@netlify/identity 0.3.0-alpha.3 → 0.3.0-alpha.5

package/README.md

@@ -9,7 +9,7 @@ A lightweight, no-config headless authentication library for projects using Netl
 - [Netlify Identity](https://docs.netlify.com/security/secure-access-to-sites/identity/) must be enabled on your Netlify project
 - For local development, use [`netlify dev`](https://docs.netlify.com/cli/local-development/) so the Identity endpoint is available
 
-### How this library relates to other Netlify auth packages
+## How this library relates to other Netlify auth packages
 
 | Package                                                                         | What it is                                     | When to use it                                                                             |
 | ------------------------------------------------------------------------------- | ---------------------------------------------- | ------------------------------------------------------------------------------------------ |
@@ -54,8 +54,8 @@ import { login, getUser } from '@netlify/identity'
 const user = await login('jane@example.com', 'password123')
 console.log(`Hello, ${user.name}`)
 
-// Later, check auth state synchronously
-const currentUser = getUser()
+// Later, check auth state
+const currentUser = await getUser()
 ```
 
 ### Protect a Netlify Function
@@ -65,7 +65,7 @@ import { getUser } from '@netlify/identity'
 import type { Context } from '@netlify/functions'
 
 export default async (req: Request, context: Context) => {
-  const user = getUser()
+  const user = await getUser()
   if (!user) return new Response('Unauthorized', { status: 401 })
   return Response.json({ id: user.id, email: user.email })
 }
@@ -78,7 +78,7 @@ import { getUser } from '@netlify/identity'
 import type { Context } from '@netlify/edge-functions'
 
 export default async (req: Request, context: Context) => {
-  const user = getUser()
+  const user = await getUser()
   if (!user) return new Response('Unauthorized', { status: 401 })
   return Response.json({ id: user.id, email: user.email })
 }
@@ -91,20 +91,20 @@ export default async (req: Request, context: Context) => {
 #### `getUser`
 
 ```ts
-getUser(): User | null
+getUser(): Promise<User | null>
 ```
 
-Returns the current authenticated user, or `null` if not logged in. Synchronous. Never throws.
+Returns the current authenticated user, or `null` if not logged in. Always returns a full `User` object with all available fields (email, roles, timestamps, metadata) regardless of whether the call happens in the browser or on the server. Never throws.
 
 > **Next.js note:** Calling `getUser()` in a Server Component opts the page into [dynamic rendering](https://nextjs.org/docs/app/building-your-application/rendering/server-components#dynamic-rendering) because it reads cookies. This is expected and correct for authenticated pages. Next.js handles the internal dynamic rendering signal automatically.
 
 #### `isAuthenticated`
 
 ```ts
-isAuthenticated(): boolean
+isAuthenticated(): Promise<boolean>
 ```
 
-Returns `true` if a user is currently authenticated. Equivalent to `getUser() !== null`. Never throws.
+Returns `true` if a user is currently authenticated. Equivalent to `(await getUser()) !== null`. Never throws.
 
 #### `getIdentityConfig`
 
@@ -200,7 +200,7 @@ hydrateSession(): Promise<User | null>
 
 Bootstraps the browser-side gotrue-js session from server-set auth cookies (`nf_jwt`, `nf_refresh`). Returns the hydrated `User`, or `null` if no auth cookies are present. No-op on the server.
 
-**When to use:** After a server-side login (e.g., via a Netlify Function or Server Action), the `nf_jwt` cookie is set but gotrue-js has no browser session yet. `getUser()` works immediately (it decodes the cookie), but account operations like `updateUser()` or `verifyEmailChange()` require a live gotrue-js session. Call `hydrateSession()` once on page load to bridge this gap.
+**When to use:** After a server-side login (e.g., via a Netlify Function or Server Action), the `nf_jwt` cookie is set but gotrue-js has no browser session yet. `getUser()` calls `hydrateSession()` automatically, but account operations like `updateUser()` or `verifyEmailChange()` require a live gotrue-js session. Call `hydrateSession()` explicitly if you need the session ready before calling those operations.
 
 If a gotrue-js session already exists (e.g., from a browser-side login), this is a no-op and returns the existing user.
 
@@ -373,6 +373,7 @@ interface User {
   provider?: AuthProvider
   name?: string
   pictureUrl?: string
+  roles?: string[]
   metadata?: Record<string, unknown>
   rawGoTrueData?: Record<string, unknown>
 }
@@ -501,6 +502,14 @@ const AUTH_EVENTS: {
 
 Constants for auth event names. Use these instead of string literals for type safety and autocomplete.
 
+| Event           | When it fires                                                                                                                                                                                                                                                                         |
+| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `LOGIN`         | `login()`, `signup()` (with autoconfirm), `recoverPassword()`, `handleAuthCallback()` (OAuth/confirmation), `hydrateSession()`                                                                                                                                                        |
+| `LOGOUT`        | `logout()`                                                                                                                                                                                                                                                                            |
+| `TOKEN_REFRESH` | gotrue-js refreshes an expiring access token in the background                                                                                                                                                                                                                        |
+| `USER_UPDATED`  | `updateUser()`, `verifyEmailChange()`, `handleAuthCallback()` (email change)                                                                                                                                                                                                          |
+| `RECOVERY`      | `handleAuthCallback()` (recovery token only). The user is authenticated but has **not** set a new password yet. Listen for this to redirect to a password reset form. `recoverPassword()` emits `LOGIN` instead because it completes both steps (token redemption + password change). |
+
 #### `AuthEvent`
 
