@nextsparkjs/core 0.1.0-beta.19 → 0.1.0-beta.190

package/dist/lib/services/user-flags.service.js

@@ -1,4 +1,4 @@
-import { MetaService } from "./meta.service";
+import { MetaService } from "./meta.service.js";
 const flagCache = {};
 const CACHE_TTL = 5 * 60 * 1e3;
 class UserFlagsService {

package/dist/lib/services/user.service.d.ts

@@ -189,6 +189,22 @@ export declare class UserService {
      * await UserService.deleteAllUserMetas('user-id-123', 'current-user-id')
      */
     static deleteAllUserMetas(userId: string, currentUserId: string): Promise<void>;
+    /**
+     * Anonymize (soft-delete) a user account.
+     *
+     * A hard DELETE of the users row fails under foreign-key constraints (other
+     * tables reference the user) and would orphan that history. Anonymizing
+     * instead frees the UNIQUE email for re-registration, strips PII, revokes
+     * every session and purges stored credentials, while preserving referential
+     * integrity. `userId` must come from the caller's session — a user may only
+     * anonymize their own account.
+     *
+     * Throws an Error with `.code === 'OWNS_TEAMS'` when the user still owns
+     * teams; the caller must surface that so ownership is transferred first.
+     *
+     * @param userId - ID of the account to anonymize (own account only)
+     */
+    static anonymizeAccount(userId: string): Promise<void>;
     /**
      * Get metadata for multiple users in bulk (solves N+1 query problem)
      *

package/dist/lib/services/user.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/user.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAG1D,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,QAAQ,CAAA;CAChB;AAmBD,qBAAa,WAAW;IACtB;;;;;;;;;;OAUG;WACU,OAAO,CAClB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAwCvB;;;;;;;;;OASG;WACU,cAAc,CACzB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAwCvB;;;;;;;;;OASG;WACU,WAAW,CACtB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAwCvB;;;;;;;;;OASG;WACU,aAAa,CACxB,OAAO,EAAE,MAAM,EAAE,EACjB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,EAAE,CAAC;IA2ClB;;;;;;;;;;;;;;OAcG;WACU,UAAU,CACrB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,iBAAiB,EAC1B,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IAwFhB;;;;;;;;;;;;OAYG;WACU,YAAY,CACvB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,cAAc,UAAQ,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAwBnC;;;;;;;;;;;OAWG;WACU,WAAW,CACtB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,OAAO,CAAC;IA4BnB;;;;;;;;;;;;;;;OAeG;WACU,oBAAoB,CAC/B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAAE,EAClB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IA4BnC;;;;;;;;;;;;;;;;;OAiBG;WACU,cAAc,CACzB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,OAAO,EAClB,aAAa,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,YAAY,CAAA;KAAE,GAChF,OAAO,CAAC,IAAI,CAAC;IA8BhB;;;;;;;;;;;;;;;OAeG;WACU,eAAe,CAC1B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,aAAa,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,YAAY,CAAA;KAAE,GAChF,OAAO,CAAC,IAAI,CAAC;IA6BhB;;;;;;;;;OASG;WACU,cAAc,CACzB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IA4BhB;;;;;;;;OAQG;WACU,kBAAkB,CAC7B,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IAuBhB;;;;;;;;;;;;;;OAcG;WACU,gBAAgB,CAC3B,OAAO,EAAE,MAAM,EAAE,EACjB,aAAa,EAAE,MAAM,EACrB,cAAc,UAAQ,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAwBnD;;;;;;;;;;;;;;;;;;;OAmBG;WACU,iBAAiB,CAC5B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,OAAO,EAClB,aAAa,EAAE,MAAM,EACrB,KAAK,SAAM,EACX,MAAM,SAAI,GACT,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAyBlD"}
+{"version":3,"file":"user.service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/user.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAG1D,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,QAAQ,CAAA;CAChB;AAmBD,qBAAa,WAAW;IACtB;;;;;;;;;;OAUG;WACU,OAAO,CAClB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAwCvB;;;;;;;;;OASG;WACU,cAAc,CACzB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAwCvB;;;;;;;;;OASG;WACU,WAAW,CACtB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAwCvB;;;;;;;;;OASG;WACU,aAAa,CACxB,OAAO,EAAE,MAAM,EAAE,EACjB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,EAAE,CAAC;IA2ClB;;;;;;;;;;;;;;OAcG;WACU,UAAU,CACrB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,iBAAiB,EAC1B,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IAwFhB;;;;;;;;;;;;OAYG;WACU,YAAY,CACvB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,cAAc,UAAQ,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAwBnC;;;;;;;;;;;OAWG;WACU,WAAW,CACtB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,OAAO,CAAC;IA4BnB;;;;;;;;;;;;;;;OAeG;WACU,oBAAoB,CAC/B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAAE,EAClB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IA4BnC;;;;;;;;;;;;;;;;;OAiBG;WACU,cAAc,CACzB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,OAAO,EAClB,aAAa,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,YAAY,CAAA;KAAE,GAChF,OAAO,CAAC,IAAI,CAAC;IA8BhB;;;;;;;;;;;;;;;OAeG;WACU,eAAe,CAC1B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,aAAa,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,YAAY,CAAA;KAAE,GAChF,OAAO,CAAC,IAAI,CAAC;IA6BhB;;;;;;;;;OASG;WACU,cAAc,CACzB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IA4BhB;;;;;;;;OAQG;WACU,kBAAkB,CAC7B,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IAuBhB;;;;;;;;;;;;;;OAcG;WACU,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuD5D;;;;;;;;;;;;;;OAcG;WACU,gBAAgB,CAC3B,OAAO,EAAE,MAAM,EAAE,EACjB,aAAa,EAAE,MAAM,EACrB,cAAc,UAAQ,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAwBnD;;;;;;;;;;;;;;;;;;;OAmBG;WACU,iBAAiB,CAC5B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,OAAO,EAClB,aAAa,EAAE,MAAM,EACrB,KAAK,SAAM,EACX,MAAM,SAAI,GACT,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAyBlD"}

