@withwiz/toolkit 0.7.1 → 0.9.0

package/dist/{chunk-B6L5XV7O.js → chunk-SCAFDDJP.js}

@@ -1,32 +1,32 @@
 import {
   NoopCacheManager
-} from "./chunk-VPRTPW7C.js";
+} from "./chunk-XF3WUF3F.js";
 import {
   RedisCacheManager
-} from "./chunk-JKSABDFT.js";
+} from "./chunk-4TGPAUJV.js";
 import {
   HybridCacheManager
-} from "./chunk-BFZR62LZ.js";
+} from "./chunk-XXPB4C37.js";
+import {
+  InMemoryCacheManager
+} from "./chunk-JHUWZ6YW.js";
 import {
   isRedisAvailableNow,
   isRedisGloballyDisabled
-} from "./chunk-6TUDUOGC.js";
-import {
-  InMemoryCacheManager
-} from "./chunk-J5NLAZV2.js";
+} from "./chunk-ZEHNCHIV.js";
 import {
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 import {
   getCacheConfig
-} from "./chunk-MREY2W7N.js";
+} from "./chunk-Y6CPPBJI.js";
 import {
   getENV,
   isCacheEnabled
-} from "./chunk-7F5X6F7X.js";
+} from "./chunk-HV6A6Z5R.js";
 import {
   isCacheConfigInitialized
-} from "./chunk-GORISA3L.js";
+} from "./chunk-7KIM5MHV.js";
 import {
   configWarn
 } from "./chunk-6J2EJVND.js";

package/dist/{chunk-KXYDTC4A.js → chunk-SNFPZD6L.js}

@@ -1,9 +1,12 @@
 import {
   __spreadValues
-} from "./chunk-ORMEWXMH.js";
+} from "./chunk-N3ETBM74.js";
 
 // src/core/validators/password-validator.ts
 import { z } from "zod";
+var BCRYPT_MAX_PASSWORD_BYTES = 72;
+var utf8ByteLength = (value) => new TextEncoder().encode(value).length;
+var BCRYPT_BYTE_LIMIT_MESSAGE = `Password cannot exceed ${BCRYPT_MAX_PASSWORD_BYTES} bytes`;
 var PasswordStrength = /* @__PURE__ */ ((PasswordStrength2) => {
   PasswordStrength2["VERY_WEAK"] = "very_weak";
   PasswordStrength2["WEAK"] = "weak";
@@ -25,6 +28,9 @@ var PasswordValidator = class {
     if (password.length > opts.maxLength) {
       errors.push(`Password cannot exceed ${opts.maxLength} characters`);
     }
+    if (utf8ByteLength(password) > BCRYPT_MAX_PASSWORD_BYTES) {
+      errors.push(BCRYPT_BYTE_LIMIT_MESSAGE);
+    }
     if (opts.requireNumber && !/\d/.test(password)) {
       errors.push("Password must contain at least one number");
     }
@@ -136,7 +142,10 @@ var PasswordValidator = class {
     if (opts.customPattern) {
       schema = schema.regex(opts.customPattern, opts.customMessage);
     }
-    return schema;
+    return schema.refine(
+      (value) => utf8ByteLength(value) <= BCRYPT_MAX_PASSWORD_BYTES,
+      { message: BCRYPT_BYTE_LIMIT_MESSAGE }
+    );
   }
   /**
    * 비밀번호 확인 검증

package/dist/{chunk-B5VRZ2VJ.js → chunk-TNDEYJEL.js}

@@ -1,15 +1,20 @@
 import {
   JWTService
-} from "./chunk-2PFSRVVD.js";
+} from "./chunk-LWHLB2Y6.js";
 import {
   AuthError
 } from "./chunk-5GWGARXI.js";
 import {
-  JWT_DEFAULTS
-} from "./chunk-2SIBG5BG.js";
+  JWT_DEFAULTS,
+  ROLE_DEFAULTS
+} from "./chunk-7YWUKMZD.js";
+import {
+  __spreadValues
+} from "./chunk-N3ETBM74.js";
 
