@nextsparkjs/core 0.1.0-beta.17 → 0.1.0-beta.171

package/dist/lib/services/user.service.js

@@ -1,5 +1,5 @@
-import { queryOneWithRLS, queryWithRLS, mutateWithRLS } from "../db";
-import { MetaService } from "./meta.service";
+import { queryOneWithRLS, queryWithRLS, mutateWithRLS } from "../db.js";
+import { MetaService } from "./meta.service.js";
 class UserService {
   /**
    * Get user by ID or email
@@ -35,7 +35,7 @@ class UserService {
           "emailVerified",
           "createdAt",
           "updatedAt"
-        FROM "user"
+        FROM "users"
         WHERE id = $1 OR email = $1`,
         [identifier],
         currentUserId
@@ -81,7 +81,7 @@ class UserService {
           "emailVerified",
           "createdAt",
           "updatedAt"
-        FROM "user"
+        FROM "users"
         WHERE email = $1`,
         [email],
         currentUserId
@@ -127,7 +127,7 @@ class UserService {
           "emailVerified",
           "createdAt",
           "updatedAt"
-        FROM "user"
+        FROM "users"
         WHERE id = $1`,
         [userId],
         currentUserId
@@ -174,7 +174,7 @@ class UserService {
           "emailVerified",
           "createdAt",
           "updatedAt"
-        FROM "user"
+        FROM "users"
         WHERE id IN (${placeholders})`,
         userIds,
         currentUserId
@@ -238,7 +238,7 @@ class UserService {
       updateFields.push(`"updatedAt" = CURRENT_TIMESTAMP`);
       values.push(userId);
       const query = `
-        UPDATE "user"
+        UPDATE "users"
         SET ${updateFields.join(", ")}
         WHERE id = $${paramCount}
         RETURNING
@@ -530,6 +530,52 @@ class UserService {
       );
     }
   }
+  /**
+   * Anonymize (soft-delete) a user account.
+   *
+   * A hard DELETE of the users row fails under foreign-key constraints (other
+   * tables reference the user) and would orphan that history. Anonymizing
+   * instead frees the UNIQUE email for re-registration, strips PII, revokes
+   * every session and purges stored credentials, while preserving referential
+   * integrity. `userId` must come from the caller's session — a user may only
+   * anonymize their own account.
+   *
+   * Throws an Error with `.code === 'OWNS_TEAMS'` when the user still owns
+   * teams; the caller must surface that so ownership is transferred first.
+   *
+   * @param userId - ID of the account to anonymize (own account only)
+   */
+  static async anonymizeAccount(userId) {
+    if (!userId || userId.trim() === "") {
+      throw new Error("User ID is required");
+    }
+    const { TeamService } = await import("./team.service.js");
+    const ownedTeams = await TeamService.getByOwnerId(userId);
+    if (ownedTeams.length > 0) {
+      const error = new Error(
+        "Cannot delete account while owning teams. Transfer ownership or delete teams first."
+      );
+      error.code = "OWNS_TEAMS";
+      throw error;
+    }
+    await UserService.deleteAllUserMetas(userId, userId);
+    const result = await mutateWithRLS(
+      `UPDATE "users"
+         SET email = 'deleted+' || id || '@deleted.invalid',
+             "emailVerified" = false,
+             "firstName" = 'Deleted',
+             "lastName" = 'account',
+             image = NULL
+       WHERE id = $1`,
+      [userId],
+      userId
+    );
+    if (result.rowCount === 0) {
+      throw new Error("User not found");
+    }
+    await mutateWithRLS('DELETE FROM "session" WHERE "userId" = $1', [userId], userId, { service: true });
+    await mutateWithRLS('DELETE FROM "account" WHERE "userId" = $1', [userId], userId, { service: true });
+  }
   /**
    * Get metadata for multiple users in bulk (solves N+1 query problem)
    *

