@withwiz/toolkit 0.7.1 → 0.9.0

package/dist/{chunk-UBASOMP5.js → chunk-HGVPZSWW.js}

@@ -1,17 +1,17 @@
 import {
   TokenRefreshService
-} from "./chunk-ARXUKGZI.js";
-import {
-  setTokenCookies
-} from "./chunk-RJGYONRO.js";
+} from "./chunk-XAGPZLRK.js";
 import {
   AuthError
 } from "./chunk-5GWGARXI.js";
+import {
+  getTokenDeliveryStrategy
+} from "./chunk-63EKUOJH.js";
 
 // src/next/auth-handlers/refresh.handler.ts
 import { NextResponse } from "next/server";
 function createRefreshHandler(options) {
-  const { dependencies, jwt, hooks, cookie } = options;
+  const { dependencies, jwt, hooks, cookie, tokenDelivery } = options;
   const refreshService = new TokenRefreshService({
     userRepository: dependencies.userRepository,
     jwtSecret: jwt.secret,
@@ -21,9 +21,9 @@ function createRefreshHandler(options) {
     logger: dependencies.logger
   });
   return async (request) => {
-    var _a;
     try {
-      const refreshToken = (_a = request.cookies.get("refresh_token")) == null ? void 0 : _a.value;
+      const strategy = getTokenDeliveryStrategy(tokenDelivery);
+      const refreshToken = await strategy.extractRefreshToken(request);
       if (!refreshToken) {
         return NextResponse.json({ success: false, error: "No refresh token" }, { status: 401 });
       }
@@ -32,12 +32,17 @@ function createRefreshHandler(options) {
         if (hookResult instanceof Response) return hookResult;
       }
       const result = await refreshService.refresh(refreshToken);
-      const response = NextResponse.json({
-        success: true,
-        accessToken: result.accessToken,
-        user: result.user
-      });
-      setTokenCookies(response, { accessToken: result.accessToken, refreshToken }, { secure: cookie == null ? void 0 : cookie.secure });
+      const response = NextResponse.json(
+        strategy.buildTokenResponse(
+          { success: true, user: result.user },
+          { accessToken: result.accessToken }
+        )
+      );
+      strategy.attachCookies(
+        response,
+        { accessToken: result.accessToken, refreshToken },
+        { secure: cookie == null ? void 0 : cookie.secure }
+      );
       return response;
     } catch (error) {
       if (error instanceof AuthError) {

package/dist/{chunk-7F5X6F7X.js → chunk-HV6A6Z5R.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-PX535BHW.js";
 import {
   getResolvedCacheConfig
-} from "./chunk-GORISA3L.js";
+} from "./chunk-7KIM5MHV.js";
 