 // src/core/auth/services/login.service.ts
 import { compare } from "bcryptjs";
+var DUMMY_PASSWORD_HASH = "$2b$12$/l4jMXYcTL.SQgNWzy1UcuSlrtLlw.GFTpWDYTficzN2kRhN/LwEO";
 var LoginService = class {
   constructor(config) {
     var _a, _b, _c;
@@ -20,6 +25,7 @@ var LoginService = class {
       refreshTokenExpiry: (_b = config.refreshTokenExpiry) != null ? _b : JWT_DEFAULTS.DEFAULT_REFRESH_TOKEN_EXPIRES,
       algorithm: JWT_DEFAULTS.ALGORITHM
     }, config.logger);
+    this.passwordHasher = config.passwordHasher;
     this.logger = (_c = config.logger) != null ? _c : { debug() {
     }, info() {
     }, warn() {
@@ -30,12 +36,17 @@ var LoginService = class {
     var _a;
     const user = await this.userRepo.findByEmail(email);
     if (!user) {
+      if (this.passwordHasher) {
+        await this.passwordHasher.hash(password).catch(() => void 0);
+      } else {
+        await compare(password, DUMMY_PASSWORD_HASH);
+      }
       throw new AuthError("Invalid credentials", "INVALID_CREDENTIALS", 401);
     }
     if (user.isActive === false) {
       throw new AuthError("Account is disabled", "ACCOUNT_DISABLED", 403);
     }
-    const isValid = await compare(password, storedHash);
+    const isValid = this.passwordHasher ? await this.passwordHasher.verify(password, storedHash) : await compare(password, storedHash);
     if (!isValid) {
       this.logger.warn("Failed login attempt", { email });
       throw new AuthError("Invalid credentials", "INVALID_CREDENTIALS", 401);
@@ -43,12 +54,20 @@ var LoginService = class {
     const tokens = await this.jwtService.createTokenPair({
       id: user.id,
       email: user.email,
-      role: (_a = user.role) != null ? _a : "USER",
+      role: (_a = user.role) != null ? _a : ROLE_DEFAULTS.DEFAULT_ROLE,
       emailVerified: user.emailVerified
     });
+    let rehashedPassword;
+    if (this.passwordHasher && this.passwordHasher.needsRehash(storedHash)) {
+      try {
+        rehashedPassword = await this.passwordHasher.hash(password);
+      } catch (error) {
+        this.logger.warn("Password rehash failed", { userId: user.id, error });
+      }
+    }
     await this.userRepo.updateLastLoginAt(user.id);
     this.logger.info("User logged in successfully", { userId: user.id });
-    return { user, tokens };
+    return __spreadValues({ user, tokens }, rehashedPassword ? { rehashedPassword } : {});
   }
 };
 

package/dist/{chunk-GDTZMX3L.js → chunk-TRGFXIEF.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-XQIAXMRY.js";
 import {
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 
 // src/next/middleware/rate-limit.ts
 var GLOBAL_KEY = "__withwiz_rateLimitAdapter__";

package/dist/{chunk-JRORMRVN.js → chunk-U2TGXJ3A.js}

@@ -1,6 +1,6 @@
 import {
   OAuthManager
-} from "./chunk-UQ3Z3ZAF.js";
+} from "./chunk-P7WHMKN5.js";
 import {
   generateOAuthState,
   setOAuthStateCookie

package/dist/{chunk-VNDL2E44.js → chunk-U52U5SK7.js}

@@ -1,10 +1,10 @@
 import {
   runCommand,
   runMacCommand
-} from "./chunk-4KJZRI74.js";
+} from "./chunk-KWUOLKDO.js";
 import {
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 
 // src/core/system/memory.ts
 import os from "os";