package/dist/lib/services/user.service.js

@@ -1,5 +1,5 @@
-import { queryOneWithRLS, queryWithRLS, mutateWithRLS } from "../db";
-import { MetaService } from "./meta.service";
+import { queryOneWithRLS, queryWithRLS, mutateWithRLS } from "../db.js";
+import { MetaService } from "./meta.service.js";
 class UserService {
   /**
    * Get user by ID or email
@@ -35,7 +35,7 @@ class UserService {
           "emailVerified",
           "createdAt",
           "updatedAt"
-        FROM "user"
+        FROM "users"
         WHERE id = $1 OR email = $1`,
         [identifier],
         currentUserId
@@ -81,7 +81,7 @@ class UserService {
           "emailVerified",
           "createdAt",
           "updatedAt"
-        FROM "user"
+        FROM "users"
         WHERE email = $1`,
         [email],
         currentUserId
@@ -127,7 +127,7 @@ class UserService {
           "emailVerified",
           "createdAt",
           "updatedAt"
-        FROM "user"
+        FROM "users"
         WHERE id = $1`,
         [userId],
         currentUserId
@@ -174,7 +174,7 @@ class UserService {
           "emailVerified",
           "createdAt",
           "updatedAt"
-        FROM "user"
+        FROM "users"
         WHERE id IN (${placeholders})`,
         userIds,
         currentUserId
@@ -238,7 +238,7 @@ class UserService {
       updateFields.push(`"updatedAt" = CURRENT_TIMESTAMP`);
       values.push(userId);
       const query = `
-        UPDATE "user"
+        UPDATE "users"
         SET ${updateFields.join(", ")}
         WHERE id = $${paramCount}
         RETURNING
@@ -530,6 +530,52 @@ class UserService {
       );
     }
   }
+  /**
+   * Anonymize (soft-delete) a user account.
+   *
+   * A hard DELETE of the users row fails under foreign-key constraints (other
+   * tables reference the user) and would orphan that history. Anonymizing
+   * instead frees the UNIQUE email for re-registration, strips PII, revokes
+   * every session and purges stored credentials, while preserving referential
+   * integrity. `userId` must come from the caller's session — a user may only
+   * anonymize their own account.
+   *
+   * Throws an Error with `.code === 'OWNS_TEAMS'` when the user still owns
+   * teams; the caller must surface that so ownership is transferred first.
+   *
+   * @param userId - ID of the account to anonymize (own account only)
+   */
+  static async anonymizeAccount(userId) {
+    if (!userId || userId.trim() === "") {
+      throw new Error("User ID is required");
+    }
+    const { TeamService } = await import("./team.service.js");
+    const ownedTeams = await TeamService.getByOwnerId(userId);
+    if (ownedTeams.length > 0) {
+      const error = new Error(
+        "Cannot delete account while owning teams. Transfer ownership or delete teams first."
+      );
+      error.code = "OWNS_TEAMS";
+      throw error;
+    }
+    await UserService.deleteAllUserMetas(userId, userId);
+    const result = await mutateWithRLS(
+      `UPDATE "users"
+         SET email = 'deleted+' || id || '@deleted.invalid',
+             "emailVerified" = false,
+             "firstName" = 'Deleted',
+             "lastName" = 'account',
+             image = NULL
+       WHERE id = $1`,
+      [userId],
+      userId
+    );
+    if (result.rowCount === 0) {
+      throw new Error("User not found");
+    }
+    await mutateWithRLS('DELETE FROM "session" WHERE "userId" = $1', [userId], userId, { service: true });
+    await mutateWithRLS('DELETE FROM "account" WHERE "userId" = $1', [userId], userId, { service: true });
+  }
   /**
    * Get metadata for multiple users in bulk (solves N+1 query problem)
    *

