "string" || j.id_token === "") {
+      throw new EidOidcError("server_error", "OIDC token \u0445\u0430\u0440\u0438\u0443\u043D\u0434 id_token \u0430\u043B\u0433\u0430");
+    }
+    return j.id_token;
+  }
+  /**
+   * id_token шалгана: JWKS (`kid`, cache; танихгүй kid → нэг удаа дахин татна) ES256 гарын үсэг, `iss`, `aud`
+   * (= clientId; олон aud бол `azp`), `exp`/`iat` (±60 сек), `nonce`. Амжилтгүй бол `invalid_id_token`.
+   */
+  async verifyIdToken(idToken, opts) {
+    const bad = (why) => new EidOidcError("invalid_id_token", `id_token: ${why}`);
+    const parts = idToken.split(".");
+    if (parts.length !== 3) throw bad("\u0445\u044D\u043B\u0431\u044D\u0440 \u0431\u0443\u0440\u0443\u0443");
+    const header = decodeJsonPart(parts[0]);
+    const payload = decodeJsonPart(parts[1]);
+    if (!header || !payload) throw bad("\u0445\u044D\u043B\u0431\u044D\u0440 \u0431\u0443\u0440\u0443\u0443");
+    if (header.alg !== "ES256") throw bad("alg ES256 \u0431\u0438\u0448");
+    const kid = typeof header.kid === "string" ? header.kid : "";
+    if (!kid) throw bad("kid \u0430\u043B\u0433\u0430");
+    const pick = (ks) => ks.find(
+      (k) => k.kid === kid && k.kty === "EC" && k.crv === "P-256" && (k.use === void 0 || k.use === "sig") && (k.alg === void 0 || k.alg === "ES256")
+    );
+    const jwk = pick(await this.keys(false)) ?? pick(await this.keys(true));
+    if (!jwk || !jwk.x || !jwk.y) throw bad(`\u0442\u0430\u043D\u0438\u0445\u0433\u04AF\u0439 kid ${kid}`);
+    const sig = Buffer.from(parts[2], "base64url");
+    if (sig.length !== 64) throw bad("\u0433\u0430\u0440\u044B\u043D \u04AF\u0441\u044D\u0433 \u0442\u0430\u0430\u0440\u0441\u0430\u043D\u0433\u04AF\u0439");
+    let ok = false;
+    try {
+      const key = await globalThis.crypto.subtle.importKey(
+        "jwk",
+        { kty: "EC", crv: "P-256", x: jwk.x, y: jwk.y },
+        { name: "ECDSA", namedCurve: "P-256" },
+        false,
+        ["verify"]
+      );
+      ok = await globalThis.crypto.subtle.verify(
+        { name: "ECDSA", hash: "SHA-256" },
+        key,
+        sig,
+        new TextEncoder().encode(parts[0] + "." + parts[1])
+      );
+    } catch {
+      ok = false;
+    }
+    if (!ok) throw bad("\u0433\u0430\u0440\u044B\u043D \u04AF\u0441\u044D\u0433 \u0442\u0430\u0430\u0440\u0441\u0430\u043D\u0433\u04AF\u0439");
+    const c = payload;
+    const now = Math.floor(Date.now() / 1e3);
+    if (c.iss !== this.issuer) throw bad("iss \u0442\u0430\u0430\u0440\u0430\u0445\u0433\u04AF\u0439");
+    const aud = Array.isArray(c.aud) ? c.aud : [c.aud];
+    if (!aud.includes(this.cfg.clientId)) throw bad("aud \u0442\u0430\u0430\u0440\u0430\u0445\u0433\u04AF\u0439");
+    if (aud.length > 1 && c.azp !== this.cfg.clientId) throw bad("azp \u0442\u0430\u0430\u0440\u0430\u0445\u0433\u04AF\u0439");
+    if (typeof c.exp !== "number" || now > c.exp + CLOCK_SKEW_S) throw bad("\u0445\u0443\u0433\u0430\u0446\u0430\u0430 \u0434\u0443\u0443\u0441\u0441\u0430\u043D");
+    if (typeof c.iat !== "number" || c.iat > now + CLOCK_SKEW_S) throw bad("iat \u0438\u0440\u044D\u044D\u0434\u04AF\u0439\u0434");
+    if (typeof c.nonce !== "string" || !opts.nonce || !timingSafeEqualStr(c.nonce, opts.nonce)) throw bad("nonce \u0442\u0430\u0430\u0440\u0430\u0445\u0433\u04AF\u0439");
+    if (typeof c.sub !== "string" || c.sub === "") throw bad("sub \u0430\u043B\u0433\u0430");
