@usequark/quark-create-app 1.25.16 → 1.27.0

package/README.md

@@ -48,7 +48,7 @@ npx @usequark/quark-create-app@latest my-app
 npx @usequark/quark-create-app add jobs
 
 # Print an embedded skill for a feature
-npx @usequark/quark-create-app skill bookings
+npx @usequark/quark-create-app skill model
 
 # Update Quark packages in an existing project
 npx @usequark/quark-create-app update
@@ -95,7 +95,7 @@ npx @usequark/quark-create-app@latest my-app --no-prompts
 
 ### Packages
 
-Specify which optional packages to include (default: `ui,jobs`; valid: `ui`, `jobs`):
+Specify which optional packages to include (default: `ui,jobs`; valid: `ui`, `jobs`, `pwa` — `mobile` is added post-creation via `quark add mobile`):
 
 ```bash
 # Only include UI package
@@ -131,16 +131,13 @@ npx @usequark/quark-create-app@latest my-app --no-prompts --signup disabled
 Print an embedded skill for a feature:
 
 ```bash
-# Print the bookings skill
-npx @usequark/quark-create-app@latest skill bookings
-
 # Print a core skill (model, endpoint, dashboard)
 npx @usequark/quark-create-app@latest skill model
 npx @usequark/quark-create-app@latest skill endpoint
 npx @usequark/quark-create-app@latest skill dashboard
 ```
 
-Available skills: `model`, `endpoint`, `dashboard`, `bookings`, `crm`, `cms`, `ai`.
+Available skills: `model`, `endpoint`, `dashboard` (core workflows), plus the embedded domain skills shipped with every project (`payment`, `ecommerce` incl. catalog/cart/checkout, `i18n`). Domain verticals (`bookings`, `crm`, `cms`, `ai`) are built on demand via those workflows, not printed as named skills.
 
 ### Skip Installation Steps
 
@@ -189,8 +186,9 @@ npx @usequark/quark-create-app@latest my-app \
 # Lightweight template checks
 pnpm test
 
-# E2E scaffold simulation
-pnpm test:e2e
+# Full lifecycle E2E (scaffold -> build -> Docker -> migrate -> run). Phase 3
+# runs `pnpm build`, so a scaffolded import that does not compile fails here.
+pnpm test:e2e:full
 
 # Full build verification (opt-in)
 QUARK_CLI_BUILD_TEST=1 pnpm test:build

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usequark/quark-create-app",
-  "version": "1.25.16",
+  "version": "1.27.0",
   "description": "CLI to scaffold new Quark projects with Next.js, Prisma, BullMQ, and Railway deployment",
   "keywords": [
     "quark",

package/src/index.js

@@ -1363,6 +1363,13 @@ STORAGE_PROVIDER=local
 # RATE_LIMIT_WINDOW_MS=900000  # Window in ms (default: 15 minutes)
 # API_BODY_SIZE_LIMIT=2097152  # 2MB (default)
 # UPLOAD_SIZE_LIMIT=10485760   # 10MB proxy-level limit (default)
+# Rate-limit buckets key on <client-ip>:<path>, the client IP taken from the
+# proxy headers (left-most x-forwarded-for, then x-real-ip). Default (unset)
+# trusts those headers - the right choice behind a reverse proxy (Railway/
+# Docker/nginx) that overwrites them. Set to false when the app is exposed
+# directly, so a spoofed header cannot earn a fresh bucket; every client then
+# shares one bucket per route.
+# TRUST_PROXY_HEADERS=true
 
 # --- Logging & Cache ---
 # LOG_LEVEL=debug              # debug, info, warn, error (default: debug dev, info prod)
@@ -1936,6 +1943,58 @@ async function compareScaffoldManagedFiles(expectedDir, projectDir) {
 	};
 }
 
+/**
+ * Apply the mobile-specific edits `add mobile` makes to scaffold-managed ROOT
+ * files.
+ *
+ * `mobile` is a post-creation-only feature: `create` rejects it, so the
+ * reference scaffold `update --scaffold-check` builds can never carry these
+ * edits. Replaying them on the reference when the project has mobile installed
+ * scopes the byte comparison by installed feature instead of reporting the
+ * expected `EXPO_PUBLIC_API_URL` block as drift.