package/dist/{chunk-54REXMTE.js → chunk-UWOWKOOQ.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-7ZO5UNTJ.js";
 import {
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 
 // src/next/middleware/cors.ts
 import { NextResponse } from "next/server";
@@ -25,6 +25,7 @@ function createCorsMiddleware(config) {
       const response2 = new NextResponse(null, { status: 204 });
       if (origin && allowedOrigins.includes(origin)) {
         response2.headers.set("Access-Control-Allow-Origin", origin);
+        response2.headers.append("Vary", "Origin");
         if (allowCredentials) {
           response2.headers.set("Access-Control-Allow-Credentials", "true");
         }
@@ -39,6 +40,7 @@ function createCorsMiddleware(config) {
     const response = await next();
     if (origin && allowedOrigins.includes(origin)) {
       response.headers.set("Access-Control-Allow-Origin", origin);
+      response.headers.append("Vary", "Origin");
       if (allowCredentials) {
         response.headers.set("Access-Control-Allow-Credentials", "true");
       }

package/dist/{chunk-4PROUAZ5.js → chunk-V3WZFUY3.js}

@@ -3,27 +3,27 @@ import {
 } from "./chunk-VC2E6KYQ.js";
 import {
   MiddlewareChain
-} from "./chunk-UMRKMF3E.js";
+} from "./chunk-WXOWI7BJ.js";
 import {
   rateLimitMiddleware
-} from "./chunk-GDTZMX3L.js";
+} from "./chunk-TRGFXIEF.js";
 import {
   responseLoggerMiddleware
-} from "./chunk-GJO2MPC3.js";
+} from "./chunk-LCYDMYZS.js";
 import {
   securityMiddleware
-} from "./chunk-Q66VOVGN.js";
+} from "./chunk-Y4WPEIKW.js";
 import {
   adminMiddleware,
   authMiddleware,
   optionalAuthMiddleware
-} from "./chunk-6TRD7ZW4.js";
+} from "./chunk-XKIBJJA3.js";
 import {
   corsMiddleware
-} from "./chunk-54REXMTE.js";
+} from "./chunk-UWOWKOOQ.js";
 import {
   errorHandlerMiddleware
-} from "./chunk-W7PEL3DX.js";
+} from "./chunk-BRBOGLFT.js";
 
 // src/next/middleware/wrappers.ts
 function withPublicApi(handler) {

package/dist/{chunk-G4LJN4OZ.js → chunk-VH57Y5Z4.js}

@@ -1,7 +1,7 @@
 import {
   cache,
   geoCache
-} from "./chunk-B6L5XV7O.js";
+} from "./chunk-SCAFDDJP.js";
 
