@usequark/quark-create-app 1.25.12 → 1.25.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usequark/quark-create-app",
-  "version": "1.25.12",
+  "version": "1.25.14",
   "description": "CLI to scaffold new Quark projects with Next.js, Prisma, BullMQ, and Railway deployment",
   "keywords": [
     "quark",
@@ -59,7 +59,7 @@
     "sync-templates:check": "node scripts/sync-templates.js --check",
     "regen-migration": "node scripts/regenerate-template-migration.js",
     "smoke:published": "node scripts/smoke-published.js",
-    "test": "node test-cli.js && node --test src/utils.test.js && node --test src/prepare-hooks.test.js && node --test src/scaffold-output.test.js && node --test src/template-scripts.test.js && node --test src/scaffold-guards.test.js && node --test src/template-config.test.js && node --test src/worker-dockerfile.test.js && node --test src/dependabot-config.test.js && node --test 'src/deploy/**/*.test.js' && node --test --test-concurrency=1 'src/deploy/**/*.integration.test.js'",
+    "test": "node test-cli.js && node --test src/utils.test.js && node --test src/prepare-hooks.test.js && node --test src/scaffold-warning.test.js && node --test src/scaffold-output.test.js && node --test src/scaffold-drift.test.js && node --test src/mobile-template.test.js && node --test src/template-scripts.test.js && node --test src/scaffold-guards.test.js && node --test src/template-config.test.js && node --test src/worker-dockerfile.test.js && node --test src/dependabot-config.test.js && node --test 'src/deploy/**/*.test.js' && node --test --test-concurrency=1 'src/deploy/**/*.integration.test.js'",
     "test:build": "node test-build.js",
     "test:e2e": "node test-e2e.js",
     "test:e2e:full": "node test-e2e-full.js",

package/src/index.js

@@ -1219,37 +1219,6 @@ program
 			);
 			console.log(chalk.green(`    ✓ next.config.js patched`));
 
-			// Step 7d: Strip jobs-related code from register route when jobs not selected
-			if (!features.includes("jobs")) {
-				const registerPath = path.join(
-					targetDir,
-					"apps",
-					"web",
-					"src",
-					"app",
-					"api",
-					"auth",
-					"register",
-					"route.js",
-				);
-				if (await fs.pathExists(registerPath)) {
-					let content = await fs.readFile(registerPath, "utf-8");
-					// Remove the jobs import line
-					content = content.replace(
-						/import\s*\{[^}]*\}\s*from\s*["']@[^/]+\/jobs["'];?\n/,
-						"",
-					);
-					// Remove createQueue from the core import if present
-					content = content.replace(/\tcreateQueue,\n/, "");
-					// Remove the @quark:start:jobs ... @quark:end:jobs block (inclusive)
-					content = content.replace(
-						/[ \t]*\/\/ @quark:start:jobs[\s\S]*?\/\/ @quark:end:jobs\n?/,
-						"",
-					);
-					await fs.writeFile(registerPath, content);
-				}
-			}
-
 			// Step 8: Create .env.example file
 			console.log(chalk.cyan("\n  📋 Creating environment configuration..."));
 			const envExampleTemplate = `# ⚠️  IMPORTANT: Copy this file to .env and fill in the values for your environment.
@@ -1867,6 +1836,34 @@ async function detectInstalledFeatures(projectDir) {
 	return installed;
 }
 
