@nextsparkjs/core 0.1.0-beta.169 → 0.1.0-beta.170

package/dist/lib/actions/user.actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.actions.d.ts","sourceRoot":"","sources":["../../../src/lib/actions/user.actions.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAA;AAMzE;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAMD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAC,CA2DlD;AAMD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAC,CAsElD;AAMD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAsDrE"}
+{"version":3,"file":"user.actions.d.ts","sourceRoot":"","sources":["../../../src/lib/actions/user.actions.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAA;AAMzE;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAMD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAC,CA2DlD;AAMD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAC,CAsElD;AAMD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAgCrE"}

package/dist/lib/actions/user.actions.js

@@ -114,27 +114,13 @@ async function deleteAccount() {
       return { success: false, error: "Authentication required" };
     }
     const userId = session.user.id;
-    const { TeamService } = await import("../services/team.service.js");
-    const ownedTeams = await TeamService.getByOwnerId(userId);
-    if (ownedTeams.length > 0) {
-      return {
-        success: false,
-        error: "Cannot delete account while owning teams. Transfer ownership or delete teams first."
-      };
-    }
-    await UserService.deleteAllUserMetas(userId, userId);
-    const { mutateWithRLS } = await import("../db.js");
-    const result = await mutateWithRLS(
-      'DELETE FROM "users" WHERE id = $1',
-      [userId],
-      userId
-    );
-    if (result.rowCount === 0) {
-      return { success: false, error: "User not found" };
-    }
+    await UserService.anonymizeAccount(userId);
     revalidatePath("/");
     return { success: true };
   } catch (error) {
+    if ((error == null ? void 0 : error.code) === "OWNS_TEAMS") {
+      return { success: false, error: error.message };
+    }
     console.error("[deleteAccount] Error:", error);
     return {
       success: false,

package/dist/lib/api/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/api/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,UAAU,EAAkB,MAAM,QAAQ,CAAC;AAapD,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,OAAO,mBAAmB,EAAE,QAAQ,EAAE,CAAC;IAC9C,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,KAAK,IAAI,GAAG,UAAU,GAAG,WAAW,CAAC;AAErC;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC;IAClF,IAAI,EAAE,IAAI,CAAC;IACX,iBAAiB,CAAC,EAAE,YAAY,CAAC;CAClC,CAAC,CAoCD;AAgFD;;;GAGG;AACH,wBAAsB,iCAAiC,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC;IACrF,IAAI,EAAE,UAAU,CAAC;IACjB,iBAAiB,CAAC,EAAE,YAAY,CAAC;CAClC,CAAC,CA4BD;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CAwB3D;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAkBjF;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAE,MAAY;;;;;;GASzG;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAY,EACpB,OAAO,CAAC,EAAE,OAAO,EACjB,IAAI,CAAC,EAAE,MAAM;;;;;;;;GAWd;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,WAAW,GAAG;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAQA;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM;;;;;;;EAUd;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,MAAM,EACrB,WAAW,CAAC,EAAE,OAAO,GACpB,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,OAAO,EAAE,EAChD,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,IAEtD,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CA6CvE;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGjD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUzD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAezE;AAUD;;;GAGG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CA0CzG;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAG7F;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,EAChC,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,QAAQ,CAAC,CAqCnB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CA0BhE;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,CA0BlE;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EAAE,EACb,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,EAAE,CAAC,CA6BtD;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EAAE,EACb,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,OAAO,GACrB,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;CAAE,CAAC,EAAE,CAAC,CAgExD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3E,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,EACT,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CA2BlD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3E,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,EACT,eAAe,EAAE,OAAO,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAiBlD;AAoBD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA+DjD"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/lib/api/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,UAAU,EAAkB,MAAM,QAAQ,CAAC;AAapD,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,OAAO,mBAAmB,EAAE,QAAQ,EAAE,CAAC;IAC9C,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,KAAK,IAAI,GAAG,UAAU,GAAG,WAAW,CAAC;AAErC;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC;IAClF,IAAI,EAAE,IAAI,CAAC;IACX,iBAAiB,CAAC,EAAE,YAAY,CAAC;CAClC,CAAC,CAoCD;AAgFD;;;GAGG;AACH,wBAAsB,iCAAiC,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC;IACrF,IAAI,EAAE,UAAU,CAAC;IACjB,iBAAiB,CAAC,EAAE,YAAY,CAAC;CAClC,CAAC,CA4BD;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CAwB3D;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAkBjF;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAE,MAAY;;;;;;GASzG;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAY,EACpB,OAAO,CAAC,EAAE,OAAO,EACjB,IAAI,CAAC,EAAE,MAAM;;;;;;;;GAWd;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,WAAW,GAAG;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAQA;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM;;;;;;;EAUd;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,MAAM,EACrB,WAAW,CAAC,EAAE,OAAO,GACpB,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,OAAO,EAAE,EAChD,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,IAEtD,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,KAAG,OAAO,CAAC,YAAY,CAAC,CA6CvE;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGjD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUzD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAezE;AAUD;;;GAGG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAgDzG;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAG7F;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,EAChC,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,QAAQ,CAAC,CAyCnB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CA0BhE;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,CA0BlE;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EAAE,EACb,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,EAAE,CAAC,CA6BtD;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAClE,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,EAAE,EACb,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,OAAO,GACrB,OAAO,CAAC,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;CAAE,CAAC,EAAE,CAAC,CAgExD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3E,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,EACT,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CA2BlD;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3E,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,CAAC,EACT,eAAe,EAAE,OAAO,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAiBlD;AAoBD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA+DjD"}