 // src/core/cache/cache-invalidation.ts
 var invalidateCache = {

package/dist/chunk-VQJY52YF.js

@@ -0,0 +1,139 @@
+import {
+  ParamBuilder,
+  columnList,
+  getDialect
+} from "./chunk-2JUFL4KX.js";
+import {
+  resolveConfig
+} from "./chunk-E4TKORMQ.js";
+
+// src/core/auth/adapters/sql/oauth-account-repository.ts
+import { randomUUID } from "crypto";
+var SqlOAuthAccountRepository = class {
+  constructor(exec, config) {
+    this.exec = exec;
+    this.config = resolveConfig(config);
+    this.dialect = getDialect(this.config.dialect);
+  }
+  get table() {
+    return this.dialect.quoteId(this.config.tables.oauthAccount);
+  }
+  get cols() {
+    return this.config.oauthColumns;
+  }
+  selectColumns() {
+    const c = this.cols;
+    return [
+      c.id,
+      c.userId,
+      c.provider,
+      c.providerAccountId,
+      c.accessToken,
+      c.refreshToken,
+      c.expiresAt,
+      c.tokenType,
+      c.scope,
+      c.createdAt,
+      c.updatedAt
+    ];
+  }
+  async findByProvider(provider, providerAccountId) {
+    const c = this.cols;
+    const pb = new ParamBuilder(this.dialect);
+    const sql = `SELECT ${columnList(this.selectColumns(), this.dialect)} FROM ${this.table} WHERE ${this.dialect.quoteId(c.provider)} = ${pb.add(provider)} AND ${this.dialect.quoteId(c.providerAccountId)} = ${pb.add(providerAccountId)}`;
+    const rows = await this.exec.query(sql, pb.params);
+    return rows[0] ? this.mapToOAuthAccount(rows[0]) : null;
+  }
+  async findByUserId(userId) {
+    const pb = new ParamBuilder(this.dialect);
+    const sql = `SELECT ${columnList(this.selectColumns(), this.dialect)} FROM ${this.table} WHERE ${this.dialect.quoteId(this.cols.userId)} = ${pb.add(userId)}`;
+    const rows = await this.exec.query(sql, pb.params);
+    return rows.map((r) => this.mapToOAuthAccount(r));
+  }
+  async create(data) {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j;
+    const c = this.cols;
+    const id = randomUUID();
+    const now = /* @__PURE__ */ new Date();
+    const pb = new ParamBuilder(this.dialect);
+    const entries = [
+      [c.id, id],
+      [c.userId, data.userId],
+      [c.provider, data.provider],
+      [c.providerAccountId, data.providerAccountId],
+      [c.accessToken, (_a = data.accessToken) != null ? _a : null],
+      [c.refreshToken, (_b = data.refreshToken) != null ? _b : null],
+      [c.expiresAt, (_c = data.expiresAt) != null ? _c : null],
+      [c.tokenType, (_d = data.tokenType) != null ? _d : null],
+      [c.scope, (_e = data.scope) != null ? _e : null],
+      [c.createdAt, now],
+      [c.updatedAt, now]
+    ];
+    const colSql = entries.map(([col]) => this.dialect.quoteId(col)).join(", ");
+    const valSql = entries.map(([, val]) => pb.add(val)).join(", ");
+    const sql = `INSERT INTO ${this.table} (${colSql}) VALUES (${valSql})`;
+    await this.exec.query(sql, pb.params);
+    return {
+      id,
+      userId: data.userId,
+      provider: data.provider,
+      providerAccountId: data.providerAccountId,
+      accessToken: (_f = data.accessToken) != null ? _f : null,
+      refreshToken: (_g = data.refreshToken) != null ? _g : null,
+      expiresAt: (_h = data.expiresAt) != null ? _h : null,
+      tokenType: (_i = data.tokenType) != null ? _i : null,
+      scope: (_j = data.scope) != null ? _j : null,
+      createdAt: now,
+      updatedAt: now
+    };
+  }
+  async update(id, data) {
+    const c = this.cols;
+    const pb = new ParamBuilder(this.dialect);
+    const sets = [];
+    const assign = (col, val) => sets.push(`${this.dialect.quoteId(col)} = ${pb.add(val)}`);
+    if (data.accessToken !== void 0) assign(c.accessToken, data.accessToken);
+    if (data.refreshToken !== void 0) assign(c.refreshToken, data.refreshToken);
+    if (data.expiresAt !== void 0) assign(c.expiresAt, data.expiresAt);
+    if (data.tokenType !== void 0) assign(c.tokenType, data.tokenType);
+    if (data.scope !== void 0) assign(c.scope, data.scope);
+    assign(c.updatedAt, /* @__PURE__ */ new Date());
+    const sql = `UPDATE ${this.table} SET ${sets.join(", ")} WHERE ${this.dialect.quoteId(c.id)} = ${pb.add(id)}`;
+    await this.exec.query(sql, pb.params);
+    const updated = await this.selectById(id);
+    if (!updated) throw new Error(`OAuth account not found after update: ${id}`);
+    return updated;
+  }
+  async delete(id) {
+    const pb = new ParamBuilder(this.dialect);
+    const sql = `DELETE FROM ${this.table} WHERE ${this.dialect.quoteId(this.cols.id)} = ${pb.add(id)}`;
+    await this.exec.query(sql, pb.params);
+  }
+  async selectById(id) {
+    const pb = new ParamBuilder(this.dialect);
+    const sql = `SELECT ${columnList(this.selectColumns(), this.dialect)} FROM ${this.table} WHERE ${this.dialect.quoteId(this.cols.id)} = ${pb.add(id)}`;
+    const rows = await this.exec.query(sql, pb.params);
+    return rows[0] ? this.mapToOAuthAccount(rows[0]) : null;
+  }
+  mapToOAuthAccount(row) {
+    var _a, _b, _c, _d, _e, _f;
+    const c = this.cols;
+    return {
+      id: row[c.id],
+      userId: row[c.userId],
+      provider: row[c.provider],
+      providerAccountId: row[c.providerAccountId],
+      accessToken: (_a = row[c.accessToken]) != null ? _a : null,
+      refreshToken: (_b = row[c.refreshToken]) != null ? _b : null,
+      expiresAt: (_c = row[c.expiresAt]) != null ? _c : null,
+      tokenType: (_d = row[c.tokenType]) != null ? _d : null,
+      scope: (_e = row[c.scope]) != null ? _e : null,
+      createdAt: row[c.createdAt],
+      updatedAt: (_f = row[c.updatedAt]) != null ? _f : row[c.createdAt]
+    };
+  }
+};
+
+export {
+  SqlOAuthAccountRepository
+};

