@usequark/quark-create-app 1.25.4 → 1.25.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usequark/quark-create-app",
-  "version": "1.25.4",
+  "version": "1.25.6",
   "description": "CLI to scaffold new Quark projects with Next.js, Prisma, BullMQ, and Railway deployment",
   "keywords": [
     "quark",

package/src/deploy/discovery.js

@@ -3,6 +3,7 @@ import path from "node:path";
 import {
 	QUARK_DEPLOY_PROJECT_KIND,
 	QUARK_SERVICE_CONTRACTS,
+	QUARK_SERVICE_KINDS,
 	SUPPORTED_QUARK_SERVICE_KINDS,
 } from "./contract.js";
 
@@ -10,6 +11,17 @@ export const QUARK_DEPLOY_DIAGNOSTIC_CODES = Object.freeze({
 	MISSING_REQUIRED_SERVICE: "missing_required_service",
 });
 
+/**
+ * Codes for conditions that do not block a deploy but are worth saying out loud.
+ *
+ * Kept separate from DIAGNOSTIC_CODES because `resolveQuarkDeployProject` throws on
+ * any diagnostic, and a worker-less project is a legitimate choice — `jobs` is an
+ * optional scaffold feature. Failing the deploy would punish a valid configuration.
+ */
+export const QUARK_DEPLOY_WARNING_CODES = Object.freeze({
+	MISSING_WORKER_SERVICE: "missing_worker_service",
+});
+
 function resolveProjectPath(projectDir, relativePath) {
 	return path.join(projectDir, ...relativePath.split("/"));
 }
@@ -37,6 +49,17 @@ function createMissingRequiredServiceDiagnostic(serviceContract) {
 	};
 }
 
+function createMissingWorkerWarning() {
+	return {
+		code: QUARK_DEPLOY_WARNING_CODES.MISSING_WORKER_SERVICE,
+		serviceKind: "worker",
+		required: false,
+		expectedPath: QUARK_SERVICE_CONTRACTS.worker.relativePackageJsonPath,
+		message:
+			"No Quark worker service found. Scheduled jobs will not run — including CLEANUP_ORPHANED_FILES, which is the only thing that sweeps the File rows left orphaned when a user is deleted (onDelete: SetNull keeps the rows and the blobs). Those rows and blobs accumulate indefinitely. Add the jobs feature (`npx @usequark/quark-create-app add jobs`) if this project uploads files.",
+	};
+}
+
 function createDiscoveredService(projectDir, serviceContract, packageJson) {
 	return {
 		kind: serviceContract.kind,
@@ -68,6 +91,9 @@ export function formatQuarkDeployDiagnostics(diagnostics) {
 export async function discoverQuarkDeployProject(projectDir) {
 	const services = [];
 	const diagnostics = [];
+	const warnings = [];
+	let sawWeb = false;
+	let sawWorker = false;
 
 	for (const serviceKind of SUPPORTED_QUARK_SERVICE_KINDS) {
 		const serviceContract = QUARK_SERVICE_CONTRACTS[serviceKind];
@@ -85,16 +111,26 @@ export async function discoverQuarkDeployProject(projectDir) {
 			continue;
 		}
 
+		if (serviceKind === QUARK_SERVICE_KINDS.WEB) sawWeb = true;
+		if (serviceKind === QUARK_SERVICE_KINDS.WORKER) sawWorker = true;
+
 		services.push(
 			createDiscoveredService(projectDir, serviceContract, packageJson),
 		);
 	}
 
+	// A web project with no worker is valid — `jobs` is optional — but the orphaned
+	// file cleanup only runs there, so say so rather than letting it fail silently.
+	if (sawWeb && !sawWorker) {
+		warnings.push(createMissingWorkerWarning());
+	}
+
 	return {
 		kind: QUARK_DEPLOY_PROJECT_KIND,
 		rootDir: projectDir,
 		services,
 		diagnostics,
+		warnings,
 	};
 }
 

package/src/deploy/inspect.js

@@ -45,13 +45,23 @@ export async function inspectProject(options = {}) {
 
 	// --- Diagnostics ---
 	if (discovery.diagnostics.length > 0) {
-		output(chalk.yellow("  Diagnostics\n"));
+		output(chalk.yellow("  Diagnostics"));
 		for (const diagnostic of discovery.diagnostics) {
 			output(`  ${chalk.yellow("⚠")} ${diagnostic.message}`);
 		}
 		output();
 	}
 
