@usequark/quark-create-app 1.23.11

package/templates/base-project/.cursor/rules/quark.mdc

@@ -0,0 +1,172 @@
+---
+description: Quark project conventions for __QUARK_PROJECT_NAME__. Covers all layers: UI, backend, database, auth, jobs, testing, and deployment.
+alwaysApply: true
+---
+
+# Quark Project: __QUARK_PROJECT_NAME__
+
+Package scope: `@__QUARK_SCOPE__` - use this for ALL workspace packages.
+Scaffolded: __QUARK_SCAFFOLD_DATE__
+
+---
+
+## Non-Negotiable Rules
+
+1. **ESM only.** Always `import`/`export`. Never `require()` or `module.exports`.
+2. **No authored TypeScript.** Plain `.js` and `.jsx` files only - no repo-authored `.ts`, `.tsx`, or type annotations. Generated code is the only exception.
+3. **Validate everything at boundaries.** Server Actions and API routes must use Zod. No raw `req.body` access without parsing.
+4. **Use AppError at runtime boundaries.** Throw `AppError` / `ValidationError` / `NotFoundError` from `@techstream/quark-core/errors` in application/runtime code. Native `Error` is reserved for library, bootstrap, CLI, and test code.
+5. **Log with createLogger in runtime code.** Use `createLogger(name)` from `@techstream/quark-core` for application/runtime code. Console output is reserved for bootstrap, CLI, and test code.
+6. **DB models always have timestamps.** Every Prisma model: `createdAt DateTime @default(now())` + `updatedAt DateTime @updatedAt`.
+7. **Workspace import scope.** Use `@__QUARK_SCOPE__/*` for local packages. Never `@techstream/quark-db`, `@techstream/quark-config`, etc.
+8. **Co-located tests.** `feature.test.js` lives next to `feature.js`. Tests use `node --test` - no Jest, no Vitest.
+
+---
+
+## Import Reference
+
+```javascript
+// ✅ Workspace packages - always @__QUARK_SCOPE__/*:
+import { prisma, user, post }    from "@__QUARK_SCOPE__/db";
+import { loadConfig }            from "@__QUARK_SCOPE__/config";
+import { Button, Card, Input }   from "@__QUARK_SCOPE__/ui";
+import { JOB_TYPES }             from "@__QUARK_SCOPE__/jobs";
+
+// ✅ Published runtime - @techstream/quark-core:
+import { AppError, ValidationError, NotFoundError } from "@techstream/quark-core/errors";
+import { createLogger, getCurrentSession }          from "@techstream/quark-core";
+import { createQueue, addJob }                      from "@techstream/quark-core";
+import { metrics, cache, storage }                  from "@techstream/quark-core";
+
+// ❌ Never:
+import { Button } from "@/components/ui/button";     // wrong path convention
+import { prisma } from "@techstream/quark-db";        // wrong scope for workspace pkg
+import something  from "@techstream/quark-config";    // wrong scope for workspace pkg
+```
+
+---
+
+## UI & Design System
+
+- Styling: **Tailwind CSS utility classes only**. No inline styles, no CSS modules.
+- Components from `@__QUARK_SCOPE__/ui`. All accept `className` for overrides.
+- Available: `Button`, `Input`, `Label`, `Textarea`, `Select`, `Checkbox`, `Badge`, `Card`/`CardHeader`/`CardTitle`/`CardContent`/`CardFooter`, `Table`/`TableHeader`/`TableBody`/`TableRow`/`TableHead`/`TableCell`, `Skeleton`, `QuarkLogo` *(server)*, `Dialog` *(client)*, `Toast`/`useToast` *(client)*, `ThemeProvider`/`useTheme` *(client)*.
+- Loading states → `<Skeleton>` + `<Suspense>` boundaries.
+- User feedback → `useToast()` (mark component `"use client"`).
+- Modals → `<Dialog>` (mark parent `"use client"`).