package/dist/lib/api/helpers.js

@@ -7,7 +7,7 @@ import { auth } from "../auth.js";
 import { MetaService } from "../services/meta.service.js";
 import { ScopeService } from "../services/scope.service.js";
 import { getChildEntities } from "../entities/queries.js";
-import { getCorsOrigins, normalizeOrigin } from "../utils/cors.js";
+import { getCorsOrigins, normalizeOrigin, isOriginAllowed } from "../utils/cors.js";
 async function validateAndAuthenticateRequest(request) {
   var _a;
   const cookieHeader = request.headers.get("cookie");
@@ -271,8 +271,9 @@ async function addCorsHeaders(response, request) {
         allowedOrigin = normalizedOrigin;
       } else {
         const allowedOrigins = getCorsOrigins(config, env);
-        if (allowedOrigins.includes(normalizedOrigin)) {
-          allowedOrigin = normalizedOrigin;
+        const matched = isOriginAllowed(normalizedOrigin, allowedOrigins);
+        if (matched) {
+          allowedOrigin = matched;
         }
       }
     }
@@ -281,6 +282,7 @@ async function addCorsHeaders(response, request) {
     allowedOrigin = allowedOrigins[0] || "http://localhost:3000";
   }
   response.headers.set("Access-Control-Allow-Origin", allowedOrigin);
+  response.headers.append("Vary", "Origin");
   response.headers.set("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS");
   response.headers.set("Access-Control-Allow-Headers", "Content-Type, Authorization, X-API-Key, x-team-id, x-builder-source");
   response.headers.set("Access-Control-Allow-Credentials", "true");
@@ -309,12 +311,14 @@ async function wrapAuthHandlerWithCors(handler, request) {
       allowedOrigin = normalizedOrigin;
     } else {
       const allowedOrigins = getCorsOrigins(config, env);
-      if (allowedOrigins.includes(normalizedOrigin)) {
-        allowedOrigin = normalizedOrigin;
+      const matched = isOriginAllowed(normalizedOrigin, allowedOrigins);
+      if (matched) {
+        allowedOrigin = matched;
       }
     }
     newResponse.headers.set("Access-Control-Allow-Origin", allowedOrigin);
     newResponse.headers.set("Access-Control-Allow-Credentials", "true");
+    newResponse.headers.append("Vary", "Origin");
   }
   return newResponse;
 }

package/dist/lib/services/user.service.d.ts

@@ -189,6 +189,22 @@ export declare class UserService {
      * await UserService.deleteAllUserMetas('user-id-123', 'current-user-id')
      */
     static deleteAllUserMetas(userId: string, currentUserId: string): Promise<void>;
+    /**
+     * Anonymize (soft-delete) a user account.
+     *
+     * A hard DELETE of the users row fails under foreign-key constraints (other
+     * tables reference the user) and would orphan that history. Anonymizing
+     * instead frees the UNIQUE email for re-registration, strips PII, revokes
+     * every session and purges stored credentials, while preserving referential
+     * integrity. `userId` must come from the caller's session — a user may only
+     * anonymize their own account.
+     *
+     * Throws an Error with `.code === 'OWNS_TEAMS'` when the user still owns
+     * teams; the caller must surface that so ownership is transferred first.
+     *
+     * @param userId - ID of the account to anonymize (own account only)
+     */
+    static anonymizeAccount(userId: string): Promise<void>;
     /**
      * Get metadata for multiple users in bulk (solves N+1 query problem)
      *

