@geekmidas/cli 1.10.35 → 1.10.37

package/dist/index.mjs

@@ -1,11 +1,11 @@
 #!/usr/bin/env -S npx tsx
 import { __require } from "./chunk-Duj1WY3L.mjs";
-import { getAppBuildOrder, getDependencyEnvVars, getDeployTargetError, isDeployTargetSupported } from "./workspace-Bi4X7Yzy.mjs";
-import { getAppNameFromCwd, loadAppConfig, loadConfig, loadWorkspaceAppInfo, loadWorkspaceConfig, parseModuleConfig } from "./config-B62g483e.mjs";
+import { getAppBuildOrder, getDependencyEnvVars, getDeployTargetError, getPublicEnvPrefix, isDeployTargetSupported, stripPublicPrefix } from "./workspace-D-37Ylqo.mjs";
+import { getAppNameFromCwd, loadAppConfig, loadConfig, loadWorkspaceAppInfo, loadWorkspaceConfig, parseModuleConfig } from "./config-Bbu1JKvf.mjs";
 import { getCredentialsPath, getDokployCredentials, getDokployRegistryId, getDokployToken, removeDokployCredentials, storeDokployCredentials, storeDokployRegistryId } from "./credentials-s1kLcIzK.mjs";
-import { createStageSecrets, generateConnectionUrls, generateDbPassword, generateDbUrl, generateFullstackCustomSecrets, generateLocalStackCredentials, generatePgBossUrl, generateSecurePassword, generateServiceCredentials, rotateServicePassword, writeDockerEnvFromSecrets } from "./fullstack-secrets-P84v8zWn.mjs";
+import { createStageSecrets, generateConnectionUrls, generateDbPassword, generateDbUrl, generateFullstackCustomSecrets, generateLocalStackCredentials, generatePgBossUrl, generateSecurePassword, generateServiceCredentials, rotateServicePassword, writeDockerEnvFromSecrets } from "./fullstack-secrets-l8s3II_H.mjs";
 import { getKeyPath, maskPassword, readStageSecrets, secretsExist, setCustomSecret, toEmbeddableSecrets, writeStageSecrets } from "./storage-dbb9RyBl.mjs";
-import { ConstructGenerator, EndpointGenerator, OPENAPI_OUTPUT_PATH, generateOpenApi, isPartitionedRoutes, normalizeRoutes, openapiCommand, resolveOpenApiConfig } from "./openapi-CflxypuN.mjs";
+import { ConstructGenerator, EndpointGenerator, OPENAPI_OUTPUT_PATH, generateOpenApi, isPartitionedRoutes, normalizeRoutes, openapiCommand, resolveOpenApiConfig } from "./openapi-C5AycKTR.mjs";
 import { DokployApi } from "./dokploy-api-BIT0683o.mjs";
 import { encryptSecrets } from "./encryption-DSkIlEZ6.mjs";
 import { CachedStateProvider } from "./CachedStateProvider-C8A-cCm5.mjs";
@@ -28,14 +28,14 @@ import { randomBytes } from "node:crypto";
 import { Cron } from "@geekmidas/constructs/crons";
 import { Function } from "@geekmidas/constructs/functions";
 import { Subscriber } from "@geekmidas/constructs/subscribers";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { Client } from "pg";
 import { lookup } from "node:dns/promises";
-import { fileURLToPath, pathToFileURL } from "node:url";
 import prompts from "prompts";
 
 //#region package.json
 var name = "@geekmidas/cli";
-var version = "1.10.34";
+var version = "1.10.36";
 var description = "CLI tools for building Lambda handlers, server applications, and generating OpenAPI specs";
 var private$1 = false;
 var type = "module";
@@ -1489,6 +1489,27 @@ const FRONTEND_FRAMEWORKS = {
 		],
 		dependency: "vite",
 		installCommand: "pnpm add -D vite"
+	},
+	"tanstack-start": {
+		displayName: "TanStack Start",
+		configFiles: [
+			"vite.config.js",
+			"vite.config.ts",
+			"vite.config.mjs",
+			"vite.config.cjs"
+		],
+		dependency: "@tanstack/react-start",
+		installCommand: "pnpm add @tanstack/react-start @tanstack/react-router"
+	},
+	expo: {
+		displayName: "Expo",
+		configFiles: [
+			"app.config.ts",
+			"app.config.js",
+			"app.json"
+		],
+		dependency: "expo",
+		installCommand: "pnpm add expo"
 	}
 };
 /**
@@ -1498,6 +1519,8 @@ const FRONTEND_FRAMEWORKS = {
 */
 function detectFrontendFramework(fullPath, deps) {
 	const order = [
+		"expo",
+		"tanstack-start",
 		"nextjs",
 		"remix",
 		"vite"
@@ -1572,7 +1595,7 @@ async function validateFrontendApp(appName, appPath, workspaceRoot, framework) {
