@nextsparkjs/core 0.1.0-beta.171 → 0.1.0-beta.173

package/dist/lib/services/team.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"team.service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/team.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAOpD,MAAM,WAAW,mBAAoB,SAAQ,IAAI;IAC/C,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,eAAgB,SAAQ,IAAI;IAC3C,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAMD,qBAAa,WAAW;IAKtB;;;;;;;;;OASG;WACU,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAY3E;;;;;;;;OAQG;WACU,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAW1D;;;;;;;;OAQG;WACU,SAAS,IAAI,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAO9C;;;;;;;;OAQG;WACU,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IAK1C;;;;;;;;OAQG;WACU,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IA2CrE;;;;;;;;;OASG;WACU,kBAAkB,CAC7B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IA2BtC;;;;;;;;OAQG;WACU,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAC7C,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;QACnB,KAAK,EAAE,MAAM,CAAA;QACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KACrB,GAAG,IAAI,CAAC;IAmBT;;;;;;;;OAQG;WACU,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAgB1D;;;;;;;;;;OAUG;WACU,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsEjE;;;;;;;;;;OAUG;WACU,MAAM,CACjB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC;IA+DhB;;;;;;;;;OASG;WACU,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoClE;;;;;;;;;OASG;WACU,eAAe,CAC1B,IAAI,EAAE,MAAM,EACZ,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC;IAoBnB;;;;;;;;;OASG;WACU,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmC5D;;;;;;;;;;OAUG;WACU,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAmB3E;;;;;;;;OAQG;WACU,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAYtD"}
+{"version":3,"file":"team.service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/team.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAOpD,MAAM,WAAW,mBAAoB,SAAQ,IAAI;IAC/C,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,eAAgB,SAAQ,IAAI;IAC3C,QAAQ,EAAE,QAAQ,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAMD,qBAAa,WAAW;IAKtB;;;;;;;;;OASG;WACU,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAY3E;;;;;;;;OAQG;WACU,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAW1D;;;;;;;;OAQG;WACU,SAAS,IAAI,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAO9C;;;;;;;;OAQG;WACU,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IAK1C;;;;;;;;OAQG;WACU,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IA2CrE;;;;;;;;;OASG;WACU,kBAAkB,CAC7B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IA2BtC;;;;;;;;OAQG;WACU,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAC7C,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;QACnB,KAAK,EAAE,MAAM,CAAA;QACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KACrB,GAAG,IAAI,CAAC;IAmBT;;;;;;;;OAQG;WACU,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAgB1D;;;;;;;;;;OAUG;WACU,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsEjE;;;;;;;;;;OAUG;WACU,MAAM,CACjB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC;IA+DhB;;;;;;;;;OASG;WACU,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoClE;;;;;;;;;OASG;WACU,eAAe,CAC1B,IAAI,EAAE,MAAM,EACZ,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC;IAoBnB;;;;;;;;;OASG;WACU,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmC5D;;;;;;;;;;OAUG;WACU,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA0B3E;;;;;;;;OAQG;WACU,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAYtD"}

package/dist/lib/services/team.service.js

@@ -410,7 +410,10 @@ class TeamService {
       throw new Error("User ID and Team ID are required");
     }
     const member = await queryOneWithRLS(
-      'SELECT id FROM "team_members" WHERE "teamId" = $1 AND "userId" = $2',
+      `SELECT tm.id
+         FROM "team_members" tm
+         INNER JOIN "teams" t ON t.id = tm."teamId"
+        WHERE tm."teamId" = $1 AND tm."userId" = $2 AND t."deletedAt" IS NULL`,
       [teamId, userId],
       userId
     );

package/dist/styles/classes.json

@@ -1,5 +1,5 @@
 {
-  "generated": "2026-06-22T20:21:00.466Z",
+  "generated": "2026-06-23T13:21:29.773Z",
   "totalClasses": 1081,
   "classes": [
     "!text-2xl",

package/dist/templates/app/api/auth/[...all]/route.ts

@@ -115,6 +115,13 @@ export async function POST(req: NextRequest) {
   const isOAuthCallback = pathname.includes('/api/auth/callback/');
   const isSignupRequest = isSignupAttempt || isOAuthCallback;
 
+  // A first-time OTP sign-in (emailOTP plugin with disableSignUp:false) auto-creates
+  // the user, so it is an implicit signup that can also carry an intent. It is a
+  // sign-in endpoint, so it is deliberately NOT part of `isSignupRequest` above
+  // (no registration-mode gating) — it only participates in the intent wrapping
+  // below, exactly like header/OAuth signup.
+  const isOtpSignin = pathname.includes('/sign-in/email-otp');
+
   if (isSignupRequest) {
     const registrationMode = AUTH_CONFIG?.registration?.mode ?? 'open';
     const teamsMode = TEAMS_CONFIG.mode;
@@ -160,10 +167,15 @@ export async function POST(req: NextRequest) {
   // Read the optional signup intent and run the signup within request-scoped
   // context so the user.create.after hook can map it to an initial team role
   // (AUTH_CONFIG.signupIntent). Header-based signup carries it in the
-  // `x-signup-intent` header; OAuth callbacks (incl. form_post-mode providers
-  // that POST the callback) can't, so they fall back to the `signup-intent`
-  // cookie set by the client before the OAuth flow (see the GET handler).
-  const signupIntent = isSignupAttempt
+  // `x-signup-intent` header; a first-time OTP sign-in carries it the same way
+  // (header preferred, `signup-intent` cookie fallback); OAuth callbacks (incl.
+  // form_post-mode providers that POST the callback) can't send a header, so
+  // they fall back to the cookie set by the client before the OAuth flow (see
+  // the GET handler). The value only ever maps to an app-configured role via
+  // roleMap (never an arbitrary role) and the user.create.after hook runs only
+  // when a user is actually created, so wrapping an existing-user sign-in is a
+  // no-op — there is no escalation surface.
+  const signupIntent = (isSignupAttempt || isOtpSignin)
     ? (req.headers.get('x-signup-intent') || req.cookies.get('signup-intent')?.value || undefined)
     : isOAuthCallback
       ? (req.cookies.get('signup-intent')?.value || undefined)

package/dist/templates/app/api/v1/teams/route.ts

@@ -66,8 +66,13 @@ export const GET = withRateLimitTier(withApiLogging(async (req: NextRequest): Pr
     }
 
