@gerege-systems/eid-mongolia-sdk 0.8.0 → 0.9.0

package/README.md

@@ -4,8 +4,10 @@
 (authentication) ба хууль ёсны цахим гарын үсэг (qualified signature) хийлгэх Node.js/TypeScript сан.
 RP-API v3, Smart-ID нийцтэй. Бүрэн баримт: <https://developer.eidmongolia.mn/>.
 
-> ⚠️ Зөвхөн **backend**-д ажиллана (`@gerege-systems/eid-mongolia-sdk/browser`-ийн legacy device-link туслахаас бусад).
-> API secret (`rp_sk_…`) браузер/гар утсанд хэзээ ч задлахгүй.
+> ⚠️ SDK **backend**-д ажиллана: бүх дуудлага API secret (`rp_sk_…`)-ээр баталгаажна, secret-ийг браузер/гар утсанд
+> хэзээ ч задлахгүй. Браузерт зөвхөн таны backend-ийн өгсөн холбоос/QR/товч харагдана — «eID-ээр нэвтрэх» товч ч
+> энгийн холбоос, `code` → `id_token` солих нь backend-д (§1a). `@gerege-systems/eid-mongolia-sdk/browser`-ийн
+> legacy device-link туслахууд 2026-10-07-оос ажиллахгүй (§4).
 
 ## Суулгах
 
@@ -17,9 +19,11 @@ Node.js ≥ 22 (global `fetch`, `node:crypto`).
 
 ## 1. RP бүртгүүлэх
 
-`POST https://ca.eidmongolia.mn/v3/rp-applications` (эсвэл [developer.eidmongolia.mn](https://developer.eidmongolia.mn)) —
-оператор баталсны дараа **relyingPartyUUID** ба **API secret** (`rp_sk_…`) олгогдоно; secret **зөвхөн нэг удаа**
-харагдана. Дэлгэрэнгүй: <https://developer.eidmongolia.mn/#registration>.
+RP-г eID Mongolia-гийн оператор бүртгэнэ — хүсэлтээ <eIDsupport@gerege.com> эсвэл 7777-3773-аар гаргана
+(нийтийн `POST /v3/rp-applications` 2026-10-14-нөөс засвартай: `503 rp_applications_maintenance`). Оператор
+баталсны дараа **relyingPartyUUID** ба **API secret** (`rp_sk_…`) олгогдоно; secret **зөвхөн нэг удаа** харагдана.
+Шаардлагатай мэдээлэл (байгууллага, зорилго `AUTH`/`SIGN`, `callbackHosts`, OIDC redirect URI…):
+<https://developer.eidmongolia.mn/#registration>.
 
 ## 1a. «eID-ээр нэвтрэх» (OpenID Connect)
 
@@ -28,6 +32,11 @@ Node.js ≥ 22 (global `fetch`, `node:crypto`).
 (Authorization Code + PKCE `S256`) `id_token` өгнө — Google/Apple нэвтрэлттэй ижил. Утасны хөтчөөс дарахад
 хуудасгүйгээр шууд eID апп нээгдэнэ. Гэрээ: <https://developer.eidmongolia.mn/#oidc>.
 
+**Хаана юу ажиллах.** Товч нь браузерт (энгийн `<a href>` таны backend-ийн `/auth/eid/login` руу); `EidOidcClient`
+нь backend-д — authorize URL угсрах, callback-д `code`-ийг `client_secret`-ээр `id_token` болгон солих, гарын үсгийг
+шалгах. eID-ийн OIDC client нь одоогоор зөвхөн **confidential client** (`client_secret_basic`): backend-гүй SPA эсвэл
+native апп дангаараа token endpoint-ийг дуудаж чадахгүй — native апп ч `code`-ийг өөрийн backend-ээр солино (доор).
+
 **Бүртгэл.** `client_id` = таны RP UUID (`relyingPartyUUID`), `client_secret` = RP API secret (`rp_sk_…`).
 RP-д `AUTH` эрх, OIDC асаалттай, `redirect_uri` (https, ≤ 10) бүртгэлтэй байна — authorize/token-ий `redirect_uri`
 бүртгэлтэйтэй **тэмдэгт бүрээрээ** таарах ёстой. Иргэний ETSI дугаар (`pnomn` claim) хэрэгтэй бол `PNOMN` эрх
@@ -77,15 +86,23 @@ callback → `oidc.handleCallback(request.nextUrl.searchParams, tx)` (зөвхө
 хэрэглэгчийн tap-аас эхэлсэн redirect гинжид eID аппыг нээнэ.
 
 ```html
-<a class="eid-login" href="/auth/eid/login">eID-ээр нэвтрэх</a>
+<a class="eid-login" href="/auth/eid/login">
+  <img src="/img/eid-mongolia.png" alt="" width="20" height="20">
+  eID Mongolia-аар нэвтрэх
+</a>
 <style>
-  .eid-login { display: inline-flex; align-items: center; justify-content: center; min-height: 44px;
-    padding: 0 1.25rem; border-radius: 8px; background: #0b3d91; color: #fff; font: 600 1rem/1 system-ui, sans-serif;
-    text-decoration: none; }
-  .eid-login:focus-visible { outline: 2px solid #0b3d91; outline-offset: 2px; }
+  .eid-login { display: inline-flex; align-items: center; justify-content: center; gap: .5rem; min-height: 44px;
+    padding: 0 1.25rem; border: 1px solid #d0d5dd; border-radius: 6px; background: #fff; color: #111827;
+    font: 500 1rem/1 system-ui, sans-serif; text-decoration: none; }
+  .eid-login:hover { background: #f5f7fa; }
+  .eid-login:focus-visible { outline: 2px solid currentColor; outline-offset: 2px; }
 </style>
 ```
 
+Бичвэр «eID Mongolia-аар нэвтрэх», зүүн талд eID Mongolia лого (<https://developer.eidmongolia.mn/logo-96.png>-ийг
+татаж өөрийн хостоос үйлчил). Google/Apple-ийн товч шиг саармаг (цагаан, хүрээтэй) — таны сайтын бусад нэвтрэх
+товчтой зэрэгцэж болно. Жишээ: <https://demo.eidmongolia.mn>.
+
 `createAuthorization({ display: "page" })` — утсан дээр ч нэвтрэх хуудас (QR / push) харуулна (ж: таблет киоск).
 
 **`id_token` claims** (`EidIdTokenClaims`): `sub` (pairwise — RP тус бүрд өөр, иргэнд тогтмол), `acr`
@@ -123,7 +140,7 @@ const eid = new EidClient({
   trust: { trustAnchorsPem: [process.env.EID_NATIONAL_ROOT_CA_PEM!] }, // ← Mongolian National Root CA, production-д ЗААВАЛ
 });
 
-// ETSI (PNOMN-<иргэний дугаар>) / регистр / иргэний дугаар — аль нь ч болно (сервер таьна)
+// ETSI (PNOMN-<иргэний дугаар>) / регистр / иргэний дугаар — аль нь ч болно (сервер танина)
 const s = await eid.auth.notificationByEtsi("PNOMN-12345678", [
   { type: "displayTextAndPIN", displayText60: "Хаан Банк-д нэвтрэх" },
 ]);
@@ -134,8 +151,19 @@ const result = await eid.session.waitForResult(s.sessionId); // long-poll
 const who = eid.validator.validateAuth(result, s.acsp); // ← гинж + ACSP_V2 крипто-баталгаажуулна
 
 console.log(who.documentNumber, who.subject); // баталгаажсан иргэн
+const { name, serialNumber } = who.parsedSubject; // "Болд Бат", "PNOMN-12345678" (givenName/surname/commonName/country…)
 ```
 
+Subject-ийн талбарууд (`parsedSubject`, `validateSign`-д ч мөн) нь `parseSubject(cert)`-ээс — OID 2.5.4.42/4/3/5/6/10/97,
+UTF8String/PrintableString/BMPString. `parseSubject` нь зөвхөн задлалт: баталгаажаагүй гэрчилгээний нэрэнд бүү итгэ.
+
+> **Ижил утсан дээр push хэрэглэхгүй.** Push (`notificationBy*`)-ийн хүсэлт eID аппад мэдэгдэл / «хүлээгдэж буй»
+> жагсаалтаар ирдэг; Smart-ID ба eID-д Notification төрлийн device link **байхгүй** (CA `docs/DEVICE_LINK_V3.md` §3).
+> Хуучин `/dl?sessionId&vc` холбоос (`deviceLink`) push session-д ч юу ч өгөхгүй (сервер `DEVICE_LINK_REQUIRED`).
+> Иргэн RP-ийг eID апптай ижил утсан дээр нээсэн бол push-ийн оронд **device-link Web2App** урсгал хэрэглэ
+> (`auth.deviceLink*` / `pdf.prepare({ flow: "device-link" })` + `buildDeviceLink(…, "Web2App")`, §4) — товч аппыг шууд
+> нээж, callback-аар буцна. Push-д «eID аппаа нээнэ үү» гэсэн текст л хангалттай.
+
 ## 3. Гарын үсэг (qualified signature)
 