package/dist/lib/teams/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../../src/lib/teams/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,IAAI,EAAc,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEzD;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA6D7E;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAW1D;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAGtD;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,QAAmB,EACzB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,aAAa,GAAE,QAAQ,EAAuB,GAC7C,OAAO,CAAC,OAAO,CAAC,CAYlB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAQ1B;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,MAAM,EAAE,MAAM;;QAEpD,MAAM;UACJ,MAAM;UACN,MAAM;iBACC,MAAM,GAAG,IAAI;aACjB,MAAM;eACJ,MAAM,GAAG,IAAI;cACd,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;eAClB,MAAM;eACN,MAAM;cACP,QAAQ;cACR,MAAM;KAyBnB;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,IAAI,GAAG;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,CAAC,CAqBlD;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM;QAGR,MAAM;YACF,MAAM;YACN,MAAM;UACR,QAAQ;eACH,MAAM,GAAG,IAAI;cACd,MAAM;eACL,MAAM;eACN,MAAM;cACP,MAAM,GAAG,IAAI;eACZ,MAAM;eACN,MAAM,GAAG,IAAI;KAuB3B;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC,CAclB;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAalB;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CA2Bf"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../../src/lib/teams/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,IAAI,EAAc,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEzD;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgE7E;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAW1D;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAGtD;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,QAAmB,EACzB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CA8Bf;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,aAAa,GAAE,QAAQ,EAAuB,GAC7C,OAAO,CAAC,OAAO,CAAC,CAYlB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAQ1B;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,MAAM,EAAE,MAAM;;QAEpD,MAAM;UACJ,MAAM;UACN,MAAM;iBACC,MAAM,GAAG,IAAI;aACjB,MAAM;eACJ,MAAM,GAAG,IAAI;cACd,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;eAClB,MAAM;eACN,MAAM;cACP,QAAQ;cACR,MAAM;KAyBnB;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,IAAI,GAAG;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,CAAC,CAqBlD;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM;QAGR,MAAM;YACF,MAAM;YACN,MAAM;UACR,QAAQ;eACH,MAAM,GAAG,IAAI;cACd,MAAM;eACL,MAAM;eACN,MAAM;cACP,MAAM,GAAG,IAAI;eACZ,MAAM;eACN,MAAM,GAAG,IAAI;KAuB3B;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC,CAclB;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAalB;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CA2Bf"}

package/dist/lib/teams/actions.js

@@ -1,4 +1,4 @@
-import { queryWithRLS, queryOneWithRLS, getTransactionClient } from "../db";
+import { queryWithRLS, queryOneWithRLS, getServiceTransactionClient } from "../db.js";
 async function createTeam(userId, name) {
   const user = await queryOneWithRLS(
     'SELECT id, email, name FROM "users" WHERE id = $1',
@@ -10,7 +10,7 @@ async function createTeam(userId, name) {
   const timestamp = Date.now().toString(36);
   const teamSlug = `team-${timestamp}-${userId.substring(0, 4).toLowerCase()}`;
   const teamName = name || (user.name ? `${user.name}'s Team` : "My Team");
-  const tx = await getTransactionClient(userId);
+  const tx = await getServiceTransactionClient();
   try {
     const [team] = await tx.query(
       `INSERT INTO "teams" (name, slug, "ownerId")
@@ -75,7 +75,8 @@ async function addUserToGlobalTeam(userId, role = "member", invitedBy) {
     `INSERT INTO "team_members" ("teamId", "userId", role, "invitedBy", "joinedAt")
      VALUES ($1, $2, $3, $4, NOW())`,
     [team.id, userId, role, invitedBy || null],
-    userId
+    userId,
+    { service: true }
   );
   console.log(`User ${userId} added to global team ${team.id} as ${role}`);
 }

