@withwiz/toolkit 0.7.1 → 0.8.0

package/README.ko.md

@@ -0,0 +1,235 @@
+# @withwiz/toolkit
+
+[English](README.md) | **한국어**
+
+Shared utility library for [withwiz](https://github.com/greeun) projects — 인증, 캐싱, 에러 처리, 미들웨어, 지오로케이션, 로깅 등 프로덕션 수준의 모듈 모음.
+
+## Features
+
+- **Composition root** — 단일 `initialize()`로 모든 티어 설정을 한 번에 조립
+- **Framework tiers** — `core` / `next` / `react` / `prisma` 4개 티어로 의존성 분리 (0.7+)
+- **Auth** — JWT, password hashing, OAuth helpers (Google / GitHub / Kakao / Microsoft / Meta), state-cookie CSRF 바인딩, Prisma adapter
+- **Cache** — Redis / in-memory / hybrid / noop 백엔드, factory, invalidation, defaults
+- **Constants** — Error codes, messages, pagination, security constants
+- **Error** — Typed `AppError`, framework-aware error handler / display (core · next · react)
+- **Geolocation** — GeoIP lookup, batch processing, provider factory
+- **Hooks** — `useDataTable`, `useDebounce`, `useExitIntent`, `useTimezone`
+- **Logger** — Winston-based structured logger with daily rotation
+- **Middleware** — Auth, rate-limiting, CORS, security middleware wrappers (Next.js)
+- **Storage** — Cloudflare R2 (AWS S3-compatible) storage
+- **System** — Health check, system monitoring
+- **Types** — Shared TypeScript types (API, DB, env, GeoIP, user, i18n, QR)
+- **Utils** — Sanitizer, type-guards, CSV export, URL normalizer, timezone, IP utils, ...
+- **Validators** — Password strength validator
+
+## Installation
+
+```bash
+npm install @withwiz/toolkit
+# or
+pnpm add @withwiz/toolkit
+# or
+yarn add @withwiz/toolkit
+```
+
+### Peer dependencies (optional)
+
+`next` / `react` / `react-dom` 은 **optional** peer입니다 — 사용하는 티어가 요구하는 peer만 설치하세요.
+
+```bash
+# next 티어를 쓸 때
+npm install next
+
+# react 티어를 쓸 때
+npm install react react-dom
+
+# core 티어만 쓰는 백엔드 / CLI
+# (별도 peer 설치 불필요)
+```
+
+## Quick start
+
+```ts
+// Auth — JWT
+import { signToken, verifyToken } from '@withwiz/toolkit/core/auth/jwt'
+
+const token = await signToken({ userId: 'u_123' })
+const payload = await verifyToken(token)
+```
+
+```ts
+// Cache — Redis wrapper
+import { withCache } from '@withwiz/toolkit/core/cache'
+
+const data = await withCache('my-key', async () => fetchData(), 3600)
+```
+
+```ts
+// Error — typed error class
+import { AppError } from '@withwiz/toolkit/core/error'
+
+throw new AppError('NOT_FOUND', 'Resource not found', 404)
+```
+
+```ts
+// Logger
+import { logInfo, logError } from '@withwiz/toolkit/core/logger/logger'
+
+logInfo('Server started', { port: 3000 })
+logError('Something went wrong', { error })
+```
+
+```ts
+// Geolocation
+import { getGeoLocation } from '@withwiz/toolkit/core/geolocation'
+
+const geo = await getGeoLocation('8.8.8.8')
+// { country: 'US', city: 'Mountain View', ... }
+```
+
+```tsx
+// Hooks (React)
+import { useDebounce } from '@withwiz/toolkit/react/hooks/useDebounce'
+
+const debouncedQuery = useDebounce(query, 300)
+```
+
+```ts
+// Utils
+import { sanitizeInput } from '@withwiz/toolkit/core/utils/sanitizer'
+import { formatNumber }  from '@withwiz/toolkit/core/utils/format-number'
+import { normalizeUrl }  from '@withwiz/toolkit/core/utils/url-normalizer'
+```
+
+### 토큰 전달 모드 (tokenDelivery)
+
+인증 토큰 전달 방식을 초기화 시 선택할 수 있습니다. 기본값은 `'hybrid'`(쿠키 + 헤더 동시 지원, 기존 동작)입니다.