 ```ts
@@ -181,7 +209,7 @@ try {
   // MUST: endResult OK, pdf.documentStatus READY, pdf.signer.onBehalfOf = хүссэн байгууллага,
   // татсан файлын SHA-256 = pdf.outSha256, validation.indication "valid", ltv true.
   if (r.pdf?.documentStatus !== "READY" || r.pdf.signer?.onBehalfOf !== "NTRMN-6235972") throw new Error("…");
-  const signed = await eid.pdf.document(s.sessionId);
+  const signed = await eid.pdf.documentVerified(s.sessionId, r.pdf); // SHA-256 ≠ pdf.outSha256 → ValidationError
   console.log(r.pdf.signer.claimedRole); // "Гүйцэтгэх захирал, Гэрэгэ Системс ХХК (NTRMN-6235972)"
 } catch (e) {
   if ((e instanceof ForbiddenError || e instanceof ApiError) && e.code) {
@@ -195,6 +223,10 @@ try {
 // — CMS/PDF-ийг та угсардаг тул мэдүүлсэн үүргийг (signer-attributes-v2) өөрөө нэмнэ.
 ```
 
+`prepare`-ийн хариу `digest` (DTBS, base64) — иргэний зурах 32 байт, push ба device-link хоёуланд (хуучин CA push-д
+`undefined`). Иргэний гарын үсгийг өөрөө шалгах бол: `eid.validator.validateSign(r, s.digest!)`. Гарын үсэгтэй PDF-ийг
+`pdf.document()`-ийн оронд `pdf.documentVerified(sessionId, r.pdf)`-аар тат — `READY` + `outSha256` тулгалтыг хийнэ.
+
 Олон талт гэрээ: А байгууллагын гаралтыг өөрчлөлтгүй Б-ийн `prepare`-д (`docID`, өөр `onBehalfOf`) илгээнэ.
 Session-ий `onBehalfOf` блок (`role`/`rightType`) нь хариу угсрах үеийн бүртгэл; `pdf.signer.onBehalfOf`/`claimedRole`
 нь баримтад бичигдсэн утга.
@@ -226,7 +258,8 @@ import { buildDeviceLink, type DeviceLinkSession } from "@gerege-systems/eid-mon
 // backend — session эхлүүлээд бүх хариуг СЕРВЕРТ хадгална (sessionToken/sessionSecret/receivedAt/acsp)
 const s = await eid.auth.deviceLinkAnonymous(
   [{ type: "displayTextAndPIN", displayText60: "Хаан Банк-д нэвтрэх" }],
-  { callbackUrl: "https://bank.example.mn/eid/callback?state=…" }, // товч харуулах бол
+  { callbackUrl: "https://bank.example.mn/auth/eid/callback?state=…" }, // товч харуулах бол; host нь callbackHosts-д,
+  // зам нь үргэлж /auth/eid/callback болж нормчлогдоно (зөвхөн query хадгалагдана), https заавал
 );
 store.put(s.sessionId, s);
 res.json({ sessionId: s.sessionId, vc: s.vc }); // браузерт ЗӨВХӨН эдгээр
@@ -275,10 +308,9 @@ eid.validator.validateAuth(result, s.acsp, {
 QR ба товч хоёуланг харуулсан хуудсанд: callback-аар ирсэн үр дүнг `Web2App`/`App2App`-аар, poll-оор ирснийг
 `QR`-аар шалга (товчоор нээгдсэн session зөвхөн callback-аар дуусна).
 
-> ⚠️ **Шилжилт.** eID Mongolia 2.2.3 (build 59)-өөс өмнөх апп v3 холбоосыг танихгүй. RP-ийн v3 рүү шилжилтийг
-> тохиргооны унтраалгаар (анхдагч legacy) хийж, build 59 store-д гарч `min_version=59` тавигдах мөчид асаана.
-> Legacy `deviceLink(session)` (`{deviceLinkBase}?sessionId=…&vc=…`) болон `/browser` entry-ийн
-> `openOrShowQR` **deprecated** — тэр мөчөөс сервер статик холбоосыг хүлээн авахгүй.
+> ⚠️ **Legacy холбоос хасагдсан (2026-10-07).** Статик `deviceLink(session)` (`{deviceLinkBase}?sessionId=…&vc=…`)
+> болон `/browser` entry-ийн `openOrShowQR`-ээр нээгдсэн session-д сервер утасны үйлдлийг `DEVICE_LINK_REQUIRED`-аар
+> татгалзана — зөвхөн v3 (`buildDeviceLink`) ажиллана. Аппын доод хувилбар: iOS 2.2.3 (59), Android 70.
 
 ## Аюулгүй байдал — яагаад `validator` заавал
 
@@ -293,9 +325,14 @@ OK ирж болзошгүй. Иймд `ResponseValidator`:
    - **auth** → ACSP_V2 payload (`smart-id|ACSP_V2|serverRandom|rpChallenge|userChallenge|B64(rpName)|B64(brokeredRpName)|B64(SHA-256(interactions))|interactionTypeUsed|initialCallbackUrl|flowType`, hash = хүсэлтийн `hashAlgorithm`) дээр — `flowType`, `userChallenge`, `serverRandom` ба алгоритмын downgrade-ийг мөн шалгана;
      `expectedFlowType` өгвөл `flowType` эхлүүлсэн урсгалтай ЯГ таарах, Web2App/App2App-д `userChallengeVerifier` заавал
      `initialCallbackUrl`-ийг хариуны `signature.initialCallbackUrl`-аас авна (CA урсгалаар шийднэ: QR/Notification →
-     `""`, Web2App/App2App → таны callback; шилжилтийн үед legacy `/dl` ба push-д таны callback) — зөвхөн `""` эсвэл
+     `""`, Web2App/App2App → таны callback) — зөвхөн `""` эсвэл
      таны илгээсэн callback байхад, Web2App/App2App-д заавал таны callback; өөр утга → татгалзана
    - **sign** → RP-ийн өгсөн digest дээр
+   - алгоритм нь гэрчилгээний түлхүүртэй уях: `ecdsa-with-SHA256` зөвхөн EC P-256 түлхүүрт, RSA алгоритмууд зөвхөн
+     RSA түлхүүрт (alg confusion хаалт). Hash нь үргэлж хүссэнтэй ЯГ тэнцүү. RP-API session-ий гарын үсэг CA дээр
+     SplitKey RSA (одоогийн бүх мобайл гэрчилгээ) эсвэл legacy threshold ECDSA P-256-аас гарна; ECDSA credential
+     зөвхөн SHA-256 digest зурдаг (өөр hash хүссэн session-д сервер гарын үсэг гаргахгүй), тиймээс SHA-384/512
+     хүссэн session-д `ecdsa-with-SHA256` хариу ирвэл хуурамч гэж татгалзана.
 
 Аль нэг алхам бүтэлгүйтвэл `ValidationError` шиднэ — хариунд **итгэхгүй**.
 

package/dist/{browser-Db82DlYN.d.cts → browser-B_XtyuFG.d.cts}

@@ -216,9 +216,8 @@ type DeviceLinkInput = Pick<DeviceLinkSession, "sessionId" | "vc" | "deviceLinkB
  * QR-д эсвэл «eID аппаар нээх» товчинд тавина.
  *
  * @deprecated Legacy статик холбоос — холбоосын төрөл (QR/Web2App) хамгаалагдаагүй, relay-д нээлттэй.
- * eID Mongolia 2.2.3 (build 59) гармагц сервер унтраана (`EID_DEVICE_LINK_LEGACY=false`). Шинэ код
- * backend-д {@link buildDeviceLink} (v3) ашиглана; build 59-өөс өмнөх апп v3 холбоосыг танихгүй тул
- * RP v3 рүү шилжих нь тохиргооны унтраалгаар (анхдагч legacy) хийгдэнэ.
+ * Сервер 2026-10-07-нд хассан: ийм холбоосоор нээгдсэн session-д утасны үйлдлийг `DEVICE_LINK_REQUIRED`-аар
+ * татгалзана. Backend-д {@link buildDeviceLink} (v3) ашиглана.
  *
  * @throws {DeviceLinkError} deviceLinkBase байхгүй / http(s) биш, sessionId UUID биш, vc 5 орон биш.
  */
@@ -251,6 +250,8 @@ interface OpenOrShowQROptions {
  * Link-ийг алгасаж /dl хуудсыг нээдэг; тэр хуудас «Аппаар нээх» товч ба store холбоосыг санал болгоно.
  *
  * @throws {DeviceLinkError} холбоос угсрах боломжгүй бол ({@link deviceLink}).
+ * @deprecated Legacy {@link deviceLink} холбоос дээр тулгуурладаг — сервер 2026-10-07-нд хассан тул ажиллахгүй.
+ * QR-ийг backend-ийн `buildDeviceLink` (v3)-ээр, утсан дээр Web2App холбоосыг энгийн `<a href>`-ээр харуулна.
  */
 declare function openOrShowQR(session: DeviceLinkInput, opts: OpenOrShowQROptions): "opened" | "qr";
 
@@ -317,4 +318,4 @@ declare class ValidationError extends EidError {
 declare class DeviceLinkError extends EidError {
 }
 
-export { type AcspContext as A, type CertificateLevel as C, type DeviceLinkSession as D, EidError as E, type FlowType as F, type HashAlgorithm as H, type Interaction as I, type NotificationSession as N, ON_BEHALF_ERROR_CODES as O, type PdfDocumentStatus as P, type RpCredentials as R, type SignatureAlgorithm as S, ValidationError as V, type SessionResult as a, type RepresentationsResponse as b, ApiError as c, AuthenticationError as d, DeviceLinkError as e, type DeviceLinkInput as f, type EndResult as g, ForbiddenError as h, type NavigatorLike as i, NetworkError as j, type OnBehalfErrorCode as k, type OpenOrShowQROptions as l, type OrgResult as m, type PdfSessionBlock as n, type PdfSigner as o, type Representation as p, SessionFailedError as q, type SessionState as r, type SignatureAlgorithmParameters as s, type SignatureProtocol as t, deviceLink as u, isMobileUserAgent as v, openOrShowQR as w };
+export { type AcspContext as A, type CertificateLevel as C, type DeviceLinkSession as D, EidError as E, type FlowType as F, type HashAlgorithm as H, type Interaction as I, type NotificationSession as N, ON_BEHALF_ERROR_CODES as O, type PdfSessionBlock as P, type RpCredentials as R, type SignatureAlgorithm as S, ValidationError as V, type SessionResult as a, type RepresentationsResponse as b, ApiError as c, AuthenticationError as d, DeviceLinkError as e, type DeviceLinkInput as f, type EndResult as g, ForbiddenError as h, type NavigatorLike as i, NetworkError as j, type OnBehalfErrorCode as k, type OpenOrShowQROptions as l, type OrgResult as m, type PdfDocumentStatus as n, type PdfSigner as o, type Representation as p, SessionFailedError as q, type SessionState as r, type SignatureAlgorithmParameters as s, type SignatureProtocol as t, deviceLink as u, isMobileUserAgent as v, openOrShowQR as w };

package/dist/{browser-Db82DlYN.d.ts → browser-B_XtyuFG.d.ts}

@@ -216,9 +216,8 @@ type DeviceLinkInput = Pick<DeviceLinkSession, "sessionId" | "vc" | "deviceLinkB
  * QR-д эсвэл «eID аппаар нээх» товчинд тавина.
  *
  * @deprecated Legacy статик холбоос — холбоосын төрөл (QR/Web2App) хамгаалагдаагүй, relay-д нээлттэй.
- * eID Mongolia 2.2.3 (build 59) гармагц сервер унтраана (`EID_DEVICE_LINK_LEGACY=false`). Шинэ код
- * backend-д {@link buildDeviceLink} (v3) ашиглана; build 59-өөс өмнөх апп v3 холбоосыг танихгүй тул
- * RP v3 рүү шилжих нь тохиргооны унтраалгаар (анхдагч legacy) хийгдэнэ.
+ * Сервер 2026-10-07-нд хассан: ийм холбоосоор нээгдсэн session-д утасны үйлдлийг `DEVICE_LINK_REQUIRED`-аар
+ * татгалзана. Backend-д {@link buildDeviceLink} (v3) ашиглана.
  *
  * @throws {DeviceLinkError} deviceLinkBase байхгүй / http(s) биш, sessionId UUID биш, vc 5 орон биш.
  */
@@ -251,6 +250,8 @@ interface OpenOrShowQROptions {
  * Link-ийг алгасаж /dl хуудсыг нээдэг; тэр хуудас «Аппаар нээх» товч ба store холбоосыг санал болгоно.
  *
  * @throws {DeviceLinkError} холбоос угсрах боломжгүй бол ({@link deviceLink}).
+ * @deprecated Legacy {@link deviceLink} холбоос дээр тулгуурладаг — сервер 2026-10-07-нд хассан тул ажиллахгүй.
+ * QR-ийг backend-ийн `buildDeviceLink` (v3)-ээр, утсан дээр Web2App холбоосыг энгийн `<a href>`-ээр харуулна.
  */
 declare function openOrShowQR(session: DeviceLinkInput, opts: OpenOrShowQROptions): "opened" | "qr";
 
@@ -317,4 +318,4 @@ declare class ValidationError extends EidError {
 declare class DeviceLinkError extends EidError {
 }
 