 // src/core/cache/cache-env.ts
 function _getNodeEnv() {

package/dist/chunk-ILMPKSWS.js

@@ -0,0 +1,125 @@
+import {
+  AuthError
+} from "./chunk-5GWGARXI.js";
+
+// src/core/auth/password/hasher.ts
+import bcrypt from "bcryptjs";
+var BCRYPT_PREFIX = /^\$2[aby]\$/;
+var BcryptPasswordHasher = class {
+  constructor(options = {}) {
+    this.id = "bcrypt";
+    var _a;
+    this.rounds = (_a = options.rounds) != null ? _a : 12;
+  }
+  identifies(hash) {
+    return BCRYPT_PREFIX.test(hash);
+  }
+  async hash(password) {
+    return bcrypt.hash(password, this.rounds);
+  }
+  async verify(password, hash) {
+    return bcrypt.compare(password, hash);
+  }
+  needsRehash(hash) {
+    var _a;
+    if (!this.identifies(hash)) return true;
+    const cost = Number.parseInt((_a = hash.split("$")[2]) != null ? _a : "", 10);
+    if (Number.isNaN(cost)) return true;
+    return cost < this.rounds;
+  }
+};
+var ARGON2_PREFIX = /^\$argon2(id|i|d)\$/;
+var argon2Cache;
+async function loadArgon2() {
+  var _a;
+  if (argon2Cache) return argon2Cache;
+  try {
+    const mod = await import("argon2");
+    argon2Cache = (_a = mod.default) != null ? _a : mod;
+    return argon2Cache;
+  } catch (e) {
+    throw new AuthError(
+      "argon2 package is not installed. Run `npm install argon2` to use Argon2idPasswordHasher.",
+      "ARGON2_NOT_INSTALLED",
+      500
+    );
+  }
+}
+function __resetArgon2Cache() {
+  argon2Cache = void 0;
+}
+function parseArgon2Params(hash) {
+  const paramSegment = hash.split("$").find((s) => s.startsWith("m="));
+  if (!paramSegment) return null;
+  const params = {};
+  for (const kv of paramSegment.split(",")) {
+    const [k, v] = kv.split("=");
+    const n = Number.parseInt(v != null ? v : "", 10);
+    if (!Number.isNaN(n)) params[k] = n;
+  }
+  if (params.m === void 0 || params.t === void 0 || params.p === void 0) return null;
+  return { m: params.m, t: params.t, p: params.p };
+}
+var Argon2idPasswordHasher = class {
+  constructor(options = {}) {
+    this.id = "argon2id";
+    var _a, _b, _c;
+    this.memoryCost = (_a = options.memoryCost) != null ? _a : 19456;
+    this.timeCost = (_b = options.timeCost) != null ? _b : 2;
+    this.parallelism = (_c = options.parallelism) != null ? _c : 1;
+  }
+  identifies(hash) {
+    return ARGON2_PREFIX.test(hash);
+  }
+  async hash(password) {
+    const argon2 = await loadArgon2();
+    return argon2.hash(password, {
+      type: argon2.argon2id,
+      memoryCost: this.memoryCost,
+      timeCost: this.timeCost,
+      parallelism: this.parallelism
+    });
+  }
+  async verify(password, hash) {
+    const argon2 = await loadArgon2();
+    return argon2.verify(hash, password);
+  }
+  needsRehash(hash) {
+    if (!this.identifies(hash)) return true;
+    const params = parseArgon2Params(hash);
+    if (!params) return true;
+    return params.m < this.memoryCost || params.t < this.timeCost || params.p < this.parallelism;
+  }
+};
+var MigratingPasswordHasher = class {
+  constructor(options) {
+    var _a;
+    this.preferred = options.preferred;
+    this.legacy = (_a = options.legacy) != null ? _a : [];
+  }
+  get id() {
+    return this.preferred.id;
+  }
+  identifies(hash) {
+    return [this.preferred, ...this.legacy].some((h) => h.identifies(hash));
+  }
+  async hash(password) {
+    return this.preferred.hash(password);
+  }
+  async verify(password, hash) {
+    const hasher = [this.preferred, ...this.legacy].find((h) => h.identifies(hash));
+    if (!hasher) return false;
+    return hasher.verify(password, hash);
+  }
+  needsRehash(hash) {
+    if (!this.preferred.identifies(hash)) return true;
+    return this.preferred.needsRehash(hash);
+  }
+};
+
+export {
+  BcryptPasswordHasher,
+  __resetArgon2Cache,
+  Argon2idPasswordHasher,
+  MigratingPasswordHasher
+};

package/dist/{chunk-J5NLAZV2.js → chunk-JHUWZ6YW.js}

@@ -1,13 +1,13 @@
 import {
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 import {
   DEFAULT_INMEMORY_CONFIG
 } from "./chunk-O4L6RI5S.js";
 import {
   __spreadProps,
   __spreadValues
-} from "./chunk-ORMEWXMH.js";
+} from "./chunk-N3ETBM74.js";
 
 // src/core/cache/inmemory-cache-manager.ts
 var InMemoryCacheManager = class _InMemoryCacheManager {

package/dist/{chunk-LON5THYQ.js → chunk-KLMKCYIN.js}

@@ -1,6 +1,6 @@
 import {
   PasswordResetService
-} from "./chunk-N5VOFGF3.js";
+} from "./chunk-75UDFONR.js";
 
 // src/next/auth-handlers/forgot-password.handler.ts
 import { NextResponse } from "next/server";

package/dist/{chunk-4KJZRI74.js → chunk-KWUOLKDO.js}

@@ -1,6 +1,6 @@
 import {
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 
 // src/core/system/utils.ts
 import { exec } from "child_process";

package/dist/{chunk-GJO2MPC3.js → chunk-LCYDMYZS.js}

@@ -2,7 +2,7 @@ import {
   logApiRequest,
   logApiResponse,
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 
 // src/next/middleware/response-logger.ts
 var responseLoggerMiddleware = async (context, next) => {

package/dist/{chunk-WIQAPWTY.js → chunk-LL3VWKY4.js}

@@ -1,6 +1,6 @@
 import {
   clearTokenCookies
-} from "./chunk-RJGYONRO.js";
+} from "./chunk-PRPMEHRE.js";
 