+ *
+ * This does not weaken drift detection: the edits are constants, so tampering
+ * with — or deleting — the mobile block in a project still differs from the
+ * reference and is still reported.
+ *
+ * Idempotent, and only writes a file when it actually changes it.
+ *
+ * @param {string} projectDir
+ */
+async function applyMobileScaffoldEdits(projectDir) {
+	const envExamplePath = path.join(projectDir, ".env.example");
+	if (await fs.pathExists(envExamplePath)) {
+		const envContent = await fs.readFile(envExamplePath, "utf-8");
+		if (!envContent.includes("EXPO_PUBLIC_API_URL")) {
+			await fs.writeFile(
+				envExamplePath,
+				`${envContent}\n# --- Mobile App ---\nEXPO_PUBLIC_API_URL=http://localhost:3000\n`,
+			);
+		}
+	}
+
+	const rootPkgPath = path.join(projectDir, "package.json");
+	if (!(await fs.pathExists(rootPkgPath))) return;
+
+	const scope = await detectProjectScope(projectDir);
+	if (!scope) return;
+
+	const rootPkg = await fs.readJSON(rootPkgPath);
+	rootPkg.scripts = rootPkg.scripts || {};
+	let changed = false;
+	if (!rootPkg.scripts["dev:mobile"]) {
+		rootPkg.scripts["dev:mobile"] = `pnpm --filter @${scope}/mobile start`;
+		changed = true;
+	}
+	if (!rootPkg.scripts["build:mobile"]) {
+		rootPkg.scripts["build:mobile"] = `pnpm --filter @${scope}/mobile export`;
+		changed = true;
+	}
+	if (changed) {
+		await fs.writeFile(rootPkgPath, `${JSON.stringify(rootPkg, null, "\t")}\n`);
+	}
+}
+
 async function createReferenceScaffold(projectDir, quarkLink) {
 	const projectName = quarkLink.projectName || path.basename(projectDir);
 	const linkedFeatures = resolveFeatureSelection(
@@ -2023,9 +2082,19 @@ async function createReferenceScaffold(projectDir, quarkLink) {
 		);
 	}
 
+	const expectedDir = path.join(tempRoot, projectName);
+
+	// `mobile` is post-creation only, so the subprocess above can never build its
+	// root edits (see scaffoldFeatures). Replay them onto the reference when the
+	// project has mobile installed so the mobile block reads as expected, not as
+	// drift.
+	if (comparisonFeatures.includes("mobile")) {
+		await applyMobileScaffoldEdits(expectedDir);
+	}
+
 	return {
 		tempRoot,
-		expectedDir: path.join(tempRoot, projectName),
+		expectedDir,
 		linkedFeatures,
 		detectedFeatures,
 		comparisonFeatures,
@@ -2390,35 +2459,11 @@ program
 							scope,
 						);
 
-						// Add EXPO_PUBLIC_API_URL to .env.example
-						const envExamplePath = path.join(projectDir, ".env.example");
-						if (await fs.pathExists(envExamplePath)) {
-							let envContent = await fs.readFile(envExamplePath, "utf-8");
-							if (!envContent.includes("EXPO_PUBLIC_API_URL")) {
-								envContent +=
-									"\n# --- Mobile App ---\nEXPO_PUBLIC_API_URL=http://localhost:3000\n";
-								await fs.writeFile(envExamplePath, envContent);
-							}
-						}
-
-						// Add mobile scripts to root package.json
-						const rootPkgPath = path.join(projectDir, "package.json");
-						if (await fs.pathExists(rootPkgPath)) {
-							const rootPkg = await fs.readJSON(rootPkgPath);
-							rootPkg.scripts = rootPkg.scripts || {};
-							if (!rootPkg.scripts["dev:mobile"]) {
-								rootPkg.scripts["dev:mobile"] =
-									`pnpm --filter @${scope}/mobile start`;
-							}
-							if (!rootPkg.scripts["build:mobile"]) {
-								rootPkg.scripts["build:mobile"] =
-									`pnpm --filter @${scope}/mobile export`;
-							}
-							await fs.writeFile(
-								rootPkgPath,
-								`${JSON.stringify(rootPkg, null, "\t")}\n`,
-							);
-						}
+						// Mobile-specific root edits (`.env.example` +
+						// dev:mobile/build:mobile scripts). Shared with the reference
+						// scaffold so `update --scaffold-check` can reproduce them —
+						// see applyMobileScaffoldEdits.