+/**
+ * Detect which AI-harness skill directory a project uses.
+ *
+ * The scaffold writes embedded skills to exactly one of HARNESS_SKILL_DIRS and
+ * points the AI-context docs at that path. The drift check rebuilds a reference
+ * scaffold to compare against, so it must pass the same `--harness` the project
+ * was built with — otherwise the reference lands skills in .opencode/skills for
+ * a claude/copilot project and reports those files as drift forever.
+ *
+ * `.github/skills` is checked last on purpose: every scaffold carries
+ * `.github/skills/project-context/SKILL.md` regardless of harness, so its
+ * presence alone says nothing about the selection.
+ *
+ * @param {string} projectDir
+ * @returns {Promise<string>} A key of HARNESS_SKILL_DIRS, defaulting to
+ *   DEFAULT_HARNESS when no skill directory exists yet.
+ */
+async function detectConfiguredHarness(projectDir) {
+	for (const harness of ["opencode", "claude", "copilot"]) {
+		if (
+			await fs.pathExists(path.join(projectDir, HARNESS_SKILL_DIRS[harness]))
+		) {
+			return harness;
+		}
+	}
+	return DEFAULT_HARNESS;
+}
+
 async function collectRelativeFilePaths(
 	rootDir,
 	currentDir = rootDir,
@@ -1944,6 +1941,16 @@ async function createReferenceScaffold(projectDir, quarkLink) {
 		...linkedFeatures,
 		...detectedFeatures,
 	]);
+	// `mobile` is a post-creation-only feature: `create` rejects it ("run quark
+	// add mobile after scaffolding") while `add mobile` records it in
+	// .quark-link.json like any other package. Forwarding it below therefore
+	// made the reference-scaffold subprocess exit non-zero, which crashed
+	// `update --scaffold-check` with "Could not generate the reference
+	// scaffold" on every project that had ever run `add mobile` — the check
+	// meant to keep projects healthy took the whole command down instead.
+	const scaffoldFeatures = comparisonFeatures.filter(
+		(feature) => feature !== "mobile",
+	);
 	const allowSignup =
 		typeof quarkLink.authAllowSignup === "boolean"
 			? quarkLink.authAllowSignup
@@ -1957,11 +1964,28 @@ async function createReferenceScaffold(projectDir, quarkLink) {
 		"--no-prompts",
 		"--skip-install",
 		"--skip-docker",
+		// A hand-edited or legacy .quark-link.json can leave the optional set
+		// empty (only mobile recorded). `--packages ""` parses as one invalid
+		// feature and the subprocess rejects it, so fall back to the minimum
+		// scaffoldable set rather than failing the check on a technicality.
 		"--packages",
-		comparisonFeatures.join(","),
+		scaffoldFeatures.length > 0 ? scaffoldFeatures.join(",") : "ui",
 		"--signup",
 		allowSignup ? "enabled" : "disabled",
 	];
+	// Forward the project's brief and harness so the reference scaffold is
+	// byte-comparable. Without them the reference is built with the default
+	// brief and the default harness directory, so every project with a custom
+	// `--prompt` reports false drift on the brief-seeded doc files, and every
+	// `--harness claude|copilot` project reports false-missing skill files for
+	// the default .opencode/skills directory it never had.
+	if (
+		typeof quarkLink.brief === "string" &&
+		quarkLink.brief.trim().length > 0
+	) {
+		args.push("--prompt", quarkLink.brief);
+	}
+	args.push("--harness", await detectConfiguredHarness(projectDir));
 
 	try {
 		await execa(process.execPath, args, {
@@ -1975,7 +1999,15 @@ async function createReferenceScaffold(projectDir, quarkLink) {
 			stdio: "pipe",
 		});
 	} catch (error) {
-		const details = error.stderr || error.stdout || error.shortMessage;
+		// Keep the subprocess's own error output, drop its stack trace: the
+		// reference scaffold is a CLI invocation whose failure reason is the
+		// line it printed before it exited, and a raw "at ..." dump only makes
+		// a failed check look like a CLI crash.
+		const details = (error.stderr || error.stdout || error.shortMessage || "")
+			.split("\n")
+			.filter((line) => !/^\s*at\s/.test(line))
+			.join("\n")
+			.trim();
 		await fs.remove(tempRoot);
 		throw new Error(
 			details
@@ -2381,60 +2413,15 @@ program
 							);
 						}
 
-						// Add DEVICE model to Prisma schema
-						const schemaPath = path.join(
-							projectDir,
-							"packages/db/prisma/schema.prisma",
-						);
-						if (await fs.pathExists(schemaPath)) {
-							let schema = await fs.readFile(schemaPath, "utf-8");
-							if (!schema.includes("model Device")) {
-								// Insert Device model after AuditLog
-								const deviceModel = `
-
-// ─── Device Model (Mobile Push Notifications) ────────────────────────────────
-
-model Device {
-  id        String   @id @default(cuid())
-  userId    String
-  user      User     @relation(fields: [userId], references: [id], onDelete: Cascade)
-  platform  String   // "ios" | "android"
-  pushToken String
-  deviceId  String
-  createdAt DateTime @default(now())
-  updatedAt DateTime @updatedAt
-
-  @@unique([userId, deviceId])
-  @@index([userId])
-  @@index([pushToken])
-  @@index([createdAt])
-}
-`;
-								schema = schema.replace(
-									/(\/\/ Audit Log Model[\s\S]*?^}\s)/m,
-									`$1${deviceModel}`,
-								);
-								// Add devices relation to User model
-								schema = schema.replace(
-									/(files\s+File\[\])/,
-									"$1\n  devices       Device[]",
-								);
-								await fs.writeFile(schemaPath, schema);
-							}
-						}
-
 						console.log(
 							chalk.green("    ✓ Mobile app scaffolded (apps/mobile)"),
 						);
-						console.log(
-							chalk.green("    ✓ DEVICE model added to Prisma schema"),
-						);
 						console.log(
 							chalk.green("    ✓ EXPO_PUBLIC_API_URL added to .env.example"),
 						);
 						console.log(
 							chalk.dim(
-								"    · API routes (token, refresh, device/register) already in base template",
+								"    · API routes (token, refresh) already in base template",
 							),
 						);
 					}
@@ -2604,12 +2591,7 @@ model Device {
 				console.log(chalk.white("  3. pnpm dev (starts web + worker)"));
 				console.log(
 					chalk.white(
-						"  4. pnpm dev:mobile (starts Expo in a second terminal)",
-					),
-				);
-				console.log(
-					chalk.white(
-						"  5. Configure APNs/FCM env vars for push notifications\n",
+						"  4. pnpm dev:mobile (starts Expo in a second terminal)\n",
 					),
 				);
 			}
@@ -2794,10 +2776,23 @@ program
 		}
 