package/dist/lib/services/user.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/user.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAG1D,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,QAAQ,CAAA;CAChB;AAmBD,qBAAa,WAAW;IACtB;;;;;;;;;;OAUG;WACU,OAAO,CAClB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAwCvB;;;;;;;;;OASG;WACU,cAAc,CACzB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAwCvB;;;;;;;;;OASG;WACU,WAAW,CACtB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAwCvB;;;;;;;;;OASG;WACU,aAAa,CACxB,OAAO,EAAE,MAAM,EAAE,EACjB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,EAAE,CAAC;IA2ClB;;;;;;;;;;;;;;OAcG;WACU,UAAU,CACrB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,iBAAiB,EAC1B,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IAwFhB;;;;;;;;;;;;OAYG;WACU,YAAY,CACvB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,cAAc,UAAQ,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAwBnC;;;;;;;;;;;OAWG;WACU,WAAW,CACtB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,OAAO,CAAC;IA4BnB;;;;;;;;;;;;;;;OAeG;WACU,oBAAoB,CAC/B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAAE,EAClB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IA4BnC;;;;;;;;;;;;;;;;;OAiBG;WACU,cAAc,CACzB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,OAAO,EAClB,aAAa,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,YAAY,CAAA;KAAE,GAChF,OAAO,CAAC,IAAI,CAAC;IA8BhB;;;;;;;;;;;;;;;OAeG;WACU,eAAe,CAC1B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,aAAa,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,YAAY,CAAA;KAAE,GAChF,OAAO,CAAC,IAAI,CAAC;IA6BhB;;;;;;;;;OASG;WACU,cAAc,CACzB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IA4BhB;;;;;;;;OAQG;WACU,kBAAkB,CAC7B,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IAuBhB;;;;;;;;;;;;;;OAcG;WACU,gBAAgB,CAC3B,OAAO,EAAE,MAAM,EAAE,EACjB,aAAa,EAAE,MAAM,EACrB,cAAc,UAAQ,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAwBnD;;;;;;;;;;;;;;;;;;;OAmBG;WACU,iBAAiB,CAC5B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,OAAO,EAClB,aAAa,EAAE,MAAM,EACrB,KAAK,SAAM,EACX,MAAM,SAAI,GACT,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAyBlD"}
+{"version":3,"file":"user.service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/user.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAG1D,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,QAAQ,CAAA;CAChB;AAmBD,qBAAa,WAAW;IACtB;;;;;;;;;;OAUG;WACU,OAAO,CAClB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAwCvB;;;;;;;;;OASG;WACU,cAAc,CACzB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAwCvB;;;;;;;;;OASG;WACU,WAAW,CACtB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAwCvB;;;;;;;;;OASG;WACU,aAAa,CACxB,OAAO,EAAE,MAAM,EAAE,EACjB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,EAAE,CAAC;IA2ClB;;;;;;;;;;;;;;OAcG;WACU,UAAU,CACrB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,iBAAiB,EAC1B,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IAwFhB;;;;;;;;;;;;OAYG;WACU,YAAY,CACvB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,cAAc,UAAQ,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAwBnC;;;;;;;;;;;OAWG;WACU,WAAW,CACtB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,OAAO,CAAC;IA4BnB;;;;;;;;;;;;;;;OAeG;WACU,oBAAoB,CAC/B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAAE,EAClB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IA4BnC;;;;;;;;;;;;;;;;;OAiBG;WACU,cAAc,CACzB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,OAAO,EAClB,aAAa,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,YAAY,CAAA;KAAE,GAChF,OAAO,CAAC,IAAI,CAAC;IA8BhB;;;;;;;;;;;;;;;OAeG;WACU,eAAe,CAC1B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,aAAa,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,YAAY,CAAA;KAAE,GAChF,OAAO,CAAC,IAAI,CAAC;IA6BhB;;;;;;;;;OASG;WACU,cAAc,CACzB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IA4BhB;;;;;;;;OAQG;WACU,kBAAkB,CAC7B,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IAuBhB;;;;;;;;;;;;;;OAcG;WACU,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuD5D;;;;;;;;;;;;;;OAcG;WACU,gBAAgB,CAC3B,OAAO,EAAE,MAAM,EAAE,EACjB,aAAa,EAAE,MAAM,EACrB,cAAc,UAAQ,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAwBnD;;;;;;;;;;;;;;;;;;;OAmBG;WACU,iBAAiB,CAC5B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,OAAO,EAClB,aAAa,EAAE,MAAM,EACrB,KAAK,SAAM,EACX,MAAM,SAAI,GACT,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAyBlD"}