 // src/next/auth-handlers/logout.handler.ts
 import { NextResponse } from "next/server";

package/dist/{chunk-IMAFMUZ7.js → chunk-LSS3GJUE.js}

@@ -1,6 +1,6 @@
 import {
   PasswordResetService
-} from "./chunk-N5VOFGF3.js";
+} from "./chunk-75UDFONR.js";
 import {
   AuthError
 } from "./chunk-5GWGARXI.js";
@@ -8,10 +8,11 @@ import {
 // src/next/auth-handlers/reset-password.handler.ts
 import { NextResponse } from "next/server";
 import { z } from "zod";
+var withinBcryptByteLimit = (value) => new TextEncoder().encode(value).length <= 72;
 var schema = z.object({
   email: z.string().email(),
   token: z.string().min(1),
-  password: z.string().min(8)
+  password: z.string().min(8).refine(withinBcryptByteLimit, { message: "Password cannot exceed 72 bytes" })
 });
 function createResetPasswordHandler(options) {
   const { dependencies } = options;

package/dist/{chunk-2PFSRVVD.js → chunk-LWHLB2Y6.js}

@@ -4,25 +4,78 @@ import {
 import {
   __spreadProps,
   __spreadValues
-} from "./chunk-ORMEWXMH.js";
+} from "./chunk-N3ETBM74.js";
 
