@withwiz/toolkit 0.7.1 → 0.8.0

package/dist/{chunk-2PFSRVVD.js → chunk-LWHLB2Y6.js}

@@ -4,25 +4,78 @@ import {
 import {
   __spreadProps,
   __spreadValues
-} from "./chunk-ORMEWXMH.js";
+} from "./chunk-N3ETBM74.js";
 
 // src/core/auth/jwt/index.ts
-import { SignJWT, jwtVerify } from "jose";
+import { randomUUID } from "crypto";
+import {
+  SignJWT,
+  jwtVerify,
+  importPKCS8,
+  importSPKI,
+  createRemoteJWKSet
+} from "jose";
 var JWTManager = class {
   constructor(config, logger) {
     this.config = config;
     this.logger = logger;
-    this.secretKey = new TextEncoder().encode(config.secret);
-    if (config.secret.length < 32) {
-      throw new JWTError("JWT secret must be at least 32 characters long", "TOKEN_CREATION_FAILED");
+    if (this.isSymmetric()) {
+      if (!config.secret || config.secret.length < 32) {
+        throw new JWTError("JWT secret must be at least 32 characters long", "TOKEN_CREATION_FAILED");
+      }
+      this.secretKey = new TextEncoder().encode(config.secret);
+    } else {
+      if (!config.privateKey && !config.publicKey && !config.jwksUri) {
+        throw new JWTError(
+          "Asymmetric JWT requires privateKey (sign) and/or publicKey/jwksUri (verify)",
+          "TOKEN_CREATION_FAILED"
+        );
+      }
+    }
+  }
+  isSymmetric() {
+    return this.config.algorithm.startsWith("HS");
+  }
+  /** 발급용 키 (HS: secret, 비대칭: PKCS#8 개인키). 결과를 캐시한다. */
+  async getSigningKey() {
+    var _a;
+    if (this.isSymmetric()) {
+      return this.secretKey;
     }
+    if (!this.config.privateKey) {
+      throw new JWTError("No privateKey configured for signing", "TOKEN_CREATION_FAILED");
+    }
+    (_a = this.signingKeyCache) != null ? _a : this.signingKeyCache = importPKCS8(this.config.privateKey, this.config.algorithm);
+    return this.signingKeyCache;
+  }
+  /**
+   * 검증용 키를 jose getKey 함수로 정규화해 반환한다 (HS: secret, 비대칭:
+   * SPKI 공개키 또는 원격 JWKS). 정적 키도 함수로 감싸 단일 호출 경로를 쓰며,
+   * jose 는 함수 호출 전 알고리즘 allowlist 를 검증하므로 confusion 가드는 유지된다.
+   */
+  async getVerifyKey() {
+    var _a, _b;
+    if (this.isSymmetric()) {
+      const key = this.secretKey;
+      return async () => key;
+    }
+    if (this.config.jwksUri) {
+      (_a = this.jwks) != null ? _a : this.jwks = createRemoteJWKSet(new URL(this.config.jwksUri));
+      return this.jwks;
+    }
+    if (this.config.publicKey) {
+      (_b = this.verifyKeyCache) != null ? _b : this.verifyKeyCache = importSPKI(this.config.publicKey, this.config.algorithm);
+      const key = await this.verifyKeyCache;
+      return async () => key;
+    }
+    throw new JWTError("No publicKey or jwksUri configured for verification", "TOKEN_VERIFICATION_FAILED");
   }
   /**
    * Access JWT 토큰 생성
    */
   async createAccessToken(payload) {
     try {
-      const jwt = await new SignJWT(__spreadProps(__spreadValues({}, payload), { tokenType: "access" })).setProtectedHeader({ alg: this.config.algorithm }).setIssuedAt().setExpirationTime(this.config.accessTokenExpiry).sign(this.secretKey);
+      const jwt = await new SignJWT(__spreadProps(__spreadValues({}, payload), { tokenType: "access" })).setProtectedHeader({ alg: this.config.algorithm }).setIssuedAt().setExpirationTime(this.config.accessTokenExpiry).sign(await this.getSigningKey());
       this.logger.debug("Access token created successfully", {
         userId: payload.userId,
         expiresIn: this.config.accessTokenExpiry
@@ -38,14 +91,20 @@ var JWTManager = class {
   }
   /**
    * Refresh 토큰 생성
+   *
+   * rotation/reuse detection 용 `jti`(토큰 고유 id)와 `familyId`(회전 계보 id)를
+   * 함께 발급할 수 있다. 미지정 시 0.8 이전과 동일하게 식별자 없는 refresh
+   * 토큰을 만든다(하위 호환).
    */
-  async createRefreshToken(userId) {
+  async createRefreshToken(userId, options) {
     try {
       const payload = {
         userId,
         tokenType: "refresh"
       };
-      const jwt = await new SignJWT(payload).setProtectedHeader({ alg: this.config.algorithm }).setIssuedAt().setExpirationTime(this.config.refreshTokenExpiry).sign(this.secretKey);
