@gerege-systems/eid-mongolia-sdk 0.6.1 → 0.8.0

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { R as RpCredentials, C as CertificateLevel, I as Interaction, S as SignatureAlgorithm, H as HashAlgorithm, N as NotificationSession, D as DeviceLinkSession, a as SessionResult, A as AcspContext, F as FlowType } from './browser-BU9ShPWO.cjs';
-export { b as ApiError, c as AuthenticationError, d as DeviceLinkError, e as DeviceLinkInput, E as EidError, f as EndResult, g as ForbiddenError, h as NavigatorLike, i as NetworkError, O as OpenOrShowQROptions, j as SessionFailedError, k as SessionState, l as SignatureAlgorithmParameters, m as SignatureProtocol, V as ValidationError, n as deviceLink, o as isMobileUserAgent, p as openOrShowQR } from './browser-BU9ShPWO.cjs';
+import { R as RpCredentials, C as CertificateLevel, I as Interaction, S as SignatureAlgorithm, H as HashAlgorithm, N as NotificationSession, D as DeviceLinkSession, a as SessionResult, b as RepresentationsResponse, A as AcspContext, F as FlowType, E as EidError } from './browser-Db82DlYN.cjs';
+export { c as ApiError, d as AuthenticationError, e as DeviceLinkError, f as DeviceLinkInput, g as EndResult, h as ForbiddenError, i as NavigatorLike, j as NetworkError, O as ON_BEHALF_ERROR_CODES, k as OnBehalfErrorCode, l as OpenOrShowQROptions, m as OrgResult, P as PdfDocumentStatus, n as PdfSessionBlock, o as PdfSigner, p as Representation, q as SessionFailedError, r as SessionState, s as SignatureAlgorithmParameters, t as SignatureProtocol, V as ValidationError, u as deviceLink, v as isMobileUserAgent, w as openOrShowQR } from './browser-Db82DlYN.cjs';
 import { X509Certificate, KeyObject } from 'node:crypto';
 
 interface HttpConfig {
@@ -23,7 +23,12 @@ declare class Http {
     constructor(cfg: HttpConfig);
     post(path: string, body: unknown, timeoutMs?: number): Promise<unknown>;
     get(path: string, timeoutMs?: number): Promise<unknown>;
-    private request;
+    /** multipart/form-data POST (Content-Type-ийг boundary-тай нь fetch тавина). JSON хариу. */
+    postMultipart(path: string, form: FormData, timeoutMs?: number): Promise<unknown>;
+    /** GET — хариуг байтаар (ж: гарын үсэгтэй PDF). */
+    getBytes(path: string, timeoutMs?: number): Promise<Uint8Array>;
+    private json;
+    private send;
 }
 
 interface AuthDefaults {
@@ -131,6 +136,73 @@ declare class SessionApi {
     }): Promise<SessionResult>;
 }
 
+interface PdfDefaults {
+    certificateLevel: CertificateLevel;
+}
+/** Гарын үсэг зурагч — яг нэг нь. */
+type PdfSignerRef = {
+    etsi: string;
+} | {
+    documentNumber: string;
+} | {
+    certificateChoiceSessionId: string;
+};
+interface PdfPrepareInput {
+    /** Эх PDF (≤ 10 223 616 байт — `/.well-known/eid` `pdfSigning.maxInputBytes`). */
+    pdf: Uint8Array;
+    /** Баримтын нэр (≤ 120 тэмдэгт) — /verify хуудас, иргэний түүхэнд харагдана. */
+    fileName: string;
+    signer: PdfSignerRef;
+    /** `notification` (push) эсвэл `device-link` (QR/Web2App/App2App). Анхдагч notification. */
+    flow?: "notification" | "device-link";
+    certificateLevel?: CertificateLevel;
+    /** device-link Web2App/App2App буцах URL. */
+    initialCallbackUrl?: string;
+    /** Олон гарын үсэгтэй баримтад хүлээж буй docID (заавал биш — CA өөрөө олно). */
+    docID?: string;
+    /**
+     * Байгууллагын нэрийн өмнөөс: байгууллагын ETSI (`NTRMN-<бүртгэл>`). Сервер төлөөллийг prepare-д ба баримт
+     * угсрахын өмнө дахин шалгана; татгалзвал `ForbiddenError`/`ApiError` `.code` ({@link OnBehalfErrorCode}).