 // src/core/auth/jwt/index.ts
-import { SignJWT, jwtVerify } from "jose";
+import { randomUUID } from "crypto";
+import {
+  SignJWT,
+  jwtVerify,
+  importPKCS8,
+  importSPKI,
+  createRemoteJWKSet
+} from "jose";
 var JWTManager = class {
   constructor(config, logger) {
     this.config = config;
     this.logger = logger;
-    this.secretKey = new TextEncoder().encode(config.secret);
-    if (config.secret.length < 32) {
-      throw new JWTError("JWT secret must be at least 32 characters long", "TOKEN_CREATION_FAILED");
+    if (this.isSymmetric()) {
+      if (!config.secret || config.secret.length < 32) {
+        throw new JWTError("JWT secret must be at least 32 characters long", "TOKEN_CREATION_FAILED");
+      }
+      this.secretKey = new TextEncoder().encode(config.secret);
+    } else {
+      if (!config.privateKey && !config.publicKey && !config.jwksUri) {
+        throw new JWTError(
+          "Asymmetric JWT requires privateKey (sign) and/or publicKey/jwksUri (verify)",
+          "TOKEN_CREATION_FAILED"
+        );
+      }
+    }
+  }
+  isSymmetric() {
+    return this.config.algorithm.startsWith("HS");
+  }
+  /** 발급용 키 (HS: secret, 비대칭: PKCS#8 개인키). 결과를 캐시한다. */
+  async getSigningKey() {
+    var _a;
+    if (this.isSymmetric()) {
+      return this.secretKey;
     }
+    if (!this.config.privateKey) {
+      throw new JWTError("No privateKey configured for signing", "TOKEN_CREATION_FAILED");
+    }
+    (_a = this.signingKeyCache) != null ? _a : this.signingKeyCache = importPKCS8(this.config.privateKey, this.config.algorithm);
+    return this.signingKeyCache;
+  }
+  /**
+   * 검증용 키를 jose getKey 함수로 정규화해 반환한다 (HS: secret, 비대칭:
+   * SPKI 공개키 또는 원격 JWKS). 정적 키도 함수로 감싸 단일 호출 경로를 쓰며,
+   * jose 는 함수 호출 전 알고리즘 allowlist 를 검증하므로 confusion 가드는 유지된다.
+   */
+  async getVerifyKey() {
+    var _a, _b;
+    if (this.isSymmetric()) {
+      const key = this.secretKey;
+      return async () => key;
+    }
+    if (this.config.jwksUri) {
+      (_a = this.jwks) != null ? _a : this.jwks = createRemoteJWKSet(new URL(this.config.jwksUri));
+      return this.jwks;
+    }
+    if (this.config.publicKey) {
+      (_b = this.verifyKeyCache) != null ? _b : this.verifyKeyCache = importSPKI(this.config.publicKey, this.config.algorithm);
+      const key = await this.verifyKeyCache;
+      return async () => key;
+    }
+    throw new JWTError("No publicKey or jwksUri configured for verification", "TOKEN_VERIFICATION_FAILED");
   }
   /**
    * Access JWT 토큰 생성
    */
   async createAccessToken(payload) {
     try {
-      const jwt = await new SignJWT(__spreadProps(__spreadValues({}, payload), { tokenType: "access" })).setProtectedHeader({ alg: this.config.algorithm }).setIssuedAt().setExpirationTime(this.config.accessTokenExpiry).sign(this.secretKey);
+      const jwt = await new SignJWT(__spreadProps(__spreadValues({}, payload), { tokenType: "access" })).setProtectedHeader({ alg: this.config.algorithm }).setIssuedAt().setExpirationTime(this.config.accessTokenExpiry).sign(await this.getSigningKey());
       this.logger.debug("Access token created successfully", {
         userId: payload.userId,
         expiresIn: this.config.accessTokenExpiry
@@ -38,14 +91,20 @@ var JWTManager = class {
   }
   /**
    * Refresh 토큰 생성
+   *
+   * rotation/reuse detection 용 `jti`(토큰 고유 id)와 `familyId`(회전 계보 id)를
+   * 함께 발급할 수 있다. 미지정 시 0.8 이전과 동일하게 식별자 없는 refresh
+   * 토큰을 만든다(하위 호환).
    */
-  async createRefreshToken(userId) {
+  async createRefreshToken(userId, options) {
     try {
       const payload = {
         userId,
         tokenType: "refresh"
       };
-      const jwt = await new SignJWT(payload).setProtectedHeader({ alg: this.config.algorithm }).setIssuedAt().setExpirationTime(this.config.refreshTokenExpiry).sign(this.secretKey);
+      if (options == null ? void 0 : options.jti) payload.jti = options.jti;
+      if (options == null ? void 0 : options.familyId) payload.familyId = options.familyId;
+      const jwt = await new SignJWT(payload).setProtectedHeader({ alg: this.config.algorithm }).setIssuedAt().setExpirationTime(this.config.refreshTokenExpiry).sign(await this.getSigningKey());
       this.logger.debug("Refresh token created successfully", {
         userId,
         expiresIn: this.config.refreshTokenExpiry
@@ -62,8 +121,11 @@ var JWTManager = class {
   /**
    * 토큰 쌍 생성 (Access + Refresh)
    */
-  async createTokenPair(user) {
+  async createTokenPair(user, options) {
+    var _a, _b;
     try {
+      const jti = (_a = options == null ? void 0 : options.jti) != null ? _a : randomUUID();
+      const familyId = (_b = options == null ? void 0 : options.familyId) != null ? _b : randomUUID();
       const [accessToken, refreshToken] = await Promise.all([
         this.createAccessToken({
           id: user.id,
@@ -72,9 +134,9 @@ var JWTManager = class {
           role: user.role,
           emailVerified: user.emailVerified
         }),
-        this.createRefreshToken(user.id)
+        this.createRefreshToken(user.id, { jti, familyId })
       ]);
-      this.logger.debug("Token pair created successfully", { userId: user.id });
+      this.logger.debug("Token pair created successfully", { userId: user.id, familyId });
       return { accessToken, refreshToken };
     } catch (error) {
       this.logger.error("Failed to create token pair", {
@@ -89,7 +151,7 @@ var JWTManager = class {
    */
   async verifyAccessToken(token) {
     try {
-      const { payload } = await jwtVerify(token, this.secretKey, {
+      const { payload } = await jwtVerify(token, await this.getVerifyKey(), {
         algorithms: [this.config.algorithm]
       });
       const userId = payload.userId || payload.sub || payload.id;
@@ -106,6 +168,8 @@ var JWTManager = class {
         id: userId,
         userId,
         email: payload.email,
+        // role 은 신뢰 불가 토큰에서 옴 — TRole 단언은 소비자 어휘로의 타입 편의일 뿐
+        // 런타임 검증은 아니다.
         role: payload.role,
         emailVerified: payload.emailVerified,
         tokenType: payload.tokenType,
@@ -131,7 +195,7 @@ var JWTManager = class {
    */
   async verifyRefreshToken(token) {
     try {
-      const { payload } = await jwtVerify(token, this.secretKey, {
+      const { payload } = await jwtVerify(token, await this.getVerifyKey(), {
         algorithms: [this.config.algorithm]
       });
       const userId = payload.userId || payload.sub || payload.id;
@@ -146,7 +210,9 @@ var JWTManager = class {
       });
       return {
         userId,
-        tokenType: payload.tokenType
+        tokenType: payload.tokenType,
+        jti: typeof payload.jti === "string" ? payload.jti : void 0,
+        familyId: typeof payload.familyId === "string" ? payload.familyId : void 0
       };
     } catch (error) {
       this.logger.error("Failed to verify refresh token", {
@@ -239,8 +305,8 @@ var JWTService = class {
   /**
    * Refresh 토큰 생성
    */
-  async createRefreshToken(userId) {
-    return this.manager.createRefreshToken(userId);
+  async createRefreshToken(userId, options) {
+    return this.manager.createRefreshToken(userId, options);
   }
   /**
    * Refresh 토큰 검증
@@ -251,8 +317,8 @@ var JWTService = class {
   /**
    * 토큰 쌍 생성
    */
-  async createTokenPair(user) {
-    return this.manager.createTokenPair(user);
+  async createTokenPair(user, options) {
+    return this.manager.createTokenPair(user, options);
   }
   /**
    * Access 토큰 생성