package/dist/lib/teams/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../../src/lib/teams/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,IAAI,EAAc,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEzD;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA6D7E;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAW1D;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAGtD;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,QAAmB,EACzB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,aAAa,GAAE,QAAQ,EAAuB,GAC7C,OAAO,CAAC,OAAO,CAAC,CAYlB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAQ1B;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,MAAM,EAAE,MAAM;;QAEpD,MAAM;UACJ,MAAM;UACN,MAAM;iBACC,MAAM,GAAG,IAAI;aACjB,MAAM;eACJ,MAAM,GAAG,IAAI;cACd,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;eAClB,MAAM;eACN,MAAM;cACP,QAAQ;cACR,MAAM;KAyBnB;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,IAAI,GAAG;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,CAAC,CAqBlD;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM;QAGR,MAAM;YACF,MAAM;YACN,MAAM;UACR,QAAQ;eACH,MAAM,GAAG,IAAI;cACd,MAAM;eACL,MAAM;eACN,MAAM;cACP,MAAM,GAAG,IAAI;eACZ,MAAM;eACN,MAAM,GAAG,IAAI;KAuB3B;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC,CAclB;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAalB;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CA2Bf"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../../src/lib/teams/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,IAAI,EAAc,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEzD;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgE7E;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAW1D;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAGtD;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,QAAmB,EACzB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CA8Bf;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,aAAa,GAAE,QAAQ,EAAuB,GAC7C,OAAO,CAAC,OAAO,CAAC,CAYlB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAQ1B;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,MAAM,EAAE,MAAM;;QAEpD,MAAM;UACJ,MAAM;UACN,MAAM;iBACC,MAAM,GAAG,IAAI;aACjB,MAAM;eACJ,MAAM,GAAG,IAAI;cACd,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;eAClB,MAAM;eACN,MAAM;cACP,QAAQ;cACR,MAAM;KAyBnB;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,IAAI,GAAG;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,CAAC,CAqBlD;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM;QAGR,MAAM;YACF,MAAM;YACN,MAAM;UACR,QAAQ;eACH,MAAM,GAAG,IAAI;cACd,MAAM;eACL,MAAM;eACN,MAAM;cACP,MAAM,GAAG,IAAI;eACZ,MAAM;eACN,MAAM,GAAG,IAAI;KAuB3B;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC,CAclB;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAalB;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CA2Bf"}

package/dist/lib/teams/actions.js

@@ -1,4 +1,4 @@
-import { queryWithRLS, queryOneWithRLS, getTransactionClient } from "../db";
+import { queryWithRLS, queryOneWithRLS, getServiceTransactionClient } from "../db.js";
 async function createTeam(userId, name) {
   const user = await queryOneWithRLS(
     'SELECT id, email, name FROM "users" WHERE id = $1',
@@ -10,7 +10,7 @@ async function createTeam(userId, name) {
   const timestamp = Date.now().toString(36);
   const teamSlug = `team-${timestamp}-${userId.substring(0, 4).toLowerCase()}`;
   const teamName = name || (user.name ? `${user.name}'s Team` : "My Team");
-  const tx = await getTransactionClient(userId);
+  const tx = await getServiceTransactionClient();
   try {
     const [team] = await tx.query(
       `INSERT INTO "teams" (name, slug, "ownerId")
@@ -75,7 +75,8 @@ async function addUserToGlobalTeam(userId, role = "member", invitedBy) {
     `INSERT INTO "team_members" ("teamId", "userId", role, "invitedBy", "joinedAt")
      VALUES ($1, $2, $3, $4, NOW())`,
     [team.id, userId, role, invitedBy || null],
-    userId
+    userId,
+    { service: true }
   );
   console.log(`User ${userId} added to global team ${team.id} as ${role}`);
 }