+     */
+    onBehalfOf?: string;
+}
+/** prepare-ийн хариу. device-link-д `deviceLink` (digest/interactions-ийг authCode-д ЯГ ХЭВЭЭР). */
+interface PdfPrepareSession {
+    sessionId: string;
+    docId: string;
+    /** Иргэнд ХАРУУЛАХ баталгаажуулах код (ПИН биш). */
+    vc: string | null;
+    deviceLink: {
+        sessionToken: string;
+        sessionSecret: string;
+        deviceLinkBase: string;
+        digest: string;
+        interactions: string;
+    } | null;
+    /** SDK хариу хүлээн авсан мөч (ms epoch) — QR-ийн `receivedAt` ({@link buildDeviceLink}). */
+    receivedAt: number;
+}
+declare class PdfApi {
+    private readonly http;
+    private readonly creds;
+    private readonly defaults;
+    constructor(http: Http, creds: RpCredentials, defaults: PdfDefaults);
+    /** POST /pdf/sign/prepare — multipart (`request` JSON + `pdf`). SIGN эрх шаардана. */
+    prepare(input: PdfPrepareInput): Promise<PdfPrepareSession>;
+    /**
+     * GET /pdf/sign/{sessionID}/document — гарын үсэгтэй PDF (READY-ээс хойш 30 мин). Татсан байтын SHA-256-ийг
+     * session-ий `pdf.outSha256`-тай тулга. Эрх хасагдсан бол `ForbiddenError` `.code = "REPRESENTATION_REVOKED"`.
+     */
+    document(sessionId: string): Promise<Uint8Array>;
+}
+
+declare class OrganizationApi {
+    private readonly http;
+    constructor(http: Http);
+    /** GET /organization/representations/etsi/{personEtsi}. Сонголт нь итгэх эх биш — сервер дахин шалгана. */
+    getRepresentations(personEtsi: string): Promise<RepresentationsResponse>;
+}
+
 /**
  * validateAuth-ийн нэмэлт шалгалт — RP ЯМАР урсгал эхлүүлснээ мэддэг тул түүнийг тулгана
  * (device-link relay хаалт).
@@ -283,6 +355,8 @@ declare function resolveBaseUrl(baseUrl: string | undefined): string;
 declare class EidClient {
     readonly auth: AuthApi;
     readonly sign: SignApi;
+    readonly pdf: PdfApi;
+    readonly organization: OrganizationApi;
     readonly session: SessionApi;
     readonly validator: ResponseValidator;
     constructor(cfg: ClientConfig);
@@ -383,4 +457,141 @@ interface QrDeviceLinkTickerOptions {
  */
 declare function qrDeviceLinkTicker(input: Omit<BuildDeviceLinkInput, "deviceLinkType" | "now">, onLink: (link: string) => void, opts?: QrDeviceLinkTickerOptions): () => void;
 
-export { AcspContext, type AcspV2Params, AuthApi, type AuthDefaults, type AuthOptions, type BuildDeviceLinkInput, CertificateLevel, type ClientConfig, DEFAULT_BASE_URL, DeviceLinkSession, type DeviceLinkSessionType, type DeviceLinkType, EidClient, FlowType, HashAlgorithm, Http, type HttpConfig, Interaction, NotificationSession, type QrDeviceLinkTickerOptions, ResponseValidator, type RevocationChecker, type RevocationStatus, RpCredentials, SessionApi, SessionResult, SignApi, type SignDefaults, type SignOptions, SignatureAlgorithm, type TrustConfig, type ValidateAuthOptions, type VerifiedIdentity, type VerifiedSignature, acspV2Digest, buildAcspV2Payload, buildDeviceLink, interactionsToBase64, parseSessionResult, qrDeviceLinkTicker, randomChallenge, resolveBaseUrl, sha256Base64, userChallengeOf, verifyPayloadSignature, verifyPrehashedSignature };
+/** eID-ийн OIDC issuer (төгсгөлд `/` байхгүй). */
+declare const EID_OIDC_ISSUER = "https://login.eidmongolia.mn";
+/** `acr` утгууд — иргэний гэрчилгээний бодит түвшин. */
+declare const EID_ACR_QUALIFIED = "urn:eidmongolia:loa:qualified";
+declare const EID_ACR_ADVANCED = "urn:eidmongolia:loa:advanced";
+/**
+ * OIDC алдааны код. Authorize redirect (RFC 6749 §4.1.2.1) ба token endpoint (§5.2)-ийн стандарт кодууд, мөн
+ * SDK-ийн өөрийн шалгалтын кодууд:
+ * - `state_mismatch` — callback-ийн `state` хадгалсантай таарсангүй (CSRF / өөр tab / cookie дууссан) → дахин эхлүүл;
+ * - `invalid_callback` — `code` алга / хэт урт, эсвэл `iss` параметр өөр;
+ * - `invalid_id_token` — id_token-ий гарын үсэг / iss / aud / exp / iat / nonce шалгалт унасан (ИТГЭХГҮЙ);
+ * - `discovery_failed` — discovery/JWKS буруу эсвэл issuer таарахгүй.