package/dist/lib/services/user.service.js

@@ -530,6 +530,52 @@ class UserService {
       );
     }
   }
+  /**
+   * Anonymize (soft-delete) a user account.
+   *
+   * A hard DELETE of the users row fails under foreign-key constraints (other
+   * tables reference the user) and would orphan that history. Anonymizing
+   * instead frees the UNIQUE email for re-registration, strips PII, revokes
+   * every session and purges stored credentials, while preserving referential
+   * integrity. `userId` must come from the caller's session — a user may only
+   * anonymize their own account.
+   *
+   * Throws an Error with `.code === 'OWNS_TEAMS'` when the user still owns
+   * teams; the caller must surface that so ownership is transferred first.
+   *
+   * @param userId - ID of the account to anonymize (own account only)
+   */
+  static async anonymizeAccount(userId) {
+    if (!userId || userId.trim() === "") {
+      throw new Error("User ID is required");
+    }
+    const { TeamService } = await import("./team.service.js");
+    const ownedTeams = await TeamService.getByOwnerId(userId);
+    if (ownedTeams.length > 0) {
+      const error = new Error(
+        "Cannot delete account while owning teams. Transfer ownership or delete teams first."
+      );
+      error.code = "OWNS_TEAMS";
+      throw error;
+    }
+    await UserService.deleteAllUserMetas(userId, userId);
+    const result = await mutateWithRLS(
+      `UPDATE "users"
+         SET email = 'deleted+' || id || '@deleted.invalid',
+             "emailVerified" = false,
+             "firstName" = 'Deleted',
+             "lastName" = 'account',
+             image = NULL
+       WHERE id = $1`,
+      [userId],
+      userId
+    );
+    if (result.rowCount === 0) {
+      throw new Error("User not found");
+    }
+    await mutateWithRLS('DELETE FROM "session" WHERE "userId" = $1', [userId], userId, { service: true });
+    await mutateWithRLS('DELETE FROM "account" WHERE "userId" = $1', [userId], userId, { service: true });
+  }
   /**
    * Get metadata for multiple users in bulk (solves N+1 query problem)
    *

package/dist/lib/utils/cors.d.ts

@@ -68,4 +68,24 @@ export declare function normalizeCorsEnvironment(env: string): 'development' | '
  * ```
  */
 export declare function getCorsOrigins(config: ApplicationConfig, env?: string): string[];
+/**
+ * Check whether a request origin is allowed, supporting wildcard-pattern entries
+ * in the allow-list. A `*` in an entry matches exactly ONE host label (no dots),
+ * so `https://*.example.app` matches `https://tenant.example.app` but NOT
+ * `https://a.b.example.app`, `https://example.app`, or look-alikes like
+ * `https://evil-example.app`. Entries without `*` are matched exactly.
+ *
+ * Returns the CONCRETE request origin to echo back (never the pattern or `*`) so
+ * credentialed responses — which cannot use `*` for Access-Control-Allow-Origin —
+ * send a valid concrete origin; returns null when nothing matches.
+ *
+ * Why wildcards: multi-tenant apps serve dynamic per-tenant subdomains that can't
+ * be enumerated in config. A single `https://*.<apex>` entry lets a session on
+ * the apex be recognized cross-subdomain without listing every tenant origin.
+ *
+ * @param requestOrigin - The (already normalized) incoming Origin to validate.
+ * @param allowedOrigins - The allow-list from getCorsOrigins() (may contain patterns).
+ * @returns The origin to echo (the requestOrigin on match), or null on no match.
+ */
+export declare function isOriginAllowed(requestOrigin: string, allowedOrigins: string[]): string | null;
 //# sourceMappingURL=cors.d.ts.map

package/dist/lib/utils/cors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../src/lib/utils/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE/D;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,aAAa,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,CAAA;AAc7E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAetD;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,YAAY,CAkBlF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,iBAAiB,EACzB,GAAG,GAAE,MAA8C,GAClD,MAAM,EAAE,CA+CV"}
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../src/lib/utils/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE/D;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,aAAa,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,CAAA;AAc7E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAetD;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,YAAY,CAkBlF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,iBAAiB,EACzB,GAAG,GAAE,MAA8C,GAClD,MAAM,EAAE,CA+CV;AASD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAC7B,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,MAAM,EAAE,GACvB,MAAM,GAAG,IAAI,CA6Bf"}

package/dist/lib/utils/cors.js

@@ -57,8 +57,29 @@ function getCorsOrigins(config, env = process.env.NODE_ENV || "development") {
   }
   return origins;
 }
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function isOriginAllowed(requestOrigin, allowedOrigins) {
+  if (!requestOrigin) return null;
+  for (const entry of allowedOrigins) {
+    if (!entry) continue;
+    if (!entry.includes("*")) {
+      if (entry === requestOrigin) return requestOrigin;
+      continue;
+    }
+    if (!entry.includes("://")) continue;
+    const pattern = "^" + escapeRegExp(entry).replace(/(?:\\\*)+/g, "[^.]+") + "$";
+    try {
+      if (new RegExp(pattern).test(requestOrigin)) return requestOrigin;
+    } catch {
+    }
+  }
+  return null;
+}
 export {
   getCorsOrigins,
+  isOriginAllowed,
   normalizeCorsEnvironment,
   normalizeOrigin
 };

package/dist/styles/classes.json

@@ -1,5 +1,5 @@
 {
-  "generated": "2026-06-21T18:23:36.275Z",
+  "generated": "2026-06-21T21:50:46.106Z",
   "totalClasses": 1081,
   "classes": [
     "!text-2xl",

package/dist/templates/app/api/user/delete-account/route.ts

@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { auth } from "@nextsparkjs/core/lib/auth";
-import { mutateWithRLS } from "@nextsparkjs/core/lib/db";
 import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
+import { UserService } from "@nextsparkjs/core/lib/services";
 
 export const DELETE = withRateLimitTier(async (req: NextRequest) => {
   try {
@@ -17,35 +17,37 @@ export const DELETE = withRateLimitTier(async (req: NextRequest) => {
     const userId = session.user.id;
 
     try {
-      // Sign out the user first (while the user still exists)
+      // Anonymize the account: scrubs user metadata, frees the UNIQUE email,
+      // strips PII, and revokes every session + stored credential. A hard
+      // DELETE fails under foreign-key constraints; anonymizing preserves
+      // referential integrity. Throws code 'OWNS_TEAMS' if the user still
+      // owns teams (ownership must be transferred or those teams deleted first).
+      await UserService.anonymizeAccount(userId);
+
+      // Sessions are already revoked server-side; clear the current session
+      // cookie on this device too.
       try {
-        await auth.api.signOut({
-          headers: req.headers,
-        });
+        await auth.api.signOut({ headers: req.headers });
       } catch (signOutError) {
-        console.warn("Sign out failed (user may already be signed out):", signOutError);
+        console.warn("Sign out after account deletion failed (already revoked):", signOutError);
       }
 
-      // Delete user account and all associated data
-      // RLS policies will ensure only the user's own data is deleted
-      await mutateWithRLS(
-        'DELETE FROM "users" WHERE id = $1',
-        [userId],
-        userId
-      );
-
-      return NextResponse.json({ 
-        message: "Account deleted successfully" 
+      return NextResponse.json({
+        message: "Account deleted successfully",
       });
-
     } catch (dbError) {
+      if ((dbError as { code?: string })?.code === "OWNS_TEAMS") {
+        return NextResponse.json(
+          { error: (dbError as Error).message },
+          { status: 409 }
+        );
+      }
       console.error("Failed to delete user account:", dbError);
       return NextResponse.json(
         { error: "Failed to delete account" },
         { status: 500 }
       );
     }
-
   } catch (error) {
     console.error("Delete account error:", error);
     return NextResponse.json(

package/dist/templates/app/api/v1/users/[id]/meta/[key]/route.ts

@@ -116,21 +116,15 @@ export const GET = withRateLimitTier(withApiLogging(async (
     // Get user metadata value using UserService
     const metaValue = await UserService.getUserMeta(id, key, authResult.user.id)
 
-    // Return 404 if metadata key doesn't exist
-    if (metaValue === null || metaValue === undefined) {
-      const response = createApiError(
-        `Metadata key '${key}' not found for user`,
-        404,
-        null,
-        'META_NOT_FOUND'
-      )
-      return addCorsHeaders(response)
-    }
-
-    // Return metadata value
+    // Return 200 with value:null for an unset-but-valid key. A missing optional
+    // meta value is a normal state, not an error — a 404 here forces every
+    // client that reads an optional key to swallow a network 4xx (which the
+    // browser still logs as a failed request). The key itself was already
+    // validated above (INVALID_META_KEY), so reaching here means the key is
+    // valid and simply has no stored value yet.
     const response = createApiResponse({
       key,
-      value: metaValue,
+      value: metaValue ?? null,
     })
     return addCorsHeaders(response)
   } catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextsparkjs/core",
-  "version": "0.1.0-beta.169",
+  "version": "0.1.0-beta.170",
   "description": "NextSpark - The complete SaaS framework for Next.js",
   "license": "MIT",
   "author": "NextSpark <hello@nextspark.dev>",
@@ -469,7 +469,7 @@
     "tailwind-merge": "^3.3.1",
     "uuid": "^13.0.0",
     "zod": "^4.1.5",
-    "@nextsparkjs/testing": "0.1.0-beta.169"
+    "@nextsparkjs/testing": "0.1.0-beta.170"
   },
   "scripts": {
     "postinstall": "node scripts/postinstall.mjs || true",

package/templates/app/api/user/delete-account/route.ts

@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { auth } from "@nextsparkjs/core/lib/auth";
-import { mutateWithRLS } from "@nextsparkjs/core/lib/db";
 import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
+import { UserService } from "@nextsparkjs/core/lib/services";
 
 export const DELETE = withRateLimitTier(async (req: NextRequest) => {
   try {
@@ -17,35 +17,37 @@ export const DELETE = withRateLimitTier(async (req: NextRequest) => {
     const userId = session.user.id;
 
     try {
-      // Sign out the user first (while the user still exists)
+      // Anonymize the account: scrubs user metadata, frees the UNIQUE email,
+      // strips PII, and revokes every session + stored credential. A hard
+      // DELETE fails under foreign-key constraints; anonymizing preserves
+      // referential integrity. Throws code 'OWNS_TEAMS' if the user still
+      // owns teams (ownership must be transferred or those teams deleted first).
+      await UserService.anonymizeAccount(userId);
+
+      // Sessions are already revoked server-side; clear the current session
+      // cookie on this device too.
       try {
-        await auth.api.signOut({
-          headers: req.headers,
-        });
+        await auth.api.signOut({ headers: req.headers });
       } catch (signOutError) {
-        console.warn("Sign out failed (user may already be signed out):", signOutError);
+        console.warn("Sign out after account deletion failed (already revoked):", signOutError);
       }
 
-      // Delete user account and all associated data
-      // RLS policies will ensure only the user's own data is deleted
-      await mutateWithRLS(
-        'DELETE FROM "users" WHERE id = $1',
-        [userId],
-        userId
-      );
-
-      return NextResponse.json({ 
-        message: "Account deleted successfully" 
+      return NextResponse.json({
+        message: "Account deleted successfully",
       });
-
     } catch (dbError) {
+      if ((dbError as { code?: string })?.code === "OWNS_TEAMS") {
+        return NextResponse.json(
+          { error: (dbError as Error).message },
+          { status: 409 }
+        );
+      }
       console.error("Failed to delete user account:", dbError);
       return NextResponse.json(
         { error: "Failed to delete account" },
         { status: 500 }
       );
     }
-
   } catch (error) {
     console.error("Delete account error:", error);
     return NextResponse.json(

package/templates/app/api/v1/users/[id]/meta/[key]/route.ts

@@ -116,21 +116,15 @@ export const GET = withRateLimitTier(withApiLogging(async (
     // Get user metadata value using UserService
     const metaValue = await UserService.getUserMeta(id, key, authResult.user.id)
 
-    // Return 404 if metadata key doesn't exist
-    if (metaValue === null || metaValue === undefined) {
-      const response = createApiError(
-        `Metadata key '${key}' not found for user`,
-        404,
-        null,
-        'META_NOT_FOUND'
-      )
-      return addCorsHeaders(response)
-    }
-
-    // Return metadata value
+    // Return 200 with value:null for an unset-but-valid key. A missing optional
+    // meta value is a normal state, not an error — a 404 here forces every
+    // client that reads an optional key to swallow a network 4xx (which the
+    // browser still logs as a failed request). The key itself was already
+    // validated above (INVALID_META_KEY), so reaching here means the key is
+    // valid and simply has no stored value yet.
     const response = createApiResponse({
       key,
-      value: metaValue,
+      value: metaValue ?? null,
     })
     return addCorsHeaders(response)
   } catch (error) {