 		if (options.scaffoldCheck) {
-			const scaffoldReport = await reportScaffoldDrift(
-				process.cwd(),
-				quarkLink,
-			);
+			let scaffoldReport;
+			try {
+				scaffoldReport = await reportScaffoldDrift(process.cwd(), quarkLink);
+			} catch (error) {
+				// A drift check that cannot build its reference scaffold must
+				// fail loudly and cleanly. The old behaviour rethrew into the
+				// command handler, so a subprocess rejection surfaced as a raw
+				// stack trace — indistinguishable from a CLI crash, when what
+				// actually happened is that the check could not run.
+				console.error(
+					chalk.red(
+						`✗ Scaffold check could not run: ${error?.message || error}`,
+					),
+				);
+				process.exitCode = 1;
+				return;
+			}
 			const hasDrift =
 				scaffoldReport.changed.length > 0 || scaffoldReport.missing.length > 0;
 			if (options.failOnDrift && hasDrift) {

package/src/scaffold-warning.js

@@ -30,6 +30,11 @@ export function warnIfJobsOmitted(features, log = console.log) {
 			`      Deleting a user leaves their uploaded files orphaned in storage — the schema\n      keeps the rows rather than removing them — and without a worker nothing sweeps them.`,
 		),
 	);
+	log(
+		chalk.dim(
+			`      Signup welcome emails are also skipped: nothing processes the queue.`,
+		),
+	);
 	log(
 		chalk.dim(
 			`      Add it later with: npx @usequark/quark-create-app add jobs\n`,

package/templates/base-project/apps/web/src/lib/auth.js

@@ -2,7 +2,7 @@ import { PrismaAdapter } from "@auth/prisma-adapter";
 import { createAuthConfig, verifyPassword } from "@usequark/quark-core/auth";
 import { createLogger } from "@usequark/quark-core/core";
 import { AppError } from "@usequark/quark-core/errors";
-import { Prisma, prisma, user } from "@usequark/quark-db";
+import { Prisma, prisma, user as userQueries } from "@usequark/quark-db";
 import NextAuth from "next-auth";
 import CredentialsProvider from "next-auth/providers/credentials";
 import GithubProvider from "next-auth/providers/github";
@@ -66,7 +66,7 @@ const providers = [
 			}
 
 			try {
-				const existingUser = await user.findByEmail(credentials.email);
+				const existingUser = await userQueries.findByEmail(credentials.email);
 
 				if (!existingUser?.password) {
 					return null;
@@ -156,6 +156,64 @@ if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {
 	);
 }
 
+/**
+ * Re-validate the session against the database on every request.
+ *
+ * Web sessions are signed JWTs: a credentials provider forces the JWT
+ * strategy (Auth.js rejects `strategy: "database"` when every provider is
+ * credentials, and scaffolds always ship one), and the cookie would otherwise
+ * stay valid for its full 30 days no matter what happened to the account
+ * behind it. That was the review's "logins can't be revoked" finding — banning
+ * a user, demoting an admin, or changing a password did nothing until the
+ * token expired on its own.
+ *
+ * The revocation check is a single indexed primary-key read, which is the
+ * same cost Auth.js itself pays for database sessions — but it works for
+ * credentials apps too:
+ *
+ *   - user gone (deleted / banned by deletion)  → reject, cookie cleared
+ *   - `passwordChangedAt` after the token's iat → reject, cookie cleared
+ *   - role or profile changed                   → refreshed into the token,
+ *     so `requireRole` reads the current role, not the sign-in-time one
+ *
+ * Returning null from the `jwt` callback is Auth.js's documented "invalidate
+ * this session" signal: it clears the cookie and the request continues
+ * unauthenticated.
+ */
+async function validateSessionToken(token) {
+	if (typeof token.id !== "string" || token.id.length === 0) {
+		return null;
+	}
+
+	try {
+		const account = await userQueries.findById(token.id);
+
+		if (!account) {
+			return null;
+		}
+
+		if (
+			account.passwordChangedAt &&
+			typeof token.iat === "number" &&
+			account.passwordChangedAt.getTime() / 1000 > token.iat
+		) {
+			return null;
+		}
+
+		token.email = account.email;
+		token.name = account.name;
+		token.role = account.role;
+		return token;
+	} catch (err) {
+		// Fail closed: an unreachable database invalidates the session rather
+		// than letting an unverified cookie through. The next request retries.
+		logger.error("Session validation failed", {
+			message: err?.message ?? String(err),
+		});
+		return null;
+	}
+}
+
 export function getAuthOptions() {
 	return createAuthConfig({
 		adapter: PrismaAdapter(prisma),
@@ -172,7 +230,28 @@ export function getAuthOptions() {
 			},
 		},
 		session: {
+			// JWT is not a preference here, it is a constraint: Auth.js throws
+			// `UnsupportedStrategy` when strategy is "database" and every
+			// configured provider is credentials, and the scaffold always ships
+			// the credentials provider. Revocation is therefore enforced by
+			// `validateSessionToken` above, not by server-side session rows.
 			strategy: "jwt",
+			maxAge: 30 * 24 * 60 * 60, // 30 days
+		},
+		callbacks: {
+			async jwt({ token, user: signedInUser }) {
+				// Sign-in: stamp the identity once; the DB check below is for
+				// every subsequent request.
+				if (signedInUser) {
+					token.id = signedInUser.id;
+					token.email = signedInUser.email;
+					token.name = signedInUser.name;
+					token.role = signedInUser.role || "viewer";
+					return token;
+				}
+
+				return validateSessionToken(token);
+			},
 		},
 	});
 }