 */
 async function validateFrontendApps(workspace) {
 	const results = [];
-	for (const [appName, app] of Object.entries(workspace.apps)) if (app.type === "frontend") {
+	for (const [appName, app] of Object.entries(workspace.apps)) if (app.type === "web") {
 		const result = await validateFrontendApp(appName, app.path, workspace.root, app.framework);
 		results.push(result);
 	}
@@ -1608,9 +1631,12 @@ async function loadDevSecrets(workspace) {
 async function workspaceDevCommand(workspace, options) {
 	const appCount = Object.keys(workspace.apps).length;
 	const backendApps = Object.entries(workspace.apps).filter(([_, app]) => app.type === "backend");
-	const frontendApps = Object.entries(workspace.apps).filter(([_, app]) => app.type === "frontend");
+	const frontendApps = Object.entries(workspace.apps).filter(([_, app]) => app.type === "web");
+	const mobileApps = Object.entries(workspace.apps).filter(([_, app]) => app.type === "mobile");
 	logger$11.log(`\n🚀 Starting workspace: ${workspace.name}`);
-	logger$11.log(`   ${backendApps.length} backend app(s), ${frontendApps.length} frontend app(s)`);
+	const counts = [`${backendApps.length} backend`, `${frontendApps.length} web`];
+	if (mobileApps.length > 0) counts.push(`${mobileApps.length} mobile`);
+	logger$11.log(`   ${counts.join(", ")} app(s)`);
 	const conflicts = checkPortConflicts(workspace);
 	if (conflicts.length > 0) {
 		for (const conflict of conflicts) logger$11.error(`❌ Port conflict: Apps "${conflict.app1}" and "${conflict.app2}" both use port ${conflict.port}`);
@@ -1659,7 +1685,8 @@ async function workspaceDevCommand(workspace, options) {
 		const app = workspace.apps[appName];
 		if (!app) continue;
 		const deps = app.dependencies.length > 0 ? ` (depends on: ${app.dependencies.join(", ")})` : "";
-		logger$11.log(`   ${app.type === "backend" ? "🔧" : "🌐"} ${appName} → http://localhost:${app.port}${deps}`);
+		const icon = app.type === "backend" ? "🔧" : app.type === "mobile" ? "📱" : "🌐";
+		logger$11.log(`   ${icon} ${appName} → http://localhost:${app.port}${deps}`);
 	}
 	const configFiles = [
 		"gkm.config.ts",
@@ -2376,7 +2403,7 @@ async function workspaceBuildCommand(workspace, options) {
 	const results = [];
 	const apps = Object.entries(workspace.apps);
 	const backendApps = apps.filter(([, app]) => app.type === "backend");
-	const frontendApps = apps.filter(([, app]) => app.type === "frontend");
+	const frontendApps = apps.filter(([, app]) => app.type === "web");
 	logger$9.log(`\n🏗️  Building workspace: ${workspace.name}`);
 	logger$9.log(`   Backend apps: ${backendApps.map(([name$1]) => name$1).join(", ") || "none"}`);
 	logger$9.log(`   Frontend apps: ${frontendApps.map(([name$1]) => name$1).join(", ") || "none"}`);
@@ -2419,7 +2446,7 @@ async function workspaceBuildCommand(workspace, options) {
 		await openapiCommand({ cwd: workspace.root });
 		logger$9.log(`\n📋 Build Summary:`);
 		for (const result of results) {
-			const icon = result.type === "backend" ? "⚙️" : "🌐";
+			const icon = result.type === "backend" ? "⚙️" : result.type === "mobile" ? "📱" : "🌐";
 			logger$9.log(`   ${icon} ${result.appName}: ${result.outputPath || "built"}`);
 		}
 	} catch (error) {
@@ -2440,8 +2467,14 @@ async function workspaceBuildCommand(workspace, options) {
 */
 function getAppOutputPath(workspace, _appName, app) {
 	const appPath = join(workspace.root, app.path);
-	if (app.type === "frontend") return join(appPath, ".next");
-	else return join(appPath, ".gkm");
+	if (app.type === "mobile") return "";
+	if (app.type === "web") switch (app.framework) {
+		case "vite":
+		case "tanstack-start": return join(appPath, "dist");
+		case "remix": return join(appPath, "build");
+		default: return join(appPath, ".next");
+	}
+	return join(appPath, ".gkm");
 }
 /**
 * Format routes for logging, handling PartitionedRoutes.
