@idp.global/sdk 17.0.0 → 18.0.0

package/changelog.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## 2026-09-19 - 18.0.0
+
+### Breaking Changes
+
+- move the server account store from `@push.rocks/smartdata` to `@lossless.org/client/nosqldb` (persistence)
+  - Removes the `@push.rocks/smartdata` dependency and adds a required peer dependency `@lossless.org/client` (`>=1.0.0 <2.0.0`). Consumers of `@idp.global/sdk/server` must install it themselves; the subpath imports it statically, so every `./server` import fails without it.
+  - `SmartdataAccountStore({ smartdataDb })` and `setAccountDocSmartdataDb()` now take the `SmartdataDb` exported by `@lossless.org/client/nosqldb`. A `SmartdataDb` built by `@push.rocks/smartdata` is no longer accepted: it is a different class identity and both the type check and the model's runtime db resolution reject it.
+  - The store, the document class and the scrypt password hasher are otherwise unchanged. Stored accounts are not transformed: the collection stays `IdpSdkAccountDoc`, `_id` stays a mongo ObjectId distinct from the application `id`, the `_id_` and unique `id_1` indexes are unchanged, and the persisted field set, field types and `scrypt:v1` hash format are asserted verbatim in `test/test.account-store-persistence.node.ts`.
+
+
+### Fixes
+
+- upgrade release tooling to the current published versions (deps-dev)
+  - pnpm 12.3.4 -> 12.4.1, `@git.zone/tsbuild` ^4.4.2 -> ^4.5.0, `@git.zone/tstest` ^6.0.0 -> ^6.1.1, `@types/node` 26.4.1 -> 26.5.1.
+
+## 2026-09-13 - 17.1.0
+
+### Fixes
+
+- Update release tooling, require build and test preflight, and qualify account persistence against NoSQLDB 10.2.0.
+
+### Features
+
+- Add a subject-bound server UserInfo client with bounded transport and validated organization display claims.
+
 ## 2026-09-09 - 17.0.0
 
 ### Breaking Changes

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@idp.global/sdk',
-    version: '17.0.0',
+    version: '18.0.0',
     description: 'Reusable browser and server SDK for idp.global authentication.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxpQkFBaUI7SUFDdkIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLGdFQUFnRTtDQUM5RSxDQUFBIn0=

package/dist_ts_server/classes.account-doc.d.ts

@@ -1,7 +1,7 @@
 import * as plugins from './plugins.js';
 import type { IIdpSdkAccount, TIdpAccountAuthSource, TIdpAccountRole, TIdpAccountStatus } from './interfaces.js';
-export declare const setAccountDocSmartdataDb: (smartdataDbArg: plugins.smartdata.SmartdataDb) => void;
-export declare class IdpSdkAccountDoc extends plugins.smartdata.SmartDataDbDoc<IdpSdkAccountDoc, IdpSdkAccountDoc> {
+export declare const setAccountDocSmartdataDb: (smartdataDbArg: plugins.nosqldb.SmartdataDb) => void;
+export declare class IdpSdkAccountDoc extends plugins.nosqldb.SmartDataDbDoc<IdpSdkAccountDoc, IdpSdkAccountDoc> {
     id: string;
     email: string;
     emailNormalized: string;