+- Default to **Server Components**. Only add `"use client"` when necessary.
+
+---
+
+## Server Action Pattern
+
+```javascript
+"use server";
+import { z } from "zod";
+import { ValidationError, AppError } from "@techstream/quark-core/errors";
+import { getCurrentSession, createLogger } from "@techstream/quark-core";
+import { prisma } from "@__QUARK_SCOPE__/db";
+
+const log = createLogger("action:example");
+const schema = z.object({ title: z.string().min(1).max(255) });
+
+export async function createExample(formData) {
+  const session = await getCurrentSession();
+  if (!session) throw new AppError("Unauthorized", 401);
+
+  const parsed = schema.safeParse(Object.fromEntries(formData));
+  if (!parsed.success) throw new ValidationError(parsed.error.flatten());
+
+  const result = await prisma.example.create({ data: parsed.data });
+  log.info("created", { id: result.id });
+  return result;
+}
+```
+
+---
+
+## API Route Pattern
+
+```javascript
+import { NextResponse } from "next/server";
+import { AppError } from "@techstream/quark-core/errors";
+import { createLogger } from "@techstream/quark-core";
+
+const log = createLogger("api:example");
+
+export async function GET(request) {
+  try {
+    return NextResponse.json({ data });
+  } catch (error) {
+    log.error("request failed", { error });
+    if (error instanceof AppError)
+      return NextResponse.json({ error: error.message }, { status: error.statusCode });
+    return NextResponse.json({ error: "Internal server error" }, { status: 500 });
+  }
+}
+```
+
+---
+
+## Database
+
+- Schema: `packages/db/prisma/schema.prisma`
+- Query helpers: `packages/db/src/queries.js` - add functions here, don't call `prisma.*` directly in components or actions.
+- Always run `pnpm db:generate` after schema changes, then `pnpm db:migrate`.
+
+---
+
+## Auth
+
+```javascript
+import { getCurrentSession } from "@techstream/quark-core";
+
+const session = await getCurrentSession();       // null if unauthenticated
+if (!session) redirect("/login");                // Server Component
+if (!session) throw new AppError("Unauthorized", 401);  // Server Action / API
+if (session.user.role !== "ADMIN") throw new AppError("Forbidden", 403);
+```
+
+---
+
+## Background Jobs
+
+```javascript
+// Dispatch (from Server Action or API route):
+import { createQueue, addJob } from "@techstream/quark-core";
+import { JOB_TYPES } from "@__QUARK_SCOPE__/jobs";
+const queue = createQueue("default");
+await addJob(queue, JOB_TYPES.MY_JOB, { userId });
+
+// Handle (apps/worker/src/handlers/):
+import { createLogger } from "@techstream/quark-core";
+const log = createLogger("job:my-job");
+export async function handleMyJob({ data }) { log.info("processing", data); }
+```
+
+---
+
+## Testing
+
+```javascript
+import { test } from "node:test";
+import assert from "node:assert";
+
+test("feature", async (t) => {
+  await t.test("does X", async () => {
+    assert.strictEqual(actual, expected);
+  });
+});
+```
+
+---
+
+## Environment
+
+New env vars must be registered in `packages/config/src/validate-env.js` before use. Load config via `loadConfig()` from `@__QUARK_SCOPE__/config`.
+
+---
+
+## Deployment
+
+Railway: two services (`web` + `worker`). Migrations auto-run on deploy via `preDeploy` in `.railway/railway.ts`. Env vars managed in Railway dashboard - never committed.