+
+```typescript
+import { initialize } from '@withwiz/toolkit/initialize';
+
+initialize({
+  auth: {
+    jwtSecret: process.env.JWT_SECRET!,
+    tokenDelivery: 'cookie', // 'cookie' | 'header' | 'hybrid' (기본)
+  },
+});
+```
+
+핸들러별로 덮어쓸 수도 있습니다 (옵션 > 전역 > `'hybrid'` 순):
+
+```typescript
+createAuthHandlers({ ...options, tokenDelivery: 'header' });
+```
+
+| 모드 | 토큰 위치 | 특징 |
+|---|---|---|
+| `cookie` | HttpOnly 쿠키 전용 | 응답 body 에서 토큰 제거 — XSS 노출 면 최소. 브라우저 앱 권장 |
+| `header` | `Authorization: Bearer` + body | refresh 는 body `{ refreshToken }` 으로 전달. 클라이언트 저장소는 XSS 에 상대적으로 취약 — 비브라우저 클라이언트용 |
+| `hybrid` | 둘 다 | 기존 동작. 쿠키 우선, 헤더/body 폴백 |
+
+**제약**: OAuth callback 은 redirect 응답이라 모드와 무관하게 쿠키로만 토큰을 전달합니다. OAuth 를 쓰는 앱은 `'cookie'` 또는 `'hybrid'` 를 사용하세요.
+
+## Module reference
+
+0.7부터 모든 subpath는 프레임워크 의존성에 따라 4개 티어로 분리됩니다.
+자세한 티어 모델·규칙·마이그레이션 매핑은 [`docs/FRAMEWORK_TIERS.md`](docs/FRAMEWORK_TIERS.md)
+및 [`CHANGELOG.md`](CHANGELOG.md) 의 0.7.0 항목을 참조하세요.
+
+### Composition root
+
+| Subpath | Description |
+|---|---|
+| `/initialize` | 모든 티어 설정을 단일 객체로 조립하는 통합 진입점 |
+
+### `core` — 프레임워크 독립 (pure TS)
+
+| Subpath | Description |
+|---|---|
+| `/core/auth` | Full auth (JWT + password + OAuth + services + email + types) |
+| `/core/auth/jwt` | JWT sign / verify |
+| `/core/auth/password` | bcrypt helpers |
+| `/core/auth/oauth` | OAuth utilities (Google / GitHub / Kakao / Microsoft / Meta) |
+| `/core/auth/oauth/providers/{google,github,kakao,microsoft,meta}` | Individual OAuth providers |
+| `/core/auth/services` | Login / token-refresh / oauth-callback services |
+| `/core/auth/email` | Email token generation |
+| `/core/auth/types` | Framework-independent auth types |
+| `/core/cache` | Cache facade (get / set / delete / withCache) |
+| `/core/cache/cache-factory` | Cache backend factory (Redis / in-memory / hybrid / noop) |
+| `/core/cache/cache-invalidation` | Pattern-based cache invalidation |
+| `/core/config` | Config registry |
+| `/core/constants/{error-codes,messages,pagination,security}` | Shared constants |
+| `/core/cors` | Framework-independent CORS config |
+| `/core/error` | `AppError`, error codes, i18n messages, `extractErrorInfo` |
+| `/core/geolocation` | GeoIP lookup, batch processor, provider factory |
+| `/core/logger/logger` | Winston-based structured logger |
+| `/core/storage` | Cloudflare R2 / S3-compatible storage |
+| `/core/system` | Health check, system monitoring |
+| `/core/types/{api,database,env,geoip,i18n,qr-code,user}` | Shared TypeScript types |
+| `/core/utils` | `sanitizer`, `type-guards`, `format-number`, `ip-utils`, `timezone`, ... |
+| `/core/validators` | Password strength validator |
+
+### `next` — Next.js 의존
+
+| Subpath | Description |
+|---|---|
+| `/next/middleware` | Auth · rate-limit · CORS · security · wrappers |
+| `/next/auth-handlers` | Route handlers (login / refresh / oauth callback / me) |
+| `/next/auth-types` | Handler types (`NextRequest` signatures) |
+| `/next/error` | `error-handler` (NextResponse), `LocaleDetector`, `ErrorBoundary` |
+| `/next/utils` | `api-helpers`, `cors`, `csv-export`, `error-processor` |
+
+### `react` — React 의존
+
+| Subpath | Description |
+|---|---|
+| `/react/components/ui/*` | Button, Table, Badge, DataTable, ... |
+| `/react/hooks/{useDataTable,useDebounce,useExitIntent,useTimezone}` | React hooks |
+| `/react/error` | `error-display` (sonner toast) |
+| `/react/utils/{client-utils,qr-code}` | Browser-context utilities |
+
+### `prisma` — Prisma 의존
+
+| Subpath | Description |
+|---|---|
+| `/prisma/auth-adapter` | `UserRepository` / `OAuthAccountRepository` / `EmailTokenRepository` Prisma 구현체 |
+
+## Requirements
+
+- Node.js >= 18
+- TypeScript >= 5
+
+### Optional peers
+
+`next` / `react` / `react-dom` 은 `optional` peer dependency입니다.