package/dist/lib/teams/active-team-cookie.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Active Team Cookie
+ *
+ * `activeTeamId` tells server code which team a signed-in request acts in: the
+ * dashboard layouts (through the proxy), server actions and resolveTeamContext.
+ * POST /api/v1/teams/switch writes it, host-only and for a year, as
+ * `<session id>:<team id>`. Readers take the team only for the session that
+ * wrote it, so a cookie left on the same browser by an earlier session, another
+ * user's or one since rotated, names no team instead of the wrong one;
+ * TeamProvider writes the current session's team as soon as it mounts. Being
+ * host-only, each subdomain of a multi-tenant app keeps its own team.
+ */
+export declare const ACTIVE_TEAM_COOKIE = "activeTeamId";
+/** How long the browser keeps the cookie, in seconds. */
+export declare const ACTIVE_TEAM_COOKIE_MAX_AGE: number;
+/** The cookie value that makes `teamId` the active team of session `sessionId`. */
+export declare function activeTeamCookieValue(sessionId: string, teamId: string): string;
+/**
+ * The team a cookie value names for `sessionId`, or null when the value belongs
+ * to another session, carries no session (it was written before values were
+ * bound to one) or there is no session to compare it with.
+ */
+export declare function activeTeamIdForSession(value: string | null | undefined, sessionId: string | null | undefined): string | null;
+//# sourceMappingURL=active-team-cookie.d.ts.map

package/dist/lib/teams/active-team-cookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"active-team-cookie.d.ts","sourceRoot":"","sources":["../../../src/lib/teams/active-team-cookie.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,eAAO,MAAM,kBAAkB,iBAAiB,CAAA;AAEhD,yDAAyD;AACzD,eAAO,MAAM,0BAA0B,QAAqB,CAAA;AAE5D,mFAAmF;AACnF,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE/E;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACnC,MAAM,GAAG,IAAI,CAKf"}

package/dist/lib/teams/active-team-cookie.js

@@ -0,0 +1,17 @@
+const ACTIVE_TEAM_COOKIE = "activeTeamId";
+const ACTIVE_TEAM_COOKIE_MAX_AGE = 60 * 60 * 24 * 365;
+function activeTeamCookieValue(sessionId, teamId) {
+  return `${sessionId}:${teamId}`;
+}
+function activeTeamIdForSession(value, sessionId) {
+  if (!value || !sessionId) return null;
+  const separator = value.indexOf(":");
+  if (separator === -1 || value.slice(0, separator) !== sessionId) return null;
+  return value.slice(separator + 1) || null;
+}
+export {
+  ACTIVE_TEAM_COOKIE,
+  ACTIVE_TEAM_COOKIE_MAX_AGE,
+  activeTeamCookieValue,
+  activeTeamIdForSession
+};

package/dist/lib/teams/dashboard-team.d.ts

@@ -0,0 +1,20 @@
+/** The header the proxy forwards the session's active team in. */
+export declare const ACTIVE_TEAM_HEADER = "x-active-team-id";
+/**
+ * The team a user joined first, among teams that still exist: the default that
+ * resolveTeamContext and TeamProvider also fall back to.
+ */
+export declare function getUserDefaultTeamId(userId: string): Promise<string | undefined>;
+/**
+ * The team to check a dashboard request's permissions in, or null when the user
+ * belongs to none. The team the session chose counts only while the user is
+ * still a member and the team still exists: someone else may have removed them
+ * or deleted it since, and then the default team is used, as when there is no
+ * choice at all. One query answers both.
+ *
+ * A failed query rejects instead of answering null: the layouts skip the
+ * permission check for a user in no team, so an error read as "no team" would
+ * let the request through unchecked.
+ */
+export declare function getDashboardTeamId(headers: Pick<Headers, 'get'>, userId: string): Promise<string | null>;
+//# sourceMappingURL=dashboard-team.d.ts.map

package/dist/lib/teams/dashboard-team.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard-team.d.ts","sourceRoot":"","sources":["../../../src/lib/teams/dashboard-team.ts"],"names":[],"mappings":"AAYA,kEAAkE;AAClE,eAAO,MAAM,kBAAkB,qBAAqB,CAAA;AAEpD;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAetF;AAmBD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAExG"}