@@ -3003,6 +3036,66 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 	return results;
 }
 
+//#endregion
+//#region src/deploy/domain.ts
+/**
+* Resolve the hostname for an app based on stage configuration.
+*
+* Domain resolution priority:
+* 1. Explicit app.domain override (string or stage-specific)
+* 2. Default pattern based on app type:
+*    - Main frontend app gets base domain (e.g., 'myapp.com')
+*    - Other apps get prefixed domain (e.g., 'api.myapp.com')
+*
+* @param appName - The name of the app
+* @param app - The normalized app configuration
+* @param stage - The deployment stage (e.g., 'production', 'development')
+* @param dokployConfig - Dokploy workspace configuration with domain mappings
+* @param isMainFrontend - Whether this is the main frontend app
+* @returns The resolved hostname for the app
+* @throws Error if no domain configuration is found for the stage
+*/
+function resolveHost(appName, app, stage, dokployConfig, isMainFrontend) {
+	if (app.domain) {
+		if (typeof app.domain === "string") return app.domain;
+		if (app.domain[stage]) return app.domain[stage];
+	}
+	const baseDomain = dokployConfig?.domains?.[stage];
+	if (!baseDomain) throw new Error(`No domain configured for stage "${stage}". Add deploy.dokploy.domains.${stage} to gkm.config.ts`);
+	if (isMainFrontend) return baseDomain;
+	return `${appName}.${baseDomain}`;
+}
+/**
+* Determine if an app is the "main" frontend (gets base domain).
+*
+* An app is considered the main frontend if:
+* 1. It's named 'web' and is a frontend type
+* 2. It's the first frontend app in the apps list
+*
+* @param appName - The name of the app to check
+* @param app - The app configuration
+* @param allApps - All apps in the workspace
+* @returns True if this is the main frontend app
+*/
+function isMainFrontendApp(appName, app, allApps) {
+	if (app.type !== "web") return false;
+	if (appName === "web") return true;
+	for (const [name$1, a] of Object.entries(allApps)) if (a.type === "web") return name$1 === appName;
+	return false;
+}
+/**
+* Get public URL arg names from app dependencies.
+*
+* @param app - The web/mobile app configuration
+* @returns Array of arg names like 'NEXT_PUBLIC_API_URL', or [] for frameworks
+*   without a public prefix (e.g. Remix).