package/dist/lib/teams/permissions.d.ts

@@ -89,6 +89,24 @@ export declare function isSuperadmin(userRole: UserRole): boolean;
  * @returns True if action is allowed, false otherwise
  */
 export declare function canManageRole(actorRole: string, targetRole: string): boolean;
+/**
+ * Check if a role can invite another role to the team
+ *
+ * Reads hierarchy from the merged permissions registry, so any roles added
+ * by consumers via additional config are supported automatically.
+ *
+ * Semantics: invitation is allowed when the actor's hierarchy level is
+ * greater than or equal to the target's hierarchy level. Peers can invite
+ * peers (e.g. admin → admin); a lower-ranked actor cannot invite a
+ * higher-ranked target.
+ *
+ * Missing hierarchy entries are treated as 0, mirroring canManageRole.
+ *
+ * @param actorRole - The role of the user issuing the invitation
+ * @param targetRole - The role the invitee would receive
+ * @returns True if the invitation is allowed, false otherwise
+ */
+export declare function canInviteToRole(actorRole: string, targetRole: string): boolean;
 /**
  * Get human-readable role description
  *

package/dist/lib/teams/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../src/lib/teams/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAUH;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,YAAY,CAAA;AAE9C;;GAEG;AACH,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,WAAW,GACX,aAAa,GACb,mBAAmB,GACnB,qBAAqB,GACrB,qBAAqB,GACrB,0BAA0B,GAC1B,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,qBAAqB,CAAA;AAEzB;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,cAAc,EAYhD,CAAA;AAuCD;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,CAAgC,CAAA;AAM7F;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,cAAc,EAC1B,aAAa,GAAE,OAAe,GAC7B,OAAO,CAWT;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,aAAa,GAAE,OAAe,GAC7B,cAAc,EAAE,CAQlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,UAAU,EAAE,cAAc,GACzB,OAAO,CAcT;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAExD;AAMD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAKT;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGvD;AAMD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGrD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAI5C;AAMD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA0BvC"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../src/lib/teams/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAUH;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,YAAY,CAAA;AAE9C;;GAEG;AACH,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,WAAW,GACX,aAAa,GACb,mBAAmB,GACnB,qBAAqB,GACrB,qBAAqB,GACrB,0BAA0B,GAC1B,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,qBAAqB,CAAA;AAEzB;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,cAAc,EAYhD,CAAA;AAuCD;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,CAAgC,CAAA;AAM7F;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,cAAc,EAC1B,aAAa,GAAE,OAAe,GAC7B,OAAO,CAWT;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,aAAa,GAAE,OAAe,GAC7B,cAAc,EAAE,CAQlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,UAAU,EAAE,cAAc,GACzB,OAAO,CAcT;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAExD;AAMD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAKT;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAIT;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGvD;AAMD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGrD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAI5C;AAMD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA0BvC"}

package/dist/lib/teams/permissions.js

@@ -63,6 +63,10 @@ function canManageRole(actorRole, targetRole) {
   const hierarchy = getHierarchyFromRegistry();
   return (hierarchy[actorRole] ?? 0) > (hierarchy[targetRole] ?? 0);
 }
+function canInviteToRole(actorRole, targetRole) {
+  const hierarchy = getHierarchyFromRegistry();
+  return (hierarchy[actorRole] ?? 0) >= (hierarchy[targetRole] ?? 0);
+}
 function getRoleDescription(role) {
   const descriptions = getDescriptionsFromRegistry();
   return descriptions[role] ?? "No description available";
@@ -97,6 +101,7 @@ function validateRoleTransition(fromRole, toRole, actorRole) {
 }
 export {
   ALL_TEAM_PERMISSIONS,
+  canInviteToRole,
   canManageRole,
   checkTeamPermission,
   getInvitableRoles,

