@withwiz/toolkit 0.7.1 → 0.9.0

package/README.ko.md

@@ -0,0 +1,226 @@
+# @withwiz/toolkit
+
+[English](README.md) | **한국어**
+
+Shared utility library for [withwiz](https://github.com/greeun) projects — 인증, 캐싱, 에러 처리, 미들웨어, 지오로케이션, 로깅 등 프로덕션 수준의 모듈 모음.
+
+## Features
+
+- **Composition root** — 단일 `initialize()`로 모든 티어 설정을 한 번에 조립
+- **Framework tiers** — `core` / `next` / `prisma` 3개 티어로 의존성 분리 (0.8+)
+- **Auth** — JWT, password hashing, OAuth helpers (Google / GitHub / Kakao / Microsoft / Meta), state-cookie CSRF 바인딩, Prisma adapter
+- **Cache** — Redis / in-memory / hybrid / noop 백엔드, factory, invalidation, defaults
+- **Constants** — Error codes, messages, pagination, security constants
+- **Error** — Typed `AppError`, framework-aware error handler (core · next)
+- **Geolocation** — GeoIP lookup, batch processing, provider factory
+- **Logger** — Winston-based structured logger with daily rotation
+- **Middleware** — Auth, rate-limiting, CORS, security middleware wrappers (Next.js)
+- **Storage** — Cloudflare R2 (AWS S3-compatible) storage
+- **System** — Health check, system monitoring
+- **Types** — Shared TypeScript types (API, DB, env, GeoIP, user, i18n, QR)
+- **Utils** — Sanitizer, type-guards, CSV export, URL normalizer, timezone, IP utils, ...
+- **Validators** — Password strength validator
+
+## Installation
+
+```bash
+npm install @withwiz/toolkit
+# or
+pnpm add @withwiz/toolkit
+# or
+yarn add @withwiz/toolkit
+```
+
+### Peer dependencies (optional)
+
+`next` / `react` / `react-dom` 은 **optional** peer입니다 — 사용하는 티어가 요구하는 peer만 설치하세요.
+
+```bash
+# next 티어를 쓸 때
+# (React 도 필요 — next/error/ErrorBoundary 가 React 컴포넌트)
+npm install next react react-dom
+
+# core 티어만 쓰는 백엔드 / CLI
+# (별도 peer 설치 불필요)
+```
+
+> **React 컴포넌트 분리 (0.8).** `react` 티어(UI 컴포넌트, hooks, `error-display`)는
+> 독립 패키지 [`@withwiz/ui`](https://github.com/greeun) 로 추출되었습니다.
+> `@withwiz/toolkit/react/*` → `@withwiz/ui/react/*` 로 import 경로를 치환하세요.
+
+## Quick start
+
+```ts
+// Auth — JWT
+import { signToken, verifyToken } from '@withwiz/toolkit/core/auth/jwt'
+
+const token = await signToken({ userId: 'u_123' })
+const payload = await verifyToken(token)
+```
+
+```ts
+// Cache — Redis wrapper
+import { withCache } from '@withwiz/toolkit/core/cache'
+
+const data = await withCache('my-key', async () => fetchData(), 3600)
+```
+
+```ts
+// Error — typed error class
+import { AppError } from '@withwiz/toolkit/core/error'
+
+throw new AppError('NOT_FOUND', 'Resource not found', 404)
+```
+
+```ts
+// Logger
+import { logInfo, logError } from '@withwiz/toolkit/core/logger/logger'
+
+logInfo('Server started', { port: 3000 })
+logError('Something went wrong', { error })
+```
+
+```ts
+// Geolocation
+import { getGeoLocation } from '@withwiz/toolkit/core/geolocation'
+
+const geo = await getGeoLocation('8.8.8.8')
+// { country: 'US', city: 'Mountain View', ... }
+```
+
+```ts
+// Utils
+import { sanitizeInput } from '@withwiz/toolkit/core/utils/sanitizer'
+import { formatNumber }  from '@withwiz/toolkit/core/utils/format-number'
+import { normalizeUrl }  from '@withwiz/toolkit/core/utils/url-normalizer'
+```
+
+### 토큰 전달 모드 (tokenDelivery)
+
+인증 토큰 전달 방식을 초기화 시 선택할 수 있습니다. 기본값은 `'hybrid'`(쿠키 + 헤더 동시 지원, 기존 동작)입니다.
+
+```typescript
+import { initialize } from '@withwiz/toolkit/initialize';
+
+initialize({
+  auth: {
+    jwtSecret: process.env.JWT_SECRET!,
+    tokenDelivery: 'cookie', // 'cookie' | 'header' | 'hybrid' (기본)
+  },
+});
+```
+
+핸들러별로 덮어쓸 수도 있습니다 (옵션 > 전역 > `'hybrid'` 순):
+
+```typescript
+createAuthHandlers({ ...options, tokenDelivery: 'header' });
+```
+
+| 모드 | 토큰 위치 | 특징 |
+|---|---|---|
+| `cookie` | HttpOnly 쿠키 전용 | 응답 body 에서 토큰 제거 — XSS 노출 면 최소. 브라우저 앱 권장 |
+| `header` | `Authorization: Bearer` + body | refresh 는 body `{ refreshToken }` 으로 전달. 클라이언트 저장소는 XSS 에 상대적으로 취약 — 비브라우저 클라이언트용 |