package/dist/{chunk-BBE4RXR7.js → chunk-MTZXWVW3.js}

@@ -1,12 +1,13 @@
 import {
   JWTService
-} from "./chunk-2PFSRVVD.js";
+} from "./chunk-LWHLB2Y6.js";
 import {
   AuthError
 } from "./chunk-5GWGARXI.js";
 import {
-  JWT_DEFAULTS
-} from "./chunk-2SIBG5BG.js";
+  JWT_DEFAULTS,
+  ROLE_DEFAULTS
+} from "./chunk-7YWUKMZD.js";
 
 // src/core/auth/services/oauth-callback.service.ts
 var OAuthCallbackService = class {
@@ -47,6 +48,17 @@ var OAuthCallbackService = class {
     }
     const existingUser = await this.userRepo.findByEmail(input.email);
     if (existingUser) {
+      if (input.emailVerified !== true) {
+        this.logger.warn("Blocked OAuth account linking for unverified email", {
+          provider: input.provider,
+          userId: existingUser.id
+        });
+        throw new AuthError(
+          "OAuth email is not verified by the provider; cannot link to an existing account",
+          "OAUTH_EMAIL_NOT_VERIFIED",
+          403
+        );
+      }
       await this.oauthRepo.create({
         userId: existingUser.id,
         provider: input.provider,
@@ -62,8 +74,7 @@ var OAuthCallbackService = class {
       email: input.email,
       name: input.name,
       image: input.image,
-      emailVerified: /* @__PURE__ */ new Date()
-      // OAuth users are auto-verified
+      emailVerified: input.emailVerified === true ? /* @__PURE__ */ new Date() : null
     });
     await this.oauthRepo.create({
       userId: newUser.id,
@@ -81,7 +92,7 @@ var OAuthCallbackService = class {
     return this.jwtService.createTokenPair({
       id: user.id,
       email: user.email,
-      role: (_a = user.role) != null ? _a : "USER",
+      role: (_a = user.role) != null ? _a : ROLE_DEFAULTS.DEFAULT_ROLE,
       emailVerified: user.emailVerified
     });
   }

package/dist/{chunk-ORMEWXMH.js → chunk-N3ETBM74.js}

@@ -17,21 +17,8 @@ var __spreadValues = (a, b) => {
   return a;
 };
 var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
-var __objRest = (source, exclude) => {
-  var target = {};
-  for (var prop in source)
-    if (__hasOwnProp.call(source, prop) && exclude.indexOf(prop) < 0)
-      target[prop] = source[prop];
-  if (source != null && __getOwnPropSymbols)
-    for (var prop of __getOwnPropSymbols(source)) {
-      if (exclude.indexOf(prop) < 0 && __propIsEnum.call(source, prop))
-        target[prop] = source[prop];
-    }
-  return target;
-};
 
 export {
   __spreadValues,
-  __spreadProps,
-  __objRest
+  __spreadProps
 };

package/dist/{chunk-KYAHURXN.js → chunk-N3TCQ5BF.js}

@@ -1,6 +1,6 @@
 import {
   JWT_DEFAULTS
-} from "./chunk-2SIBG5BG.js";
+} from "./chunk-7YWUKMZD.js";
 import {
   configWarn
 } from "./chunk-6J2EJVND.js";
@@ -10,7 +10,7 @@ import {
 