+*/
+function getPublicUrlArgNames(app) {
+	const prefix = getPublicEnvPrefix(app);
+	if (!prefix) return [];
+	return app.dependencies.map((dep) => `${prefix}${dep.toUpperCase()}_URL`);
+}
+
 //#endregion
 //#region src/docker/compose.ts
 /** Default Docker images for services */
@@ -3314,15 +3407,18 @@ function generateWorkspaceCompose(workspace, options = {}) {
 
 services:
 `;
-	for (const [appName, app] of apps) yaml += generateAppService(appName, app, apps, {
-		registry,
-		projectName: workspace.name,
-		hasPostgres,
-		hasRedis,
-		hasMinio,
-		hasMail,
-		eventsBackend
-	});
+	for (const [appName, app] of apps) {
+		if (app.type === "mobile") continue;
+		yaml += generateAppService(appName, app, apps, {
+			registry,
+			projectName: workspace.name,
+			hasPostgres,
+			hasRedis,
+			hasMinio,
+			hasMail,
+			eventsBackend
+		});
+	}
 	if (hasPostgres) yaml += `
   postgres:
     image: ${postgresImage}
@@ -3491,8 +3587,8 @@ function getInfraServiceImage(serviceName, config$1) {
 function generateAppService(appName, app, allApps, options) {
 	const { registry, projectName, hasPostgres, hasRedis, hasMinio, hasMail, eventsBackend } = options;
 	const imageRef = registry ? `\${REGISTRY:-${registry}}/` : "";
-	const healthCheckPath = app.type === "frontend" ? "/" : "/health";
-	const healthCheckCmd = app.type === "frontend" ? `["CMD", "wget", "-q", "--spider", "http://localhost:${app.port}/"]` : `["CMD", "wget", "-q", "--spider", "http://localhost:${app.port}${healthCheckPath}"]`;
+	const healthCheckPath = app.type === "web" ? "/" : "/health";
+	const healthCheckCmd = app.type === "web" ? `["CMD", "wget", "-q", "--spider", "http://localhost:${app.port}/"]` : `["CMD", "wget", "-q", "--spider", "http://localhost:${app.port}${healthCheckPath}"]`;
 	let yaml = `
   ${appName}:
     build:
@@ -4295,6 +4391,115 @@ ENTRYPOINT ["/sbin/tini", "--"]
 CMD ["node", "index.mjs"]
 `;
 }
+/**
+* Generate a Dockerfile for Node-based SSR web frameworks (TanStack Start,
+* Remix). Builds with turbo, then runs the framework's production start
+* script via `npm start`.
+*
+* Public URL build args are declared so framework bundlers (Vite, Vinxi)
+* can inline them at build time. Per-framework prefix is the caller's job.
+* @internal Exported for testing
+*/
+function generateNodeWebDockerfile(options) {
+	const { baseImage, port, appPath, turboPackage, packageManager, publicUrlArgs = [] } = options;
+	const pm = getPmConfig(packageManager);
+	const installPm = pm.install ? `RUN ${pm.install}` : "";
+	const turboInstallCmd = getTurboInstallCmd(packageManager);
+	const turboCmd = packageManager === "pnpm" ? "pnpm dlx turbo" : "npx turbo";
+	const startCmd = packageManager === "pnpm" ? "pnpm start" : `${pm.lockfile.startsWith("package-lock") ? "npm" : packageManager} start`;
+	const argDecls = publicUrlArgs.map((a) => `ARG ${a}=""`).join("\n");
+	const envDecls = publicUrlArgs.map((a) => `ENV ${a}=$${a}`).join("\n");
+	return `# syntax=docker/dockerfile:1
+# Node SSR web Dockerfile (TanStack Start / Remix) with turbo prune
+
+FROM ${baseImage} AS pruner
+WORKDIR /app
+${installPm}
+COPY . .
+RUN ${turboCmd} prune ${turboPackage} --docker
+
+FROM ${baseImage} AS deps
+WORKDIR /app
+${installPm}
+COPY --from=pruner /app/out/${pm.lockfile} ./
+COPY --from=pruner /app/out/json/ ./
+RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
+    ${turboInstallCmd}
+
+FROM deps AS builder
+WORKDIR /app
+${argDecls}
+${envDecls}
+COPY --from=pruner /app/out/full/ ./
+COPY --from=pruner /app/tsconfig.* ./
+RUN ${turboCmd} run build --filter=${turboPackage}
+
+FROM ${baseImage} AS runner
+WORKDIR /app
+RUN apk add --no-cache tini
+RUN addgroup --system --gid 1001 nodejs && \\
+    adduser --system --uid 1001 app
+
+# Copy the whole built workspace — frameworks differ on output paths
+COPY --from=builder --chown=app:nodejs /app/ ./
+
+ENV NODE_ENV=production
+ENV PORT=${port}
+ENV HOSTNAME="0.0.0.0"
+
+USER app
+EXPOSE ${port}
+
+ENTRYPOINT ["/sbin/tini", "--"]
+CMD ["sh", "-c", "cd ${appPath} && ${startCmd}"]
+`;
+}
+/**
+* Generate a Dockerfile for Vite SPA apps. Builds the static bundle with
+* turbo, then serves it via nginx.
