@gerege-systems/eid-mongolia-sdk 0.8.1 → 0.9.0

package/README.md

@@ -151,8 +151,19 @@ const result = await eid.session.waitForResult(s.sessionId); // long-poll
 const who = eid.validator.validateAuth(result, s.acsp); // ← гинж + ACSP_V2 крипто-баталгаажуулна
 
 console.log(who.documentNumber, who.subject); // баталгаажсан иргэн
+const { name, serialNumber } = who.parsedSubject; // "Болд Бат", "PNOMN-12345678" (givenName/surname/commonName/country…)
 ```
 
+Subject-ийн талбарууд (`parsedSubject`, `validateSign`-д ч мөн) нь `parseSubject(cert)`-ээс — OID 2.5.4.42/4/3/5/6/10/97,
+UTF8String/PrintableString/BMPString. `parseSubject` нь зөвхөн задлалт: баталгаажаагүй гэрчилгээний нэрэнд бүү итгэ.
+
+> **Ижил утсан дээр push хэрэглэхгүй.** Push (`notificationBy*`)-ийн хүсэлт eID аппад мэдэгдэл / «хүлээгдэж буй»
+> жагсаалтаар ирдэг; Smart-ID ба eID-д Notification төрлийн device link **байхгүй** (CA `docs/DEVICE_LINK_V3.md` §3).
+> Хуучин `/dl?sessionId&vc` холбоос (`deviceLink`) push session-д ч юу ч өгөхгүй (сервер `DEVICE_LINK_REQUIRED`).
+> Иргэн RP-ийг eID апптай ижил утсан дээр нээсэн бол push-ийн оронд **device-link Web2App** урсгал хэрэглэ
+> (`auth.deviceLink*` / `pdf.prepare({ flow: "device-link" })` + `buildDeviceLink(…, "Web2App")`, §4) — товч аппыг шууд
+> нээж, callback-аар буцна. Push-д «eID аппаа нээнэ үү» гэсэн текст л хангалттай.
+
 ## 3. Гарын үсэг (qualified signature)
 
 ```ts
@@ -198,7 +209,7 @@ try {
   // MUST: endResult OK, pdf.documentStatus READY, pdf.signer.onBehalfOf = хүссэн байгууллага,
   // татсан файлын SHA-256 = pdf.outSha256, validation.indication "valid", ltv true.
   if (r.pdf?.documentStatus !== "READY" || r.pdf.signer?.onBehalfOf !== "NTRMN-6235972") throw new Error("…");
-  const signed = await eid.pdf.document(s.sessionId);
+  const signed = await eid.pdf.documentVerified(s.sessionId, r.pdf); // SHA-256 ≠ pdf.outSha256 → ValidationError
   console.log(r.pdf.signer.claimedRole); // "Гүйцэтгэх захирал, Гэрэгэ Системс ХХК (NTRMN-6235972)"
 } catch (e) {
   if ((e instanceof ForbiddenError || e instanceof ApiError) && e.code) {
@@ -212,6 +223,10 @@ try {
 // — CMS/PDF-ийг та угсардаг тул мэдүүлсэн үүргийг (signer-attributes-v2) өөрөө нэмнэ.
 ```
 
+`prepare`-ийн хариу `digest` (DTBS, base64) — иргэний зурах 32 байт, push ба device-link хоёуланд (хуучин CA push-д
+`undefined`). Иргэний гарын үсгийг өөрөө шалгах бол: `eid.validator.validateSign(r, s.digest!)`. Гарын үсэгтэй PDF-ийг
+`pdf.document()`-ийн оронд `pdf.documentVerified(sessionId, r.pdf)`-аар тат — `READY` + `outSha256` тулгалтыг хийнэ.
+
 Олон талт гэрээ: А байгууллагын гаралтыг өөрчлөлтгүй Б-ийн `prepare`-д (`docID`, өөр `onBehalfOf`) илгээнэ.
 Session-ий `onBehalfOf` блок (`role`/`rightType`) нь хариу угсрах үеийн бүртгэл; `pdf.signer.onBehalfOf`/`claimedRole`
 нь баримтад бичигдсэн утга.
@@ -313,6 +328,11 @@ OK ирж болзошгүй. Иймд `ResponseValidator`:
      `""`, Web2App/App2App → таны callback) — зөвхөн `""` эсвэл
      таны илгээсэн callback байхад, Web2App/App2App-д заавал таны callback; өөр утга → татгалзана
    - **sign** → RP-ийн өгсөн digest дээр
+   - алгоритм нь гэрчилгээний түлхүүртэй уях: `ecdsa-with-SHA256` зөвхөн EC P-256 түлхүүрт, RSA алгоритмууд зөвхөн
+     RSA түлхүүрт (alg confusion хаалт). Hash нь үргэлж хүссэнтэй ЯГ тэнцүү. RP-API session-ий гарын үсэг CA дээр
+     SplitKey RSA (одоогийн бүх мобайл гэрчилгээ) эсвэл legacy threshold ECDSA P-256-аас гарна; ECDSA credential
+     зөвхөн SHA-256 digest зурдаг (өөр hash хүссэн session-д сервер гарын үсэг гаргахгүй), тиймээс SHA-384/512
+     хүссэн session-д `ecdsa-with-SHA256` хариу ирвэл хуурамч гэж татгалзана.
 
 Аль нэг алхам бүтэлгүйтвэл `ValidationError` шиднэ — хариунд **итгэхгүй**.
 

package/dist/{browser-DqKDj2nB.d.cts → browser-B_XtyuFG.d.cts}

@@ -318,4 +318,4 @@ declare class ValidationError extends EidError {
 declare class DeviceLinkError extends EidError {
 }
 
-export { type AcspContext as A, type CertificateLevel as C, type DeviceLinkSession as D, EidError as E, type FlowType as F, type HashAlgorithm as H, type Interaction as I, type NotificationSession as N, ON_BEHALF_ERROR_CODES as O, type PdfDocumentStatus as P, type RpCredentials as R, type SignatureAlgorithm as S, ValidationError as V, type SessionResult as a, type RepresentationsResponse as b, ApiError as c, AuthenticationError as d, DeviceLinkError as e, type DeviceLinkInput as f, type EndResult as g, ForbiddenError as h, type NavigatorLike as i, NetworkError as j, type OnBehalfErrorCode as k, type OpenOrShowQROptions as l, type OrgResult as m, type PdfSessionBlock as n, type PdfSigner as o, type Representation as p, SessionFailedError as q, type SessionState as r, type SignatureAlgorithmParameters as s, type SignatureProtocol as t, deviceLink as u, isMobileUserAgent as v, openOrShowQR as w };
+export { type AcspContext as A, type CertificateLevel as C, type DeviceLinkSession as D, EidError as E, type FlowType as F, type HashAlgorithm as H, type Interaction as I, type NotificationSession as N, ON_BEHALF_ERROR_CODES as O, type PdfSessionBlock as P, type RpCredentials as R, type SignatureAlgorithm as S, ValidationError as V, type SessionResult as a, type RepresentationsResponse as b, ApiError as c, AuthenticationError as d, DeviceLinkError as e, type DeviceLinkInput as f, type EndResult as g, ForbiddenError as h, type NavigatorLike as i, NetworkError as j, type OnBehalfErrorCode as k, type OpenOrShowQROptions as l, type OrgResult as m, type PdfDocumentStatus as n, type PdfSigner as o, type Representation as p, SessionFailedError as q, type SessionState as r, type SignatureAlgorithmParameters as s, type SignatureProtocol as t, deviceLink as u, isMobileUserAgent as v, openOrShowQR as w };

package/dist/{browser-DqKDj2nB.d.ts → browser-B_XtyuFG.d.ts}

@@ -318,4 +318,4 @@ declare class ValidationError extends EidError {
 declare class DeviceLinkError extends EidError {
 }
 
-export { type AcspContext as A, type CertificateLevel as C, type DeviceLinkSession as D, EidError as E, type FlowType as F, type HashAlgorithm as H, type Interaction as I, type NotificationSession as N, ON_BEHALF_ERROR_CODES as O, type PdfDocumentStatus as P, type RpCredentials as R, type SignatureAlgorithm as S, ValidationError as V, type SessionResult as a, type RepresentationsResponse as b, ApiError as c, AuthenticationError as d, DeviceLinkError as e, type DeviceLinkInput as f, type EndResult as g, ForbiddenError as h, type NavigatorLike as i, NetworkError as j, type OnBehalfErrorCode as k, type OpenOrShowQROptions as l, type OrgResult as m, type PdfSessionBlock as n, type PdfSigner as o, type Representation as p, SessionFailedError as q, type SessionState as r, type SignatureAlgorithmParameters as s, type SignatureProtocol as t, deviceLink as u, isMobileUserAgent as v, openOrShowQR as w };
+export { type AcspContext as A, type CertificateLevel as C, type DeviceLinkSession as D, EidError as E, type FlowType as F, type HashAlgorithm as H, type Interaction as I, type NotificationSession as N, ON_BEHALF_ERROR_CODES as O, type PdfSessionBlock as P, type RpCredentials as R, type SignatureAlgorithm as S, ValidationError as V, type SessionResult as a, type RepresentationsResponse as b, ApiError as c, AuthenticationError as d, DeviceLinkError as e, type DeviceLinkInput as f, type EndResult as g, ForbiddenError as h, type NavigatorLike as i, NetworkError as j, type OnBehalfErrorCode as k, type OpenOrShowQROptions as l, type OrgResult as m, type PdfDocumentStatus as n, type PdfSigner as o, type Representation as p, SessionFailedError as q, type SessionState as r, type SignatureAlgorithmParameters as s, type SignatureProtocol as t, deviceLink as u, isMobileUserAgent as v, openOrShowQR as w };

package/dist/browser.d.cts

@@ -1 +1 @@
-export { e as DeviceLinkError, f as DeviceLinkInput, D as DeviceLinkSession, E as EidError, i as NavigatorLike, l as OpenOrShowQROptions, u as deviceLink, v as isMobileUserAgent, w as openOrShowQR } from './browser-DqKDj2nB.cjs';
+export { e as DeviceLinkError, f as DeviceLinkInput, D as DeviceLinkSession, E as EidError, i as NavigatorLike, l as OpenOrShowQROptions, u as deviceLink, v as isMobileUserAgent, w as openOrShowQR } from './browser-B_XtyuFG.cjs';

package/dist/browser.d.ts

@@ -1 +1 @@
-export { e as DeviceLinkError, f as DeviceLinkInput, D as DeviceLinkSession, E as EidError, i as NavigatorLike, l as OpenOrShowQROptions, u as deviceLink, v as isMobileUserAgent, w as openOrShowQR } from './browser-DqKDj2nB.js';
+export { e as DeviceLinkError, f as DeviceLinkInput, D as DeviceLinkSession, E as EidError, i as NavigatorLike, l as OpenOrShowQROptions, u as deviceLink, v as isMobileUserAgent, w as openOrShowQR } from './browser-B_XtyuFG.js';

package/dist/index.cjs

@@ -51,6 +51,7 @@ __export(index_exports, {
   isMobileUserAgent: () => isMobileUserAgent,
   openOrShowQR: () => openOrShowQR,
   parseSessionResult: () => parseSessionResult,
+  parseSubject: () => parseSubject,
   pkceChallenge: () => pkceChallenge,
   qrDeviceLinkTicker: () => qrDeviceLinkTicker,
   randomChallenge: () => randomChallenge,
@@ -480,6 +481,7 @@ var SessionApi = class {
 };
 
 // src/pdf.ts
+var import_node_crypto2 = require("crypto");
 function rec3(v) {
   return v && typeof v === "object" ? v : {};
 }
@@ -512,10 +514,12 @@ var PdfApi = class {
     const receivedAt = Date.now();
     const vc = rec3(r.vc).value;
     const dl = rec3(r.deviceLink);
+    const digest = typeof r.digest === "string" && r.digest ? r.digest : typeof dl.digest === "string" && dl.digest ? dl.digest : void 0;
     return {
       sessionId: String(r.sessionID),
       docId: String(r.docID),
       vc: vc != null ? String(vc) : null,
+      ...digest !== void 0 ? { digest } : {},
       deviceLink: dl.sessionToken ? {
         sessionToken: String(dl.sessionToken),
         sessionSecret: String(dl.sessionSecret),
@@ -533,6 +537,26 @@ var PdfApi = class {
   document(sessionId) {
     return this.http.getBytes(`/pdf/sign/${encodeURIComponent(sessionId)}/document`, 6e4);
   }
+  /**
+   * {@link document} + тулгалт: татсан байтын SHA-256 нь session poll-ийн `pdf.outSha256`-тай тэнцүү байх ёстой.