+ *
+ * `access_denied` = иргэн татгалзсан, нэвтрэлтийн хугацаа дууссан, эсвэл гэрчилгээний шалгалт унасан → «дахин оролд».
+ */
+type EidOidcErrorCode = "access_denied" | "login_required" | "invalid_request" | "invalid_scope" | "unauthorized_client" | "unsupported_response_type" | "request_not_supported" | "temporarily_unavailable" | "server_error" | "invalid_client" | "invalid_grant" | "unsupported_grant_type" | "state_mismatch" | "invalid_callback" | "invalid_id_token" | "discovery_failed";
+/**
+ * OIDC урсгалын алдаа. `code`-оор салгана. `description` нь серверийн `error_description` — логт л,
+ * хэрэглэгчид шууд харуулахгүй.
+ */
+declare class EidOidcError extends EidError {
+    readonly code: EidOidcErrorCode;
+    readonly description?: string | undefined;
+    constructor(code: EidOidcErrorCode, message: string, description?: string | undefined);
+}
+interface EidOidcClientConfig {
+    /** RP UUID (`relyingPartyUUID`). */
+    clientId: string;
+    /** RP API secret (`rp_sk_…`) — зөвхөн backend-д. */
+    clientSecret: string;
+    /** Бүртгэлтэй redirect URI — тэмдэгт бүрээрээ таарах ёстой. */
+    redirectUri: string;
+    /** Анхдагч {@link EID_OIDC_ISSUER}. */
+    issuer?: string;
+    /** Анхдагч `"openid"`. Иргэний ETSI дугаар хэрэгтэй бол `"openid pnomn"` (RP-д `PNOMN` эрх). */
+    scope?: string;
+    /** HTTP timeout (мс), анхдагч 10000. */
+    timeoutMs?: number;
+    /** fetch орлуулагч (тест). */
+    fetchImpl?: typeof fetch;
+}
+interface EidOidcDiscovery {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    jwks_uri: string;
+    [k: string]: unknown;
+}
+interface CreateAuthorizationOptions {
+    /** Энэ хүсэлтэд scope-ыг дарна. */
+    scope?: string;
+    /**
+     * `touch` (анхдагч) — утасны хөтчөөс шууд eID апп; `page` — үргэлж нэвтрэх хуудас (QR / push), ж: таблет киоск.
+     */
+    display?: "page" | "touch";
+}
+/** RP-ийн хадгалах ёстой гүйлгээ — httpOnly cookie / server session-д (браузерийн JS-д биш). */
+interface EidAuthorization {
+    /** Хөтчийг энэ рүү 302. */
+    url: string;
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+}
+/** createAuthorization-аас хадгалсан утгууд. */
+interface EidCallbackChecks {
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+}
+/** id_token-ий claim-ууд (`docs/OIDC.md` §4). */
+interface EidIdTokenClaims {
+    iss: string;
+    aud: string | string[];
+    azp?: string;
+    /** Pairwise — RP тус бүрд өөр, иргэнд тогтмол. Хэрэглэгчийг ҮҮГЭЭР таньна. */
+    sub: string;
+    exp: number;
+    iat: number;
+    nonce: string;
+    /** Иргэн баталгаажуулсан мөч (Unix сек). */
+    auth_time: number;
+    /** {@link EID_ACR_QUALIFIED} эсвэл {@link EID_ACR_ADVANCED}. */
+    acr: string;
+    /** Гэрчилгээний GIVENNAME — латин (ICAO, том үсэг). */
+    given_name: string;
+    /** Гэрчилгээний SURNAME (эцэг/эхийн нэр) — латин. */
+    family_name: string;
+    /** Нэр — кирилл (бүртгэлд байхгүй бол алга). */
+    given_name_mn?: string;
+    /** Эцэг/эхийн нэр — кирилл (бүртгэлд байхгүй бол алга). */
+    family_name_mn?: string;
+    /** `PNOMN-<иргэний дугаар>` — зөвхөн `pnomn` scope + `PNOMN` эрхтэй үед. */
+    pnomn?: string;
+    [k: string]: unknown;
+}
+interface EidCallbackResult {
+    claims: EidIdTokenClaims;
+    idToken: string;
+}
+declare class EidOidcClient {
+    private readonly cfg;
+    readonly issuer: string;
+    private readonly scope;
+    private discovery?;
+    private jwks?;
+    constructor(cfg: EidOidcClientConfig);
+    /** Discovery document (1 цаг cache). `issuer` нь тохиргоотой яг таарах ёстой (OIDC Discovery §4.3). */
+    discover(): Promise<EidOidcDiscovery>;
+    private fetchDiscovery;
+    /**
+     * Authorize URL + санамсаргүй state / nonce / PKCE codeVerifier. RP буцаасан `state`, `nonce`, `codeVerifier`-ийг
+     * хөтчийн session-тэй холбож (httpOnly cookie эсвэл server session) хадгалаад хөтчийг `url` руу 302 хийнэ.