+사용하는 티어가 요구하는 peer만 설치하세요:
+
+- `core` 티어만 쓰는 백엔드 / CLI: peer 불필요
+- `next` 티어: Next.js >= 15
+- `react` 티어: React >= 18, React-DOM >= 18
+- `prisma` 티어: Prisma 호환 클라이언트 (덕 타이핑)
+- Prisma 어댑터의 `EmailTokenRepository` 등 일부 모듈: `date-fns >= 3` (optional)
+- 이메일 전송: `nodemailer >= 6` (optional)
+
+## Development
+
+```bash
+# Install dependencies
+npm install
+
+# Build
+npm run build
+
+# Run tests
+npm test
+
+# Watch mode
+npm run test:watch
+
+# Coverage
+npm run test:coverage
+```
+
+## License
+
+MIT © [withwiz](https://github.com/greeun)

package/README.md

@@ -1,13 +1,15 @@
 # @withwiz/toolkit
 
+**English** | [한국어](README.ko.md)
+
 Shared utility library for [withwiz](https://github.com/greeun) projects — a collection of production-ready modules for authentication, caching, error handling, middleware, geolocation, logging, and more.
 
 ## Features
 
-- **Composition root** — 단일 `initialize()`로 모든 티어 설정을 한 번에 조립
-- **Framework tiers** — `core` / `next` / `react` / `prisma` 4개 티어로 의존성 분리 (0.7+)
-- **Auth** — JWT, password hashing, OAuth helpers (Google / GitHub / Kakao / Microsoft / Meta), state-cookie CSRF 바인딩, Prisma adapter
-- **Cache** — Redis / in-memory / hybrid / noop 백엔드, factory, invalidation, defaults
+- **Composition root** — assemble every tier's configuration at once with a single `initialize()`
+- **Framework tiers** — dependencies split across four tiers: `core` / `next` / `react` / `prisma` (0.7+)
+- **Auth** — JWT, password hashing, OAuth helpers (Google / GitHub / Kakao / Microsoft / Meta), state-cookie CSRF binding, Prisma adapter
+- **Cache** — Redis / in-memory / hybrid / noop backends, factory, invalidation, defaults
 - **Constants** — Error codes, messages, pagination, security constants
 - **Error** — Typed `AppError`, framework-aware error handler / display (core · next · react)
 - **Geolocation** — GeoIP lookup, batch processing, provider factory
@@ -32,17 +34,17 @@ yarn add @withwiz/toolkit
 
 ### Peer dependencies (optional)
 
-`next` / `react` / `react-dom` 은 **optional** peer입니다 — 사용하는 티어가 요구하는 peer만 설치하세요.
+`next` / `react` / `react-dom` are **optional** peers — install only the peers required by the tiers you use.