package/dist_ts_server/classes.account-doc.js

@@ -44,11 +44,11 @@ const getDb = () => {
     return activeSmartdataDb;
 };
 let IdpSdkAccountDoc = (() => {
-    let _classDecorators = [plugins.smartdata.Collection(() => getDb())];
+    let _classDecorators = [plugins.nosqldb.Collection(() => getDb())];
     let _classDescriptor;
     let _classExtraInitializers = [];
     let _classThis;
-    let _classSuper = plugins.smartdata.SmartDataDbDoc;
+    let _classSuper = plugins.nosqldb.SmartDataDbDoc;
     let _id_decorators;
     let _id_initializers = [];
     let _id_extraInitializers = [];
@@ -89,18 +89,18 @@ let IdpSdkAccountDoc = (() => {
         static { _classThis = this; }
         static {
             const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
-            _id_decorators = [plugins.smartdata.unI(), plugins.smartdata.svDb()];
-            _email_decorators = [plugins.smartdata.svDb()];
-            _emailNormalized_decorators = [plugins.smartdata.svDb()];
-            _name_decorators = [plugins.smartdata.svDb()];
-            _role_decorators = [plugins.smartdata.svDb()];
-            _status_decorators = [plugins.smartdata.svDb()];
-            _authSources_decorators = [plugins.smartdata.svDb()];
-            _passwordHash_decorators = [plugins.smartdata.svDb()];
-            _idpSubject_decorators = [plugins.smartdata.svDb()];
-            _createdAt_decorators = [plugins.smartdata.svDb()];
-            _updatedAt_decorators = [plugins.smartdata.svDb()];
-            _lastLoginAt_decorators = [plugins.smartdata.svDb()];
+            _id_decorators = [plugins.nosqldb.unI(), plugins.nosqldb.svDb()];
+            _email_decorators = [plugins.nosqldb.svDb()];
+            _emailNormalized_decorators = [plugins.nosqldb.svDb()];
+            _name_decorators = [plugins.nosqldb.svDb()];
+            _role_decorators = [plugins.nosqldb.svDb()];
+            _status_decorators = [plugins.nosqldb.svDb()];
+            _authSources_decorators = [plugins.nosqldb.svDb()];
+            _passwordHash_decorators = [plugins.nosqldb.svDb()];
+            _idpSubject_decorators = [plugins.nosqldb.svDb()];
+            _createdAt_decorators = [plugins.nosqldb.svDb()];
+            _updatedAt_decorators = [plugins.nosqldb.svDb()];
+            _lastLoginAt_decorators = [plugins.nosqldb.svDb()];
             __esDecorate(null, null, _id_decorators, { kind: "field", name: "id", static: false, private: false, access: { has: obj => "id" in obj, get: obj => obj.id, set: (obj, value) => { obj.id = value; } }, metadata: _metadata }, _id_initializers, _id_extraInitializers);
             __esDecorate(null, null, _email_decorators, { kind: "field", name: "email", static: false, private: false, access: { has: obj => "email" in obj, get: obj => obj.email, set: (obj, value) => { obj.email = value; } }, metadata: _metadata }, _email_initializers, _email_extraInitializers);
             __esDecorate(null, null, _emailNormalized_decorators, { kind: "field", name: "emailNormalized", static: false, private: false, access: { has: obj => "emailNormalized" in obj, get: obj => obj.emailNormalized, set: (obj, value) => { obj.emailNormalized = value; } }, metadata: _metadata }, _emailNormalized_initializers, _emailNormalized_extraInitializers);
@@ -163,4 +163,4 @@ let IdpSdkAccountDoc = (() => {
     return IdpSdkAccountDoc = _classThis;
 })();
 export { IdpSdkAccountDoc };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5hY2NvdW50LWRvYy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzX3NlcnZlci9jbGFzc2VzLmFjY291bnQtZG9jLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUd4QyxJQUFJLGlCQUFpQixHQUF5QyxJQUFJLENBQUM7QUFFbkUsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxjQUE2QyxFQUFFLEVBQUU7SUFDeEYsaUJBQWlCLEdBQUcsY0FBYyxDQUFDO0FBQ3JDLENBQUMsQ0FBQztBQUVGLE1BQU0sS0FBSyxHQUFHLEdBQUcsRUFBRTtJQUNqQixJQUFJLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztRQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLGdEQUFnRCxDQUFDLENBQUM7SUFDcEUsQ0FBQztJQUNELE9BQU8saUJBQWlCLENBQUM7QUFDM0IsQ0FBQyxDQUFDO0lBR1csZ0JBQWdCOzRCQUQ1QixPQUFPLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxLQUFLLEVBQUUsQ0FBQzs7OztzQkFDTixPQUFPLENBQUMsU0FBUyxDQUFDLGNBQWM7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Z0NBQXhDLFNBQVEsV0FBb0U7Ozs7OEJBQ3ZHLE9BQU8sQ0FBQyxTQUFTLENBQUMsR0FBRyxFQUFFLEVBQ3ZCLE9BQU8sQ0FBQyxTQUFTLENBQUMsSUFBSSxFQUFFO2lDQUd4QixPQUFPLENBQUMsU0FBUyxDQUFDLElBQUksRUFBRTsyQ0FHeEIsT0FBTyxDQUFDLFNBQVMsQ0FBQyxJQUFJLEVBQUU7Z0NBR3hCLE9BQU8sQ0FBQyxTQUFTLENBQUMsSUFBSSxFQUFFO2dDQUd4QixPQUFPLENBQUMsU0FBUyxDQUFDLElBQUksRUFBRTtrQ0FHeEIsT0FBTyxDQUFDLFNBQVMsQ0FBQyxJQUFJLEVBQUU7dUNBR3hCLE9BQU8sQ0FBQyxTQUFTLENBQUMsSUFBSSxFQUFFO3dDQUd4QixPQUFPLENBQUMsU0FBUyxDQUFDLElBQUksRUFBRTtzQ0FHeEIsT0FBTyxDQUFDLFNBQVMsQ0FBQyxJQUFJLEVBQUU7cUNBR3hCLE9BQU8sQ0FBQyxTQUFTLENBQUMsSUFBSSxFQUFFO3FDQUd4QixPQUFPLENBQUMsU0FBUyxDQUFDLElBQUksRUFBRTt1Q0FHeEIsT0FBTyxDQUFDLFNBQVMsQ0FBQyxJQUFJLEVBQUU7WUFoQ3pCLHdKQUFPLEVBQUUsNkJBQUYsRUFBRSwrRUFBVTtZQUduQixpS0FBTyxLQUFLLDZCQUFMLEtBQUsscUZBQVU7WUFHdEIsK0xBQU8sZUFBZSw2QkFBZixlQUFlLHlHQUFVO1lBR2hDLDhKQUFPLElBQUksNkJBQUosSUFBSSxtRkFBYztZQUd6Qiw4SkFBTyxJQUFJLDZCQUFKLElBQUksbUZBQW1CO1lBRzlCLG9LQUFPLE1BQU0sNkJBQU4sTUFBTSx1RkFBcUI7WUFHbEMsbUxBQU8sV0FBVyw2QkFBWCxXQUFXLGlHQUEyQjtZQUc3QyxzTEFBTyxZQUFZLDZCQUFaLFlBQVksbUdBQVU7WUFHN0IsZ0xBQU8sVUFBVSw2QkFBVixVQUFVLCtGQUFVO1lBRzNCLDZLQUFPLFNBQVMsNkJBQVQsU0FBUyw2RkFBVTtZQUcxQiw2S0FBTyxTQUFTLDZCQUFULFNBQVMsNkZBQVU7WUFHMUIsbUxBQU8sV0FBVyw2QkFBWCxXQUFXLGlHQUFVO1lBcEM5Qiw2S0FrRUM7OztZQWxFWSx1REFBZ0I7O1FBR3BCLEVBQUUscURBQVU7UUFHWixLQUFLLDBHQUFVO1FBR2YsZUFBZSx1SEFBVTtRQUd6QixJQUFJLDZHQUFXLEVBQUUsR0FBQztRQUdsQixJQUFJLDJHQUFtQjtRQUd2QixNQUFNLDZHQUFxQjtRQUczQixXQUFXLG9IQUEyQjtRQUd0QyxZQUFZLDBIQUFVO1FBR3RCLFVBQVUseUhBQVU7UUFHcEIsU0FBUyxzSEFBVTtRQUduQixTQUFTLHFIQUFVO1FBR25CLFdBQVcsdUhBQVU7UUFFckIsU0FBUztZQUNkLE9BQU87Z0JBQ0wsRUFBRSxFQUFFLElBQUksQ0FBQyxFQUFFO2dCQUNYLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSztnQkFDakIsZUFBZSxFQUFFLElBQUksQ0FBQyxlQUFlO2dCQUNyQyxJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUk7Z0JBQ2YsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJO2dCQUNmLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTTtnQkFDbkIsV0FBVyxFQUFFLElBQUksQ0FBQyxXQUFXLElBQUksRUFBRTtnQkFDbkMsWUFBWSxFQUFFLElBQUksQ0FBQyxZQUFZO2dCQUMvQixVQUFVLEVBQUUsSUFBSSxDQUFDLFVBQVU7Z0JBQzNCLFNBQVMsRUFBRSxJQUFJLENBQUMsU0FBUztnQkFDekIsU0FBUyxFQUFFLElBQUksQ0FBQyxTQUFTO2dCQUN6QixXQUFXLEVBQUUsSUFBSSxDQUFDLFdBQVc7YUFDOUIsQ0FBQztRQUNKLENBQUM7UUFFTSxNQUFNLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxLQUFhO1lBQ3hDLE9BQU8sZ0JBQWdCLENBQUMsV0FBVyxDQUFDLEVBQUUsRUFBRSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7UUFDckQsQ0FBQztRQUVNLE1BQU0sQ0FBQyxLQUFLLENBQUMscUJBQXFCLENBQUMsa0JBQTBCO1lBQ2xFLE9BQU8sZ0JBQWdCLENBQUMsV0FBVyxDQUFDLEVBQUUsZUFBZSxFQUFFLGtCQUFrQixFQUFFLENBQUMsQ0FBQztRQUMvRSxDQUFDO1FBRU0sTUFBTSxDQUFDLEtBQUssQ0FBQyxVQUFVO1lBQzVCLE9BQU8sZ0JBQWdCLENBQUMsWUFBWSxDQUFDLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztRQUM1RSxDQUFDOzs7Ozs7OztTQWpFVSxnQkFBZ0IifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5hY2NvdW50LWRvYy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzX3NlcnZlci9jbGFzc2VzLmFjY291bnQtZG9jLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUd4QyxJQUFJLGlCQUFpQixHQUF1QyxJQUFJLENBQUM7QUFFakUsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxjQUEyQyxFQUFFLEVBQUU7SUFDdEYsaUJBQWlCLEdBQUcsY0FBYyxDQUFDO0FBQ3JDLENBQUMsQ0FBQztBQUVGLE1BQU0sS0FBSyxHQUFHLEdBQUcsRUFBRTtJQUNqQixJQUFJLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztRQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLGdEQUFnRCxDQUFDLENBQUM7SUFDcEUsQ0FBQztJQUNELE9BQU8saUJBQWlCLENBQUM7QUFDM0IsQ0FBQyxDQUFDO0lBR1csZ0JBQWdCOzRCQUQ1QixPQUFPLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxLQUFLLEVBQUUsQ0FBQzs7OztzQkFDSixPQUFPLENBQUMsT0FBTyxDQUFDLGNBQWM7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Z0NBQXRDLFNBQVEsV0FBa0U7Ozs7OEJBQ3JHLE9BQU8sQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFLEVBQ3JCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO2lDQUd0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTsyQ0FHdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7Z0NBR3RCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO2dDQUd0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtrQ0FHdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7dUNBR3RCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO3dDQUd0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtzQ0FHdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7cUNBR3RCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO3FDQUd0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTt1Q0FHdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7WUFoQ3ZCLHdKQUFPLEVBQUUsNkJBQUYsRUFBRSwrRUFBVTtZQUduQixpS0FBTyxLQUFLLDZCQUFMLEtBQUsscUZBQVU7WUFHdEIsK0xBQU8sZUFBZSw2QkFBZixlQUFlLHlHQUFVO1lBR2hDLDhKQUFPLElBQUksNkJBQUosSUFBSSxtRkFBYztZQUd6Qiw4SkFBTyxJQUFJLDZCQUFKLElBQUksbUZBQW1CO1lBRzlCLG9LQUFPLE1BQU0sNkJBQU4sTUFBTSx1RkFBcUI7WUFHbEMsbUxBQU8sV0FBVyw2QkFBWCxXQUFXLGlHQUEyQjtZQUc3QyxzTEFBTyxZQUFZLDZCQUFaLFlBQVksbUdBQVU7WUFHN0IsZ0xBQU8sVUFBVSw2QkFBVixVQUFVLCtGQUFVO1lBRzNCLDZLQUFPLFNBQVMsNkJBQVQsU0FBUyw2RkFBVTtZQUcxQiw2S0FBTyxTQUFTLDZCQUFULFNBQVMsNkZBQVU7WUFHMUIsbUxBQU8sV0FBVyw2QkFBWCxXQUFXLGlHQUFVO1lBcEM5Qiw2S0FrRUM7OztZQWxFWSx1REFBZ0I7O1FBR3BCLEVBQUUscURBQVU7UUFHWixLQUFLLDBHQUFVO1FBR2YsZUFBZSx1SEFBVTtRQUd6QixJQUFJLDZHQUFXLEVBQUUsR0FBQztRQUdsQixJQUFJLDJHQUFtQjtRQUd2QixNQUFNLDZHQUFxQjtRQUczQixXQUFXLG9IQUEyQjtRQUd0QyxZQUFZLDBIQUFVO1FBR3RCLFVBQVUseUhBQVU7UUFHcEIsU0FBUyxzSEFBVTtRQUduQixTQUFTLHFIQUFVO1FBR25CLFdBQVcsdUhBQVU7UUFFckIsU0FBUztZQUNkLE9BQU87Z0JBQ0wsRUFBRSxFQUFFLElBQUksQ0FBQyxFQUFFO2dCQUNYLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSztnQkFDakIsZUFBZSxFQUFFLElBQUksQ0FBQyxlQUFlO2dCQUNyQyxJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUk7Z0JBQ2YsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJO2dCQUNmLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTTtnQkFDbkIsV0FBVyxFQUFFLElBQUksQ0FBQyxXQUFXLElBQUksRUFBRTtnQkFDbkMsWUFBWSxFQUFFLElBQUksQ0FBQyxZQUFZO2dCQUMvQixVQUFVLEVBQUUsSUFBSSxDQUFDLFVBQVU7Z0JBQzNCLFNBQVMsRUFBRSxJQUFJLENBQUMsU0FBUztnQkFDekIsU0FBUyxFQUFFLElBQUksQ0FBQyxTQUFTO2dCQUN6QixXQUFXLEVBQUUsSUFBSSxDQUFDLFdBQVc7YUFDOUIsQ0FBQztRQUNKLENBQUM7UUFFTSxNQUFNLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxLQUFhO1lBQ3hDLE9BQU8sZ0JBQWdCLENBQUMsV0FBVyxDQUFDLEVBQUUsRUFBRSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7UUFDckQsQ0FBQztRQUVNLE1BQU0sQ0FBQyxLQUFLLENBQUMscUJBQXFCLENBQUMsa0JBQTBCO1lBQ2xFLE9BQU8sZ0JBQWdCLENBQUMsV0FBVyxDQUFDLEVBQUUsZUFBZSxFQUFFLGtCQUFrQixFQUFFLENBQUMsQ0FBQztRQUMvRSxDQUFDO1FBRU0sTUFBTSxDQUFDLEtBQUssQ0FBQyxVQUFVO1lBQzVCLE9BQU8sZ0JBQWdCLENBQUMsWUFBWSxDQUFDLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztRQUM1RSxDQUFDOzs7Ozs7OztTQWpFVSxnQkFBZ0IifQ==

package/dist_ts_server/classes.account-store.d.ts

@@ -3,7 +3,7 @@ import type { ICreateIdpSdkAccountOptions, IIdpSdkAccount } from './interfaces.j
 export declare class SmartdataAccountStore {
     private optionsArg;
     constructor(optionsArg: {
-        smartdataDb: plugins.smartdata.SmartdataDb;
+        smartdataDb: plugins.nosqldb.SmartdataDb;
     });
     normalizeEmail(emailArg: string): string;
     createAccount(optionsArg: ICreateIdpSdkAccountOptions): Promise<IIdpSdkAccount>;