-export { type AcspContext as A, type CertificateLevel as C, type DeviceLinkSession as D, EidError as E, type FlowType as F, type HashAlgorithm as H, type Interaction as I, type NotificationSession as N, ON_BEHALF_ERROR_CODES as O, type PdfDocumentStatus as P, type RpCredentials as R, type SignatureAlgorithm as S, ValidationError as V, type SessionResult as a, type RepresentationsResponse as b, ApiError as c, AuthenticationError as d, DeviceLinkError as e, type DeviceLinkInput as f, type EndResult as g, ForbiddenError as h, type NavigatorLike as i, NetworkError as j, type OnBehalfErrorCode as k, type OpenOrShowQROptions as l, type OrgResult as m, type PdfSessionBlock as n, type PdfSigner as o, type Representation as p, SessionFailedError as q, type SessionState as r, type SignatureAlgorithmParameters as s, type SignatureProtocol as t, deviceLink as u, isMobileUserAgent as v, openOrShowQR as w };
+export { type AcspContext as A, type CertificateLevel as C, type DeviceLinkSession as D, EidError as E, type FlowType as F, type HashAlgorithm as H, type Interaction as I, type NotificationSession as N, ON_BEHALF_ERROR_CODES as O, type PdfSessionBlock as P, type RpCredentials as R, type SignatureAlgorithm as S, ValidationError as V, type SessionResult as a, type RepresentationsResponse as b, ApiError as c, AuthenticationError as d, DeviceLinkError as e, type DeviceLinkInput as f, type EndResult as g, ForbiddenError as h, type NavigatorLike as i, NetworkError as j, type OnBehalfErrorCode as k, type OpenOrShowQROptions as l, type OrgResult as m, type PdfDocumentStatus as n, type PdfSigner as o, type Representation as p, SessionFailedError as q, type SessionState as r, type SignatureAlgorithmParameters as s, type SignatureProtocol as t, deviceLink as u, isMobileUserAgent as v, openOrShowQR as w };

package/dist/browser.d.cts

@@ -1 +1 @@
-export { e as DeviceLinkError, f as DeviceLinkInput, D as DeviceLinkSession, E as EidError, i as NavigatorLike, l as OpenOrShowQROptions, u as deviceLink, v as isMobileUserAgent, w as openOrShowQR } from './browser-Db82DlYN.cjs';
+export { e as DeviceLinkError, f as DeviceLinkInput, D as DeviceLinkSession, E as EidError, i as NavigatorLike, l as OpenOrShowQROptions, u as deviceLink, v as isMobileUserAgent, w as openOrShowQR } from './browser-B_XtyuFG.cjs';

package/dist/browser.d.ts

@@ -1 +1 @@
-export { e as DeviceLinkError, f as DeviceLinkInput, D as DeviceLinkSession, E as EidError, i as NavigatorLike, l as OpenOrShowQROptions, u as deviceLink, v as isMobileUserAgent, w as openOrShowQR } from './browser-Db82DlYN.js';
+export { e as DeviceLinkError, f as DeviceLinkInput, D as DeviceLinkSession, E as EidError, i as NavigatorLike, l as OpenOrShowQROptions, u as deviceLink, v as isMobileUserAgent, w as openOrShowQR } from './browser-B_XtyuFG.js';

package/dist/index.cjs

@@ -51,6 +51,7 @@ __export(index_exports, {
   isMobileUserAgent: () => isMobileUserAgent,
   openOrShowQR: () => openOrShowQR,
   parseSessionResult: () => parseSessionResult,
+  parseSubject: () => parseSubject,
   pkceChallenge: () => pkceChallenge,
   qrDeviceLinkTicker: () => qrDeviceLinkTicker,
   randomChallenge: () => randomChallenge,
@@ -480,6 +481,7 @@ var SessionApi = class {
 };
 
 // src/pdf.ts
+var import_node_crypto2 = require("crypto");
 function rec3(v) {
   return v && typeof v === "object" ? v : {};
 }
@@ -512,10 +514,12 @@ var PdfApi = class {
     const receivedAt = Date.now();
     const vc = rec3(r.vc).value;
     const dl = rec3(r.deviceLink);
+    const digest = typeof r.digest === "string" && r.digest ? r.digest : typeof dl.digest === "string" && dl.digest ? dl.digest : void 0;
     return {
       sessionId: String(r.sessionID),
       docId: String(r.docID),
       vc: vc != null ? String(vc) : null,
+      ...digest !== void 0 ? { digest } : {},
       deviceLink: dl.sessionToken ? {
         sessionToken: String(dl.sessionToken),
         sessionSecret: String(dl.sessionSecret),
@@ -533,6 +537,26 @@ var PdfApi = class {
   document(sessionId) {
     return this.http.getBytes(`/pdf/sign/${encodeURIComponent(sessionId)}/document`, 6e4);
   }
+  /**
+   * {@link document} + тулгалт: татсан байтын SHA-256 нь session poll-ийн `pdf.outSha256`-тай тэнцүү байх ёстой.
+   * `expected` — poll-ийн `result.pdf` блок (`documentStatus` READY + `outSha256` заавал) эсвэл SHA-256 hex.
+   *
+   * @throws {ValidationError} блок READY биш / `outSha256` алга / hash таарахгүй (файлд бүү итгэ).
+   */
+  async documentVerified(sessionId, expected) {
+    let want;
+    if (typeof expected === "string") {
+      want = expected;
+    } else {
+      if (expected.documentStatus !== "READY") throw new ValidationError(`pdf.documentStatus ${expected.documentStatus} \u2260 READY`);
+      want = expected.outSha256;
+    }
+    if (!want || !/^[0-9a-fA-F]{64}$/.test(want)) throw new ValidationError("pdf.outSha256 \u0430\u043B\u0433\u0430 \u044D\u0441\u0432\u044D\u043B SHA-256 hex \u0431\u0438\u0448");
+    const bytes = await this.document(sessionId);
+    const got = (0, import_node_crypto2.createHash)("sha256").update(bytes).digest("hex");
+    if (got !== want.toLowerCase()) throw new ValidationError("\u0422\u0430\u0442\u0441\u0430\u043D PDF-\u0438\u0439\u043D SHA-256 \u043D\u044C pdf.outSha256-\u0442\u0430\u0439 \u0442\u0430\u0430\u0440\u0441\u0430\u043D\u0433\u04AF\u0439");
+    return bytes;
+  }
 };
 
 // src/organization.ts
@@ -550,7 +574,114 @@ var OrganizationApi = class {
 };
 
 // src/validator.ts
-var import_node_crypto2 = require("crypto");
+var import_node_crypto4 = require("crypto");
+
+// src/subject.ts
+var import_node_crypto3 = require("crypto");
+var OIDS = {
+  "2.5.4.42": "givenName",
+  "2.5.4.4": "surname",
+  "2.5.4.3": "commonName",
+  "2.5.4.5": "serialNumber",
+  "2.5.4.6": "country",
+  "2.5.4.10": "organization",
+  "2.5.4.97": "organizationIdentifier"
+};
+function tlv(buf, pos, limit) {
+  if (pos + 2 > limit) throw new ValidationError("subject: DER \u0442\u043E\u043B\u0433\u043E\u0439 \u0431\u043E\u0433\u0438\u043D\u043E");
+  const tag = buf[pos];
+  if ((tag & 31) === 31) throw new ValidationError("subject: \u043E\u043B\u043E\u043D \u0431\u0430\u0439\u0442 tag \u0434\u044D\u043C\u0436\u0438\u0433\u0434\u044D\u044D\u0433\u04AF\u0439");
+  let len = buf[pos + 1];
+  let i = pos + 2;
+  if (len & 128) {
+    const n = len & 127;
+    if (n === 0 || n > 3) throw new ValidationError("subject: DER \u0443\u0440\u0442 \u0431\u0443\u0440\u0443\u0443");
+    if (i + n > limit) throw new ValidationError("subject: DER \u0443\u0440\u0442 \u0431\u043E\u0433\u0438\u043D\u043E");
+    len = 0;
+    for (let k = 0; k < n; k++) len = len * 256 + buf[i++];
+  }
+  if (i + len > limit) throw new ValidationError("subject: DER \u0430\u0433\u0443\u0443\u043B\u0433\u0430 \u0445\u0438\u043B\u044D\u044D\u0441 \u0433\u0430\u0440\u043D\u0430");
+  return { tag, start: i, end: i + len };
+}
+function oidOf(buf, t) {
+  if (t.tag !== 6 || t.end === t.start) throw new ValidationError("subject: OID \u0431\u0438\u0448");
+  const parts = [];
+  let v = 0;
+  for (let i = t.start; i < t.end; i++) {
+    const b = buf[i];
+    v = v * 128 + (b & 127);
+    if (!(b & 128)) {
+      if (parts.length === 0) parts.push(v < 80 ? Math.floor(v / 40) : 2, v < 80 ? v % 40 : v - 80);
+      else parts.push(v);
+      v = 0;
+    }
+  }
+  return parts.join(".");
+}
+function stringOf(buf, t) {
+  const bytes = buf.subarray(t.start, t.end);
+  switch (t.tag) {
+    case 12:
+      try {
+        return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+      } catch {
+        throw new ValidationError("subject: UTF8String \u0431\u0443\u0440\u0443\u0443 UTF-8");
+      }
+    case 19:
+    // PrintableString
+    case 22:
+    // IA5String
+    case 20:
+      return Buffer.from(bytes).toString("latin1");
+    case 30: {
+      if (bytes.length % 2) throw new ValidationError("subject: BMPString \u0443\u0440\u0442 \u0441\u043E\u043D\u0434\u0433\u043E\u0439");
+      return Buffer.from(bytes).swap16().toString("utf16le");
+    }
+    default:
+      return void 0;
+  }
+}
+function parseSubject(cert) {
+  const der = cert instanceof import_node_crypto3.X509Certificate ? new Uint8Array(cert.raw) : typeof cert === "string" ? new Uint8Array(Buffer.from(cert, "base64")) : cert;
+  const top = tlv(der, 0, der.length);
+  if (top.tag !== 48) throw new ValidationError("subject: Certificate SEQUENCE \u0431\u0438\u0448");
+  const tbs = tlv(der, top.start, top.end);
+  if (tbs.tag !== 48) throw new ValidationError("subject: tbsCertificate SEQUENCE \u0431\u0438\u0448");
+  let pos = tbs.start;
+  let first = tlv(der, pos, tbs.end);
+  if (first.tag === 160) {
+    pos = first.end;
+    first = tlv(der, pos, tbs.end);
+  }
+  let field = first;
+  for (let k = 0; k < 4; k++) field = tlv(der, field.end, tbs.end);
+  if (field.tag !== 48) throw new ValidationError("subject: Name SEQUENCE \u0431\u0438\u0448");
+  const out = { name: null, attributes: {} };
+  for (let sp = field.start; sp < field.end; ) {
+    const rdn = tlv(der, sp, field.end);
+    if (rdn.tag !== 49) throw new ValidationError("subject: RDN SET \u0431\u0438\u0448");
+    for (let ap = rdn.start; ap < rdn.end; ) {
+      const atv = tlv(der, ap, rdn.end);
+      if (atv.tag !== 48) throw new ValidationError("subject: AttributeTypeAndValue SEQUENCE \u0431\u0438\u0448");
+      const oidT = tlv(der, atv.start, atv.end);
+      const valT = tlv(der, oidT.end, atv.end);
+      const oid = oidOf(der, oidT);
+      const value = stringOf(der, valT);
+      if (value !== void 0 && !(oid in out.attributes)) {
+        out.attributes[oid] = value;
+        const key = OIDS[oid];
+        if (key) out[key] = value;
+      }
+      ap = atv.end;
+    }
+    sp = rdn.end;
+  }
+  const full = [out.givenName, out.surname].filter((s) => s).join(" ");
+  out.name = full || out.commonName || null;
+  return out;
+}
+
+// src/validator.ts
 var ResponseValidator = class {
   anchors;
