@absolutejs/auth 0.29.3 → 0.30.0-beta.1

package/dist/credentials/config.d.ts

@@ -26,6 +26,8 @@ export type CredentialsConfig<UserType> = {
         headers: Record<string, string | undefined>;
         ip?: string;
     }) => boolean | Promise<boolean>;
+    passwordVerifier?: (plainPassword: string, storedHash: string) => Promise<boolean>;
+    rehashOnLogin?: boolean;
     loginRoute?: RouteString;
     onCreateCredentialUser: (identity: CredentialIdentity & Record<string, unknown>) => Promise<Response | StatusReturn | UserType> | Response | StatusReturn | UserType;
     onCredentialsLoginError?: (context: {

package/dist/credentials/import.d.ts

@@ -0,0 +1,34 @@
+import type { CredentialRecord, CredentialStore } from './types';
+export type ImportableUser<UserType> = {
+    passwordHash?: string;
+    user: UserType;
+};
+export type ImportUserResult<UserType> = {
+    error: string;
+    ok: false;
+    user: UserType;
+} | {
+    credential?: CredentialRecord;
+    ok: true;
+    user: UserType;
+};
+export type ImportUsersOptions<UserType> = {
+    onCreateUser: (input: ImportableUser<UserType>) => Promise<{
+        email: string;
+        emailVerified?: boolean;
+        userId?: string;
+    } | null>;
+    concurrency?: number;
+    credentialStore: CredentialStore;
+};
+export declare const importUser: <UserType>(input: ImportableUser<UserType>, options: ImportUsersOptions<UserType>) => Promise<ImportUserResult<UserType>>;
+export declare const importUsers: <UserType>(inputs: readonly ImportableUser<UserType>[], options: ImportUsersOptions<UserType>) => Promise<{
+    failed: number;
+    results: ImportUserResult<UserType>[];
+    succeeded: number;
+}>;
+export declare const rehashCredentialPassword: ({ credentialStore, current, plainPassword }: {
+    credentialStore: CredentialStore;
+    current: CredentialRecord;
+    plainPassword: string;
+}) => Promise<void>;

package/dist/credentials/legacyHashers.d.ts

@@ -0,0 +1,3 @@
+export declare const isLegacyHash: (storedHash: string) => boolean;
+export declare const verifyAuth0Pbkdf2: (plainPassword: string, wrappedHash: string) => Promise<boolean>;
+export declare const verifyCognitoSha256: (plainPassword: string, wrappedHash: string) => Promise<boolean>;

package/dist/credentials/login.d.ts

@@ -1,6 +1,6 @@
 import { Elysia } from 'elysia';
 import { type CredentialRouteProps } from './config';
-export declare const credentialsLogin: <UserType>({ authSessionStore, checkBreachesOnLogin, credentialStore, getUserByEmail, isMfaRequired, lockoutGuard, loginRoute, onCredentialsLoginError, onCredentialsLoginSuccess, requireEmailVerification, sessionDurationMs }: CredentialRouteProps<UserType>) => Elysia<"", {
+export declare const credentialsLogin: <UserType>({ authSessionStore, checkBreachesOnLogin, credentialStore, getUserByEmail, isMfaRequired, lockoutGuard, loginRoute, onCredentialsLoginError, onCredentialsLoginSuccess, passwordVerifier, rehashOnLogin, requireEmailVerification, sessionDurationMs }: CredentialRouteProps<UserType>) => Elysia<"", {
     decorator: {};
     store: {
         session: import("..").SessionRecord<UserType>;