+     */
+    createAuthorization(opts?: CreateAuthorizationOptions): Promise<EidAuthorization>;
+    /**
+     * redirect_uri руу ирсэн callback-ийг шийднэ: state тулгах → `error` бол {@link EidOidcError} → code солих →
+     * id_token шалгах. `input` — бүтэн callback URL, харьцангуй зам (`/cb?code=…`) эсвэл query (`URLSearchParams` / `code=…&state=…`); зөвхөн query-г уншина.
+     * Амжилтгүй бүх тохиолдолд {@link EidOidcError} (эсвэл {@link NetworkError}) шиднэ.
+     */
+    handleCallback(input: string | URL | URLSearchParams, checks: EidCallbackChecks): Promise<EidCallbackResult>;
+    /** `POST token_endpoint` (client_secret_basic, RFC 6749 §2.3.1) → id_token. */
+    private exchangeCode;
+    /**
+     * id_token шалгана: JWKS (`kid`, cache; танихгүй kid → нэг удаа дахин татна) ES256 гарын үсэг, `iss`, `aud`
+     * (= clientId; олон aud бол `azp`), `exp`/`iat` (±60 сек), `nonce`. Амжилтгүй бол `invalid_id_token`.
+     */
+    verifyIdToken(idToken: string, opts: {
+        nonce: string;
+    }): Promise<EidIdTokenClaims>;
+    private keys;
+    private getJson;
+    private fetch;
+}
+/** PKCE S256: `BASE64URL(SHA-256(ASCII(code_verifier)))` (RFC 7636 §4.2). */
+declare function pkceChallenge(codeVerifier: string): Promise<string>;
+
+export { AcspContext, type AcspV2Params, AuthApi, type AuthDefaults, type AuthOptions, type BuildDeviceLinkInput, CertificateLevel, type ClientConfig, type CreateAuthorizationOptions, DEFAULT_BASE_URL, DeviceLinkSession, type DeviceLinkSessionType, type DeviceLinkType, EID_ACR_ADVANCED, EID_ACR_QUALIFIED, EID_OIDC_ISSUER, type EidAuthorization, type EidCallbackChecks, type EidCallbackResult, EidClient, EidError, type EidIdTokenClaims, EidOidcClient, type EidOidcClientConfig, type EidOidcDiscovery, EidOidcError, type EidOidcErrorCode, FlowType, HashAlgorithm, Http, type HttpConfig, Interaction, NotificationSession, OrganizationApi, PdfApi, type PdfDefaults, type PdfPrepareInput, type PdfPrepareSession, type PdfSignerRef, type QrDeviceLinkTickerOptions, RepresentationsResponse, ResponseValidator, type RevocationChecker, type RevocationStatus, RpCredentials, SessionApi, SessionResult, SignApi, type SignDefaults, type SignOptions, SignatureAlgorithm, type TrustConfig, type ValidateAuthOptions, type VerifiedIdentity, type VerifiedSignature, acspV2Digest, buildAcspV2Payload, buildDeviceLink, interactionsToBase64, parseSessionResult, pkceChallenge, qrDeviceLinkTicker, randomChallenge, resolveBaseUrl, sha256Base64, userChallengeOf, verifyPayloadSignature, verifyPrehashedSignature };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { R as RpCredentials, C as CertificateLevel, I as Interaction, S as SignatureAlgorithm, H as HashAlgorithm, N as NotificationSession, D as DeviceLinkSession, a as SessionResult, A as AcspContext, F as FlowType } from './browser-BU9ShPWO.js';