   intermediates;
@@ -560,8 +691,8 @@ var ResponseValidator = class {
   revocation;
   revocationMode;
   constructor(trust = {}) {
-    this.anchors = (trust.trustAnchorsPem ?? []).map((p) => new import_node_crypto2.X509Certificate(p));
-    this.intermediates = (trust.intermediatesPem ?? []).map((p) => new import_node_crypto2.X509Certificate(p));
+    this.anchors = (trust.trustAnchorsPem ?? []).map((p) => new import_node_crypto4.X509Certificate(p));
+    this.intermediates = (trust.intermediatesPem ?? []).map((p) => new import_node_crypto4.X509Certificate(p));
     this.requiredLevel = trust.requiredLevel ?? "QUALIFIED";
     this.skew = trust.clockSkewMs ?? 0;
     this.allowUntrusted = trust.allowUntrusted ?? false;
@@ -592,7 +723,7 @@ var ResponseValidator = class {
       throw new ValidationError("userChallengeVerifier \u043D\u044C \u0433\u0430\u0440\u044B\u043D \u04AF\u0441\u044D\u0433 \u0437\u0443\u0440\u0430\u0433\u0434\u0441\u0430\u043D userChallenge-\u0442\u044D\u0439 \u0442\u0430\u0430\u0440\u0441\u0430\u043D\u0433\u04AF\u0439");
     }
     if (!interactionTypeUsed) throw new ValidationError("interactionTypeUsed \u0430\u043B\u0433\u0430");
-    const { alg, hash } = this.algorithmOf(result, acsp.signatureAlgorithm, acsp.hashAlgorithm);
+    const { alg, hash } = this.algorithmOf(result, leaf, acsp.signatureAlgorithm, acsp.hashAlgorithm);
     const payload = buildAcspV2Payload({
       serverRandom,
       rpChallenge: acsp.rpChallenge,
@@ -611,6 +742,7 @@ var ResponseValidator = class {
       documentNumber: result.documentNumber,
       certificate: leaf,
       subject: leaf.subject,
+      parsedSubject: parseSubject(leaf),
       certificateLevel: String(result.certificateLevel ?? "")
     };
   }
@@ -621,7 +753,7 @@ var ResponseValidator = class {
   validateSign(result, digestB64, hashAlgorithm = "SHA-256") {
     const leaf = this.precheck(result, "RAW_DIGEST_SIGNATURE");
     const digest = Buffer.from(digestB64, "base64");
-    const { alg, hash } = this.algorithmOf(result, null, hashAlgorithm);
+    const { alg, hash } = this.algorithmOf(result, leaf, null, hashAlgorithm);
     if (digest.length !== hashLen(hash)) throw new ValidationError("digest \u0443\u0440\u0442 hashAlgorithm-\u0442\u0430\u0439 \u0442\u0430\u0430\u0440\u0430\u0445\u0433\u04AF\u0439");
     if (!verifyPrehashedSignature(digest, result.signatureValueB64, leaf.publicKey, alg, hash)) {
       throw new ValidationError("\u0413\u0430\u0440\u044B\u043D \u04AF\u0441\u044D\u0433 \u04E9\u0433\u0441\u04E9\u043D digest-\u0442\u044D\u0439 \u0442\u0430\u0430\u0440\u0441\u0430\u043D\u0433\u04AF\u0439");
@@ -631,27 +763,47 @@ var ResponseValidator = class {
       signatureValueB64: result.signatureValueB64,
       signatureAlgorithm: result.signatureAlgorithm,
       certificate: leaf,
-      subject: leaf.subject
+      subject: leaf.subject,
+      parsedSubject: parseSubject(leaf)
     };
   }
   /**
-   * Хариуны signatureAlgorithm + hashAlgorithm-ийг RP-ийн хүссэнтэй тулгана (downgrade хаалт).
-   * ecdsa-with-SHA256 (хуучин cert) хүссэн rsassa-pss-ийн оронд ирэхийг зөвшөөрнө — SHA-256-аар л.
+   * Хариуны signatureAlgorithm + hashAlgorithm-ийг RP-ийн хүссэнтэй ба иргэний түлхүүрийн төрөлтэй тулгана
+   * (downgrade / alg confusion хаалт).
+   *
+   * CA-ийн бодит зан (ca-eidmongolia-mn `service/memory/crypto_wired.go` `messageHash`, `domain/enums.go`):
+   * RP-API session-ий гарын үсэг хоёр замаас л гарна — SplitKey RSA (`rsassa-pss` / `shaNNNWithRSAEncryption`,
+   * hash = хүсэлтийн `hashAlgorithm`) ба legacy threshold ECDSA P-256 (ҮРГЭЛЖ `ecdsa-with-SHA256`). ECDSA credential
+   * зөвхөн 32 байт digest зурдаг: session-ий hash SHA-256 биш бол сервер гарын үсэг гаргахгүй (session OK болохгүй).
+   * Иймд:
+   *   - hash нь ҮРГЭЛЖ хүссэнтэй яг тэнцүү — `ecdsa-with-SHA256` хариу SHA-384/512 хүссэн session-д ирвэл хуурамч;
+   *   - `ecdsa-with-SHA256` нь хүссэн `rsassa-pss`-ийн оронд ирж болно (credential-ийн төрөл), ГЭХДЭЭ зөвхөн
+   *     EC P-256 түлхүүртэй гэрчилгээнд; RSA алгоритмууд зөвхөн RSA түлхүүрт (alg confusion үгүй).
    */
-  algorithmOf(result, wantAlg, wantHash) {
+  algorithmOf(result, leaf, wantAlg, wantHash) {
     const alg = result.signatureAlgorithm ?? "";
+    const keyType = leaf.publicKey.asymmetricKeyType;
     let hash;
     if (alg === "rsassa-pss") {
       hash = String(result.signatureAlgorithmParameters?.hashAlgorithm ?? "");
+      if (!HASHES.has(hash)) throw new ValidationError(`\u0414\u044D\u043C\u0436\u0438\u0433\u0434\u044D\u044D\u0433\u04AF\u0439 hashAlgorithm: ${hash}`);
       const mgf = result.signatureAlgorithmParameters?.maskGenAlgorithm?.parameters?.hashAlgorithm;
       if (mgf && mgf !== hash) throw new ValidationError("MGF1 hash \u043D\u044C hashAlgorithm-\u0430\u0430\u0441 \u04E9\u04E9\u0440");
       if (result.signatureAlgorithmParameters?.saltLength != null && result.signatureAlgorithmParameters.saltLength !== hashLen(hash)) {
         throw new ValidationError("saltLength \u2260 hLen");
       }
+      if (keyType !== "rsa" && keyType !== "rsa-pss") throw new ValidationError(`${alg} \u043D\u044C ${keyType} \u0442\u04AF\u043B\u0445\u04AF\u04AF\u0440\u0442\u044D\u0439 \u0442\u0430\u0430\u0440\u0430\u0445\u0433\u04AF\u0439`);
     } else if (/^sha(256|384|512)WithRSAEncryption$/.test(alg)) {
       hash = "SHA-" + alg.slice(3, 6);
+      if (keyType !== "rsa") throw new ValidationError(`${alg} \u043D\u044C ${keyType} \u0442\u04AF\u043B\u0445\u04AF\u04AF\u0440\u0442\u044D\u0439 \u0442\u0430\u0430\u0440\u0430\u0445\u0433\u04AF\u0439`);
     } else if (alg === "ecdsa-with-SHA256") {
       hash = "SHA-256";
+      if (keyType !== "ec" || leaf.publicKey.asymmetricKeyDetails?.namedCurve !== "prime256v1") {
+        throw new ValidationError(`${alg} \u043D\u044C EC P-256 \u0431\u0443\u0441 \u0442\u04AF\u043B\u0445\u04AF\u04AF\u0440\u0442\u044D\u0439 \u0442\u0430\u0430\u0440\u0430\u0445\u0433\u04AF\u0439`);
+      }
+      if (wantHash !== hash) {
+        throw new ValidationError(`ecdsa-with-SHA256 \u0445\u0430\u0440\u0438\u0443 ${wantHash} \u0445\u04AF\u0441\u0441\u044D\u043D session-\u0434 \u0431\u043E\u043B\u043E\u043C\u0436\u0433\u04AF\u0439 (ECDSA credential \u0437\u04E9\u0432\u0445\u04E9\u043D SHA-256)`);
+      }
     } else {
       throw new ValidationError(`\u0414\u044D\u043C\u0436\u0438\u0433\u0434\u044D\u044D\u0433\u04AF\u0439 signatureAlgorithm: ${alg}`);
     }
@@ -672,7 +824,7 @@ var ResponseValidator = class {
     if (!result.certificateDerB64) throw new ValidationError("\u0425\u0430\u0440\u0438\u0443\u043D\u0434 \u0433\u044D\u0440\u0447\u0438\u043B\u0433\u044D\u044D \u0430\u043B\u0433\u0430");
     if (!result.signatureValueB64) throw new ValidationError("\u0425\u0430\u0440\u0438\u0443\u043D\u0434 \u0433\u0430\u0440\u044B\u043D \u04AF\u0441\u044D\u0433 \u0430\u043B\u0433\u0430");
     if (!result.documentNumber) throw new ValidationError("\u0425\u0430\u0440\u0438\u0443\u043D\u0434 documentNumber \u0430\u043B\u0433\u0430");
-    const leaf = new import_node_crypto2.X509Certificate(Buffer.from(result.certificateDerB64, "base64"));
+    const leaf = new import_node_crypto4.X509Certificate(Buffer.from(result.certificateDerB64, "base64"));
     this.checkValidity(leaf);
     this.checkLevel(String(result.certificateLevel ?? ""));
     if (this.anchors.length === 0) {
@@ -750,16 +902,16 @@ function signedCallbackUrl(fromResponse, rpCallback, flowType) {
   return fromResponse;
 }
 function userChallengeOf(verifier) {
-  return (0, import_node_crypto2.createHash)("sha256").update(verifier, "utf8").digest("base64url");
+  return (0, import_node_crypto4.createHash)("sha256").update(verifier, "utf8").digest("base64url");
 }
 function verifyPayloadSignature(payload, sigB64, key, alg, hash) {
   const sig = Buffer.from(sigB64, "base64");
   const h = nodeHash(hash);
   if (alg === "rsassa-pss") {
-    return (0, import_node_crypto2.verify)(h, payload, { key, padding: import_node_crypto2.constants.RSA_PKCS1_PSS_PADDING, saltLength: hashLen(hash) }, sig);
+    return (0, import_node_crypto4.verify)(h, payload, { key, padding: import_node_crypto4.constants.RSA_PKCS1_PSS_PADDING, saltLength: hashLen(hash) }, sig);
   }
-  if (alg === "ecdsa-with-SHA256") return (0, import_node_crypto2.verify)(h, payload, { key, dsaEncoding: "der" }, sig);
-  return (0, import_node_crypto2.verify)(h, payload, { key, padding: import_node_crypto2.constants.RSA_PKCS1_PADDING }, sig);
+  if (alg === "ecdsa-with-SHA256") return (0, import_node_crypto4.verify)(h, payload, { key, dsaEncoding: "der" }, sig);
+  return (0, import_node_crypto4.verify)(h, payload, { key, padding: import_node_crypto4.constants.RSA_PKCS1_PADDING }, sig);
 }
 function verifyPrehashedSignature(digest, sigB64, key, alg, hash) {
   const sig = Buffer.from(sigB64, "base64");
@@ -768,7 +920,7 @@ function verifyPrehashedSignature(digest, sigB64, key, alg, hash) {
   if (!modBits || sig.length !== Math.ceil(modBits / 8)) return false;
   let em;
   try {
-    em = (0, import_node_crypto2.publicDecrypt)({ key, padding: import_node_crypto2.constants.RSA_NO_PADDING }, sig);
+    em = (0, import_node_crypto4.publicDecrypt)({ key, padding: import_node_crypto4.constants.RSA_NO_PADDING }, sig);
   } catch {
     return false;
   }
@@ -841,6 +993,7 @@ function ecdsaP256VerifyPrehashed(digest, sig, key) {
   const R = ptAdd(ptMul(mod(z * w, n), [P256.gx, P256.gy]), ptMul(mod(r * w, n), Q));
   return R !== null && mod(R[0], n) === r;
 }
+var HASHES = /* @__PURE__ */ new Set(["SHA-256", "SHA-384", "SHA-512"]);
 var DIGEST_INFO = {
   "SHA-256": Buffer.from("3031300d060960864801650304020105000420", "hex"),
   "SHA-384": Buffer.from("3041300d060960864801650304020205000430", "hex"),
@@ -851,7 +1004,7 @@ function mgf1(hash, seed, length) {
   for (let i = 0, n = 0; n < length; i++, n += hashLen(hash)) {
     const c = Buffer.alloc(4);