package/dist/index.d.ts

@@ -13458,6 +13458,9 @@ export declare const auth: <UserType>({ providersConfiguration, authorizeRoute,
                 acr_values?: string | undefined;
                 code_challenge?: string | undefined;
                 code_challenge_method?: string | undefined;
+                id_token_hint?: string | undefined;
+                max_age?: string | undefined;
+                prompt?: string | undefined;
                 request_uri?: string | undefined;
                 response_type?: string | undefined;
                 state?: string | undefined;
@@ -13667,8 +13670,8 @@ export declare const auth: <UserType>({ providersConfiguration, authorizeRoute,
             params: {};
             query: {
                 client_id?: string | undefined;
-                state?: string | undefined;
                 id_token_hint?: string | undefined;
+                state?: string | undefined;
                 post_logout_redirect_uri?: string | undefined;
             };
             headers: unknown;
@@ -13691,8 +13694,8 @@ export declare const auth: <UserType>({ providersConfiguration, authorizeRoute,
         post: {
             body: {
                 client_id?: string | undefined;
-                state?: string | undefined;
                 id_token_hint?: string | undefined;
+                state?: string | undefined;
                 post_logout_redirect_uri?: string | undefined;
             };
             params: {};
@@ -13832,6 +13835,54 @@ export declare const auth: <UserType>({ providersConfiguration, authorizeRoute,
             };
         };
     };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: {
+                authorization?: string | undefined;
+            };
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                access_token?: string | undefined;
+            };
+            params: {};
+            query: unknown;
+            headers: {
+                authorization?: string | undefined;
+            };
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
 } & {
     [x: string]: {
         get: {
@@ -14999,6 +15050,9 @@ export * from './tenancy';
 export * from './credentials/config';
 export * from './credentials/passwordPolicy';
 export * from './credentials/emailValidation';
+export { importUser, importUsers, rehashCredentialPassword } from './credentials/import';
+export type { ImportUserResult, ImportUsersOptions, ImportableUser } from './credentials/import';
+export { isLegacyHash, verifyAuth0Pbkdf2, verifyCognitoSha256 } from './credentials/legacyHashers';
 export * from './credentials/types';
 export { credentialRoutes } from './credentials/routes';
 export { credentialsEmailVerification } from './credentials/emailVerification';
@@ -15067,6 +15121,8 @@ export type { DpopResult } from './oidc/dpop';
 export { CLIENT_ASSERTION_TYPE, verifyClientAssertion } from './oidc/clientAuth';
 export { createInMemoryAuthorizationCodeStore, createInMemoryClientAssertionJtiStore, createInMemoryClientRegistrationTokenStore, createInMemoryDeviceAuthorizationStore, createInMemoryInitialAccessTokenStore, createInMemoryLogoutDeliveryStore, createInMemoryOAuthClientStore, createInMemoryOidcRefreshTokenStore, createInMemoryPushedAuthorizationRequestStore } from './oidc/inMemoryStores';
 export { consumePushedRequest, pushAuthorizationRequest, DEFAULT_PAR_TTL_MS, REQUEST_URI_PREFIX } from './oidc/par';
+export { fetchUserInfo, readUserInfoBearer, userInfoChallengeHeader } from './oidc/userinfo';
+export type { UserInfoResult } from './oidc/userinfo';
 export { fanOutBackchannelLogout, mintLogoutToken, resolvePostLogoutRedirect, verifyIdTokenHint } from './oidc/logout';
 export { createNeonAuthorizationCodeStore, createNeonClientAssertionJtiStore, createNeonClientRegistrationTokenStore, createNeonDeviceAuthorizationStore, createNeonInitialAccessTokenStore, createNeonLogoutDeliveryStore, createNeonOAuthClientStore, createNeonOidcRefreshTokenStore, createNeonPushedAuthorizationRequestStore, createPostgresAuthorizationCodeStore, createPostgresClientAssertionJtiStore, createPostgresClientRegistrationTokenStore, createPostgresDeviceAuthorizationStore, createPostgresInitialAccessTokenStore, createPostgresLogoutDeliveryStore, createPostgresOAuthClientStore, createPostgresOidcRefreshTokenStore, createPostgresPushedAuthorizationRequestStore, oauthClientAssertionJtisTable, oauthClientRegistrationTokensTable, oauthClientsTable, oauthCodesTable, oauthDeviceAuthorizationsTable, oauthInitialAccessTokensTable, oauthLogoutDeliveriesTable, oauthPushedAuthorizationRequestsTable, oauthRefreshTokensTable } from './oidc/postgresStores';
 export { deleteRegisteredClient, getRegisteredClient, registerClient, updateRegisteredClient, type ClientRegistrationDecision, type ClientRegistrationMetadata, type OnClientRegistration, type RegisterClientResult } from './oidc/registration';

package/dist/index.js

@@ -3392,6 +3392,110 @@ var credentialsEmailVerification = ({
 // src/credentials/login.ts
 import { Elysia as Elysia6, t as t6 } from "elysia";
 
+// src/credentials/import.ts
+var normalizeEmail = (email) => email.trim().toLowerCase();
+var buildCredential = (email, emailVerified, passwordHash, userId) => ({
+  createdAt: Date.now(),
+  email,
+  emailVerified,
+  passwordHash,
+  status: "active",
+  updatedAt: Date.now(),
+  userId
+});
+var importUser = async (input, options) => {
+  try {
+    const created = await options.onCreateUser(input);
+    if (created === null)
+      return {
+        error: "onCreateUser returned null",
+        ok: false,
+        user: input.user
+      };
+    const email = normalizeEmail(created.email);
+    const emailVerified = created.emailVerified ?? true;
+    if (input.passwordHash === undefined) {
+      return { ok: true, user: input.user };
+    }
+    const credential = buildCredential(email, emailVerified, input.passwordHash, created.userId);
+    await options.credentialStore.saveCredential(credential);
+    return { credential, ok: true, user: input.user };
+  } catch (err) {
+    return {
+      error: err instanceof Error ? err.message : String(err),
+      ok: false,
+      user: input.user
+    };
+  }
+};
+var importUsers = async (inputs, options) => {
+  const concurrency = Math.max(1, options.concurrency ?? 1);
+  const results = [];
+  for (let cursor = 0;cursor < inputs.length; cursor += concurrency) {
+    const slice = inputs.slice(cursor, cursor + concurrency);
+    const batch = await Promise.all(slice.map((input) => importUser(input, options)));
+    results.push(...batch);
+  }
+  return {
+    failed: results.filter((result) => !result.ok).length,
+    results,
+    succeeded: results.filter((result) => result.ok).length
+  };
+};
+var rehashCredentialPassword = async ({
+  credentialStore,
+  current,
+  plainPassword
+}) => {
+  const passwordHash = await hashPassword(plainPassword);
+  await credentialStore.saveCredential({
+    ...current,
+    passwordHash,
+    updatedAt: Date.now()
+  });
+};
+
+// src/credentials/legacyHashers.ts
+var PBKDF2_DEFAULT_ITERATIONS = 1e5;
+var PBKDF2_KEY_LENGTH_BYTES = 32;
+var constantTimeEqualBytes = (left, right) => {
+  if (left.byteLength !== right.byteLength)
+    return false;
+  let diff = 0;
+  for (let index = 0;index < left.byteLength; index++) {
+    diff |= (left[index] ?? 0) ^ (right[index] ?? 0);
+  }
+  return diff === 0;
+};
+var base64Decode = (encoded) => new Uint8Array(Buffer.from(encoded, "base64"));
+var sha256Bytes = async (input) => new Uint8Array(await crypto.subtle.digest("SHA-256", input));
+var isLegacyHash = (storedHash) => !storedHash.startsWith("$argon2id$") && !storedHash.startsWith("$2");
+var verifyAuth0Pbkdf2 = async (plainPassword, wrappedHash) => {
+  const parts = wrappedHash.split(":");
+  if (parts.length !== 4 || parts[0] !== "auth0_pbkdf2")
+    return false;
+  const salt = base64Decode(parts[1] ?? "");
+  const expected = base64Decode(parts[2] ?? "");
+  const iterations = Number(parts[3] ?? PBKDF2_DEFAULT_ITERATIONS);
+  if (Number.isNaN(iterations) || iterations <= 0)
+    return false;
+  const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(plainPassword), { name: "PBKDF2" }, false, ["deriveBits"]);
+  const derivedBits = await crypto.subtle.deriveBits({ hash: "SHA-256", iterations, name: "PBKDF2", salt }, key, PBKDF2_KEY_LENGTH_BYTES * 8);
+  return constantTimeEqualBytes(new Uint8Array(derivedBits), expected);
+};
+var verifyCognitoSha256 = async (plainPassword, wrappedHash) => {
+  const parts = wrappedHash.split(":");
+  if (parts.length !== 3 || parts[0] !== "cognito_sha256")
+    return false;
+  const salt = base64Decode(parts[1] ?? "");
+  const expected = base64Decode(parts[2] ?? "");
+  const payload = new Uint8Array(salt.byteLength + plainPassword.length);
+  payload.set(salt, 0);
+  payload.set(new TextEncoder().encode(plainPassword), salt.byteLength);
+  const derived = await sha256Bytes(payload);
+  return constantTimeEqualBytes(derived, expected);
+};
+
 // src/credentials/passwordPolicy.ts
 var DEFAULT_MIN_LENGTH = 12;
 var HEX_RADIX = 16;
@@ -3452,6 +3556,8 @@ var credentialsLogin = ({
   loginRoute = "/auth/login",
   onCredentialsLoginError,
   onCredentialsLoginSuccess,
+  passwordVerifier,
+  rehashOnLogin = false,
   requireEmailVerification = false,
   sessionDurationMs = DEFAULT_CREDENTIAL_SESSION_TTL_MS
 }) => new Elysia6().use(sessionStore()).post(loginRoute, async ({
@@ -3479,7 +3585,8 @@ var credentialsLogin = ({
   }
   const credential = await credentialStore.getCredentialByEmail(normalizedEmail);
   const user = await getUserByEmail(normalizedEmail);
-  const passwordValid = credential ? await verifyPassword(password, credential.passwordHash) : false;
+  const verifyHash = passwordVerifier ?? verifyPassword;
+  const passwordValid = credential === undefined ? false : await verifyHash(password, credential.passwordHash);
   if (!credential || !user || credential.status !== "active" || !passwordValid) {
     await lockoutGuard?.recordFailure(normalizedEmail);
     await onCredentialsLoginError?.({
@@ -3489,6 +3596,13 @@ var credentialsLogin = ({
     return status("Unauthorized", "Invalid email or password");
   }
   await lockoutGuard?.recordSuccess(normalizedEmail);
+  if (rehashOnLogin && isLegacyHash(credential.passwordHash)) {
+    await rehashCredentialPassword({
+      credentialStore,
+      current: credential,
+      plainPassword: password
+    });
+  }
   if (requireEmailVerification && !credential.emailVerified) {
     return status("Forbidden", { status: "email_not_verified" });
   }
@@ -4843,6 +4957,51 @@ var pushAuthorizationRequest = async ({
   };
 };
 
+// src/oidc/userinfo.ts
+var BEARER_PREFIX2 = "Bearer ";
+var readBearer = (authorization) => {
+  if (authorization === undefined || !authorization.startsWith(BEARER_PREFIX2)) {
+    return;
+  }
+  return authorization.slice(BEARER_PREFIX2.length).trim();
+};
+var readUserInfoBearer = readBearer;
+var fetchUserInfo = async ({
+  config,
+  now = Date.now(),
+  token
+}) => {
+  if (token === undefined) {
+    return {
+      body: { error: "invalid_request" },
+      error: "invalid_request",
+      ok: false
+    };
+  }
+  const verified = await verifyJwt(token, config.signingKey.publicJwk);
+  if (verified === undefined) {
+    return {
+      body: { error: "invalid_token" },
+      error: "invalid_token",
+      ok: false
+    };
+  }
+  const { payload } = verified;
+  if (typeof payload.sub !== "string" || typeof payload.exp !== "number" || payload.exp * 1000 <= now) {
+    return {
+      body: { error: "invalid_token" },
+      error: "invalid_token",
+      ok: false
+    };
+  }
+  const enriched = await config.getUserInfo?.(payload.sub);
+  return {
+    body: { ...enriched ?? {}, sub: payload.sub },
+    ok: true
+  };
+};
+var userInfoChallengeHeader = (error) => `Bearer realm="userinfo", error="${error}"`;
+
 // src/oidc/registration.ts
 var REG_TOKEN_BYTES = 32;
 var CLIENT_ID_BYTES = 16;
@@ -5106,6 +5265,7 @@ var oidcProviderRoutes = (config) => {
   const endSessionRoute = `${oidcRoute}/end_session`;
   const parRoute = `${oidcRoute}/par`;
   const registrationRoute = `${oidcRoute}/register`;
+  const userinfoRoute = `${oidcRoute}/userinfo`;
   const registrationBaseUrl = `${issuer}${registrationRoute}`;
   const tokenUrl = `${issuer}${oidcRoute}/token`;
   const authenticateClient = async (clientId, clientSecret) => {
@@ -5317,7 +5477,8 @@ var oidcProviderRoutes = (config) => {
       "none",
       "private_key_jwt"
     ],
-    token_endpoint_auth_signing_alg_values_supported: ["ES256"]
+    token_endpoint_auth_signing_alg_values_supported: ["ES256"],
+    userinfo_endpoint: `${issuer}${userinfoRoute}`
   };
   if (config.deviceAuthorizationStore) {
     discovery.device_authorization_endpoint = `${issuer}${deviceAuthorizationRoute}`;
@@ -5422,7 +5583,21 @@ var oidcProviderRoutes = (config) => {
       session: store.session,
       userSessionId: user_session_id.value
     });
-    if (userSession === undefined) {
+    const promptValues = effectiveQuery.prompt === undefined ? [] : effectiveQuery.prompt.split(" ");
+    const wantsSilent = promptValues.includes("none");
+    const wantsLogin = promptValues.includes("login") || promptValues.includes("consent");
+    const maxAge = effectiveQuery.max_age === undefined ? undefined : Number(effectiveQuery.max_age);
+    const sessionStaleByMaxAge = userSession !== undefined && maxAge !== undefined && !Number.isNaN(maxAge) && maxAge >= 0 && (userSession.authenticatedAt ?? 0) < Date.now() - maxAge * 1000;
+    const hintSub = effectiveQuery.id_token_hint === undefined ? undefined : (await verifyIdTokenHint({
+      config,
+      idTokenHint: effectiveQuery.id_token_hint
+    }))?.sub;
+    const hintMismatch = userSession !== undefined && hintSub !== undefined && hintSub !== getUserId(userSession.user);
+    const needsReauth = wantsLogin || sessionStaleByMaxAge || hintMismatch;
+    if (userSession === undefined || needsReauth) {
+      if (wantsSilent) {
+        return errorRedirect(userSession === undefined ? "login_required" : "interaction_required");
+      }
       return loginUrl === undefined ? jsonResponse({ error: "login_required" }, HTTP_UNAUTHORIZED2) : redirectTo(`${loginUrl}?return_to=${encodeURIComponent(request.url)}`);
     }
     const requested = scope === undefined || scope.length === 0 ? client.scopes : scope.split(" ").filter((entry) => client.scopes.includes(entry));
@@ -5472,7 +5647,10 @@ var oidcProviderRoutes = (config) => {
       client_id: t12.Optional(t12.String()),
       code_challenge: t12.Optional(t12.String()),
       code_challenge_method: t12.Optional(t12.String()),
+      id_token_hint: t12.Optional(t12.String()),
+      max_age: t12.Optional(t12.String()),
       nonce: t12.Optional(t12.String()),
+      prompt: t12.Optional(t12.String()),
       redirect_uri: t12.Optional(t12.String()),
       request_uri: t12.Optional(t12.String()),
       response_type: t12.Optional(t12.String()),
@@ -5813,6 +5991,43 @@ var oidcProviderRoutes = (config) => {
       authorization: t12.Optional(t12.String())
     }),
     params: t12.Object({ clientId: t12.String() })
+  }).get(userinfoRoute, async ({ headers }) => {
+    const token = readUserInfoBearer(headers.authorization);
+    const result = await fetchUserInfo({ config, token });
+    if (!result.ok) {
+      return new Response(JSON.stringify(result.body), {
+        headers: {
+          "content-type": "application/json",
+          "www-authenticate": userInfoChallengeHeader(result.error)
+        },
+        status: HTTP_UNAUTHORIZED2
+      });
+    }
+    return jsonResponse(result.body, HTTP_OK2);
+  }, {
+    headers: t12.Object({
+      authorization: t12.Optional(t12.String())
+    })
+  }).post(userinfoRoute, async ({ headers, body }) => {
+    const token = readUserInfoBearer(headers.authorization) ?? body.access_token;
+    const result = await fetchUserInfo({ config, token });
+    if (!result.ok) {
+      return new Response(JSON.stringify(result.body), {
+        headers: {
+          "content-type": "application/json",
+          "www-authenticate": userInfoChallengeHeader(result.error)
+        },
+        status: HTTP_UNAUTHORIZED2
+      });
+    }
+    return jsonResponse(result.body, HTTP_OK2);
+  }, {
+    body: t12.Object({
+      access_token: t12.Optional(t12.String())
+    }),
+    headers: t12.Object({
+      authorization: t12.Optional(t12.String())
+    })
   }).get(jwksRoute, () => ({ keys: [toPublicJwk(signingKey)] })).get("/.well-known/openid-configuration", () => discovery);
 };
 
@@ -6314,7 +6529,7 @@ import { Elysia as Elysia18, t as t15 } from "elysia";
 // src/scim/config.ts
 var DEFAULT_SCIM_ROUTE = "/scim/v2";
 var SCIM_TOKEN_BYTES = 32;
-var BEARER_PREFIX2 = "Bearer ";
+var BEARER_PREFIX3 = "Bearer ";
 var createScimToken = async (scimTokenStore, organizationId) => {
   const token = generateSecureToken(SCIM_TOKEN_BYTES);
   const record = {
@@ -6327,10 +6542,10 @@ var createScimToken = async (scimTokenStore, organizationId) => {
   return { token, tokenId: record.tokenId };
 };
 var resolveScimOrganization = async (scimTokenStore, authorization) => {
-  if (authorization === undefined || !authorization.startsWith(BEARER_PREFIX2)) {
+  if (authorization === undefined || !authorization.startsWith(BEARER_PREFIX3)) {
     return;
   }
-  const token = authorization.slice(BEARER_PREFIX2.length).trim();
+  const token = authorization.slice(BEARER_PREFIX3.length).trim();
   if (token.length === 0)
     return;
   const record = await scimTokenStore.findByHashedToken(await hashToken(token));
@@ -6347,7 +6562,7 @@ var DEFAULT_PORTAL_ROUTE = "/auth/portal";
 var DEFAULT_SETUP_SESSION_TTL_MS = MILLISECONDS_IN_A_DAY * SETUP_TTL_DAYS;
 