package/dist/lib/teams/schema.d.ts

@@ -7,17 +7,12 @@
  * @module core/lib/teams/schema
  */
 import { z } from 'zod';
-export declare const teamRoleSchema: z.ZodEnum<{
-    member: "member";
-    owner: "owner";
-    admin: "admin";
-    viewer: "viewer";
-}>;
+export declare const teamRoleSchema: z.ZodString;
 export declare const invitationStatusSchema: z.ZodEnum<{
+    expired: "expired";
     pending: "pending";
     accepted: "accepted";
     declined: "declined";
-    expired: "expired";
 }>;
 export declare const teamSchema: z.ZodObject<{
     id: z.ZodString;
@@ -34,12 +29,7 @@ export declare const teamMemberSchema: z.ZodObject<{
     id: z.ZodString;
     teamId: z.ZodString;
     userId: z.ZodString;
-    role: z.ZodEnum<{
-        member: "member";
-        owner: "owner";
-        admin: "admin";
-        viewer: "viewer";
-    }>;
+    role: z.ZodString;
     invitedBy: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     joinedAt: z.ZodString;
     createdAt: z.ZodString;
@@ -49,17 +39,12 @@ export declare const teamInvitationSchema: z.ZodObject<{
     id: z.ZodString;
     teamId: z.ZodString;
     email: z.ZodString;
-    role: z.ZodEnum<{
-        member: "member";
-        owner: "owner";
-        admin: "admin";
-        viewer: "viewer";
-    }>;
+    role: z.ZodString;
     status: z.ZodEnum<{
+        expired: "expired";
         pending: "pending";
         accepted: "accepted";
         declined: "declined";
-        expired: "expired";
     }>;
     token: z.ZodString;
     invitedBy: z.ZodString;
@@ -74,27 +59,52 @@ export declare const createTeamSchema: z.ZodObject<{
     slug: z.ZodString;
     description: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
-export declare const updateTeamSchema: z.ZodObject<{
+/**
+ * Schema for owner-only team updates (name/description)
+ * Only team owners (ownerId === userId) can update these fields
+ * Used when: Owner updates team name or description
+ *
+ * @security This schema is only used after owner verification
+ * @note Fields are optional to allow partial updates (e.g., only description)
+ */
+export declare const ownerUpdateTeamSchema: z.ZodObject<{
     name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+/**
+ * Schema for admin team updates (non-owner-only fields)
+ * Admins can update: slug, avatarUrl, settings
+ * Does NOT include name/description (those are owner-only)
+ * Used when: Admin (non-owner) updates team metadata
+ *
+ * @security This schema explicitly excludes owner-only fields (name, description)
+ */
+export declare const adminUpdateTeamSchema: z.ZodObject<{
     slug: z.ZodOptional<z.ZodString>;
+    avatarUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    settings: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+/**
+ * Schema for general team updates (combined owner + admin permissions)
+ * This is a merge of ownerUpdateTeamSchema and adminUpdateTeamSchema
+ * Used for: API consumers that need a unified schema
+ *
+ * @note For internal use, prefer ownerUpdateTeamSchema or adminUpdateTeamSchema
+ * based on the user's role and the fields being updated
+ */
+export declare const updateTeamSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
     description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    slug: z.ZodOptional<z.ZodString>;
     avatarUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     settings: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$strip>;
 export declare const inviteMemberSchema: z.ZodObject<{
     email: z.ZodString;
-    role: z.ZodEnum<{
-        member: "member";
-        admin: "admin";
-        viewer: "viewer";
-    }>;
+    role: z.ZodString;
 }, z.core.$strip>;
 export declare const updateMemberRoleSchema: z.ZodObject<{
-    role: z.ZodEnum<{
-        member: "member";
-        admin: "admin";
-        viewer: "viewer";
-    }>;
+    role: z.ZodString;
 }, z.core.$strip>;
 export declare const paginationSchema: z.ZodObject<{
     page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
@@ -121,22 +131,17 @@ export declare const teamListQuerySchema: z.ZodObject<{
 export declare const memberListQuerySchema: z.ZodObject<{
     page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-    role: z.ZodOptional<z.ZodEnum<{
-        member: "member";
-        owner: "owner";
-        admin: "admin";
-        viewer: "viewer";
-    }>>;
+    role: z.ZodOptional<z.ZodString>;
     search: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export declare const invitationListQuerySchema: z.ZodObject<{
     page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     status: z.ZodOptional<z.ZodEnum<{
+        expired: "expired";
         pending: "pending";
         accepted: "accepted";
         declined: "declined";
-        expired: "expired";
     }>>;
 }, z.core.$strip>;
 export type TeamSchema = z.infer<typeof teamSchema>;
@@ -144,6 +149,8 @@ export type TeamMemberSchema = z.infer<typeof teamMemberSchema>;
 export type TeamInvitationSchema = z.infer<typeof teamInvitationSchema>;
 export type CreateTeamSchema = z.infer<typeof createTeamSchema>;
 export type UpdateTeamSchema = z.infer<typeof updateTeamSchema>;
+export type OwnerUpdateTeamSchema = z.infer<typeof ownerUpdateTeamSchema>;
+export type AdminUpdateTeamSchema = z.infer<typeof adminUpdateTeamSchema>;
 export type InviteMemberSchema = z.infer<typeof inviteMemberSchema>;
 export type UpdateMemberRoleSchema = z.infer<typeof updateMemberRoleSchema>;
 export type TeamListQuerySchema = z.infer<typeof teamListQuerySchema>;

