@withwiz/toolkit 0.7.0 → 0.8.0

package/dist/core/auth/index.js

@@ -6,13 +6,18 @@ import {
   getPasswordStrength,
   passwordValidator,
   validatePassword
-} from "../../chunk-6JXHXIEH.js";
+} from "../../chunk-3UIKCS56.js";
 import {
   PasswordHasher,
   PasswordValidator,
   defaultPasswordSchema,
   strongPasswordSchema
-} from "../../chunk-MNYVAEXK.js";
+} from "../../chunk-4ROIPF33.js";
+import {
+  Argon2idPasswordHasher,
+  BcryptPasswordHasher,
+  MigratingPasswordHasher
+} from "../../chunk-ILMPKSWS.js";
 import {
   JWTClientManager,
   clearStoredTokens,
@@ -28,14 +33,12 @@ import {
   isTokenExpired,
   isTokenExpiringSoon,
   storeTokens
-} from "../../chunk-LG3KM5V3.js";
-import {
-  TokenGenerator
-} from "../../chunk-D73ZJQMX.js";
+} from "../../chunk-5I3EQHR4.js";
 import {
   OAuthManager
-} from "../../chunk-V3GEYUBG.js";
+} from "../../chunk-ER6LSA4M.js";
 import "../../chunk-CDALZTPN.js";
+import "../../chunk-GSSHHVHF.js";
 import {
   GitHubOAuthProvider
 } from "../../chunk-HIZ7USIF.js";
@@ -46,18 +49,19 @@ import {
   KakaoOAuthProvider
 } from "../../chunk-65HVR74O.js";
 import "../../chunk-33RIHX7O.js";
-import "../../chunk-GSSHHVHF.js";
 import "../../chunk-JLRMET4V.js";
+import {
+  JWTManager,
+  JWTService
+} from "../../chunk-LWHLB2Y6.js";
+import {
+  TokenGenerator
+} from "../../chunk-ZZABL54F.js";
 import {
   OAUTH_PROVIDERS,
   PasswordStrength,
   TokenType
 } from "../../chunk-GH3U4WRE.js";
-import {
-  JWTManager,
-  JWTService
-} from "../../chunk-2PFSRVVD.js";
-import "../../chunk-2JGSS4RM.js";
 import {
   AUTH_ERROR_CODES,
   AuthError,
@@ -66,14 +70,17 @@ import {
   OAuthError,
   PasswordError
 } from "../../chunk-5GWGARXI.js";
-import "../../chunk-UKPMQBU2.js";
+import "../../chunk-PRPMEHRE.js";
+import "../../chunk-N3TCQ5BF.js";
+import "../../chunk-7YWUKMZD.js";
 import "../../chunk-6J2EJVND.js";
 import "../../chunk-F3R3UYBF.js";
-import "../../chunk-2SIBG5BG.js";
-import "../../chunk-ORMEWXMH.js";
+import "../../chunk-N3ETBM74.js";
 export {
   AUTH_ERROR_CODES,
+  Argon2idPasswordHasher,
   AuthError,
+  BcryptPasswordHasher,
   DEFAULT_PASSWORD_CONFIG,
   EmailError,
   GitHubOAuthProvider,
@@ -83,6 +90,7 @@ export {
   JWTManager,
   JWTService,
   KakaoOAuthProvider,
+  MigratingPasswordHasher,
   OAUTH_PROVIDERS,
   OAuthError,
   OAuthManager,

package/dist/core/auth/jwt/client.js

@@ -15,8 +15,9 @@ import {
   isTokenExpired,
   isTokenExpiringSoon,
   storeTokens
-} from "../../../chunk-LG3KM5V3.js";
-import "../../../chunk-ORMEWXMH.js";
+} from "../../../chunk-5I3EQHR4.js";
+import "../../../chunk-7YWUKMZD.js";
+import "../../../chunk-N3ETBM74.js";
 export {
   JWTClientManager,
   clearStoredTokens,