 // src/portal/operations.ts
-var BEARER_PREFIX3 = "Bearer ";
+var BEARER_PREFIX4 = "Bearer ";
 var createSetupSession = async ({
   capabilities,
   createdBy,
@@ -6373,10 +6588,10 @@ var resolveSetupSession = async ({
   authorization,
   setupSessionStore
 }) => {
-  if (authorization === undefined || !authorization.startsWith(BEARER_PREFIX3)) {
+  if (authorization === undefined || !authorization.startsWith(BEARER_PREFIX4)) {
     return;
   }
-  const token = authorization.slice(BEARER_PREFIX3.length).trim();
+  const token = authorization.slice(BEARER_PREFIX4.length).trim();
   if (token.length === 0)
     return;
   const session = await setupSessionStore.getSetupSessionByTokenHash(await hashToken(token));
@@ -22896,7 +23111,9 @@ export {
   verifyHcaptcha,
   verifyDpopProof,
   verifyDpopNonce,
+  verifyCognitoSha256,
   verifyClientAssertion,
+  verifyAuth0Pbkdf2,
   verifyAuditChain,
   verifyApiKey,
   verifyAccessToken,
@@ -22904,6 +23121,7 @@ export {
   validateSession,
   validateEmailDeliverability,
   userSessionIdTypebox,
+  userInfoChallengeHeader,
   updateRegisteredClient,
   trustDevice,
   toPublicJwk,
@@ -22942,9 +23160,11 @@ export {
   resolveAuthHtmxRenderers,
   resolveApiPrincipal,
   removeFromSessionRing,
+  rehashCredentialPassword,
   registerClient,
   refreshableProviderOptions,
   recordLoginAttempt,
+  readUserInfoBearer,
   readSessionRing,
   pushAuthorizationRequest,
   providers,
@@ -23001,6 +23221,7 @@ export {
   isPKCEProviderOption,
   isOIDCProviderOption,
   isMfaEnrolled,
+  isLegacyHash,
   isImpersonating,
   isDisposableEmail,
   isAuthIntent,
@@ -23008,6 +23229,8 @@ export {
   inviteToOrganization,
   introspectToken,
   instantiateUserSession,
+  importUsers,
+  importUser,
   hashToken,
   hashPassword,
   hashAuditEvent,
@@ -23023,6 +23246,7 @@ export {
   generateEncryptionKey,
   generateBackupCodes,
   fingerprintDevice,
+  fetchUserInfo,
   fanOutBackchannelLogout,
   extractPropFromIdentity,
   extractDpopNonceClaim,
@@ -23226,5 +23450,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=A629114DF39943A964756E2164756E21
+//# debugId=658AE7172110F24564756E2164756E21
 //# sourceMappingURL=index.js.map