+   * `expected` — poll-ийн `result.pdf` блок (`documentStatus` READY + `outSha256` заавал) эсвэл SHA-256 hex.
+   *
+   * @throws {ValidationError} блок READY биш / `outSha256` алга / hash таарахгүй (файлд бүү итгэ).
+   */
+  async documentVerified(sessionId, expected) {
+    let want;
+    if (typeof expected === "string") {
+      want = expected;
+    } else {
+      if (expected.documentStatus !== "READY") throw new ValidationError(`pdf.documentStatus ${expected.documentStatus} \u2260 READY`);
+      want = expected.outSha256;
+    }
+    if (!want || !/^[0-9a-fA-F]{64}$/.test(want)) throw new ValidationError("pdf.outSha256 \u0430\u043B\u0433\u0430 \u044D\u0441\u0432\u044D\u043B SHA-256 hex \u0431\u0438\u0448");
+    const bytes = await this.document(sessionId);
+    const got = (0, import_node_crypto2.createHash)("sha256").update(bytes).digest("hex");
+    if (got !== want.toLowerCase()) throw new ValidationError("\u0422\u0430\u0442\u0441\u0430\u043D PDF-\u0438\u0439\u043D SHA-256 \u043D\u044C pdf.outSha256-\u0442\u0430\u0439 \u0442\u0430\u0430\u0440\u0441\u0430\u043D\u0433\u04AF\u0439");
+    return bytes;
+  }
 };
 
 // src/organization.ts
@@ -550,7 +574,114 @@ var OrganizationApi = class {
 };
 
 // src/validator.ts
-var import_node_crypto2 = require("crypto");
+var import_node_crypto4 = require("crypto");
+
+// src/subject.ts
+var import_node_crypto3 = require("crypto");
+var OIDS = {
+  "2.5.4.42": "givenName",
+  "2.5.4.4": "surname",
+  "2.5.4.3": "commonName",
+  "2.5.4.5": "serialNumber",
+  "2.5.4.6": "country",
+  "2.5.4.10": "organization",
+  "2.5.4.97": "organizationIdentifier"
+};
+function tlv(buf, pos, limit) {
+  if (pos + 2 > limit) throw new ValidationError("subject: DER \u0442\u043E\u043B\u0433\u043E\u0439 \u0431\u043E\u0433\u0438\u043D\u043E");
+  const tag = buf[pos];
+  if ((tag & 31) === 31) throw new ValidationError("subject: \u043E\u043B\u043E\u043D \u0431\u0430\u0439\u0442 tag \u0434\u044D\u043C\u0436\u0438\u0433\u0434\u044D\u044D\u0433\u04AF\u0439");
+  let len = buf[pos + 1];
+  let i = pos + 2;
+  if (len & 128) {
+    const n = len & 127;
+    if (n === 0 || n > 3) throw new ValidationError("subject: DER \u0443\u0440\u0442 \u0431\u0443\u0440\u0443\u0443");
+    if (i + n > limit) throw new ValidationError("subject: DER \u0443\u0440\u0442 \u0431\u043E\u0433\u0438\u043D\u043E");
+    len = 0;
+    for (let k = 0; k < n; k++) len = len * 256 + buf[i++];
+  }
+  if (i + len > limit) throw new ValidationError("subject: DER \u0430\u0433\u0443\u0443\u043B\u0433\u0430 \u0445\u0438\u043B\u044D\u044D\u0441 \u0433\u0430\u0440\u043D\u0430");
+  return { tag, start: i, end: i + len };
+}
+function oidOf(buf, t) {
+  if (t.tag !== 6 || t.end === t.start) throw new ValidationError("subject: OID \u0431\u0438\u0448");
+  const parts = [];
+  let v = 0;
+  for (let i = t.start; i < t.end; i++) {
+    const b = buf[i];
+    v = v * 128 + (b & 127);
+    if (!(b & 128)) {
+      if (parts.length === 0) parts.push(v < 80 ? Math.floor(v / 40) : 2, v < 80 ? v % 40 : v - 80);
+      else parts.push(v);
+      v = 0;
+    }
+  }
+  return parts.join(".");
+}
+function stringOf(buf, t) {
+  const bytes = buf.subarray(t.start, t.end);
+  switch (t.tag) {
+    case 12:
+      try {
+        return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+      } catch {
+        throw new ValidationError("subject: UTF8String \u0431\u0443\u0440\u0443\u0443 UTF-8");
+      }
+    case 19:
+    // PrintableString
+    case 22:
+    // IA5String
+    case 20:
+      return Buffer.from(bytes).toString("latin1");
+    case 30: {
+      if (bytes.length % 2) throw new ValidationError("subject: BMPString \u0443\u0440\u0442 \u0441\u043E\u043D\u0434\u0433\u043E\u0439");
+      return Buffer.from(bytes).swap16().toString("utf16le");
+    }
+    default:
+      return void 0;
+  }
+}
+function parseSubject(cert) {
+  const der = cert instanceof import_node_crypto3.X509Certificate ? new Uint8Array(cert.raw) : typeof cert === "string" ? new Uint8Array(Buffer.from(cert, "base64")) : cert;
+  const top = tlv(der, 0, der.length);
+  if (top.tag !== 48) throw new ValidationError("subject: Certificate SEQUENCE \u0431\u0438\u0448");
+  const tbs = tlv(der, top.start, top.end);
+  if (tbs.tag !== 48) throw new ValidationError("subject: tbsCertificate SEQUENCE \u0431\u0438\u0448");
+  let pos = tbs.start;
+  let first = tlv(der, pos, tbs.end);
+  if (first.tag === 160) {
+    pos = first.end;
+    first = tlv(der, pos, tbs.end);
+  }
+  let field = first;
+  for (let k = 0; k < 4; k++) field = tlv(der, field.end, tbs.end);
+  if (field.tag !== 48) throw new ValidationError("subject: Name SEQUENCE \u0431\u0438\u0448");
+  const out = { name: null, attributes: {} };
+  for (let sp = field.start; sp < field.end; ) {
+    const rdn = tlv(der, sp, field.end);
+    if (rdn.tag !== 49) throw new ValidationError("subject: RDN SET \u0431\u0438\u0448");
+    for (let ap = rdn.start; ap < rdn.end; ) {
+      const atv = tlv(der, ap, rdn.end);
+      if (atv.tag !== 48) throw new ValidationError("subject: AttributeTypeAndValue SEQUENCE \u0431\u0438\u0448");
+      const oidT = tlv(der, atv.start, atv.end);
+      const valT = tlv(der, oidT.end, atv.end);
+      const oid = oidOf(der, oidT);
+      const value = stringOf(der, valT);
+      if (value !== void 0 && !(oid in out.attributes)) {
+        out.attributes[oid] = value;
+        const key = OIDS[oid];
+        if (key) out[key] = value;
+      }
+      ap = atv.end;
+    }
+    sp = rdn.end;
+  }
+  const full = [out.givenName, out.surname].filter((s) => s).join(" ");
+  out.name = full || out.commonName || null;
+  return out;
+}
+
+// src/validator.ts
 var ResponseValidator = class {
   anchors;
   intermediates;
@@ -560,8 +691,8 @@ var ResponseValidator = class {
   revocation;
   revocationMode;
   constructor(trust = {}) {
-    this.anchors = (trust.trustAnchorsPem ?? []).map((p) => new import_node_crypto2.X509Certificate(p));
-    this.intermediates = (trust.intermediatesPem ?? []).map((p) => new import_node_crypto2.X509Certificate(p));
+    this.anchors = (trust.trustAnchorsPem ?? []).map((p) => new import_node_crypto4.X509Certificate(p));
+    this.intermediates = (trust.intermediatesPem ?? []).map((p) => new import_node_crypto4.X509Certificate(p));
     this.requiredLevel = trust.requiredLevel ?? "QUALIFIED";
     this.skew = trust.clockSkewMs ?? 0;
     this.allowUntrusted = trust.allowUntrusted ?? false;
@@ -592,7 +723,7 @@ var ResponseValidator = class {
       throw new ValidationError("userChallengeVerifier \u043D\u044C \u0433\u0430\u0440\u044B\u043D \u04AF\u0441\u044D\u0433 \u0437\u0443\u0440\u0430\u0433\u0434\u0441\u0430\u043D userChallenge-\u0442\u044D\u0439 \u0442\u0430\u0430\u0440\u0441\u0430\u043D\u0433\u04AF\u0439");
     }
     if (!interactionTypeUsed) throw new ValidationError("interactionTypeUsed \u0430\u043B\u0433\u0430");
-    const { alg, hash } = this.algorithmOf(result, acsp.signatureAlgorithm, acsp.hashAlgorithm);
+    const { alg, hash } = this.algorithmOf(result, leaf, acsp.signatureAlgorithm, acsp.hashAlgorithm);
     const payload = buildAcspV2Payload({
       serverRandom,
       rpChallenge: acsp.rpChallenge,
@@ -611,6 +742,7 @@ var ResponseValidator = class {
       documentNumber: result.documentNumber,
       certificate: leaf,
       subject: leaf.subject,
+      parsedSubject: parseSubject(leaf),
       certificateLevel: String(result.certificateLevel ?? "")
     };
   }