-export { b as ApiError, c as AuthenticationError, d as DeviceLinkError, e as DeviceLinkInput, E as EidError, f as EndResult, g as ForbiddenError, h as NavigatorLike, i as NetworkError, O as OpenOrShowQROptions, j as SessionFailedError, k as SessionState, l as SignatureAlgorithmParameters, m as SignatureProtocol, V as ValidationError, n as deviceLink, o as isMobileUserAgent, p as openOrShowQR } from './browser-BU9ShPWO.js';
+import { R as RpCredentials, C as CertificateLevel, I as Interaction, S as SignatureAlgorithm, H as HashAlgorithm, N as NotificationSession, D as DeviceLinkSession, a as SessionResult, b as RepresentationsResponse, A as AcspContext, F as FlowType, E as EidError } from './browser-Db82DlYN.js';
+export { c as ApiError, d as AuthenticationError, e as DeviceLinkError, f as DeviceLinkInput, g as EndResult, h as ForbiddenError, i as NavigatorLike, j as NetworkError, O as ON_BEHALF_ERROR_CODES, k as OnBehalfErrorCode, l as OpenOrShowQROptions, m as OrgResult, P as PdfDocumentStatus, n as PdfSessionBlock, o as PdfSigner, p as Representation, q as SessionFailedError, r as SessionState, s as SignatureAlgorithmParameters, t as SignatureProtocol, V as ValidationError, u as deviceLink, v as isMobileUserAgent, w as openOrShowQR } from './browser-Db82DlYN.js';
 import { X509Certificate, KeyObject } from 'node:crypto';
 
 interface HttpConfig {
@@ -23,7 +23,12 @@ declare class Http {
     constructor(cfg: HttpConfig);
     post(path: string, body: unknown, timeoutMs?: number): Promise<unknown>;
     get(path: string, timeoutMs?: number): Promise<unknown>;
-    private request;
+    /** multipart/form-data POST (Content-Type-ийг boundary-тай нь fetch тавина). JSON хариу. */
+    postMultipart(path: string, form: FormData, timeoutMs?: number): Promise<unknown>;
+    /** GET — хариуг байтаар (ж: гарын үсэгтэй PDF). */
+    getBytes(path: string, timeoutMs?: number): Promise<Uint8Array>;
+    private json;
+    private send;
 }
 
 interface AuthDefaults {
@@ -131,6 +136,73 @@ declare class SessionApi {
     }): Promise<SessionResult>;
 }
 
+interface PdfDefaults {
+    certificateLevel: CertificateLevel;
+}
+/** Гарын үсэг зурагч — яг нэг нь. */
+type PdfSignerRef = {
+    etsi: string;
+} | {
+    documentNumber: string;
+} | {
+    certificateChoiceSessionId: string;
+};
+interface PdfPrepareInput {
+    /** Эх PDF (≤ 10 223 616 байт — `/.well-known/eid` `pdfSigning.maxInputBytes`). */
+    pdf: Uint8Array;
+    /** Баримтын нэр (≤ 120 тэмдэгт) — /verify хуудас, иргэний түүхэнд харагдана. */
+    fileName: string;
+    signer: PdfSignerRef;
+    /** `notification` (push) эсвэл `device-link` (QR/Web2App/App2App). Анхдагч notification. */
+    flow?: "notification" | "device-link";
+    certificateLevel?: CertificateLevel;
+    /** device-link Web2App/App2App буцах URL. */
+    initialCallbackUrl?: string;
+    /** Олон гарын үсэгтэй баримтад хүлээж буй docID (заавал биш — CA өөрөө олно). */
+    docID?: string;
+    /**
+     * Байгууллагын нэрийн өмнөөс: байгууллагын ETSI (`NTRMN-<бүртгэл>`). Сервер төлөөллийг prepare-д ба баримт
+     * угсрахын өмнө дахин шалгана; татгалзвал `ForbiddenError`/`ApiError` `.code` ({@link OnBehalfErrorCode}).