package/dist/lib/teams/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/lib/teams/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,eAAO,MAAM,cAAc;;;;;EAAiD,CAAA;AAC5E,eAAO,MAAM,sBAAsB;;;;;EAAyD,CAAA;AAG5F,eAAO,MAAM,UAAU;;;;;;;;;;iBAUrB,CAAA;AAGF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;iBAS3B,CAAA;AAGF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;iBAa/B,CAAA;AAGF,eAAO,MAAM,gBAAgB;;;;iBAI3B,CAAA;AAEF,eAAO,MAAM,gBAAgB;;;;;;iBAM3B,CAAA;AAEF,eAAO,MAAM,kBAAkB;;;;;;;iBAK7B,CAAA;AAEF,eAAO,MAAM,sBAAsB;;;;;;iBAIjC,CAAA;AAGF,eAAO,MAAM,gBAAgB;;;iBAG3B,CAAA;AAGF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;iBAK9B,CAAA;AAEF,eAAO,MAAM,qBAAqB;;;;;;;;;;iBAGhC,CAAA;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;iBAEpC,CAAA;AAGF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAA;AACnD,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAC/D,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AACvE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAC/D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAC/D,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AACnE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAC3E,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AACrE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AACzE,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAA"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/lib/teams/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAKvB,eAAO,MAAM,cAAc,aAG1B,CAAA;AACD,eAAO,MAAM,sBAAsB;;;;;EAAyD,CAAA;AAG5F,eAAO,MAAM,UAAU;;;;;;;;;;iBAerB,CAAA;AAGF,eAAO,MAAM,gBAAgB;;;;;;;;;iBAS3B,CAAA;AAGF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;iBAa/B,CAAA;AAGF,eAAO,MAAM,gBAAgB;;;;iBAI3B,CAAA;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB;;;iBAOhC,CAAA;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB;;;;iBAIhC,CAAA;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB;;;;;;iBAAqD,CAAA;AAElF,eAAO,MAAM,kBAAkB;;;iBAM7B,CAAA;AAEF,eAAO,MAAM,sBAAsB;;iBAKjC,CAAA;AAGF,eAAO,MAAM,gBAAgB;;;iBAG3B,CAAA;AAGF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;iBAK9B,CAAA;AAEF,eAAO,MAAM,qBAAqB;;;;;iBAGhC,CAAA;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;iBAEpC,CAAA;AAGF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAA;AACnD,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAC/D,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AACvE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAC/D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAC/D,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AACzE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AACzE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AACnE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAC3E,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AACrE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AACzE,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAA"}