 
 ```bash
-# next 티어를 쓸 때
+# When using the next tier
 npm install next
 
-# react 티어를 쓸 때
+# When using the react tier
 npm install react react-dom
 
-# core 티어만 쓰는 백엔드 / CLI
-# (별도 peer 설치 불필요)
+# Backend / CLI using only the core tier
+# (no extra peers required)
 ```
 
 ## Quick start
@@ -99,19 +101,48 @@ import { formatNumber }  from '@withwiz/toolkit/core/utils/format-number'
 import { normalizeUrl }  from '@withwiz/toolkit/core/utils/url-normalizer'
 ```
 
+### Token delivery mode (tokenDelivery)
+
+You can choose how authentication tokens are delivered at initialization time. The default is `'hybrid'` (cookie + header support, the legacy behavior).
+
+```typescript
+import { initialize } from '@withwiz/toolkit/initialize';
+
+initialize({
+  auth: {
+    jwtSecret: process.env.JWT_SECRET!,
+    tokenDelivery: 'cookie', // 'cookie' | 'header' | 'hybrid' (default)
+  },
+});
+```
+
+It can also be overridden per handler (precedence: option > global > `'hybrid'`):
+
+```typescript
+createAuthHandlers({ ...options, tokenDelivery: 'header' });
+```
+
+| Mode | Token location | Notes |
+|---|---|---|
+| `cookie` | HttpOnly cookie only | Token removed from the response body — minimal XSS exposure. Recommended for browser apps |
+| `header` | `Authorization: Bearer` + body | Refresh is passed via the body `{ refreshToken }`. Client-side storage is relatively vulnerable to XSS — for non-browser clients |
+| `hybrid` | Both | Legacy behavior. Cookie first, with header/body fallback |
+
+**Constraint**: The OAuth callback is a redirect response, so it always delivers the token via cookie regardless of the mode. Apps that use OAuth should use `'cookie'` or `'hybrid'`.
+
 ## Module reference
 
-0.7부터 모든 subpath는 프레임워크 의존성에 따라 4개 티어로 분리됩니다.
-자세한 티어 모델·규칙·마이그레이션 매핑은 [`docs/FRAMEWORK_TIERS.md`](docs/FRAMEWORK_TIERS.md)
-및 [`CHANGELOG.md`](CHANGELOG.md) 의 0.7.0 항목을 참조하세요.
+Since 0.7, every subpath is split into four tiers based on its framework dependencies.
+For the detailed tier model, rules, and migration mapping, see [`docs/FRAMEWORK_TIERS.md`](docs/FRAMEWORK_TIERS.md)
+and the 0.7.0 entry in [`CHANGELOG.md`](CHANGELOG.md).
 
 ### Composition root
 
 | Subpath | Description |
 |---|---|
-| `/initialize` | 모든 티어 설정을 단일 객체로 조립하는 통합 진입점 |
+| `/initialize` | Unified entry point that assembles every tier's configuration into a single object |
 
-### `core` — 프레임워크 독립 (pure TS)
+### `core` — framework-independent (pure TS)
 
 | Subpath | Description |
 |---|---|
@@ -138,7 +169,7 @@ import { normalizeUrl }  from '@withwiz/toolkit/core/utils/url-normalizer'
 | `/core/utils` | `sanitizer`, `type-guards`, `format-number`, `ip-utils`, `timezone`, ... |
 | `/core/validators` | Password strength validator |
 
-### `next` — Next.js 의존
+### `next` — depends on Next.js
 
 | Subpath | Description |
 |---|---|
@@ -148,7 +179,7 @@ import { normalizeUrl }  from '@withwiz/toolkit/core/utils/url-normalizer'
 | `/next/error` | `error-handler` (NextResponse), `LocaleDetector`, `ErrorBoundary` |
 | `/next/utils` | `api-helpers`, `cors`, `csv-export`, `error-processor` |
 
-### `react` — React 의존
+### `react` — depends on React
 
 | Subpath | Description |
 |---|---|
@@ -157,11 +188,11 @@ import { normalizeUrl }  from '@withwiz/toolkit/core/utils/url-normalizer'
 | `/react/error` | `error-display` (sonner toast) |
 | `/react/utils/{client-utils,qr-code}` | Browser-context utilities |
 
-### `prisma` — Prisma 의존
+### `prisma` — depends on Prisma
 
 | Subpath | Description |
 |---|---|
-| `/prisma/auth-adapter` | `UserRepository` / `OAuthAccountRepository` / `EmailTokenRepository` Prisma 구현체 |
+| `/prisma/auth-adapter` | Prisma implementations of `UserRepository` / `OAuthAccountRepository` / `EmailTokenRepository` |
 
 ## Requirements
 
@@ -170,15 +201,15 @@ import { normalizeUrl }  from '@withwiz/toolkit/core/utils/url-normalizer'
 
 ### Optional peers
 
-`next` / `react` / `react-dom` 은 `optional` peer dependency입니다.