+* @internal Exported for testing
+*/
+function generateViteStaticDockerfile(options) {
+	const { baseImage, port, appPath, turboPackage, packageManager, publicUrlArgs = [] } = options;
+	const pm = getPmConfig(packageManager);
+	const installPm = pm.install ? `RUN ${pm.install}` : "";
+	const turboInstallCmd = getTurboInstallCmd(packageManager);
+	const turboCmd = packageManager === "pnpm" ? "pnpm dlx turbo" : "npx turbo";
+	const argDecls = publicUrlArgs.map((a) => `ARG ${a}=""`).join("\n");
+	const envDecls = publicUrlArgs.map((a) => `ENV ${a}=$${a}`).join("\n");
+	return `# syntax=docker/dockerfile:1
+# Vite SPA Dockerfile — builds static assets, serves via nginx
+
+FROM ${baseImage} AS pruner
+WORKDIR /app
+${installPm}
+COPY . .
+RUN ${turboCmd} prune ${turboPackage} --docker
+
+FROM ${baseImage} AS deps
+WORKDIR /app
+${installPm}
+COPY --from=pruner /app/out/${pm.lockfile} ./
+COPY --from=pruner /app/out/json/ ./
+RUN --mount=type=cache,id=${pm.cacheId},target=${pm.cacheTarget} \\
+    ${turboInstallCmd}
+
+FROM deps AS builder
+WORKDIR /app
+${argDecls}
+${envDecls}
+COPY --from=pruner /app/out/full/ ./
+COPY --from=pruner /app/tsconfig.* ./
+RUN ${turboCmd} run build --filter=${turboPackage}
+
+FROM nginx:alpine AS runner
+COPY --from=builder /app/${appPath}/dist /usr/share/nginx/html
+RUN printf 'server {\\n  listen ${port};\\n  root /usr/share/nginx/html;\\n  index index.html;\\n  location / { try_files $uri $uri/ /index.html; }\\n}\\n' \\
+    > /etc/nginx/conf.d/default.conf
+EXPOSE ${port}
+CMD ["nginx", "-g", "daemon off;"]
+`;
+}
 
 //#endregion
 //#region src/docker/index.ts
@@ -4480,6 +4685,10 @@ async function workspaceDockerCommand(workspace, options) {
 	const packageManager = detectPackageManager$1(workspace.root);
 	logger$7.log(`   Package manager: ${packageManager}`);
 	for (const [appName, app] of apps) {
+		if (app.type === "mobile") {
+			logger$7.log(`\n   📱 Skipping Docker for ${appName} (mobile app — deploy via framework toolchain)`);
+			continue;
+		}
 		const appPath = app.path;
 		const fullAppPath = join(workspace.root, appPath);
 		const turboPackage = getAppPackageName(fullAppPath) ?? appName;
@@ -4488,15 +4697,28 @@ async function workspaceDockerCommand(workspace, options) {
 		const buildType = hasEntry ? "entry" : app.type;
 		logger$7.log(`\n   📄 Generating Dockerfile for ${appName} (${buildType})`);
 		let dockerfile;
-		if (app.type === "frontend") dockerfile = generateNextjsDockerfile({
-			imageName,
-			baseImage: "node:22-alpine",
-			port: app.port,
-			appPath,
-			turboPackage,
-			packageManager
-		});
-		else if (app.entry) dockerfile = generateEntryDockerfile({
+		if (app.type === "web") {
+			const publicUrlArgs = getPublicUrlArgNames(app);
+			const webOpts = {
+				imageName,
+				baseImage: "node:22-alpine",
+				port: app.port,
+				appPath,
+				turboPackage,
+				packageManager,
+				publicUrlArgs
+			};
+			switch (app.framework) {
+				case "vite":
+					dockerfile = generateViteStaticDockerfile(webOpts);
+					break;
+				case "tanstack-start":
+				case "remix":
+					dockerfile = generateNodeWebDockerfile(webOpts);
+					break;
+				default: dockerfile = generateNextjsDockerfile(webOpts);
+			}
+		} else if (app.entry) dockerfile = generateEntryDockerfile({
 			imageName,
 			baseImage: "node:22-alpine",
 			port: app.port,