     c.writeUInt32BE(i, 0);
-    out.push((0, import_node_crypto2.createHash)(nodeHash(hash)).update(seed).update(c).digest());
+    out.push((0, import_node_crypto4.createHash)(nodeHash(hash)).update(seed).update(c).digest());
   }
   return Buffer.concat(out).subarray(0, length);
 }
@@ -875,7 +1028,7 @@ function emsaPssVerify(mHash, em, emBits, hash) {
   const psLen = emLen - hLen - sLen - 2;
   if (!db.subarray(0, psLen).every((b) => b === 0) || db[psLen] !== 1) return false;
   const salt = db.subarray(psLen + 1);
-  const h2 = (0, import_node_crypto2.createHash)(nodeHash(hash)).update(Buffer.alloc(8)).update(mHash).update(salt).digest();
+  const h2 = (0, import_node_crypto4.createHash)(nodeHash(hash)).update(Buffer.alloc(8)).update(mHash).update(salt).digest();
   return h.equals(h2);
 }
 function isCa(cert) {
@@ -970,7 +1123,7 @@ function openOrShowQR(session, opts) {
 }
 
 // src/devicelinkv3.ts
-var import_node_crypto3 = require("crypto");
+var import_node_crypto5 = require("crypto");
 var TYPES = ["QR", "Web2App", "App2App"];
 var PROTOCOL = { auth: "ACSP_V2", sign: "RAW_DIGEST_SIGNATURE", cert: "" };
 var TOKEN_RE = /^[A-Za-z0-9_-]+$/;
@@ -1027,7 +1180,7 @@ function buildDeviceLink(p) {
     callback,
     unprotected
   ].join("|");
-  const authCode = (0, import_node_crypto3.createHmac)("sha256", Buffer.from(p.sessionSecret, "base64")).update(payload, "utf8").digest("base64url");
+  const authCode = (0, import_node_crypto5.createHmac)("sha256", Buffer.from(p.sessionSecret, "base64")).update(payload, "utf8").digest("base64url");
   return `${unprotected}&authCode=${authCode}`;
 }
 function qrDeviceLinkTicker(input, onLink, opts) {
@@ -1040,7 +1193,7 @@ function qrDeviceLinkTicker(input, onLink, opts) {
 }
 
 // src/oidc.ts
-var import_node_crypto4 = require("crypto");
+var import_node_crypto6 = require("crypto");
 var EID_OIDC_ISSUER = "https://login.eidmongolia.mn";
 var EID_ACR_QUALIFIED = "urn:eidmongolia:loa:qualified";
 var EID_ACR_ADVANCED = "urn:eidmongolia:loa:advanced";
@@ -1297,7 +1450,7 @@ function formEncode(s) {
 function timingSafeEqualStr(a, b) {
   const x = Buffer.from(a, "utf8");
   const y = Buffer.from(b, "utf8");
-  return x.length === y.length && (0, import_node_crypto4.timingSafeEqual)(x, y);
+  return x.length === y.length && (0, import_node_crypto6.timingSafeEqual)(x, y);
 }
 function decodeJsonPart(s) {
   try {
@@ -1348,6 +1501,7 @@ function callbackParams(input) {
   isMobileUserAgent,
   openOrShowQR,
   parseSessionResult,
+  parseSubject,
   pkceChallenge,
   qrDeviceLinkTicker,
   randomChallenge,

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { R as RpCredentials, C as CertificateLevel, I as Interaction, S as SignatureAlgorithm, H as HashAlgorithm, N as NotificationSession, D as DeviceLinkSession, a as SessionResult, b as RepresentationsResponse, A as AcspContext, F as FlowType, E as EidError } from './browser-Db82DlYN.cjs';
-export { c as ApiError, d as AuthenticationError, e as DeviceLinkError, f as DeviceLinkInput, g as EndResult, h as ForbiddenError, i as NavigatorLike, j as NetworkError, O as ON_BEHALF_ERROR_CODES, k as OnBehalfErrorCode, l as OpenOrShowQROptions, m as OrgResult, P as PdfDocumentStatus, n as PdfSessionBlock, o as PdfSigner, p as Representation, q as SessionFailedError, r as SessionState, s as SignatureAlgorithmParameters, t as SignatureProtocol, V as ValidationError, u as deviceLink, v as isMobileUserAgent, w as openOrShowQR } from './browser-Db82DlYN.cjs';
+import { R as RpCredentials, C as CertificateLevel, I as Interaction, S as SignatureAlgorithm, H as HashAlgorithm, N as NotificationSession, D as DeviceLinkSession, a as SessionResult, P as PdfSessionBlock, b as RepresentationsResponse, A as AcspContext, F as FlowType, E as EidError } from './browser-B_XtyuFG.cjs';
+export { c as ApiError, d as AuthenticationError, e as DeviceLinkError, f as DeviceLinkInput, g as EndResult, h as ForbiddenError, i as NavigatorLike, j as NetworkError, O as ON_BEHALF_ERROR_CODES, k as OnBehalfErrorCode, l as OpenOrShowQROptions, m as OrgResult, n as PdfDocumentStatus, o as PdfSigner, p as Representation, q as SessionFailedError, r as SessionState, s as SignatureAlgorithmParameters, t as SignatureProtocol, V as ValidationError, u as deviceLink, v as isMobileUserAgent, w as openOrShowQR } from './browser-B_XtyuFG.cjs';
 import { X509Certificate, KeyObject } from 'node:crypto';
 
 interface HttpConfig {
@@ -172,6 +172,12 @@ interface PdfPrepareSession {
     docId: string;
     /** Иргэнд ХАРУУЛАХ баталгаажуулах код (ПИН биш). */
     vc: string | null;
+    /**
+     * Иргэний зурах DTBS (base64, SHA-256 = 32 байт) — урсгалаас үл хамааран. Хариуны гарын үсгийг өөрөө шалгахад:
+     * `validator.validateSign(result, digest)`. Хуучин CA push хариунд талбаргүй → undefined (device-link-д
+     * `deviceLink.digest`-ээс).
+     */
+    digest?: string;
     deviceLink: {
         sessionToken: string;
         sessionSecret: string;
@@ -194,6 +200,13 @@ declare class PdfApi {
      * session-ий `pdf.outSha256`-тай тулга. Эрх хасагдсан бол `ForbiddenError` `.code = "REPRESENTATION_REVOKED"`.
      */
     document(sessionId: string): Promise<Uint8Array>;
+    /**
+     * {@link document} + тулгалт: татсан байтын SHA-256 нь session poll-ийн `pdf.outSha256`-тай тэнцүү байх ёстой.
+     * `expected` — poll-ийн `result.pdf` блок (`documentStatus` READY + `outSha256` заавал) эсвэл SHA-256 hex.
+     *
+     * @throws {ValidationError} блок READY биш / `outSha256` алга / hash таарахгүй (файлд бүү итгэ).
+     */
+    documentVerified(sessionId: string, expected: PdfSessionBlock | string): Promise<Uint8Array>;
 }
 
 declare class OrganizationApi {
@@ -203,6 +216,36 @@ declare class OrganizationApi {
     getRepresentations(personEtsi: string): Promise<RepresentationsResponse>;
 }
 
+/** Задалсан subject. Cert-д байхгүй талбар — undefined. Давхардсан OID-ийн эхнийх нь. */
+interface CertSubject {
+    /** 2.5.4.42 GIVENNAME. */
+    givenName?: string;
+    /** 2.5.4.4 SURNAME. */
+    surname?: string;
+    /** 2.5.4.3 CN. */
+    commonName?: string;
+    /** 2.5.4.5 SERIALNUMBER — иргэнд ETSI (`PNOMN-<иргэний дугаар>`). */
+    serialNumber?: string;
+    /** 2.5.4.6 C (ж: "MN"). */
+    country?: string;
+    /** 2.5.4.10 O. */
+    organization?: string;
+    /** 2.5.4.97 organizationIdentifier (ж: `NTRMN-…`). */
+    organizationIdentifier?: string;
+    /** Харуулах нэр: «givenName surname», эс бөгөөс commonName, эс бөгөөс null. */
+    name: string | null;
+    /** Бүх атрибут, OID → утга (эхний утга). Дээрхээс бусад OID-д. */
+    attributes: Record<string, string>;
+}
+/**
+ * Гэрчилгээний subject-ийг задална. `cert` — `X509Certificate`, DER байт, эсвэл base64 DER
+ * (session хариуны `certificateDerB64`). Гэмтсэн DER → {@link ValidationError}.
+ *
+ * (!) Энэ нь зөвхөн задлалт — гэрчилгээнд итгэх эсэхийг `ResponseValidator` шийднэ. Баталгаажаагүй
+ * гэрчилгээний нэрэнд бүү итгэ: `validateAuth`/`validateSign`-ийн `parsedSubject`-ийг ашигла.
+ */
+declare function parseSubject(cert: X509Certificate | Uint8Array | string): CertSubject;
+
 /**
  * validateAuth-ийн нэмэлт шалгалт — RP ЯМАР урсгал эхлүүлснээ мэддэг тул түүнийг тулгана
  * (device-link relay хаалт).
@@ -218,8 +261,7 @@ interface ValidateAuthOptions {
      * (verifier-тэй) ирсэн үр дүнг "Web2App"/"App2App"-аар, poll-оор ирснийг "QR"-аар шалга — товчоор
      * нээгдсэн session poll замаар OK болохгүй, callback-аар л дуусна.
      *
-     * ⚠️ Legacy `/dl?sessionId&vc` холбоосонд төрөл хамгаалагдаагүй — build 59 + `min_version=59` хүртэл
-     * энэ шалгалт relay-ээс бүрэн хамгаалахгүй.
+     * Legacy `/dl?sessionId&vc` холбоос 2026-10-07-нд серверээс хасагдсан — төрөл үргэлж authCode-оор хамгаалагдана.
      */
     expectedFlowType?: FlowType;
     /**
@@ -272,6 +314,8 @@ interface VerifiedIdentity {
     certificate: X509Certificate;
     /** Cert subject DN (түүхий). Ж: "C=MN, CN=..., SERIALNUMBER=PNOMN-...". */
     subject: string;
+    /** Subject-ийн задалсан талбарууд (нэр, ETSI `serialNumber`, улс) — {@link parseSubject}. */
+    parsedSubject: CertSubject;
     certificateLevel: string;
 }
 /** Баталгаажсан гарын үсэг (sign). */
@@ -281,6 +325,8 @@ interface VerifiedSignature {
     signatureAlgorithm: string | null;
     certificate: X509Certificate;
     subject: string;
+    /** Subject-ийн задалсан талбарууд — {@link parseSubject}. */
+    parsedSubject: CertSubject;
 }
 declare class ResponseValidator {
     private readonly anchors;
@@ -302,8 +348,17 @@ declare class ResponseValidator {
      */
     validateSign(result: SessionResult, digestB64: string, hashAlgorithm?: string): VerifiedSignature;
     /**
-     * Хариуны signatureAlgorithm + hashAlgorithm-ийг RP-ийн хүссэнтэй тулгана (downgrade хаалт).
-     * ecdsa-with-SHA256 (хуучин cert) хүссэн rsassa-pss-ийн оронд ирэхийг зөвшөөрнө — SHA-256-аар л.
+     * Хариуны signatureAlgorithm + hashAlgorithm-ийг RP-ийн хүссэнтэй ба иргэний түлхүүрийн төрөлтэй тулгана
+     * (downgrade / alg confusion хаалт).
+     *
+     * CA-ийн бодит зан (ca-eidmongolia-mn `service/memory/crypto_wired.go` `messageHash`, `domain/enums.go`):
+     * RP-API session-ий гарын үсэг хоёр замаас л гарна — SplitKey RSA (`rsassa-pss` / `shaNNNWithRSAEncryption`,
+     * hash = хүсэлтийн `hashAlgorithm`) ба legacy threshold ECDSA P-256 (ҮРГЭЛЖ `ecdsa-with-SHA256`). ECDSA credential
+     * зөвхөн 32 байт digest зурдаг: session-ий hash SHA-256 биш бол сервер гарын үсэг гаргахгүй (session OK болохгүй).
+     * Иймд:
+     *   - hash нь ҮРГЭЛЖ хүссэнтэй яг тэнцүү — `ecdsa-with-SHA256` хариу SHA-384/512 хүссэн session-д ирвэл хуурамч;
+     *   - `ecdsa-with-SHA256` нь хүссэн `rsassa-pss`-ийн оронд ирж болно (credential-ийн төрөл), ГЭХДЭЭ зөвхөн
+     *     EC P-256 түлхүүртэй гэрчилгээнд; RSA алгоритмууд зөвхөн RSA түлхүүрт (alg confusion үгүй).