+	// --- Warnings ---
+	// Non-blocking, so printed after diagnostics and separately from them.
+	if (discovery.warnings.length > 0) {
+		output(chalk.yellow("  Warnings"));
+		for (const warning of discovery.warnings) {
+			output(`  ${chalk.yellow("⚠")} ${warning.message}`);
+		}
+		output();
+	}
+
 	// --- Railway readiness ---
 	output(chalk.cyan("  Railway Readiness\n"));
 

package/src/index.js

@@ -10,6 +10,7 @@ import { execa } from "execa";
 import fs from "fs-extra";
 import prompts from "prompts";
 import { SCAFFOLD_GITIGNORE } from "./scaffold-gitignore.js";
+import { warnIfJobsOmitted } from "./scaffold-warning.js";
 import { findEnclosingGitRepo, formatProjectDisplayName } from "./utils.js";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -611,7 +612,7 @@ program
 	)
 	.option(
 		"--packages <packages>",
-		"Comma-separated list of optional packages to include (ui,jobs,pwa)",
+		"Comma-separated optional packages to include (ui,jobs,pwa). db, config, ui always scaffolded. Mobile is post-creation: quark add mobile",
 	)
 	.option(
 		"--prompt <prompt>",
@@ -952,6 +953,8 @@ program
 						`  Selected packages: ${features.join(", ") || "none"} (non-interactive mode)`,
 					),
 				);
+
+				warnIfJobsOmitted(features);
 			} else if (!options.prompts) {
 				// Use defaults when --no-prompts is set without --packages
 				console.log(chalk.cyan("\n  🎯 Configuring optional packages..."));
@@ -1014,6 +1017,8 @@ program
 
 				features = resolveFeatureSelection(selectedFeatures);
 
+				warnIfJobsOmitted(features);
+
 				const requestedFeatures = [...selectedFeatures];
 				const autoIncluded = features.filter(
 					(feature) => !requestedFeatures.includes(feature),

package/src/scaffold-warning.js

@@ -0,0 +1,39 @@
+import chalk from "chalk";
+
+/**
+ * Warn when the `jobs` feature was not selected for a scaffold.
+ *
+ * `File.uploadedBy` is `onDelete: SetNull`, so deleting a user orphans their file
+ * rows rather than removing them. `CLEANUP_ORPHANED_FILES` is the only thing that
+ * sweeps those rows and their blobs, and it runs in the worker — which is scaffolded
+ * only alongside `jobs`. Declining `jobs` therefore leaves orphaned rows and blobs
+ * accumulating indefinitely, with nothing reading `uploadedById = null` to surface
+ * them.
+ *
+ * Said at the point of the decision rather than discovered in production. It is a
+ * warning and not a refusal: `jobs` is optional and a project with no uploads has no
+ * orphan problem.
+ *
+ * @param {string[]} features - Resolved feature list for the scaffold.
+ * @returns {boolean} Whether the warning was printed.
+ */
+export function warnIfJobsOmitted(features, log = console.log) {
+	if (features.includes("jobs")) return false;
+
+	log(
+		chalk.yellow(
+			`    ⚠ Background jobs omitted: the orphaned-file cleanup will not exist.`,
+		),
+	);
+	log(
+		chalk.dim(
+			`      Deleting a user leaves their uploaded files orphaned in storage — the schema\n      keeps the rows rather than removing them — and without a worker nothing sweeps them.`,
+		),
+	);
+	log(
+		chalk.dim(
+			`      Add it later with: npx @usequark/quark-create-app add jobs\n`,
+		),
+	);
+	return true;
+}

package/templates/base-project/apps/web/package.json

@@ -25,7 +25,7 @@
 		"@usequark/quark-ui": "workspace:*",
 		"ioredis": "^6.0.0",
 		"jose": "^6.2.12",
-		"next": "16.3.6",
+		"next": "16.3.8",
 		"next-auth": "5.0.0-beta.32",
 		"pg": "^8.23.0",
 		"react": "19.3.0",

package/templates/base-project/apps/web/src/app/api/csrf/route.js

@@ -6,21 +6,32 @@
 
 import { generateCsrfToken } from "@usequark/quark-core";
 import { NextResponse } from "next/server";
-import { auth } from "@/lib/auth";
 import { getCsrfCookieOptions } from "@/lib/csrf-cookie";
 