package/dist/{chunk-5S7M2AJL.js → chunk-VWAB4PM7.js}

@@ -1,6 +1,6 @@
 import {
   getErrorMessage
-} from "./chunk-7WG7XPXC.js";
+} from "./chunk-KKZCNF6U.js";
 import {
   getErrorCategory
 } from "./chunk-XQIAXMRY.js";

package/dist/{chunk-AQZPGOEZ.js → chunk-VWKZMGPJ.js}

@@ -1,6 +1,6 @@
 import {
   TokenGenerator
-} from "./chunk-D73ZJQMX.js";
+} from "./chunk-ZZABL54F.js";
 import {
   AuthError
 } from "./chunk-5GWGARXI.js";
@@ -20,12 +20,13 @@ var EmailVerificationService = class {
     } };
   }
   async verify(email, token) {
-    const tokenRecord = await this.tokenRepo.findByEmailAndToken(email, token, "EMAIL_VERIFICATION" /* EMAIL_VERIFICATION */);
+    const hashedToken = TokenGenerator.hash(token);
+    const tokenRecord = await this.tokenRepo.findByEmailAndToken(email, hashedToken, "EMAIL_VERIFICATION" /* EMAIL_VERIFICATION */);
     if (!tokenRecord || tokenRecord.expires < /* @__PURE__ */ new Date()) {
       throw new AuthError("Invalid or expired verification token", "TOKEN_INVALID", 400);
     }
     await this.userRepo.verifyEmail(email);
-    await this.tokenRepo.delete(email, token, "EMAIL_VERIFICATION" /* EMAIL_VERIFICATION */);
+    await this.tokenRepo.delete(email, hashedToken, "EMAIL_VERIFICATION" /* EMAIL_VERIFICATION */);
     this.logger.info("Email verified", { email });
   }
   async resend(email) {
@@ -38,7 +39,7 @@ var EmailVerificationService = class {
     }
     const token = TokenGenerator.generate();
     const expires = new Date(Date.now() + this.tokenExpiryHours * 60 * 60 * 1e3);
-    await this.tokenRepo.create(email, token, "EMAIL_VERIFICATION" /* EMAIL_VERIFICATION */, expires);
+    await this.tokenRepo.create(email, TokenGenerator.hash(token), "EMAIL_VERIFICATION" /* EMAIL_VERIFICATION */, expires);
     await this.emailSender.sendVerificationEmail(email, token);
     this.logger.info("Verification email resent", { email });
   }

package/dist/{chunk-4K27YLAE.js → chunk-VZ2PQA4U.js}

@@ -1,9 +1,9 @@
 import {
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 import {
   __spreadValues
-} from "./chunk-ORMEWXMH.js";
+} from "./chunk-N3ETBM74.js";
 