+						await applyMobileScaffoldEdits(projectDir);
 
 						console.log(
 							chalk.green("    ✓ Mobile app scaffolded (apps/mobile)"),

package/templates/base-project/apps/web/.env.example

@@ -102,6 +102,16 @@ ADMIN_PASSWORD=SET_ME
 # Leave unset in development - the endpoint is unprotected by default.
 # METRICS_TOKEN=replace_with_a_long_random_secret
 
+# --- Rate Limiting & Security ---
+# Rate-limit buckets are keyed on the client IP taken from the proxy headers
+# (left-most x-forwarded-for, then x-real-ip). Proxy headers are client-supplied
+# and only an identity when a reverse proxy overwrites them on every request.
+# Default (unset) trusts them - correct behind Railway/Docker/nginx.
+# Set to false when the app is reachable directly: the headers are then ignored
+# and every client shares one bucket per route, so a spoofed x-forwarded-for
+# cannot earn a fresh bucket. Boolean-like: true/false/1/0/yes/no/on/off.
+# TRUST_PROXY_HEADERS=true
+
 # --- File Storage ---
 # Default: local filesystem (./uploads). No further config needed for development.
 STORAGE_PROVIDER=local

package/templates/base-project/apps/web/src/app/api/auth/apple/route.js

@@ -5,6 +5,8 @@ import { user } from "@usequark/quark-db";
 import { importJWK, jwtVerify } from "jose";
 import { NextResponse } from "next/server";
 import { z } from "zod";
+import { isEmailVerificationRequired } from "../../../../lib/auth-email-verification";
+import { isEmailVerified } from "../../../../lib/email-verified";
 import { issueTokenPair } from "../../../../lib/jwt";
 import { handleError } from "../../error-handler";
 
@@ -122,6 +124,28 @@ export async function POST(request) {
 			);
 		}
 
+		// An unverified address proves nothing about who controls the inbox, and
+		// this route creates the account on first sight — so without this check the
+		// confirmation that is supposed to establish ownership of the address is
+		// the attacker's to skip rather than the victim's to perform.
+		//
+		// It sits after the missing-email `400` on purpose, matching the Google
+		// route's ordering: that response describes the shape of the token rather
+		// than reporting that the token was refused. What matters for security is
+		// the position relative to the database: the check lands before
+		// `findByEmail`, so an unverified address can never become a registration
+		// or existence oracle. Governed by `REQUIRE_EMAIL_VERIFICATION` like every
+		// other sign-in path — `false` restores the pre-gate behaviour.
+		if (
+			isEmailVerificationRequired() &&
+			!isEmailVerified(payload.email_verified)
+		) {
+			return NextResponse.json(
+				{ message: "Invalid Apple token" },
+				{ status: 401 },
+			);
+		}
+
 		// Find or create user
 		let existingUser = await user.findByEmail(appleEmail);
 		if (!existingUser) {

package/templates/base-project/apps/web/src/app/api/auth/forgot-password/route.js

@@ -0,0 +1,57 @@
+import {
+	createLogger,
+	validateBody,
+	withCsrfProtection,
+} from "@usequark/quark-core/core";
+import { user } from "@usequark/quark-db";
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { sendResetPasswordEmail } from "@/lib/send-reset-password-email";
+import { handleError } from "../../error-handler";
+
+const logger = createLogger("auth:forgot-password");
+
+const forgotPasswordSchema = z.object({
+	email: z.string().email("Invalid email address"),
+});
+
+/**
+ * The response for every request, registered address or not.
+ *
+ * Replying differently for unknown addresses turns this route into an
+ * email-enumeration oracle: the difference between "no such user" and "check
+ * your inbox" is exactly the information a spammer or a spear-phisher is
+ * probing for. The same 200 with the same body is also what the rate limiter
+ * needs — a distinguishable error path would let an attacker distinguish
+ * "limited" from "not a valid address" from the outside.
+ */
+const NEUTRAL_RESPONSE = {
+	message: "If that email address has an account, a reset link is on its way.",
+};
+
+export const POST = withCsrfProtection(async (request) => {
+	try {
+		const { email } = await validateBody(request, forgotPasswordSchema);
+
+		const account = await user.findByEmail(email);
+
+		if (account) {
+			try {
+				await sendResetPasswordEmail(account);
+			} catch (error) {
+				// The address exists; the answer must still be the neutral one. A
+				// failure here is operational (token issue or queue down), so it is
+				// logged where an operator can see it and deliberately not surfaced
+				// to the caller.