 ```ts
@@ -603,8 +612,8 @@ export default function LoginPage() {
 import { getUser } from '@netlify/identity'
 import { redirect } from 'next/navigation'
 
-export default function Dashboard() {
-  const user = getUser()
+export default async function Dashboard() {
+  const user = await getUser()
   if (!user) redirect('/login')
 
   return <h1>Hello, {user.email}</h1>
@@ -643,7 +652,7 @@ import { getUser } from '@netlify/identity'
 import { redirect } from '@remix-run/node'
 
 export async function loader() {
-  const user = getUser()
+  const user = await getUser()
   if (!user) return redirect('/login')
   return { user }
 }
@@ -661,7 +670,7 @@ import { createServerFn } from '@tanstack/react-start'
 import { getUser } from '@netlify/identity'
 
 export const getServerUser = createServerFn({ method: 'GET' }).handler(async () => {
-  const user = getUser()
+  const user = await getUser()
   return user ?? null
 })
 ```
@@ -747,7 +756,7 @@ export const POST: APIRoute = async ({ request }) => {
 // src/pages/dashboard.astro
 import { getUser } from '@netlify/identity'
 
-const user = getUser()
+const user = await getUser()
 if (!user) return Astro.redirect('/login')
 ---
 <h1>Hello, {user.email}</h1>
@@ -789,8 +798,8 @@ if (!user) return Astro.redirect('/login')
 import { getUser } from '@netlify/identity'
 import { redirect } from '@sveltejs/kit'
 
-export function load() {
-  const user = getUser()
+export async function load() {
+  const user = await getUser()
   if (!user) redirect(302, '/login')
   return { user }
 }
@@ -865,9 +874,10 @@ import { getUser, onAuthChange } from '@netlify/identity'
 import type { User } from '@netlify/identity'
 
 export function useAuth() {
-  const [user, setUser] = useState<User | null>(getUser())
+  const [user, setUser] = useState<User | null>(null)
 
   useEffect(() => {
+    getUser().then(setUser)
     return onAuthChange((_event, user) => setUser(user))
   }, [])
 

package/dist/index.cjs

@@ -61,7 +61,7 @@ var AUTH_PROVIDERS = ["google", "github", "gitlab", "bitbucket", "facebook", "sa
 var import_gotrue_js = __toESM(require("gotrue-js"), 1);
 
 // src/errors.ts
-var AuthError = class extends Error {
+var AuthError = class _AuthError extends Error {
   constructor(message, status, options) {
     super(message);
     this.name = "AuthError";
@@ -70,6 +70,10 @@ var AuthError = class extends Error {
       this.cause = options.cause;
     }
   }
+  static from(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return new _AuthError(message, void 0, { cause: error });
+  }
 };
 var MissingIdentityError = class extends Error {
   constructor(message = "Netlify Identity is not available.") {
@@ -94,7 +98,7 @@ var discoverApiUrl = () => {
       cachedApiUrl = identityContext.url;
     } else if (globalThis.Netlify?.context?.url) {
       cachedApiUrl = new URL(IDENTITY_PATH, globalThis.Netlify.context.url).href;
-    } else if (process.env.URL) {
+    } else if (typeof process !== "undefined" && process.env?.URL) {
       cachedApiUrl = new URL(IDENTITY_PATH, process.env.URL).href;
     }
   }
@@ -131,7 +135,7 @@ var getIdentityContext = () => {
   if (globalThis.Netlify?.context?.url) {
     return { url: new URL(IDENTITY_PATH, globalThis.Netlify.context.url).href };
   }
-  const siteUrl = process.env.URL;
+  const siteUrl = typeof process !== "undefined" ? process.env?.URL : void 0;
   if (siteUrl) {
     return { url: new URL(IDENTITY_PATH, siteUrl).href };
   }
@@ -143,7 +147,12 @@ var NF_JWT_COOKIE = "nf_jwt";
 var NF_REFRESH_COOKIE = "nf_refresh";
 var getCookie = (name) => {
   const match = document.cookie.match(new RegExp(`(?:^|; )${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}=([^;]*)`));
-  return match ? decodeURIComponent(match[1]) : null;
+  if (!match) return null;
+  try {
+    return decodeURIComponent(match[1]);
+  } catch {
+    return match[1];
+  }
 };
 var setAuthCookies = (cookies, accessToken, refreshToken) => {
   cookies.set({
@@ -213,143 +222,6 @@ var triggerNextjsDynamic = () => {
   }
 };
 
-// src/user.ts
-var toAuthProvider = (value) => typeof value === "string" && AUTH_PROVIDERS.includes(value) ? value : void 0;
-var toUser = (userData) => {
-  const userMeta = userData.user_metadata ?? {};
-  const appMeta = userData.app_metadata ?? {};
-  const name = userMeta.full_name || userMeta.name;
-  const pictureUrl = userMeta.avatar_url;
-  return {
-    id: userData.id,
-    email: userData.email,
-    emailVerified: !!userData.confirmed_at,
-    createdAt: userData.created_at,
-    updatedAt: userData.updated_at,
-    provider: toAuthProvider(appMeta.provider),
-    name: typeof name === "string" ? name : void 0,
-    pictureUrl: typeof pictureUrl === "string" ? pictureUrl : void 0,
-    metadata: userMeta,
-    rawGoTrueData: { ...userData }
-  };
-};
-var claimsToUser = (claims) => {
-  const appMeta = claims.app_metadata ?? {};
-  const userMeta = claims.user_metadata ?? {};
-  const name = userMeta.full_name || userMeta.name;
-  return {
-    id: claims.sub ?? "",
-    email: claims.email,
-    provider: toAuthProvider(appMeta.provider),
-    name: typeof name === "string" ? name : void 0,
-    metadata: userMeta
-  };
-};
-var hydrating = false;
-var backgroundHydrate = (accessToken) => {
-  if (hydrating) return;
-  hydrating = true;
-  const refreshToken = getCookie(NF_REFRESH_COOKIE) ?? "";
-  const decoded = decodeJwtPayload(accessToken);
-  const expiresAt = decoded?.exp ?? Math.floor(Date.now() / 1e3) + 3600;
-  const expiresIn = Math.max(0, expiresAt - Math.floor(Date.now() / 1e3));
-  setTimeout(() => {
-    try {
-      const client = getClient();
-      client.createUser(
-        {
-          access_token: accessToken,
-          token_type: "bearer",
-          expires_in: expiresIn,
-          expires_at: expiresAt,
-          refresh_token: refreshToken
-        },
-        true
-      ).catch(() => {
-      }).finally(() => {
-        hydrating = false;
-      });
-    } catch {
-      hydrating = false;
-    }
-  }, 0);
-};
-var decodeJwtPayload = (token) => {
-  try {
-    const parts = token.split(".");
-    if (parts.length !== 3) return null;
-    const payload = atob(parts[1].replace(/-/g, "+").replace(/_/g, "/"));
-    return JSON.parse(payload);
-  } catch {
-    return null;
-  }
-};
-var getUser = () => {
-  if (isBrowser()) {
-    const client = getGoTrueClient();
-    const currentUser = client?.currentUser() ?? null;
-    if (currentUser) {
-      const jwt2 = getCookie(NF_JWT_COOKIE);
-      if (!jwt2) {
-        try {
-          currentUser.clearSession();
-        } catch {
-        }
-        return null;
-      }
-      return toUser(currentUser);
-    }
-    const jwt = getCookie(NF_JWT_COOKIE);
-    if (!jwt) return null;
-    const claims = decodeJwtPayload(jwt);
-    if (!claims) return null;
-    backgroundHydrate(jwt);
-    return claimsToUser(claims);
-  }
-  triggerNextjsDynamic();
-  const identityContext = globalThis.netlifyIdentityContext;
-  if (identityContext?.user) {
-    return claimsToUser(identityContext.user);
-  }
-  const serverJwt = getServerCookie(NF_JWT_COOKIE);
-  if (serverJwt) {
-    const claims = decodeJwtPayload(serverJwt);
-    if (claims) return claimsToUser(claims);
-  }
-  return null;
-};
-var isAuthenticated = () => getUser() !== null;
-
-// src/config.ts
-var getIdentityConfig = () => {
-  if (isBrowser()) {