      */
     private algorithmOf;
     /** state/endResult, cert байгаа эсэх, chain, validity, certLevel — нийтлэг шалгалт. */
@@ -594,4 +649,4 @@ declare class EidOidcClient {
 /** PKCE S256: `BASE64URL(SHA-256(ASCII(code_verifier)))` (RFC 7636 §4.2). */
 declare function pkceChallenge(codeVerifier: string): Promise<string>;
 
-export { AcspContext, type AcspV2Params, AuthApi, type AuthDefaults, type AuthOptions, type BuildDeviceLinkInput, CertificateLevel, type ClientConfig, type CreateAuthorizationOptions, DEFAULT_BASE_URL, DeviceLinkSession, type DeviceLinkSessionType, type DeviceLinkType, EID_ACR_ADVANCED, EID_ACR_QUALIFIED, EID_OIDC_ISSUER, type EidAuthorization, type EidCallbackChecks, type EidCallbackResult, EidClient, EidError, type EidIdTokenClaims, EidOidcClient, type EidOidcClientConfig, type EidOidcDiscovery, EidOidcError, type EidOidcErrorCode, FlowType, HashAlgorithm, Http, type HttpConfig, Interaction, NotificationSession, OrganizationApi, PdfApi, type PdfDefaults, type PdfPrepareInput, type PdfPrepareSession, type PdfSignerRef, type QrDeviceLinkTickerOptions, RepresentationsResponse, ResponseValidator, type RevocationChecker, type RevocationStatus, RpCredentials, SessionApi, SessionResult, SignApi, type SignDefaults, type SignOptions, SignatureAlgorithm, type TrustConfig, type ValidateAuthOptions, type VerifiedIdentity, type VerifiedSignature, acspV2Digest, buildAcspV2Payload, buildDeviceLink, interactionsToBase64, parseSessionResult, pkceChallenge, qrDeviceLinkTicker, randomChallenge, resolveBaseUrl, sha256Base64, userChallengeOf, verifyPayloadSignature, verifyPrehashedSignature };
+export { AcspContext, type AcspV2Params, AuthApi, type AuthDefaults, type AuthOptions, type BuildDeviceLinkInput, type CertSubject, CertificateLevel, type ClientConfig, type CreateAuthorizationOptions, DEFAULT_BASE_URL, DeviceLinkSession, type DeviceLinkSessionType, type DeviceLinkType, EID_ACR_ADVANCED, EID_ACR_QUALIFIED, EID_OIDC_ISSUER, type EidAuthorization, type EidCallbackChecks, type EidCallbackResult, EidClient, EidError, type EidIdTokenClaims, EidOidcClient, type EidOidcClientConfig, type EidOidcDiscovery, EidOidcError, type EidOidcErrorCode, FlowType, HashAlgorithm, Http, type HttpConfig, Interaction, NotificationSession, OrganizationApi, PdfApi, type PdfDefaults, type PdfPrepareInput, type PdfPrepareSession, PdfSessionBlock, type PdfSignerRef, type QrDeviceLinkTickerOptions, RepresentationsResponse, ResponseValidator, type RevocationChecker, type RevocationStatus, RpCredentials, SessionApi, SessionResult, SignApi, type SignDefaults, type SignOptions, SignatureAlgorithm, type TrustConfig, type ValidateAuthOptions, type VerifiedIdentity, type VerifiedSignature, acspV2Digest, buildAcspV2Payload, buildDeviceLink, interactionsToBase64, parseSessionResult, parseSubject, pkceChallenge, qrDeviceLinkTicker, randomChallenge, resolveBaseUrl, sha256Base64, userChallengeOf, verifyPayloadSignature, verifyPrehashedSignature };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { R as RpCredentials, C as CertificateLevel, I as Interaction, S as SignatureAlgorithm, H as HashAlgorithm, N as NotificationSession, D as DeviceLinkSession, a as SessionResult, b as RepresentationsResponse, A as AcspContext, F as FlowType, E as EidError } from './browser-Db82DlYN.js';
-export { c as ApiError, d as AuthenticationError, e as DeviceLinkError, f as DeviceLinkInput, g as EndResult, h as ForbiddenError, i as NavigatorLike, j as NetworkError, O as ON_BEHALF_ERROR_CODES, k as OnBehalfErrorCode, l as OpenOrShowQROptions, m as OrgResult, P as PdfDocumentStatus, n as PdfSessionBlock, o as PdfSigner, p as Representation, q as SessionFailedError, r as SessionState, s as SignatureAlgorithmParameters, t as SignatureProtocol, V as ValidationError, u as deviceLink, v as isMobileUserAgent, w as openOrShowQR } from './browser-Db82DlYN.js';
+import { R as RpCredentials, C as CertificateLevel, I as Interaction, S as SignatureAlgorithm, H as HashAlgorithm, N as NotificationSession, D as DeviceLinkSession, a as SessionResult, P as PdfSessionBlock, b as RepresentationsResponse, A as AcspContext, F as FlowType, E as EidError } from './browser-B_XtyuFG.js';
+export { c as ApiError, d as AuthenticationError, e as DeviceLinkError, f as DeviceLinkInput, g as EndResult, h as ForbiddenError, i as NavigatorLike, j as NetworkError, O as ON_BEHALF_ERROR_CODES, k as OnBehalfErrorCode, l as OpenOrShowQROptions, m as OrgResult, n as PdfDocumentStatus, o as PdfSigner, p as Representation, q as SessionFailedError, r as SessionState, s as SignatureAlgorithmParameters, t as SignatureProtocol, V as ValidationError, u as deviceLink, v as isMobileUserAgent, w as openOrShowQR } from './browser-B_XtyuFG.js';
 import { X509Certificate, KeyObject } from 'node:crypto';
 
 interface HttpConfig {
@@ -172,6 +172,12 @@ interface PdfPrepareSession {
     docId: string;
     /** Иргэнд ХАРУУЛАХ баталгаажуулах код (ПИН биш). */
     vc: string | null;
+    /**
+     * Иргэний зурах DTBS (base64, SHA-256 = 32 байт) — урсгалаас үл хамааран. Хариуны гарын үсгийг өөрөө шалгахад:
+     * `validator.validateSign(result, digest)`. Хуучин CA push хариунд талбаргүй → undefined (device-link-д
+     * `deviceLink.digest`-ээс).
+     */
+    digest?: string;
     deviceLink: {
         sessionToken: string;
         sessionSecret: string;
@@ -194,6 +200,13 @@ declare class PdfApi {
      * session-ий `pdf.outSha256`-тай тулга. Эрх хасагдсан бол `ForbiddenError` `.code = "REPRESENTATION_REVOKED"`.
      */
     document(sessionId: string): Promise<Uint8Array>;
+    /**
+     * {@link document} + тулгалт: татсан байтын SHA-256 нь session poll-ийн `pdf.outSha256`-тай тэнцүү байх ёстой.
+     * `expected` — poll-ийн `result.pdf` блок (`documentStatus` READY + `outSha256` заавал) эсвэл SHA-256 hex.
+     *
+     * @throws {ValidationError} блок READY биш / `outSha256` алга / hash таарахгүй (файлд бүү итгэ).
+     */
+    documentVerified(sessionId: string, expected: PdfSessionBlock | string): Promise<Uint8Array>;
 }
 
 declare class OrganizationApi {
@@ -203,6 +216,36 @@ declare class OrganizationApi {
     getRepresentations(personEtsi: string): Promise<RepresentationsResponse>;
 }
 
+/** Задалсан subject. Cert-д байхгүй талбар — undefined. Давхардсан OID-ийн эхнийх нь. */
+interface CertSubject {
+    /** 2.5.4.42 GIVENNAME. */
+    givenName?: string;
+    /** 2.5.4.4 SURNAME. */
+    surname?: string;
+    /** 2.5.4.3 CN. */
+    commonName?: string;
+    /** 2.5.4.5 SERIALNUMBER — иргэнд ETSI (`PNOMN-<иргэний дугаар>`). */
+    serialNumber?: string;
+    /** 2.5.4.6 C (ж: "MN"). */
+    country?: string;
+    /** 2.5.4.10 O. */
+    organization?: string;
+    /** 2.5.4.97 organizationIdentifier (ж: `NTRMN-…`). */
+    organizationIdentifier?: string;
+    /** Харуулах нэр: «givenName surname», эс бөгөөс commonName, эс бөгөөс null. */
+    name: string | null;
+    /** Бүх атрибут, OID → утга (эхний утга). Дээрхээс бусад OID-д. */
+    attributes: Record<string, string>;
+}
+/**
+ * Гэрчилгээний subject-ийг задална. `cert` — `X509Certificate`, DER байт, эсвэл base64 DER
+ * (session хариуны `certificateDerB64`). Гэмтсэн DER → {@link ValidationError}.
+ *
+ * (!) Энэ нь зөвхөн задлалт — гэрчилгээнд итгэх эсэхийг `ResponseValidator` шийднэ. Баталгаажаагүй
+ * гэрчилгээний нэрэнд бүү итгэ: `validateAuth`/`validateSign`-ийн `parsedSubject`-ийг ашигла.
+ */
+declare function parseSubject(cert: X509Certificate | Uint8Array | string): CertSubject;
+
 /**
  * validateAuth-ийн нэмэлт шалгалт — RP ЯМАР урсгал эхлүүлснээ мэддэг тул түүнийг тулгана
  * (device-link relay хаалт).
@@ -218,8 +261,7 @@ interface ValidateAuthOptions {
      * (verifier-тэй) ирсэн үр дүнг "Web2App"/"App2App"-аар, poll-оор ирснийг "QR"-аар шалга — товчоор
      * нээгдсэн session poll замаар OK болохгүй, callback-аар л дуусна.
      *
-     * ⚠️ Legacy `/dl?sessionId&vc` холбоосонд төрөл хамгаалагдаагүй — build 59 + `min_version=59` хүртэл
-     * энэ шалгалт relay-ээс бүрэн хамгаалахгүй.
+     * Legacy `/dl?sessionId&vc` холбоос 2026-10-07-нд серверээс хасагдсан — төрөл үргэлж authCode-оор хамгаалагдана.
      */
     expectedFlowType?: FlowType;
     /**
@@ -272,6 +314,8 @@ interface VerifiedIdentity {
     certificate: X509Certificate;
     /** Cert subject DN (түүхий). Ж: "C=MN, CN=..., SERIALNUMBER=PNOMN-...". */
     subject: string;
+    /** Subject-ийн задалсан талбарууд (нэр, ETSI `serialNumber`, улс) — {@link parseSubject}. */
+    parsedSubject: CertSubject;
     certificateLevel: string;
 }
 /** Баталгаажсан гарын үсэг (sign). */
@@ -281,6 +325,8 @@ interface VerifiedSignature {
     signatureAlgorithm: string | null;
     certificate: X509Certificate;
     subject: string;
+    /** Subject-ийн задалсан талбарууд — {@link parseSubject}. */
+    parsedSubject: CertSubject;
 }
 declare class ResponseValidator {
     private readonly anchors;
@@ -302,8 +348,17 @@ declare class ResponseValidator {
      */
     validateSign(result: SessionResult, digestB64: string, hashAlgorithm?: string): VerifiedSignature;
     /**
-     * Хариуны signatureAlgorithm + hashAlgorithm-ийг RP-ийн хүссэнтэй тулгана (downgrade хаалт).
-     * ecdsa-with-SHA256 (хуучин cert) хүссэн rsassa-pss-ийн оронд ирэхийг зөвшөөрнө — SHA-256-аар л.
+     * Хариуны signatureAlgorithm + hashAlgorithm-ийг RP-ийн хүссэнтэй ба иргэний түлхүүрийн төрөлтэй тулгана
+     * (downgrade / alg confusion хаалт).
+     *
+     * CA-ийн бодит зан (ca-eidmongolia-mn `service/memory/crypto_wired.go` `messageHash`, `domain/enums.go`):
+     * RP-API session-ий гарын үсэг хоёр замаас л гарна — SplitKey RSA (`rsassa-pss` / `shaNNNWithRSAEncryption`,
+     * hash = хүсэлтийн `hashAlgorithm`) ба legacy threshold ECDSA P-256 (ҮРГЭЛЖ `ecdsa-with-SHA256`). ECDSA credential
+     * зөвхөн 32 байт digest зурдаг: session-ий hash SHA-256 биш бол сервер гарын үсэг гаргахгүй (session OK болохгүй).
+     * Иймд:
+     *   - hash нь ҮРГЭЛЖ хүссэнтэй яг тэнцүү — `ecdsa-with-SHA256` хариу SHA-384/512 хүссэн session-д ирвэл хуурамч;
+     *   - `ecdsa-with-SHA256` нь хүссэн `rsassa-pss`-ийн оронд ирж болно (credential-ийн төрөл), ГЭХДЭЭ зөвхөн
+     *     EC P-256 түлхүүртэй гэрчилгээнд; RSA алгоритмууд зөвхөн RSA түлхүүрт (alg confusion үгүй).
      */
     private algorithmOf;
     /** state/endResult, cert байгаа эсэх, chain, validity, certLevel — нийтлэг шалгалт. */
@@ -594,4 +649,4 @@ declare class EidOidcClient {
 /** PKCE S256: `BASE64URL(SHA-256(ASCII(code_verifier)))` (RFC 7636 §4.2). */
 declare function pkceChallenge(codeVerifier: string): Promise<string>;
 
-export { AcspContext, type AcspV2Params, AuthApi, type AuthDefaults, type AuthOptions, type BuildDeviceLinkInput, CertificateLevel, type ClientConfig, type CreateAuthorizationOptions, DEFAULT_BASE_URL, DeviceLinkSession, type DeviceLinkSessionType, type DeviceLinkType, EID_ACR_ADVANCED, EID_ACR_QUALIFIED, EID_OIDC_ISSUER, type EidAuthorization, type EidCallbackChecks, type EidCallbackResult, EidClient, EidError, type EidIdTokenClaims, EidOidcClient, type EidOidcClientConfig, type EidOidcDiscovery, EidOidcError, type EidOidcErrorCode, FlowType, HashAlgorithm, Http, type HttpConfig, Interaction, NotificationSession, OrganizationApi, PdfApi, type PdfDefaults, type PdfPrepareInput, type PdfPrepareSession, type PdfSignerRef, type QrDeviceLinkTickerOptions, RepresentationsResponse, ResponseValidator, type RevocationChecker, type RevocationStatus, RpCredentials, SessionApi, SessionResult, SignApi, type SignDefaults, type SignOptions, SignatureAlgorithm, type TrustConfig, type ValidateAuthOptions, type VerifiedIdentity, type VerifiedSignature, acspV2Digest, buildAcspV2Payload, buildDeviceLink, interactionsToBase64, parseSessionResult, pkceChallenge, qrDeviceLinkTicker, randomChallenge, resolveBaseUrl, sha256Base64, userChallengeOf, verifyPayloadSignature, verifyPrehashedSignature };
+export { AcspContext, type AcspV2Params, AuthApi, type AuthDefaults, type AuthOptions, type BuildDeviceLinkInput, type CertSubject, CertificateLevel, type ClientConfig, type CreateAuthorizationOptions, DEFAULT_BASE_URL, DeviceLinkSession, type DeviceLinkSessionType, type DeviceLinkType, EID_ACR_ADVANCED, EID_ACR_QUALIFIED, EID_OIDC_ISSUER, type EidAuthorization, type EidCallbackChecks, type EidCallbackResult, EidClient, EidError, type EidIdTokenClaims, EidOidcClient, type EidOidcClientConfig, type EidOidcDiscovery, EidOidcError, type EidOidcErrorCode, FlowType, HashAlgorithm, Http, type HttpConfig, Interaction, NotificationSession, OrganizationApi, PdfApi, type PdfDefaults, type PdfPrepareInput, type PdfPrepareSession, PdfSessionBlock, type PdfSignerRef, type QrDeviceLinkTickerOptions, RepresentationsResponse, ResponseValidator, type RevocationChecker, type RevocationStatus, RpCredentials, SessionApi, SessionResult, SignApi, type SignDefaults, type SignOptions, SignatureAlgorithm, type TrustConfig, type ValidateAuthOptions, type VerifiedIdentity, type VerifiedSignature, acspV2Digest, buildAcspV2Payload, buildDeviceLink, interactionsToBase64, parseSessionResult, parseSubject, pkceChallenge, qrDeviceLinkTicker, randomChallenge, resolveBaseUrl, sha256Base64, userChallengeOf, verifyPayloadSignature, verifyPrehashedSignature };

package/dist/index.js

@@ -381,6 +381,7 @@ var SessionApi = class {
 };
 
 // src/pdf.ts
+import { createHash as createHash2 } from "crypto";
 function rec3(v) {
   return v && typeof v === "object" ? v : {};
 }
@@ -413,10 +414,12 @@ var PdfApi = class {
     const receivedAt = Date.now();
     const vc = rec3(r.vc).value;
     const dl = rec3(r.deviceLink);
+    const digest = typeof r.digest === "string" && r.digest ? r.digest : typeof dl.digest === "string" && dl.digest ? dl.digest : void 0;
     return {
       sessionId: String(r.sessionID),
       docId: String(r.docID),
       vc: vc != null ? String(vc) : null,
+      ...digest !== void 0 ? { digest } : {},
       deviceLink: dl.sessionToken ? {
         sessionToken: String(dl.sessionToken),
         sessionSecret: String(dl.sessionSecret),
@@ -434,6 +437,26 @@ var PdfApi = class {
   document(sessionId) {
     return this.http.getBytes(`/pdf/sign/${encodeURIComponent(sessionId)}/document`, 6e4);
   }
+  /**
+   * {@link document} + тулгалт: татсан байтын SHA-256 нь session poll-ийн `pdf.outSha256`-тай тэнцүү байх ёстой.
+   * `expected` — poll-ийн `result.pdf` блок (`documentStatus` READY + `outSha256` заавал) эсвэл SHA-256 hex.
+   *
+   * @throws {ValidationError} блок READY биш / `outSha256` алга / hash таарахгүй (файлд бүү итгэ).
+   */
+  async documentVerified(sessionId, expected) {
+    let want;
+    if (typeof expected === "string") {
+      want = expected;
+    } else {
+      if (expected.documentStatus !== "READY") throw new ValidationError(`pdf.documentStatus ${expected.documentStatus} \u2260 READY`);
+      want = expected.outSha256;
+    }
+    if (!want || !/^[0-9a-fA-F]{64}$/.test(want)) throw new ValidationError("pdf.outSha256 \u0430\u043B\u0433\u0430 \u044D\u0441\u0432\u044D\u043B SHA-256 hex \u0431\u0438\u0448");
+    const bytes = await this.document(sessionId);
+    const got = createHash2("sha256").update(bytes).digest("hex");
+    if (got !== want.toLowerCase()) throw new ValidationError("\u0422\u0430\u0442\u0441\u0430\u043D PDF-\u0438\u0439\u043D SHA-256 \u043D\u044C pdf.outSha256-\u0442\u0430\u0439 \u0442\u0430\u0430\u0440\u0441\u0430\u043D\u0433\u04AF\u0439");
+    return bytes;
+  }
 };
 
 // src/organization.ts
@@ -451,7 +474,114 @@ var OrganizationApi = class {
 };
 
 // src/validator.ts
-import { X509Certificate, constants, createHash as createHash2, publicDecrypt, verify } from "crypto";
+import { X509Certificate as X509Certificate2, constants, createHash as createHash3, publicDecrypt, verify } from "crypto";
+
+// src/subject.ts
+import { X509Certificate } from "crypto";
+var OIDS = {
+  "2.5.4.42": "givenName",
+  "2.5.4.4": "surname",
+  "2.5.4.3": "commonName",
+  "2.5.4.5": "serialNumber",
+  "2.5.4.6": "country",
+  "2.5.4.10": "organization",
+  "2.5.4.97": "organizationIdentifier"
+};
+function tlv(buf, pos, limit) {
+  if (pos + 2 > limit) throw new ValidationError("subject: DER \u0442\u043E\u043B\u0433\u043E\u0439 \u0431\u043E\u0433\u0438\u043D\u043E");
+  const tag = buf[pos];
+  if ((tag & 31) === 31) throw new ValidationError("subject: \u043E\u043B\u043E\u043D \u0431\u0430\u0439\u0442 tag \u0434\u044D\u043C\u0436\u0438\u0433\u0434\u044D\u044D\u0433\u04AF\u0439");
+  let len = buf[pos + 1];
+  let i = pos + 2;
+  if (len & 128) {
+    const n = len & 127;
+    if (n === 0 || n > 3) throw new ValidationError("subject: DER \u0443\u0440\u0442 \u0431\u0443\u0440\u0443\u0443");
+    if (i + n > limit) throw new ValidationError("subject: DER \u0443\u0440\u0442 \u0431\u043E\u0433\u0438\u043D\u043E");
+    len = 0;
+    for (let k = 0; k < n; k++) len = len * 256 + buf[i++];
+  }
+  if (i + len > limit) throw new ValidationError("subject: DER \u0430\u0433\u0443\u0443\u043B\u0433\u0430 \u0445\u0438\u043B\u044D\u044D\u0441 \u0433\u0430\u0440\u043D\u0430");
+  return { tag, start: i, end: i + len };
+}
+function oidOf(buf, t) {
+  if (t.tag !== 6 || t.end === t.start) throw new ValidationError("subject: OID \u0431\u0438\u0448");
+  const parts = [];
+  let v = 0;
+  for (let i = t.start; i < t.end; i++) {
+    const b = buf[i];
+    v = v * 128 + (b & 127);
+    if (!(b & 128)) {
+      if (parts.length === 0) parts.push(v < 80 ? Math.floor(v / 40) : 2, v < 80 ? v % 40 : v - 80);
+      else parts.push(v);
+      v = 0;
+    }
+  }
+  return parts.join(".");
+}
+function stringOf(buf, t) {
+  const bytes = buf.subarray(t.start, t.end);
+  switch (t.tag) {
+    case 12:
+      try {
+        return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+      } catch {
+        throw new ValidationError("subject: UTF8String \u0431\u0443\u0440\u0443\u0443 UTF-8");
+      }
+    case 19:
+    // PrintableString
+    case 22:
+    // IA5String
+    case 20:
+      return Buffer.from(bytes).toString("latin1");
+    case 30: {
+      if (bytes.length % 2) throw new ValidationError("subject: BMPString \u0443\u0440\u0442 \u0441\u043E\u043D\u0434\u0433\u043E\u0439");
+      return Buffer.from(bytes).swap16().toString("utf16le");
+    }
+    default:
+      return void 0;
+  }
+}
+function parseSubject(cert) {
+  const der = cert instanceof X509Certificate ? new Uint8Array(cert.raw) : typeof cert === "string" ? new Uint8Array(Buffer.from(cert, "base64")) : cert;
+  const top = tlv(der, 0, der.length);
+  if (top.tag !== 48) throw new ValidationError("subject: Certificate SEQUENCE \u0431\u0438\u0448");
+  const tbs = tlv(der, top.start, top.end);
+  if (tbs.tag !== 48) throw new ValidationError("subject: tbsCertificate SEQUENCE \u0431\u0438\u0448");
+  let pos = tbs.start;
+  let first = tlv(der, pos, tbs.end);
+  if (first.tag === 160) {
+    pos = first.end;
+    first = tlv(der, pos, tbs.end);
+  }
+  let field = first;
+  for (let k = 0; k < 4; k++) field = tlv(der, field.end, tbs.end);
+  if (field.tag !== 48) throw new ValidationError("subject: Name SEQUENCE \u0431\u0438\u0448");
+  const out = { name: null, attributes: {} };
+  for (let sp = field.start; sp < field.end; ) {
+    const rdn = tlv(der, sp, field.end);
+    if (rdn.tag !== 49) throw new ValidationError("subject: RDN SET \u0431\u0438\u0448");
+    for (let ap = rdn.start; ap < rdn.end; ) {
+      const atv = tlv(der, ap, rdn.end);
+      if (atv.tag !== 48) throw new ValidationError("subject: AttributeTypeAndValue SEQUENCE \u0431\u0438\u0448");
+      const oidT = tlv(der, atv.start, atv.end);
+      const valT = tlv(der, oidT.end, atv.end);
+      const oid = oidOf(der, oidT);
+      const value = stringOf(der, valT);
+      if (value !== void 0 && !(oid in out.attributes)) {
+        out.attributes[oid] = value;
+        const key = OIDS[oid];
+        if (key) out[key] = value;
+      }
+      ap = atv.end;
+    }
+    sp = rdn.end;
+  }
+  const full = [out.givenName, out.surname].filter((s) => s).join(" ");
+  out.name = full || out.commonName || null;
+  return out;
+}
+
+// src/validator.ts
 var ResponseValidator = class {
   anchors;
   intermediates;
@@ -461,8 +591,8 @@ var ResponseValidator = class {
   revocation;
   revocationMode;
   constructor(trust = {}) {
-    this.anchors = (trust.trustAnchorsPem ?? []).map((p) => new X509Certificate(p));
-    this.intermediates = (trust.intermediatesPem ?? []).map((p) => new X509Certificate(p));
+    this.anchors = (trust.trustAnchorsPem ?? []).map((p) => new X509Certificate2(p));
+    this.intermediates = (trust.intermediatesPem ?? []).map((p) => new X509Certificate2(p));
     this.requiredLevel = trust.requiredLevel ?? "QUALIFIED";
     this.skew = trust.clockSkewMs ?? 0;
     this.allowUntrusted = trust.allowUntrusted ?? false;
@@ -493,7 +623,7 @@ var ResponseValidator = class {
       throw new ValidationError("userChallengeVerifier \u043D\u044C \u0433\u0430\u0440\u044B\u043D \u04AF\u0441\u044D\u0433 \u0437\u0443\u0440\u0430\u0433\u0434\u0441\u0430\u043D userChallenge-\u0442\u044D\u0439 \u0442\u0430\u0430\u0440\u0441\u0430\u043D\u0433\u04AF\u0439");
     }
     if (!interactionTypeUsed) throw new ValidationError("interactionTypeUsed \u0430\u043B\u0433\u0430");
-    const { alg, hash } = this.algorithmOf(result, acsp.signatureAlgorithm, acsp.hashAlgorithm);
+    const { alg, hash } = this.algorithmOf(result, leaf, acsp.signatureAlgorithm, acsp.hashAlgorithm);
     const payload = buildAcspV2Payload({
       serverRandom,
       rpChallenge: acsp.rpChallenge,
@@ -512,6 +642,7 @@ var ResponseValidator = class {
       documentNumber: result.documentNumber,
       certificate: leaf,
       subject: leaf.subject,
+      parsedSubject: parseSubject(leaf),
       certificateLevel: String(result.certificateLevel ?? "")
     };
   }
@@ -522,7 +653,7 @@ var ResponseValidator = class {
   validateSign(result, digestB64, hashAlgorithm = "SHA-256") {
     const leaf = this.precheck(result, "RAW_DIGEST_SIGNATURE");
     const digest = Buffer.from(digestB64, "base64");
-    const { alg, hash } = this.algorithmOf(result, null, hashAlgorithm);
+    const { alg, hash } = this.algorithmOf(result, leaf, null, hashAlgorithm);
     if (digest.length !== hashLen(hash)) throw new ValidationError("digest \u0443\u0440\u0442 hashAlgorithm-\u0442\u0430\u0439 \u0442\u0430\u0430\u0440\u0430\u0445\u0433\u04AF\u0439");
     if (!verifyPrehashedSignature(digest, result.signatureValueB64, leaf.publicKey, alg, hash)) {
       throw new ValidationError("\u0413\u0430\u0440\u044B\u043D \u04AF\u0441\u044D\u0433 \u04E9\u0433\u0441\u04E9\u043D digest-\u0442\u044D\u0439 \u0442\u0430\u0430\u0440\u0441\u0430\u043D\u0433\u04AF\u0439");
@@ -532,27 +663,47 @@ var ResponseValidator = class {
       signatureValueB64: result.signatureValueB64,
       signatureAlgorithm: result.signatureAlgorithm,
       certificate: leaf,
-      subject: leaf.subject
+      subject: leaf.subject,
+      parsedSubject: parseSubject(leaf)
     };
   }
   /**
-   * Хариуны signatureAlgorithm + hashAlgorithm-ийг RP-ийн хүссэнтэй тулгана (downgrade хаалт).
-   * ecdsa-with-SHA256 (хуучин cert) хүссэн rsassa-pss-ийн оронд ирэхийг зөвшөөрнө — SHA-256-аар л.
+   * Хариуны signatureAlgorithm + hashAlgorithm-ийг RP-ийн хүссэнтэй ба иргэний түлхүүрийн төрөлтэй тулгана
+   * (downgrade / alg confusion хаалт).
+   *
+   * CA-ийн бодит зан (ca-eidmongolia-mn `service/memory/crypto_wired.go` `messageHash`, `domain/enums.go`):
+   * RP-API session-ий гарын үсэг хоёр замаас л гарна — SplitKey RSA (`rsassa-pss` / `shaNNNWithRSAEncryption`,
+   * hash = хүсэлтийн `hashAlgorithm`) ба legacy threshold ECDSA P-256 (ҮРГЭЛЖ `ecdsa-with-SHA256`). ECDSA credential
+   * зөвхөн 32 байт digest зурдаг: session-ий hash SHA-256 биш бол сервер гарын үсэг гаргахгүй (session OK болохгүй).
+   * Иймд:
+   *   - hash нь ҮРГЭЛЖ хүссэнтэй яг тэнцүү — `ecdsa-with-SHA256` хариу SHA-384/512 хүссэн session-д ирвэл хуурамч;
+   *   - `ecdsa-with-SHA256` нь хүссэн `rsassa-pss`-ийн оронд ирж болно (credential-ийн төрөл), ГЭХДЭЭ зөвхөн
+   *     EC P-256 түлхүүртэй гэрчилгээнд; RSA алгоритмууд зөвхөн RSA түлхүүрт (alg confusion үгүй).
    */
-  algorithmOf(result, wantAlg, wantHash) {
+  algorithmOf(result, leaf, wantAlg, wantHash) {
     const alg = result.signatureAlgorithm ?? "";
+    const keyType = leaf.publicKey.asymmetricKeyType;
     let hash;
     if (alg === "rsassa-pss") {
       hash = String(result.signatureAlgorithmParameters?.hashAlgorithm ?? "");
+      if (!HASHES.has(hash)) throw new ValidationError(`\u0414\u044D\u043C\u0436\u0438\u0433\u0434\u044D\u044D\u0433\u04AF\u0439 hashAlgorithm: ${hash}`);
       const mgf = result.signatureAlgorithmParameters?.maskGenAlgorithm?.parameters?.hashAlgorithm;
       if (mgf && mgf !== hash) throw new ValidationError("MGF1 hash \u043D\u044C hashAlgorithm-\u0430\u0430\u0441 \u04E9\u04E9\u0440");
       if (result.signatureAlgorithmParameters?.saltLength != null && result.signatureAlgorithmParameters.saltLength !== hashLen(hash)) {
         throw new ValidationError("saltLength \u2260 hLen");
       }
+      if (keyType !== "rsa" && keyType !== "rsa-pss") throw new ValidationError(`${alg} \u043D\u044C ${keyType} \u0442\u04AF\u043B\u0445\u04AF\u04AF\u0440\u0442\u044D\u0439 \u0442\u0430\u0430\u0440\u0430\u0445\u0433\u04AF\u0439`);
     } else if (/^sha(256|384|512)WithRSAEncryption$/.test(alg)) {
       hash = "SHA-" + alg.slice(3, 6);
+      if (keyType !== "rsa") throw new ValidationError(`${alg} \u043D\u044C ${keyType} \u0442\u04AF\u043B\u0445\u04AF\u04AF\u0440\u0442\u044D\u0439 \u0442\u0430\u0430\u0440\u0430\u0445\u0433\u04AF\u0439`);
     } else if (alg === "ecdsa-with-SHA256") {
       hash = "SHA-256";
+      if (keyType !== "ec" || leaf.publicKey.asymmetricKeyDetails?.namedCurve !== "prime256v1") {
+        throw new ValidationError(`${alg} \u043D\u044C EC P-256 \u0431\u0443\u0441 \u0442\u04AF\u043B\u0445\u04AF\u04AF\u0440\u0442\u044D\u0439 \u0442\u0430\u0430\u0440\u0430\u0445\u0433\u04AF\u0439`);
+      }
+      if (wantHash !== hash) {
+        throw new ValidationError(`ecdsa-with-SHA256 \u0445\u0430\u0440\u0438\u0443 ${wantHash} \u0445\u04AF\u0441\u0441\u044D\u043D session-\u0434 \u0431\u043E\u043B\u043E\u043C\u0436\u0433\u04AF\u0439 (ECDSA credential \u0437\u04E9\u0432\u0445\u04E9\u043D SHA-256)`);
+      }
     } else {
       throw new ValidationError(`\u0414\u044D\u043C\u0436\u0438\u0433\u0434\u044D\u044D\u0433\u04AF\u0439 signatureAlgorithm: ${alg}`);
     }
@@ -573,7 +724,7 @@ var ResponseValidator = class {
     if (!result.certificateDerB64) throw new ValidationError("\u0425\u0430\u0440\u0438\u0443\u043D\u0434 \u0433\u044D\u0440\u0447\u0438\u043B\u0433\u044D\u044D \u0430\u043B\u0433\u0430");
     if (!result.signatureValueB64) throw new ValidationError("\u0425\u0430\u0440\u0438\u0443\u043D\u0434 \u0433\u0430\u0440\u044B\u043D \u04AF\u0441\u044D\u0433 \u0430\u043B\u0433\u0430");
     if (!result.documentNumber) throw new ValidationError("\u0425\u0430\u0440\u0438\u0443\u043D\u0434 documentNumber \u0430\u043B\u0433\u0430");
-    const leaf = new X509Certificate(Buffer.from(result.certificateDerB64, "base64"));
+    const leaf = new X509Certificate2(Buffer.from(result.certificateDerB64, "base64"));
     this.checkValidity(leaf);
     this.checkLevel(String(result.certificateLevel ?? ""));
     if (this.anchors.length === 0) {
@@ -651,7 +802,7 @@ function signedCallbackUrl(fromResponse, rpCallback, flowType) {
   return fromResponse;
 }
 function userChallengeOf(verifier) {
-  return createHash2("sha256").update(verifier, "utf8").digest("base64url");
+  return createHash3("sha256").update(verifier, "utf8").digest("base64url");
 }
 function verifyPayloadSignature(payload, sigB64, key, alg, hash) {
   const sig = Buffer.from(sigB64, "base64");
@@ -742,6 +893,7 @@ function ecdsaP256VerifyPrehashed(digest, sig, key) {
   const R = ptAdd(ptMul(mod(z * w, n), [P256.gx, P256.gy]), ptMul(mod(r * w, n), Q));
   return R !== null && mod(R[0], n) === r;
 }
+var HASHES = /* @__PURE__ */ new Set(["SHA-256", "SHA-384", "SHA-512"]);
 var DIGEST_INFO = {
   "SHA-256": Buffer.from("3031300d060960864801650304020105000420", "hex"),
   "SHA-384": Buffer.from("3041300d060960864801650304020205000430", "hex"),
@@ -752,7 +904,7 @@ function mgf1(hash, seed, length) {
   for (let i = 0, n = 0; n < length; i++, n += hashLen(hash)) {
     const c = Buffer.alloc(4);
     c.writeUInt32BE(i, 0);
-    out.push(createHash2(nodeHash(hash)).update(seed).update(c).digest());
+    out.push(createHash3(nodeHash(hash)).update(seed).update(c).digest());
   }
   return Buffer.concat(out).subarray(0, length);
 }
@@ -776,7 +928,7 @@ function emsaPssVerify(mHash, em, emBits, hash) {
   const psLen = emLen - hLen - sLen - 2;
   if (!db.subarray(0, psLen).every((b) => b === 0) || db[psLen] !== 1) return false;
   const salt = db.subarray(psLen + 1);
-  const h2 = createHash2(nodeHash(hash)).update(Buffer.alloc(8)).update(mHash).update(salt).digest();
+  const h2 = createHash3(nodeHash(hash)).update(Buffer.alloc(8)).update(mHash).update(salt).digest();
   return h.equals(h2);
 }
 function isCa(cert) {
@@ -1206,6 +1358,7 @@ export {
   isMobileUserAgent,
   openOrShowQR,
   parseSessionResult,
+  parseSubject,
   pkceChallenge,
   qrDeviceLinkTicker,
   randomChallenge,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gerege-systems/eid-mongolia-sdk",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "e-ID Mongolia Relying Party SDK — иргэнээр утсаар нь нэвтрэлт ба хууль ёсны цахим гарын үсэг (RP-API v3, Smart-ID нийцтэй).",
   "license": "MIT",
   "type": "module",