package/dist_ts_server/classes.account-store.js

@@ -81,4 +81,4 @@ export class SmartdataAccountStore {
         return [...new Set(authSourcesArg.filter((sourceArg) => sourceArg === 'local' || sourceArg === 'idp.global'))];
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5hY2NvdW50LXN0b3JlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHNfc2VydmVyL2NsYXNzZXMuYWNjb3VudC1zdG9yZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUN4QyxPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsd0JBQXdCLEVBQUUsTUFBTSwwQkFBMEIsQ0FBQztBQUN0RixPQUFPLEVBQUUsY0FBYyxFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFHOUQsTUFBTSxPQUFPLHFCQUFxQjtJQUNaO0lBQXBCLFlBQW9CLFVBQTBEO1FBQTFELGVBQVUsR0FBVixVQUFVLENBQWdEO1FBQzVFLHdCQUF3QixDQUFDLFVBQVUsQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUNuRCxDQUFDO0lBRU0sY0FBYyxDQUFDLFFBQWdCO1FBQ3BDLE9BQU8sUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxDQUFDO0lBQ3ZDLENBQUM7SUFFTSxLQUFLLENBQUMsYUFBYSxDQUFDLFVBQXVDO1FBQ2hFLE1BQU0sZUFBZSxHQUFHLElBQUksQ0FBQyxjQUFjLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQzlELElBQUksQ0FBQyxlQUFlLElBQUksQ0FBQyxlQUFlLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDdkQsTUFBTSxJQUFJLEtBQUssQ0FBQyxtQ0FBbUMsQ0FBQyxDQUFDO1FBQ3ZELENBQUM7UUFDRCxNQUFNLFFBQVEsR0FBRyxNQUFNLGdCQUFnQixDQUFDLHFCQUFxQixDQUFDLGVBQWUsQ0FBQyxDQUFDO1FBQy9FLElBQUksUUFBUSxFQUFFLENBQUM7WUFDYixNQUFNLElBQUksS0FBSyxDQUFDLDhCQUE4QixlQUFlLEVBQUUsQ0FBQyxDQUFDO1FBQ25FLENBQUM7UUFFRCxNQUFNLFdBQVcsR0FBRyxJQUFJLENBQUMsb0JBQW9CLENBQUMsVUFBVSxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQ3RFLElBQUksV0FBVyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUM3QixNQUFNLElBQUksS0FBSyxDQUFDLHNDQUFzQyxDQUFDLENBQUM7UUFDMUQsQ0FBQztRQUNELElBQUksV0FBVyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUMxRCxNQUFNLElBQUksS0FBSyxDQUFDLDZDQUE2QyxDQUFDLENBQUM7UUFDakUsQ0FBQztRQUVELE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUN2QixNQUFNLEdBQUcsR0FBRyxJQUFJLGdCQUFnQixFQUFFLENBQUM7UUFDbkMsR0FBRyxDQUFDLEVBQUUsR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQ3JDLEdBQUcsQ0FBQyxLQUFLLEdBQUcsVUFBVSxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUNwQyxHQUFHLENBQUMsZUFBZSxHQUFHLGVBQWUsQ0FBQztRQUN0QyxHQUFHLENBQUMsSUFBSSxHQUFHLFVBQVUsQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLElBQUksR0FBRyxDQUFDLEtBQUssQ0FBQztRQUMvQyxHQUFHLENBQUMsSUFBSSxHQUFHLFVBQVUsQ0FBQyxJQUFJLENBQUM7UUFDM0IsR0FBRyxDQUFDLE1BQU0sR0FBRyxVQUFVLENBQUMsTUFBTSxJQUFJLFFBQVEsQ0FBQztRQUMzQyxHQUFHLENBQUMsV0FBVyxHQUFHLFdBQVcsQ0FBQztRQUM5QixHQUFHLENBQUMsWUFBWSxHQUFHLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLE1BQU0sY0FBYyxDQUFDLFlBQVksQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztRQUM1RyxHQUFHLENBQUMsVUFBVSxHQUFHLFVBQVUsQ0FBQyxVQUFVLENBQUM7UUFDdkMsR0FBRyxDQUFDLFNBQVMsR0FBRyxHQUFHLENBQUM7UUFDcEIsR0FBRyxDQUFDLFNBQVMsR0FBRyxHQUFHLENBQUM7UUFDcEIsTUFBTSxHQUFHLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDakIsT0FBTyxHQUFHLENBQUMsU0FBUyxFQUFFLENBQUM7SUFDekIsQ0FBQztJQUVNLEtBQUssQ0FBQyxpQkFBaUIsQ0FBQyxRQUFnQjtRQUM3QyxNQUFNLEdBQUcsR0FBRyxNQUFNLGdCQUFnQixDQUFDLHFCQUFxQixDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztRQUN4RixPQUFPLEdBQUcsRUFBRSxTQUFTLEVBQUUsSUFBSSxJQUFJLENBQUM7SUFDbEMsQ0FBQztJQUVNLEtBQUssQ0FBQyxjQUFjLENBQUMsS0FBYTtRQUN2QyxNQUFNLEdBQUcsR0FBRyxNQUFNLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNuRCxPQUFPLEdBQUcsRUFBRSxTQUFTLEVBQUUsSUFBSSxJQUFJLENBQUM7SUFDbEMsQ0FBQztJQUVNLEtBQUssQ0FBQyxZQUFZO1FBQ3ZCLE1BQU0sSUFBSSxHQUFHLE1BQU0sZ0JBQWdCLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ3JELE9BQU8sSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUVNLEtBQUssQ0FBQyxxQkFBcUI7UUFDaEMsTUFBTSxNQUFNLEdBQUcsTUFBTSxnQkFBZ0IsQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUNuRCxPQUFPLE1BQU0sQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDO0lBQzNCLENBQUM7SUFFTSxLQUFLLENBQUMsbUJBQW1CLENBQUMsVUFBMEIsRUFBRSxXQUFtQjtRQUM5RSxJQUFJLFVBQVUsQ0FBQyxNQUFNLEtBQUssUUFBUSxJQUFJLENBQUMsVUFBVSxDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUNoRixPQUFPLEtBQUssQ0FBQztRQUNmLENBQUM7UUFDRCxPQUFPLGNBQWMsQ0FBQyxjQUFjLENBQUMsV0FBVyxFQUFFLFVBQVUsQ0FBQyxZQUFZLENBQUMsQ0FBQztJQUM3RSxDQUFDO0lBRU0sS0FBSyxDQUFDLGdCQUFnQixDQUFDLFlBQW9CLEVBQUUsUUFBaUM7UUFDbkYsTUFBTSxHQUFHLEdBQUcsTUFBTSxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLENBQUM7UUFDMUQsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQ1QsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDO1FBQ0QsSUFBSSxRQUFRLENBQUMsVUFBVSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3RDLEdBQUcsQ0FBQyxVQUFVLEdBQUcsUUFBUSxDQUFDLFVBQVUsQ0FBQztRQUN2QyxDQUFDO1FBQ0QsR0FBRyxDQUFDLFdBQVcsR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDN0IsR0FBRyxDQUFDLFNBQVMsR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDM0IsTUFBTSxHQUFHLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDakIsT0FBTyxHQUFHLENBQUMsU0FBUyxFQUFFLENBQUM7SUFDekIsQ0FBQztJQUVPLG9CQUFvQixDQUFDLGNBQXVDO1FBQ2xFLE9BQU8sQ0FBQyxHQUFHLElBQUksR0FBRyxDQUFDLGNBQWMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLFNBQVMsS0FBSyxPQUFPLElBQUksU0FBUyxLQUFLLFlBQVksQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNqSCxDQUFDO0NBQ0YifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5hY2NvdW50LXN0b3JlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHNfc2VydmVyL2NsYXNzZXMuYWNjb3VudC1zdG9yZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUN4QyxPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsd0JBQXdCLEVBQUUsTUFBTSwwQkFBMEIsQ0FBQztBQUN0RixPQUFPLEVBQUUsY0FBYyxFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFHOUQsTUFBTSxPQUFPLHFCQUFxQjtJQUNaO0lBQXBCLFlBQW9CLFVBQXdEO1FBQXhELGVBQVUsR0FBVixVQUFVLENBQThDO1FBQzFFLHdCQUF3QixDQUFDLFVBQVUsQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUNuRCxDQUFDO0lBRU0sY0FBYyxDQUFDLFFBQWdCO1FBQ3BDLE9BQU8sUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxDQUFDO0lBQ3ZDLENBQUM7SUFFTSxLQUFLLENBQUMsYUFBYSxDQUFDLFVBQXVDO1FBQ2hFLE1BQU0sZUFBZSxHQUFHLElBQUksQ0FBQyxjQUFjLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQzlELElBQUksQ0FBQyxlQUFlLElBQUksQ0FBQyxlQUFlLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDdkQsTUFBTSxJQUFJLEtBQUssQ0FBQyxtQ0FBbUMsQ0FBQyxDQUFDO1FBQ3ZELENBQUM7UUFDRCxNQUFNLFFBQVEsR0FBRyxNQUFNLGdCQUFnQixDQUFDLHFCQUFxQixDQUFDLGVBQWUsQ0FBQyxDQUFDO1FBQy9FLElBQUksUUFBUSxFQUFFLENBQUM7WUFDYixNQUFNLElBQUksS0FBSyxDQUFDLDhCQUE4QixlQUFlLEVBQUUsQ0FBQyxDQUFDO1FBQ25FLENBQUM7UUFFRCxNQUFNLFdBQVcsR0FBRyxJQUFJLENBQUMsb0JBQW9CLENBQUMsVUFBVSxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQ3RFLElBQUksV0FBVyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUM3QixNQUFNLElBQUksS0FBSyxDQUFDLHNDQUFzQyxDQUFDLENBQUM7UUFDMUQsQ0FBQztRQUNELElBQUksV0FBVyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUMxRCxNQUFNLElBQUksS0FBSyxDQUFDLDZDQUE2QyxDQUFDLENBQUM7UUFDakUsQ0FBQztRQUVELE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUN2QixNQUFNLEdBQUcsR0FBRyxJQUFJLGdCQUFnQixFQUFFLENBQUM7UUFDbkMsR0FBRyxDQUFDLEVBQUUsR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQ3JDLEdBQUcsQ0FBQyxLQUFLLEdBQUcsVUFBVSxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUNwQyxHQUFHLENBQUMsZUFBZSxHQUFHLGVBQWUsQ0FBQztRQUN0QyxHQUFHLENBQUMsSUFBSSxHQUFHLFVBQVUsQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLElBQUksR0FBRyxDQUFDLEtBQUssQ0FBQztRQUMvQyxHQUFHLENBQUMsSUFBSSxHQUFHLFVBQVUsQ0FBQyxJQUFJLENBQUM7UUFDM0IsR0FBRyxDQUFDLE1BQU0sR0FBRyxVQUFVLENBQUMsTUFBTSxJQUFJLFFBQVEsQ0FBQztRQUMzQyxHQUFHLENBQUMsV0FBVyxHQUFHLFdBQVcsQ0FBQztRQUM5QixHQUFHLENBQUMsWUFBWSxHQUFHLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLE1BQU0sY0FBYyxDQUFDLFlBQVksQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztRQUM1RyxHQUFHLENBQUMsVUFBVSxHQUFHLFVBQVUsQ0FBQyxVQUFVLENBQUM7UUFDdkMsR0FBRyxDQUFDLFNBQVMsR0FBRyxHQUFHLENBQUM7UUFDcEIsR0FBRyxDQUFDLFNBQVMsR0FBRyxHQUFHLENBQUM7UUFDcEIsTUFBTSxHQUFHLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDakIsT0FBTyxHQUFHLENBQUMsU0FBUyxFQUFFLENBQUM7SUFDekIsQ0FBQztJQUVNLEtBQUssQ0FBQyxpQkFBaUIsQ0FBQyxRQUFnQjtRQUM3QyxNQUFNLEdBQUcsR0FBRyxNQUFNLGdCQUFnQixDQUFDLHFCQUFxQixDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztRQUN4RixPQUFPLEdBQUcsRUFBRSxTQUFTLEVBQUUsSUFBSSxJQUFJLENBQUM7SUFDbEMsQ0FBQztJQUVNLEtBQUssQ0FBQyxjQUFjLENBQUMsS0FBYTtRQUN2QyxNQUFNLEdBQUcsR0FBRyxNQUFNLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNuRCxPQUFPLEdBQUcsRUFBRSxTQUFTLEVBQUUsSUFBSSxJQUFJLENBQUM7SUFDbEMsQ0FBQztJQUVNLEtBQUssQ0FBQyxZQUFZO1FBQ3ZCLE1BQU0sSUFBSSxHQUFHLE1BQU0sZ0JBQWdCLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ3JELE9BQU8sSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUVNLEtBQUssQ0FBQyxxQkFBcUI7UUFDaEMsTUFBTSxNQUFNLEdBQUcsTUFBTSxnQkFBZ0IsQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUNuRCxPQUFPLE1BQU0sQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDO0lBQzNCLENBQUM7SUFFTSxLQUFLLENBQUMsbUJBQW1CLENBQUMsVUFBMEIsRUFBRSxXQUFtQjtRQUM5RSxJQUFJLFVBQVUsQ0FBQyxNQUFNLEtBQUssUUFBUSxJQUFJLENBQUMsVUFBVSxDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUNoRixPQUFPLEtBQUssQ0FBQztRQUNmLENBQUM7UUFDRCxPQUFPLGNBQWMsQ0FBQyxjQUFjLENBQUMsV0FBVyxFQUFFLFVBQVUsQ0FBQyxZQUFZLENBQUMsQ0FBQztJQUM3RSxDQUFDO0lBRU0sS0FBSyxDQUFDLGdCQUFnQixDQUFDLFlBQW9CLEVBQUUsUUFBaUM7UUFDbkYsTUFBTSxHQUFHLEdBQUcsTUFBTSxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLENBQUM7UUFDMUQsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQ1QsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDO1FBQ0QsSUFBSSxRQUFRLENBQUMsVUFBVSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3RDLEdBQUcsQ0FBQyxVQUFVLEdBQUcsUUFBUSxDQUFDLFVBQVUsQ0FBQztRQUN2QyxDQUFDO1FBQ0QsR0FBRyxDQUFDLFdBQVcsR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDN0IsR0FBRyxDQUFDLFNBQVMsR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDM0IsTUFBTSxHQUFHLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDakIsT0FBTyxHQUFHLENBQUMsU0FBUyxFQUFFLENBQUM7SUFDekIsQ0FBQztJQUVPLG9CQUFvQixDQUFDLGNBQXVDO1FBQ2xFLE9BQU8sQ0FBQyxHQUFHLElBQUksR0FBRyxDQUFDLGNBQWMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLFNBQVMsS0FBSyxPQUFPLElBQUksU0FBUyxLQUFLLFlBQVksQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNqSCxDQUFDO0NBQ0YifQ==