+/**
+ * Headers applied to every response.
+ *
+ * `no-store` is load-bearing, not hygiene. The body of this response *is* a
+ * write credential: paired with the cookie it sets, it authorises the holder's
+ * next mutating request. A shared cache that stored it could hand the token to
+ * a second caller, who would then be able to write as the first — so this
+ * response must never be cached, by the browser or anything between it and the
+ * client. `Vary: Cookie` keeps that true for a cache that keys on request
+ * headers rather than obeying `no-store` outright.
+ */
+const NO_STORE_HEADERS = {
+	"Cache-Control": "no-store, no-cache, must-revalidate",
+	Vary: "Cookie",
+};
+
 export async function GET(request) {
 	try {
-		const session = await auth();
-
-		if (!session) {
-			return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
-		}
-
-		// Generate CSRF token
 		const csrfToken = generateCsrfToken();
 
-		const response = NextResponse.json({ csrfToken });
+		const response = NextResponse.json(
+			{ csrfToken },
+			{ headers: NO_STORE_HEADERS },
+		);
 
 		// Store the token in a secure HTTP-only cookie so the server can
 		// validate it on subsequent state-changing requests.
@@ -34,7 +45,7 @@ export async function GET(request) {
 	} catch (_error) {
 		return NextResponse.json(
 			{ error: "Failed to generate CSRF token" },
-			{ status: 500 },
+			{ status: 500, headers: NO_STORE_HEADERS },
 		);
 	}
 }

package/templates/base-project/apps/web/src/app/api/users/[id]/route.js

@@ -1,4 +1,8 @@
-import { validateBody, withCsrfProtection } from "@usequark/quark-core";
+import {
+	ConflictError,
+	validateBody,
+	withCsrfProtection,
+} from "@usequark/quark-core";
 import { user, userUpdateSchema } from "@usequark/quark-db";
 import { NextResponse } from "next/server";
 import { requireRole } from "@/lib/auth-middleware";
@@ -36,11 +40,33 @@ export const PATCH = withCsrfProtection(async (request, { params }) => {
 	}
 });
 
+/**
+ * DELETE /api/users/[id]
+ * Delete a user. Admin only.
+ *
+ * Self-deletion is refused. The route resolves its target purely from the path
+ * segment and otherwise only checks the caller's role, so an admin could delete
+ * their own row — and if they were the last admin, leave the deployment with no
+ * way to administer it. Refusing here rather than warning is deliberate: the
+ * request cannot succeed without leaving either the caller or the deployment
+ * locked out, so there is no outcome the caller would want.
+ *
+ * This guard is per-request, not a check on the remaining admin count. Two
+ * concurrent deletes of the two last admins can still both pass it. Enforcing
+ * that invariant needs a transaction around the count and the delete, which is a
+ * larger change than this endpoint's current shape supports.
+ */
 export const DELETE = withCsrfProtection(async (_request, { params }) => {
 	try {
-		await requireRole("admin");
+		const session = await requireRole("admin");
 		const { id } = await params;
 
+		if (session?.user?.id === id) {
+			throw new ConflictError(
+				"You cannot delete the account you are signed in as",
+			);
+		}
+
 		const existingUser = await user.findById(id);
 		if (!existingUser) {
 			return NextResponse.json({ message: "User not found" }, { status: 404 });

package/templates/base-project/apps/web/src/app/auth/register/RegisterPageClient.js

@@ -1,5 +1,6 @@
 "use client";
 
+import { clearCsrfToken, getCsrfToken } from "@usequark/quark-core/csrf-client";
 import {
 	Button,
 	ErrorBanner,
@@ -98,16 +99,55 @@ function RegisterForm() {
 		setPasswordError("");
 		setLoading(true);
 