@@ -621,7 +753,7 @@ var ResponseValidator = class {
   validateSign(result, digestB64, hashAlgorithm = "SHA-256") {
     const leaf = this.precheck(result, "RAW_DIGEST_SIGNATURE");
     const digest = Buffer.from(digestB64, "base64");
-    const { alg, hash } = this.algorithmOf(result, null, hashAlgorithm);
+    const { alg, hash } = this.algorithmOf(result, leaf, null, hashAlgorithm);
     if (digest.length !== hashLen(hash)) throw new ValidationError("digest \u0443\u0440\u0442 hashAlgorithm-\u0442\u0430\u0439 \u0442\u0430\u0430\u0440\u0430\u0445\u0433\u04AF\u0439");
     if (!verifyPrehashedSignature(digest, result.signatureValueB64, leaf.publicKey, alg, hash)) {
       throw new ValidationError("\u0413\u0430\u0440\u044B\u043D \u04AF\u0441\u044D\u0433 \u04E9\u0433\u0441\u04E9\u043D digest-\u0442\u044D\u0439 \u0442\u0430\u0430\u0440\u0441\u0430\u043D\u0433\u04AF\u0439");
@@ -631,27 +763,47 @@ var ResponseValidator = class {
       signatureValueB64: result.signatureValueB64,
       signatureAlgorithm: result.signatureAlgorithm,
       certificate: leaf,
-      subject: leaf.subject
+      subject: leaf.subject,
+      parsedSubject: parseSubject(leaf)
     };
   }
   /**
-   * Хариуны signatureAlgorithm + hashAlgorithm-ийг RP-ийн хүссэнтэй тулгана (downgrade хаалт).
-   * ecdsa-with-SHA256 (хуучин cert) хүссэн rsassa-pss-ийн оронд ирэхийг зөвшөөрнө — SHA-256-аар л.
+   * Хариуны signatureAlgorithm + hashAlgorithm-ийг RP-ийн хүссэнтэй ба иргэний түлхүүрийн төрөлтэй тулгана
+   * (downgrade / alg confusion хаалт).
+   *
+   * CA-ийн бодит зан (ca-eidmongolia-mn `service/memory/crypto_wired.go` `messageHash`, `domain/enums.go`):
+   * RP-API session-ий гарын үсэг хоёр замаас л гарна — SplitKey RSA (`rsassa-pss` / `shaNNNWithRSAEncryption`,
+   * hash = хүсэлтийн `hashAlgorithm`) ба legacy threshold ECDSA P-256 (ҮРГЭЛЖ `ecdsa-with-SHA256`). ECDSA credential
+   * зөвхөн 32 байт digest зурдаг: session-ий hash SHA-256 биш бол сервер гарын үсэг гаргахгүй (session OK болохгүй).
+   * Иймд:
+   *   - hash нь ҮРГЭЛЖ хүссэнтэй яг тэнцүү — `ecdsa-with-SHA256` хариу SHA-384/512 хүссэн session-д ирвэл хуурамч;
+   *   - `ecdsa-with-SHA256` нь хүссэн `rsassa-pss`-ийн оронд ирж болно (credential-ийн төрөл), ГЭХДЭЭ зөвхөн
+   *     EC P-256 түлхүүртэй гэрчилгээнд; RSA алгоритмууд зөвхөн RSA түлхүүрт (alg confusion үгүй).
    */
-  algorithmOf(result, wantAlg, wantHash) {
+  algorithmOf(result, leaf, wantAlg, wantHash) {
     const alg = result.signatureAlgorithm ?? "";
+    const keyType = leaf.publicKey.asymmetricKeyType;
     let hash;
     if (alg === "rsassa-pss") {
       hash = String(result.signatureAlgorithmParameters?.hashAlgorithm ?? "");
+      if (!HASHES.has(hash)) throw new ValidationError(`\u0414\u044D\u043C\u0436\u0438\u0433\u0434\u044D\u044D\u0433\u04AF\u0439 hashAlgorithm: ${hash}`);
       const mgf = result.signatureAlgorithmParameters?.maskGenAlgorithm?.parameters?.hashAlgorithm;
       if (mgf && mgf !== hash) throw new ValidationError("MGF1 hash \u043D\u044C hashAlgorithm-\u0430\u0430\u0441 \u04E9\u04E9\u0440");
       if (result.signatureAlgorithmParameters?.saltLength != null && result.signatureAlgorithmParameters.saltLength !== hashLen(hash)) {
         throw new ValidationError("saltLength \u2260 hLen");
       }
+      if (keyType !== "rsa" && keyType !== "rsa-pss") throw new ValidationError(`${alg} \u043D\u044C ${keyType} \u0442\u04AF\u043B\u0445\u04AF\u04AF\u0440\u0442\u044D\u0439 \u0442\u0430\u0430\u0440\u0430\u0445\u0433\u04AF\u0439`);
     } else if (/^sha(256|384|512)WithRSAEncryption$/.test(alg)) {
       hash = "SHA-" + alg.slice(3, 6);
+      if (keyType !== "rsa") throw new ValidationError(`${alg} \u043D\u044C ${keyType} \u0442\u04AF\u043B\u0445\u04AF\u04AF\u0440\u0442\u044D\u0439 \u0442\u0430\u0430\u0440\u0430\u0445\u0433\u04AF\u0439`);
     } else if (alg === "ecdsa-with-SHA256") {
       hash = "SHA-256";
+      if (keyType !== "ec" || leaf.publicKey.asymmetricKeyDetails?.namedCurve !== "prime256v1") {
+        throw new ValidationError(`${alg} \u043D\u044C EC P-256 \u0431\u0443\u0441 \u0442\u04AF\u043B\u0445\u04AF\u04AF\u0440\u0442\u044D\u0439 \u0442\u0430\u0430\u0440\u0430\u0445\u0433\u04AF\u0439`);
+      }
+      if (wantHash !== hash) {
+        throw new ValidationError(`ecdsa-with-SHA256 \u0445\u0430\u0440\u0438\u0443 ${wantHash} \u0445\u04AF\u0441\u0441\u044D\u043D session-\u0434 \u0431\u043E\u043B\u043E\u043C\u0436\u0433\u04AF\u0439 (ECDSA credential \u0437\u04E9\u0432\u0445\u04E9\u043D SHA-256)`);
+      }
     } else {
       throw new ValidationError(`\u0414\u044D\u043C\u0436\u0438\u0433\u0434\u044D\u044D\u0433\u04AF\u0439 signatureAlgorithm: ${alg}`);
     }
@@ -672,7 +824,7 @@ var ResponseValidator = class {
     if (!result.certificateDerB64) throw new ValidationError("\u0425\u0430\u0440\u0438\u0443\u043D\u0434 \u0433\u044D\u0440\u0447\u0438\u043B\u0433\u044D\u044D \u0430\u043B\u0433\u0430");
     if (!result.signatureValueB64) throw new ValidationError("\u0425\u0430\u0440\u0438\u0443\u043D\u0434 \u0433\u0430\u0440\u044B\u043D \u04AF\u0441\u044D\u0433 \u0430\u043B\u0433\u0430");
     if (!result.documentNumber) throw new ValidationError("\u0425\u0430\u0440\u0438\u0443\u043D\u0434 documentNumber \u0430\u043B\u0433\u0430");
-    const leaf = new import_node_crypto2.X509Certificate(Buffer.from(result.certificateDerB64, "base64"));
+    const leaf = new import_node_crypto4.X509Certificate(Buffer.from(result.certificateDerB64, "base64"));
     this.checkValidity(leaf);
     this.checkLevel(String(result.certificateLevel ?? ""));
     if (this.anchors.length === 0) {
@@ -750,16 +902,16 @@ function signedCallbackUrl(fromResponse, rpCallback, flowType) {
   return fromResponse;
 }
 function userChallengeOf(verifier) {
-  return (0, import_node_crypto2.createHash)("sha256").update(verifier, "utf8").digest("base64url");
+  return (0, import_node_crypto4.createHash)("sha256").update(verifier, "utf8").digest("base64url");
 }
 function verifyPayloadSignature(payload, sigB64, key, alg, hash) {
   const sig = Buffer.from(sigB64, "base64");
   const h = nodeHash(hash);
   if (alg === "rsassa-pss") {
-    return (0, import_node_crypto2.verify)(h, payload, { key, padding: import_node_crypto2.constants.RSA_PKCS1_PSS_PADDING, saltLength: hashLen(hash) }, sig);
+    return (0, import_node_crypto4.verify)(h, payload, { key, padding: import_node_crypto4.constants.RSA_PKCS1_PSS_PADDING, saltLength: hashLen(hash) }, sig);
   }
-  if (alg === "ecdsa-with-SHA256") return (0, import_node_crypto2.verify)(h, payload, { key, dsaEncoding: "der" }, sig);
-  return (0, import_node_crypto2.verify)(h, payload, { key, padding: import_node_crypto2.constants.RSA_PKCS1_PADDING }, sig);
+  if (alg === "ecdsa-with-SHA256") return (0, import_node_crypto4.verify)(h, payload, { key, dsaEncoding: "der" }, sig);
+  return (0, import_node_crypto4.verify)(h, payload, { key, padding: import_node_crypto4.constants.RSA_PKCS1_PADDING }, sig);
 }
 function verifyPrehashedSignature(digest, sigB64, key, alg, hash) {
   const sig = Buffer.from(sigB64, "base64");
@@ -768,7 +920,7 @@ function verifyPrehashedSignature(digest, sigB64, key, alg, hash) {
   if (!modBits || sig.length !== Math.ceil(modBits / 8)) return false;
   let em;
   try {
-    em = (0, import_node_crypto2.publicDecrypt)({ key, padding: import_node_crypto2.constants.RSA_NO_PADDING }, sig);
+    em = (0, import_node_crypto4.publicDecrypt)({ key, padding: import_node_crypto4.constants.RSA_NO_PADDING }, sig);