+     */
+    onBehalfOf?: string;
+}
+/** prepare-ийн хариу. device-link-д `deviceLink` (digest/interactions-ийг authCode-д ЯГ ХЭВЭЭР). */
+interface PdfPrepareSession {
+    sessionId: string;
+    docId: string;
+    /** Иргэнд ХАРУУЛАХ баталгаажуулах код (ПИН биш). */
+    vc: string | null;
+    deviceLink: {
+        sessionToken: string;
+        sessionSecret: string;
+        deviceLinkBase: string;
+        digest: string;
+        interactions: string;
+    } | null;
+    /** SDK хариу хүлээн авсан мөч (ms epoch) — QR-ийн `receivedAt` ({@link buildDeviceLink}). */
+    receivedAt: number;
+}
+declare class PdfApi {
+    private readonly http;
+    private readonly creds;
+    private readonly defaults;
+    constructor(http: Http, creds: RpCredentials, defaults: PdfDefaults);
+    /** POST /pdf/sign/prepare — multipart (`request` JSON + `pdf`). SIGN эрх шаардана. */
+    prepare(input: PdfPrepareInput): Promise<PdfPrepareSession>;
+    /**
+     * GET /pdf/sign/{sessionID}/document — гарын үсэгтэй PDF (READY-ээс хойш 30 мин). Татсан байтын SHA-256-ийг
+     * session-ий `pdf.outSha256`-тай тулга. Эрх хасагдсан бол `ForbiddenError` `.code = "REPRESENTATION_REVOKED"`.
+     */
+    document(sessionId: string): Promise<Uint8Array>;
+}
+
+declare class OrganizationApi {
+    private readonly http;
+    constructor(http: Http);
+    /** GET /organization/representations/etsi/{personEtsi}. Сонголт нь итгэх эх биш — сервер дахин шалгана. */
+    getRepresentations(personEtsi: string): Promise<RepresentationsResponse>;
+}
+
 /**
  * validateAuth-ийн нэмэлт шалгалт — RP ЯМАР урсгал эхлүүлснээ мэддэг тул түүнийг тулгана
  * (device-link relay хаалт).
@@ -283,6 +355,8 @@ declare function resolveBaseUrl(baseUrl: string | undefined): string;
 declare class EidClient {
     readonly auth: AuthApi;
     readonly sign: SignApi;
+    readonly pdf: PdfApi;
+    readonly organization: OrganizationApi;
     readonly session: SessionApi;
     readonly validator: ResponseValidator;
     constructor(cfg: ClientConfig);
@@ -383,4 +457,141 @@ interface QrDeviceLinkTickerOptions {
  */
 declare function qrDeviceLinkTicker(input: Omit<BuildDeviceLinkInput, "deviceLinkType" | "now">, onLink: (link: string) => void, opts?: QrDeviceLinkTickerOptions): () => void;
 
-export { AcspContext, type AcspV2Params, AuthApi, type AuthDefaults, type AuthOptions, type BuildDeviceLinkInput, CertificateLevel, type ClientConfig, DEFAULT_BASE_URL, DeviceLinkSession, type DeviceLinkSessionType, type DeviceLinkType, EidClient, FlowType, HashAlgorithm, Http, type HttpConfig, Interaction, NotificationSession, type QrDeviceLinkTickerOptions, ResponseValidator, type RevocationChecker, type RevocationStatus, RpCredentials, SessionApi, SessionResult, SignApi, type SignDefaults, type SignOptions, SignatureAlgorithm, type TrustConfig, type ValidateAuthOptions, type VerifiedIdentity, type VerifiedSignature, acspV2Digest, buildAcspV2Payload, buildDeviceLink, interactionsToBase64, parseSessionResult, qrDeviceLinkTicker, randomChallenge, resolveBaseUrl, sha256Base64, userChallengeOf, verifyPayloadSignature, verifyPrehashedSignature };
+/** eID-ийн OIDC issuer (төгсгөлд `/` байхгүй). */
+declare const EID_OIDC_ISSUER = "https://login.eidmongolia.mn";
+/** `acr` утгууд — иргэний гэрчилгээний бодит түвшин. */
+declare const EID_ACR_QUALIFIED = "urn:eidmongolia:loa:qualified";
+declare const EID_ACR_ADVANCED = "urn:eidmongolia:loa:advanced";
+/**
+ * OIDC алдааны код. Authorize redirect (RFC 6749 §4.1.2.1) ба token endpoint (§5.2)-ийн стандарт кодууд, мөн
+ * SDK-ийн өөрийн шалгалтын кодууд:
+ * - `state_mismatch` — callback-ийн `state` хадгалсантай таарсангүй (CSRF / өөр tab / cookie дууссан) → дахин эхлүүл;
+ * - `invalid_callback` — `code` алга / хэт урт, эсвэл `iss` параметр өөр;
+ * - `invalid_id_token` — id_token-ий гарын үсэг / iss / aud / exp / iat / nonce шалгалт унасан (ИТГЭХГҮЙ);
+ * - `discovery_failed` — discovery/JWKS буруу эсвэл issuer таарахгүй.
+ *
+ * `access_denied` = иргэн татгалзсан, нэвтрэлтийн хугацаа дууссан, эсвэл гэрчилгээний шалгалт унасан → «дахин оролд».
+ */
+type EidOidcErrorCode = "access_denied" | "login_required" | "invalid_request" | "invalid_scope" | "unauthorized_client" | "unsupported_response_type" | "request_not_supported" | "temporarily_unavailable" | "server_error" | "invalid_client" | "invalid_grant" | "unsupported_grant_type" | "state_mismatch" | "invalid_callback" | "invalid_id_token" | "discovery_failed";
+/**
+ * OIDC урсгалын алдаа. `code`-оор салгана. `description` нь серверийн `error_description` — логт л,
+ * хэрэглэгчид шууд харуулахгүй.
+ */
+declare class EidOidcError extends EidError {
+    readonly code: EidOidcErrorCode;
+    readonly description?: string | undefined;
+    constructor(code: EidOidcErrorCode, message: string, description?: string | undefined);
+}
+interface EidOidcClientConfig {
+    /** RP UUID (`relyingPartyUUID`). */
+    clientId: string;
+    /** RP API secret (`rp_sk_…`) — зөвхөн backend-д. */
+    clientSecret: string;
+    /** Бүртгэлтэй redirect URI — тэмдэгт бүрээрээ таарах ёстой. */
+    redirectUri: string;
+    /** Анхдагч {@link EID_OIDC_ISSUER}. */
+    issuer?: string;
+    /** Анхдагч `"openid"`. Иргэний ETSI дугаар хэрэгтэй бол `"openid pnomn"` (RP-д `PNOMN` эрх). */
+    scope?: string;
+    /** HTTP timeout (мс), анхдагч 10000. */
+    timeoutMs?: number;
+    /** fetch орлуулагч (тест). */
+    fetchImpl?: typeof fetch;
+}
+interface EidOidcDiscovery {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    jwks_uri: string;
+    [k: string]: unknown;
+}
+interface CreateAuthorizationOptions {
+    /** Энэ хүсэлтэд scope-ыг дарна. */
+    scope?: string;
+    /**
+     * `touch` (анхдагч) — утасны хөтчөөс шууд eID апп; `page` — үргэлж нэвтрэх хуудас (QR / push), ж: таблет киоск.
+     */
+    display?: "page" | "touch";
+}
+/** RP-ийн хадгалах ёстой гүйлгээ — httpOnly cookie / server session-д (браузерийн JS-д биш). */
+interface EidAuthorization {
+    /** Хөтчийг энэ рүү 302. */
+    url: string;
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+}
+/** createAuthorization-аас хадгалсан утгууд. */
+interface EidCallbackChecks {
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+}
+/** id_token-ий claim-ууд (`docs/OIDC.md` §4). */
+interface EidIdTokenClaims {
+    iss: string;
+    aud: string | string[];
+    azp?: string;
+    /** Pairwise — RP тус бүрд өөр, иргэнд тогтмол. Хэрэглэгчийг ҮҮГЭЭР таньна. */
+    sub: string;
+    exp: number;
+    iat: number;
+    nonce: string;
+    /** Иргэн баталгаажуулсан мөч (Unix сек). */
+    auth_time: number;
+    /** {@link EID_ACR_QUALIFIED} эсвэл {@link EID_ACR_ADVANCED}. */
+    acr: string;
+    /** Гэрчилгээний GIVENNAME — латин (ICAO, том үсэг). */
+    given_name: string;
+    /** Гэрчилгээний SURNAME (эцэг/эхийн нэр) — латин. */
+    family_name: string;
+    /** Нэр — кирилл (бүртгэлд байхгүй бол алга). */
+    given_name_mn?: string;
+    /** Эцэг/эхийн нэр — кирилл (бүртгэлд байхгүй бол алга). */
+    family_name_mn?: string;
+    /** `PNOMN-<иргэний дугаар>` — зөвхөн `pnomn` scope + `PNOMN` эрхтэй үед. */
+    pnomn?: string;
+    [k: string]: unknown;
+}
+interface EidCallbackResult {
+    claims: EidIdTokenClaims;
+    idToken: string;
+}
+declare class EidOidcClient {
+    private readonly cfg;
+    readonly issuer: string;
+    private readonly scope;
+    private discovery?;
+    private jwks?;
+    constructor(cfg: EidOidcClientConfig);
+    /** Discovery document (1 цаг cache). `issuer` нь тохиргоотой яг таарах ёстой (OIDC Discovery §4.3). */
+    discover(): Promise<EidOidcDiscovery>;
+    private fetchDiscovery;
+    /**
+     * Authorize URL + санамсаргүй state / nonce / PKCE codeVerifier. RP буцаасан `state`, `nonce`, `codeVerifier`-ийг
+     * хөтчийн session-тэй холбож (httpOnly cookie эсвэл server session) хадгалаад хөтчийг `url` руу 302 хийнэ.
+     */
+    createAuthorization(opts?: CreateAuthorizationOptions): Promise<EidAuthorization>;
+    /**
+     * redirect_uri руу ирсэн callback-ийг шийднэ: state тулгах → `error` бол {@link EidOidcError} → code солих →
+     * id_token шалгах. `input` — бүтэн callback URL, харьцангуй зам (`/cb?code=…`) эсвэл query (`URLSearchParams` / `code=…&state=…`); зөвхөн query-г уншина.
+     * Амжилтгүй бүх тохиолдолд {@link EidOidcError} (эсвэл {@link NetworkError}) шиднэ.
+     */
+    handleCallback(input: string | URL | URLSearchParams, checks: EidCallbackChecks): Promise<EidCallbackResult>;
+    /** `POST token_endpoint` (client_secret_basic, RFC 6749 §2.3.1) → id_token. */
+    private exchangeCode;
+    /**
+     * id_token шалгана: JWKS (`kid`, cache; танихгүй kid → нэг удаа дахин татна) ES256 гарын үсэг, `iss`, `aud`
+     * (= clientId; олон aud бол `azp`), `exp`/`iat` (±60 сек), `nonce`. Амжилтгүй бол `invalid_id_token`.
+     */
+    verifyIdToken(idToken: string, opts: {
+        nonce: string;
+    }): Promise<EidIdTokenClaims>;
+    private keys;
+    private getJson;
+    private fetch;
+}
+/** PKCE S256: `BASE64URL(SHA-256(ASCII(code_verifier)))` (RFC 7636 §4.2). */
+declare function pkceChallenge(codeVerifier: string): Promise<string>;
+
+export { AcspContext, type AcspV2Params, AuthApi, type AuthDefaults, type AuthOptions, type BuildDeviceLinkInput, CertificateLevel, type ClientConfig, type CreateAuthorizationOptions, DEFAULT_BASE_URL, DeviceLinkSession, type DeviceLinkSessionType, type DeviceLinkType, EID_ACR_ADVANCED, EID_ACR_QUALIFIED, EID_OIDC_ISSUER, type EidAuthorization, type EidCallbackChecks, type EidCallbackResult, EidClient, EidError, type EidIdTokenClaims, EidOidcClient, type EidOidcClientConfig, type EidOidcDiscovery, EidOidcError, type EidOidcErrorCode, FlowType, HashAlgorithm, Http, type HttpConfig, Interaction, NotificationSession, OrganizationApi, PdfApi, type PdfDefaults, type PdfPrepareInput, type PdfPrepareSession, type PdfSignerRef, type QrDeviceLinkTickerOptions, RepresentationsResponse, ResponseValidator, type RevocationChecker, type RevocationStatus, RpCredentials, SessionApi, SessionResult, SignApi, type SignDefaults, type SignOptions, SignatureAlgorithm, type TrustConfig, type ValidateAuthOptions, type VerifiedIdentity, type VerifiedSignature, acspV2Digest, buildAcspV2Payload, buildDeviceLink, interactionsToBase64, parseSessionResult, pkceChallenge, qrDeviceLinkTicker, randomChallenge, resolveBaseUrl, sha256Base64, userChallengeOf, verifyPayloadSignature, verifyPrehashedSignature };