package/templates/base-project/apps/web/src/lib/enqueue-welcome-email.js

@@ -1,4 +1,15 @@
-import { JOB_NAMES, JOB_QUEUES } from "@usequark/quark-jobs";
+/**
+ * Queue and job name for the signup welcome email.
+ *
+ * These mirror `JOB_QUEUES.EMAIL` and `JOB_NAMES.SEND_WELCOME_EMAIL` in the
+ * `@<scope>/jobs` package — an *optional* scaffold package. Importing them from
+ * there puts `@<scope>/jobs` in the web module graph of every project, and a
+ * project that declines `jobs` has no such dependency to resolve: the web app
+ * fails to build before any test can run. The strings are duplicated here on
+ * purpose; a `packages/cli` test fails when the two copies diverge.
+ */
+export const EMAIL_QUEUE = "email-queue";
+export const SEND_WELCOME_EMAIL = "send-welcome-email";
 
 /**
  * Loads the queue module on demand.
@@ -39,10 +50,10 @@ function loadQueueModule() {
  */
 export async function enqueueWelcomeEmail(userId, loadQueue = loadQueueModule) {
 	const { createQueue } = await loadQueue();
-	const queue = createQueue(JOB_QUEUES.EMAIL);
+	const queue = createQueue(EMAIL_QUEUE);
 
 	try {
-		await queue.add(JOB_NAMES.SEND_WELCOME_EMAIL, { userId });
+		await queue.add(SEND_WELCOME_EMAIL, { userId });
 	} finally {
 		// Never let a failing close mask the enqueue outcome — the caller only
 		// needs to know whether the job reached the queue.

package/templates/base-project/apps/web/src/lib/proxy-auth.js

@@ -1,6 +1,3 @@
-import { getAuthSecret } from "@usequark/quark-core/auth";
-import { getToken } from "next-auth/jwt";
-
 const STRICT_AUTH_RATE_LIMIT_ROUTES = new Set([
 	// `callback/credentials` is where the next-auth client POSTs a credentials
 	// sign-in (next-auth/react posts to `callback/<provider>` for credentials

package/templates/base-project/packages/db/prisma/migrations/20260202061128_initial/migration.sql

@@ -16,6 +16,7 @@ CREATE TABLE "User" (
     "password" TEXT,
     "image" TEXT,
     "role" "UserRole" NOT NULL DEFAULT 'viewer',
+    "passwordChangedAt" TIMESTAMP(3),
     "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
     "updatedAt" TIMESTAMP(3) NOT NULL,
 
@@ -117,9 +118,6 @@ CREATE TABLE "AuditLog" (
 -- CreateIndex
 CREATE UNIQUE INDEX "User_email_key" ON "User"("email");
 
--- CreateIndex
-CREATE INDEX "User_email_idx" ON "User"("email");
-
 -- CreateIndex
 CREATE INDEX "User_createdAt_idx" ON "User"("createdAt");
 
@@ -141,9 +139,6 @@ CREATE INDEX "Session_expires_idx" ON "Session"("expires");
 -- CreateIndex
 CREATE UNIQUE INDEX "VerificationToken_token_key" ON "VerificationToken"("token");
 
--- CreateIndex
-CREATE INDEX "VerificationToken_token_idx" ON "VerificationToken"("token");
-
 -- CreateIndex
 CREATE INDEX "VerificationToken_expires_idx" ON "VerificationToken"("expires");
 
