@usequark/quark-create-app 1.27.0 → 1.27.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usequark/quark-create-app",
-  "version": "1.27.0",
+  "version": "1.27.1",
   "description": "CLI to scaffold new Quark projects with Next.js, Prisma, BullMQ, and Railway deployment",
   "keywords": [
     "quark",

package/templates/base-project/apps/web/src/lib/auth.js

@@ -237,6 +237,13 @@ async function validateSessionToken(token) {
 
 export function getAuthOptions() {
 	return createAuthConfig({
+		// The adapter is load-bearing even though sessions are JWT (see
+		// `session.strategy` below): it persists the `Account` rows that link
+		// OAuth identities to users — the adapter reads and writes them, and
+		// `account.findByUserIdAndProvider` is covered in `packages/db`. Do
+		// not remove it. The `Session` model queries (`session.*` in
+		// `packages/db/src/queries.js`) are the opposite: app-owned helpers the
+		// JWT strategy never populates.
 		adapter: PrismaAdapter(prisma),
 		providers: providers,
 		logger: {

package/templates/base-project/packages/db/src/queries.js

@@ -139,6 +139,12 @@ export const account = {
 };
 
 // Session queries (NextAuth)
+//
+// App-owned helpers, not Auth.js storage: the scaffold pins
+// `session.strategy: "jwt"` (see `apps/web/src/lib/auth.js`), under which
+// Auth.js neither reads nor writes session rows — revocation is enforced by
+// `validateSessionToken` re-reading the user row instead. Kept for apps that
+// need server-side session bookkeeping of their own.
 export const session = {
 	findByToken: (sessionToken) => {
 		return prisma.session.findUnique({