-사용하는 티어가 요구하는 peer만 설치하세요:
+`next` / `react` / `react-dom` are `optional` peer dependencies.
+Install only the peers required by the tiers you use:
 
-- `core` 티어만 쓰는 백엔드 / CLI: peer 불필요
-- `next` 티어: Next.js >= 15
-- `react` 티어: React >= 18, React-DOM >= 18
-- `prisma` 티어: Prisma 호환 클라이언트 (덕 타이핑)
-- Prisma 어댑터의 `EmailTokenRepository` 등 일부 모듈: `date-fns >= 3` (optional)
-- 이메일 전송: `nodemailer >= 6` (optional)
+- Backend / CLI using only the `core` tier: no peers required
+- `next` tier: Next.js >= 15
+- `react` tier: React >= 18, React-DOM >= 18
+- `prisma` tier: a Prisma-compatible client (duck-typed)
+- Some modules such as the Prisma adapter's `EmailTokenRepository`: `date-fns >= 3` (optional)
+- Email delivery: `nodemailer >= 6` (optional)
 
 ## Development
 

package/dist/{chunk-V6YD53NH.js → chunk-23LQJYZN.js}

@@ -2,6 +2,9 @@ import {
   ERROR_CODES,
   formatErrorMessage
 } from "./chunk-XQIAXMRY.js";
+import {
+  ROLE_DEFAULTS
+} from "./chunk-7YWUKMZD.js";
 
 // src/next/utils/api-helpers.ts
 import { NextResponse } from "next/server";
@@ -73,8 +76,8 @@ function createPaginatedResponse(data, total, page, limit) {
     }
   });
 }
-function requireAdmin(userRole) {
-  if (userRole !== "ADMIN") {
+function requireAdmin(userRole, adminRole = ROLE_DEFAULTS.ADMIN_ROLE) {
+  if (userRole !== adminRole) {
     return {
       isAdmin: false,
       response: NextResponse.json(

package/dist/{chunk-ZTRASVGZ.js → chunk-34L7HTM7.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-PX535BHW.js";
 import {
   __spreadValues
-} from "./chunk-ORMEWXMH.js";
+} from "./chunk-N3ETBM74.js";
 
 // src/next/utils/cors.ts
 import { NextResponse } from "next/server";

package/dist/{chunk-GSUCBWML.js → chunk-3RK3MKAR.js}

@@ -1,6 +1,6 @@
 import {
   __spreadValues
-} from "./chunk-ORMEWXMH.js";
+} from "./chunk-N3ETBM74.js";
 
 // src/core/utils/sanitizer.ts
 function sanitizeHtml(input) {
@@ -21,7 +21,10 @@ function removeEventHandlers(input) {
   if (!input || typeof input !== "string") {
     return "";
   }
-  return input.replace(/\bon\w+\s*=\s*["'][^"']*["']/gi, "");
+  return input.replace(
+    /\bon\w+\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+)/gi,
+    ""
+  );
 }
 function sanitizeUrl(url) {
   if (!url || typeof url !== "string") {

package/dist/{chunk-6JXHXIEH.js → chunk-3UIKCS56.js}

@@ -1,10 +1,10 @@
 import {
   PasswordHasher,
   PasswordValidator
-} from "./chunk-MNYVAEXK.js";
+} from "./chunk-4ROIPF33.js";
 import {
   __spreadValues
-} from "./chunk-ORMEWXMH.js";
+} from "./chunk-N3ETBM74.js";
 
 // src/core/auth/password/client-helper.ts
 var DEFAULT_PASSWORD_CONFIG = {

package/dist/{chunk-MNYVAEXK.js → chunk-4ROIPF33.js}

@@ -1,6 +1,9 @@
 // src/core/auth/password/index.ts
 import { z } from "zod";
 import bcrypt from "bcryptjs";
+var BCRYPT_MAX_PASSWORD_BYTES = 72;
+var utf8ByteLength = (value) => new TextEncoder().encode(value).length;
+var BCRYPT_BYTE_LIMIT_MESSAGE = `Password cannot exceed ${BCRYPT_MAX_PASSWORD_BYTES} bytes`;
 var _PasswordValidator = class _PasswordValidator {
   constructor(config) {
     this.config = config;
@@ -20,6 +23,9 @@ var _PasswordValidator = class _PasswordValidator {
         `Password cannot exceed ${this.config.maxLength} characters`
       );
     }
+    if (utf8ByteLength(password) > BCRYPT_MAX_PASSWORD_BYTES) {
+      errors.push(BCRYPT_BYTE_LIMIT_MESSAGE);
+    }
     if (this.config.requireNumber && !/\d/.test(password)) {
       errors.push("Password must contain at least one number");
     }
@@ -119,7 +125,10 @@ var _PasswordValidator = class _PasswordValidator {
         "Password must contain at least one special character"
       );
     }
-    return schema;
+    return schema.refine(
+      (value) => utf8ByteLength(value) <= BCRYPT_MAX_PASSWORD_BYTES,
+      { message: BCRYPT_BYTE_LIMIT_MESSAGE }
+    );
   }
   /**
    * 비밀번호 힌트 생성
@@ -201,11 +210,15 @@ var PasswordHasher = class {
     return bcrypt.compare(password, hash);
   }
 };
-var defaultPasswordSchema = z.string().min(8, "Password must be at least 8 characters long").max(128, "Password cannot exceed 128 characters").regex(/\d/, "Password must contain at least one number");
+var defaultPasswordSchema = z.string().min(8, "Password must be at least 8 characters long").max(128, "Password cannot exceed 128 characters").regex(/\d/, "Password must contain at least one number").refine((value) => utf8ByteLength(value) <= BCRYPT_MAX_PASSWORD_BYTES, {
+  message: BCRYPT_BYTE_LIMIT_MESSAGE
+});
 var strongPasswordSchema = z.string().min(12, "Password must be at least 12 characters long").max(128, "Password cannot exceed 128 characters").regex(/[a-z]/, "Password must contain at least one lowercase letter").regex(/[A-Z]/, "Password must contain at least one uppercase letter").regex(/\d/, "Password must contain at least one number").regex(
   /[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?~`]/,
   "Password must contain at least one special character"
-);
+).refine((value) => utf8ByteLength(value) <= BCRYPT_MAX_PASSWORD_BYTES, {
+  message: BCRYPT_BYTE_LIMIT_MESSAGE
+});
 
 export {
   PasswordValidator,

package/dist/{chunk-JKSABDFT.js → chunk-4TGPAUJV.js}

@@ -3,17 +3,17 @@ import {
   isRedisGloballyDisabled,
   notifyRedisError,
   resetRedisGlobalState
-} from "./chunk-6TUDUOGC.js";
+} from "./chunk-ZEHNCHIV.js";
 import {
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 import {
   getENV,
   isCacheEnabled
-} from "./chunk-7F5X6F7X.js";
+} from "./chunk-HV6A6Z5R.js";
 import {
   __spreadValues
-} from "./chunk-ORMEWXMH.js";
+} from "./chunk-N3ETBM74.js";
 
 // src/core/cache/redis-cache-manager.ts
 var RedisCacheManager = class _RedisCacheManager {

package/dist/{chunk-D2KXIKI4.js → chunk-4XPXZNBX.js}

@@ -1,18 +1,19 @@
 import {
   JWTService
-} from "./chunk-2PFSRVVD.js";
-import {
-  setTokenCookies
-} from "./chunk-RJGYONRO.js";
+} from "./chunk-LWHLB2Y6.js";
 import {
   AuthError
 } from "./chunk-5GWGARXI.js";
 import {
-  JWT_DEFAULTS
-} from "./chunk-2SIBG5BG.js";
+  getTokenDeliveryStrategy
+} from "./chunk-63EKUOJH.js";
+import {
+  JWT_DEFAULTS,
+  ROLE_DEFAULTS
+} from "./chunk-7YWUKMZD.js";
 import {
   __spreadValues
-} from "./chunk-ORMEWXMH.js";
+} from "./chunk-N3ETBM74.js";
 
 // src/next/auth-handlers/login.handler.ts
 import { NextResponse } from "next/server";
@@ -22,9 +23,10 @@ var loginSchema = z.object({
   email: z.string().email(),
   password: z.string().min(1)
 });
+var DUMMY_PASSWORD_HASH = "$2b$12$/l4jMXYcTL.SQgNWzy1UcuSlrtLlw.GFTpWDYTficzN2kRhN/LwEO";
 function createLoginHandler(options) {
   var _a, _b;
-  const { dependencies, jwt, hooks, features, cookie } = options;
+  const { dependencies, jwt, hooks, features, cookie, tokenDelivery } = options;
   const jwtService = new JWTService({
     secret: jwt.secret,
     accessTokenExpiry: (_a = jwt.accessTokenExpiry) != null ? _a : JWT_DEFAULTS.DEFAULT_ACCESS_TOKEN_EXPIRES,
@@ -50,6 +52,7 @@ function createLoginHandler(options) {
       }
       const user = await dependencies.userRepository.findByEmail(email);
       if (!user) {
+        await compare(password, DUMMY_PASSWORD_HASH);
         return NextResponse.json({ success: false, error: "Invalid credentials" }, { status: 401 });
       }
       if (user.isActive === false) {
@@ -57,6 +60,7 @@ function createLoginHandler(options) {
       }
       const userRecord = user;
       if (!userRecord.password) {
+        await compare(password, DUMMY_PASSWORD_HASH);
         return NextResponse.json({ success: false, error: "Invalid credentials" }, { status: 401 });
       }
       const isValid = await compare(password, userRecord.password);
@@ -72,7 +76,7 @@ function createLoginHandler(options) {
       const tokens = await jwtService.createTokenPair({
         id: user.id,
         email: user.email,
-        role: (_a2 = user.role) != null ? _a2 : "USER",
+        role: (_a2 = user.role) != null ? _a2 : ROLE_DEFAULTS.DEFAULT_ROLE,
         emailVerified: user.emailVerified
       });
       await dependencies.userRepository.updateLastLoginAt(user.id);
@@ -87,8 +91,11 @@ function createLoginHandler(options) {
       if (hooks == null ? void 0 : hooks.extendUserResponse) {
         userResponse = __spreadValues(__spreadValues({}, userResponse), await hooks.extendUserResponse(user));
       }
-      const response = NextResponse.json({ success: true, user: userResponse, tokens });
-      setTokenCookies(response, tokens, { secure: cookie == null ? void 0 : cookie.secure });
+      const strategy = getTokenDeliveryStrategy(tokenDelivery);
+      const response = NextResponse.json(
+        strategy.buildTokenResponse({ success: true, user: userResponse }, { tokens })
+      );
+      strategy.attachCookies(response, tokens, { secure: cookie == null ? void 0 : cookie.secure });
       return response;
     } catch (error) {
       if (error instanceof AuthError) {

package/dist/{chunk-LG3KM5V3.js → chunk-5I3EQHR4.js}

@@ -1,3 +1,7 @@
+import {
+  ROLE_DEFAULTS
+} from "./chunk-7YWUKMZD.js";
+
 // src/core/auth/jwt/client.ts
 var JWTClientManager = class {
   constructor(storageKey = "jwt_tokens") {
@@ -136,10 +140,10 @@ var JWTClientManager = class {
    */
   getUserRole(token) {
     if (!token) {
-      return "USER";
+      return ROLE_DEFAULTS.DEFAULT_ROLE;
     }
     const user = this.extractUserFromToken(token);
-    return (user == null ? void 0 : user.role) || "USER";
+    return (user == null ? void 0 : user.role) || ROLE_DEFAULTS.DEFAULT_ROLE;
   }
   /**
    * Authorization 헤더 생성