+    return c;
+  }
+  keys(force) {
+    const c = this.jwks;
+    if (!force && c && Date.now() - c.at < CACHE_MS) return c.keys;
+    const keys = this.discover().then(async (d) => {
+      const j = await this.getJson(d.jwks_uri);
+      return Array.isArray(j?.keys) ? j.keys : [];
+    });
+    this.jwks = { at: Date.now(), keys };
+    keys.catch(() => {
+      if (this.jwks?.keys === keys) this.jwks = void 0;
+    });
+    return keys;
+  }
+  async getJson(url) {
+    const res = await this.fetch(url, { method: "GET", headers: { Accept: "application/json" } });
+    if (!res.ok) throw new EidOidcError("discovery_failed", `OIDC ${res.status}: ${url}`);
+    try {
+      return await res.json();
+    } catch {
+      throw new EidOidcError("discovery_failed", `OIDC JSON \u0431\u0438\u0448: ${url}`);
+    }
+  }
+  async fetch(url, init) {
+    const f = this.cfg.fetchImpl ?? fetch;
+    try {
+      return await f(url, {
+        ...init,
+        redirect: "error",
+        signal: AbortSignal.timeout(this.cfg.timeoutMs ?? DEFAULT_TIMEOUT_MS2)
+      });
+    } catch (e) {
+      const err = e;
+      if (err.name === "TimeoutError" || err.name === "AbortError") {
+        throw new NetworkError(`OIDC \u0445\u04AF\u0441\u044D\u043B\u0442 \u0445\u0443\u0433\u0430\u0446\u0430\u0430 \u0445\u044D\u0442\u044D\u0440\u043B\u044D\u044D: ${url}`);
+      }
+      throw new NetworkError(`OIDC \u0441\u04AF\u043B\u0436\u044D\u044D\u043D\u0438\u0439 \u0430\u043B\u0434\u0430\u0430 (${url}): ${err.message}`);
+    }
+  }
+};
+async function pkceChallenge(codeVerifier) {
+  const h = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(codeVerifier));
+  return Buffer.from(h).toString("base64url");
+}
+function randomB64url(bytes) {
+  return Buffer.from(globalThis.crypto.getRandomValues(new Uint8Array(bytes))).toString("base64url");
+}
+function formEncode(s) {
+  return new URLSearchParams({ v: s }).toString().slice(2);
+}
+function timingSafeEqualStr(a, b) {
+  const x = Buffer.from(a, "utf8");
+  const y = Buffer.from(b, "utf8");
+  return x.length === y.length && (0, import_node_crypto4.timingSafeEqual)(x, y);
+}
+function decodeJsonPart(s) {
+  try {
+    const v = JSON.parse(Buffer.from(s, "base64url").toString("utf8"));
+    return v && typeof v === "object" && !Array.isArray(v) ? v : null;
+  } catch {
+    return null;
+  }
+}
+function callbackParams(input) {
+  if (input instanceof URLSearchParams) return input;
+  if (input instanceof URL) return input.searchParams;
+  const s = input.trim();
+  if (/^https?:\/\//i.test(s)) return new URL(s).searchParams;
+  const i = s.indexOf("?");
+  return new URLSearchParams(i >= 0 ? s.slice(i + 1) : s);
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ApiError,
@@ -890,11 +1322,19 @@ function qrDeviceLinkTicker(input, onLink, opts) {
   AuthenticationError,
   DEFAULT_BASE_URL,
   DeviceLinkError,
+  EID_ACR_ADVANCED,
+  EID_ACR_QUALIFIED,
+  EID_OIDC_ISSUER,
   EidClient,
   EidError,
+  EidOidcClient,
+  EidOidcError,
   ForbiddenError,
   Http,
   NetworkError,
+  ON_BEHALF_ERROR_CODES,
+  OrganizationApi,
+  PdfApi,
   ResponseValidator,
   SessionApi,
   SessionFailedError,
@@ -908,6 +1348,7 @@ function qrDeviceLinkTicker(input, onLink, opts) {
   isMobileUserAgent,
   openOrShowQR,
   parseSessionResult,
+  pkceChallenge,
   qrDeviceLinkTicker,
   randomChallenge,
   resolveBaseUrl,