@@ -153,12 +148,6 @@ CREATE UNIQUE INDEX "VerificationToken_identifier_token_key" ON "VerificationTok
 -- CreateIndex
 CREATE INDEX "Job_queue_idx" ON "Job"("queue");
 
--- CreateIndex
-CREATE INDEX "Job_status_idx" ON "Job"("status");
-
--- CreateIndex
-CREATE INDEX "Job_runAt_idx" ON "Job"("runAt");
-
 -- CreateIndex
 CREATE INDEX "Job_status_runAt_idx" ON "Job"("status", "runAt");
 

package/templates/base-project/packages/db/prisma/schema.prisma

@@ -29,6 +29,10 @@ model User {
   password      String?
   image         String?
   role          UserRole  @default(viewer)
+  // Bumped whenever the account's password changes. Session tokens (web JWTs
+  // and mobile refresh tokens) issued before this instant are rejected, so a
+  // stolen or pre-change session dies with the password it was born under.
+  passwordChangedAt DateTime?
   createdAt     DateTime  @default(now())
   updatedAt     DateTime  @updatedAt
 
@@ -37,7 +41,8 @@ model User {
   auditLogs     AuditLog[]
   files         File[]
 
-  @@index([email])
+  // `email` is already @unique (User_email_key); a second plain index on the
+  // same column only adds write cost.
   @@index([createdAt])
 }
 
@@ -85,8 +90,9 @@ model VerificationToken {
   createdAt  DateTime @default(now())
   updatedAt  DateTime @updatedAt
 
+  // `token` is already @unique (VerificationToken_token_key); a second plain
+  // index on the same column only adds write cost.
   @@unique([identifier, token])
-  @@index([token])
   @@index([expires])
 }
 
@@ -106,9 +112,9 @@ model Job {
   createdAt DateTime  @default(now())
   updatedAt DateTime  @updatedAt
 
+  // (status, runAt) serves status-only queries through its leftmost prefix;
+  // single-column [status] and [runAt] indexes were removed as redundant.
   @@index([queue])
-  @@index([status])
-  @@index([runAt])
   @@index([status, runAt])
   @@index([createdAt])
 }

package/templates/base-project/packages/db/src/queries.js

@@ -11,6 +11,7 @@ const USER_SAFE_SELECT = {
 	name: true,
 	image: true,
 	role: true,
+	passwordChangedAt: true,
 	createdAt: true,
 	updatedAt: true,
 };

package/templates/jobs/src/definitions.js

@@ -1,7 +1,6 @@
 export const JOB_QUEUES = {
 	EMAIL: "email-queue",
 	FILES: "files-queue",
-	PUSH: "push-queue",
 	DEFAULT: "default-queue",
 };
 
@@ -9,5 +8,4 @@ export const JOB_NAMES = {
 	SEND_WELCOME_EMAIL: "send-welcome-email",
 	SEND_RESET_PASSWORD_EMAIL: "send-reset-password-email",
 	CLEANUP_ORPHANED_FILES: "cleanup-orphaned-files",
-	SEND_PUSH_NOTIFICATION: "send-push-notification",
 };

package/templates/mobile/app/(app)/_layout.tsx

@@ -2,7 +2,6 @@ import { Ionicons } from "@expo/vector-icons";
 import { Redirect, Tabs } from "expo-router";
 import { Platform } from "react-native";
 import { useSafeAreaInsets } from "react-native-safe-area-context";
-import { AuthGate } from "../../components/AuthGate";
 import { useTheme } from "../../components/ThemeProvider";
 import { useAuth } from "../../hooks/use-auth";
 
@@ -21,7 +20,7 @@ export default function AppLayout() {
 	}
 
 	return (
-		<AuthGate>
+		<>
 			<Tabs
 				screenOptions={{
 					headerShown: false,
@@ -78,6 +77,6 @@ export default function AppLayout() {
 					}}
 				/>
 			</Tabs>
-		</AuthGate>
+		</>
 	);
 }

package/templates/mobile/hooks/use-auth.ts

@@ -10,7 +10,6 @@ interface AuthState {
 	isLoading: boolean;
 	signIn: (email: string, password: string) => Promise<void>;
 	signOut: () => Promise<void>;
-	registerPushToken: () => Promise<void>;
 }
 
 let authStateListeners: Array<() => void> = [];
@@ -19,7 +18,6 @@ let globalAuthState: AuthState = {
 	isLoading: true,
 	signIn: async () => {},
 	signOut: async () => {},
-	registerPushToken: async () => {},
 };
 
 function notifyListeners() {
@@ -35,10 +33,6 @@ export function useAuthInit() {
 	const [, setState] = useState<AuthState>(globalAuthState);
 
 	useEffect(() => {
-		import("../lib/notifications")
-			.then((m) => m.configureNotificationHandler())
-			.catch(() => {});
-
 		(async () => {
 			try {
 				const authenticated = await checkAuth();
@@ -104,24 +98,9 @@ export function useAuth(): AuthState {
 		notifyListeners();
 	}, []);
 