+				logger.error("Failed to send password reset email", {
+					userId: account.id,
+					message: error?.message ?? String(error),
+				});
+			}
+		}
+
+		return NextResponse.json(NEUTRAL_RESPONSE);
+	} catch (error) {
+		return handleError(error);
+	}
+});

package/templates/base-project/apps/web/src/app/api/auth/google/route.js

@@ -6,6 +6,7 @@ import { validateBody } from "@usequark/quark-core/core";
 import { user } from "@usequark/quark-db";
 import { NextResponse } from "next/server";
 import { z } from "zod";
+import { isEmailVerificationRequired } from "../../../../lib/auth-email-verification";
 import { isEmailVerified } from "../../../../lib/email-verified";
 import { issueTokenPair } from "../../../../lib/jwt";
 import { handleError } from "../../error-handler";
@@ -85,7 +86,10 @@ export async function POST(request) {
 		// read for what it is. What matters for security is the position relative
 		// to the database: both checks land before `findByEmail`, so an unverified
 		// address can never become a registration or existence oracle.
-		if (!isEmailVerified(tokenInfo.email_verified)) {
+		if (
+			isEmailVerificationRequired() &&
+			!isEmailVerified(tokenInfo.email_verified)
+		) {
 			return NextResponse.json(
 				{ message: "Invalid Google token" },
 				{ status: 401 },

package/templates/base-project/apps/web/src/app/api/auth/refresh/route.js

@@ -1,4 +1,5 @@
 import { createLogger, validateBody } from "@usequark/quark-core/core";
+import { user as userQueries } from "@usequark/quark-db";
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { issueTokenPair, verifyMobileToken } from "../../../../lib/jwt";
@@ -10,9 +11,29 @@ const refreshRequestSchema = z.object({
 	refreshToken: z.string().min(1),
 });
 
+/**
+ * The one response every refused refresh gets.
+ *
+ * A deleted account, a password reset, a forged signature and an expired token
+ * are indistinguishable to the caller: they share a status and a body, so a
+ * probing client cannot learn which check failed.
+ */
+function invalidRefreshToken() {
+	return NextResponse.json(
+		{ message: "Invalid or expired refresh token" },
+		{ status: 401 },
+	);
+}
+
 /**
  * POST /api/auth/refresh
  * Exchange a refresh token for a new access token.
+ *
+ * A refresh token lives for 30 days, so the identity it was minted with cannot
+ * be trusted for that long. This re-reads the current id, email, name and role
+ * from the user's row on every exchange — the same revocation contract
+ * `validateSessionToken` applies to web sessions — and refuses the exchange
+ * when the account is gone or its password changed after the token was issued.
  */
 export async function POST(request) {
 	try {
@@ -21,10 +42,7 @@ export async function POST(request) {
 		const payload = await verifyMobileToken(refreshToken);
 		if (!payload) {
 			logger.warn("Invalid refresh token");
-			return NextResponse.json(
-				{ message: "Invalid or expired refresh token" },
-				{ status: 401 },
-			);
+			return invalidRefreshToken();
 		}
 
 		if (payload.type !== "refresh") {
@@ -34,11 +52,42 @@ export async function POST(request) {
 			);
 		}
 
+		// A genuine refresh token always carries `sub`; refuse anything else
+		// rather than handing `undefined` to the query layer.
+		if (typeof payload.sub !== "string" || payload.sub.length === 0) {
+			logger.warn("Refresh token has no subject");
+			return invalidRefreshToken();
+		}
+
+		const account = await userQueries.findById(payload.sub);
+		if (!account) {
+			// Deleted (or otherwise removed) between issue and exchange. Without
+			// this read the route would keep minting access tokens for a ghost.
+			logger.warn("Refresh token for an account that no longer exists");
+			return invalidRefreshToken();
+		}
+
+		// Mirrors `validateSessionToken`: a password reset stamps
+		// `passwordChangedAt`, and any token issued before that instant is dead.
+		// `iat` is whole seconds; comparing against the millisecond stamp as a
+		// fraction keeps a change in the same second from leaking a token.