+| `hybrid` | 둘 다 | 기존 동작. 쿠키 우선, 헤더/body 폴백 |
+
+**제약**: OAuth callback 은 redirect 응답이라 모드와 무관하게 쿠키로만 토큰을 전달합니다. OAuth 를 쓰는 앱은 `'cookie'` 또는 `'hybrid'` 를 사용하세요.
+
+## Module reference
+
+0.7부터 모든 subpath는 프레임워크 의존성에 따라 티어로 분리됩니다
+(0.8부터 `core` / `next` / `prisma` 3개 — `react` 티어는 `@withwiz/ui` 로 이동).
+자세한 티어 모델·규칙·마이그레이션 매핑은 [`docs/FRAMEWORK_TIERS.md`](docs/FRAMEWORK_TIERS.md)
+및 [`CHANGELOG.md`](CHANGELOG.md) 의 0.7.0 / 0.8.0 항목을 참조하세요.
+
+### Composition root
+
+| Subpath | Description |
+|---|---|
+| `/initialize` | 모든 티어 설정을 단일 객체로 조립하는 통합 진입점 |
+
+### `core` — 프레임워크 독립 (pure TS)
+
+| Subpath | Description |
+|---|---|
+| `/core/auth` | Full auth (JWT + password + OAuth + services + email + types) |
+| `/core/auth/jwt` | JWT sign / verify |
+| `/core/auth/password` | bcrypt helpers |
+| `/core/auth/oauth` | OAuth utilities (Google / GitHub / Kakao / Microsoft / Meta) |
+| `/core/auth/oauth/providers/{google,github,kakao,microsoft,meta}` | Individual OAuth providers |
+| `/core/auth/services` | Login / token-refresh / oauth-callback services |
+| `/core/auth/email` | Email token generation |
+| `/core/auth/types` | Framework-independent auth types |
+| `/core/cache` | Cache facade (get / set / delete / withCache) |
+| `/core/cache/cache-factory` | Cache backend factory (Redis / in-memory / hybrid / noop) |
+| `/core/cache/cache-invalidation` | Pattern-based cache invalidation |
+| `/core/config` | Config registry |
+| `/core/constants/{error-codes,messages,pagination,security}` | Shared constants |
+| `/core/cors` | Framework-independent CORS config |
+| `/core/error` | `AppError`, error codes, i18n messages, `extractErrorInfo` |
+| `/core/geolocation` | GeoIP lookup, batch processor, provider factory |
+| `/core/logger/logger` | Winston-based structured logger |
+| `/core/storage` | Cloudflare R2 / S3-compatible storage |
+| `/core/system` | Health check, system monitoring |
+| `/core/types/{api,database,env,geoip,i18n,qr-code,user}` | Shared TypeScript types |
+| `/core/utils` | `sanitizer`, `type-guards`, `format-number`, `ip-utils`, `timezone`, ... |
+| `/core/validators` | Password strength validator |
+
+### `next` — Next.js 의존
+
+| Subpath | Description |
+|---|---|
+| `/next/middleware` | Auth · rate-limit · CORS · security · wrappers |
+| `/next/auth-handlers` | Route handlers (login / refresh / oauth callback / me) |
+| `/next/auth-types` | Handler types (`NextRequest` signatures) |
+| `/next/error` | `error-handler` (NextResponse), `LocaleDetector`, `ErrorBoundary` |
+| `/next/utils` | `api-helpers`, `cors`, `csv-export`, `error-processor` |
+
+### `react` — `@withwiz/ui` 로 이동 (0.8)
+
+React 티어(UI 컴포넌트, hooks, `error-display`, 브라우저 컨텍스트 utils)는 독립 패키지
+[`@withwiz/ui`](https://github.com/greeun) 로 추출되었습니다.
+import 경로 치환: `@withwiz/toolkit/react/*` → `@withwiz/ui/react/*`.
+
+### `prisma` — Prisma 의존
+
+| Subpath | Description |
+|---|---|
+| `/prisma/auth-adapter` | `UserRepository` / `OAuthAccountRepository` / `EmailTokenRepository` Prisma 구현체 |
+
+## Requirements
+
+- Node.js >= 18
+- TypeScript >= 5
+
+### Optional peers
+
+`next` / `react` / `react-dom` 은 `optional` peer dependency입니다.
+사용하는 티어가 요구하는 peer만 설치하세요:
+
+- `core` 티어만 쓰는 백엔드 / CLI: peer 불필요
+- `next` 티어: Next.js >= 15, 그리고 React >= 18 / React-DOM >= 18 (`next/error/ErrorBoundary` 가 React 컴포넌트)
+- `prisma` 티어: Prisma 호환 클라이언트 (덕 타이핑)
+- Prisma 어댑터의 `EmailTokenRepository` 등 일부 모듈: `date-fns >= 3` (optional)
+- 이메일 전송: `nodemailer >= 6` (optional)
+
+## Development
+
+```bash
+# Install dependencies
+npm install
+
+# Build
+npm run build
+
+# Run tests
+npm test
+
+# Watch mode
+npm run test:watch
+
+# Coverage
+npm run test:coverage
+```
+
+## License
+
+MIT © [withwiz](https://github.com/greeun)