   } catch {
     return false;
   }
@@ -841,6 +993,7 @@ function ecdsaP256VerifyPrehashed(digest, sig, key) {
   const R = ptAdd(ptMul(mod(z * w, n), [P256.gx, P256.gy]), ptMul(mod(r * w, n), Q));
   return R !== null && mod(R[0], n) === r;
 }
+var HASHES = /* @__PURE__ */ new Set(["SHA-256", "SHA-384", "SHA-512"]);
 var DIGEST_INFO = {
   "SHA-256": Buffer.from("3031300d060960864801650304020105000420", "hex"),
   "SHA-384": Buffer.from("3041300d060960864801650304020205000430", "hex"),
@@ -851,7 +1004,7 @@ function mgf1(hash, seed, length) {
   for (let i = 0, n = 0; n < length; i++, n += hashLen(hash)) {
     const c = Buffer.alloc(4);
     c.writeUInt32BE(i, 0);
-    out.push((0, import_node_crypto2.createHash)(nodeHash(hash)).update(seed).update(c).digest());
+    out.push((0, import_node_crypto4.createHash)(nodeHash(hash)).update(seed).update(c).digest());
   }
   return Buffer.concat(out).subarray(0, length);
 }
@@ -875,7 +1028,7 @@ function emsaPssVerify(mHash, em, emBits, hash) {
   const psLen = emLen - hLen - sLen - 2;
   if (!db.subarray(0, psLen).every((b) => b === 0) || db[psLen] !== 1) return false;
   const salt = db.subarray(psLen + 1);
-  const h2 = (0, import_node_crypto2.createHash)(nodeHash(hash)).update(Buffer.alloc(8)).update(mHash).update(salt).digest();
+  const h2 = (0, import_node_crypto4.createHash)(nodeHash(hash)).update(Buffer.alloc(8)).update(mHash).update(salt).digest();
   return h.equals(h2);
 }
 function isCa(cert) {
@@ -970,7 +1123,7 @@ function openOrShowQR(session, opts) {
 }
 
 // src/devicelinkv3.ts
-var import_node_crypto3 = require("crypto");
+var import_node_crypto5 = require("crypto");
 var TYPES = ["QR", "Web2App", "App2App"];
 var PROTOCOL = { auth: "ACSP_V2", sign: "RAW_DIGEST_SIGNATURE", cert: "" };
 var TOKEN_RE = /^[A-Za-z0-9_-]+$/;
@@ -1027,7 +1180,7 @@ function buildDeviceLink(p) {
     callback,
     unprotected
   ].join("|");
-  const authCode = (0, import_node_crypto3.createHmac)("sha256", Buffer.from(p.sessionSecret, "base64")).update(payload, "utf8").digest("base64url");
+  const authCode = (0, import_node_crypto5.createHmac)("sha256", Buffer.from(p.sessionSecret, "base64")).update(payload, "utf8").digest("base64url");
   return `${unprotected}&authCode=${authCode}`;
 }
 function qrDeviceLinkTicker(input, onLink, opts) {
@@ -1040,7 +1193,7 @@ function qrDeviceLinkTicker(input, onLink, opts) {
 }
 
 // src/oidc.ts
-var import_node_crypto4 = require("crypto");
+var import_node_crypto6 = require("crypto");
 var EID_OIDC_ISSUER = "https://login.eidmongolia.mn";
 var EID_ACR_QUALIFIED = "urn:eidmongolia:loa:qualified";
 var EID_ACR_ADVANCED = "urn:eidmongolia:loa:advanced";
@@ -1297,7 +1450,7 @@ function formEncode(s) {
 function timingSafeEqualStr(a, b) {
   const x = Buffer.from(a, "utf8");
   const y = Buffer.from(b, "utf8");
-  return x.length === y.length && (0, import_node_crypto4.timingSafeEqual)(x, y);
+  return x.length === y.length && (0, import_node_crypto6.timingSafeEqual)(x, y);
 }
 function decodeJsonPart(s) {
   try {
@@ -1348,6 +1501,7 @@ function callbackParams(input) {
   isMobileUserAgent,
   openOrShowQR,
   parseSessionResult,
+  parseSubject,
   pkceChallenge,
   qrDeviceLinkTicker,
   randomChallenge,

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { R as RpCredentials, C as CertificateLevel, I as Interaction, S as SignatureAlgorithm, H as HashAlgorithm, N as NotificationSession, D as DeviceLinkSession, a as SessionResult, b as RepresentationsResponse, A as AcspContext, F as FlowType, E as EidError } from './browser-DqKDj2nB.cjs';
-export { c as ApiError, d as AuthenticationError, e as DeviceLinkError, f as DeviceLinkInput, g as EndResult, h as ForbiddenError, i as NavigatorLike, j as NetworkError, O as ON_BEHALF_ERROR_CODES, k as OnBehalfErrorCode, l as OpenOrShowQROptions, m as OrgResult, P as PdfDocumentStatus, n as PdfSessionBlock, o as PdfSigner, p as Representation, q as SessionFailedError, r as SessionState, s as SignatureAlgorithmParameters, t as SignatureProtocol, V as ValidationError, u as deviceLink, v as isMobileUserAgent, w as openOrShowQR } from './browser-DqKDj2nB.cjs';
+import { R as RpCredentials, C as CertificateLevel, I as Interaction, S as SignatureAlgorithm, H as HashAlgorithm, N as NotificationSession, D as DeviceLinkSession, a as SessionResult, P as PdfSessionBlock, b as RepresentationsResponse, A as AcspContext, F as FlowType, E as EidError } from './browser-B_XtyuFG.cjs';
+export { c as ApiError, d as AuthenticationError, e as DeviceLinkError, f as DeviceLinkInput, g as EndResult, h as ForbiddenError, i as NavigatorLike, j as NetworkError, O as ON_BEHALF_ERROR_CODES, k as OnBehalfErrorCode, l as OpenOrShowQROptions, m as OrgResult, n as PdfDocumentStatus, o as PdfSigner, p as Representation, q as SessionFailedError, r as SessionState, s as SignatureAlgorithmParameters, t as SignatureProtocol, V as ValidationError, u as deviceLink, v as isMobileUserAgent, w as openOrShowQR } from './browser-B_XtyuFG.cjs';
 import { X509Certificate, KeyObject } from 'node:crypto';
 
 interface HttpConfig {
@@ -172,6 +172,12 @@ interface PdfPrepareSession {
     docId: string;
     /** Иргэнд ХАРУУЛАХ баталгаажуулах код (ПИН биш). */
     vc: string | null;
+    /**
+     * Иргэний зурах DTBS (base64, SHA-256 = 32 байт) — урсгалаас үл хамааран. Хариуны гарын үсгийг өөрөө шалгахад:
+     * `validator.validateSign(result, digest)`. Хуучин CA push хариунд талбаргүй → undefined (device-link-д
+     * `deviceLink.digest`-ээс).
+     */
+    digest?: string;
     deviceLink: {
         sessionToken: string;
         sessionSecret: string;
@@ -194,6 +200,13 @@ declare class PdfApi {
      * session-ий `pdf.outSha256`-тай тулга. Эрх хасагдсан бол `ForbiddenError` `.code = "REPRESENTATION_REVOKED"`.
      */
     document(sessionId: string): Promise<Uint8Array>;
+    /**
+     * {@link document} + тулгалт: татсан байтын SHA-256 нь session poll-ийн `pdf.outSha256`-тай тэнцүү байх ёстой.
+     * `expected` — poll-ийн `result.pdf` блок (`documentStatus` READY + `outSha256` заавал) эсвэл SHA-256 hex.
+     *
+     * @throws {ValidationError} блок READY биш / `outSha256` алга / hash таарахгүй (файлд бүү итгэ).
+     */
+    documentVerified(sessionId: string, expected: PdfSessionBlock | string): Promise<Uint8Array>;
 }
 
 declare class OrganizationApi {
@@ -203,6 +216,36 @@ declare class OrganizationApi {
     getRepresentations(personEtsi: string): Promise<RepresentationsResponse>;
 }
 
+/** Задалсан subject. Cert-д байхгүй талбар — undefined. Давхардсан OID-ийн эхнийх нь. */
+interface CertSubject {
+    /** 2.5.4.42 GIVENNAME. */
+    givenName?: string;
+    /** 2.5.4.4 SURNAME. */
+    surname?: string;
+    /** 2.5.4.3 CN. */
+    commonName?: string;
+    /** 2.5.4.5 SERIALNUMBER — иргэнд ETSI (`PNOMN-<иргэний дугаар>`). */
+    serialNumber?: string;
+    /** 2.5.4.6 C (ж: "MN"). */
+    country?: string;
+    /** 2.5.4.10 O. */
+    organization?: string;
+    /** 2.5.4.97 organizationIdentifier (ж: `NTRMN-…`). */
+    organizationIdentifier?: string;
+    /** Харуулах нэр: «givenName surname», эс бөгөөс commonName, эс бөгөөс null. */
+    name: string | null;
+    /** Бүх атрибут, OID → утга (эхний утга). Дээрхээс бусад OID-д. */
+    attributes: Record<string, string>;
+}
+/**
+ * Гэрчилгээний subject-ийг задална. `cert` — `X509Certificate`, DER байт, эсвэл base64 DER
+ * (session хариуны `certificateDerB64`). Гэмтсэн DER → {@link ValidationError}.