-    return { url: `${window.location.origin}${IDENTITY_PATH}` };
-  }
-  return getIdentityContext();
-};
-var getSettings = async () => {
-  const client = getClient();
-  try {
-    const raw = await client.settings();
-    const external = raw.external ?? {};
-    return {
-      autoconfirm: raw.autoconfirm,
-      disableSignup: raw.disable_signup,
-      providers: {
-        google: external.google ?? false,
-        github: external.github ?? false,
-        gitlab: external.gitlab ?? false,
-        bitbucket: external.bitbucket ?? false,
-        facebook: external.facebook ?? false,
-        email: external.email ?? false,
-        saml: external.saml ?? false
-      }
-    };
-  } catch (err) {
-    throw new AuthError(err instanceof Error ? err.message : "Failed to fetch identity settings", 502, { cause: err });
-  }
-};
-
 // src/events.ts
 var AUTH_EVENTS = {
   LOGIN: "login",
@@ -428,7 +300,7 @@ var login = async (email, password) => {
         body: body.toString()
       });
     } catch (error) {
-      throw new AuthError(error.message, void 0, { cause: error });
+      throw AuthError.from(error);
     }
     if (!res.ok) {
       const errorBody = await res.json().catch(() => ({}));
@@ -442,7 +314,7 @@ var login = async (email, password) => {
         headers: { Authorization: `Bearer ${accessToken}` }
       });
     } catch (error) {
-      throw new AuthError(error.message, void 0, { cause: error });
+      throw AuthError.from(error);
     }
     if (!userRes.ok) {
       const errorBody = await userRes.json().catch(() => ({}));
@@ -462,7 +334,7 @@ var login = async (email, password) => {
     emitAuthEvent(AUTH_EVENTS.LOGIN, user);
     return user;
   } catch (error) {
-    throw new AuthError(error.message, void 0, { cause: error });
+    throw AuthError.from(error);
   }
 };
 var signup = async (email, password, data) => {
@@ -477,7 +349,7 @@ var signup = async (email, password, data) => {
         body: JSON.stringify({ email, password, data })
       });
     } catch (error) {
-      throw new AuthError(error.message, void 0, { cause: error });
+      throw AuthError.from(error);
     }
     if (!res.ok) {
       const errorBody = await res.json().catch(() => ({}));
@@ -506,7 +378,7 @@ var signup = async (email, password, data) => {
     }
     return user;
   } catch (error) {
-    throw new AuthError(error.message, void 0, { cause: error });
+    throw AuthError.from(error);
   }
 };
 var logout = async () => {
@@ -535,7 +407,7 @@ var logout = async () => {
     deleteBrowserAuthCookies();
     emitAuthEvent(AUTH_EVENTS.LOGOUT, null);
   } catch (error) {
-    throw new AuthError(error.message, void 0, { cause: error });
+    throw AuthError.from(error);
   }
 };
 var oauthLogin = (provider) => {
@@ -566,7 +438,7 @@ var handleAuthCallback = async () => {
     return null;
   } catch (error) {
     if (error instanceof AuthError) throw error;
-    throw new AuthError(error.message, void 0, { cause: error });
+    throw AuthError.from(error);
   }
 };
 var handleOAuthCallback = async (client, params, accessToken) => {
@@ -651,21 +523,172 @@ var hydrateSession = async () => {
   const decoded = decodeJwtPayload(accessToken);
   const expiresAt = decoded?.exp ?? Math.floor(Date.now() / 1e3) + 3600;
   const expiresIn = Math.max(0, expiresAt - Math.floor(Date.now() / 1e3));
-  const gotrueUser = await client.createUser(
-    {
-      access_token: accessToken,
-      token_type: "bearer",
-      expires_in: expiresIn,
-      expires_at: expiresAt,
-      refresh_token: refreshToken
-    },
-    persistSession
-  );
+  let gotrueUser;
+  try {
+    gotrueUser = await client.createUser(
+      {
+        access_token: accessToken,
+        token_type: "bearer",
+        expires_in: expiresIn,
+        expires_at: expiresAt,
+        refresh_token: refreshToken
+      },
+      persistSession
+    );
+  } catch {
+    deleteBrowserAuthCookies();
+    return null;
+  }
   const user = toUser(gotrueUser);
   emitAuthEvent(AUTH_EVENTS.LOGIN, user);
   return user;
 };
 
+// src/user.ts
+var toAuthProvider = (value) => typeof value === "string" && AUTH_PROVIDERS.includes(value) ? value : void 0;
+var toRoles = (appMeta) => {
+  const roles = appMeta.roles;
+  if (Array.isArray(roles) && roles.every((r) => typeof r === "string")) {
+    return roles;
+  }
+  return void 0;
+};
+var toUser = (userData) => {
+  const userMeta = userData.user_metadata ?? {};
+  const appMeta = userData.app_metadata ?? {};
+  const name = userMeta.full_name || userMeta.name;
+  const pictureUrl = userMeta.avatar_url;
+  return {
+    id: userData.id,
+    email: userData.email,
+    emailVerified: !!userData.confirmed_at,
+    createdAt: userData.created_at,
+    updatedAt: userData.updated_at,
+    provider: toAuthProvider(appMeta.provider),
+    name: typeof name === "string" ? name : void 0,
+    pictureUrl: typeof pictureUrl === "string" ? pictureUrl : void 0,
+    roles: toRoles(appMeta),
+    metadata: userMeta,
+    rawGoTrueData: { ...userData }
+  };
+};
+var claimsToUser = (claims) => {
+  const appMeta = claims.app_metadata ?? {};
+  const userMeta = claims.user_metadata ?? {};
+  const name = userMeta.full_name || userMeta.name;
+  const pictureUrl = userMeta.avatar_url;
+  return {
+    id: claims.sub ?? "",
+    email: claims.email,
+    provider: toAuthProvider(appMeta.provider),
+    name: typeof name === "string" ? name : void 0,
+    pictureUrl: typeof pictureUrl === "string" ? pictureUrl : void 0,
+    roles: toRoles(appMeta),
+    metadata: userMeta
+  };
+};
+var decodeJwtPayload = (token) => {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+    const payload = atob(parts[1].replace(/-/g, "+").replace(/_/g, "/"));
+    return JSON.parse(payload);
+  } catch {
+    return null;
+  }
+};
+var fetchFullUser = async (identityUrl, jwt) => {
+  try {
+    const res = await fetch(`${identityUrl}/user`, {
+      headers: { Authorization: `Bearer ${jwt}` }
+    });
+    if (!res.ok) return null;
+    const userData = await res.json();
+    return toUser(userData);
+  } catch {
+    return null;
+  }
+};
+var resolveIdentityUrl = () => {
+  const identityContext = getIdentityContext();
+  if (identityContext?.url) return identityContext.url;
+  if (globalThis.Netlify?.context?.url) {
+    return new URL(IDENTITY_PATH, globalThis.Netlify.context.url).href;
+  }
+  const siteUrl = typeof process !== "undefined" ? process.env?.URL : void 0;
+  if (siteUrl) {
+    return new URL(IDENTITY_PATH, siteUrl).href;
+  }
+  return null;
+};
+var getUser = async () => {
+  if (isBrowser()) {
+    const client = getGoTrueClient();
+    const currentUser = client?.currentUser() ?? null;
+    if (currentUser) {
+      const jwt2 = getCookie(NF_JWT_COOKIE);
+      if (!jwt2) {
+        try {
+          currentUser.clearSession();
+        } catch {
+        }
+        return null;
+      }
+      return toUser(currentUser);
+    }
+    const jwt = getCookie(NF_JWT_COOKIE);
+    if (!jwt) return null;
+    const claims2 = decodeJwtPayload(jwt);
+    if (!claims2) return null;
+    const hydrated = await hydrateSession();
+    if (hydrated) return hydrated;
+    return claimsToUser(claims2);
+  }
+  triggerNextjsDynamic();
+  const identityContext = globalThis.netlifyIdentityContext;
+  const serverJwt = identityContext?.token || getServerCookie(NF_JWT_COOKIE);
+  if (serverJwt) {
+    const identityUrl = resolveIdentityUrl();
+    if (identityUrl) {
+      const fullUser = await fetchFullUser(identityUrl, serverJwt);
+      if (fullUser) return fullUser;
+    }
+  }
+  const claims = identityContext?.user ?? (serverJwt ? decodeJwtPayload(serverJwt) : null);
+  return claims ? claimsToUser(claims) : null;
+};
+var isAuthenticated = async () => await getUser() !== null;
+
+// src/config.ts
+var getIdentityConfig = () => {
+  if (isBrowser()) {
+    return { url: `${window.location.origin}${IDENTITY_PATH}` };
+  }
+  return getIdentityContext();
+};
+var getSettings = async () => {
+  const client = getClient();
+  try {
+    const raw = await client.settings();
+    const external = raw.external ?? {};
+    return {
+      autoconfirm: raw.autoconfirm,
+      disableSignup: raw.disable_signup,
+      providers: {
+        google: external.google ?? false,
+        github: external.github ?? false,
+        gitlab: external.gitlab ?? false,
+        bitbucket: external.bitbucket ?? false,
+        facebook: external.facebook ?? false,
+        email: external.email ?? false,
+        saml: external.saml ?? false
+      }
+    };
+  } catch (err) {
+    throw new AuthError(err instanceof Error ? err.message : "Failed to fetch identity settings", 502, { cause: err });
+  }
+};
+
 // src/account.ts
 var resolveCurrentUser = async () => {
   const client = getClient();
@@ -685,7 +708,7 @@ var requestPasswordRecovery = async (email) => {
   try {
     await client.requestPasswordRecovery(email);
   } catch (error) {
-    throw new AuthError(error.message, void 0, { cause: error });
+    throw AuthError.from(error);
   }
 };
 var recoverPassword = async (token, newPassword) => {
@@ -697,7 +720,7 @@ var recoverPassword = async (token, newPassword) => {
     emitAuthEvent(AUTH_EVENTS.LOGIN, user);
     return user;
   } catch (error) {
-    throw new AuthError(error.message, void 0, { cause: error });
+    throw AuthError.from(error);
   }
 };
 var confirmEmail = async (token) => {
@@ -708,7 +731,7 @@ var confirmEmail = async (token) => {
     emitAuthEvent(AUTH_EVENTS.LOGIN, user);
     return user;
   } catch (error) {
-    throw new AuthError(error.message, void 0, { cause: error });
+    throw AuthError.from(error);
   }
 };
 var acceptInvite = async (token, password) => {
@@ -719,15 +742,15 @@ var acceptInvite = async (token, password) => {
     emitAuthEvent(AUTH_EVENTS.LOGIN, user);
     return user;
   } catch (error) {
-    throw new AuthError(error.message, void 0, { cause: error });
+    throw AuthError.from(error);
   }
 };
 var verifyEmailChange = async (token) => {
   if (!isBrowser()) throw new AuthError("verifyEmailChange() is only available in the browser");
   const currentUser = await resolveCurrentUser();
-  const jwt = await currentUser.jwt();
-  const identityUrl = `${window.location.origin}${IDENTITY_PATH}`;
   try {
+    const jwt = await currentUser.jwt();
+    const identityUrl = `${window.location.origin}${IDENTITY_PATH}`;
     const res = await fetch(`${identityUrl}/user`, {
       method: "PUT",
       headers: {
@@ -746,7 +769,7 @@ var verifyEmailChange = async (token) => {
     return user;
   } catch (error) {
     if (error instanceof AuthError) throw error;
-    throw new AuthError(error.message, void 0, { cause: error });
+    throw AuthError.from(error);
   }
 };
 var updateUser = async (updates) => {
@@ -757,7 +780,7 @@ var updateUser = async (updates) => {
     emitAuthEvent(AUTH_EVENTS.USER_UPDATED, user);
     return user;
   } catch (error) {
-    throw new AuthError(error.message, void 0, { cause: error });
+    throw AuthError.from(error);
   }
 };