package/README.md

@@ -1,17 +1,18 @@
 # @withwiz/toolkit
 
+**English** | [한국어](README.ko.md)
+
 Shared utility library for [withwiz](https://github.com/greeun) projects — a collection of production-ready modules for authentication, caching, error handling, middleware, geolocation, logging, and more.
 
 ## Features
 
-- **Composition root** — 단일 `initialize()`로 모든 티어 설정을 한 번에 조립
-- **Framework tiers** — `core` / `next` / `react` / `prisma` 4개 티어로 의존성 분리 (0.7+)
-- **Auth** — JWT, password hashing, OAuth helpers (Google / GitHub / Kakao / Microsoft / Meta), state-cookie CSRF 바인딩, Prisma adapter
-- **Cache** — Redis / in-memory / hybrid / noop 백엔드, factory, invalidation, defaults
+- **Composition root** — assemble every tier's configuration at once with a single `initialize()`
+- **Framework tiers** — dependencies split across three tiers: `core` / `next` / `prisma` (0.8+)
+- **Auth** — JWT, password hashing, OAuth helpers (Google / GitHub / Kakao / Microsoft / Meta), state-cookie CSRF binding, Prisma adapter
+- **Cache** — Redis / in-memory / hybrid / noop backends, factory, invalidation, defaults
 - **Constants** — Error codes, messages, pagination, security constants
-- **Error** — Typed `AppError`, framework-aware error handler / display (core · next · react)
+- **Error** — Typed `AppError`, framework-aware error handler (core · next)
 - **Geolocation** — GeoIP lookup, batch processing, provider factory
-- **Hooks** — `useDataTable`, `useDebounce`, `useExitIntent`, `useTimezone`
 - **Logger** — Winston-based structured logger with daily rotation
 - **Middleware** — Auth, rate-limiting, CORS, security middleware wrappers (Next.js)
 - **Storage** — Cloudflare R2 (AWS S3-compatible) storage
@@ -32,19 +33,21 @@ yarn add @withwiz/toolkit
 