package/dist/core/auth/jwt/cookie.d.ts

@@ -4,7 +4,7 @@
  * NextResponse 타입을 제네릭으로 처리하여
  * symlink 환경에서의 next 패키지 경로 충돌을 방지합니다.
  */
-import type { TokenPair } from '@withwiz/core/auth/types';
+import type { TokenPair } from '@withwiz/toolkit/core/auth/types';
 /** cookies.set()을 지원하는 Response 타입 */
 interface CookieSettableResponse {
     cookies: {

package/dist/core/auth/jwt/cookie.js

@@ -1,12 +1,12 @@
 import {
   clearTokenCookies,
   setTokenCookies
-} from "../../../chunk-2JGSS4RM.js";
-import "../../../chunk-UKPMQBU2.js";
+} from "../../../chunk-PRPMEHRE.js";
+import "../../../chunk-N3TCQ5BF.js";
+import "../../../chunk-7YWUKMZD.js";
 import "../../../chunk-6J2EJVND.js";
 import "../../../chunk-F3R3UYBF.js";
-import "../../../chunk-2SIBG5BG.js";
-import "../../../chunk-ORMEWXMH.js";
+import "../../../chunk-N3ETBM74.js";
 export {
   clearTokenCookies,
   setTokenCookies

package/dist/core/auth/jwt/index.d.ts

@@ -4,20 +4,39 @@
  * JWT 토큰 생성 및 검증 모듈 (프레임워크 독립적)
  * Next.js, Express, Fastify 등 어디서나 사용 가능
  */
-import type { JWTConfig, JWTPayload, TokenPair, Logger } from "@withwiz/core/auth/types";
+import type { JWTConfig, JWTPayload, TokenPair, Logger } from "@withwiz/toolkit/core/auth/types";
 export declare class JWTManager {
     private config;
     private logger;
-    private secretKey;
+    private secretKey?;
+    private signingKeyCache?;
+    private verifyKeyCache?;
+    private jwks?;
     constructor(config: JWTConfig, logger: Logger);
+    private isSymmetric;
+    /** 발급용 키 (HS: secret, 비대칭: PKCS#8 개인키). 결과를 캐시한다. */
+    private getSigningKey;
+    /**
+     * 검증용 키를 jose getKey 함수로 정규화해 반환한다 (HS: secret, 비대칭:
+     * SPKI 공개키 또는 원격 JWKS). 정적 키도 함수로 감싸 단일 호출 경로를 쓰며,
+     * jose 는 함수 호출 전 알고리즘 allowlist 를 검증하므로 confusion 가드는 유지된다.
+     */
+    private getVerifyKey;
     /**
      * Access JWT 토큰 생성
      */
     createAccessToken(payload: Omit<JWTPayload, "iat" | "exp">): Promise<string>;
     /**
      * Refresh 토큰 생성
+     *
+     * rotation/reuse detection 용 `jti`(토큰 고유 id)와 `familyId`(회전 계보 id)를
+     * 함께 발급할 수 있다. 미지정 시 0.8 이전과 동일하게 식별자 없는 refresh
+     * 토큰을 만든다(하위 호환).
      */
-    createRefreshToken(userId: string): Promise<string>;
+    createRefreshToken(userId: string, options?: {
+        jti?: string;
+        familyId?: string;
+    }): Promise<string>;
     /**
      * 토큰 쌍 생성 (Access + Refresh)
      */
@@ -26,17 +45,22 @@ export declare class JWTManager {
         email: string;
         role: string;
         emailVerified?: Date | null;
+    }, options?: {
+        jti?: string;
+        familyId?: string;
     }): Promise<TokenPair>;
     /**
      * Access JWT 토큰 검증
      */
-    verifyAccessToken(token: string): Promise<JWTPayload>;
+    verifyAccessToken<TRole extends string = string>(token: string): Promise<JWTPayload<TRole>>;
     /**
      * Refresh 토큰 검증
      */
     verifyRefreshToken(token: string): Promise<{
         userId: string;
         tokenType: string;
+        jti?: string;
+        familyId?: string;
     }>;
     /**
      * Authorization 헤더에서 토큰 추출
@@ -73,17 +97,22 @@ export declare class JWTService {
     /**
      * 토큰 검증
      */
-    verify(token: string): Promise<JWTPayload>;
+    verify<TRole extends string = string>(token: string): Promise<JWTPayload<TRole>>;
     /**
      * Refresh 토큰 생성
      */
-    createRefreshToken(userId: string): Promise<string>;
+    createRefreshToken(userId: string, options?: {
+        jti?: string;
+        familyId?: string;
+    }): Promise<string>;
     /**
      * Refresh 토큰 검증
      */
     verifyRefreshToken(token: string): Promise<{
         userId: string;
         tokenType: string;
+        jti?: string;
+        familyId?: string;
     }>;
     /**
      * 토큰 쌍 생성
@@ -93,6 +122,9 @@ export declare class JWTService {
         email: string;
         role: string;
         emailVerified?: Date | null;
+    }, options?: {
+        jti?: string;
+        familyId?: string;
     }): Promise<TokenPair>;
     /**
      * Access 토큰 생성
@@ -101,12 +133,12 @@ export declare class JWTService {
     /**
      * Access 토큰 검증
      */
-    verifyAccessToken(token: string): Promise<JWTPayload>;
+    verifyAccessToken<TRole extends string = string>(token: string): Promise<JWTPayload<TRole>>;
     /**
      * Authorization 헤더에서 토큰 추출
      */
     extractTokenFromHeader(authHeader: string | undefined): string | null;
 }
-export { setTokenCookies, clearTokenCookies } from './cookie';
-export type { CookieOptions } from './cookie';
+export { setTokenCookies, clearTokenCookies } from '@withwiz/toolkit/core/auth/jwt/cookie';
+export type { CookieOptions } from '@withwiz/toolkit/core/auth/jwt/cookie';
 export type { JWTConfig, JWTPayload, TokenPair };