package/dist/lib/teams/schema.js

@@ -1,10 +1,20 @@
 import { z } from "zod";
-const teamRoleSchema = z.enum(["owner", "admin", "member", "viewer"]);
+import { AVAILABLE_ROLES } from "@nextsparkjs/registries/permissions-registry";
+import { getInvitableRoles } from "./permissions.js";
+const teamRoleSchema = z.string().refine(
+  (role) => AVAILABLE_ROLES.includes(role),
+  (role) => ({ message: `Invalid team role: ${role}. Must be one of: ${[...AVAILABLE_ROLES].join(", ")}` })
+);
 const invitationStatusSchema = z.enum(["pending", "accepted", "declined", "expired"]);
 const teamSchema = z.object({
   id: z.string().uuid(),
   name: z.string().min(2, "Name must be at least 2 characters").max(100, "Name must be at most 100 characters"),
   slug: z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "Slug must contain only lowercase letters, numbers, and hyphens"),
+  /**
+   * Description field has no max length limit (TEXT type in database)
+   * Database migration 007_teams_table.sql defines this as TEXT without constraints
+   * If max length is desired, it should be a business decision
+   */
   description: z.string().nullable().optional(),
   ownerId: z.string(),
   avatarUrl: z.string().url().nullable().optional(),
@@ -41,24 +51,29 @@ const createTeamSchema = z.object({
   slug: z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "Slug must contain only lowercase letters, numbers, and hyphens"),
   description: z.string().optional()
 });
-const updateTeamSchema = z.object({
-  name: z.string().min(2).max(100).optional(),
+const ownerUpdateTeamSchema = z.object({
+  name: z.string().min(1, "Team name is required").min(2, "Name must be at least 2 characters").max(100, "Name must be at most 100 characters").optional(),
+  description: z.string().nullable().optional()
+});
+const adminUpdateTeamSchema = z.object({
   slug: z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/).optional(),
-  description: z.string().nullable().optional(),
   avatarUrl: z.string().url().nullable().optional(),
   settings: z.record(z.string(), z.unknown()).optional()
 });
+const updateTeamSchema = ownerUpdateTeamSchema.merge(adminUpdateTeamSchema);
 const inviteMemberSchema = z.object({
   email: z.string().email("Invalid email address"),
-  role: z.enum(["admin", "member", "viewer"], {
-    message: "Role must be admin, member, or viewer"
-  })
+  role: z.string().refine(
+    (role) => getInvitableRoles().includes(role),
+    (role) => ({ message: `Role must be one of: ${getInvitableRoles().join(", ")}` })
+  )
   // Cannot invite as owner
 });
 const updateMemberRoleSchema = z.object({
-  role: z.enum(["admin", "member", "viewer"], {
-    message: "Role must be admin, member, or viewer"
-  })
+  role: z.string().refine(
+    (role) => getInvitableRoles().includes(role),
+    (role) => ({ message: `Role must be one of: ${getInvitableRoles().join(", ")}` })
+  )
   // Cannot promote to owner
 });
 const paginationSchema = z.object({
@@ -80,11 +95,13 @@ const invitationListQuerySchema = paginationSchema.extend({
   status: invitationStatusSchema.optional()
 });
 export {
+  adminUpdateTeamSchema,
   createTeamSchema,
   invitationListQuerySchema,
   invitationStatusSchema,
   inviteMemberSchema,
   memberListQuerySchema,
+  ownerUpdateTeamSchema,
   paginationSchema,
   teamInvitationSchema,
   teamListQuerySchema,