 ### Peer dependencies (optional)
 
-`next` / `react` / `react-dom` 은 **optional** peer입니다 — 사용하는 티어가 요구하는 peer만 설치하세요.
+`next` / `react` / `react-dom` are **optional** peers — install only the peers required by the tiers you use.
 
 ```bash
-# next 티어를 쓸 때
-npm install next
-
-# react 티어를 쓸 때
-npm install react react-dom
+# When using the next tier
+# (React is also needed — next/error/ErrorBoundary is a React component)
+npm install next react react-dom
 
-# core 티어만 쓰는 백엔드 / CLI
-# (별도 peer 설치 불필요)
+# Backend / CLI using only the core tier
+# (no extra peers required)
 ```
 
+> **React components moved out (0.8).** The `react` tier (UI components, hooks,
+> `error-display`) was extracted to [`@withwiz/ui`](https://github.com/greeun).
+> Migrate by replacing `@withwiz/toolkit/react/*` → `@withwiz/ui/react/*`.
+
 ## Quick start
 
 ```ts
@@ -85,13 +88,6 @@ const geo = await getGeoLocation('8.8.8.8')
 // { country: 'US', city: 'Mountain View', ... }
 ```
 
-```tsx
-// Hooks (React)
-import { useDebounce } from '@withwiz/toolkit/react/hooks/useDebounce'
-
-const debouncedQuery = useDebounce(query, 300)
-```
-
 ```ts
 // Utils
 import { sanitizeInput } from '@withwiz/toolkit/core/utils/sanitizer'
@@ -99,19 +95,49 @@ import { formatNumber }  from '@withwiz/toolkit/core/utils/format-number'
 import { normalizeUrl }  from '@withwiz/toolkit/core/utils/url-normalizer'
 ```
 
+### Token delivery mode (tokenDelivery)
+
+You can choose how authentication tokens are delivered at initialization time. The default is `'hybrid'` (cookie + header support, the legacy behavior).
+
+```typescript
+import { initialize } from '@withwiz/toolkit/initialize';
+
+initialize({
+  auth: {
+    jwtSecret: process.env.JWT_SECRET!,
+    tokenDelivery: 'cookie', // 'cookie' | 'header' | 'hybrid' (default)
+  },
+});
+```
+
+It can also be overridden per handler (precedence: option > global > `'hybrid'`):
+
+```typescript
+createAuthHandlers({ ...options, tokenDelivery: 'header' });
+```
+
+| Mode | Token location | Notes |
+|---|---|---|
+| `cookie` | HttpOnly cookie only | Token removed from the response body — minimal XSS exposure. Recommended for browser apps |
+| `header` | `Authorization: Bearer` + body | Refresh is passed via the body `{ refreshToken }`. Client-side storage is relatively vulnerable to XSS — for non-browser clients |
+| `hybrid` | Both | Legacy behavior. Cookie first, with header/body fallback |
+
+**Constraint**: The OAuth callback is a redirect response, so it always delivers the token via cookie regardless of the mode. Apps that use OAuth should use `'cookie'` or `'hybrid'`.
+
 ## Module reference
 
-0.7부터 모든 subpath는 프레임워크 의존성에 따라 4개 티어로 분리됩니다.
-자세한 티어 모델·규칙·마이그레이션 매핑은 [`docs/FRAMEWORK_TIERS.md`](docs/FRAMEWORK_TIERS.md)
-및 [`CHANGELOG.md`](CHANGELOG.md) 의 0.7.0 항목을 참조하세요.
+Since 0.7, every subpath is split into tiers based on its framework dependencies
+(`core` / `next` / `prisma` since 0.8 — the `react` tier moved to `@withwiz/ui`).
+For the detailed tier model, rules, and migration mapping, see [`docs/FRAMEWORK_TIERS.md`](docs/FRAMEWORK_TIERS.md)
+and the 0.7.0 / 0.8.0 entries in [`CHANGELOG.md`](CHANGELOG.md).
 