@@ -4536,7 +4758,7 @@ async function workspaceDockerCommand(workspace, options) {
 	logger$7.log(`\n✅ Generated ${results.length} Dockerfile(s) + docker-compose.yml`);
 	logger$7.log("\n📋 Build commands:");
 	for (const result of results) {
-		const icon = result.type === "backend" ? "⚙️" : "🌐";
+		const icon = result.type === "backend" ? "⚙️" : result.type === "mobile" ? "📱" : "🌐";
 		logger$7.log(`   ${icon} docker build -f .gkm/docker/Dockerfile.${result.appName} -t ${result.imageName} .`);
 	}
 	logger$7.log("\n📋 Run all services:");
@@ -4773,54 +4995,6 @@ async function deployDokploy(options) {
 	};
 }
 
-//#endregion
-//#region src/deploy/domain.ts
-/**
-* Resolve the hostname for an app based on stage configuration.
-*
-* Domain resolution priority:
-* 1. Explicit app.domain override (string or stage-specific)
-* 2. Default pattern based on app type:
-*    - Main frontend app gets base domain (e.g., 'myapp.com')
-*    - Other apps get prefixed domain (e.g., 'api.myapp.com')
-*
-* @param appName - The name of the app
-* @param app - The normalized app configuration
-* @param stage - The deployment stage (e.g., 'production', 'development')
-* @param dokployConfig - Dokploy workspace configuration with domain mappings
-* @param isMainFrontend - Whether this is the main frontend app
-* @returns The resolved hostname for the app
-* @throws Error if no domain configuration is found for the stage
-*/
-function resolveHost(appName, app, stage, dokployConfig, isMainFrontend) {
-	if (app.domain) {
-		if (typeof app.domain === "string") return app.domain;
-		if (app.domain[stage]) return app.domain[stage];
-	}
-	const baseDomain = dokployConfig?.domains?.[stage];
-	if (!baseDomain) throw new Error(`No domain configured for stage "${stage}". Add deploy.dokploy.domains.${stage} to gkm.config.ts`);
-	if (isMainFrontend) return baseDomain;
-	return `${appName}.${baseDomain}`;
-}
-/**
-* Determine if an app is the "main" frontend (gets base domain).
-*
-* An app is considered the main frontend if:
-* 1. It's named 'web' and is a frontend type
-* 2. It's the first frontend app in the apps list
-*
-* @param appName - The name of the app to check
-* @param app - The app configuration
-* @param allApps - All apps in the workspace
-* @returns True if this is the main frontend app
-*/
-function isMainFrontendApp(appName, app, allApps) {
-	if (app.type !== "frontend") return false;
-	if (appName === "web") return true;
-	for (const [name$1, a] of Object.entries(allApps)) if (a.type === "frontend") return name$1 === appName;
-	return false;
-}
-
 //#endregion
 //#region src/deploy/env-resolver.ts
 /**
@@ -4881,9 +5055,8 @@ function resolveEnvVar(varName, context) {
 			break;
 	}
 	if (context.dependencyUrls && varName.endsWith("_URL")) {
-		let depName;
-		if (varName.startsWith("NEXT_PUBLIC_")) depName = varName.slice(12, -4).toLowerCase();
-		else depName = varName.slice(0, -4).toLowerCase();
+		const stripped = stripPublicPrefix(varName) ?? varName;
+		const depName = stripped.slice(0, -4).toLowerCase();
 		if (context.dependencyUrls[depName]) return context.dependencyUrls[depName];
 	}
 	if (context.userSecrets) {
@@ -5295,8 +5468,9 @@ function resolveSnifferFile(baseName) {
 */
 async function sniffAppEnvironment(app, appName, workspacePath, options = {}) {