 // src/core/geolocation/batch-processor.ts
 var BatchProcessor = class {

package/dist/{chunk-ZOWEW4GY.js → chunk-WBHX4MJV.js}

@@ -3,10 +3,10 @@ import {
   formatBytesPerSec,
   runCommand,
   runMacCommand
-} from "./chunk-4KJZRI74.js";
+} from "./chunk-KWUOLKDO.js";
 import {
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 
 // src/core/system/network.ts
 async function getNetworkInfo() {

package/dist/{chunk-G4SNTXJ3.js → chunk-WSHRBK6Y.js}

@@ -1,20 +1,20 @@
 import {
   OAuthCallbackService
-} from "./chunk-BBE4RXR7.js";
+} from "./chunk-MTZXWVW3.js";
 import {
   OAuthManager
-} from "./chunk-UQ3Z3ZAF.js";
+} from "./chunk-P7WHMKN5.js";
 import {
   OAUTH_STATE_COOKIE,
   clearOAuthStateCookie,
   validateOAuthState
 } from "./chunk-JLRMET4V.js";
-import {
-  setTokenCookies
-} from "./chunk-RJGYONRO.js";
 import {
   AuthError
 } from "./chunk-5GWGARXI.js";
+import {
+  setTokenCookies
+} from "./chunk-PRPMEHRE.js";
 
 // src/next/auth-handlers/oauth-callback.handler.ts
 import { NextResponse } from "next/server";
@@ -76,7 +76,8 @@ function createOAuthCallbackHandler(options) {
         email: userInfo.email,
         name: userInfo.name,
         image: userInfo.image,
-        accessToken
+        accessToken,
+        emailVerified: userInfo.emailVerified
       });
       if (hooks == null ? void 0 : hooks.onAfterOAuth) await hooks.onAfterOAuth(result.user, provider, result.isNewUser);
       if (result.isNewUser && (hooks == null ? void 0 : hooks.onOAuthFirstLogin)) {

package/dist/{chunk-UMRKMF3E.js → chunk-WXOWI7BJ.js}

@@ -1,9 +1,9 @@
 import {
   logger
-} from "./chunk-KG65BFPK.js";
+} from "./chunk-QAIN3WNN.js";
 import {
   __spreadValues
-} from "./chunk-ORMEWXMH.js";
+} from "./chunk-N3ETBM74.js";
 