 ### Composition root
 
 | Subpath | Description |
 |---|---|
-| `/initialize` | 모든 티어 설정을 단일 객체로 조립하는 통합 진입점 |
+| `/initialize` | Unified entry point that assembles every tier's configuration into a single object |
 
-### `core` — 프레임워크 독립 (pure TS)
+### `core` — framework-independent (pure TS)
 
 | Subpath | Description |
 |---|---|
@@ -138,7 +164,7 @@ import { normalizeUrl }  from '@withwiz/toolkit/core/utils/url-normalizer'
 | `/core/utils` | `sanitizer`, `type-guards`, `format-number`, `ip-utils`, `timezone`, ... |
 | `/core/validators` | Password strength validator |
 
-### `next` — Next.js 의존
+### `next` — depends on Next.js
 
 | Subpath | Description |
 |---|---|
@@ -148,20 +174,17 @@ import { normalizeUrl }  from '@withwiz/toolkit/core/utils/url-normalizer'
 | `/next/error` | `error-handler` (NextResponse), `LocaleDetector`, `ErrorBoundary` |
 | `/next/utils` | `api-helpers`, `cors`, `csv-export`, `error-processor` |
 
-### `react` — React 의존
+### `react` — moved to `@withwiz/ui` (0.8)
 
-| Subpath | Description |
-|---|---|
-| `/react/components/ui/*` | Button, Table, Badge, DataTable, ... |
-| `/react/hooks/{useDataTable,useDebounce,useExitIntent,useTimezone}` | React hooks |
-| `/react/error` | `error-display` (sonner toast) |
-| `/react/utils/{client-utils,qr-code}` | Browser-context utilities |
+The React tier (UI components, hooks, `error-display`, browser-context utils) was
+extracted to the standalone [`@withwiz/ui`](https://github.com/greeun) package.
+Migrate imports: `@withwiz/toolkit/react/*` → `@withwiz/ui/react/*`.
 
-### `prisma` — Prisma 의존
+### `prisma` — depends on Prisma
 
 | Subpath | Description |
 |---|---|
-| `/prisma/auth-adapter` | `UserRepository` / `OAuthAccountRepository` / `EmailTokenRepository` Prisma 구현체 |
+| `/prisma/auth-adapter` | Prisma implementations of `UserRepository` / `OAuthAccountRepository` / `EmailTokenRepository` |
 
 ## Requirements
 
@@ -170,15 +193,14 @@ import { normalizeUrl }  from '@withwiz/toolkit/core/utils/url-normalizer'
 
 ### Optional peers
 
-`next` / `react` / `react-dom` 은 `optional` peer dependency입니다.
-사용하는 티어가 요구하는 peer만 설치하세요:
+`next` / `react` / `react-dom` are `optional` peer dependencies.
+Install only the peers required by the tiers you use:
 
-- `core` 티어만 쓰는 백엔드 / CLI: peer 불필요
-- `next` 티어: Next.js >= 15
-- `react` 티어: React >= 18, React-DOM >= 18
-- `prisma` 티어: Prisma 호환 클라이언트 (덕 타이핑)
-- Prisma 어댑터의 `EmailTokenRepository` 등 일부 모듈: `date-fns >= 3` (optional)
-- 이메일 전송: `nodemailer >= 6` (optional)
+- Backend / CLI using only the `core` tier: no peers required
+- `next` tier: Next.js >= 15, plus React >= 18 / React-DOM >= 18 (`next/error/ErrorBoundary` is a React component)
+- `prisma` tier: a Prisma-compatible client (duck-typed)
+- Some modules such as the Prisma adapter's `EmailTokenRepository`: `date-fns >= 3` (optional)
+- Email delivery: `nodemailer >= 6` (optional)
 