package/templates/base-project/.dockerignore

@@ -0,0 +1,14 @@
+node_modules
+.git
+.next
+dist
+coverage
+.turbo
+.env
+.env.*
+!.env.example
+*.log
+.DS_Store
+.idea
+.vscode
+docs

package/templates/base-project/.env.railway.example

@@ -0,0 +1,87 @@
+# Default Railway runtime variables for __QUARK_PROJECT_NAME__.
+# Copy these values into Railway shared/service variables as a starting point.
+# Railway does not read docker-compose.yml or the local .env example.
+# Add managed PostgreSQL and Redis services in Railway first, then wire the
+# placeholders below with Railway service references or pasted connection
+# strings before the first deploy.
+# Railway injects PORT automatically, so do not set it manually here.
+
+# --- Core runtime ---
+NODE_ENV=production
+# Forces the standalone Next.js server to bind on Railway's network interface.
+HOSTNAME=0.0.0.0
+APP_NAME=__QUARK_PROJECT_NAME__
+APP_DESCRIPTION=Update this before production deployment.
+# APP_URL must be an absolute public URL with https://
+APP_URL=https://__QUARK_PROJECT_NAME__.railway.app
+ALLOW_INDEXING=false
+AUTH_ALLOW_SIGNUP=false
+
+# --- Auth ---
+# Generate with: openssl rand -base64 32
+# AUTH_SECRET is an alternative name; the deploy CLI auto-sets both.
+# Must be at least 32 characters or startup validation fails.
+NEXTAUTH_SECRET=CHANGE_ME_TO_A_32_CHARACTERS_OR_LONGER_SECRET
+
+# APP_URL is the canonical public URL. NEXTAUTH_URL is derived automatically.
+# Uncomment only if you need to override it explicitly.
+# NEXTAUTH_URL=https://__QUARK_PROJECT_NAME__.railway.app
+
+# --- Managed infrastructure ---
+# `quark deploy railway` automatically sets DATABASE_URL and REDIS_URL using
+# Railway service references (${{Postgres.DATABASE_URL}}, ${{Redis.REDIS_URL}}).
+# You only need to set these manually if you are not using the CLI deploy flow.
+# DATABASE_URL=postgresql://user:pass@host:5432/db
+# REDIS_URL=redis://user:pass@host:6379
+
+# --- Worker ---
+WORKER_CONCURRENCY=5
+
+# --- Optional remote seed defaults ---
+# Used only when you intentionally run `pnpm db:seed` against Railway.
+# Remove these after the first seed if you do not want bootstrap admin
+# credentials stored in Railway long term.
+SEED_PROFILE=minimal
+ADMIN_EMAIL=admin@example.com
+ADMIN_PASSWORD=CHANGE_ME_TO_STRONG_ADMIN_PASSWORD
+# ADMIN_NAME=Admin
+
+# --- Storage ---
+# Local storage is ephemeral on Railway. Keep this only if uploaded files do not
+# need to survive redeploys or reschedules. For durable uploads, switch to s3.
+STORAGE_PROVIDER=local
+# STORAGE_PROVIDER=s3
+# S3_BUCKET=your-bucket-name
+# S3_REGION=auto
+# S3_ENDPOINT=https://<account-id>.r2.cloudflarestorage.com
+# S3_ACCESS_KEY_ID=your-access-key
+# S3_SECRET_ACCESS_KEY=your-secret-key
+# S3_PUBLIC_URL=https://your-public-bucket-domain.com
+
+# --- Email ---
+# Configure a real provider before enabling email in Railway.
+# EMAIL_PROVIDER=smtp
+# EMAIL_FROM=__QUARK_PROJECT_NAME__ <noreply@yourdomain.com>
+# SMTP_HOST=smtp.example.com
+# SMTP_PORT=587
+# SMTP_SECURE=true
+# SMTP_USER=your_smtp_user
+# SMTP_PASSWORD=your_smtp_password
+# RESEND_API_KEY=re_xxxxxxxxxxxxx
+# ZEPTOMAIL_TOKEN=Zoho-enczapikey your_zeptomail_api_key
+# ZEPTOMAIL_URL=https://api.zeptomail.com
+# ZEPTOMAIL_BOUNCE_EMAIL=bounce@yourdomain.com
+
+# --- Optional analytics ---
+# NEXT_PUBLIC_UMAMI_URL=https://umami.example.com
+# NEXT_PUBLIC_UMAMI_WEBSITE_ID=00000000-0000-0000-0000-000000000000
+# NEXT_PUBLIC_UMAMI_REPLAY_ENABLED=false
+
+# --- Optional tuning ---
+# LOG_LEVEL=info
+# CACHE_TTL=600
+# RATE_LIMIT_MAX=100
+# RATE_LIMIT_WINDOW_MS=900000
+# API_BODY_SIZE_LIMIT=2097152
+# UPLOAD_SIZE_LIMIT=10485760
+# ASSET_CDN_URL=https://cdn.yourdomain.com