-		const res = await fetch("/api/auth/register", {
+		// The CSRF token has to be in hand before the write. `GET /api/csrf` sets
+		// the matching httpOnly cookie and returns the same value; the server
+		// compares the two, so a request that arrives without the cookie is
+		// rejected before the handler runs. This page is pre-authentication, which
+		// is why the endpoint mints tokens for callers with no session.
+		//
+		// Both the token fetch and the write can fail on the network, and this
+		// handler has already set `loading`. Without a catch, either one would
+		// leave the button spinning forever.
+		try {
+			const res = await postRegistration(await getCsrfToken());
+
+			// The cache refetches on a timer, which covers expiry. It cannot cover
+			// the server rotating the cookie underneath us — a sign-out, or anything
+			// else that clears cookies — and that surfaces as a rejected write with
+			// nothing visibly wrong. Drop the stale token and try once more; a
+			// second failure is a real failure and falls through to the banner.
+			if (res.status === 401) {
+				clearCsrfToken();
+				return await completeRegistration(
+					await postRegistration(await getCsrfToken()),
+				);
+			}
+
+			return await completeRegistration(res);
+		} catch {
+			setError("Could not reach the server. Try again.");
+			setLoading(false);
+		}
+	}
+
+	/** POST the form to /api/auth/register with the given token. */
+	async function postRegistration(csrfToken) {
+		return await fetch("/api/auth/register", {
 			method: "POST",
-			headers: { "Content-Type": "application/json" },
+			headers: {
+				"Content-Type": "application/json",
+				"X-CSRF-Token": csrfToken,
+			},
 			body: JSON.stringify({
 				email: email.trim(),
 				password,
 				name: name.trim() || undefined,
 			}),
 		});
+	}
 
+	/** Surface a failure, or sign the new account in. */
+	async function completeRegistration(res) {
 		if (!res.ok) {
 			const body = await res.json().catch(() => ({}));
 			setError(body.message || "Registration failed. Try again.");

package/templates/base-project/packages/db/prisma/migrations/20260202061128_initial/migration.sql

@@ -101,7 +101,8 @@ CREATE TABLE "File" (
 -- CreateTable
 CREATE TABLE "AuditLog" (
     "id" TEXT NOT NULL,
-    "userId" TEXT NOT NULL,
+    "userId" TEXT,
+    "actorEmail" TEXT,
     "action" TEXT NOT NULL,
     "entity" TEXT NOT NULL,
     "entityId" TEXT NOT NULL,
@@ -198,5 +199,5 @@ ALTER TABLE "Session" ADD CONSTRAINT "Session_userId_fkey" FOREIGN KEY ("userId"
 ALTER TABLE "File" ADD CONSTRAINT "File_uploadedById_fkey" FOREIGN KEY ("uploadedById") REFERENCES "User"("id") ON DELETE SET NULL ON UPDATE CASCADE;
 
 -- AddForeignKey
-ALTER TABLE "AuditLog" ADD CONSTRAINT "AuditLog_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "AuditLog" ADD CONSTRAINT "AuditLog_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE SET NULL ON UPDATE CASCADE;
 

package/templates/base-project/packages/db/prisma/schema.prisma

@@ -141,18 +141,28 @@ model File {
 }
 
 // Audit Log Model
+//
+// `userId` is nullable and SetNull, not Cascade. An audit record that is deleted
+// along with the user it describes cannot serve as an audit trail — and deleting a
+// user destroys the rows recording what that user did, including the rows recording
+// the deletion itself.
+//
+// `actorEmail` snapshots the actor's address at write time. With SetNull alone the
+// row survives but stops naming who acted, so a trail that outlives its actor would
+// be unattributable. The snapshot keeps the record readable on its own terms.
 model AuditLog {
-  id        String   @id @default(cuid())
-  userId    String
-  action    String
-  entity    String
-  entityId  String
-  changes   Json?
-  metadata  Json?
-  createdAt DateTime @default(now())
-  updatedAt DateTime @updatedAt
-
-  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+  id          String   @id @default(cuid())
+  userId      String?
+  actorEmail  String?
+  action      String
+  entity      String
+  entityId    String
+  changes     Json?
+  metadata    Json?
+  createdAt   DateTime @default(now())
+  updatedAt   DateTime @updatedAt
+
+  user User? @relation(fields: [userId], references: [id], onDelete: SetNull)
 
   @@index([userId])
   @@index([action])

package/templates/base-project/packages/db/src/queries.js

@@ -15,6 +15,22 @@ const USER_SAFE_SELECT = {
 	updatedAt: true,
 };
 
+/**
+ * Look up an actor's email for the AuditLog snapshot.
+ *
+ * The lookup cannot miss: the foreign key rejects a `userId` that names no user,
+ * so `onDelete: SetNull` is the only way `userId` becomes null, and it happens after
+ * the snapshot was written. A null `userId` here means the caller supplied none.
+ */
+async function resolveActorEmail(userId) {
+	if (!userId) return null;
+	const actor = await prisma.user.findUnique({
+		where: { id: userId },
+		select: { email: true },
+	});
+	return actor?.email ?? null;
+}
+
 export { USER_SAFE_SELECT };
 