+      if (options == null ? void 0 : options.jti) payload.jti = options.jti;
+      if (options == null ? void 0 : options.familyId) payload.familyId = options.familyId;
+      const jwt = await new SignJWT(payload).setProtectedHeader({ alg: this.config.algorithm }).setIssuedAt().setExpirationTime(this.config.refreshTokenExpiry).sign(await this.getSigningKey());
       this.logger.debug("Refresh token created successfully", {
         userId,
         expiresIn: this.config.refreshTokenExpiry
@@ -62,8 +121,11 @@ var JWTManager = class {
   /**
    * 토큰 쌍 생성 (Access + Refresh)
    */
-  async createTokenPair(user) {
+  async createTokenPair(user, options) {
+    var _a, _b;
     try {
+      const jti = (_a = options == null ? void 0 : options.jti) != null ? _a : randomUUID();
+      const familyId = (_b = options == null ? void 0 : options.familyId) != null ? _b : randomUUID();
       const [accessToken, refreshToken] = await Promise.all([
         this.createAccessToken({
           id: user.id,
@@ -72,9 +134,9 @@ var JWTManager = class {
           role: user.role,
           emailVerified: user.emailVerified
         }),
-        this.createRefreshToken(user.id)
+        this.createRefreshToken(user.id, { jti, familyId })
       ]);
-      this.logger.debug("Token pair created successfully", { userId: user.id });
+      this.logger.debug("Token pair created successfully", { userId: user.id, familyId });
       return { accessToken, refreshToken };
     } catch (error) {
       this.logger.error("Failed to create token pair", {
@@ -89,7 +151,7 @@ var JWTManager = class {
    */
   async verifyAccessToken(token) {
     try {
-      const { payload } = await jwtVerify(token, this.secretKey, {
+      const { payload } = await jwtVerify(token, await this.getVerifyKey(), {
         algorithms: [this.config.algorithm]
       });
       const userId = payload.userId || payload.sub || payload.id;
@@ -106,6 +168,8 @@ var JWTManager = class {
         id: userId,
         userId,
         email: payload.email,
+        // role 은 신뢰 불가 토큰에서 옴 — TRole 단언은 소비자 어휘로의 타입 편의일 뿐
+        // 런타임 검증은 아니다.
         role: payload.role,
         emailVerified: payload.emailVerified,
         tokenType: payload.tokenType,
@@ -131,7 +195,7 @@ var JWTManager = class {
    */
   async verifyRefreshToken(token) {
     try {
-      const { payload } = await jwtVerify(token, this.secretKey, {
+      const { payload } = await jwtVerify(token, await this.getVerifyKey(), {
         algorithms: [this.config.algorithm]
       });
       const userId = payload.userId || payload.sub || payload.id;
@@ -146,7 +210,9 @@ var JWTManager = class {
       });
       return {
         userId,
-        tokenType: payload.tokenType
+        tokenType: payload.tokenType,
+        jti: typeof payload.jti === "string" ? payload.jti : void 0,
+        familyId: typeof payload.familyId === "string" ? payload.familyId : void 0
       };
     } catch (error) {
       this.logger.error("Failed to verify refresh token", {
@@ -239,8 +305,8 @@ var JWTService = class {
   /**
    * Refresh 토큰 생성
    */
-  async createRefreshToken(userId) {
-    return this.manager.createRefreshToken(userId);
+  async createRefreshToken(userId, options) {
+    return this.manager.createRefreshToken(userId, options);
   }
   /**
    * Refresh 토큰 검증
@@ -251,8 +317,8 @@ var JWTService = class {
   /**
    * 토큰 쌍 생성
    */
-  async createTokenPair(user) {
-    return this.manager.createTokenPair(user);
+  async createTokenPair(user, options) {
+    return this.manager.createTokenPair(user, options);
   }
   /**
    * Access 토큰 생성

package/dist/{chunk-BBE4RXR7.js → chunk-MTZXWVW3.js}

@@ -1,12 +1,13 @@
 import {
   JWTService
-} from "./chunk-2PFSRVVD.js";
+} from "./chunk-LWHLB2Y6.js";
 import {
   AuthError
 } from "./chunk-5GWGARXI.js";
 import {
-  JWT_DEFAULTS
-} from "./chunk-2SIBG5BG.js";
+  JWT_DEFAULTS,
+  ROLE_DEFAULTS
+} from "./chunk-7YWUKMZD.js";
 
 // src/core/auth/services/oauth-callback.service.ts
 var OAuthCallbackService = class {
@@ -47,6 +48,17 @@ var OAuthCallbackService = class {
     }
     const existingUser = await this.userRepo.findByEmail(input.email);
     if (existingUser) {
+      if (input.emailVerified !== true) {
+        this.logger.warn("Blocked OAuth account linking for unverified email", {
+          provider: input.provider,
+          userId: existingUser.id
+        });
+        throw new AuthError(
+          "OAuth email is not verified by the provider; cannot link to an existing account",
+          "OAUTH_EMAIL_NOT_VERIFIED",
+          403
+        );
+      }
       await this.oauthRepo.create({
         userId: existingUser.id,
         provider: input.provider,
@@ -62,8 +74,7 @@ var OAuthCallbackService = class {
       email: input.email,
       name: input.name,
       image: input.image,
-      emailVerified: /* @__PURE__ */ new Date()
-      // OAuth users are auto-verified
+      emailVerified: input.emailVerified === true ? /* @__PURE__ */ new Date() : null
     });
     await this.oauthRepo.create({
       userId: newUser.id,
@@ -81,7 +92,7 @@ var OAuthCallbackService = class {
     return this.jwtService.createTokenPair({
       id: user.id,
       email: user.email,
-      role: (_a = user.role) != null ? _a : "USER",
+      role: (_a = user.role) != null ? _a : ROLE_DEFAULTS.DEFAULT_ROLE,
       emailVerified: user.emailVerified
     });
   }

package/dist/{chunk-ORMEWXMH.js → chunk-N3ETBM74.js}

@@ -17,21 +17,8 @@ var __spreadValues = (a, b) => {
   return a;
 };
 var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
-var __objRest = (source, exclude) => {
-  var target = {};
-  for (var prop in source)
-    if (__hasOwnProp.call(source, prop) && exclude.indexOf(prop) < 0)
-      target[prop] = source[prop];
-  if (source != null && __getOwnPropSymbols)
-    for (var prop of __getOwnPropSymbols(source)) {
-      if (exclude.indexOf(prop) < 0 && __propIsEnum.call(source, prop))
-        target[prop] = source[prop];
-    }
-  return target;
-};
 
 export {
   __spreadValues,
-  __spreadProps,
-  __objRest
+  __spreadProps
 };

package/dist/{chunk-KYAHURXN.js → chunk-N3TCQ5BF.js}

@@ -1,6 +1,6 @@
 import {
   JWT_DEFAULTS
-} from "./chunk-2SIBG5BG.js";
+} from "./chunk-7YWUKMZD.js";
 import {
   configWarn
 } from "./chunk-6J2EJVND.js";
@@ -10,7 +10,7 @@ import {
 
 // src/core/auth/config.ts
 function initializeAuth(config) {
-  var _a, _b, _c, _d;
+  var _a, _b, _c, _d, _e;
   (_a = globalThis.__withwiz_config) != null ? _a : globalThis.__withwiz_config = {};
   if (globalThis.__withwiz_config.auth) return;
   if (!config.jwtSecret) {
@@ -26,7 +26,8 @@ function initializeAuth(config) {
     jwtSecret: config.jwtSecret,
     accessTokenExpiry: (_b = config.accessTokenExpiry) != null ? _b : JWT_DEFAULTS.DEFAULT_ACCESS_TOKEN_EXPIRES,
     refreshTokenExpiry: (_c = config.refreshTokenExpiry) != null ? _c : JWT_DEFAULTS.DEFAULT_REFRESH_TOKEN_EXPIRES,
-    cookieSecure: (_d = config.cookieSecure) != null ? _d : false
+    cookieSecure: (_d = config.cookieSecure) != null ? _d : false,
+    tokenDelivery: (_e = config.tokenDelivery) != null ? _e : "hybrid"
   };
 }
 function getAuthConfig() {

package/dist/{chunk-G4SNTXJ3.js → chunk-NLV7IEYM.js}

@@ -1,20 +1,20 @@
 import {
   OAuthCallbackService
-} from "./chunk-BBE4RXR7.js";
+} from "./chunk-MTZXWVW3.js";
 import {
   OAuthManager
-} from "./chunk-UQ3Z3ZAF.js";
+} from "./chunk-ER6LSA4M.js";
 import {
   OAUTH_STATE_COOKIE,
   clearOAuthStateCookie,
   validateOAuthState
 } from "./chunk-JLRMET4V.js";
-import {
-  setTokenCookies
-} from "./chunk-RJGYONRO.js";
 import {
   AuthError
 } from "./chunk-5GWGARXI.js";
+import {
+  setTokenCookies
+} from "./chunk-PRPMEHRE.js";
 
 // src/next/auth-handlers/oauth-callback.handler.ts
 import { NextResponse } from "next/server";
@@ -76,7 +76,8 @@ function createOAuthCallbackHandler(options) {
         email: userInfo.email,
         name: userInfo.name,
         image: userInfo.image,
-        accessToken
+        accessToken,
+        emailVerified: userInfo.emailVerified
       });
       if (hooks == null ? void 0 : hooks.onAfterOAuth) await hooks.onAfterOAuth(result.user, provider, result.isNewUser);
       if (result.isNewUser && (hooks == null ? void 0 : hooks.onOAuthFirstLogin)) {

package/dist/{chunk-HX4MPCVV.js → chunk-NTZBMWB6.js}

@@ -1,17 +1,17 @@
 import {
   getCacheManager,
   getEffectiveCacheBackend
-} from "./chunk-B6L5XV7O.js";
+} from "./chunk-SCAFDDJP.js";
 import {
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 import {
   getCacheConfig,
   getCacheTTL
-} from "./chunk-MREY2W7N.js";
+} from "./chunk-Y6CPPBJI.js";
 import {
   isCacheEnabled
-} from "./chunk-7F5X6F7X.js";
+} from "./chunk-HV6A6Z5R.js";
 
 // src/core/cache/cache-wrapper.ts
 function getCacheBackendLabel() {

package/dist/{chunk-JRORMRVN.js → chunk-OII5BXCZ.js}

@@ -1,6 +1,6 @@
 import {
   OAuthManager
-} from "./chunk-UQ3Z3ZAF.js";
+} from "./chunk-ER6LSA4M.js";
 import {
   generateOAuthState,
   setOAuthStateCookie

package/dist/{chunk-RJGYONRO.js → chunk-PRPMEHRE.js}

@@ -1,9 +1,9 @@
 import {
   getAuthConfig
-} from "./chunk-KYAHURXN.js";
+} from "./chunk-N3TCQ5BF.js";
 import {
   __spreadValues
-} from "./chunk-ORMEWXMH.js";
+} from "./chunk-N3ETBM74.js";
 
 // src/core/auth/jwt/cookie.ts
 function getDefaultOptions() {

package/dist/{chunk-KG65BFPK.js → chunk-QAIN3WNN.js}

@@ -4,7 +4,7 @@ import {
 import {
   __spreadProps,
   __spreadValues
-} from "./chunk-ORMEWXMH.js";
+} from "./chunk-N3ETBM74.js";
 
 // src/core/logger/logger.ts
 import fs from "fs";

package/dist/{chunk-JJAIVUVD.js → chunk-R7EFDSPZ.js}

@@ -12,11 +12,11 @@ import {
 } from "./chunk-5GWGARXI.js";
 import {
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 import {
   __spreadProps,
   __spreadValues
-} from "./chunk-ORMEWXMH.js";
+} from "./chunk-N3ETBM74.js";
 
 // src/next/error/error-handler.ts
 import { NextResponse } from "next/server";

package/dist/{chunk-VJE4HA2C.js → chunk-RWCPRPEP.js}

@@ -1,6 +1,6 @@
 import {
   RegisterService
-} from "./chunk-LUIYCIF7.js";
+} from "./chunk-Y4ME3Q5K.js";
 import {
   AuthError
 } from "./chunk-5GWGARXI.js";
@@ -8,9 +8,10 @@ import {
 // src/next/auth-handlers/register.handler.ts
 import { NextResponse } from "next/server";
 import { z } from "zod";
+var withinBcryptByteLimit = (value) => new TextEncoder().encode(value).length <= 72;
 var registerSchema = z.object({
   email: z.string().email(),
-  password: z.string().min(8),
+  password: z.string().min(8).refine(withinBcryptByteLimit, { message: "Password cannot exceed 72 bytes" }),
   name: z.string().min(1).optional()
 });
 function createRegisterHandler(options) {

package/dist/{chunk-B6L5XV7O.js → chunk-SCAFDDJP.js}

@@ -1,32 +1,32 @@
 import {
   NoopCacheManager
-} from "./chunk-VPRTPW7C.js";
+} from "./chunk-XF3WUF3F.js";
 import {
   RedisCacheManager
-} from "./chunk-JKSABDFT.js";
+} from "./chunk-4TGPAUJV.js";
 import {
   HybridCacheManager
-} from "./chunk-BFZR62LZ.js";
+} from "./chunk-XXPB4C37.js";
+import {
+  InMemoryCacheManager
+} from "./chunk-JHUWZ6YW.js";
 import {
   isRedisAvailableNow,
   isRedisGloballyDisabled
-} from "./chunk-6TUDUOGC.js";
-import {
-  InMemoryCacheManager
-} from "./chunk-J5NLAZV2.js";
+} from "./chunk-ZEHNCHIV.js";
 import {
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 import {
   getCacheConfig
-} from "./chunk-MREY2W7N.js";
+} from "./chunk-Y6CPPBJI.js";
 import {
   getENV,
   isCacheEnabled
-} from "./chunk-7F5X6F7X.js";
+} from "./chunk-HV6A6Z5R.js";
 import {
   isCacheConfigInitialized
-} from "./chunk-GORISA3L.js";
+} from "./chunk-7KIM5MHV.js";
 import {
   configWarn
 } from "./chunk-6J2EJVND.js";

package/dist/{chunk-KXYDTC4A.js → chunk-SNFPZD6L.js}

@@ -1,9 +1,12 @@
 import {
   __spreadValues
-} from "./chunk-ORMEWXMH.js";
+} from "./chunk-N3ETBM74.js";
 
 // src/core/validators/password-validator.ts
 import { z } from "zod";
+var BCRYPT_MAX_PASSWORD_BYTES = 72;
+var utf8ByteLength = (value) => new TextEncoder().encode(value).length;
+var BCRYPT_BYTE_LIMIT_MESSAGE = `Password cannot exceed ${BCRYPT_MAX_PASSWORD_BYTES} bytes`;
 var PasswordStrength = /* @__PURE__ */ ((PasswordStrength2) => {
   PasswordStrength2["VERY_WEAK"] = "very_weak";
   PasswordStrength2["WEAK"] = "weak";
@@ -25,6 +28,9 @@ var PasswordValidator = class {
     if (password.length > opts.maxLength) {
       errors.push(`Password cannot exceed ${opts.maxLength} characters`);
     }
+    if (utf8ByteLength(password) > BCRYPT_MAX_PASSWORD_BYTES) {
+      errors.push(BCRYPT_BYTE_LIMIT_MESSAGE);
+    }
     if (opts.requireNumber && !/\d/.test(password)) {
       errors.push("Password must contain at least one number");
     }
@@ -136,7 +142,10 @@ var PasswordValidator = class {
     if (opts.customPattern) {
       schema = schema.regex(opts.customPattern, opts.customMessage);
     }
-    return schema;
+    return schema.refine(
+      (value) => utf8ByteLength(value) <= BCRYPT_MAX_PASSWORD_BYTES,
+      { message: BCRYPT_BYTE_LIMIT_MESSAGE }
+    );
   }
   /**
    * 비밀번호 확인 검증

package/dist/{chunk-MWBEE6VI.js → chunk-SXBDP3CK.js}

@@ -4,13 +4,13 @@ import {
 } from "./chunk-PBVP7CFZ.js";
 import {
   getPlatform
-} from "./chunk-4KJZRI74.js";
+} from "./chunk-KWUOLKDO.js";
 import {
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 import {
   getResolvedCacheConfig
-} from "./chunk-GORISA3L.js";
+} from "./chunk-7KIM5MHV.js";
 
 // src/core/system/health-check.ts
 async function checkServiceHealth(prismaClient) {

package/dist/{chunk-B5VRZ2VJ.js → chunk-TNDEYJEL.js}

@@ -1,15 +1,20 @@
 import {
   JWTService
-} from "./chunk-2PFSRVVD.js";
+} from "./chunk-LWHLB2Y6.js";
 import {
   AuthError
 } from "./chunk-5GWGARXI.js";
 import {
-  JWT_DEFAULTS
-} from "./chunk-2SIBG5BG.js";
+  JWT_DEFAULTS,
+  ROLE_DEFAULTS
+} from "./chunk-7YWUKMZD.js";
+import {
+  __spreadValues
+} from "./chunk-N3ETBM74.js";
 
 // src/core/auth/services/login.service.ts
 import { compare } from "bcryptjs";
+var DUMMY_PASSWORD_HASH = "$2b$12$/l4jMXYcTL.SQgNWzy1UcuSlrtLlw.GFTpWDYTficzN2kRhN/LwEO";
 var LoginService = class {
   constructor(config) {
     var _a, _b, _c;
@@ -20,6 +25,7 @@ var LoginService = class {
       refreshTokenExpiry: (_b = config.refreshTokenExpiry) != null ? _b : JWT_DEFAULTS.DEFAULT_REFRESH_TOKEN_EXPIRES,
       algorithm: JWT_DEFAULTS.ALGORITHM
     }, config.logger);
+    this.passwordHasher = config.passwordHasher;
     this.logger = (_c = config.logger) != null ? _c : { debug() {
     }, info() {
     }, warn() {
@@ -30,12 +36,17 @@ var LoginService = class {
     var _a;
     const user = await this.userRepo.findByEmail(email);
     if (!user) {
+      if (this.passwordHasher) {
+        await this.passwordHasher.hash(password).catch(() => void 0);
+      } else {
+        await compare(password, DUMMY_PASSWORD_HASH);
+      }
       throw new AuthError("Invalid credentials", "INVALID_CREDENTIALS", 401);
     }
     if (user.isActive === false) {
       throw new AuthError("Account is disabled", "ACCOUNT_DISABLED", 403);
     }
-    const isValid = await compare(password, storedHash);
+    const isValid = this.passwordHasher ? await this.passwordHasher.verify(password, storedHash) : await compare(password, storedHash);
     if (!isValid) {
       this.logger.warn("Failed login attempt", { email });
       throw new AuthError("Invalid credentials", "INVALID_CREDENTIALS", 401);
@@ -43,12 +54,20 @@ var LoginService = class {
     const tokens = await this.jwtService.createTokenPair({
       id: user.id,
       email: user.email,
-      role: (_a = user.role) != null ? _a : "USER",
+      role: (_a = user.role) != null ? _a : ROLE_DEFAULTS.DEFAULT_ROLE,
       emailVerified: user.emailVerified
     });
+    let rehashedPassword;
+    if (this.passwordHasher && this.passwordHasher.needsRehash(storedHash)) {
+      try {
+        rehashedPassword = await this.passwordHasher.hash(password);
+      } catch (error) {
+        this.logger.warn("Password rehash failed", { userId: user.id, error });
+      }
+    }
     await this.userRepo.updateLastLoginAt(user.id);
     this.logger.info("User logged in successfully", { userId: user.id });
-    return { user, tokens };
+    return __spreadValues({ user, tokens }, rehashedPassword ? { rehashedPassword } : {});
   }
 };
 

package/dist/{chunk-GDTZMX3L.js → chunk-TRGFXIEF.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-XQIAXMRY.js";
 import {
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 
 // src/next/middleware/rate-limit.ts
 var GLOBAL_KEY = "__withwiz_rateLimitAdapter__";

package/dist/{chunk-VNDL2E44.js → chunk-U52U5SK7.js}

@@ -1,10 +1,10 @@
 import {
   runCommand,
   runMacCommand
-} from "./chunk-4KJZRI74.js";
+} from "./chunk-KWUOLKDO.js";
 import {
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 
 // src/core/system/memory.ts
 import os from "os";

package/dist/{chunk-54REXMTE.js → chunk-UWOWKOOQ.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-7ZO5UNTJ.js";
 import {
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 
 // src/next/middleware/cors.ts
 import { NextResponse } from "next/server";
@@ -25,6 +25,7 @@ function createCorsMiddleware(config) {
       const response2 = new NextResponse(null, { status: 204 });
       if (origin && allowedOrigins.includes(origin)) {
         response2.headers.set("Access-Control-Allow-Origin", origin);
+        response2.headers.append("Vary", "Origin");
         if (allowCredentials) {
           response2.headers.set("Access-Control-Allow-Credentials", "true");
         }
@@ -39,6 +40,7 @@ function createCorsMiddleware(config) {
     const response = await next();
     if (origin && allowedOrigins.includes(origin)) {
       response.headers.set("Access-Control-Allow-Origin", origin);
+      response.headers.append("Vary", "Origin");
       if (allowCredentials) {
         response.headers.set("Access-Control-Allow-Credentials", "true");
       }