-	const registerPushToken = useCallback(async () => {
-		try {
-			const { registerForPushNotifications, registerDevice } = await import(
-				"../lib/notifications"
-			);
-			const token = await registerForPushNotifications();
-			if (token) {
-				await registerDevice(token);
-			}
-		} catch {
-			// Non-critical - don't block auth flow
-		}
-	}, []);
-
 	return {
 		...state,
 		signIn,
 		signOut,
-		registerPushToken,
 	};
 }

package/templates/mobile/package.json

@@ -18,8 +18,6 @@
 		"expo-auth-session": "~57.0.13",
 		"expo-constants": "~57.0.19",
 		"expo-crypto": "~57.0.3",
-		"expo-device": "~57.0.2",
-		"expo-notifications": "~57.0.21",
 		"expo-router": "~57.0.23",
 		"expo-secure-store": "~57.0.4",
 		"expo-status-bar": "~57.0.1",

package/templates/worker/package.json

@@ -26,8 +26,7 @@
 		"@usequark/quark-core": "^2.0.0",
 		"@usequark/quark-db": "workspace:*",
 		"@usequark/quark-jobs": "workspace:*",
-		"bullmq": "^6.3.8",
-		"jose": "^6.2.12"
+		"bullmq": "^6.3.8"
 	},
 	"devDependencies": {
 		"@types/node": "^26.6.2",

package/templates/worker/src/handlers/index.js

@@ -10,11 +10,9 @@ import {
 	handleSendWelcomeEmail,
 } from "./email.js";
 import { handleCleanupOrphanedFiles } from "./files.js";
-import { handleSendPushNotification } from "./push-notification.js";
 
 export const jobHandlers = {
 	[JOB_NAMES.SEND_WELCOME_EMAIL]: handleSendWelcomeEmail,
 	[JOB_NAMES.SEND_RESET_PASSWORD_EMAIL]: handleSendResetPasswordEmail,
 	[JOB_NAMES.CLEANUP_ORPHANED_FILES]: handleCleanupOrphanedFiles,
-	[JOB_NAMES.SEND_PUSH_NOTIFICATION]: handleSendPushNotification,
 };

package/templates/base-project/apps/web/src/app/api/device/register/route.js

@@ -1,57 +0,0 @@
-import { validateBody } from "@usequark/quark-core/core";
-import { prisma } from "@usequark/quark-db";
-import { NextResponse } from "next/server";
-import { z } from "zod";
-import { extractBearerPayload } from "../../../../lib/jwt";
-import { handleError } from "../../error-handler";
-
-const deviceRegisterSchema = z.object({
-	platform: z.enum(["ios", "android"]),
-	pushToken: z.string().min(1),
-	deviceId: z.string().min(1),
-});
-
-/**
- * POST /api/device/register
- * Register a mobile device for push notifications.
- * Requires authentication via Bearer token.
- */
-export async function POST(request) {
-	try {
-		const payload = await extractBearerPayload(request);
-		if (!payload?.sub) {
-			return NextResponse.json(
-				{ message: "Authentication required" },
-				{ status: 401 },
-			);
-		}
-
-		const userId = payload.sub;
-
-		const { platform, pushToken, deviceId } = await validateBody(
-			request,
-			deviceRegisterSchema,
-		);
-
-		// Upsert device record
-		await prisma.device.upsert({
-			where: {
-				userId_deviceId: { userId, deviceId },
-			},
-			update: {
-				pushToken,
-				platform,
-			},
-			create: {
-				userId,
-				platform,
-				pushToken,
-				deviceId,
-			},
-		});
-
-		return NextResponse.json({ success: true });
-	} catch (error) {
-		return handleError(error);
-	}
-}

package/templates/mobile/components/AuthGate.tsx

@@ -1,19 +0,0 @@
-import { type ReactNode, useEffect } from "react";
-import { useAuth } from "../hooks/use-auth";
-
-interface AuthGateProps {
-	children: ReactNode;
-}
-
-/**
- * Wraps authenticated screens and ensures push token is registered.
- */
-export function AuthGate({ children }: AuthGateProps) {
-	const { registerPushToken } = useAuth();
-
-	useEffect(() => {
-		registerPushToken();
-	}, [registerPushToken]);
-
-	return <>{children}</>;
-}