+		if (
+			account.passwordChangedAt &&
+			typeof payload.iat === "number" &&
+			account.passwordChangedAt.getTime() / 1000 > payload.iat
+		) {
+			logger.warn("Refresh token issued before the password changed");
+			return invalidRefreshToken();
+		}
+
+		// The claims come from the row, never from the token: a 30-day-old
+		// `role` (or any stale profile field) must not be re-stamped onto a fresh
+		// access token.
 		const { token } = await issueTokenPair({
-			id: payload.sub,
-			email: payload.email,
-			name: payload.name,
-			role: payload.role,
+			id: account.id,
+			email: account.email,
+			name: account.name,
+			role: account.role,
 		});
 
 		return NextResponse.json({ token });

package/templates/base-project/apps/web/src/app/api/auth/register/route.js

@@ -1,11 +1,18 @@
 import { hashPassword } from "@usequark/quark-core/auth";
-import { validateBody, withCsrfProtection } from "@usequark/quark-core/core";
+import {
+	createLogger,
+	validateBody,
+	withCsrfProtection,
+} from "@usequark/quark-core/core";
 import { user, userRegisterSchema } from "@usequark/quark-db";
 import { NextResponse } from "next/server";
 import { isSignupEnabled } from "@/lib/auth-signup";
 import { enqueueWelcomeEmail } from "@/lib/enqueue-welcome-email";
+import { sendVerificationEmail } from "@/lib/send-verification-email";
 import { handleError } from "../../error-handler";
 
+const logger = createLogger("auth:register");
+
 export const POST = withCsrfProtection(async (request) => {
 	if (!isSignupEnabled()) {
 		return NextResponse.json(
@@ -51,6 +58,18 @@ export const POST = withCsrfProtection(async (request) => {
 			// Non-critical - user is created even if email fails to enqueue
 		}
 
+		// Issue and enqueue the email-verification link. Equally non-fatal: the
+		// account exists either way, and an unverified address is not (yet) a
+		// gated account — it just has no confirmation on file.
+		try {
+			await sendVerificationEmail(newUser);
+		} catch (error) {
+			logger.error("Failed to send verification email", {
+				userId: newUser.id,
+				message: error?.message ?? String(error),
+			});
+		}
+
 		return NextResponse.json(safeUser, { status: 201 });
 	} catch (error) {
 		return handleError(error);

package/templates/base-project/apps/web/src/app/api/auth/reset-password/route.js

@@ -0,0 +1,105 @@
+import { hashPassword, hashToken } from "@usequark/quark-core/auth";
+import { validateBody, withCsrfProtection } from "@usequark/quark-core/core";
+import { ValidationError } from "@usequark/quark-core/errors";
+import { passwordSchema, user, verificationToken } from "@usequark/quark-db";
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { handleError } from "../../error-handler";
+
+const resetPasswordSchema = z.object({
+	token: z.string().min(1, "A reset token is required"),
+	password: passwordSchema,
+});
+
+/**
+ * The message used for every refused reset: unknown token, expired token, or
+ * account gone. An attacker probing a stolen link learns nothing from which
+ * wording comes back, because they are the same.
+ */
+const UNUSABLE_LINK_MESSAGE =
+	"This reset link is invalid or has expired. Request a new one.";
+
+/**
+ * Loads the token row for a presented token, or null when there is none usable.
+ *
+ * The row is found by the SHA-256 digest, never by the raw value — that is the
+ * entire point of storing the digest in the first place. Expiry is checked
+ * here so both GET and POST agree on what "usable" means, and so a consumed
+ * (deleted) token is indistinguishable from one that never existed.
+ *
+ * @param {string | null} rawToken - The token from the link's query string.
+ * @returns {Promise<object | null>} The `VerificationToken` row, or null.
+ */
+async function resolveToken(rawToken) {
+	if (!rawToken) return null;
+
+	const record = await verificationToken.findByToken(hashToken(rawToken));
+	if (!record) return null;
+	if (record.expires.getTime() <= Date.now()) return null;
+
+	return record;
+}
+
+/**
+ * Answers whether a link is still usable, so the reset page can render the form
+ * or an error before the user types a new password into a dead form.
+ *
+ * GET is safe (no state change) and so is not CSRF-protected; the lookup is a
+ * single indexed primary-key read.