 // User queries
@@ -188,13 +204,21 @@ export const verificationToken = {
 };
 
 // AuditLog queries
+//
+// `user` is optional: a deleted user leaves `userId` null but the row survives
+// (see the AuditLog model). Every read therefore returns `actorEmail` alongside,
+// so a caller can name the actor without dereferencing `user`. Render `actorEmail`
+// — `user` is for callers that need the live row, e.g. to follow through to the
+// user's current role.
+const AUDIT_ACTOR_SELECT = { id: true, email: true, name: true };
+
 export const auditLog = {
 	findAll: (options = {}) => {
 		const { skip = 0, take = 50 } = options;
 		return prisma.auditLog.findMany({
 			skip,
 			take,
-			include: { user: { select: { id: true, email: true, name: true } } },
+			include: { user: { select: AUDIT_ACTOR_SELECT } },
 			orderBy: { createdAt: "desc" },
 		});
 	},
@@ -204,7 +228,7 @@ export const auditLog = {
 			where: { userId },
 			skip,
 			take,
-			include: { user: { select: { id: true, email: true, name: true } } },
+			include: { user: { select: AUDIT_ACTOR_SELECT } },
 			orderBy: { createdAt: "desc" },
 		});
 	},
@@ -214,7 +238,7 @@ export const auditLog = {
 			where: { entity },
 			skip,
 			take,
-			include: { user: { select: { id: true, email: true, name: true } } },
+			include: { user: { select: AUDIT_ACTOR_SELECT } },
 			orderBy: { createdAt: "desc" },
 		});
 	},
@@ -224,14 +248,25 @@ export const auditLog = {
 			where: { action },
 			skip,
 			take,
-			include: { user: { select: { id: true, email: true, name: true } } },
+			include: { user: { select: AUDIT_ACTOR_SELECT } },
 			orderBy: { createdAt: "desc" },
 		});
 	},
-	create: (data) => {
+	/**
+	 * Create an audit record, snapshotting the actor's email.
+	 *
+	 * The snapshot is written here rather than left to the caller because it is the
+	 * only thing that keeps the record attributable once the user row is gone:
+	 * `onDelete: SetNull` preserves the row but clears `userId`. A caller that
+	 * forgets the field gets a permanent record naming nobody, so this derives it
+	 * from `userId` when not supplied.
+	 */
+	create: async (data) => {
+		const actorEmail =
+			data.actorEmail ?? (await resolveActorEmail(data.userId));
 		return prisma.auditLog.create({
-			data,
-			include: { user: { select: { id: true, email: true, name: true } } },
+			data: { ...data, actorEmail },
+			include: { user: { select: AUDIT_ACTOR_SELECT } },
 		});
 	},
 };

package/templates/base-project/pnpm-workspace.yaml

@@ -11,6 +11,31 @@ onlyBuiltDependencies:
   - simple-git-hooks
 
 overrides:
+  # next-auth@5.0.0-beta.32 and @auth/core@0.41.3 declare nodemailer as an
+  # OPTIONAL peer with the range `^7.0.7 || ^8.0.5`. Every advisory against
+  # nodemailer needs >=10.0.6, so no version inside that peer range is
+  # patched, and neither package has shipped a newer release that widens it.
+  #
+  # Nothing in this repo uses Auth.js's Nodemailer email provider: auth.js
+  # configures Credentials, Github and Google only, and @auth/core's index
+  # never imports nodemailer statically (only providers/nodemailer.js does).
+  # Outgoing mail goes through @usequark/quark-core, which depends on
+  # nodemailer ^10.0.10 directly. Removing the unused peer edge deletes the
+  # vulnerable 7.0.13 copy from the tree instead of forcing it two majors past
+  # a range its author chose. Delete these two lines if you ever add
+  # next-auth/providers/nodemailer.
+  "next-auth>nodemailer": "-"
+  "@auth/core>nodemailer": "-"
+  # stripe@17.7.0 declares `qs: ^6.11.0`, so 6.16.0 is inside its own range and
+  # `pnpm update` cannot move it (qs is not a direct dependency of any workspace
+  # package). GHSA-g4mx-9h6g-cwc7 / GHSA-hrpp-f998-fjpq both need >=6.16.0.
+  qs@>=6.14.2 <=6.15.3: ">=6.16.0"
+  # xcode@3.0.1 declares `uuid: ^7.0.3`; GHSA-w5hq-g745-h8pq needs >=11.1.1,
+  # four majors ahead. Safe here because xcode only calls uuid.v4() (lib/
+  # pbxProject.js), which is unchanged in 11.x, and 11.1.1 still supports
+  # CommonJS require(). This is build-time only - xcode is reached through
+  # @expo/config-plugins while generating native projects.
+  uuid@<11.1.1: ">=11.1.1"
   fast-xml-builder@<1.1.7: ">=1.1.7"
   fast-xml-parser@<5.10.1: ">=5.10.1"
   lodash@>=4.0.0 <=4.17.22: ">=4.17.23"