package/dist/core/auth/jwt/index.js

@@ -1,17 +1,17 @@
 import {
   JWTManager,
   JWTService
-} from "../../../chunk-2PFSRVVD.js";
+} from "../../../chunk-LWHLB2Y6.js";
+import "../../../chunk-5GWGARXI.js";
 import {
   clearTokenCookies,
   setTokenCookies
-} from "../../../chunk-2JGSS4RM.js";
-import "../../../chunk-5GWGARXI.js";
-import "../../../chunk-UKPMQBU2.js";
+} from "../../../chunk-PRPMEHRE.js";
+import "../../../chunk-N3TCQ5BF.js";
+import "../../../chunk-7YWUKMZD.js";
 import "../../../chunk-6J2EJVND.js";
 import "../../../chunk-F3R3UYBF.js";
-import "../../../chunk-2SIBG5BG.js";
-import "../../../chunk-ORMEWXMH.js";
+import "../../../chunk-N3ETBM74.js";
 export {
   JWTManager,
   JWTService,

package/dist/core/auth/jwt/types.d.ts

@@ -3,4 +3,4 @@
  *
  * JWT 모듈 전용 타입 정의
  */
-export * from '@withwiz/core/auth/types';
+export * from '@withwiz/toolkit/core/auth/types';

package/dist/core/auth/jwt/types.js

@@ -3,7 +3,7 @@ import {
   PasswordStrength,
   TokenType
 } from "../../../chunk-GH3U4WRE.js";
-import "../../../chunk-ORMEWXMH.js";
+import "../../../chunk-N3ETBM74.js";
 export {
   OAUTH_PROVIDERS,
   PasswordStrength,