 // src/next/middleware/middleware-chain.ts
 var MiddlewareChain = class {

package/dist/chunk-XAGPZLRK.js

@@ -0,0 +1,106 @@
+import {
+  JWTService
+} from "./chunk-LWHLB2Y6.js";
+import {
+  AuthError
+} from "./chunk-5GWGARXI.js";
+import {
+  JWT_DEFAULTS,
+  ROLE_DEFAULTS
+} from "./chunk-7YWUKMZD.js";
+
+// src/core/auth/services/token-refresh.service.ts
+import { randomUUID } from "crypto";
+var TokenRefreshService = class {
+  constructor(config) {
+    var _a, _b, _c;
+    this.userRepo = config.userRepository;
+    this.jwtService = new JWTService({
+      secret: config.jwtSecret,
+      accessTokenExpiry: (_a = config.accessTokenExpiry) != null ? _a : JWT_DEFAULTS.DEFAULT_ACCESS_TOKEN_EXPIRES,
+      refreshTokenExpiry: (_b = config.refreshTokenExpiry) != null ? _b : JWT_DEFAULTS.DEFAULT_REFRESH_TOKEN_EXPIRES,
+      algorithm: JWT_DEFAULTS.ALGORITHM
+    }, config.logger);
+    this.isTokenBlacklisted = config.isTokenBlacklisted;
+    this.store = config.refreshTokenStore;
+    this.logger = (_c = config.logger) != null ? _c : { debug() {
+    }, info() {
+    }, warn() {
+    }, error() {
+    } };
+  }
+  async refresh(refreshToken) {
+    var _a, _b, _c;
+    if (this.isTokenBlacklisted) {
+      const blacklisted = await this.isTokenBlacklisted(refreshToken);
+      if (blacklisted) {
+        throw new AuthError("Token has been revoked", "TOKEN_REVOKED", 401);
+      }
+    }
+    const { userId, jti, familyId } = await this.jwtService.verifyRefreshToken(refreshToken);
+    if (this.store) {
+      if (familyId && await this.store.isFamilyRevoked(familyId)) {
+        throw new AuthError("Token has been revoked", "TOKEN_REVOKED", 401);
+      }
+      if (jti && await this.store.isUsed(jti)) {
+        if (familyId) await this.store.revokeFamily(familyId);
+        this.logger.warn("Refresh token reuse detected", { userId, jti, familyId });
+        throw new AuthError("Refresh token reuse detected", "TOKEN_REUSE_DETECTED", 401);
+      }
+    }
+    const user = await this.userRepo.findById(userId);
+    if (!user) {
+      throw new AuthError("User not found", "USER_NOT_FOUND", 401);
+    }
+    if (user.isActive === false) {
+      throw new AuthError("Account is disabled", "ACCOUNT_DISABLED", 403);
+    }
+    const role = (_a = user.role) != null ? _a : ROLE_DEFAULTS.DEFAULT_ROLE;
+    const accessToken = await this.jwtService.createAccessToken({
+      id: user.id,
+      userId: user.id,
+      email: user.email,
+      role,
+      emailVerified: user.emailVerified
+    });
+    if (!this.store) {
+      return { accessToken, user: { id: user.id, email: user.email, role } };
+    }
+    const family = familyId != null ? familyId : randomUUID();
+    if (jti) {
+      await this.store.markUsed(jti, { familyId: family, userId });
+    }
+    const newJti = randomUUID();
+    const newRefreshToken = await this.jwtService.createRefreshToken(userId, {
+      jti: newJti,
+      familyId: family
+    });
+    await ((_c = (_b = this.store).register) == null ? void 0 : _c.call(_b, { jti: newJti, familyId: family, userId }));
+    return { accessToken, refreshToken: newRefreshToken, user: { id: user.id, email: user.email, role } };
+  }
+  /**
+   * family 전체를 즉시 무효화한다 (stateful 로그아웃 / 탈취 대응).
+   * store 미주입 시 동작하지 않는다.
+   */
+  async revokeFamily(familyId) {
+    if (!this.store) {
+      throw new AuthError("Refresh token store is not configured", "STORE_NOT_CONFIGURED", 500);
+    }
+    await this.store.revokeFamily(familyId);
+  }
+  /**
+   * refresh 토큰을 검증해 그 family 를 무효화한다 (로그아웃 핸들러용).
+   * 토큰에 familyId 가 없으면(레거시) 무효화할 family 가 없으므로 무시한다.
+   */
+  async revokeByToken(refreshToken) {
+    if (!this.store) {
+      throw new AuthError("Refresh token store is not configured", "STORE_NOT_CONFIGURED", 500);
+    }
+    const { familyId } = await this.jwtService.verifyRefreshToken(refreshToken);
+    if (familyId) await this.store.revokeFamily(familyId);
+  }
+};
+
+export {
+  TokenRefreshService
+};

package/dist/{chunk-VPRTPW7C.js → chunk-XF3WUF3F.js}

@@ -1,9 +1,9 @@
 import {
   getCacheConfig
-} from "./chunk-MREY2W7N.js";
+} from "./chunk-Y6CPPBJI.js";
 import {
   getENV
-} from "./chunk-7F5X6F7X.js";
+} from "./chunk-HV6A6Z5R.js";
 
 // src/core/cache/noop-cache-manager.ts
 var NoopCacheManager = class {