package/templates/mobile/lib/notifications.ts

@@ -1,77 +0,0 @@
-import { Platform } from "react-native";
-import { apiClient } from "./api-client";
-
-/**
- * Register the device push token with the backend.
- * Must be called after authentication.
- */
-export async function registerForPushNotifications(): Promise<string | null> {
-	const Device = await import("expo-device");
-	if (!Device.isDevice) {
-		return null;
-	}
-
-	const Notifications = await import("expo-notifications");
-
-	const { status: existingStatus } = await Notifications.getPermissionsAsync();
-	let finalStatus = existingStatus;
-
-	if (existingStatus !== "granted") {
-		const { status } = await Notifications.requestPermissionsAsync();
-		finalStatus = status;
-	}
-
-	if (finalStatus !== "granted") {
-		return null;
-	}
-
-	const tokenData = await Notifications.getExpoPushTokenAsync();
-	const pushToken = tokenData.data;
-
-	if (Platform.OS === "android") {
-		Notifications.setNotificationChannelAsync("default", {
-			name: "default",
-			importance: Notifications.AndroidImportance.MAX,
-			vibrationPattern: [0, 250, 250, 250],
-			lightColor: "#FF231F7C",
-		});
-	}
-
-	return pushToken;
-}
-
-/**
- * Send the push token to the backend for storage.
- */
-export async function registerDevice(pushToken: string): Promise<void> {
-	const { Platform: PlatformModule } = await import("react-native");
-	const Constants = await import("expo-constants");
-	const deviceId =
-		Constants.default?.installationId ||
-		Constants.default?.expoConfig?.extra?.eas?.projectId ||
-		"unknown";
-
-	await apiClient("/api/device/register", {
-		method: "POST",
-		body: JSON.stringify({
-			platform: PlatformModule.OS,
-			pushToken,
-			deviceId,
-		}),
-	});
-}
-
-/**
- * Configure foreground notification handling.
- */
-export async function configureNotificationHandler() {
-	const Notifications = await import("expo-notifications");
-	Notifications.setNotificationHandler({
-		handleNotification: async () => ({
-			shouldShowBanner: true,
-			shouldShowList: true,
-			shouldPlaySound: true,
-			shouldSetBadge: false,
-		}),
-	});
-}