package/dist/core/auth/oauth/index.d.ts

@@ -4,12 +4,12 @@
  * OAuth 2.0 인증 모듈 (프레임워크 독립적)
  * 플러그인 기반 프로바이더 레지스트리 패턴
  */
-import type { OAuthConfig, OAuthUserInfo, Logger, IOAuthProviderAdapter } from '@withwiz/core/auth/types';
-import { OAUTH_PROVIDERS } from '@withwiz/core/auth/types';
+import type { OAuthConfig, OAuthUserInfo, Logger, IOAuthProviderAdapter } from '@withwiz/toolkit/core/auth/types';
+import { OAUTH_PROVIDERS } from '@withwiz/toolkit/core/auth/types';
 export { OAUTH_PROVIDERS };
-export { OAUTH_STATE_COOKIE, generateOAuthState, setOAuthStateCookie, clearOAuthStateCookie, validateOAuthState, } from './state-cookie';
-export type { OAuthStateCookieOptions } from './state-cookie';
-export { GoogleOAuthProvider, GitHubOAuthProvider, KakaoOAuthProvider, MicrosoftOAuthProvider, MetaOAuthProvider, } from './providers';
+export { OAUTH_STATE_COOKIE, generateOAuthState, setOAuthStateCookie, clearOAuthStateCookie, validateOAuthState, } from '@withwiz/toolkit/core/auth/oauth/state-cookie';
+export type { OAuthStateCookieOptions } from '@withwiz/toolkit/core/auth/oauth/state-cookie';
+export { GoogleOAuthProvider, GitHubOAuthProvider, KakaoOAuthProvider, MicrosoftOAuthProvider, MetaOAuthProvider, } from '@withwiz/toolkit/core/auth/oauth/providers';
 export declare class OAuthManager {
     private config;
     private logger;
@@ -40,4 +40,4 @@ export declare class OAuthManager {
      */
     private getProviderConfig;
 }
-export type { OAuthConfig, OAuthUserInfo, OAuthTokenResponse, IOAuthProviderAdapter, OAuthProviderConfig } from '@withwiz/core/auth/types';
+export type { OAuthConfig, OAuthUserInfo, OAuthTokenResponse, IOAuthProviderAdapter, OAuthProviderConfig } from '@withwiz/toolkit/core/auth/types';

package/dist/core/auth/oauth/index.js

@@ -1,7 +1,10 @@
 import {
   OAuthManager
-} from "../../../chunk-V3GEYUBG.js";
+} from "../../../chunk-ER6LSA4M.js";
 import "../../../chunk-CDALZTPN.js";
+import {
+  MicrosoftOAuthProvider
+} from "../../../chunk-GSSHHVHF.js";
 import {
   GitHubOAuthProvider
 } from "../../../chunk-HIZ7USIF.js";
@@ -14,9 +17,6 @@ import {
 import {
   MetaOAuthProvider
 } from "../../../chunk-33RIHX7O.js";
-import {
-  MicrosoftOAuthProvider
-} from "../../../chunk-GSSHHVHF.js";
 import {
   OAUTH_STATE_COOKIE,
   clearOAuthStateCookie,
@@ -28,7 +28,7 @@ import {
   OAUTH_PROVIDERS
 } from "../../../chunk-GH3U4WRE.js";
 import "../../../chunk-5GWGARXI.js";
-import "../../../chunk-ORMEWXMH.js";
+import "../../../chunk-N3ETBM74.js";
 export {
   GitHubOAuthProvider,
   GoogleOAuthProvider,

package/dist/core/auth/oauth/providers/github.d.ts

@@ -3,7 +3,7 @@
  *
  * GitHub OAuth 2.0 인증 어댑터
  */
-import type { IOAuthProviderAdapter, OAuthProviderConfig, OAuthUserInfo, OAuthTokenResponse } from '@withwiz/core/auth/types';
+import type { IOAuthProviderAdapter, OAuthProviderConfig, OAuthUserInfo, OAuthTokenResponse } from '@withwiz/toolkit/core/auth/types';
 export declare class GitHubOAuthProvider implements IOAuthProviderAdapter {
     readonly name = "github";
     getLoginUrl(config: OAuthProviderConfig, state?: string): string;

package/dist/core/auth/oauth/providers/github.js

@@ -2,7 +2,7 @@ import {
   GitHubOAuthProvider
 } from "../../../../chunk-HIZ7USIF.js";
 import "../../../../chunk-5GWGARXI.js";
-import "../../../../chunk-ORMEWXMH.js";
+import "../../../../chunk-N3ETBM74.js";
 export {
   GitHubOAuthProvider
 };

package/dist/core/auth/oauth/providers/google.d.ts

@@ -3,7 +3,7 @@
  *
  * Google OAuth 2.0 인증 어댑터
  */
-import type { IOAuthProviderAdapter, OAuthProviderConfig, OAuthUserInfo, OAuthTokenResponse } from '@withwiz/core/auth/types';
+import type { IOAuthProviderAdapter, OAuthProviderConfig, OAuthUserInfo, OAuthTokenResponse } from '@withwiz/toolkit/core/auth/types';
 export declare class GoogleOAuthProvider implements IOAuthProviderAdapter {
     readonly name = "google";
     getLoginUrl(config: OAuthProviderConfig, state?: string): string;

package/dist/core/auth/oauth/providers/google.js

@@ -2,7 +2,7 @@ import {
   GoogleOAuthProvider
 } from "../../../../chunk-GF3DKZIW.js";
 import "../../../../chunk-5GWGARXI.js";
-import "../../../../chunk-ORMEWXMH.js";
+import "../../../../chunk-N3ETBM74.js";
 export {
   GoogleOAuthProvider
 };

package/dist/core/auth/oauth/providers/index.d.ts

@@ -1,5 +1,5 @@
-export { GoogleOAuthProvider } from './google';
-export { GitHubOAuthProvider } from './github';
-export { KakaoOAuthProvider } from './kakao';
-export { MicrosoftOAuthProvider } from './microsoft';
-export { MetaOAuthProvider } from './meta';
+export { GoogleOAuthProvider } from '@withwiz/toolkit/core/auth/oauth/providers/google';
+export { GitHubOAuthProvider } from '@withwiz/toolkit/core/auth/oauth/providers/github';
+export { KakaoOAuthProvider } from '@withwiz/toolkit/core/auth/oauth/providers/kakao';
+export { MicrosoftOAuthProvider } from '@withwiz/toolkit/core/auth/oauth/providers/microsoft';
+export { MetaOAuthProvider } from '@withwiz/toolkit/core/auth/oauth/providers/meta';

package/dist/core/auth/oauth/providers/index.js

@@ -1,4 +1,7 @@
 import "../../../../chunk-CDALZTPN.js";
+import {
+  MicrosoftOAuthProvider
+} from "../../../../chunk-GSSHHVHF.js";
 import {
   GitHubOAuthProvider
 } from "../../../../chunk-HIZ7USIF.js";
@@ -11,11 +14,8 @@ import {
 import {
   MetaOAuthProvider
 } from "../../../../chunk-33RIHX7O.js";
-import {
-  MicrosoftOAuthProvider
-} from "../../../../chunk-GSSHHVHF.js";
 import "../../../../chunk-5GWGARXI.js";
-import "../../../../chunk-ORMEWXMH.js";
+import "../../../../chunk-N3ETBM74.js";
 export {
   GitHubOAuthProvider,
   GoogleOAuthProvider,

package/dist/core/auth/oauth/providers/kakao.d.ts

@@ -3,7 +3,7 @@
  *
  * Kakao OAuth 2.0 인증 어댑터
  */
-import type { IOAuthProviderAdapter, OAuthProviderConfig, OAuthUserInfo, OAuthTokenResponse } from '@withwiz/core/auth/types';
+import type { IOAuthProviderAdapter, OAuthProviderConfig, OAuthUserInfo, OAuthTokenResponse } from '@withwiz/toolkit/core/auth/types';
 export declare class KakaoOAuthProvider implements IOAuthProviderAdapter {
     readonly name = "kakao";
     getLoginUrl(config: OAuthProviderConfig, state?: string): string;

package/dist/core/auth/oauth/providers/kakao.js

@@ -2,7 +2,7 @@ import {
   KakaoOAuthProvider
 } from "../../../../chunk-65HVR74O.js";
 import "../../../../chunk-5GWGARXI.js";
-import "../../../../chunk-ORMEWXMH.js";
+import "../../../../chunk-N3ETBM74.js";
 export {
   KakaoOAuthProvider
 };

package/dist/core/auth/oauth/providers/meta.d.ts

@@ -5,7 +5,7 @@
  * - Token 교환은 Meta 공식 권고에 따라 GET + query string 사용
  * - 사용자 정보는 Graph /me?fields=id,name,email,picture 응답에서 매핑
  */
-import type { IOAuthProviderAdapter, OAuthProviderConfig, OAuthUserInfo, OAuthTokenResponse } from '@withwiz/core/auth/types';
+import type { IOAuthProviderAdapter, OAuthProviderConfig, OAuthUserInfo, OAuthTokenResponse } from '@withwiz/toolkit/core/auth/types';
 export declare class MetaOAuthProvider implements IOAuthProviderAdapter {
     readonly name = "meta";
     getLoginUrl(config: OAuthProviderConfig, state?: string): string;

package/dist/core/auth/oauth/providers/meta.js

@@ -2,7 +2,7 @@ import {
   MetaOAuthProvider
 } from "../../../../chunk-33RIHX7O.js";
 import "../../../../chunk-5GWGARXI.js";
-import "../../../../chunk-ORMEWXMH.js";
+import "../../../../chunk-N3ETBM74.js";
 export {
   MetaOAuthProvider
 };

package/dist/core/auth/oauth/providers/microsoft.d.ts

@@ -12,7 +12,7 @@
  * 위해, exchangeCodeForToken은 upstream의 `id_token` 값을 OAuthTokenResponse.access_token
  * 필드에 담아 반환한다. getUserInfo는 그 문자열을 JWKS 서명 검증 후 사용한다.
  */
-import type { IOAuthProviderAdapter, OAuthProviderConfig, OAuthUserInfo, OAuthTokenResponse } from '@withwiz/core/auth/types';
+import type { IOAuthProviderAdapter, OAuthProviderConfig, OAuthUserInfo, OAuthTokenResponse } from '@withwiz/toolkit/core/auth/types';
 export declare class MicrosoftOAuthProvider implements IOAuthProviderAdapter {
     readonly name = "microsoft";
     getLoginUrl(config: OAuthProviderConfig, state?: string): string;

package/dist/core/auth/oauth/providers/microsoft.js

@@ -2,7 +2,7 @@ import {
   MicrosoftOAuthProvider
 } from "../../../../chunk-GSSHHVHF.js";
 import "../../../../chunk-5GWGARXI.js";
-import "../../../../chunk-ORMEWXMH.js";
+import "../../../../chunk-N3ETBM74.js";
 export {
   MicrosoftOAuthProvider
 };

package/dist/core/auth/oauth/state-cookie.js

@@ -5,7 +5,7 @@ import {
   setOAuthStateCookie,
   validateOAuthState
 } from "../../../chunk-JLRMET4V.js";
-import "../../../chunk-ORMEWXMH.js";
+import "../../../chunk-N3ETBM74.js";
 export {
   OAUTH_STATE_COOKIE,
   clearOAuthStateCookie,

package/dist/core/auth/password/client-helper.d.ts

@@ -3,8 +3,8 @@
  *
  * 클라이언트 사이드용 비밀번호 검증 헬퍼 (프레임워크 독립적)
  */
-import { PasswordValidator, PasswordHasher } from './index';
-import type { PasswordConfig } from '@withwiz/core/auth/types';
+import { PasswordValidator, PasswordHasher } from '@withwiz/toolkit/core/auth/password';
+import type { PasswordConfig } from '@withwiz/toolkit/core/auth/types';
 import type { z } from 'zod';
 /**
  * 기본 비밀번호 설정
@@ -17,19 +17,19 @@ export declare function createPasswordValidator(config?: Partial<PasswordConfig>
 /**
  * 비밀번호 검증 헬퍼 함수 (간편 사용)
  */
-export declare function validatePassword(password: string, config?: Partial<PasswordConfig>): import("./index").PasswordValidationResult;
+export declare function validatePassword(password: string, config?: Partial<PasswordConfig>): import("@withwiz/toolkit/core/auth/password").PasswordValidationResult;
 /**
  * 비밀번호 강도 계산 헬퍼 함수
  */
-export declare function getPasswordStrength(password: string, config?: Partial<PasswordConfig>): import("@withwiz/core/auth/types").PasswordStrength;
+export declare function getPasswordStrength(password: string, config?: Partial<PasswordConfig>): import("@withwiz/toolkit/core/auth/types").PasswordStrength;
 /**
  * Zod 스키마 생성 헬퍼 함수
  */
-export declare function createPasswordSchema(config?: Partial<PasswordConfig>): z.ZodString;
+export declare function createPasswordSchema(config?: Partial<PasswordConfig>): z.ZodType<string>;
 /**
  * 기본 Zod 스키마 (기존 defaultPasswordSchema와 호환)
  */
-export declare const defaultPasswordSchema: z.ZodString;
+export declare const defaultPasswordSchema: z.ZodType<string, z.ZodTypeDef, string>;
 /**
  * 싱글톤 인스턴스 (기존 PasswordValidator 정적 메서드 대체)
  */
@@ -39,6 +39,6 @@ export declare const passwordValidator: PasswordValidator;
  * ⚠️ WARNING: 해싱은 서버 사이드에서만 수행해야 합니다.
  */
 export declare function createPasswordHasher(rounds?: number): PasswordHasher;
-export { PasswordValidator, PasswordHasher } from './index';
-export type { PasswordValidationResult } from './index';
-export type { PasswordConfig, PasswordStrength } from '@withwiz/core/auth/types';
+export { PasswordValidator, PasswordHasher } from '@withwiz/toolkit/core/auth/password';
+export type { PasswordValidationResult } from '@withwiz/toolkit/core/auth/password';
+export type { PasswordConfig, PasswordStrength } from '@withwiz/toolkit/core/auth/types';

package/dist/core/auth/password/client-helper.js

@@ -7,13 +7,15 @@ import {
   getPasswordStrength,
   passwordValidator,
   validatePassword
-} from "../../../chunk-6JXHXIEH.js";
+} from "../../../chunk-3UIKCS56.js";
 import {
   PasswordHasher,
   PasswordValidator
-} from "../../../chunk-MNYVAEXK.js";
+} from "../../../chunk-4ROIPF33.js";
+import "../../../chunk-ILMPKSWS.js";
 import "../../../chunk-GH3U4WRE.js";
-import "../../../chunk-ORMEWXMH.js";
+import "../../../chunk-5GWGARXI.js";
+import "../../../chunk-N3ETBM74.js";
 export {
   DEFAULT_PASSWORD_CONFIG,
   PasswordHasher,

package/dist/core/auth/password/hasher.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Pluggable Password Hashing
+ *
+ * `IPasswordHasher` 추상화로 해시 백엔드를 교체 가능하게 한다.
+ * - `BcryptPasswordHasher`: 기본(bcryptjs). 하드 의존성.
+ * - `Argon2idPasswordHasher`: argon2id. `argon2` 패키지를 지연 import 하는
+ *   optional 의존성 — 설치되지 않으면 verify/hash 호출 시 명확한 에러를 던진다.
+ * - `MigratingPasswordHasher`: preferred + legacy 해셔를 조합해 레거시 해시를
+ *   검증하고(scrypt→bcrypt 등) rehash 대상 여부를 판정한다 (rehash-on-login).
+ *
+ * rehash-on-login 흐름: 로그인 시 verify() 성공 후 needsRehash(storedHash) 가
+ * true 면 preferred 스킴으로 다시 해싱해 저장한다. 평문은 로그인 시점에만
+ * 존재하므로 이 시점이 무중단 마이그레이션의 유일한 기회다.
+ */
+export interface IPasswordHasher {
+    /** 스킴 식별자 (예: 'bcrypt', 'argon2id'). 로깅/디버깅용. */
+    readonly id: string;
+    /** 이 해셔가 인식하는 해시 포맷인지 판정 (verify 위임 라우팅에 사용). */
+    identifies(hash: string): boolean;
+    /** 평문을 이 해셔의 스킴으로 해싱. */
+    hash(password: string): Promise<string>;
+    /** 평문과 해시 비교. */
+    verify(password: string, hash: string): Promise<boolean>;
+    /**
+     * 이 해시를 다시 해싱해야 하는지 판정한다.
+     * - 다른 스킴이거나(스킴 마이그레이션)
+     * - 같은 스킴이지만 파라미터가 현재 설정보다 약하면 true.
+     */
+    needsRehash(hash: string): boolean;
+}
+export interface BcryptHasherOptions {
+    /** bcrypt cost factor. 기본 12. */
+    rounds?: number;
+}
+export declare class BcryptPasswordHasher implements IPasswordHasher {
+    readonly id = "bcrypt";
+    private rounds;
+    constructor(options?: BcryptHasherOptions);
+    identifies(hash: string): boolean;
+    hash(password: string): Promise<string>;
+    verify(password: string, hash: string): Promise<boolean>;
+    needsRehash(hash: string): boolean;
+}
+export interface Argon2idHasherOptions {
+    /** 메모리 비용 (KiB). 기본 19456 (= 19 MiB, OWASP 권장 하한). */
+    memoryCost?: number;
+    /** 반복 횟수. 기본 2. */
+    timeCost?: number;
+    /** 병렬성. 기본 1. */
+    parallelism?: number;
+}
+/** 테스트 전용: 지연 로드된 argon2 모듈 캐시를 초기화한다. */
+export declare function __resetArgon2Cache(): void;
+export declare class Argon2idPasswordHasher implements IPasswordHasher {
+    readonly id = "argon2id";
+    private memoryCost;
+    private timeCost;
+    private parallelism;
+    constructor(options?: Argon2idHasherOptions);
+    identifies(hash: string): boolean;
+    hash(password: string): Promise<string>;
+    verify(password: string, hash: string): Promise<boolean>;
+    needsRehash(hash: string): boolean;
+}
+export interface MigratingHasherOptions {
+    /** 신규 해시 및 rehash 대상 스킴. */
+    preferred: IPasswordHasher;
+    /**
+     * 검증만 지원하는 레거시 해셔들 (예: 소비자가 구현한 scrypt 어댑터).
+     * verify 시 preferred 다음 순서로 매칭을 시도한다.
+     */
+    legacy?: IPasswordHasher[];
+}
+export declare class MigratingPasswordHasher implements IPasswordHasher {
+    private preferred;
+    private legacy;
+    constructor(options: MigratingHasherOptions);
+    get id(): string;
+    identifies(hash: string): boolean;
+    hash(password: string): Promise<string>;
+    verify(password: string, hash: string): Promise<boolean>;
+    needsRehash(hash: string): boolean;
+}