 ## Development
 

package/dist/{chunk-V6YD53NH.js → chunk-23LQJYZN.js}

@@ -2,6 +2,9 @@ import {
   ERROR_CODES,
   formatErrorMessage
 } from "./chunk-XQIAXMRY.js";
+import {
+  ROLE_DEFAULTS
+} from "./chunk-7YWUKMZD.js";
 
 // src/next/utils/api-helpers.ts
 import { NextResponse } from "next/server";
@@ -73,8 +76,8 @@ function createPaginatedResponse(data, total, page, limit) {
     }
   });
 }
-function requireAdmin(userRole) {
-  if (userRole !== "ADMIN") {
+function requireAdmin(userRole, adminRole = ROLE_DEFAULTS.ADMIN_ROLE) {
+  if (userRole !== adminRole) {
     return {
       isAdmin: false,
       response: NextResponse.json(

package/dist/chunk-2JUFL4KX.js

@@ -0,0 +1,41 @@
+// src/core/auth/adapters/sql/dialect.ts
+var POSTGRES = {
+  placeholder: (index) => `$${index}`,
+  quoteId: (id) => `"${id}"`
+};
+var MYSQL = {
+  placeholder: () => "?",
+  quoteId: (id) => `\`${id}\``
+};
+function getDialect(dialect) {
+  switch (dialect) {
+    case "postgres":
+      return POSTGRES;
+    case "mysql":
+      return MYSQL;
+    default:
+      throw new Error(`Unsupported SQL dialect: ${dialect}`);
+  }
+}
+var ParamBuilder = class {
+  constructor(dialect) {
+    this.dialect = dialect;
+    this._params = [];
+  }
+  add(value) {
+    this._params.push(value);
+    return this.dialect.placeholder(this._params.length);
+  }
+  get params() {
+    return this._params;
+  }
+};
+function columnList(columns, dialect) {
+  return columns.map((c) => dialect.quoteId(c)).join(", ");
+}
+
+export {
+  getDialect,
+  ParamBuilder,
+  columnList
+};

package/dist/{chunk-ZTRASVGZ.js → chunk-34L7HTM7.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-PX535BHW.js";
 import {
   __spreadValues
-} from "./chunk-ORMEWXMH.js";
+} from "./chunk-N3ETBM74.js";
 
 // src/next/utils/cors.ts
 import { NextResponse } from "next/server";

package/dist/{chunk-GSUCBWML.js → chunk-3RK3MKAR.js}

@@ -1,6 +1,6 @@
 import {
   __spreadValues
-} from "./chunk-ORMEWXMH.js";
+} from "./chunk-N3ETBM74.js";
 
 // src/core/utils/sanitizer.ts
 function sanitizeHtml(input) {
@@ -21,7 +21,10 @@ function removeEventHandlers(input) {
   if (!input || typeof input !== "string") {
     return "";
   }
-  return input.replace(/\bon\w+\s*=\s*["'][^"']*["']/gi, "");
+  return input.replace(
+    /\bon\w+\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+)/gi,
+    ""
+  );
 }
 function sanitizeUrl(url) {
   if (!url || typeof url !== "string") {

package/dist/{chunk-6JXHXIEH.js → chunk-3UIKCS56.js}

@@ -1,10 +1,10 @@
 import {
   PasswordHasher,
   PasswordValidator
-} from "./chunk-MNYVAEXK.js";
+} from "./chunk-4ROIPF33.js";
 import {
   __spreadValues
-} from "./chunk-ORMEWXMH.js";
+} from "./chunk-N3ETBM74.js";
 
 // src/core/auth/password/client-helper.ts
 var DEFAULT_PASSWORD_CONFIG = {

package/dist/{chunk-MWBEE6VI.js → chunk-4EXZ2SDV.js}

@@ -1,16 +1,16 @@
+import {
+  getPlatform
+} from "./chunk-KWUOLKDO.js";
 import {
   formatDatabaseError,
   formatRedisError
 } from "./chunk-PBVP7CFZ.js";
-import {
-  getPlatform
-} from "./chunk-4KJZRI74.js";
 import {
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 import {
   getResolvedCacheConfig
-} from "./chunk-GORISA3L.js";
+} from "./chunk-7KIM5MHV.js";
 
 // src/core/system/health-check.ts
 async function checkServiceHealth(prismaClient) {

package/dist/{chunk-MNYVAEXK.js → chunk-4ROIPF33.js}

@@ -1,6 +1,9 @@
 // src/core/auth/password/index.ts
 import { z } from "zod";
 import bcrypt from "bcryptjs";
+var BCRYPT_MAX_PASSWORD_BYTES = 72;
+var utf8ByteLength = (value) => new TextEncoder().encode(value).length;
+var BCRYPT_BYTE_LIMIT_MESSAGE = `Password cannot exceed ${BCRYPT_MAX_PASSWORD_BYTES} bytes`;
 var _PasswordValidator = class _PasswordValidator {
   constructor(config) {
     this.config = config;
@@ -20,6 +23,9 @@ var _PasswordValidator = class _PasswordValidator {
         `Password cannot exceed ${this.config.maxLength} characters`
       );
     }
+    if (utf8ByteLength(password) > BCRYPT_MAX_PASSWORD_BYTES) {
+      errors.push(BCRYPT_BYTE_LIMIT_MESSAGE);
+    }
     if (this.config.requireNumber && !/\d/.test(password)) {
       errors.push("Password must contain at least one number");
     }
@@ -119,7 +125,10 @@ var _PasswordValidator = class _PasswordValidator {
         "Password must contain at least one special character"
       );
     }
-    return schema;
+    return schema.refine(
+      (value) => utf8ByteLength(value) <= BCRYPT_MAX_PASSWORD_BYTES,
+      { message: BCRYPT_BYTE_LIMIT_MESSAGE }
+    );
   }
   /**
    * 비밀번호 힌트 생성
@@ -201,11 +210,15 @@ var PasswordHasher = class {
     return bcrypt.compare(password, hash);
   }
 };
-var defaultPasswordSchema = z.string().min(8, "Password must be at least 8 characters long").max(128, "Password cannot exceed 128 characters").regex(/\d/, "Password must contain at least one number");
+var defaultPasswordSchema = z.string().min(8, "Password must be at least 8 characters long").max(128, "Password cannot exceed 128 characters").regex(/\d/, "Password must contain at least one number").refine((value) => utf8ByteLength(value) <= BCRYPT_MAX_PASSWORD_BYTES, {
+  message: BCRYPT_BYTE_LIMIT_MESSAGE
+});
 var strongPasswordSchema = z.string().min(12, "Password must be at least 12 characters long").max(128, "Password cannot exceed 128 characters").regex(/[a-z]/, "Password must contain at least one lowercase letter").regex(/[A-Z]/, "Password must contain at least one uppercase letter").regex(/\d/, "Password must contain at least one number").regex(
   /[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?~`]/,
   "Password must contain at least one special character"
-);
+).refine((value) => utf8ByteLength(value) <= BCRYPT_MAX_PASSWORD_BYTES, {
+  message: BCRYPT_BYTE_LIMIT_MESSAGE
+});
 
 export {
   PasswordValidator,

package/dist/{chunk-JKSABDFT.js → chunk-4TGPAUJV.js}

@@ -3,17 +3,17 @@ import {
   isRedisGloballyDisabled,
   notifyRedisError,
   resetRedisGlobalState
-} from "./chunk-6TUDUOGC.js";
+} from "./chunk-ZEHNCHIV.js";
 import {
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 import {
   getENV,
   isCacheEnabled
-} from "./chunk-7F5X6F7X.js";
+} from "./chunk-HV6A6Z5R.js";
 import {
   __spreadValues
-} from "./chunk-ORMEWXMH.js";
+} from "./chunk-N3ETBM74.js";
 
 // src/core/cache/redis-cache-manager.ts
 var RedisCacheManager = class _RedisCacheManager {