 // src/core/auth/config.ts
 function initializeAuth(config) {
-  var _a, _b, _c, _d;
+  var _a, _b, _c, _d, _e;
   (_a = globalThis.__withwiz_config) != null ? _a : globalThis.__withwiz_config = {};
   if (globalThis.__withwiz_config.auth) return;
   if (!config.jwtSecret) {
@@ -26,7 +26,8 @@ function initializeAuth(config) {
     jwtSecret: config.jwtSecret,
     accessTokenExpiry: (_b = config.accessTokenExpiry) != null ? _b : JWT_DEFAULTS.DEFAULT_ACCESS_TOKEN_EXPIRES,
     refreshTokenExpiry: (_c = config.refreshTokenExpiry) != null ? _c : JWT_DEFAULTS.DEFAULT_REFRESH_TOKEN_EXPIRES,
-    cookieSecure: (_d = config.cookieSecure) != null ? _d : false
+    cookieSecure: (_d = config.cookieSecure) != null ? _d : false,
+    tokenDelivery: (_e = config.tokenDelivery) != null ? _e : "hybrid"
   };
 }
 function getAuthConfig() {

package/dist/{chunk-HX4MPCVV.js → chunk-NTZBMWB6.js}

@@ -1,17 +1,17 @@
 import {
   getCacheManager,
   getEffectiveCacheBackend
-} from "./chunk-B6L5XV7O.js";
+} from "./chunk-SCAFDDJP.js";
 import {
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 import {
   getCacheConfig,
   getCacheTTL
-} from "./chunk-MREY2W7N.js";
+} from "./chunk-Y6CPPBJI.js";
 import {
   isCacheEnabled
-} from "./chunk-7F5X6F7X.js";
+} from "./chunk-HV6A6Z5R.js";
 
 // src/core/cache/cache-wrapper.ts
 function getCacheBackendLabel() {

package/dist/{chunk-RJGYONRO.js → chunk-PRPMEHRE.js}

@@ -1,9 +1,9 @@
 import {
   getAuthConfig
-} from "./chunk-KYAHURXN.js";
+} from "./chunk-N3TCQ5BF.js";
 import {
   __spreadValues
-} from "./chunk-ORMEWXMH.js";
+} from "./chunk-N3ETBM74.js";
 
 // src/core/auth/jwt/cookie.ts
 function getDefaultOptions() {

package/dist/{chunk-KG65BFPK.js → chunk-QAIN3WNN.js}

@@ -4,7 +4,7 @@ import {
 import {
   __spreadProps,
   __spreadValues
-} from "./chunk-ORMEWXMH.js";
+} from "./chunk-N3ETBM74.js";
 
 // src/core/logger/logger.ts
 import fs from "fs";

package/dist/{chunk-JJAIVUVD.js → chunk-R7EFDSPZ.js}

@@ -12,11 +12,11 @@ import {
 } from "./chunk-5GWGARXI.js";
 import {
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 import {
   __spreadProps,
   __spreadValues
-} from "./chunk-ORMEWXMH.js";
+} from "./chunk-N3ETBM74.js";
 
 // src/next/error/error-handler.ts
 import { NextResponse } from "next/server";

package/dist/{chunk-VJE4HA2C.js → chunk-RWCPRPEP.js}

@@ -1,6 +1,6 @@
 import {
   RegisterService
-} from "./chunk-LUIYCIF7.js";
+} from "./chunk-Y4ME3Q5K.js";
 import {
   AuthError
 } from "./chunk-5GWGARXI.js";
@@ -8,9 +8,10 @@ import {
 // src/next/auth-handlers/register.handler.ts
 import { NextResponse } from "next/server";
 import { z } from "zod";
+var withinBcryptByteLimit = (value) => new TextEncoder().encode(value).length <= 72;
 var registerSchema = z.object({
   email: z.string().email(),
-  password: z.string().min(8),
+  password: z.string().min(8).refine(withinBcryptByteLimit, { message: "Password cannot exceed 72 bytes" }),
   name: z.string().min(1).optional()
 });
 function createRegisterHandler(options) {