package/dist/lib/teams/dashboard-team.js

@@ -0,0 +1,38 @@
+import { cache } from "react";
+import { queryOne } from "../db.js";
+const ACTIVE_TEAM_HEADER = "x-active-team-id";
+async function getUserDefaultTeamId(userId) {
+  try {
+    const result = await queryOne(
+      `SELECT tm."teamId" FROM "team_members" tm
+       INNER JOIN "teams" t ON t.id = tm."teamId"
+       WHERE tm."userId" = $1 AND t."deletedAt" IS NULL
+       ORDER BY tm."joinedAt" ASC
+       LIMIT 1`,
+      [userId]
+    );
+    return result == null ? void 0 : result.teamId;
+  } catch (error) {
+    console.error("[teams] Failed to get default team:", error);
+    return void 0;
+  }
+}
+const findDashboardTeamId = cache(async (userId, chosenTeamId) => {
+  const result = await queryOne(
+    `SELECT tm."teamId" FROM "team_members" tm
+     INNER JOIN "teams" t ON t.id = tm."teamId"
+     WHERE tm."userId" = $1 AND t."deletedAt" IS NULL
+     ORDER BY (tm."teamId" = $2) IS TRUE DESC, tm."joinedAt" ASC
+     LIMIT 1`,
+    [userId, chosenTeamId]
+  );
+  return (result == null ? void 0 : result.teamId) ?? null;
+});
+function getDashboardTeamId(headers, userId) {
+  return findDashboardTeamId(userId, headers.get(ACTIVE_TEAM_HEADER));
+}
+export {
+  ACTIVE_TEAM_HEADER,
+  getDashboardTeamId,
+  getUserDefaultTeamId
+};

package/dist/lib/teams/permissions.d.ts

@@ -89,6 +89,24 @@ export declare function isSuperadmin(userRole: UserRole): boolean;
  * @returns True if action is allowed, false otherwise
  */
 export declare function canManageRole(actorRole: string, targetRole: string): boolean;
+/**
+ * Check if a role can invite another role to the team
+ *
+ * Reads hierarchy from the merged permissions registry, so any roles added
+ * by consumers via additional config are supported automatically.
+ *
+ * Semantics: invitation is allowed when the actor's hierarchy level is
+ * greater than or equal to the target's hierarchy level. Peers can invite
+ * peers (e.g. admin → admin); a lower-ranked actor cannot invite a
+ * higher-ranked target.
+ *
+ * Missing hierarchy entries are treated as 0, mirroring canManageRole.
+ *
+ * @param actorRole - The role of the user issuing the invitation
+ * @param targetRole - The role the invitee would receive
+ * @returns True if the invitation is allowed, false otherwise
+ */
+export declare function canInviteToRole(actorRole: string, targetRole: string): boolean;
 /**
  * Get human-readable role description
  *
@@ -115,7 +133,9 @@ export declare function isInvitableRole(role: string): boolean;
 export declare function getInvitableRoles(): string[];
 /**
  * Validate role transition
- * Check if changing from one role to another is allowed
+ * Check if changing from one role to another is allowed.
+ *
+ * The actor must strictly outrank BOTH the current role and the new role.
  *
  * @param fromRole - Current role
  * @param toRole - New role

package/dist/lib/teams/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../src/lib/teams/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAUH;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,YAAY,CAAA;AAE9C;;GAEG;AACH,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,WAAW,GACX,aAAa,GACb,mBAAmB,GACnB,qBAAqB,GACrB,qBAAqB,GACrB,0BAA0B,GAC1B,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,qBAAqB,CAAA;AAEzB;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,cAAc,EAYhD,CAAA;AAuCD;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,CAAgC,CAAA;AAM7F;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,cAAc,EAC1B,aAAa,GAAE,OAAe,GAC7B,OAAO,CAWT;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,aAAa,GAAE,OAAe,GAC7B,cAAc,EAAE,CAQlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,UAAU,EAAE,cAAc,GACzB,OAAO,CAcT;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAExD;AAMD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAKT;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGvD;AAMD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGrD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAI5C;AAMD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA0BvC"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../src/lib/teams/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAUH;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,YAAY,CAAA;AAE9C;;GAEG;AACH,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,WAAW,GACX,aAAa,GACb,mBAAmB,GACnB,qBAAqB,GACrB,qBAAqB,GACrB,0BAA0B,GAC1B,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,qBAAqB,CAAA;AAEzB;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,cAAc,EAYhD,CAAA;AAuCD;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,CAAgC,CAAA;AAM7F;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,cAAc,EAC1B,aAAa,GAAE,OAAe,GAC7B,OAAO,CAWT;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,aAAa,GAAE,OAAe,GAC7B,cAAc,EAAE,CAQlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,UAAU,EAAE,cAAc,GACzB,OAAO,CAcT;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAExD;AAMD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAKT;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAIT;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGvD;AAMD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGrD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAI5C;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAoCvC"}

package/dist/lib/teams/permissions.js

@@ -63,6 +63,10 @@ function canManageRole(actorRole, targetRole) {
   const hierarchy = getHierarchyFromRegistry();
   return (hierarchy[actorRole] ?? 0) > (hierarchy[targetRole] ?? 0);
 }
+function canInviteToRole(actorRole, targetRole) {
+  const hierarchy = getHierarchyFromRegistry();
+  return (hierarchy[actorRole] ?? 0) >= (hierarchy[targetRole] ?? 0);
+}
 function getRoleDescription(role) {
   const descriptions = getDescriptionsFromRegistry();
   return descriptions[role] ?? "No description available";
@@ -93,10 +97,17 @@ function validateRoleTransition(fromRole, toRole, actorRole) {
       reason: "You do not have permission to change this user's role."
     };
   }
+  if (!canManageRole(actorRole, toRole)) {
+    return {
+      allowed: false,
+      reason: "You cannot assign a role equal to or higher than your own."
+    };
+  }
   return { allowed: true };
 }
 export {
   ALL_TEAM_PERMISSIONS,
+  canInviteToRole,
   canManageRole,
   checkTeamPermission,
   getInvitableRoles,

package/dist/lib/teams/schema.d.ts

@@ -6,18 +6,13 @@
  *
  * @module core/lib/teams/schema
  */
-import { z } from 'zod';
-export declare const teamRoleSchema: z.ZodEnum<{
-    member: "member";
-    owner: "owner";
-    admin: "admin";
-    viewer: "viewer";
-}>;
+import * as z from 'zod';
+export declare const teamRoleSchema: z.ZodString;
 export declare const invitationStatusSchema: z.ZodEnum<{
+    expired: "expired";
     pending: "pending";
     accepted: "accepted";
     declined: "declined";
-    expired: "expired";
 }>;
 export declare const teamSchema: z.ZodObject<{
     id: z.ZodString;
@@ -34,12 +29,7 @@ export declare const teamMemberSchema: z.ZodObject<{
     id: z.ZodString;
     teamId: z.ZodString;
     userId: z.ZodString;
-    role: z.ZodEnum<{
-        member: "member";
-        owner: "owner";
-        admin: "admin";
-        viewer: "viewer";
-    }>;
+    role: z.ZodString;
     invitedBy: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     joinedAt: z.ZodString;
     createdAt: z.ZodString;
@@ -49,17 +39,12 @@ export declare const teamInvitationSchema: z.ZodObject<{
     id: z.ZodString;
     teamId: z.ZodString;
     email: z.ZodString;
-    role: z.ZodEnum<{
-        member: "member";
-        owner: "owner";
-        admin: "admin";
-        viewer: "viewer";
-    }>;
+    role: z.ZodString;
     status: z.ZodEnum<{
+        expired: "expired";
         pending: "pending";
         accepted: "accepted";
         declined: "declined";
-        expired: "expired";
     }>;
     token: z.ZodString;
     invitedBy: z.ZodString;
@@ -74,27 +59,52 @@ export declare const createTeamSchema: z.ZodObject<{
     slug: z.ZodString;
     description: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
-export declare const updateTeamSchema: z.ZodObject<{
+/**
+ * Schema for owner-only team updates (name/description)
+ * Only team owners (ownerId === userId) can update these fields
+ * Used when: Owner updates team name or description
+ *
+ * @security This schema is only used after owner verification
+ * @note Fields are optional to allow partial updates (e.g., only description)
+ */
+export declare const ownerUpdateTeamSchema: z.ZodObject<{
     name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+/**
+ * Schema for admin team updates (non-owner-only fields)
+ * Admins can update: slug, avatarUrl, settings
+ * Does NOT include name/description (those are owner-only)
+ * Used when: Admin (non-owner) updates team metadata
+ *
+ * @security This schema explicitly excludes owner-only fields (name, description)
+ */
+export declare const adminUpdateTeamSchema: z.ZodObject<{
     slug: z.ZodOptional<z.ZodString>;
+    avatarUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    settings: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+/**
+ * Schema for general team updates (combined owner + admin permissions)
+ * This is a merge of ownerUpdateTeamSchema and adminUpdateTeamSchema
+ * Used for: API consumers that need a unified schema
+ *
+ * @note For internal use, prefer ownerUpdateTeamSchema or adminUpdateTeamSchema
+ * based on the user's role and the fields being updated
+ */
+export declare const updateTeamSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
     description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    slug: z.ZodOptional<z.ZodString>;
     avatarUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     settings: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$strip>;
 export declare const inviteMemberSchema: z.ZodObject<{
     email: z.ZodString;
-    role: z.ZodEnum<{
-        member: "member";
-        admin: "admin";
-        viewer: "viewer";
-    }>;
+    role: z.ZodString;
 }, z.core.$strip>;
 export declare const updateMemberRoleSchema: z.ZodObject<{
-    role: z.ZodEnum<{
-        member: "member";
-        admin: "admin";
-        viewer: "viewer";
-    }>;
+    role: z.ZodString;
 }, z.core.$strip>;
 export declare const paginationSchema: z.ZodObject<{
     page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
@@ -121,22 +131,17 @@ export declare const teamListQuerySchema: z.ZodObject<{
 export declare const memberListQuerySchema: z.ZodObject<{
     page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-    role: z.ZodOptional<z.ZodEnum<{
-        member: "member";
-        owner: "owner";
-        admin: "admin";
-        viewer: "viewer";
-    }>>;
+    role: z.ZodOptional<z.ZodString>;
     search: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export declare const invitationListQuerySchema: z.ZodObject<{
     page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     status: z.ZodOptional<z.ZodEnum<{
+        expired: "expired";
         pending: "pending";
         accepted: "accepted";
         declined: "declined";
-        expired: "expired";
     }>>;
 }, z.core.$strip>;
 export type TeamSchema = z.infer<typeof teamSchema>;
@@ -144,6 +149,8 @@ export type TeamMemberSchema = z.infer<typeof teamMemberSchema>;
 export type TeamInvitationSchema = z.infer<typeof teamInvitationSchema>;
 export type CreateTeamSchema = z.infer<typeof createTeamSchema>;
 export type UpdateTeamSchema = z.infer<typeof updateTeamSchema>;
+export type OwnerUpdateTeamSchema = z.infer<typeof ownerUpdateTeamSchema>;
+export type AdminUpdateTeamSchema = z.infer<typeof adminUpdateTeamSchema>;
 export type InviteMemberSchema = z.infer<typeof inviteMemberSchema>;
 export type UpdateMemberRoleSchema = z.infer<typeof updateMemberRoleSchema>;
 export type TeamListQuerySchema = z.infer<typeof teamListQuerySchema>;

package/dist/lib/teams/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/lib/teams/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,eAAO,MAAM,cAAc;;;;;EAAiD,CAAA;AAC5E,eAAO,MAAM,sBAAsB;;;;;EAAyD,CAAA;AAG5F,eAAO,MAAM,UAAU;;;;;;;;;;iBAUrB,CAAA;AAGF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;iBAS3B,CAAA;AAGF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;iBAa/B,CAAA;AAGF,eAAO,MAAM,gBAAgB;;;;iBAI3B,CAAA;AAEF,eAAO,MAAM,gBAAgB;;;;;;iBAM3B,CAAA;AAEF,eAAO,MAAM,kBAAkB;;;;;;;iBAK7B,CAAA;AAEF,eAAO,MAAM,sBAAsB;;;;;;iBAIjC,CAAA;AAGF,eAAO,MAAM,gBAAgB;;;iBAG3B,CAAA;AAGF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;iBAK9B,CAAA;AAEF,eAAO,MAAM,qBAAqB;;;;;;;;;;iBAGhC,CAAA;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;iBAEpC,CAAA;AAGF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAA;AACnD,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAC/D,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AACvE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAC/D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAC/D,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AACnE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAC3E,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AACrE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AACzE,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAA"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/lib/teams/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,CAAC,MAAM,KAAK,CAAA;AAKxB,eAAO,MAAM,cAAc,aAI1B,CAAA;AACD,eAAO,MAAM,sBAAsB;;;;;EAAyD,CAAA;AAG5F,eAAO,MAAM,UAAU;;;;;;;;;;iBAerB,CAAA;AAGF,eAAO,MAAM,gBAAgB;;;;;;;;;iBAS3B,CAAA;AAGF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;iBAa/B,CAAA;AAGF,eAAO,MAAM,gBAAgB;;;;iBAI3B,CAAA;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB;;;iBAOhC,CAAA;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB;;;;iBAIhC,CAAA;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB;;;;;;iBAA4D,CAAA;AAEzF,eAAO,MAAM,kBAAkB;;;iBAO7B,CAAA;AAEF,eAAO,MAAM,sBAAsB;;iBAMjC,CAAA;AAGF,eAAO,MAAM,gBAAgB;;;iBAG3B,CAAA;AAGF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;iBAK9B,CAAA;AAEF,eAAO,MAAM,qBAAqB;;;;;iBAGhC,CAAA;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;iBAEpC,CAAA;AAGF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAA;AACnD,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAC/D,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AACvE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAC/D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAC/D,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AACzE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AACzE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AACnE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAC3E,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AACrE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AACzE,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAA"}

package/dist/lib/teams/schema.js

@@ -1,10 +1,21 @@
-import { z } from "zod";
-const teamRoleSchema = z.enum(["owner", "admin", "member", "viewer"]);
+import * as z from "zod";
+import { AVAILABLE_ROLES } from "@nextsparkjs/registries/permissions-registry";
+import { getInvitableRoles } from "./permissions.js";
+const teamRoleSchema = z.string().refine(
+  (role) => AVAILABLE_ROLES.includes(role),
+  // @ts-expect-error — pre-existing type error, tracked in https://github.com/NextSpark-js/nextspark/issues/131
+  (role) => ({ message: `Invalid team role: ${role}. Must be one of: ${[...AVAILABLE_ROLES].join(", ")}` })
+);
 const invitationStatusSchema = z.enum(["pending", "accepted", "declined", "expired"]);
 const teamSchema = z.object({
   id: z.string().uuid(),
   name: z.string().min(2, "Name must be at least 2 characters").max(100, "Name must be at most 100 characters"),
   slug: z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "Slug must contain only lowercase letters, numbers, and hyphens"),
+  /**
+   * Description field has no max length limit (TEXT type in database)
+   * Database migration 007_teams_table.sql defines this as TEXT without constraints
+   * If max length is desired, it should be a business decision
+   */
   description: z.string().nullable().optional(),
   ownerId: z.string(),
   avatarUrl: z.string().url().nullable().optional(),
@@ -41,24 +52,31 @@ const createTeamSchema = z.object({
   slug: z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "Slug must contain only lowercase letters, numbers, and hyphens"),
   description: z.string().optional()
 });
-const updateTeamSchema = z.object({
-  name: z.string().min(2).max(100).optional(),
+const ownerUpdateTeamSchema = z.object({
+  name: z.string().min(1, "Team name is required").min(2, "Name must be at least 2 characters").max(100, "Name must be at most 100 characters").optional(),
+  description: z.string().nullable().optional()
+});
+const adminUpdateTeamSchema = z.object({
   slug: z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/).optional(),
-  description: z.string().nullable().optional(),
   avatarUrl: z.string().url().nullable().optional(),
   settings: z.record(z.string(), z.unknown()).optional()
 });
+const updateTeamSchema = ownerUpdateTeamSchema.extend(adminUpdateTeamSchema.shape);
 const inviteMemberSchema = z.object({
   email: z.string().email("Invalid email address"),
-  role: z.enum(["admin", "member", "viewer"], {
-    message: "Role must be admin, member, or viewer"
-  })
+  role: z.string().refine(
+    (role) => getInvitableRoles().includes(role),
+    // @ts-expect-error — pre-existing type error, tracked in https://github.com/NextSpark-js/nextspark/issues/131
+    (role) => ({ message: `Role must be one of: ${getInvitableRoles().join(", ")}` })
+  )
   // Cannot invite as owner
 });
 const updateMemberRoleSchema = z.object({
-  role: z.enum(["admin", "member", "viewer"], {
-    message: "Role must be admin, member, or viewer"
-  })
+  role: z.string().refine(
+    (role) => getInvitableRoles().includes(role),
+    // @ts-expect-error — pre-existing type error, tracked in https://github.com/NextSpark-js/nextspark/issues/131
+    (role) => ({ message: `Role must be one of: ${getInvitableRoles().join(", ")}` })
+  )
   // Cannot promote to owner
 });
 const paginationSchema = z.object({
@@ -80,11 +98,13 @@ const invitationListQuerySchema = paginationSchema.extend({
   status: invitationStatusSchema.optional()
 });
 export {
+  adminUpdateTeamSchema,
   createTeamSchema,
   invitationListQuerySchema,
   invitationStatusSchema,
   inviteMemberSchema,
   memberListQuerySchema,
+  ownerUpdateTeamSchema,
   paginationSchema,
   teamInvitationSchema,
   teamListQuerySchema,