+ *
+ * (!) Энэ нь зөвхөн задлалт — гэрчилгээнд итгэх эсэхийг `ResponseValidator` шийднэ. Баталгаажаагүй
+ * гэрчилгээний нэрэнд бүү итгэ: `validateAuth`/`validateSign`-ийн `parsedSubject`-ийг ашигла.
+ */
+declare function parseSubject(cert: X509Certificate | Uint8Array | string): CertSubject;
+
 /**
  * validateAuth-ийн нэмэлт шалгалт — RP ЯМАР урсгал эхлүүлснээ мэддэг тул түүнийг тулгана
  * (device-link relay хаалт).
@@ -271,6 +314,8 @@ interface VerifiedIdentity {
     certificate: X509Certificate;
     /** Cert subject DN (түүхий). Ж: "C=MN, CN=..., SERIALNUMBER=PNOMN-...". */
     subject: string;
+    /** Subject-ийн задалсан талбарууд (нэр, ETSI `serialNumber`, улс) — {@link parseSubject}. */
+    parsedSubject: CertSubject;
     certificateLevel: string;
 }
 /** Баталгаажсан гарын үсэг (sign). */
@@ -280,6 +325,8 @@ interface VerifiedSignature {
     signatureAlgorithm: string | null;
     certificate: X509Certificate;
     subject: string;
+    /** Subject-ийн задалсан талбарууд — {@link parseSubject}. */
+    parsedSubject: CertSubject;
 }
 declare class ResponseValidator {
     private readonly anchors;
@@ -301,8 +348,17 @@ declare class ResponseValidator {
      */
     validateSign(result: SessionResult, digestB64: string, hashAlgorithm?: string): VerifiedSignature;
     /**
-     * Хариуны signatureAlgorithm + hashAlgorithm-ийг RP-ийн хүссэнтэй тулгана (downgrade хаалт).
-     * ecdsa-with-SHA256 (хуучин cert) хүссэн rsassa-pss-ийн оронд ирэхийг зөвшөөрнө — SHA-256-аар л.
+     * Хариуны signatureAlgorithm + hashAlgorithm-ийг RP-ийн хүссэнтэй ба иргэний түлхүүрийн төрөлтэй тулгана
+     * (downgrade / alg confusion хаалт).
+     *
+     * CA-ийн бодит зан (ca-eidmongolia-mn `service/memory/crypto_wired.go` `messageHash`, `domain/enums.go`):
+     * RP-API session-ий гарын үсэг хоёр замаас л гарна — SplitKey RSA (`rsassa-pss` / `shaNNNWithRSAEncryption`,
+     * hash = хүсэлтийн `hashAlgorithm`) ба legacy threshold ECDSA P-256 (ҮРГЭЛЖ `ecdsa-with-SHA256`). ECDSA credential
+     * зөвхөн 32 байт digest зурдаг: session-ий hash SHA-256 биш бол сервер гарын үсэг гаргахгүй (session OK болохгүй).
+     * Иймд:
+     *   - hash нь ҮРГЭЛЖ хүссэнтэй яг тэнцүү — `ecdsa-with-SHA256` хариу SHA-384/512 хүссэн session-д ирвэл хуурамч;
+     *   - `ecdsa-with-SHA256` нь хүссэн `rsassa-pss`-ийн оронд ирж болно (credential-ийн төрөл), ГЭХДЭЭ зөвхөн
+     *     EC P-256 түлхүүртэй гэрчилгээнд; RSA алгоритмууд зөвхөн RSA түлхүүрт (alg confusion үгүй).
      */
     private algorithmOf;
     /** state/endResult, cert байгаа эсэх, chain, validity, certLevel — нийтлэг шалгалт. */
@@ -593,4 +649,4 @@ declare class EidOidcClient {
 /** PKCE S256: `BASE64URL(SHA-256(ASCII(code_verifier)))` (RFC 7636 §4.2). */
 declare function pkceChallenge(codeVerifier: string): Promise<string>;
 
-export { AcspContext, type AcspV2Params, AuthApi, type AuthDefaults, type AuthOptions, type BuildDeviceLinkInput, CertificateLevel, type ClientConfig, type CreateAuthorizationOptions, DEFAULT_BASE_URL, DeviceLinkSession, type DeviceLinkSessionType, type DeviceLinkType, EID_ACR_ADVANCED, EID_ACR_QUALIFIED, EID_OIDC_ISSUER, type EidAuthorization, type EidCallbackChecks, type EidCallbackResult, EidClient, EidError, type EidIdTokenClaims, EidOidcClient, type EidOidcClientConfig, type EidOidcDiscovery, EidOidcError, type EidOidcErrorCode, FlowType, HashAlgorithm, Http, type HttpConfig, Interaction, NotificationSession, OrganizationApi, PdfApi, type PdfDefaults, type PdfPrepareInput, type PdfPrepareSession, type PdfSignerRef, type QrDeviceLinkTickerOptions, RepresentationsResponse, ResponseValidator, type RevocationChecker, type RevocationStatus, RpCredentials, SessionApi, SessionResult, SignApi, type SignDefaults, type SignOptions, SignatureAlgorithm, type TrustConfig, type ValidateAuthOptions, type VerifiedIdentity, type VerifiedSignature, acspV2Digest, buildAcspV2Payload, buildDeviceLink, interactionsToBase64, parseSessionResult, pkceChallenge, qrDeviceLinkTicker, randomChallenge, resolveBaseUrl, sha256Base64, userChallengeOf, verifyPayloadSignature, verifyPrehashedSignature };
+export { AcspContext, type AcspV2Params, AuthApi, type AuthDefaults, type AuthOptions, type BuildDeviceLinkInput, type CertSubject, CertificateLevel, type ClientConfig, type CreateAuthorizationOptions, DEFAULT_BASE_URL, DeviceLinkSession, type DeviceLinkSessionType, type DeviceLinkType, EID_ACR_ADVANCED, EID_ACR_QUALIFIED, EID_OIDC_ISSUER, type EidAuthorization, type EidCallbackChecks, type EidCallbackResult, EidClient, EidError, type EidIdTokenClaims, EidOidcClient, type EidOidcClientConfig, type EidOidcDiscovery, EidOidcError, type EidOidcErrorCode, FlowType, HashAlgorithm, Http, type HttpConfig, Interaction, NotificationSession, OrganizationApi, PdfApi, type PdfDefaults, type PdfPrepareInput, type PdfPrepareSession, PdfSessionBlock, type PdfSignerRef, type QrDeviceLinkTickerOptions, RepresentationsResponse, ResponseValidator, type RevocationChecker, type RevocationStatus, RpCredentials, SessionApi, SessionResult, SignApi, type SignDefaults, type SignOptions, SignatureAlgorithm, type TrustConfig, type ValidateAuthOptions, type VerifiedIdentity, type VerifiedSignature, acspV2Digest, buildAcspV2Payload, buildDeviceLink, interactionsToBase64, parseSessionResult, parseSubject, pkceChallenge, qrDeviceLinkTicker, randomChallenge, resolveBaseUrl, sha256Base64, userChallengeOf, verifyPayloadSignature, verifyPrehashedSignature };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { R as RpCredentials, C as CertificateLevel, I as Interaction, S as SignatureAlgorithm, H as HashAlgorithm, N as NotificationSession, D as DeviceLinkSession, a as SessionResult, b as RepresentationsResponse, A as AcspContext, F as FlowType, E as EidError } from './browser-DqKDj2nB.js';
-export { c as ApiError, d as AuthenticationError, e as DeviceLinkError, f as DeviceLinkInput, g as EndResult, h as ForbiddenError, i as NavigatorLike, j as NetworkError, O as ON_BEHALF_ERROR_CODES, k as OnBehalfErrorCode, l as OpenOrShowQROptions, m as OrgResult, P as PdfDocumentStatus, n as PdfSessionBlock, o as PdfSigner, p as Representation, q as SessionFailedError, r as SessionState, s as SignatureAlgorithmParameters, t as SignatureProtocol, V as ValidationError, u as deviceLink, v as isMobileUserAgent, w as openOrShowQR } from './browser-DqKDj2nB.js';
+import { R as RpCredentials, C as CertificateLevel, I as Interaction, S as SignatureAlgorithm, H as HashAlgorithm, N as NotificationSession, D as DeviceLinkSession, a as SessionResult, P as PdfSessionBlock, b as RepresentationsResponse, A as AcspContext, F as FlowType, E as EidError } from './browser-B_XtyuFG.js';
+export { c as ApiError, d as AuthenticationError, e as DeviceLinkError, f as DeviceLinkInput, g as EndResult, h as ForbiddenError, i as NavigatorLike, j as NetworkError, O as ON_BEHALF_ERROR_CODES, k as OnBehalfErrorCode, l as OpenOrShowQROptions, m as OrgResult, n as PdfDocumentStatus, o as PdfSigner, p as Representation, q as SessionFailedError, r as SessionState, s as SignatureAlgorithmParameters, t as SignatureProtocol, V as ValidationError, u as deviceLink, v as isMobileUserAgent, w as openOrShowQR } from './browser-B_XtyuFG.js';
 import { X509Certificate, KeyObject } from 'node:crypto';
 
 interface HttpConfig {
@@ -172,6 +172,12 @@ interface PdfPrepareSession {
     docId: string;
     /** Иргэнд ХАРУУЛАХ баталгаажуулах код (ПИН биш). */
     vc: string | null;
+    /**
+     * Иргэний зурах DTBS (base64, SHA-256 = 32 байт) — урсгалаас үл хамааран. Хариуны гарын үсгийг өөрөө шалгахад:
+     * `validator.validateSign(result, digest)`. Хуучин CA push хариунд талбаргүй → undefined (device-link-д
+     * `deviceLink.digest`-ээс).