     // Build WHERE clause based on filters
-    // If scope=all (superadmin), don't filter by user
-    let whereClause = requestAllTeams ? 'WHERE 1=1' : 'WHERE tm."userId" = $1'
+    // If scope=all (superadmin), don't filter by user.
+    // For a user's own list, exclude soft-deleted teams: a member (e.g. the former
+    // owner of a discarded personal team) keeps their team_members row, so without
+    // this filter a stale active-team pointer to a deleted team resurfaces in the
+    // list and the client team resolver (which matches on membership, not deletedAt)
+    // re-selects it. scope=all stays unfiltered so admins can still see deleted teams.
+    let whereClause = requestAllTeams ? 'WHERE 1=1' : 'WHERE tm."userId" = $1 AND t."deletedAt" IS NULL'
     const queryValues: unknown[] = requestAllTeams ? [] : [authResult.user!.id]
     let paramCount = requestAllTeams ? 1 : 2
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextsparkjs/core",
-  "version": "0.1.0-beta.171",
+  "version": "0.1.0-beta.173",
   "description": "NextSpark - The complete SaaS framework for Next.js",
   "license": "MIT",
   "author": "NextSpark <hello@nextspark.dev>",
@@ -469,7 +469,7 @@
     "tailwind-merge": "^3.3.1",
     "uuid": "^13.0.0",
     "zod": "^4.1.5",
-    "@nextsparkjs/testing": "0.1.0-beta.171"
+    "@nextsparkjs/testing": "0.1.0-beta.173"
   },
   "scripts": {
     "postinstall": "node scripts/postinstall.mjs || true",

package/templates/app/api/auth/[...all]/route.ts

@@ -115,6 +115,13 @@ export async function POST(req: NextRequest) {
   const isOAuthCallback = pathname.includes('/api/auth/callback/');
   const isSignupRequest = isSignupAttempt || isOAuthCallback;
 
+  // A first-time OTP sign-in (emailOTP plugin with disableSignUp:false) auto-creates
+  // the user, so it is an implicit signup that can also carry an intent. It is a
+  // sign-in endpoint, so it is deliberately NOT part of `isSignupRequest` above
+  // (no registration-mode gating) — it only participates in the intent wrapping
+  // below, exactly like header/OAuth signup.
+  const isOtpSignin = pathname.includes('/sign-in/email-otp');
+
   if (isSignupRequest) {
     const registrationMode = AUTH_CONFIG?.registration?.mode ?? 'open';
     const teamsMode = TEAMS_CONFIG.mode;
@@ -160,10 +167,15 @@ export async function POST(req: NextRequest) {
   // Read the optional signup intent and run the signup within request-scoped
   // context so the user.create.after hook can map it to an initial team role
   // (AUTH_CONFIG.signupIntent). Header-based signup carries it in the
-  // `x-signup-intent` header; OAuth callbacks (incl. form_post-mode providers
-  // that POST the callback) can't, so they fall back to the `signup-intent`
-  // cookie set by the client before the OAuth flow (see the GET handler).
-  const signupIntent = isSignupAttempt
+  // `x-signup-intent` header; a first-time OTP sign-in carries it the same way
+  // (header preferred, `signup-intent` cookie fallback); OAuth callbacks (incl.
+  // form_post-mode providers that POST the callback) can't send a header, so
+  // they fall back to the cookie set by the client before the OAuth flow (see
+  // the GET handler). The value only ever maps to an app-configured role via
+  // roleMap (never an arbitrary role) and the user.create.after hook runs only
+  // when a user is actually created, so wrapping an existing-user sign-in is a
+  // no-op — there is no escalation surface.
+  const signupIntent = (isSignupAttempt || isOtpSignin)
     ? (req.headers.get('x-signup-intent') || req.cookies.get('signup-intent')?.value || undefined)
     : isOAuthCallback
       ? (req.cookies.get('signup-intent')?.value || undefined)

package/templates/app/api/v1/teams/route.ts

@@ -66,8 +66,13 @@ export const GET = withRateLimitTier(withApiLogging(async (req: NextRequest): Pr
     }
 
     // Build WHERE clause based on filters
-    // If scope=all (superadmin), don't filter by user
-    let whereClause = requestAllTeams ? 'WHERE 1=1' : 'WHERE tm."userId" = $1'
+    // If scope=all (superadmin), don't filter by user.
+    // For a user's own list, exclude soft-deleted teams: a member (e.g. the former
+    // owner of a discarded personal team) keeps their team_members row, so without
+    // this filter a stale active-team pointer to a deleted team resurfaces in the
+    // list and the client team resolver (which matches on membership, not deletedAt)
+    // re-selects it. scope=all stays unfiltered so admins can still see deleted teams.
+    let whereClause = requestAllTeams ? 'WHERE 1=1' : 'WHERE tm."userId" = $1 AND t."deletedAt" IS NULL'
     const queryValues: unknown[] = requestAllTeams ? [] : [authResult.user!.id]
     let paramCount = requestAllTeams ? 1 : 2