package/templates/base-project/scripts/check-standards.mjs

@@ -15,6 +15,51 @@ const tsExtensions = new Set([".ts", ".tsx"]);
 const throwNewErrorPattern = /\bthrow new Error\s*\(/;
 const consolePattern = /\bconsole\.(?:log|warn|error|info)\s*\(/;
 
+/**
+ * `next-auth` and `@auth/core` declare nodemailer as an *optional* peer pinned to
+ * `^7.0.7 || ^8.0.5`. No version in that range is free of an advisory, so
+ * pnpm-workspace.yaml removes the peer edge entirely instead:
+ *
+ *   "next-auth>nodemailer": "-"
+ *   "@auth/core>nodemailer": "-"
+ *
+ * That is what clears 13 of the 21 advisories, and it is safe only while nothing
+ * imports Auth.js's Nodemailer provider. The failure mode if that changes is bad:
+ * `providers/nodemailer.js` does `import { createTransport } from "nodemailer"` at
+ * module scope, so the import throws ERR_MODULE_NOT_FOUND on the next server start -
+ * not at build time, and not with any hint that an override caused it.
+ *
+ * This check turns that into a build failure with the fix attached. It fires on the
+ * import specifier rather than on the override, so it stays correct if the override
+ * is ever reworded, and it covers both the monorepo and the scaffold template.
+ *
+ * The pattern has to accept every way a module specifier can be reached, because a
+ * guard that misses one spelling is worse than none: it reads as protection while
+ * letting the breakage through. All of these resolve the provider and so must fail:
+ *
+ *   import N from "next-auth/providers/nodemailer"        // static default
+ *   import "next-auth/providers/nodemailer"               // bare side-effect
+ *   export { default } from "next-auth/providers/nodemailer"
+ *   await import("next-auth/providers/nodemailer")        // dynamic
+ *   import("next-auth/providers/nodemailer").then(m => m.default)
+ *   require("next-auth/providers/nodemailer")             // CommonJS
+ *
+ * The optional `\(` is what the first version got wrong: dynamic `import(` puts a
+ * paren between the keyword and the quote, so an alternation of
+ * `from|import|require\s*\(` matched the static forms and silently missed every
+ * dynamic one.
+ *
+ * Each keyword carries a leading `\b` so an identifier that merely contains one -
+ * `important`, `myrequire` - cannot trigger it, and the specifier is anchored so
+ * only this exact module matches.
+ *
+ * If you genuinely want the provider: delete the two overrides above, then add
+ * `nodemailer` (>=10.0.6, past every advisory) to the app's own dependencies and
+ * allowlist this check for that file.
+ */
+const authNodemailerProviderPattern =
+	/\b(?:from|import|require)\s*\(?\s*["'`]next-auth\/providers\/nodemailer["'`]/;
+
 /**
  * Tailwind v4 removed the bare `[--var]` shorthand that v3 accepted. Under v4 a
  * class such as `text-[--navbar-text-muted]` is still a *valid* utility name, so
@@ -125,6 +170,36 @@ function findMatchingLines(content, pattern) {
 	return matches;
 }
 