package/templates/base-project/.github/copilot-instructions.md

@@ -0,0 +1,65 @@
+<skills>
+<skill>
+<name>project-context</name>
+<description>Project-specific context and conventions. This skill evolves with your project - update it as your architecture grows.</description>
+<file>.github/skills/project-context/SKILL.md</file>
+</skill>
+</skills>
+
+# __QUARK_PROJECT_NAME__ - Project Conventions
+
+> Scaffolded with Quark on __QUARK_SCAFFOLD_DATE__. Package scope: `@__QUARK_SCOPE__`
+> Also see `CLAUDE.md` at the project root for the full context reference.
+
+## Non-Negotiable Rules
+
+- **ESM only** - `import`/`export` everywhere. Never `require()`.
+- **No authored TypeScript** - `.js` and `.jsx` only. Generated code may emit typed artifacts, but project code should not add `.ts` or `.tsx` sources.
+- **Validate at every boundary** - Zod schemas on all Server Actions and API routes.
+- **Errors** - `AppError` / `ValidationError` from `@techstream/quark-core/errors` in app/runtime code. Native `Error` is acceptable in library, bootstrap, CLI, and test code.
+- **Logging** - `createLogger(name)` from `@techstream/quark-core` in app/runtime code. Console output is acceptable in bootstrap, CLI, and test code.
+- **DB models** - Always add `createdAt` and `updatedAt` to every Prisma model.
+- **Workspace imports** - Use `@__QUARK_SCOPE__/*` for local packages (`db`, `config`, `ui`, `jobs`). Never `@techstream/quark-db` etc.
+- **Tests** - Co-located `*.test.js`, run with `node --test`.
+
+## Import Patterns
+
+```javascript
+// Workspace packages:
+import { prisma, user }          from "@__QUARK_SCOPE__/db";
+import { loadConfig }            from "@__QUARK_SCOPE__/config";
+import { Button, Card, Input }   from "@__QUARK_SCOPE__/ui";
+import { JOB_TYPES }             from "@__QUARK_SCOPE__/jobs";
+
+// Published runtime:
+import { AppError, ValidationError } from "@techstream/quark-core/errors";
+import { createLogger, getCurrentSession, createQueue, addJob } from "@techstream/quark-core";
+```
+
+## UI & Design System
+
+Components from `@__QUARK_SCOPE__/ui` - Tailwind-only, Server Component safe:
+`Button`, `Input`, `Label`, `Textarea`, `Select`, `Checkbox`, `Badge`,
+`Card`/`CardHeader`/`CardTitle`/`CardContent`/`CardFooter`,
+`Table`/`TableHeader`/`TableBody`/`TableRow`/`TableHead`/`TableCell`,
+`Skeleton`, `ErrorBanner`, `Footer`, `Navbar`/`MobileNavbar`, `RichText`,
+`QuarkLogo` *(server)*, `Dialog` *(client)*, `Toast`/`useToast` *(client)*,
+`ThemeProvider`/`useTheme` *(client)* - dark/light mode context.
+
+All accept `className`. Never import from `@/components/ui/*`.
+Inspect `apps/web/src/app/page.js` and `packages/ui/README.md` before creating bespoke public-page layout primitives.
+
+## Standard Patterns
+
+```javascript
+// Server Action:
+"use server";
+const parsed = schema.safeParse(Object.fromEntries(formData));
+if (!parsed.success) throw new ValidationError(parsed.error.flatten());
+const session = await getCurrentSession();
+if (!session) throw new AppError("Unauthorized", 401);
+
+// New env var: register in packages/config/src/validate-env.js first.
+// New DB model: schema.prisma → pnpm db:generate → pnpm db:migrate.
+// New job: define type in packages/jobs/src/index.js, handler in apps/worker/src/handlers/.
+```