package/dist/lib/teams/teams.api.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Teams Client API
+ *
+ * Client-side API functions for team operations.
+ * These functions are pure (no React) and can be used in hooks or directly.
+ *
+ * @module core/lib/teams/teams.api
+ *
+ * @example
+ * // Direct usage
+ * const teams = await TeamsAPI.getUserTeams()
+ *
+ * // In React Query
+ * useQuery({ queryFn: TeamsAPI.getUserTeams })
+ */
+import type { Team, AdminTeamsResponse, AdminTeamsParams, CreateTeamRequest } from './types';
+/**
+ * Teams Client API
+ *
+ * Provides methods for fetching teams from the API.
+ * Server-side operations use TeamService directly.
+ */
+export declare class TeamsAPI {
+    /**
+     * Fetch current user's teams
+     *
+     * @returns Array of teams the user belongs to
+     * @throws Error if request fails
+     *
+     * @example
+     * const teams = await TeamsAPI.getUserTeams()
+     */
+    static getUserTeams(): Promise<Team[]>;
+    /**
+     * Create a new team
+     *
+     * @param data - Team creation data
+     * @returns Created team
+     * @throws Error if request fails
+     */
+    static createTeam(data: CreateTeamRequest): Promise<Team>;
+    /**
+     * Fetch all teams (admin only)
+     *
+     * Requires superadmin or developer role.
+     * Supports search, filtering by type, and pagination.
+     *
+     * @param params - Query parameters
+     * @returns Teams response with counts and pagination
+     * @throws Error if request fails or user is not authorized
+     *
+     * @example
+     * // Get all user teams
+     * const response = await TeamsAPI.getAdminTeams({ type: 'user' })
+     *
+     * // Search teams
+     * const response = await TeamsAPI.getAdminTeams({ search: 'acme' })
+     *
+     * // Paginate
+     * const response = await TeamsAPI.getAdminTeams({ page: 2, limit: 20 })
+     */
+    static getAdminTeams(params?: AdminTeamsParams): Promise<AdminTeamsResponse>;
+}
+//# sourceMappingURL=teams.api.d.ts.map

package/dist/lib/teams/teams.api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams.api.d.ts","sourceRoot":"","sources":["../../../src/lib/teams/teams.api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EACV,IAAI,EACJ,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,SAAS,CAAA;AAYhB;;;;;GAKG;AACH,qBAAa,QAAQ;IAKnB;;;;;;;;OAQG;WACU,YAAY,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAa5C;;;;;;OAMG;WACU,UAAU,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB/D;;;;;;;;;;;;;;;;;;;OAmBG;WACU,aAAa,CACxB,MAAM,GAAE,gBAAqB,GAC5B,OAAO,CAAC,kBAAkB,CAAC;CAiC/B"}

package/dist/lib/teams/teams.api.js

@@ -0,0 +1,96 @@
+class TeamsAPI {
+  // =============================================================================
+  // USER TEAMS (Normal user scope)
+  // =============================================================================
+  /**
+   * Fetch current user's teams
+   *
+   * @returns Array of teams the user belongs to
+   * @throws Error if request fails
+   *
+   * @example
+   * const teams = await TeamsAPI.getUserTeams()
+   */
+  static async getUserTeams() {
+    const response = await fetch("/api/v1/teams");
+    if (!response.ok) {
+      throw new Error("Failed to fetch teams");
+    }
+    const result = await response.json();
+    return result.data || result.teams || [];
+  }
+  /**
+   * Create a new team
+   *
+   * @param data - Team creation data
+   * @returns Created team
+   * @throws Error if request fails
+   */
+  static async createTeam(data) {
+    const response = await fetch("/api/v1/teams", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(data)
+    });
+    if (!response.ok) {
+      const error = await response.json();
+      throw new Error(error.error || "Failed to create team");
+    }
+    const result = await response.json();
+    return result.data || result.team;
+  }
+  // =============================================================================
+  // ADMIN TEAMS (Superadmin/Developer scope)
+  // =============================================================================
+  /**
+   * Fetch all teams (admin only)
+   *
+   * Requires superadmin or developer role.
+   * Supports search, filtering by type, and pagination.
+   *
+   * @param params - Query parameters
+   * @returns Teams response with counts and pagination
+   * @throws Error if request fails or user is not authorized
+   *
+   * @example
+   * // Get all user teams
+   * const response = await TeamsAPI.getAdminTeams({ type: 'user' })
+   *
+   * // Search teams
+   * const response = await TeamsAPI.getAdminTeams({ search: 'acme' })
+   *
+   * // Paginate
+   * const response = await TeamsAPI.getAdminTeams({ page: 2, limit: 20 })
+   */
+  static async getAdminTeams(params = {}) {
+    const searchParams = new URLSearchParams();
+    if (params.search) {
+      searchParams.set("search", params.search);
+    }
+    if (params.type) {
+      searchParams.set("type", params.type);
+    }
+    if (params.page) {
+      searchParams.set("page", String(params.page));
+    }
+    if (params.limit) {
+      searchParams.set("limit", String(params.limit));
+    }
+    const queryString = searchParams.toString();
+    const url = `/api/superadmin/teams${queryString ? `?${queryString}` : ""}`;
+    const response = await fetch(url);
+    if (!response.ok) {
+      if (response.status === 403) {
+        throw new Error("Not authorized to view all teams");
+      }
+      if (response.status === 401) {
+        throw new Error("Authentication required");
+      }
+      throw new Error("Failed to fetch teams");
+    }
+    return response.json();
+  }
+}
+export {
+  TeamsAPI
+};

package/dist/lib/teams/teams.keys.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Teams Query Keys Factory
+ *
+ * Centralized query key management for all team-related React Query hooks.
+ * Enables predictable caching and smart cache invalidation.
+ *
+ * @module core/lib/teams/teams.keys
+ *
+ * @example
+ * // Using keys in hooks
+ * useQuery({ queryKey: teamsKeys.user() })
+ * useQuery({ queryKey: teamsKeys.adminList({ search: 'acme' }) })
+ *
+ * // Invalidating related queries
+ * queryClient.invalidateQueries({ queryKey: teamsKeys.all })
+ */
+import type { AdminTeamsParams } from './types';
+export declare const teamsKeys: {
+    /**
+     * Base key for all team queries
+     * Use to invalidate ALL team-related caches
+     */
+    readonly all: readonly ["teams"];
+    /**
+     * User's teams (normal user scope)
+     * Endpoint: GET /api/v1/teams
+     */
+    readonly user: () => readonly ["teams", "user"];
+    /**
+     * Single team by ID
+     */
+    readonly detail: (teamId: string) => readonly ["teams", "detail", string];
+    /**
+     * Admin teams scope (superadmin/developer)
+     * Base key for all admin team queries
+     */
+    readonly admin: () => readonly ["teams", "admin"];
+    /**
+     * Admin teams list with parameters
+     * Endpoint: GET /api/superadmin/teams
+     * Used by superadmin management page
+     */
+    readonly adminList: (params: AdminTeamsParams) => readonly ["teams", "admin", "list", AdminTeamsParams];
+    /**
+     * Admin teams search (optimized for dropdowns)
+     * Uses simplified key for search-based caching
+     */
+    readonly adminSearch: (search: string) => readonly ["teams", "admin", "search", string];
+};
+/**
+ * Type helper for query key inference
+ */
+export type TeamsKeys = typeof teamsKeys;
+//# sourceMappingURL=teams.keys.d.ts.map

package/dist/lib/teams/teams.keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams.keys.d.ts","sourceRoot":"","sources":["../../../src/lib/teams/teams.keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAE/C,eAAO,MAAM,SAAS;IACpB;;;OAGG;;IAGH;;;OAGG;;IAGH;;OAEG;8BACc,MAAM;IAEvB;;;OAGG;;IAGH;;;;OAIG;iCACiB,gBAAgB;IAGpC;;;OAGG;mCACmB,MAAM;CAEpB,CAAA;AAEV;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAA"}