+ */
+export async function GET(request) {
+	try {
+		const token = new URL(request.url).searchParams.get("token");
+		const record = await resolveToken(token);
+
+		return NextResponse.json(
+			{ valid: Boolean(record) },
+			{ status: record ? 200 : 400 },
+		);
+	} catch (error) {
+		return handleError(error);
+	}
+}
+
+export const POST = withCsrfProtection(async (request) => {
+	try {
+		const { token, password } = await validateBody(
+			request,
+			resetPasswordSchema,
+		);
+		const record = await resolveToken(token);
+
+		if (!record) {
+			throw new ValidationError(UNUSABLE_LINK_MESSAGE);
+		}
+
+		const account = await user.findByEmail(record.identifier);
+		if (!account) {
+			// The account was deleted after the link was issued. The link is dead
+			// either way; burn the token so it cannot be tried a second time.
+			await verificationToken.deleteByIdentifier(record.identifier);
+			throw new ValidationError(UNUSABLE_LINK_MESSAGE);
+		}
+
+		const hashedPassword = await hashPassword(password);
+		await user.update(account.id, {
+			password: hashedPassword,
+			// Stamping the change is what reaches every live session even though
+			// both are self-contained tokens: `validateSessionToken` refuses a web
+			// JWT issued before this instant, and `POST /api/auth/refresh` refuses
+			// a mobile refresh token issued before it — so a password known to an
+			// attacker stops working the moment it is replaced.
+			passwordChangedAt: new Date(),
+		});
+
+		// Single-use: the token dies with the reset it performed. Replaying the
+		// same link must not overwrite the new password with another.
+		await verificationToken.deleteByIdentifier(account.email);
+
+		return NextResponse.json({
+			message: "Your password has been updated. You can now sign in.",
+		});
+	} catch (error) {
+		return handleError(error);
+	}
+});

package/templates/base-project/apps/web/src/app/api/auth/verify-email/route.js

@@ -0,0 +1,58 @@
+import { getAppUrl } from "@usequark/quark-config";
+import { hashToken } from "@usequark/quark-core/auth";
+import { createLogger } from "@usequark/quark-core/core";
+import { user, verificationToken } from "@usequark/quark-db";
+import { NextResponse } from "next/server";
+
+const logger = createLogger("auth:verify-email");
+
+/**
+ * Redeems an emailed verification link.
+ *
+ * A GET performs the state change because that is the shape of an emailed
+ * link — a mail client fetches it by navigation, not by posting JSON. The
+ * consequence is a bearer link: whoever holds it can confirm the address, so
+ * the same threat model as the reset flow applies — the token is 256 bits of
+ * randomness, stored only as a SHA-256 digest, and single-use.
+ *
+ * Outcomes funnel into the sign-in page through `?verified=`:
+ *   - `1`      - address confirmed (or already confirmed)
+ *   - `invalid` - no token, expired, consumed, or the account is gone
+ *   - `error`  - something broke server-side; logged, and the caller still
+ *     lands somewhere useful rather than on a bare 500
+ */
+export async function GET(request) {
+	const base = getAppUrl();
+
+	try {
+		const token = new URL(request.url).searchParams.get("token");
+		const record = token
+			? await verificationToken.findByToken(hashToken(token))
+			: null;
+
+		if (!record || record.expires.getTime() <= Date.now()) {
+			return NextResponse.redirect(`${base}/auth/signin?verified=invalid`);
+		}
+
+		const account = await user.findByEmail(record.identifier);
+		if (!account) {
+			// The account is gone; the confirmation would be for nobody. Burn the
+			// token and refuse rather than leaving a live link sitting in an
+			// inbox.
+			await verificationToken.deleteByIdentifier(record.identifier);
+			return NextResponse.redirect(`${base}/auth/signin?verified=invalid`);
+		}
+
+		if (!account.emailVerified) {
+			await user.update(account.id, { emailVerified: new Date() });
+		}
+		await verificationToken.deleteByIdentifier(account.email);
+
+		return NextResponse.redirect(`${base}/auth/signin?verified=1`);
+	} catch (error) {
+		logger.error("Email verification failed", {
+			message: error?.message ?? String(error),
+		});
+		return NextResponse.redirect(`${base}/auth/signin?verified=error`);
+	}
+}