package/templates/base-project/.github/dependabot.yml

@@ -0,0 +1,31 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+
+    # Split by semver update type. A single "production" group bundles patch,
+    # minor and major bumps into one PR, so a breaking change hides behind a
+    # wall of safe patches and gets rubber-stamped. Majors get their own PR.
+    groups:
+      production-majors:
+        dependency-type: production
+        update-types: ["major"]
+      development-majors:
+        dependency-type: development
+        update-types: ["major"]
+      production-minor:
+        dependency-type: production
+        update-types: ["minor"]
+      production-patch:
+        dependency-type: production
+        update-types: ["patch"]
+      development-minor:
+        dependency-type: development
+        update-types: ["minor"]
+      development-patch:
+        dependency-type: development
+        update-types: ["patch"]
+
+    open-pull-requests-limit: 10

package/templates/base-project/.github/skills/project-context/SKILL.md

@@ -0,0 +1,109 @@
+---
+name: project-context
+description: Project-specific context and conventions. This skill evolves with your project - update it as your architecture grows.
+---
+
+# Project Context
+
+## Overview
+
+This is a Quark-based full-stack JavaScript application.
+
+| Property | Value |
+|---|---|
+| **Scope** | `@__QUARK_SCOPE__` |
+| **Framework** | Quark (scaffolded from `@techstream/quark-create-app`) |
+| **Scaffolded** | __QUARK_SCAFFOLD_DATE__ |
+
+## Project Structure
+
+```
+__QUARK_PROJECT_NAME__/
+├── apps/
+│   ├── web/          # Next.js (App Router, Server Actions)
+__QUARK_OPTIONAL_APPS__├── packages/
+│   ├── db/           # Prisma schema, client, queries
+│   ├── config/       # Environment validation & shared config
+__QUARK_OPTIONAL_PACKAGES__├── docker-compose.yml
+├── .env              # Local environment (git-ignored)
+└── .env.example      # Template for environment variables
+```
+
+## Tech Stack
+
+| Layer | Technology |
+|---|---|
+| Runtime | Node.js 22, ES Modules |
+| Package manager | pnpm (workspaces) |
+| Monorepo | Turborepo |
+| Web | Next.js 16 (App Router) |
+| Database | PostgreSQL 16 + Prisma 7 |
+| Queue | BullMQ + Redis 7 |
+| Auth | NextAuth v5 |
+| Validation | Zod 4 |
+| UI | Tailwind CSS + `@__QUARK_SCOPE__/ui` components |
+| Email | Nodemailer |
+| Linting | Biome |
+| Testing | Node.js built-in test runner |
+
+## Coding Conventions
+
+- **ESM only** - use `import`/`export`, never `require`.
+- **No authored TypeScript** - plain `.js` and `.jsx` files. Generated code may emit typed artifacts, but project code should not add `.ts` or `.tsx` sources.
+- **Imports:** Use `@techstream/quark-core` for published utilities. Use `@__QUARK_SCOPE__/*` for local packages (db, config, ui, jobs).
+- **Tests:** Co-located `*.test.js` files, run with `node --test`.
+- **Validation:** Zod schemas for all Server Actions and API routes.
+- **Errors:** Use `AppError` / `ValidationError` from `@techstream/quark-core/errors` in app/runtime code. Native `Error` is acceptable in library, bootstrap, CLI, and test code.
+- **Logging:** Use `createLogger(name)` from `@techstream/quark-core` in app/runtime code. Console output is acceptable in bootstrap, CLI, and test code.
+- **Database models:** Always include `createdAt`/`updatedAt`.
+- **Environment:** All env vars validated in `packages/config/src/validate-env.js`.
+- **Analytics:** Optional Umami support lives in `apps/web/src/lib/analytics/*`. The public env contract uses only `NEXT_PUBLIC_UMAMI_URL`, `NEXT_PUBLIC_UMAMI_WEBSITE_ID`, and `NEXT_PUBLIC_UMAMI_REPLAY_ENABLED`; replay uses a local rrweb recorder, and dormant helpers exist for dashboard-generated Umami Links, Pixels, and marketing-email snippets.
+
+## Common Commands
+
+```bash
+pnpm dev              # Start all apps in dev mode
+pnpm build            # Build everything
+pnpm test             # Run all tests
+pnpm lint             # Lint with Biome
+pnpm db:generate      # Regenerate Prisma client
+pnpm db:push          # Push schema changes
+pnpm db:migrate       # Run database migrations
+docker compose up -d  # Start infrastructure
+```
+
+## Key Files to Know
+
+- `packages/db/prisma/schema.prisma` - Database schema (edit this to add models)
+- `packages/db/src/queries.js` - Database query functions
+- `packages/config/src/validate-env.js` - Environment variable validation
+- `apps/web/src/app/` - Next.js App Router pages and API routes
+- `apps/web/src/lib/auth.js` - Authentication configuration
+- `apps/web/src/lib/seo/site-metadata.js` - `getSiteMetadata()` (root layout) and `getPageMetadata()` for per-page titles; see the `seo` skill for the page-title convention
+- `apps/web/src/lib/analytics/umami-config.js` - Optional Umami URL and replay gating
+- `apps/worker/src/handlers/` - Background job handlers
+
+## Updating Quark Core
+
+```bash
+npx @techstream/quark-create-app update   # Update core infrastructure
+pnpm update @techstream/quark-core        # Or update directly
+```
+
+---
+
+## Maintaining This Skill
+
+> **Important:** When you make changes that affect this project's architecture,
+> conventions, or structure - such as adding new packages, models, API patterns,
+> environment variables, deployment targets, or team conventions - **update this
+> skill file** to reflect those changes. This ensures future AI interactions
+> always have accurate, up-to-date context.
+>
+> Examples of when to update this file:
+> - Adding a new Prisma model or database table
+> - Introducing a new API route pattern or middleware
+> - Adding or removing a workspace package
+> - Changing deployment infrastructure or CI/CD steps
+> - Establishing new coding conventions or architectural decisions
+> - Adding third-party integrations or services