package/dist_ts_server/classes.oidc-userinfo-client.d.ts

@@ -0,0 +1,22 @@
+import * as plugins from './plugins.js';
+export interface IOidcUserInfoClientOptions {
+    issuer: string;
+    timeoutMs?: number;
+    maxResponseBytes?: number;
+}
+export interface IOidcUserInfoClientRequest {
+    token: string;
+    /** Subject already established by the application's verified OIDC login. */
+    subject: string;
+}
+export declare class OidcUserInfoError extends Error {
+    readonly code: 'invalid_request' | 'invalid_response' | 'unauthenticated' | 'unavailable';
+    constructor(code: 'invalid_request' | 'invalid_response' | 'unauthenticated' | 'unavailable');
+}
+/** Fetches display claims using a server-held token; results are never authorization grants. */
+export declare class OidcUserInfoClient {
+    #private;
+    constructor(optionsArg: IOidcUserInfoClientOptions);
+    getUserInfo(requestArg: IOidcUserInfoClientRequest): Promise<plugins.idpInterfaces.data.IUserInfoResponse>;
+    private validateResponse;
+}

package/dist_ts_server/classes.oidc-userinfo-client.js

@@ -0,0 +1,154 @@
+import * as plugins from './plugins.js';
+export class OidcUserInfoError extends Error {
+    code;
+    constructor(code) {
+        super(`OIDC userinfo ${code.replace(/_/g, ' ')}.`);
+        this.code = code;
+        this.name = 'OidcUserInfoError';
+    }
+}
+const record = (valueArg) => valueArg !== null && typeof valueArg === 'object' && !Array.isArray(valueArg);
+const exactString = (valueArg, maximumArg = 512) => typeof valueArg === 'string' && valueArg.length > 0 && valueArg.length <= maximumArg
+    && valueArg.trim() === valueArg && !/[\u0000-\u001f\u007f]/.test(valueArg);
+const strings = (valueArg) => Array.isArray(valueArg) && valueArg.every((entryArg) => exactString(entryArg))
+    && new Set(valueArg).size === valueArg.length;
+/** Fetches display claims using a server-held token; results are never authorization grants. */
+export class OidcUserInfoClient {
+    #endpoint;
+    #timeoutMs;
+    #maxResponseBytes;
+    constructor(optionsArg) {
+        if (!optionsArg || !exactString(optionsArg.issuer, 2048))
+            throw new OidcUserInfoError('invalid_request');
+        let issuer;
+        try {
+            issuer = new URL(optionsArg.issuer);
+        }
+        catch {
+            throw new OidcUserInfoError('invalid_request');
+        }
+        const canonicalIssuer = issuer.origin + (issuer.pathname === '/' ? '' : issuer.pathname);
+        if (issuer.protocol !== 'https:' || issuer.username || issuer.password || issuer.search || issuer.hash
+            || issuer.pathname.includes('//') || issuer.pathname.endsWith('/') && issuer.pathname !== '/'
+            || canonicalIssuer !== optionsArg.issuer)
+            throw new OidcUserInfoError('invalid_request');
+        this.#timeoutMs = optionsArg.timeoutMs ?? 5000;
+        this.#maxResponseBytes = optionsArg.maxResponseBytes ?? 65536;
+        if (!Number.isSafeInteger(this.#timeoutMs) || this.#timeoutMs < 1 || this.#timeoutMs > 30000
+            || !Number.isSafeInteger(this.#maxResponseBytes) || this.#maxResponseBytes < 1 || this.#maxResponseBytes > 1048576) {
+            throw new OidcUserInfoError('invalid_request');
+        }
+        this.#endpoint = `${canonicalIssuer}/oauth/userinfo`;
+    }
+    async getUserInfo(requestArg) {
+        if (!requestArg || !exactString(requestArg.subject) || !exactString(requestArg.token, 16384)
+            || !/^[A-Za-z0-9\-._~+/]+=*$/.test(requestArg.token))
+            throw new OidcUserInfoError('invalid_request');
+        // Snapshot the principal and token before any asynchronous work.
+        const { token, subject } = requestArg;
+        const controller = new AbortController();
+        let timer;
+        const deadline = new Promise((_resolveArg, rejectArg) => {
+            timer = setTimeout(() => {
+                controller.abort();
+                rejectArg(new OidcUserInfoError('unavailable'));
+            }, this.#timeoutMs);
+        });
+        let reader;
+        try {
+            const response = await Promise.race([fetch(this.#endpoint, {
+                    method: 'GET', redirect: 'error', credentials: 'omit', cache: 'no-store', signal: controller.signal,
+                    headers: { authorization: `Bearer ${token}`, accept: 'application/json' },
+                }), deadline]);
+            if (response.status === 401 || response.status === 403)
+                throw new OidcUserInfoError('unauthenticated');
+            if (response.status !== 200)
+                throw new OidcUserInfoError('unavailable');
+            if (response.headers.get('content-type')?.split(';')[0].trim().toLowerCase() !== 'application/json'
+                || !response.headers.get('cache-control')?.toLowerCase().split(',').map((partArg) => partArg.trim()).includes('no-store')
+                || !response.body)
+                throw new OidcUserInfoError('invalid_response');
+            const contentLength = response.headers.get('content-length');
+            if (contentLength !== null && (!/^\d+$/.test(contentLength) || Number(contentLength) > this.#maxResponseBytes)) {
+                throw new OidcUserInfoError('invalid_response');
+            }
+            reader = response.body.getReader();
+            const chunks = [];
+            let size = 0;
+            while (true) {
+                const part = await Promise.race([reader.read(), deadline]);
+                if (part.done)
+                    break;
+                size += part.value.byteLength;
+                if (size > this.#maxResponseBytes)
+                    throw new OidcUserInfoError('invalid_response');
+                chunks.push(part.value);
+            }
+            let value;
+            try {
+                value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks)));
+            }
+            catch {
+                throw new OidcUserInfoError('invalid_response');
+            }
+            return this.validateResponse(value, subject);
+        }
+        catch (errorArg) {
+            if (errorArg instanceof OidcUserInfoError)
+                throw errorArg;
+            // Transport errors can contain credentials, URLs or response bodies.
+            throw new OidcUserInfoError('unavailable');
+        }
+        finally {
+            clearTimeout(timer);
+            controller.abort();
+            if (reader)
+                void reader.cancel().catch(() => undefined);
+        }
+    }
+    validateResponse(valueArg, subjectArg) {
+        const invalid = () => new OidcUserInfoError('invalid_response');
+        if (!record(valueArg) || valueArg.sub !== subjectArg)
+            throw invalid();
+        const result = { sub: subjectArg };
+        for (const key of ['name', 'preferred_username', 'picture', 'email']) {
+            if (!Object.hasOwn(valueArg, key))
+                continue;
+            const value = valueArg[key];
+            if (typeof value !== 'string' || value.length > 4096)
+                throw invalid();
+            result[key] = value;
+        }
+        if (Object.hasOwn(valueArg, 'email_verified')) {
+            if (typeof valueArg.email_verified !== 'boolean')
+                throw invalid();
+            result.email_verified = valueArg.email_verified;
+        }
+        for (const key of ['roles', 'app_roles', 'app_permissions', 'app_scopes']) {
+            if (!Object.hasOwn(valueArg, key))
+                continue;
+            const value = valueArg[key];
+            if (!strings(value))
+                throw invalid();
+            result[key] = [...value];
+        }
+        if (Object.hasOwn(valueArg, 'organizations')) {
+            if (!Array.isArray(valueArg.organizations))
+                throw invalid();
+            const seen = new Set();
+            result.organizations = valueArg.organizations.map((organizationArg) => {
+                if (!record(organizationArg) || !exactString(organizationArg.id)
+                    || typeof organizationArg.name !== 'string' || organizationArg.name.length > 4096
+                    || !exactString(organizationArg.slug) || !strings(organizationArg.roles)
+                    || seen.has(organizationArg.id)
+                    || Object.keys(organizationArg).some((keyArg) => !['id', 'name', 'slug', 'roles'].includes(keyArg)))
+                    throw invalid();
+                seen.add(organizationArg.id);
+                return { id: organizationArg.id, name: organizationArg.name, slug: organizationArg.slug, roles: [...organizationArg.roles] };
+            });
+        }
+        // OIDC allows additional claims; only the documented, validated fields leave the SDK.
+        return result;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5vaWRjLXVzZXJpbmZvLWNsaWVudC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzX3NlcnZlci9jbGFzc2VzLm9pZGMtdXNlcmluZm8tY2xpZW50LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sY0FBYyxDQUFDO0FBY3hDLE1BQU0sT0FBTyxpQkFBa0IsU0FBUSxLQUFLO0lBQ2Q7SUFBNUIsWUFBNEIsSUFBZ0Y7UUFDMUcsS0FBSyxDQUFDLGlCQUFpQixJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7UUFEekIsU0FBSSxHQUFKLElBQUksQ0FBNEU7UUFFMUcsSUFBSSxDQUFDLElBQUksR0FBRyxtQkFBbUIsQ0FBQztJQUNsQyxDQUFDO0NBQ0Y7QUFFRCxNQUFNLE1BQU0sR0FBRyxDQUFDLFFBQWlCLEVBQXVDLEVBQUUsQ0FDeEUsUUFBUSxLQUFLLElBQUksSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBQ2hGLE1BQU0sV0FBVyxHQUFHLENBQUMsUUFBaUIsRUFBRSxVQUFVLEdBQUcsR0FBRyxFQUFzQixFQUFFLENBQzlFLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUMsSUFBSSxRQUFRLENBQUMsTUFBTSxJQUFJLFVBQVU7T0FDakYsUUFBUSxDQUFDLElBQUksRUFBRSxLQUFLLFFBQVEsSUFBSSxDQUFDLHVCQUF1QixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUM3RSxNQUFNLE9BQU8sR0FBRyxDQUFDLFFBQWlCLEVBQXdCLEVBQUUsQ0FDMUQsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsSUFBSSxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLENBQUM7T0FDM0UsSUFBSSxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUMsSUFBSSxLQUFLLFFBQVEsQ0FBQyxNQUFNLENBQUM7QUFFaEQsZ0dBQWdHO0FBQ2hHLE1BQU0sT0FBTyxrQkFBa0I7SUFDcEIsU0FBUyxDQUFTO0lBQ2xCLFVBQVUsQ0FBUztJQUNuQixpQkFBaUIsQ0FBUztJQUVuQyxZQUFZLFVBQXNDO1FBQ2hELElBQUksQ0FBQyxVQUFVLElBQUksQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDLE1BQU0sRUFBRSxJQUFJLENBQUM7WUFBRSxNQUFNLElBQUksaUJBQWlCLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUN6RyxJQUFJLE1BQVcsQ0FBQztRQUNoQixJQUFJLENBQUM7WUFBQyxNQUFNLEdBQUcsSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQUMsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUFDLE1BQU0sSUFBSSxpQkFBaUIsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO1FBQUMsQ0FBQztRQUN0RyxNQUFNLGVBQWUsR0FBRyxNQUFNLENBQUMsTUFBTSxHQUFHLENBQUMsTUFBTSxDQUFDLFFBQVEsS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ3pGLElBQUksTUFBTSxDQUFDLFFBQVEsS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLFFBQVEsSUFBSSxNQUFNLENBQUMsUUFBUSxJQUFJLE1BQU0sQ0FBQyxNQUFNLElBQUksTUFBTSxDQUFDLElBQUk7ZUFDakcsTUFBTSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksTUFBTSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLElBQUksTUFBTSxDQUFDLFFBQVEsS0FBSyxHQUFHO2VBQzFGLGVBQWUsS0FBSyxVQUFVLENBQUMsTUFBTTtZQUFFLE1BQU0sSUFBSSxpQkFBaUIsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO1FBQzNGLElBQUksQ0FBQyxVQUFVLEdBQUcsVUFBVSxDQUFDLFNBQVMsSUFBSSxJQUFJLENBQUM7UUFDL0MsSUFBSSxDQUFDLGlCQUFpQixHQUFHLFVBQVUsQ0FBQyxnQkFBZ0IsSUFBSSxLQUFLLENBQUM7UUFDOUQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLElBQUksQ0FBQyxVQUFVLEdBQUcsQ0FBQyxJQUFJLElBQUksQ0FBQyxVQUFVLEdBQUcsS0FBSztlQUN2RixDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLGlCQUFpQixDQUFDLElBQUksSUFBSSxDQUFDLGlCQUFpQixHQUFHLENBQUMsSUFBSSxJQUFJLENBQUMsaUJBQWlCLEdBQUcsT0FBTyxFQUFFLENBQUM7WUFDckgsTUFBTSxJQUFJLGlCQUFpQixDQUFDLGlCQUFpQixDQUFDLENBQUM7UUFDakQsQ0FBQztRQUNELElBQUksQ0FBQyxTQUFTLEdBQUcsR0FBRyxlQUFlLGlCQUFpQixDQUFDO0lBQ3ZELENBQUM7SUFFTSxLQUFLLENBQUMsV0FBVyxDQUFDLFVBQXNDO1FBQzdELElBQUksQ0FBQyxVQUFVLElBQUksQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFDO2VBQ3ZGLENBQUMseUJBQXlCLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUM7WUFBRSxNQUFNLElBQUksaUJBQWlCLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUN2RyxpRUFBaUU7UUFDakUsTUFBTSxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsR0FBRyxVQUFVLENBQUM7UUFDdEMsTUFBTSxVQUFVLEdBQUcsSUFBSSxlQUFlLEVBQUUsQ0FBQztRQUN6QyxJQUFJLEtBQW9DLENBQUM7UUFDekMsTUFBTSxRQUFRLEdBQUcsSUFBSSxPQUFPLENBQVEsQ0FBQyxXQUFXLEVBQUUsU0FBUyxFQUFFLEVBQUU7WUFDN0QsS0FBSyxHQUFHLFVBQVUsQ0FBQyxHQUFHLEVBQUU7Z0JBQ3RCLFVBQVUsQ0FBQyxLQUFLLEVBQUUsQ0FBQztnQkFDbkIsU0FBUyxDQUFDLElBQUksaUJBQWlCLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQztZQUNsRCxDQUFDLEVBQUUsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQ3RCLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxNQUEyRCxDQUFDO1FBQ2hFLElBQUksQ0FBQztZQUNILE1BQU0sUUFBUSxHQUFHLE1BQU0sT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFO29CQUN6RCxNQUFNLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsV0FBVyxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFLE1BQU0sRUFBRSxVQUFVLENBQUMsTUFBTTtvQkFDbkcsT0FBTyxFQUFFLEVBQUUsYUFBYSxFQUFFLFVBQVUsS0FBSyxFQUFFLEVBQUUsTUFBTSxFQUFFLGtCQUFrQixFQUFFO2lCQUMxRSxDQUFDLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztZQUNmLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxHQUFHLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxHQUFHO2dCQUFFLE1BQU0sSUFBSSxpQkFBaUIsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO1lBQ3ZHLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxHQUFHO2dCQUFFLE1BQU0sSUFBSSxpQkFBaUIsQ0FBQyxhQUFhLENBQUMsQ0FBQztZQUN4RSxJQUFJLFFBQVEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLGNBQWMsQ0FBQyxFQUFFLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxXQUFXLEVBQUUsS0FBSyxrQkFBa0I7bUJBQzlGLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsZUFBZSxDQUFDLEVBQUUsV0FBVyxFQUFFLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQzttQkFDdEgsQ0FBQyxRQUFRLENBQUMsSUFBSTtnQkFBRSxNQUFNLElBQUksaUJBQWlCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztZQUNyRSxNQUFNLGFBQWEsR0FBRyxRQUFRLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1lBQzdELElBQUksYUFBYSxLQUFLLElBQUksSUFBSSxDQUFDLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsSUFBSSxNQUFNLENBQUMsYUFBYSxDQUFDLEdBQUcsSUFBSSxDQUFDLGlCQUFpQixDQUFDLEVBQUUsQ0FBQztnQkFDL0csTUFBTSxJQUFJLGlCQUFpQixDQUFDLGtCQUFrQixDQUFDLENBQUM7WUFDbEQsQ0FBQztZQUNELE1BQU0sR0FBRyxRQUFRLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1lBQ25DLE1BQU0sTUFBTSxHQUFpQixFQUFFLENBQUM7WUFDaEMsSUFBSSxJQUFJLEdBQUcsQ0FBQyxDQUFDO1lBQ2IsT0FBTyxJQUFJLEVBQUUsQ0FBQztnQkFDWixNQUFNLElBQUksR0FBRyxNQUFNLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztnQkFDM0QsSUFBSSxJQUFJLENBQUMsSUFBSTtvQkFBRSxNQUFNO2dCQUNyQixJQUFJLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUM7Z0JBQzlCLElBQUksSUFBSSxHQUFHLElBQUksQ0FBQyxpQkFBaUI7b0JBQUUsTUFBTSxJQUFJLGlCQUFpQixDQUFDLGtCQUFrQixDQUFDLENBQUM7Z0JBQ25GLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQzFCLENBQUM7WUFDRCxJQUFJLEtBQWMsQ0FBQztZQUNuQixJQUFJLENBQUM7Z0JBQUMsS0FBSyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxXQUFXLENBQUMsT0FBTyxFQUFFLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQUMsQ0FBQztZQUNwRyxNQUFNLENBQUM7Z0JBQUMsTUFBTSxJQUFJLGlCQUFpQixDQUFDLGtCQUFrQixDQUFDLENBQUM7WUFBQyxDQUFDO1lBQzFELE9BQU8sSUFBSSxDQUFDLGdCQUFnQixDQUFDLEtBQUssRUFBRSxPQUFPLENBQUMsQ0FBQztRQUMvQyxDQUFDO1FBQUMsT0FBTyxRQUFRLEVBQUUsQ0FBQztZQUNsQixJQUFJLFFBQVEsWUFBWSxpQkFBaUI7Z0JBQUUsTUFBTSxRQUFRLENBQUM7WUFDMUQscUVBQXFFO1lBQ3JFLE1BQU0sSUFBSSxpQkFBaUIsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUM3QyxDQUFDO2dCQUFTLENBQUM7WUFDVCxZQUFZLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDcEIsVUFBVSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQ25CLElBQUksTUFBTTtnQkFBRSxLQUFLLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDMUQsQ0FBQztJQUNILENBQUM7SUFFTyxnQkFBZ0IsQ0FBQyxRQUFpQixFQUFFLFVBQWtCO1FBQzVELE1BQU0sT0FBTyxHQUFHLEdBQUcsRUFBRSxDQUFDLElBQUksaUJBQWlCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztRQUNoRSxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxJQUFJLFFBQVEsQ0FBQyxHQUFHLEtBQUssVUFBVTtZQUFFLE1BQU0sT0FBTyxFQUFFLENBQUM7UUFDdEUsTUFBTSxNQUFNLEdBQWlELEVBQUUsR0FBRyxFQUFFLFVBQVUsRUFBRSxDQUFDO1FBQ2pGLEtBQUssTUFBTSxHQUFHLElBQUksQ0FBQyxNQUFNLEVBQUUsb0JBQW9CLEVBQUUsU0FBUyxFQUFFLE9BQU8sQ0FBVSxFQUFFLENBQUM7WUFDOUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFLEdBQUcsQ0FBQztnQkFBRSxTQUFTO1lBQzVDLE1BQU0sS0FBSyxHQUFHLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUM1QixJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsTUFBTSxHQUFHLElBQUk7Z0JBQUUsTUFBTSxPQUFPLEVBQUUsQ0FBQztZQUN0RSxNQUFNLENBQUMsR0FBRyxDQUFDLEdBQUcsS0FBSyxDQUFDO1FBQ3RCLENBQUM7UUFDRCxJQUFJLE1BQU0sQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFLGdCQUFnQixDQUFDLEVBQUUsQ0FBQztZQUM5QyxJQUFJLE9BQU8sUUFBUSxDQUFDLGNBQWMsS0FBSyxTQUFTO2dCQUFFLE1BQU0sT0FBTyxFQUFFLENBQUM7WUFDbEUsTUFBTSxDQUFDLGNBQWMsR0FBRyxRQUFRLENBQUMsY0FBYyxDQUFDO1FBQ2xELENBQUM7UUFDRCxLQUFLLE1BQU0sR0FBRyxJQUFJLENBQUMsT0FBTyxFQUFFLFdBQVcsRUFBRSxpQkFBaUIsRUFBRSxZQUFZLENBQVUsRUFBRSxDQUFDO1lBQ25GLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFFBQVEsRUFBRSxHQUFHLENBQUM7Z0JBQUUsU0FBUztZQUM1QyxNQUFNLEtBQUssR0FBRyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDNUIsSUFBSSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUM7Z0JBQUUsTUFBTSxPQUFPLEVBQUUsQ0FBQztZQUNyQyxNQUFNLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxHQUFHLEtBQUssQ0FBQyxDQUFDO1FBQzNCLENBQUM7UUFDRCxJQUFJLE1BQU0sQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFLGVBQWUsQ0FBQyxFQUFFLENBQUM7WUFDN0MsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLGFBQWEsQ0FBQztnQkFBRSxNQUFNLE9BQU8sRUFBRSxDQUFDO1lBQzVELE1BQU0sSUFBSSxHQUFHLElBQUksR0FBRyxFQUFVLENBQUM7WUFDL0IsTUFBTSxDQUFDLGFBQWEsR0FBRyxRQUFRLENBQUMsYUFBYSxDQUFDLEdBQUcsQ0FBQyxDQUFDLGVBQXdCLEVBQUUsRUFBRTtnQkFDN0UsSUFBSSxDQUFDLE1BQU0sQ0FBQyxlQUFlLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxlQUFlLENBQUMsRUFBRSxDQUFDO3VCQUMzRCxPQUFPLGVBQWUsQ0FBQyxJQUFJLEtBQUssUUFBUSxJQUFJLGVBQWUsQ0FBQyxJQUFJLENBQUMsTUFBTSxHQUFHLElBQUk7dUJBQzlFLENBQUMsV0FBVyxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxlQUFlLENBQUMsS0FBSyxDQUFDO3VCQUNyRSxJQUFJLENBQUMsR0FBRyxDQUFDLGVBQWUsQ0FBQyxFQUFFLENBQUM7dUJBQzVCLE1BQU0sQ0FBQyxJQUFJLENBQUMsZUFBZSxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBQUUsT0FBTyxDQUFDLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDO29CQUFFLE1BQU0sT0FBTyxFQUFFLENBQUM7Z0JBQ3ZILElBQUksQ0FBQyxHQUFHLENBQUMsZUFBZSxDQUFDLEVBQUUsQ0FBQyxDQUFDO2dCQUM3QixPQUFPLEVBQUUsRUFBRSxFQUFFLGVBQWUsQ0FBQyxFQUFFLEVBQUUsSUFBSSxFQUFFLGVBQWUsQ0FBQyxJQUFJLEVBQUUsSUFBSSxFQUFFLGVBQWUsQ0FBQyxJQUFJLEVBQUUsS0FBSyxFQUFFLENBQUMsR0FBRyxlQUFlLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUMvSCxDQUFDLENBQUMsQ0FBQztRQUNMLENBQUM7UUFDRCxzRkFBc0Y7UUFDdEYsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztDQUNGIn0=

package/dist_ts_server/index.d.ts

@@ -4,4 +4,5 @@ export * from './classes.account-doc.js';
 export * from './classes.account-store.js';
 export * from './classes.idp-global-server-client.js';
 export * from './classes.oidc-introspection-client.js';
+export * from './classes.oidc-userinfo-client.js';
 export * from './classes.password-hasher.js';

package/dist_ts_server/index.js

@@ -4,5 +4,6 @@ export * from './classes.account-doc.js';
 export * from './classes.account-store.js';
 export * from './classes.idp-global-server-client.js';
 export * from './classes.oidc-introspection-client.js';
+export * from './classes.oidc-userinfo-client.js';
 export * from './classes.password-hasher.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19zZXJ2ZXIvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYyxpQkFBaUIsQ0FBQztBQUNoQyxjQUFjLG1DQUFtQyxDQUFDO0FBQ2xELGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLHVDQUF1QyxDQUFDO0FBQ3RELGNBQWMsd0NBQXdDLENBQUM7QUFDdkQsY0FBYyw4QkFBOEIsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19zZXJ2ZXIvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYyxpQkFBaUIsQ0FBQztBQUNoQyxjQUFjLG1DQUFtQyxDQUFDO0FBQ2xELGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLHVDQUF1QyxDQUFDO0FBQ3RELGNBQWMsd0NBQXdDLENBQUM7QUFDdkQsY0FBYyxtQ0FBbUMsQ0FBQztBQUNsRCxjQUFjLDhCQUE4QixDQUFDIn0=

package/dist_ts_server/plugins.d.ts

@@ -5,6 +5,6 @@ export { idpInterfaces };
 import * as typedrequest from '@api.global/typedrequest';
 import * as typedsocket from '@api.global/typedsocket';
 export { typedrequest, typedsocket };
-import * as smartdata from '@push.rocks/smartdata';
+import * as nosqldb from '@lossless.org/client/nosqldb';
 import * as smartpromise from '@push.rocks/smartpromise';
-export { smartdata, smartpromise };
+export { nosqldb, smartpromise };

package/dist_ts_server/plugins.js

@@ -5,7 +5,7 @@ export { idpInterfaces };
 import * as typedrequest from '@api.global/typedrequest';
 import * as typedsocket from '@api.global/typedsocket';
 export { typedrequest, typedsocket };
-import * as smartdata from '@push.rocks/smartdata';
+import * as nosqldb from '@lossless.org/client/nosqldb';
 import * as smartpromise from '@push.rocks/smartpromise';
-export { smartdata, smartpromise };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzX3NlcnZlci9wbHVnaW5zLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxNQUFNLE1BQU0sUUFBUSxDQUFDO0FBRWpDLE9BQU8sRUFBRSxNQUFNLEVBQUUsQ0FBQztBQUVsQixPQUFPLEtBQUssYUFBYSxNQUFNLHdCQUF3QixDQUFDO0FBRXhELE9BQU8sRUFBRSxhQUFhLEVBQUUsQ0FBQztBQUV6QixPQUFPLEtBQUssWUFBWSxNQUFNLDBCQUEwQixDQUFDO0FBQ3pELE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFFdkQsT0FBTyxFQUFFLFlBQVksRUFBRSxXQUFXLEVBQUUsQ0FBQztBQUVyQyxPQUFPLEtBQUssU0FBUyxNQUFNLHVCQUF1QixDQUFDO0FBQ25ELE9BQU8sS0FBSyxZQUFZLE1BQU0sMEJBQTBCLENBQUM7QUFFekQsT0FBTyxFQUFFLFNBQVMsRUFBRSxZQUFZLEVBQUUsQ0FBQyJ9
+export { nosqldb, smartpromise };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzX3NlcnZlci9wbHVnaW5zLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxNQUFNLE1BQU0sUUFBUSxDQUFDO0FBRWpDLE9BQU8sRUFBRSxNQUFNLEVBQUUsQ0FBQztBQUVsQixPQUFPLEtBQUssYUFBYSxNQUFNLHdCQUF3QixDQUFDO0FBRXhELE9BQU8sRUFBRSxhQUFhLEVBQUUsQ0FBQztBQUV6QixPQUFPLEtBQUssWUFBWSxNQUFNLDBCQUEwQixDQUFDO0FBQ3pELE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFFdkQsT0FBTyxFQUFFLFlBQVksRUFBRSxXQUFXLEVBQUUsQ0FBQztBQUVyQyxPQUFPLEtBQUssT0FBTyxNQUFNLDhCQUE4QixDQUFDO0FBQ3hELE9BQU8sS0FBSyxZQUFZLE1BQU0sMEJBQTBCLENBQUM7QUFFekQsT0FBTyxFQUFFLE9BQU8sRUFBRSxZQUFZLEVBQUUsQ0FBQyJ9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@idp.global/sdk",
-  "version": "17.0.0",
+  "version": "18.0.0",
   "private": false,
   "description": "Reusable browser and server SDK for idp.global authentication.",
   "type": "module",
@@ -18,7 +18,6 @@
     "@api.global/typedrequest-interfaces": "^7.1.0",
     "@api.global/typedsocket": "^8.1.0",
     "@idp.global/interfaces": "^29.1.0",
-    "@push.rocks/smartdata": "^11.7.0",
     "@push.rocks/smartjson": "^6.0.1",
     "@push.rocks/smartpromise": "^4.2.4",
     "@push.rocks/smartrx": "^3.0.12",
@@ -28,14 +27,18 @@
     "@push.rocks/webjwt": "^1.0.10",
     "@push.rocks/webstore": "^2.1.0"
   },
+  "peerDependencies": {
+    "@lossless.org/client": ">=1.0.0 <2.0.0"
+  },
   "devDependencies": {
     "@api.global/typedserver": "^11.4.0",
-    "@git.zone/tsbuild": "^4.4.2",
+    "@git.zone/tsbuild": "^4.5.0",
     "@git.zone/tsdoc": "^2.2.0",
     "@git.zone/tsrun": "^2.0.6",
-    "@git.zone/tstest": "^5.0.0",
-    "@push.rocks/smartdb": "^7.0.1",
-    "@types/node": "26.4.1"
+    "@git.zone/tstest": "^6.1.1",
+    "@lossless.org/client": "^1.0.0",
+    "@lossless.org/nosqldb": "10.2.0",
+    "@types/node": "26.5.1"
   },
   "files": [
     "ts/**/*",
@@ -60,14 +63,14 @@
     "sdk",
     "authentication",
     "oidc",
-    "smartdata"
+    "nosqldb"
   ],
   "browserslist": [
     "last 1 Chrome versions"
   ],
   "scripts": {
     "test": "pnpm run build && tstest test/ --verbose --logfile --timeout 60",
-    "build": "tsbuild tsfolders --web --allowimplicitany",
+    "build": "tsbuild tsfolders --web",
     "buildDocs": "tsdoc"
   }
 }

package/readme.md

@@ -13,7 +13,7 @@ For reporting bugs, issues, or security vulnerabilities, please visit [community
 | Runtime | Import | What it does |
 | --- | --- | --- |
 | Browser | `@idp.global/sdk/browser` | SSO client, JWT and refresh-token storage, login redirects, logout, transfer-token exchange, and typed request shortcuts for user, organization, billing, OIDC, and admin flows. |
-| Server | `@idp.global/sdk/server` | Smartdata-backed account store, scrypt password hashing, local/idp.global account authentication, a server-side typed-socket client for idp.global password login, and confidential OIDC introspection. |
+| Server | `@idp.global/sdk/server` | NoSQL-backed account store, scrypt password hashing, local/idp.global account authentication, a server-side typed-socket client for idp.global password login, and confidential OIDC introspection. |
 
 ## Install
 
@@ -21,6 +21,13 @@ For reporting bugs, issues, or security vulnerabilities, please visit [community
 pnpm add @idp.global/sdk
 ```
 
+The server subpath additionally requires the peer dependency `@lossless.org/client`,
+which provides the `SmartdataDb` the account store persists through:
+
+```bash
+pnpm add @lossless.org/client
+```
+
 This is an ESM TypeScript package. Published builds expose declaration files and runtime JavaScript through package exports.
 
 Version 17 requires an IdP listener using TypedSocket 8 and TypedRequest 8
@@ -186,20 +193,24 @@ import {
 
 The server SDK is deliberately explicit: it never auto-creates accounts during authentication. Your application decides when an account exists, which auth sources it may use, and whether it is an `admin` or `user`.
 
-### Smartdata Account Store
+### Account Store
 
-`SmartdataAccountStore` persists accounts through `@push.rocks/smartdata` and the exported `IdpSdkAccountDoc` collection.
+`SmartdataAccountStore` persists accounts through `@lossless.org/client/nosqldb`
+and the exported `IdpSdkAccountDoc` collection.
 
-The server SDK requires SmartData 11.7 or newer within major 11. Applications
-that pass a `SmartdataDb` must use the same SmartData major. Existing SDK account
-documents and their `id_1` identity index retain their schema; this dependency
-migration does not transform stored accounts.
+`@lossless.org/client` is a required peer dependency within major 1. The
+`SmartdataDb` you pass must come from that package: the account document is
+decorated by the very same module, so a `SmartdataDb` from any other package is
+rejected at compile time and cannot resolve the model at runtime. Existing SDK
+account documents, their `id_1` identity index and their `scrypt:v1` password
+hashes retain their exact stored shape; this dependency migration does not
+transform stored accounts.
 
 ```ts
-import * as smartdata from '@push.rocks/smartdata';
+import * as nosqldb from '@lossless.org/client/nosqldb';
 import { SmartdataAccountStore } from '@idp.global/sdk/server';
 
-const smartdataDb = new smartdata.SmartdataDb({
+const smartdataDb = new nosqldb.SmartdataDb({
   mongoDbUrl: process.env.MONGODB_URL!,
   mongoDbName: 'my-app',
 });
@@ -338,20 +349,57 @@ existing login and principal binding and make a fresh observation for each
 operation requiring live authority. The response contains no identity profile
 or email-based organization inference.
 
+### Server-held OIDC UserInfo
+
+Use `OidcUserInfoClient` to obtain current profile and organization picker data
+with an access token held by your application's server session:
+
+```typescript
+import { OidcUserInfoClient } from '@idp.global/sdk/server';
+
+const userInfoClient = new OidcUserInfoClient({ issuer: 'https://idp.global' });
+const claims = await userInfoClient.getUserInfo({
+  token: serverSession.accessToken,
+  subject: serverSession.idpSubject,
+});
+const ownerOrganizations = claims.organizations?.filter((organization) =>
+  organization.roles.includes('owner')) ?? [];
+```
+
+The expected subject must come from the verified OIDC login. Keep the token
+server-side; the SDK sends it only in the bearer header to the issuer's
+`/oauth/userinfo` endpoint, rejects redirects, and validates the returned subject
+and documented claims. Unknown top-level OIDC extension claims are omitted.
+The client retains no access token or claim cache. Calls have a five-second
+deadline, including body reads, and a 64 KiB response limit. Options allow a
+deadline up to 30 seconds and a response limit up to 1 MiB.
+
+Organization claims are display data within the token's original organization
+grant. Newly granted organizations require a new OIDC login; removed memberships
+or app connections disappear from subsequent responses. Authorize each protected
+operation separately with fresh `OidcIntrospectionClient` introspection. UserInfo
+does not turn a picker selection or an observed role into an authorization grant.
+
+`OidcUserInfoError.code` is `invalid_request`, `invalid_response`,
+`unauthenticated`, or `unavailable`. Provider 401/403 responses indicate that the
+server-held token is no longer accepted. Errors omit token and provider content.
+
 ### Server API Surface
 
 | API | Description |
 | --- | --- |
-| `SmartdataAccountStore` | Smartdata-backed account persistence and local password verification. |
+| `SmartdataAccountStore` | NoSQL-backed account persistence and local password verification. |
 | `AccountAuthService` | Existing-account authentication orchestration for `local`, `idp.global`, and `auto`. |
 | `IdpGlobalServerClient` | Typed-socket client for idp.global password login, JWT refresh, `whoIs` lookup, backend JWT validation fetches, and JWT key/blocklist pushes. |
 | `OidcIntrospectionClient` | Confidential server client for an exact live organization authority observation. |
 | `OidcIntrospectionError` | Sanitized introspection failure with a stable error code. |
+| `OidcUserInfoClient` | Subject-bound profile and organization display claims using a server-held OIDC token. |
+| `OidcUserInfoError` | Sanitized UserInfo failure with a stable error code. |
 | `IdpMfaRequiredError` | Password-login error carrying the MFA challenge token and available factor methods. |
 | `defaultIdpGlobalBaseUrl` | Default hosted server origin: `https://app.idp.global`. |
 | `PasswordHasher` | Static `hashPassword()` and `verifyPassword()` helpers using `scrypt:v1`. |
-| `IdpSdkAccountDoc` | Smartdata document class backing persisted SDK accounts. |
-| `setAccountDocSmartdataDb()` | Configure the active Smartdata DB for `IdpSdkAccountDoc`. Usually handled by `SmartdataAccountStore`. |
+| `IdpSdkAccountDoc` | `@lossless.org/client/nosqldb` document class backing persisted SDK accounts. |
+| `setAccountDocSmartdataDb()` | Configure the active `SmartdataDb` for `IdpSdkAccountDoc`. Usually handled by `SmartdataAccountStore`. |
 
 ### Types
 
@@ -361,6 +409,8 @@ The server export includes these TypeScript types:
 | --- | --- |
 | `IOidcIntrospectionClientOptions` | Exact HTTPS issuer, confidential client credentials, and optional deadline/response limits. |
 | `IOidcIntrospectionClientRequest` | Server-held access token, exact subject, and canonical organization ID. |
+| `IOidcUserInfoClientOptions` | Exact HTTPS issuer and optional deadline/response limits. |
+| `IOidcUserInfoClientRequest` | Server-held access token and the subject established by verified OIDC login. |
 | `TIdpAccountAuthSource` | `'local' | 'idp.global'` |
 | `TIdpAccountRole` | `'admin' | 'user'` |
 | `TIdpAccountStatus` | `'active' | 'disabled'` |
@@ -380,7 +430,7 @@ import { IdpClient } from '@idp.global/sdk/browser';
 import { AccountAuthService } from '@idp.global/sdk/server';
 ```
 
-The SDK uses typed sockets and typed requests from `@api.global/*`, shared idp.global request contracts from `@idp.global/interfaces`, and focused Push Rocks utilities for URL handling, JSON/base64 encoding, observables, JWT decoding, browser storage, smartdata persistence, and promise coordination.
+The SDK uses typed sockets and typed requests from `@api.global/*`, shared idp.global request contracts from `@idp.global/interfaces`, NoSQL persistence from `@lossless.org/client/nosqldb`, and focused Push Rocks utilities for URL handling, JSON/base64 encoding, observables, JWT decoding, browser storage, and promise coordination.
 
 ## Testing
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@idp.global/sdk',
-  version: '17.0.0',
+  version: '18.0.0',
   description: 'Reusable browser and server SDK for idp.global authentication.'
 }

package/ts_server/classes.account-doc.ts

@@ -1,9 +1,9 @@
 import * as plugins from './plugins.js';
 import type { IIdpSdkAccount, TIdpAccountAuthSource, TIdpAccountRole, TIdpAccountStatus } from './interfaces.js';
 
-let activeSmartdataDb: plugins.smartdata.SmartdataDb | null = null;
+let activeSmartdataDb: plugins.nosqldb.SmartdataDb | null = null;
 
-export const setAccountDocSmartdataDb = (smartdataDbArg: plugins.smartdata.SmartdataDb) => {
+export const setAccountDocSmartdataDb = (smartdataDbArg: plugins.nosqldb.SmartdataDb) => {
   activeSmartdataDb = smartdataDbArg;
 };
 
@@ -14,43 +14,43 @@ const getDb = () => {
   return activeSmartdataDb;
 };
 
-@plugins.smartdata.Collection(() => getDb())
-export class IdpSdkAccountDoc extends plugins.smartdata.SmartDataDbDoc<IdpSdkAccountDoc, IdpSdkAccountDoc> {
-  @plugins.smartdata.unI()
-  @plugins.smartdata.svDb()
+@plugins.nosqldb.Collection(() => getDb())
+export class IdpSdkAccountDoc extends plugins.nosqldb.SmartDataDbDoc<IdpSdkAccountDoc, IdpSdkAccountDoc> {
+  @plugins.nosqldb.unI()
+  @plugins.nosqldb.svDb()
   public id!: string;
 
-  @plugins.smartdata.svDb()
+  @plugins.nosqldb.svDb()
   public email!: string;
 
-  @plugins.smartdata.svDb()
+  @plugins.nosqldb.svDb()
   public emailNormalized!: string;
 
-  @plugins.smartdata.svDb()
+  @plugins.nosqldb.svDb()
   public name: string = '';
 
-  @plugins.smartdata.svDb()
+  @plugins.nosqldb.svDb()
   public role!: TIdpAccountRole;
 
-  @plugins.smartdata.svDb()
+  @plugins.nosqldb.svDb()
   public status!: TIdpAccountStatus;
 
-  @plugins.smartdata.svDb()
+  @plugins.nosqldb.svDb()
   public authSources!: TIdpAccountAuthSource[];
 
-  @plugins.smartdata.svDb()
+  @plugins.nosqldb.svDb()
   public passwordHash?: string;
 
-  @plugins.smartdata.svDb()
+  @plugins.nosqldb.svDb()
   public idpSubject?: string;
 
-  @plugins.smartdata.svDb()
+  @plugins.nosqldb.svDb()
   public createdAt!: number;
 
-  @plugins.smartdata.svDb()
+  @plugins.nosqldb.svDb()
   public updatedAt!: number;
 
-  @plugins.smartdata.svDb()
+  @plugins.nosqldb.svDb()
   public lastLoginAt?: number;
 
   public toAccount(): IIdpSdkAccount {

package/ts_server/classes.account-store.ts

@@ -4,7 +4,7 @@ import { PasswordHasher } from './classes.password-hasher.js';
 import type { ICreateIdpSdkAccountOptions, IIdpSdkAccount, TIdpAccountAuthSource } from './interfaces.js';
 
 export class SmartdataAccountStore {
-  constructor(private optionsArg: { smartdataDb: plugins.smartdata.SmartdataDb }) {
+  constructor(private optionsArg: { smartdataDb: plugins.nosqldb.SmartdataDb }) {
     setAccountDocSmartdataDb(optionsArg.smartdataDb);
   }
 

package/ts_server/classes.oidc-userinfo-client.ts

@@ -0,0 +1,143 @@
+import * as plugins from './plugins.js';
+
+export interface IOidcUserInfoClientOptions {
+  issuer: string;
+  timeoutMs?: number;
+  maxResponseBytes?: number;
+}
+
+export interface IOidcUserInfoClientRequest {
+  token: string;
+  /** Subject already established by the application's verified OIDC login. */
+  subject: string;
+}
+
+export class OidcUserInfoError extends Error {
+  constructor(public readonly code: 'invalid_request' | 'invalid_response' | 'unauthenticated' | 'unavailable') {
+    super(`OIDC userinfo ${code.replace(/_/g, ' ')}.`);
+    this.name = 'OidcUserInfoError';
+  }
+}
+
+const record = (valueArg: unknown): valueArg is Record<string, unknown> =>
+  valueArg !== null && typeof valueArg === 'object' && !Array.isArray(valueArg);
+const exactString = (valueArg: unknown, maximumArg = 512): valueArg is string =>
+  typeof valueArg === 'string' && valueArg.length > 0 && valueArg.length <= maximumArg
+  && valueArg.trim() === valueArg && !/[\u0000-\u001f\u007f]/.test(valueArg);
+const strings = (valueArg: unknown): valueArg is string[] =>
+  Array.isArray(valueArg) && valueArg.every((entryArg) => exactString(entryArg))
+  && new Set(valueArg).size === valueArg.length;
+
+/** Fetches display claims using a server-held token; results are never authorization grants. */
+export class OidcUserInfoClient {
+  readonly #endpoint: string;
+  readonly #timeoutMs: number;
+  readonly #maxResponseBytes: number;
+
+  constructor(optionsArg: IOidcUserInfoClientOptions) {
+    if (!optionsArg || !exactString(optionsArg.issuer, 2048)) throw new OidcUserInfoError('invalid_request');
+    let issuer: URL;
+    try { issuer = new URL(optionsArg.issuer); } catch { throw new OidcUserInfoError('invalid_request'); }
+    const canonicalIssuer = issuer.origin + (issuer.pathname === '/' ? '' : issuer.pathname);
+    if (issuer.protocol !== 'https:' || issuer.username || issuer.password || issuer.search || issuer.hash
+      || issuer.pathname.includes('//') || issuer.pathname.endsWith('/') && issuer.pathname !== '/'
+      || canonicalIssuer !== optionsArg.issuer) throw new OidcUserInfoError('invalid_request');
+    this.#timeoutMs = optionsArg.timeoutMs ?? 5000;
+    this.#maxResponseBytes = optionsArg.maxResponseBytes ?? 65536;
+    if (!Number.isSafeInteger(this.#timeoutMs) || this.#timeoutMs < 1 || this.#timeoutMs > 30000
+      || !Number.isSafeInteger(this.#maxResponseBytes) || this.#maxResponseBytes < 1 || this.#maxResponseBytes > 1048576) {
+      throw new OidcUserInfoError('invalid_request');
+    }
+    this.#endpoint = `${canonicalIssuer}/oauth/userinfo`;
+  }
+
+  public async getUserInfo(requestArg: IOidcUserInfoClientRequest): Promise<plugins.idpInterfaces.data.IUserInfoResponse> {
+    if (!requestArg || !exactString(requestArg.subject) || !exactString(requestArg.token, 16384)
+      || !/^[A-Za-z0-9\-._~+/]+=*$/.test(requestArg.token)) throw new OidcUserInfoError('invalid_request');
+    // Snapshot the principal and token before any asynchronous work.
+    const { token, subject } = requestArg;
+    const controller = new AbortController();
+    let timer: ReturnType<typeof setTimeout>;
+    const deadline = new Promise<never>((_resolveArg, rejectArg) => {
+      timer = setTimeout(() => {
+        controller.abort();
+        rejectArg(new OidcUserInfoError('unavailable'));
+      }, this.#timeoutMs);
+    });
+    let reader: ReadableStreamDefaultReader<Uint8Array> | undefined;
+    try {
+      const response = await Promise.race([fetch(this.#endpoint, {
+        method: 'GET', redirect: 'error', credentials: 'omit', cache: 'no-store', signal: controller.signal,
+        headers: { authorization: `Bearer ${token}`, accept: 'application/json' },
+      }), deadline]);
+      if (response.status === 401 || response.status === 403) throw new OidcUserInfoError('unauthenticated');
+      if (response.status !== 200) throw new OidcUserInfoError('unavailable');
+      if (response.headers.get('content-type')?.split(';')[0].trim().toLowerCase() !== 'application/json'
+        || !response.headers.get('cache-control')?.toLowerCase().split(',').map((partArg) => partArg.trim()).includes('no-store')
+        || !response.body) throw new OidcUserInfoError('invalid_response');
+      const contentLength = response.headers.get('content-length');
+      if (contentLength !== null && (!/^\d+$/.test(contentLength) || Number(contentLength) > this.#maxResponseBytes)) {
+        throw new OidcUserInfoError('invalid_response');
+      }
+      reader = response.body.getReader();
+      const chunks: Uint8Array[] = [];
+      let size = 0;
+      while (true) {
+        const part = await Promise.race([reader.read(), deadline]);
+        if (part.done) break;
+        size += part.value.byteLength;
+        if (size > this.#maxResponseBytes) throw new OidcUserInfoError('invalid_response');
+        chunks.push(part.value);
+      }
+      let value: unknown;
+      try { value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks))); }
+      catch { throw new OidcUserInfoError('invalid_response'); }
+      return this.validateResponse(value, subject);
+    } catch (errorArg) {
+      if (errorArg instanceof OidcUserInfoError) throw errorArg;
+      // Transport errors can contain credentials, URLs or response bodies.
+      throw new OidcUserInfoError('unavailable');
+    } finally {
+      clearTimeout(timer);
+      controller.abort();
+      if (reader) void reader.cancel().catch(() => undefined);
+    }
+  }
+
+  private validateResponse(valueArg: unknown, subjectArg: string): plugins.idpInterfaces.data.IUserInfoResponse {
+    const invalid = () => new OidcUserInfoError('invalid_response');
+    if (!record(valueArg) || valueArg.sub !== subjectArg) throw invalid();
+    const result: plugins.idpInterfaces.data.IUserInfoResponse = { sub: subjectArg };
+    for (const key of ['name', 'preferred_username', 'picture', 'email'] as const) {
+      if (!Object.hasOwn(valueArg, key)) continue;
+      const value = valueArg[key];
+      if (typeof value !== 'string' || value.length > 4096) throw invalid();
+      result[key] = value;
+    }
+    if (Object.hasOwn(valueArg, 'email_verified')) {
+      if (typeof valueArg.email_verified !== 'boolean') throw invalid();
+      result.email_verified = valueArg.email_verified;
+    }
+    for (const key of ['roles', 'app_roles', 'app_permissions', 'app_scopes'] as const) {
+      if (!Object.hasOwn(valueArg, key)) continue;
+      const value = valueArg[key];
+      if (!strings(value)) throw invalid();
+      result[key] = [...value];
+    }
+    if (Object.hasOwn(valueArg, 'organizations')) {
+      if (!Array.isArray(valueArg.organizations)) throw invalid();
+      const seen = new Set<string>();
+      result.organizations = valueArg.organizations.map((organizationArg: unknown) => {
+        if (!record(organizationArg) || !exactString(organizationArg.id)
+          || typeof organizationArg.name !== 'string' || organizationArg.name.length > 4096
+          || !exactString(organizationArg.slug) || !strings(organizationArg.roles)
+          || seen.has(organizationArg.id)
+          || Object.keys(organizationArg).some((keyArg) => !['id', 'name', 'slug', 'roles'].includes(keyArg))) throw invalid();
+        seen.add(organizationArg.id);
+        return { id: organizationArg.id, name: organizationArg.name, slug: organizationArg.slug, roles: [...organizationArg.roles] };
+      });
+    }
+    // OIDC allows additional claims; only the documented, validated fields leave the SDK.
+    return result;
+  }
+}

package/ts_server/index.ts

@@ -4,4 +4,5 @@ export * from './classes.account-doc.js';
 export * from './classes.account-store.js';
 export * from './classes.idp-global-server-client.js';
 export * from './classes.oidc-introspection-client.js';
+export * from './classes.oidc-userinfo-client.js';
 export * from './classes.password-hasher.js';

package/ts_server/plugins.ts

@@ -11,7 +11,7 @@ import * as typedsocket from '@api.global/typedsocket';
 
 export { typedrequest, typedsocket };
 
-import * as smartdata from '@push.rocks/smartdata';
+import * as nosqldb from '@lossless.org/client/nosqldb';
 import * as smartpromise from '@push.rocks/smartpromise';
 
-export { smartdata, smartpromise };
+export { nosqldb, smartpromise };