package/templates/worker/src/handlers/push-notification.js

@@ -1,234 +0,0 @@
-/**
- * Push Notification Job Handler
- * Sends push notifications via APNs (iOS) and FCM (Android) directly.
- * No Firebase SDK — uses HTTP APIs with service account credentials from env.
- */
-
-import { AppError, ValidationError } from "@usequark/quark-core/errors";
-import { prisma } from "@usequark/quark-db";
-import { importPKCS8, SignJWT } from "jose";
-
-const APNS_KEY = process.env.APNS_KEY;
-const APNS_KEY_ID = process.env.APNS_KEY_ID;
-const APNS_TEAM_ID = process.env.APNS_TEAM_ID;
-const APNS_BUNDLE_ID = process.env.APNS_BUNDLE_ID;
-const APNS_USE_SANDBOX = process.env.APNS_USE_SANDBOX !== "false";
-
-const GCP_SERVICE_ACCOUNT = process.env.GCP_SERVICE_ACCOUNT;
-
-/**
- * Job handler for SEND_PUSH_NOTIFICATION
- * @param {import("bullmq").Job} bullJob
- * @param {import("@usequark/quark-core").Logger} logger
- */
-export async function handleSendPushNotification(bullJob, logger) {
-	const { userId, title, body: notificationBody, data } = bullJob.data;
-
-	if (!userId || !title || !notificationBody) {
-		throw new ValidationError("Missing required fields: userId, title, body");
-	}
-
-	// Fetch all devices for the user
-	const devices = await prisma.device.findMany({
-		where: { userId },
-		select: { pushToken: true, platform: true },
-	});
-
-	if (devices.length === 0) {
-		logger.warn("No devices found for user", { userId });
-		return { success: true, sent: 0, failed: 0 };
-	}
-
-	let sent = 0;
-	let failed = 0;
-
-	for (const device of devices) {
-		try {
-			if (device.platform === "ios") {
-				await sendAPNs(device.pushToken, title, notificationBody, data);
-				sent++;
-			} else if (device.platform === "android") {
-				await sendFCM(device.pushToken, title, notificationBody, data);
-				sent++;
-			}
-		} catch (error) {
-			logger.error("Failed to send push notification", {
-				error: error.message,
-				platform: device.platform,
-				token: device.pushToken.slice(0, 10),
-			});
-			failed++;
-		}
-	}
-
-	logger.info("Push notification batch complete", {
-		userId,
-		sent,
-		failed,
-		total: devices.length,
-	});
-
-	return { success: true, sent, failed };
-}
-
-/**
- * Generate APNs JWT token for authentication.
- */
-async function generateAPNsToken() {
-	if (!APNS_KEY || !APNS_KEY_ID || !APNS_TEAM_ID) {
-		throw new AppError(
-			"APNs credentials not configured (APNS_KEY, APNS_KEY_ID, APNS_TEAM_ID)",
-			500,
-			"APNS_NOT_CONFIGURED",
-		);
-	}
-
-	const privateKey = await importPKCS8(APNS_KEY, "ES256");
-	const now = Math.floor(Date.now() / 1000);
-
-	return new SignJWT({})
-		.setProtectedHeader({ alg: "ES256", kid: APNS_KEY_ID })
-		.setIssuedAt(now)
-		.setExpirationTime("1h")
-		.setIssuer(APNS_TEAM_ID)
-		.sign(privateKey);
-}
-
-/**
- * Send push notification via Apple Push Notification service (HTTP/2).
- */
-async function sendAPNs(token, title, body, data = {}) {
-	if (!APNS_KEY) {
-		throw new AppError("APNs not configured", 500, "APNS_NOT_CONFIGURED");
-	}
-
-	const jwt = await generateAPNsToken();
-	const host = APNS_USE_SANDBOX
-		? "api.sandbox.push.apple.com"
-		: "api.push.apple.com";
-
-	const payload = {
-		aps: {
-			alert: { title, body },
-			sound: "default",
-			"content-available": 1,
-		},
-		...data,
-	};
-
-	const response = await fetch(`https://${host}/3/device/${token}`, {
-		method: "POST",
-		headers: {
-			authorization: `bearer ${jwt}`,
-			"apns-topic": APNS_BUNDLE_ID || "",
-			"apns-push-type": "alert",
-			"apns-priority": "10",
-			"content-type": "application/json",
-		},
-		body: JSON.stringify(payload),
-	});
-
-	if (!response.ok) {
-		const errorBody = await response.text();
-		throw new AppError(
-			`APNs error ${response.status}: ${errorBody}`,
-			502,
-			"APNS_ERROR",
-		);
-	}
-}
-
-/**
- * Get a short-lived OAuth2 access token for FCM from a GCP service account.
- */
-async function getFCMAccessToken() {
-	if (!GCP_SERVICE_ACCOUNT) {
-		throw new AppError(
-			"GCP_SERVICE_ACCOUNT not configured",
-			500,
-			"FCM_NOT_CONFIGURED",
-		);
-	}
-
-	const serviceAccount = JSON.parse(GCP_SERVICE_ACCOUNT);
-	const now = Math.floor(Date.now() / 1000);
-
-	const privateKey = await importPKCS8(serviceAccount.private_key, "RS256");
-
-	const jwt = await new SignJWT({
-		scope: "https://www.googleapis.com/auth/firebase.messaging",
-	})
-		.setProtectedHeader({ alg: "RS256", kid: serviceAccount.private_key_id })
-		.setIssuedAt(now)
-		.setExpirationTime("1h")
-		.setIssuer(serviceAccount.client_email)
-		.setSubject(serviceAccount.client_email)
-		.audience("https://oauth2.googleapis.com/token")
-		.sign(privateKey);
-
-	const tokenResponse = await fetch("https://oauth2.googleapis.com/token", {
-		method: "POST",
-		headers: { "Content-Type": "application/x-www-form-urlencoded" },
-		body: new URLSearchParams({
-			grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
-			assertion: jwt,
-		}),
-	});
-
-	if (!tokenResponse.ok) {
-		const error = await tokenResponse.text();
-		throw new AppError(
-			`FCM token exchange failed: ${error}`,
-			502,
-			"FCM_TOKEN_EXCHANGE_FAILED",
-		);
-	}
-
-	const { access_token } = await tokenResponse.json();
-	return access_token;
-}
-
-/**
- * Send push notification via Firebase Cloud Messaging HTTP v1 API.
- */
-async function sendFCM(token, title, body, data = {}) {
-	const accessToken = await getFCMAccessToken();
-
-	const projectId = JSON.parse(GCP_SERVICE_ACCOUNT || "{}").project_id;
-	if (!projectId) {
-		throw new AppError(
-			"GCP project_id not found in service account",
-			500,
-			"FCM_NOT_CONFIGURED",
-		);
-	}
-
-	const message = {
-		token,
-		notification: { title, body },
-		data: Object.fromEntries(
-			Object.entries(data).map(([k, v]) => [k, String(v)]),
-		),
-	};
-
-	const response = await fetch(
-		`https://fcm.googleapis.com/v1/projects/${projectId}/messages:send`,
-		{
-			method: "POST",
-			headers: {
-				authorization: `Bearer ${accessToken}`,
-				"content-type": "application/json",
-			},
-			body: JSON.stringify({ message }),
-		},
-	);
-
-	if (!response.ok) {
-		const errorBody = await response.text();
-		throw new AppError(
-			`FCM error ${response.status}: ${errorBody}`,
-			502,
-			"FCM_ERROR",
-		);
-	}
-}