package/templates/base-project/.github/workflows/ci.yml

@@ -0,0 +1,116 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+    paths-ignore:
+      - "**/*.md"
+      - "docs/**"
+  pull_request:
+    branches: [main]
+    paths-ignore:
+      - "**/*.md"
+      - "docs/**"
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+
+      - run: pnpm lint
+
+      - run: pnpm standards
+
+  test:
+    runs-on: ubuntu-latest
+    name: Test
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: app_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd="pg_isready -U postgres"
+          --health-interval=5s
+          --health-timeout=5s
+          --health-retries=5
+      redis:
+        image: redis:7-alpine
+        ports:
+          - 6379:6379
+        options: >-
+          --health-cmd="redis-cli ping"
+          --health-interval=5s
+          --health-timeout=5s
+          --health-retries=5
+    env:
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: postgres
+      POSTGRES_HOST: localhost
+      POSTGRES_PORT: "5432"
+      POSTGRES_DB: app_test
+      REDIS_HOST: localhost
+      REDIS_PORT: "6379"
+      NEXTAUTH_SECRET: ci-test-secret-must-be-at-least-32-characters-long
+      NODE_ENV: test
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+
+      - run: pnpm db:generate
+
+      - run: pnpm test
+
+  build:
+    name: Build
+    needs: [lint, test]
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+
+      - run: pnpm db:generate
+
+      - run: pnpm doctor:ci
+
+      - run: pnpm build

package/templates/base-project/.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,22 @@
+name: Auto-merge Dependabot
+
+on: pull_request
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-merge:
+    if: github.actor == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: dependabot/fetch-metadata@v2
+        id: meta
+
+      - name: Auto-merge patch updates
+        if: steps.meta.outputs.update-type == 'version-update:semver-patch'
+        run: gh pr merge "$PR_URL" --auto --squash
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

package/templates/base-project/.github/workflows/install-windows.yml

@@ -0,0 +1,27 @@
+name: Install (Windows)
+
+# Windows runners bill at 2x the Linux rate. This workflow only proves that
+# `pnpm install` resolves the lockfile, which the Linux CI jobs already cover,
+# so it runs on demand only rather than on every push and pull request.
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  install-windows:
+    name: Install (Windows)
+    runs-on: windows-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile