@nextsparkjs/core 0.1.0-beta.97 → 0.1.0-beta.99

package/dist/lib/api/index.d.ts

@@ -11,6 +11,8 @@ export * from './helpers';
 export * from './rate-limit';
 export * from './cache';
 export * from './distributed-cache';
+export * from './api-error';
 export type { ApiKeyAuth, ApiKeyValidationResult } from './auth';
 export type { ApiScope } from './keys';
+export { ApiError } from './api-error';
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/api/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,cAAc,QAAQ,CAAC;AACvB,cAAc,kBAAkB,CAAC;AACjC,cAAc,QAAQ,CAAC;AACvB,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,SAAS,CAAC;AACxB,cAAc,qBAAqB,CAAC;AAGpC,YAAY,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,QAAQ,CAAC;AACjE,YAAY,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/api/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,cAAc,QAAQ,CAAC;AACvB,cAAc,kBAAkB,CAAC;AACjC,cAAc,QAAQ,CAAC;AACvB,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,SAAS,CAAC;AACxB,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAG5B,YAAY,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,QAAQ,CAAC;AACjE,YAAY,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC"}

package/dist/lib/api/index.js

@@ -5,3 +5,8 @@ export * from "./helpers.js";
 export * from "./rate-limit.js";
 export * from "./cache.js";
 export * from "./distributed-cache.js";
+export * from "./api-error.js";
+import { ApiError } from "./api-error.js";
+export {
+  ApiError
+};

package/dist/lib/api/permission-middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-middleware.d.ts","sourceRoot":"","sources":["../../../src/lib/api/permission-middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAa1C;;GAEG;AACH,eAAO,MAAM,WAAW,SAAS,CAAA;AAEjC;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAElF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,MAAM,CAOjF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,YAAY,CAAA;CAAE,CAAC,CAkCtE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,OAAO,GACpB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAK9B"}
+{"version":3,"file":"permission-middleware.d.ts","sourceRoot":"","sources":["../../../src/lib/api/permission-middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAc1C;;GAEG;AACH,eAAO,MAAM,WAAW,SAAS,CAAA;AAEjC;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAElF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,MAAM,CAOjF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,YAAY,CAAA;CAAE,CAAC,CAkCtE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,OAAO,GACpB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAK9B"}

package/dist/lib/api/permission-middleware.js

@@ -1,5 +1,6 @@
 import { checkPermission } from "../permissions/check.js";
 import { NextResponse } from "next/server";
+import { API_ERROR_CODES } from "./api-error.js";
 const HTTP_TO_ACTION = {
   "GET": "read",
   // Single entity retrieval
@@ -31,7 +32,7 @@ async function checkEntityPermission(userId, teamId, entitySlug, action) {
           success: false,
           error: {
             message: `Permission denied: You do not have permission to ${action} ${entitySlug}`,
-            code: "PERMISSION_DENIED",
+            code: API_ERROR_CODES.PERMISSION_DENIED,
             details: {
               requiredPermission: permission,
               entity: entitySlug,

package/dist/lib/services/media.service.d.ts

@@ -2,50 +2,40 @@
  * Media Service
  *
  * Provides CRUD operations for media library entries.
- * Supports team isolation via RLS, search, filtering by type.
+ * ALL methods require teamId for strict team isolation.
  *
  * @module MediaService
  */
 import type { Media, CreateMediaInput, UpdateMediaInput, MediaListOptions, MediaListResult, MediaTag } from '../media/types';
 export declare class MediaService {
     /**
-     * Get media item by ID
+     * Get media item by ID (team-scoped)
      *
      * @param id - Media ID
      * @param userId - User ID for RLS context
+     * @param teamId - Team ID for isolation
      * @returns Media or null if not found
-     *
-     * @example
-     * const media = await MediaService.getById('media-123', 'user-456')
      */
-    static getById(id: string, userId: string): Promise<Media | null>;
+    static getById(id: string, userId: string, teamId: string): Promise<Media | null>;
     /**
-     * List media with pagination, filtering, and search
+     * List media with pagination, filtering, and search (team-scoped)
      *
      * @param userId - User ID for RLS context
+     * @param teamId - Team ID for isolation
      * @param options - List options (pagination, filtering, search, sort)
      * @returns Paginated media list result
-     *
-     * @example
-     * const result = await MediaService.list('user-123', {
-     *   limit: 20,
-     *   offset: 0,
-     *   type: 'image',
-     *   search: 'logo',
-     *   orderBy: 'createdAt',
-     *   orderDir: 'desc'
-     * })
      */
-    static list(userId: string, options?: MediaListOptions): Promise<MediaListResult>;
+    static list(userId: string, teamId: string, options?: MediaListOptions): Promise<MediaListResult>;
     /**
-     * Find existing media by filename and fileSize (duplicate detection)
+     * Find existing media by filename and fileSize (duplicate detection, team-scoped)
      *
      * @param userId - User ID for RLS context
+     * @param teamId - Team ID for isolation
      * @param filename - Original filename
      * @param fileSize - File size in bytes
      * @returns Matching media items (same name+size = likely duplicate)
      */
-    static findDuplicates(userId: string, filename: string, fileSize: number): Promise<Media[]>;
+    static findDuplicates(userId: string, teamId: string, filename: string, fileSize: number): Promise<Media[]>;
     /**
      * Create a new media record
      *
@@ -53,59 +43,44 @@ export declare class MediaService {
      * @param teamId - Team ID for isolation
      * @param data - Media data
      * @returns Created media record
-     *
-     * @example
-     * const media = await MediaService.create('user-123', 'team-456', {
-     *   url: 'https://example.com/image.jpg',
-     *   filename: 'image.jpg',
-     *   fileSize: 150000,
-     *   mimeType: 'image/jpeg',
-     *   width: 1920,
-     *   height: 1080
-     * })
      */
     static create(userId: string, teamId: string, data: CreateMediaInput): Promise<Media>;
     /**
-     * Update media metadata (title, alt, caption - file properties are immutable)
+     * Update media metadata (team-scoped)
      *
      * @param id - Media ID
      * @param userId - User ID for RLS context
-     * @param data - Update data (alt, caption)
-     * @returns Updated media record
-     *
-     * @example
-     * const media = await MediaService.update('media-123', 'user-456', {
-     *   alt: 'Company logo',
-     *   caption: 'Our brand logo in high resolution'
-     * })
+     * @param data - Update data (title, alt, caption)
+     * @param teamId - Team ID for isolation
+     * @returns Updated media record or null if not found
      */
-    static update(id: string, userId: string, data: UpdateMediaInput): Promise<Media>;
+    static update(id: string, userId: string, data: UpdateMediaInput, teamId: string): Promise<Media | null>;
     /**
-     * Soft delete a media record (sets status to 'deleted')
+     * Soft delete a media record (team-scoped)
      *
      * @param id - Media ID
      * @param userId - User ID for RLS context
+     * @param teamId - Team ID for isolation
      * @returns True if deleted successfully
-     *
-     * @example
-     * const deleted = await MediaService.softDelete('media-123', 'user-456')
      */
-    static softDelete(id: string, userId: string): Promise<boolean>;
+    static softDelete(id: string, userId: string, teamId: string): Promise<boolean>;
     /**
-     * Get all media tags
+     * Get all media tags for a team
      *
      * @param userId - User ID for RLS context
-     * @returns Array of media tags
+     * @param teamId - Team ID for isolation
+     * @returns Array of media tags scoped to the team
      */
-    static getTags(userId: string): Promise<MediaTag[]>;
+    static getTags(userId: string, teamId: string): Promise<MediaTag[]>;
     /**
      * Get tags for a specific media item
      *
      * @param mediaId - Media item ID
      * @param userId - User ID for RLS context
+     * @param teamId - Team ID for isolation (media ownership verified before calling)
      * @returns Array of tags assigned to the media
      */
-    static getMediaTags(mediaId: string, userId: string): Promise<MediaTag[]>;
+    static getMediaTags(mediaId: string, userId: string, teamId: string): Promise<MediaTag[]>;
     /**
      * Add a tag to a media item
      *
@@ -133,24 +108,23 @@ export declare class MediaService {
      */
     static setTags(mediaId: string, tagIds: string[], userId: string): Promise<void>;
     /**
-     * Create a new media tag (taxonomy of type 'media_tag')
+     * Create a new media tag (team-scoped)
      *
      * @param name - Tag display name
      * @param userId - User ID for RLS context
+     * @param teamId - Team ID for isolation
      * @returns The created tag
      */
-    static createTag(name: string, userId: string): Promise<MediaTag>;
+    static createTag(name: string, userId: string, teamId: string): Promise<MediaTag>;
     /**
-     * Count media items
+     * Count media items (team-scoped)
      *
      * @param userId - User ID for RLS context
+     * @param teamId - Team ID for isolation
      * @param options - Count options (type filter, status filter)
      * @returns Total count
-     *
-     * @example
-     * const imageCount = await MediaService.count('user-123', { type: 'image' })
      */
-    static count(userId: string, options?: {
+    static count(userId: string, teamId: string, options?: {
         type?: 'image' | 'video' | 'all';
         status?: string;
     }): Promise<number>;

package/dist/lib/services/media.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"media.service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/media.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EACV,KAAK,EACL,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,QAAQ,EACT,MAAM,gBAAgB,CAAA;AAEvB,qBAAa,YAAY;IAKvB;;;;;;;;;OASG;WACU,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAWvE;;;;;;;;;;;;;;;;OAgBG;WACU,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC;IA8F3F;;;;;;;OAOG;WACU,cAAc,CACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,KAAK,EAAE,CAAC;IAiBnB;;;;;;;;;;;;;;;;;OAiBG;WACU,MAAM,CACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,KAAK,CAAC;IAsBjB;;;;;;;;;;;;;OAaG;WACU,MAAM,CACjB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,KAAK,CAAC;IAuCjB;;;;;;;;;OASG;WACU,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkBrE;;;;;OAKG;WACU,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAazD;;;;;;OAMG;WACU,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAgB/E;;;;;;;OAOG;WACU,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgBrF;;;;;;;OAOG;WACU,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAexF;;;;;;OAMG;WACU,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBtF;;;;;;OAMG;WACU,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAkBvE;;;;;;;;;OASG;WACU,KAAK,CAChB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;QAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,KAAK,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAClE,OAAO,CAAC,MAAM,CAAC;CAkBnB"}
+{"version":3,"file":"media.service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/media.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EACV,KAAK,EACL,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,QAAQ,EACT,MAAM,gBAAgB,CAAA;AAEvB,qBAAa,YAAY;IAKvB;;;;;;;OAOG;WACU,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAYvF;;;;;;;OAOG;WACU,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC;IA+F3G;;;;;;;;OAQG;WACU,cAAc,CACzB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,KAAK,EAAE,CAAC;IAkBnB;;;;;;;OAOG;WACU,MAAM,CACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,KAAK,CAAC;IAsBjB;;;;;;;;OAQG;WACU,MAAM,CACjB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAyCxB;;;;;;;OAOG;WACU,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkBrF;;;;;;OAMG;WACU,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAczE;;;;;;;OAOG;WACU,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAkB/F;;;;;;;OAOG;WACU,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgBrF;;;;;;;OAOG;WACU,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAexF;;;;;;OAMG;WACU,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBtF;;;;;;;OAOG;WACU,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAoBvF;;;;;;;OAOG;WACU,KAAK,CAChB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;QAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,KAAK,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAClE,OAAO,CAAC,MAAM,CAAC;CAmBnB"}

package/dist/lib/services/media.service.js

@@ -4,44 +4,35 @@ class MediaService {
   // QUERIES
   // ============================================
   /**
-   * Get media item by ID
+   * Get media item by ID (team-scoped)
    *
    * @param id - Media ID
    * @param userId - User ID for RLS context
+   * @param teamId - Team ID for isolation
    * @returns Media or null if not found
-   *
-   * @example
-   * const media = await MediaService.getById('media-123', 'user-456')
    */
-  static async getById(id, userId) {
+  static async getById(id, userId, teamId) {
     if (!(id == null ? void 0 : id.trim())) throw new Error("Media ID is required");
     if (!(userId == null ? void 0 : userId.trim())) throw new Error("User ID is required");
+    if (!(teamId == null ? void 0 : teamId.trim())) throw new Error("Team ID is required");
     return queryOneWithRLS(
-      `SELECT * FROM "media" WHERE id = $1 AND status = 'active'`,
-      [id],
+      `SELECT * FROM "media" WHERE id = $1 AND "teamId" = $2 AND status = 'active'`,
+      [id, teamId],
       userId
     );
   }
   /**
-   * List media with pagination, filtering, and search
+   * List media with pagination, filtering, and search (team-scoped)
    *
    * @param userId - User ID for RLS context
+   * @param teamId - Team ID for isolation
    * @param options - List options (pagination, filtering, search, sort)
    * @returns Paginated media list result
-   *
-   * @example
-   * const result = await MediaService.list('user-123', {
-   *   limit: 20,
-   *   offset: 0,
-   *   type: 'image',
-   *   search: 'logo',
-   *   orderBy: 'createdAt',
-   *   orderDir: 'desc'
-   * })
    */
-  static async list(userId, options = {}) {
+  static async list(userId, teamId, options = {}) {
     var _a;
     if (!(userId == null ? void 0 : userId.trim())) throw new Error("User ID is required");
+    if (!(teamId == null ? void 0 : teamId.trim())) throw new Error("Team ID is required");
     const {
       limit = 20,
       offset = 0,
@@ -53,9 +44,9 @@ class MediaService {
       tagIds,
       tagSlugs
     } = options;
-    const conditions = ["m.status = $1"];
-    const params = [status];
-    let paramIndex = 2;
+    const conditions = ["m.status = $1", 'm."teamId" = $2'];
+    const params = [status, teamId];
+    let paramIndex = 3;
     if (type === "image") {
       conditions.push(`m."mimeType" LIKE 'image/%'`);
     } else if (type === "video") {
@@ -116,21 +107,23 @@ class MediaService {
     return { data, total, limit, offset };
   }
   /**
-   * Find existing media by filename and fileSize (duplicate detection)
+   * Find existing media by filename and fileSize (duplicate detection, team-scoped)
    *
    * @param userId - User ID for RLS context
+   * @param teamId - Team ID for isolation
    * @param filename - Original filename
    * @param fileSize - File size in bytes
    * @returns Matching media items (same name+size = likely duplicate)
    */
-  static async findDuplicates(userId, filename, fileSize) {
+  static async findDuplicates(userId, teamId, filename, fileSize) {
     if (!(userId == null ? void 0 : userId.trim())) throw new Error("User ID is required");
+    if (!(teamId == null ? void 0 : teamId.trim())) throw new Error("Team ID is required");
     return queryWithRLS(
       `SELECT * FROM "media"
-       WHERE filename = $1 AND "fileSize" = $2 AND status = 'active'
+       WHERE filename = $1 AND "fileSize" = $2 AND "teamId" = $3 AND status = 'active'
        ORDER BY "createdAt" DESC
        LIMIT 5`,
-      [filename, fileSize],
+      [filename, fileSize, teamId],
       userId
     );
   }
@@ -144,16 +137,6 @@ class MediaService {
    * @param teamId - Team ID for isolation
    * @param data - Media data
    * @returns Created media record
-   *
-   * @example
-   * const media = await MediaService.create('user-123', 'team-456', {
-   *   url: 'https://example.com/image.jpg',
-   *   filename: 'image.jpg',
-   *   fileSize: 150000,
-   *   mimeType: 'image/jpeg',
-   *   width: 1920,
-   *   height: 1080
-   * })
    */
   static async create(userId, teamId, data) {
     if (!(userId == null ? void 0 : userId.trim())) throw new Error("User ID is required");
@@ -183,22 +166,18 @@ class MediaService {
     return result.rows[0];
   }
   /**
-   * Update media metadata (title, alt, caption - file properties are immutable)
+   * Update media metadata (team-scoped)
    *
    * @param id - Media ID
    * @param userId - User ID for RLS context
-   * @param data - Update data (alt, caption)
-   * @returns Updated media record
-   *
-   * @example
-   * const media = await MediaService.update('media-123', 'user-456', {
-   *   alt: 'Company logo',
-   *   caption: 'Our brand logo in high resolution'
-   * })
+   * @param data - Update data (title, alt, caption)
+   * @param teamId - Team ID for isolation
+   * @returns Updated media record or null if not found
    */
-  static async update(id, userId, data) {
+  static async update(id, userId, data, teamId) {
     if (!(id == null ? void 0 : id.trim())) throw new Error("Media ID is required");
     if (!(userId == null ? void 0 : userId.trim())) throw new Error("User ID is required");
+    if (!(teamId == null ? void 0 : teamId.trim())) throw new Error("Team ID is required");
     const setClauses = [];
     const params = [];
     let paramIndex = 1;
@@ -217,55 +196,57 @@ class MediaService {
     if (setClauses.length === 0) throw new Error("No fields to update");
     setClauses.push(`"updatedAt" = NOW()`);
     params.push(id);
+    paramIndex++;
+    params.push(teamId);
     const result = await mutateWithRLS(
       `UPDATE "media"
        SET ${setClauses.join(", ")}
-       WHERE id = $${paramIndex} AND status = 'active'
+       WHERE id = $${paramIndex - 1} AND status = 'active' AND "teamId" = $${paramIndex}
        RETURNING *`,
       params,
       userId
     );
-    if (!result.rows[0]) throw new Error("Media not found or not authorized");
-    return result.rows[0];
+    return result.rows[0] || null;
   }
   /**
-   * Soft delete a media record (sets status to 'deleted')
+   * Soft delete a media record (team-scoped)
    *
    * @param id - Media ID
    * @param userId - User ID for RLS context
+   * @param teamId - Team ID for isolation
    * @returns True if deleted successfully
-   *
-   * @example
-   * const deleted = await MediaService.softDelete('media-123', 'user-456')
    */
-  static async softDelete(id, userId) {
+  static async softDelete(id, userId, teamId) {
     if (!(id == null ? void 0 : id.trim())) throw new Error("Media ID is required");
     if (!(userId == null ? void 0 : userId.trim())) throw new Error("User ID is required");
+    if (!(teamId == null ? void 0 : teamId.trim())) throw new Error("Team ID is required");
     const result = await mutateWithRLS(
       `UPDATE "media" SET status = 'deleted', "updatedAt" = NOW()
-       WHERE id = $1 AND status = 'active'`,
-      [id],
+       WHERE id = $1 AND "teamId" = $2 AND status = 'active'`,
+      [id, teamId],
       userId
     );
     return result.rowCount > 0;
   }
   // ============================================
-  // TAG OPERATIONS
+  // TAG OPERATIONS (team-scoped)
   // ============================================
   /**
-   * Get all media tags
+   * Get all media tags for a team
    *
    * @param userId - User ID for RLS context
-   * @returns Array of media tags
+   * @param teamId - Team ID for isolation
+   * @returns Array of media tags scoped to the team
    */
-  static async getTags(userId) {
+  static async getTags(userId, teamId) {
     if (!(userId == null ? void 0 : userId.trim())) throw new Error("User ID is required");
+    if (!(teamId == null ? void 0 : teamId.trim())) throw new Error("Team ID is required");
     return queryWithRLS(
       `SELECT id, type, slug, name, description, icon, color, "order", "isActive", "createdAt", "updatedAt"
        FROM "taxonomies"
-       WHERE type = 'media_tag' AND "isActive" = true AND "deletedAt" IS NULL
+       WHERE type = 'media_tag' AND "teamId" = $1 AND "isActive" = true AND "deletedAt" IS NULL
        ORDER BY "order" ASC, name ASC`,
-      [],
+      [teamId],
       userId
     );
   }
@@ -274,19 +255,22 @@ class MediaService {
    *
    * @param mediaId - Media item ID
    * @param userId - User ID for RLS context
+   * @param teamId - Team ID for isolation (media ownership verified before calling)
    * @returns Array of tags assigned to the media
    */
-  static async getMediaTags(mediaId, userId) {
+  static async getMediaTags(mediaId, userId, teamId) {
     if (!(mediaId == null ? void 0 : mediaId.trim())) throw new Error("Media ID is required");
     if (!(userId == null ? void 0 : userId.trim())) throw new Error("User ID is required");
+    if (!(teamId == null ? void 0 : teamId.trim())) throw new Error("Team ID is required");
     return queryWithRLS(
       `SELECT t.id, t.type, t.slug, t.name, t.description, t.icon, t.color, t."order", t."isActive", t."createdAt", t."updatedAt"
        FROM "taxonomies" t
        JOIN "entity_taxonomy_relations" etr ON etr."taxonomyId" = t.id
        WHERE etr."entityType" = 'media' AND etr."entityId" = $1
+         AND t."teamId" = $2
          AND t."isActive" = true AND t."deletedAt" IS NULL
        ORDER BY t."order" ASC, t.name ASC`,
-      [mediaId],
+      [mediaId, teamId],
       userId
     );
   }
@@ -359,42 +343,44 @@ class MediaService {
     }
   }
   /**
-   * Create a new media tag (taxonomy of type 'media_tag')
+   * Create a new media tag (team-scoped)
    *
    * @param name - Tag display name
    * @param userId - User ID for RLS context
+   * @param teamId - Team ID for isolation
    * @returns The created tag
    */
-  static async createTag(name, userId) {
+  static async createTag(name, userId, teamId) {
     if (!(name == null ? void 0 : name.trim())) throw new Error("Tag name is required");
     if (!(userId == null ? void 0 : userId.trim())) throw new Error("User ID is required");
+    if (!(teamId == null ? void 0 : teamId.trim())) throw new Error("Team ID is required");
     const slug = name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
     const result = await mutateWithRLS(
-      `INSERT INTO "taxonomies" (type, slug, name, "isActive")
-       VALUES ('media_tag', $1, $2, true)
-       ON CONFLICT (type, slug) DO UPDATE SET name = EXCLUDED.name
+      `INSERT INTO "taxonomies" (type, slug, name, "teamId", "isActive")
+       VALUES ('media_tag', $1, $2, $3, true)
+       ON CONFLICT (type, slug, "teamId") WHERE "teamId" IS NOT NULL
+       DO UPDATE SET name = EXCLUDED.name
        RETURNING id, slug, name, color, icon, "order", "isActive"`,
-      [slug, name.trim()],
+      [slug, name.trim(), teamId],
       userId
     );
     return result.rows[0];
   }
   /**
-   * Count media items
+   * Count media items (team-scoped)
    *
    * @param userId - User ID for RLS context
+   * @param teamId - Team ID for isolation
    * @param options - Count options (type filter, status filter)
    * @returns Total count
-   *
-   * @example
-   * const imageCount = await MediaService.count('user-123', { type: 'image' })
    */
-  static async count(userId, options = {}) {
+  static async count(userId, teamId, options = {}) {
     var _a;
     if (!(userId == null ? void 0 : userId.trim())) throw new Error("User ID is required");
+    if (!(teamId == null ? void 0 : teamId.trim())) throw new Error("Team ID is required");
     const { type = "all", status = "active" } = options;
-    const conditions = ["status = $1"];
-    const params = [status];
+    const conditions = ["status = $1", '"teamId" = $2'];
+    const params = [status, teamId];
     if (type === "image") conditions.push(`"mimeType" LIKE 'image/%'`);
     else if (type === "video") conditions.push(`"mimeType" LIKE 'video/%'`);
     const result = await queryWithRLS(

package/dist/lib/teams/schema.d.ts

@@ -7,12 +7,7 @@
  * @module core/lib/teams/schema
  */
 import { z } from 'zod';
-export declare const teamRoleSchema: z.ZodEnum<{
-    member: "member";
-    owner: "owner";
-    admin: "admin";
-    viewer: "viewer";
-}>;
+export declare const teamRoleSchema: z.ZodString;
 export declare const invitationStatusSchema: z.ZodEnum<{
     expired: "expired";
     pending: "pending";
@@ -34,12 +29,7 @@ export declare const teamMemberSchema: z.ZodObject<{
     id: z.ZodString;
     teamId: z.ZodString;
     userId: z.ZodString;
-    role: z.ZodEnum<{
-        member: "member";
-        owner: "owner";
-        admin: "admin";
-        viewer: "viewer";
-    }>;
+    role: z.ZodString;
     invitedBy: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     joinedAt: z.ZodString;
     createdAt: z.ZodString;
@@ -49,12 +39,7 @@ export declare const teamInvitationSchema: z.ZodObject<{
     id: z.ZodString;
     teamId: z.ZodString;
     email: z.ZodString;
-    role: z.ZodEnum<{
-        member: "member";
-        owner: "owner";
-        admin: "admin";
-        viewer: "viewer";
-    }>;
+    role: z.ZodString;
     status: z.ZodEnum<{
         expired: "expired";
         pending: "pending";
@@ -116,18 +101,10 @@ export declare const updateTeamSchema: z.ZodObject<{
 }, z.core.$strip>;
 export declare const inviteMemberSchema: z.ZodObject<{
     email: z.ZodString;
-    role: z.ZodEnum<{
-        member: "member";
-        admin: "admin";
-        viewer: "viewer";
-    }>;
+    role: z.ZodString;
 }, z.core.$strip>;
 export declare const updateMemberRoleSchema: z.ZodObject<{
-    role: z.ZodEnum<{
-        member: "member";
-        admin: "admin";
-        viewer: "viewer";
-    }>;
+    role: z.ZodString;
 }, z.core.$strip>;
 export declare const paginationSchema: z.ZodObject<{
     page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
@@ -154,12 +131,7 @@ export declare const teamListQuerySchema: z.ZodObject<{
 export declare const memberListQuerySchema: z.ZodObject<{
     page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-    role: z.ZodOptional<z.ZodEnum<{
-        member: "member";
-        owner: "owner";
-        admin: "admin";
-        viewer: "viewer";
-    }>>;
+    role: z.ZodOptional<z.ZodString>;
     search: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export declare const invitationListQuerySchema: z.ZodObject<{

package/dist/lib/teams/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/lib/teams/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,eAAO,MAAM,cAAc;;;;;EAAiD,CAAA;AAC5E,eAAO,MAAM,sBAAsB;;;;;EAAyD,CAAA;AAG5F,eAAO,MAAM,UAAU;;;;;;;;;;iBAerB,CAAA;AAGF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;iBAS3B,CAAA;AAGF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;iBAa/B,CAAA;AAGF,eAAO,MAAM,gBAAgB;;;;iBAI3B,CAAA;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB;;;iBAOhC,CAAA;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB;;;;iBAIhC,CAAA;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB;;;;;;iBAAqD,CAAA;AAElF,eAAO,MAAM,kBAAkB;;;;;;;iBAK7B,CAAA;AAEF,eAAO,MAAM,sBAAsB;;;;;;iBAIjC,CAAA;AAGF,eAAO,MAAM,gBAAgB;;;iBAG3B,CAAA;AAGF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;iBAK9B,CAAA;AAEF,eAAO,MAAM,qBAAqB;;;;;;;;;;iBAGhC,CAAA;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;iBAEpC,CAAA;AAGF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAA;AACnD,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAC/D,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AACvE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAC/D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAC/D,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AACzE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AACzE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AACnE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAC3E,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AACrE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AACzE,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAA"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/lib/teams/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAKvB,eAAO,MAAM,cAAc,aAG1B,CAAA;AACD,eAAO,MAAM,sBAAsB;;;;;EAAyD,CAAA;AAG5F,eAAO,MAAM,UAAU;;;;;;;;;;iBAerB,CAAA;AAGF,eAAO,MAAM,gBAAgB;;;;;;;;;iBAS3B,CAAA;AAGF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;iBAa/B,CAAA;AAGF,eAAO,MAAM,gBAAgB;;;;iBAI3B,CAAA;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB;;;iBAOhC,CAAA;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB;;;;iBAIhC,CAAA;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB;;;;;;iBAAqD,CAAA;AAElF,eAAO,MAAM,kBAAkB;;;iBAM7B,CAAA;AAEF,eAAO,MAAM,sBAAsB;;iBAKjC,CAAA;AAGF,eAAO,MAAM,gBAAgB;;;iBAG3B,CAAA;AAGF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;iBAK9B,CAAA;AAEF,eAAO,MAAM,qBAAqB;;;;;iBAGhC,CAAA;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;iBAEpC,CAAA;AAGF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAA;AACnD,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAC/D,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AACvE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAC/D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAC/D,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AACzE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AACzE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AACnE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAC3E,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AACrE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AACzE,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAA"}

package/dist/lib/teams/schema.js

@@ -1,5 +1,10 @@
 import { z } from "zod";
-const teamRoleSchema = z.enum(["owner", "admin", "member", "viewer"]);
+import { AVAILABLE_ROLES } from "@nextsparkjs/registries/permissions-registry";
+import { getInvitableRoles } from "./permissions.js";
+const teamRoleSchema = z.string().refine(
+  (role) => AVAILABLE_ROLES.includes(role),
+  (role) => ({ message: `Invalid team role: ${role}. Must be one of: ${[...AVAILABLE_ROLES].join(", ")}` })
+);
 const invitationStatusSchema = z.enum(["pending", "accepted", "declined", "expired"]);
 const teamSchema = z.object({
   id: z.string().uuid(),
@@ -58,15 +63,17 @@ const adminUpdateTeamSchema = z.object({
 const updateTeamSchema = ownerUpdateTeamSchema.merge(adminUpdateTeamSchema);
 const inviteMemberSchema = z.object({
   email: z.string().email("Invalid email address"),
-  role: z.enum(["admin", "member", "viewer"], {
-    message: "Role must be admin, member, or viewer"
-  })
+  role: z.string().refine(
+    (role) => getInvitableRoles().includes(role),
+    (role) => ({ message: `Role must be one of: ${getInvitableRoles().join(", ")}` })
+  )
   // Cannot invite as owner
 });
 const updateMemberRoleSchema = z.object({
-  role: z.enum(["admin", "member", "viewer"], {
-    message: "Role must be admin, member, or viewer"
-  })
+  role: z.string().refine(
+    (role) => getInvitableRoles().includes(role),
+    (role) => ({ message: `Role must be one of: ${getInvitableRoles().join(", ")}` })
+  )
   // Cannot promote to owner
 });
 const paginationSchema = z.object({

package/dist/messages/de/index.d.ts

@@ -1248,6 +1248,8 @@ declare const _default: {
         allPermissions: string;
         permission: string;
         dangerousAction: string;
+        roleChanged: string;
+        roleChangedDescription: string;
         roles: {
             owner: {
                 title: string;