+/**
+ * Same job as findMatchingLines, but matches against the whole file rather than one
+ * line at a time, and reports the line each match starts on.
+ *
+ * Needed for the nodemailer guard, whose pattern legitimately spans a line break:
+ * `import Nodemailer from\n  "next-auth/providers/nodemailer";` is valid JavaScript
+ * that the line-at-a-time version cannot see, because the keyword and the specifier
+ * land on different lines. Line-at-a-time is the right default for the other checks -
+ * they only ever match within one line - so this is opt-in.
+ *
+ * The match is retried with a lastIndex-aware scan because a pattern carrying the `g`
+ * flag would otherwise return only the first hit; `d` additionally keeps the index
+ * pointing at the start of the match rather than at a capture group.
+ */
+function findMatchingLinesMultiline(content, pattern) {
+	const scanner = new RegExp(
+		pattern.source,
+		pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`,
+	);
+	const matches = [];
+	let match = scanner.exec(content);
+	while (match !== null) {
+		matches.push(content.slice(0, match.index).split("\n").length);
+		// A zero-width match would otherwise loop forever.
+		scanner.lastIndex = match.index + (match[0].length || 1);
+		match = scanner.exec(content);
+	}
+	return matches;
+}
+
 async function collectFiles(directoryPath) {
 	const entries = await readdir(directoryPath, { withFileTypes: true });
 	const files = [];
@@ -213,6 +288,17 @@ async function main() {
 				);
 			}
 		}
+
+		if (isSourceFile(relativePath)) {
+			for (const lineNumber of findMatchingLinesMultiline(
+				content,
+				authNodemailerProviderPattern,
+			)) {
+				violations.push(
+					`${relativePath}:${lineNumber}: next-auth/providers/nodemailer cannot resolve - pnpm-workspace.yaml removes that peer edge to clear 13 nodemailer advisories, and the peer range (^7.0.7 || ^8.0.5) has no patched version. Delete the two nodemailer overrides and add nodemailer >=10.0.6 as a direct dependency to use this provider.`,
+				);
+			}
+		}
 	}
 
 	if (violations.length > 0) {

package/templates/base-project/skills/quark-skills/SKILL.md

@@ -14,18 +14,13 @@ Every skill below ships with this project and is always available. Skills are ab
 | add-model | `add-model/SKILL.md` | Add a new Prisma model, query helpers, and tests to the db package. |
 | add-endpoint | `add-endpoint/SKILL.md` | Add an API route (or Server Action) with Zod validation, CSRF, and role guards. |
 | add-dashboard | `add-dashboard/SKILL.md` | Add a metrics/overview dashboard page with metric cards and loading states. |
-| admin-dashboard | `admin-dashboard/SKILL.md` | Build a full admin/back-office area: guarded routes, CRUD screens, audit logging. |
 
 ## Domain starters
 
-These teach the AI to build a complete vertical on demand. No starter code is scaffolded - the AI generates it from the skill.
+These teach the AI to build a complete vertical on demand. No starter code is scaffolded; the AI generates it from the skill.
 
 | Skill | Path | Purpose |
 |---|---|---|
-| bookings | `bookings/SKILL.md` | Booking/reservation/appointment/scheduling systems. |
-| crm | `crm/SKILL.md` | Contact/pipeline/customer relationship systems. |
-| cms | `cms/SKILL.md` | Content modeling, authoring, and publishing systems. |
-| ai | `ai/SKILL.md` | AI assistant features (chat, completions) on app data. |
 | payment | `payment/SKILL.md` | Stripe payment integration, checkout, webhooks, fulfillment. |
 | ecommerce | `ecommerce/SKILL.md` | Product catalog, cart, checkout, orders, inventory. Sub-skills: `ecommerce-catalog`, `ecommerce-cart`, `ecommerce-checkout`. |
 | i18n | `i18n/SKILL.md` | Internationalization, locale routing, localized CMS content, hreflang SEO. |

package/templates/base-project/turbo.json

@@ -7,7 +7,8 @@
 		"npm_lifecycle_event",
 		"QUARK_SKIP_AUTO_CLEAN",
 		"QUARK_SKIP_DEV_PREFLIGHT",
-		"QUARK_SKIP_GIT_INIT"
+		"QUARK_SKIP_GIT_INIT",
+		"CHECK_AUDIT_FIXTURE"
 	],
 	"tasks": {
 		"clean": {

package/templates/ui/package.json

@@ -9,7 +9,7 @@
 	},
 	"dependencies": {
 		"lucide-react": "^1.48.0",
-		"next": "16.3.6"
+		"next": "16.3.8"
 	},
 	"devDependencies": {
 		"@types/react": "^19.3.0",