+     */
+    digest?: string;
     deviceLink: {
         sessionToken: string;
         sessionSecret: string;
@@ -194,6 +200,13 @@ declare class PdfApi {
      * session-ий `pdf.outSha256`-тай тулга. Эрх хасагдсан бол `ForbiddenError` `.code = "REPRESENTATION_REVOKED"`.
      */
     document(sessionId: string): Promise<Uint8Array>;
+    /**
+     * {@link document} + тулгалт: татсан байтын SHA-256 нь session poll-ийн `pdf.outSha256`-тай тэнцүү байх ёстой.
+     * `expected` — poll-ийн `result.pdf` блок (`documentStatus` READY + `outSha256` заавал) эсвэл SHA-256 hex.
+     *
+     * @throws {ValidationError} блок READY биш / `outSha256` алга / hash таарахгүй (файлд бүү итгэ).
+     */
+    documentVerified(sessionId: string, expected: PdfSessionBlock | string): Promise<Uint8Array>;
 }
 
 declare class OrganizationApi {
@@ -203,6 +216,36 @@ declare class OrganizationApi {
     getRepresentations(personEtsi: string): Promise<RepresentationsResponse>;
 }
 
+/** Задалсан subject. Cert-д байхгүй талбар — undefined. Давхардсан OID-ийн эхнийх нь. */
+interface CertSubject {
+    /** 2.5.4.42 GIVENNAME. */
+    givenName?: string;
+    /** 2.5.4.4 SURNAME. */
+    surname?: string;
+    /** 2.5.4.3 CN. */
+    commonName?: string;
+    /** 2.5.4.5 SERIALNUMBER — иргэнд ETSI (`PNOMN-<иргэний дугаар>`). */
+    serialNumber?: string;
+    /** 2.5.4.6 C (ж: "MN"). */
+    country?: string;
+    /** 2.5.4.10 O. */
+    organization?: string;
+    /** 2.5.4.97 organizationIdentifier (ж: `NTRMN-…`). */
+    organizationIdentifier?: string;
+    /** Харуулах нэр: «givenName surname», эс бөгөөс commonName, эс бөгөөс null. */
+    name: string | null;
+    /** Бүх атрибут, OID → утга (эхний утга). Дээрхээс бусад OID-д. */
+    attributes: Record<string, string>;
+}
+/**
+ * Гэрчилгээний subject-ийг задална. `cert` — `X509Certificate`, DER байт, эсвэл base64 DER
+ * (session хариуны `certificateDerB64`). Гэмтсэн DER → {@link ValidationError}.
+ *
+ * (!) Энэ нь зөвхөн задлалт — гэрчилгээнд итгэх эсэхийг `ResponseValidator` шийднэ. Баталгаажаагүй
+ * гэрчилгээний нэрэнд бүү итгэ: `validateAuth`/`validateSign`-ийн `parsedSubject`-ийг ашигла.
+ */
+declare function parseSubject(cert: X509Certificate | Uint8Array | string): CertSubject;
+
 /**
  * validateAuth-ийн нэмэлт шалгалт — RP ЯМАР урсгал эхлүүлснээ мэддэг тул түүнийг тулгана
  * (device-link relay хаалт).
@@ -271,6 +314,8 @@ interface VerifiedIdentity {
     certificate: X509Certificate;
     /** Cert subject DN (түүхий). Ж: "C=MN, CN=..., SERIALNUMBER=PNOMN-...". */
     subject: string;
+    /** Subject-ийн задалсан талбарууд (нэр, ETSI `serialNumber`, улс) — {@link parseSubject}. */
+    parsedSubject: CertSubject;
     certificateLevel: string;
 }
 /** Баталгаажсан гарын үсэг (sign). */
@@ -280,6 +325,8 @@ interface VerifiedSignature {
     signatureAlgorithm: string | null;
     certificate: X509Certificate;
     subject: string;
+    /** Subject-ийн задалсан талбарууд — {@link parseSubject}. */
+    parsedSubject: CertSubject;
 }
 declare class ResponseValidator {
     private readonly anchors;
@@ -301,8 +348,17 @@ declare class ResponseValidator {
      */
     validateSign(result: SessionResult, digestB64: string, hashAlgorithm?: string): VerifiedSignature;
     /**
-     * Хариуны signatureAlgorithm + hashAlgorithm-ийг RP-ийн хүссэнтэй тулгана (downgrade хаалт).
-     * ecdsa-with-SHA256 (хуучин cert) хүссэн rsassa-pss-ийн оронд ирэхийг зөвшөөрнө — SHA-256-аар л.
+     * Хариуны signatureAlgorithm + hashAlgorithm-ийг RP-ийн хүссэнтэй ба иргэний түлхүүрийн төрөлтэй тулгана
+     * (downgrade / alg confusion хаалт).
+     *
+     * CA-ийн бодит зан (ca-eidmongolia-mn `service/memory/crypto_wired.go` `messageHash`, `domain/enums.go`):
+     * RP-API session-ий гарын үсэг хоёр замаас л гарна — SplitKey RSA (`rsassa-pss` / `shaNNNWithRSAEncryption`,
+     * hash = хүсэлтийн `hashAlgorithm`) ба legacy threshold ECDSA P-256 (ҮРГЭЛЖ `ecdsa-with-SHA256`). ECDSA credential
+     * зөвхөн 32 байт digest зурдаг: session-ий hash SHA-256 биш бол сервер гарын үсэг гаргахгүй (session OK болохгүй).
+     * Иймд:
+     *   - hash нь ҮРГЭЛЖ хүссэнтэй яг тэнцүү — `ecdsa-with-SHA256` хариу SHA-384/512 хүссэн session-д ирвэл хуурамч;
+     *   - `ecdsa-with-SHA256` нь хүссэн `rsassa-pss`-ийн оронд ирж болно (credential-ийн төрөл), ГЭХДЭЭ зөвхөн
+     *     EC P-256 түлхүүртэй гэрчилгээнд; RSA алгоритмууд зөвхөн RSA түлхүүрт (alg confusion үгүй).
      */
     private algorithmOf;
     /** state/endResult, cert байгаа эсэх, chain, validity, certLevel — нийтлэг шалгалт. */
@@ -593,4 +649,4 @@ declare class EidOidcClient {
 /** PKCE S256: `BASE64URL(SHA-256(ASCII(code_verifier)))` (RFC 7636 §4.2). */
 declare function pkceChallenge(codeVerifier: string): Promise<string>;
 
-export { AcspContext, type AcspV2Params, AuthApi, type AuthDefaults, type AuthOptions, type BuildDeviceLinkInput, CertificateLevel, type ClientConfig, type CreateAuthorizationOptions, DEFAULT_BASE_URL, DeviceLinkSession, type DeviceLinkSessionType, type DeviceLinkType, EID_ACR_ADVANCED, EID_ACR_QUALIFIED, EID_OIDC_ISSUER, type EidAuthorization, type EidCallbackChecks, type EidCallbackResult, EidClient, EidError, type EidIdTokenClaims, EidOidcClient, type EidOidcClientConfig, type EidOidcDiscovery, EidOidcError, type EidOidcErrorCode, FlowType, HashAlgorithm, Http, type HttpConfig, Interaction, NotificationSession, OrganizationApi, PdfApi, type PdfDefaults, type PdfPrepareInput, type PdfPrepareSession, type PdfSignerRef, type QrDeviceLinkTickerOptions, RepresentationsResponse, ResponseValidator, type RevocationChecker, type RevocationStatus, RpCredentials, SessionApi, SessionResult, SignApi, type SignDefaults, type SignOptions, SignatureAlgorithm, type TrustConfig, type ValidateAuthOptions, type VerifiedIdentity, type VerifiedSignature, acspV2Digest, buildAcspV2Payload, buildDeviceLink, interactionsToBase64, parseSessionResult, pkceChallenge, qrDeviceLinkTicker, randomChallenge, resolveBaseUrl, sha256Base64, userChallengeOf, verifyPayloadSignature, verifyPrehashedSignature };
+export { AcspContext, type AcspV2Params, AuthApi, type AuthDefaults, type AuthOptions, type BuildDeviceLinkInput, type CertSubject, CertificateLevel, type ClientConfig, type CreateAuthorizationOptions, DEFAULT_BASE_URL, DeviceLinkSession, type DeviceLinkSessionType, type DeviceLinkType, EID_ACR_ADVANCED, EID_ACR_QUALIFIED, EID_OIDC_ISSUER, type EidAuthorization, type EidCallbackChecks, type EidCallbackResult, EidClient, EidError, type EidIdTokenClaims, EidOidcClient, type EidOidcClientConfig, type EidOidcDiscovery, EidOidcError, type EidOidcErrorCode, FlowType, HashAlgorithm, Http, type HttpConfig, Interaction, NotificationSession, OrganizationApi, PdfApi, type PdfDefaults, type PdfPrepareInput, type PdfPrepareSession, PdfSessionBlock, type PdfSignerRef, type QrDeviceLinkTickerOptions, RepresentationsResponse, ResponseValidator, type RevocationChecker, type RevocationStatus, RpCredentials, SessionApi, SessionResult, SignApi, type SignDefaults, type SignOptions, SignatureAlgorithm, type TrustConfig, type ValidateAuthOptions, type VerifiedIdentity, type VerifiedSignature, acspV2Digest, buildAcspV2Payload, buildDeviceLink, interactionsToBase64, parseSessionResult, parseSubject, pkceChallenge, qrDeviceLinkTicker, randomChallenge, resolveBaseUrl, sha256Base64, userChallengeOf, verifyPayloadSignature, verifyPrehashedSignature };

package/dist/index.js

@@ -381,6 +381,7 @@ var SessionApi = class {
 };
 
 // src/pdf.ts
+import { createHash as createHash2 } from "crypto";
 function rec3(v) {
   return v && typeof v === "object" ? v : {};
 }
@@ -413,10 +414,12 @@ var PdfApi = class {
     const receivedAt = Date.now();
     const vc = rec3(r.vc).value;
     const dl = rec3(r.deviceLink);
+    const digest = typeof r.digest === "string" && r.digest ? r.digest : typeof dl.digest === "string" && dl.digest ? dl.digest : void 0;
     return {
       sessionId: String(r.sessionID),
       docId: String(r.docID),
       vc: vc != null ? String(vc) : null,
+      ...digest !== void 0 ? { digest } : {},
       deviceLink: dl.sessionToken ? {
         sessionToken: String(dl.sessionToken),
         sessionSecret: String(dl.sessionSecret),
@@ -434,6 +437,26 @@ var PdfApi = class {
   document(sessionId) {
     return this.http.getBytes(`/pdf/sign/${encodeURIComponent(sessionId)}/document`, 6e4);
   }
+  /**
+   * {@link document} + тулгалт: татсан байтын SHA-256 нь session poll-ийн `pdf.outSha256`-тай тэнцүү байх ёстой.
+   * `expected` — poll-ийн `result.pdf` блок (`documentStatus` READY + `outSha256` заавал) эсвэл SHA-256 hex.
+   *
+   * @throws {ValidationError} блок READY биш / `outSha256` алга / hash таарахгүй (файлд бүү итгэ).
+   */
+  async documentVerified(sessionId, expected) {
+    let want;
+    if (typeof expected === "string") {
+      want = expected;
+    } else {
+      if (expected.documentStatus !== "READY") throw new ValidationError(`pdf.documentStatus ${expected.documentStatus} \u2260 READY`);
+      want = expected.outSha256;
+    }
+    if (!want || !/^[0-9a-fA-F]{64}$/.test(want)) throw new ValidationError("pdf.outSha256 \u0430\u043B\u0433\u0430 \u044D\u0441\u0432\u044D\u043B SHA-256 hex \u0431\u0438\u0448");
+    const bytes = await this.document(sessionId);
+    const got = createHash2("sha256").update(bytes).digest("hex");
+    if (got !== want.toLowerCase()) throw new ValidationError("\u0422\u0430\u0442\u0441\u0430\u043D PDF-\u0438\u0439\u043D SHA-256 \u043D\u044C pdf.outSha256-\u0442\u0430\u0439 \u0442\u0430\u0430\u0440\u0441\u0430\u043D\u0433\u04AF\u0439");
+    return bytes;
+  }
 };
 
 // src/organization.ts
@@ -451,7 +474,114 @@ var OrganizationApi = class {
 };
 
 // src/validator.ts
-import { X509Certificate, constants, createHash as createHash2, publicDecrypt, verify } from "crypto";
+import { X509Certificate as X509Certificate2, constants, createHash as createHash3, publicDecrypt, verify } from "crypto";
+
+// src/subject.ts
+import { X509Certificate } from "crypto";
+var OIDS = {
+  "2.5.4.42": "givenName",
+  "2.5.4.4": "surname",
+  "2.5.4.3": "commonName",
+  "2.5.4.5": "serialNumber",
+  "2.5.4.6": "country",
+  "2.5.4.10": "organization",
+  "2.5.4.97": "organizationIdentifier"
+};
+function tlv(buf, pos, limit) {
+  if (pos + 2 > limit) throw new ValidationError("subject: DER \u0442\u043E\u043B\u0433\u043E\u0439 \u0431\u043E\u0433\u0438\u043D\u043E");
+  const tag = buf[pos];
+  if ((tag & 31) === 31) throw new ValidationError("subject: \u043E\u043B\u043E\u043D \u0431\u0430\u0439\u0442 tag \u0434\u044D\u043C\u0436\u0438\u0433\u0434\u044D\u044D\u0433\u04AF\u0439");
+  let len = buf[pos + 1];
+  let i = pos + 2;
+  if (len & 128) {
+    const n = len & 127;
+    if (n === 0 || n > 3) throw new ValidationError("subject: DER \u0443\u0440\u0442 \u0431\u0443\u0440\u0443\u0443");
+    if (i + n > limit) throw new ValidationError("subject: DER \u0443\u0440\u0442 \u0431\u043E\u0433\u0438\u043D\u043E");
+    len = 0;
+    for (let k = 0; k < n; k++) len = len * 256 + buf[i++];
+  }
+  if (i + len > limit) throw new ValidationError("subject: DER \u0430\u0433\u0443\u0443\u043B\u0433\u0430 \u0445\u0438\u043B\u044D\u044D\u0441 \u0433\u0430\u0440\u043D\u0430");
+  return { tag, start: i, end: i + len };
+}
+function oidOf(buf, t) {
+  if (t.tag !== 6 || t.end === t.start) throw new ValidationError("subject: OID \u0431\u0438\u0448");
+  const parts = [];
+  let v = 0;
+  for (let i = t.start; i < t.end; i++) {
+    const b = buf[i];
+    v = v * 128 + (b & 127);
+    if (!(b & 128)) {
+      if (parts.length === 0) parts.push(v < 80 ? Math.floor(v / 40) : 2, v < 80 ? v % 40 : v - 80);
+      else parts.push(v);
+      v = 0;
+    }
+  }
+  return parts.join(".");
+}
+function stringOf(buf, t) {
+  const bytes = buf.subarray(t.start, t.end);
+  switch (t.tag) {
+    case 12:
+      try {
+        return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+      } catch {
+        throw new ValidationError("subject: UTF8String \u0431\u0443\u0440\u0443\u0443 UTF-8");
+      }
+    case 19:
+    // PrintableString
+    case 22:
+    // IA5String
+    case 20:
+      return Buffer.from(bytes).toString("latin1");
+    case 30: {
+      if (bytes.length % 2) throw new ValidationError("subject: BMPString \u0443\u0440\u0442 \u0441\u043E\u043D\u0434\u0433\u043E\u0439");
+      return Buffer.from(bytes).swap16().toString("utf16le");
+    }
+    default:
+      return void 0;
+  }
+}
+function parseSubject(cert) {
+  const der = cert instanceof X509Certificate ? new Uint8Array(cert.raw) : typeof cert === "string" ? new Uint8Array(Buffer.from(cert, "base64")) : cert;
+  const top = tlv(der, 0, der.length);
+  if (top.tag !== 48) throw new ValidationError("subject: Certificate SEQUENCE \u0431\u0438\u0448");
+  const tbs = tlv(der, top.start, top.end);
+  if (tbs.tag !== 48) throw new ValidationError("subject: tbsCertificate SEQUENCE \u0431\u0438\u0448");
+  let pos = tbs.start;
+  let first = tlv(der, pos, tbs.end);
+  if (first.tag === 160) {
+    pos = first.end;
+    first = tlv(der, pos, tbs.end);
+  }
+  let field = first;
+  for (let k = 0; k < 4; k++) field = tlv(der, field.end, tbs.end);
+  if (field.tag !== 48) throw new ValidationError("subject: Name SEQUENCE \u0431\u0438\u0448");
+  const out = { name: null, attributes: {} };
+  for (let sp = field.start; sp < field.end; ) {
+    const rdn = tlv(der, sp, field.end);
+    if (rdn.tag !== 49) throw new ValidationError("subject: RDN SET \u0431\u0438\u0448");
+    for (let ap = rdn.start; ap < rdn.end; ) {
+      const atv = tlv(der, ap, rdn.end);
+      if (atv.tag !== 48) throw new ValidationError("subject: AttributeTypeAndValue SEQUENCE \u0431\u0438\u0448");
+      const oidT = tlv(der, atv.start, atv.end);
+      const valT = tlv(der, oidT.end, atv.end);
+      const oid = oidOf(der, oidT);
+      const value = stringOf(der, valT);
+      if (value !== void 0 && !(oid in out.attributes)) {
+        out.attributes[oid] = value;
+        const key = OIDS[oid];
+        if (key) out[key] = value;
+      }
+      ap = atv.end;
+    }
+    sp = rdn.end;
+  }
+  const full = [out.givenName, out.surname].filter((s) => s).join(" ");
+  out.name = full || out.commonName || null;
+  return out;
+}
+
+// src/validator.ts
 var ResponseValidator = class {
   anchors;
   intermediates;
@@ -461,8 +591,8 @@ var ResponseValidator = class {
   revocation;
   revocationMode;
   constructor(trust = {}) {
-    this.anchors = (trust.trustAnchorsPem ?? []).map((p) => new X509Certificate(p));
-    this.intermediates = (trust.intermediatesPem ?? []).map((p) => new X509Certificate(p));
+    this.anchors = (trust.trustAnchorsPem ?? []).map((p) => new X509Certificate2(p));
+    this.intermediates = (trust.intermediatesPem ?? []).map((p) => new X509Certificate2(p));
     this.requiredLevel = trust.requiredLevel ?? "QUALIFIED";
     this.skew = trust.clockSkewMs ?? 0;
     this.allowUntrusted = trust.allowUntrusted ?? false;
@@ -493,7 +623,7 @@ var ResponseValidator = class {
       throw new ValidationError("userChallengeVerifier \u043D\u044C \u0433\u0430\u0440\u044B\u043D \u04AF\u0441\u044D\u0433 \u0437\u0443\u0440\u0430\u0433\u0434\u0441\u0430\u043D userChallenge-\u0442\u044D\u0439 \u0442\u0430\u0430\u0440\u0441\u0430\u043D\u0433\u04AF\u0439");
     }
     if (!interactionTypeUsed) throw new ValidationError("interactionTypeUsed \u0430\u043B\u0433\u0430");
-    const { alg, hash } = this.algorithmOf(result, acsp.signatureAlgorithm, acsp.hashAlgorithm);
+    const { alg, hash } = this.algorithmOf(result, leaf, acsp.signatureAlgorithm, acsp.hashAlgorithm);
     const payload = buildAcspV2Payload({
       serverRandom,
       rpChallenge: acsp.rpChallenge,
@@ -512,6 +642,7 @@ var ResponseValidator = class {
       documentNumber: result.documentNumber,
       certificate: leaf,
       subject: leaf.subject,
+      parsedSubject: parseSubject(leaf),
       certificateLevel: String(result.certificateLevel ?? "")
     };
   }
@@ -522,7 +653,7 @@ var ResponseValidator = class {
   validateSign(result, digestB64, hashAlgorithm = "SHA-256") {
     const leaf = this.precheck(result, "RAW_DIGEST_SIGNATURE");
     const digest = Buffer.from(digestB64, "base64");
-    const { alg, hash } = this.algorithmOf(result, null, hashAlgorithm);
+    const { alg, hash } = this.algorithmOf(result, leaf, null, hashAlgorithm);
     if (digest.length !== hashLen(hash)) throw new ValidationError("digest \u0443\u0440\u0442 hashAlgorithm-\u0442\u0430\u0439 \u0442\u0430\u0430\u0440\u0430\u0445\u0433\u04AF\u0439");
     if (!verifyPrehashedSignature(digest, result.signatureValueB64, leaf.publicKey, alg, hash)) {
       throw new ValidationError("\u0413\u0430\u0440\u044B\u043D \u04AF\u0441\u044D\u0433 \u04E9\u0433\u0441\u04E9\u043D digest-\u0442\u044D\u0439 \u0442\u0430\u0430\u0440\u0441\u0430\u043D\u0433\u04AF\u0439");
@@ -532,27 +663,47 @@ var ResponseValidator = class {
       signatureValueB64: result.signatureValueB64,
       signatureAlgorithm: result.signatureAlgorithm,
       certificate: leaf,
-      subject: leaf.subject
+      subject: leaf.subject,
+      parsedSubject: parseSubject(leaf)
     };
   }
   /**
-   * Хариуны signatureAlgorithm + hashAlgorithm-ийг RP-ийн хүссэнтэй тулгана (downgrade хаалт).
-   * ecdsa-with-SHA256 (хуучин cert) хүссэн rsassa-pss-ийн оронд ирэхийг зөвшөөрнө — SHA-256-аар л.
+   * Хариуны signatureAlgorithm + hashAlgorithm-ийг RP-ийн хүссэнтэй ба иргэний түлхүүрийн төрөлтэй тулгана
+   * (downgrade / alg confusion хаалт).
+   *
+   * CA-ийн бодит зан (ca-eidmongolia-mn `service/memory/crypto_wired.go` `messageHash`, `domain/enums.go`):
+   * RP-API session-ий гарын үсэг хоёр замаас л гарна — SplitKey RSA (`rsassa-pss` / `shaNNNWithRSAEncryption`,
+   * hash = хүсэлтийн `hashAlgorithm`) ба legacy threshold ECDSA P-256 (ҮРГЭЛЖ `ecdsa-with-SHA256`). ECDSA credential
+   * зөвхөн 32 байт digest зурдаг: session-ий hash SHA-256 биш бол сервер гарын үсэг гаргахгүй (session OK болохгүй).
+   * Иймд:
+   *   - hash нь ҮРГЭЛЖ хүссэнтэй яг тэнцүү — `ecdsa-with-SHA256` хариу SHA-384/512 хүссэн session-д ирвэл хуурамч;
+   *   - `ecdsa-with-SHA256` нь хүссэн `rsassa-pss`-ийн оронд ирж болно (credential-ийн төрөл), ГЭХДЭЭ зөвхөн
+   *     EC P-256 түлхүүртэй гэрчилгээнд; RSA алгоритмууд зөвхөн RSA түлхүүрт (alg confusion үгүй).
    */
-  algorithmOf(result, wantAlg, wantHash) {
+  algorithmOf(result, leaf, wantAlg, wantHash) {
     const alg = result.signatureAlgorithm ?? "";
+    const keyType = leaf.publicKey.asymmetricKeyType;
     let hash;
     if (alg === "rsassa-pss") {
       hash = String(result.signatureAlgorithmParameters?.hashAlgorithm ?? "");
+      if (!HASHES.has(hash)) throw new ValidationError(`\u0414\u044D\u043C\u0436\u0438\u0433\u0434\u044D\u044D\u0433\u04AF\u0439 hashAlgorithm: ${hash}`);
       const mgf = result.signatureAlgorithmParameters?.maskGenAlgorithm?.parameters?.hashAlgorithm;
       if (mgf && mgf !== hash) throw new ValidationError("MGF1 hash \u043D\u044C hashAlgorithm-\u0430\u0430\u0441 \u04E9\u04E9\u0440");
       if (result.signatureAlgorithmParameters?.saltLength != null && result.signatureAlgorithmParameters.saltLength !== hashLen(hash)) {
         throw new ValidationError("saltLength \u2260 hLen");
       }
+      if (keyType !== "rsa" && keyType !== "rsa-pss") throw new ValidationError(`${alg} \u043D\u044C ${keyType} \u0442\u04AF\u043B\u0445\u04AF\u04AF\u0440\u0442\u044D\u0439 \u0442\u0430\u0430\u0440\u0430\u0445\u0433\u04AF\u0439`);
     } else if (/^sha(256|384|512)WithRSAEncryption$/.test(alg)) {
       hash = "SHA-" + alg.slice(3, 6);
+      if (keyType !== "rsa") throw new ValidationError(`${alg} \u043D\u044C ${keyType} \u0442\u04AF\u043B\u0445\u04AF\u04AF\u0440\u0442\u044D\u0439 \u0442\u0430\u0430\u0440\u0430\u0445\u0433\u04AF\u0439`);
     } else if (alg === "ecdsa-with-SHA256") {
       hash = "SHA-256";
+      if (keyType !== "ec" || leaf.publicKey.asymmetricKeyDetails?.namedCurve !== "prime256v1") {
+        throw new ValidationError(`${alg} \u043D\u044C EC P-256 \u0431\u0443\u0441 \u0442\u04AF\u043B\u0445\u04AF\u04AF\u0440\u0442\u044D\u0439 \u0442\u0430\u0430\u0440\u0430\u0445\u0433\u04AF\u0439`);
+      }
+      if (wantHash !== hash) {
+        throw new ValidationError(`ecdsa-with-SHA256 \u0445\u0430\u0440\u0438\u0443 ${wantHash} \u0445\u04AF\u0441\u0441\u044D\u043D session-\u0434 \u0431\u043E\u043B\u043E\u043C\u0436\u0433\u04AF\u0439 (ECDSA credential \u0437\u04E9\u0432\u0445\u04E9\u043D SHA-256)`);
+      }
     } else {
       throw new ValidationError(`\u0414\u044D\u043C\u0436\u0438\u0433\u0434\u044D\u044D\u0433\u04AF\u0439 signatureAlgorithm: ${alg}`);
     }
@@ -573,7 +724,7 @@ var ResponseValidator = class {
     if (!result.certificateDerB64) throw new ValidationError("\u0425\u0430\u0440\u0438\u0443\u043D\u0434 \u0433\u044D\u0440\u0447\u0438\u043B\u0433\u044D\u044D \u0430\u043B\u0433\u0430");
     if (!result.signatureValueB64) throw new ValidationError("\u0425\u0430\u0440\u0438\u0443\u043D\u0434 \u0433\u0430\u0440\u044B\u043D \u04AF\u0441\u044D\u0433 \u0430\u043B\u0433\u0430");
     if (!result.documentNumber) throw new ValidationError("\u0425\u0430\u0440\u0438\u0443\u043D\u0434 documentNumber \u0430\u043B\u0433\u0430");
-    const leaf = new X509Certificate(Buffer.from(result.certificateDerB64, "base64"));
+    const leaf = new X509Certificate2(Buffer.from(result.certificateDerB64, "base64"));
     this.checkValidity(leaf);
     this.checkLevel(String(result.certificateLevel ?? ""));
     if (this.anchors.length === 0) {
@@ -651,7 +802,7 @@ function signedCallbackUrl(fromResponse, rpCallback, flowType) {
   return fromResponse;
 }
 function userChallengeOf(verifier) {
-  return createHash2("sha256").update(verifier, "utf8").digest("base64url");
+  return createHash3("sha256").update(verifier, "utf8").digest("base64url");
 }
 function verifyPayloadSignature(payload, sigB64, key, alg, hash) {
   const sig = Buffer.from(sigB64, "base64");
@@ -742,6 +893,7 @@ function ecdsaP256VerifyPrehashed(digest, sig, key) {
   const R = ptAdd(ptMul(mod(z * w, n), [P256.gx, P256.gy]), ptMul(mod(r * w, n), Q));
   return R !== null && mod(R[0], n) === r;
 }
+var HASHES = /* @__PURE__ */ new Set(["SHA-256", "SHA-384", "SHA-512"]);
 var DIGEST_INFO = {
   "SHA-256": Buffer.from("3031300d060960864801650304020105000420", "hex"),
   "SHA-384": Buffer.from("3041300d060960864801650304020205000430", "hex"),
@@ -752,7 +904,7 @@ function mgf1(hash, seed, length) {
   for (let i = 0, n = 0; n < length; i++, n += hashLen(hash)) {
     const c = Buffer.alloc(4);
     c.writeUInt32BE(i, 0);
-    out.push(createHash2(nodeHash(hash)).update(seed).update(c).digest());
+    out.push(createHash3(nodeHash(hash)).update(seed).update(c).digest());
   }
   return Buffer.concat(out).subarray(0, length);
 }
@@ -776,7 +928,7 @@ function emsaPssVerify(mHash, em, emBits, hash) {
   const psLen = emLen - hLen - sLen - 2;
   if (!db.subarray(0, psLen).every((b) => b === 0) || db[psLen] !== 1) return false;
   const salt = db.subarray(psLen + 1);
-  const h2 = createHash2(nodeHash(hash)).update(Buffer.alloc(8)).update(mHash).update(salt).digest();
+  const h2 = createHash3(nodeHash(hash)).update(Buffer.alloc(8)).update(mHash).update(salt).digest();
   return h.equals(h2);
 }
 function isCa(cert) {
@@ -1206,6 +1358,7 @@ export {
   isMobileUserAgent,
   openOrShowQR,
   parseSessionResult,
+  parseSubject,
   pkceChallenge,
   qrDeviceLinkTicker,
   randomChallenge,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gerege-systems/eid-mongolia-sdk",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "description": "e-ID Mongolia Relying Party SDK — иргэнээр утсаар нь нэвтрэлт ба хууль ёсны цахим гарын үсэг (RP-API v3, Smart-ID нийцтэй).",
   "license": "MIT",
   "type": "module",