 	const { logWarnings = true, markOptional = false } = options;
-	if (app.type === "frontend") {
-		const depVars = (app.dependencies ?? []).map((dep) => `NEXT_PUBLIC_${dep.toUpperCase()}_URL`);
+	if (app.type === "web" || app.type === "mobile") {
+		const publicPrefix = getPublicEnvPrefix(app.framework);
+		const depVars = publicPrefix ? (app.dependencies ?? []).map((dep) => `${publicPrefix}${dep.toUpperCase()}_URL`) : [];
 		if (app.config) {
 			const sniffedVars = [];
 			const sniffedOptional = [];
@@ -6221,8 +6395,10 @@ async function workspaceDeployCommand(workspace, options) {
 			}
 		}
 	}
+	const skippedMobileApps = appsToDeployNames.filter((name$1) => workspace.apps[name$1].type === "mobile");
+	if (skippedMobileApps.length > 0) logger$3.log(`\n📱 Skipping ${skippedMobileApps.length} mobile app(s) — deploy via framework toolchain: ${skippedMobileApps.join(", ")}`);
 	const backendApps = appsToDeployNames.filter((name$1) => workspace.apps[name$1].type === "backend");
-	const frontendApps = appsToDeployNames.filter((name$1) => workspace.apps[name$1].type === "frontend");
+	const frontendApps = appsToDeployNames.filter((name$1) => workspace.apps[name$1].type === "web");
 	const perAppDbCredentials = /* @__PURE__ */ new Map();
 	if (provisionedPostgres && backendApps.length > 0) {
 		const appsNeedingDb = backendApps.filter((appName) => {
@@ -6473,11 +6649,14 @@ async function workspaceDeployCommand(workspace, options) {
 				const { valid, missing, resolved } = validateEnvVars(sniffedVars, envContext);
 				if (!valid) throw new Error(formatMissingVarsError(appName, missing, stage));
 				if (Object.keys(resolved).length > 0) logger$3.log(`      Resolved ${Object.keys(resolved).length} env vars: ${Object.keys(resolved).join(", ")}`);
+				const publicPrefix = getPublicEnvPrefix(app.framework);
 				const buildArgs = [];
 				const publicUrlArgNames = [];
-				for (const [key, value] of Object.entries(resolved)) if (key.startsWith("NEXT_PUBLIC_")) {
-					buildArgs.push(`${key}=${value}`);
-					publicUrlArgNames.push(key);
+				if (publicPrefix) {
+					for (const [key, value] of Object.entries(resolved)) if (key.startsWith(publicPrefix)) {
+						buildArgs.push(`${key}=${value}`);
+						publicUrlArgNames.push(key);
+					}
 				}
 				if (buildArgs.length > 0) logger$3.log(`      Build args: ${publicUrlArgNames.join(", ")}`);
 				const imageName = `${workspace.name}-${appName}`;
@@ -6914,9 +7093,9 @@ const GEEKMIDAS_VERSIONS = {
 	"@geekmidas/constructs": "~3.0.9",
 	"@geekmidas/db": "~1.0.1",
 	"@geekmidas/emailkit": "~1.0.0",
-	"@geekmidas/envkit": "~1.0.5",
+	"@geekmidas/envkit": "~1.0.6",
 	"@geekmidas/errors": "~1.0.0",
-	"@geekmidas/events": "~1.1.0",
+	"@geekmidas/events": "~1.1.1",
 	"@geekmidas/logger": "~1.0.1",
 	"@geekmidas/rate-limit": "~2.0.0",
 	"@geekmidas/schema": "~1.0.0",
@@ -7723,48 +7902,646 @@ coverage/
 }
 
 //#endregion
-//#region src/init/generators/models.ts
+//#region src/init/generators/mobile-expo.ts
 /**
-* Generate packages/models for shared Zod schemas (monorepo only)
+* Generate an Expo mobile app for the fullstack template.
+*
+* Mirrors the structure of rezgo/apps/app: NativeWind for styling,
+* expo-router for navigation, better-auth + magic link, React Query
+* for data, all wired into the toolbox's typed API client.
 */
-function generateModelsPackage(options) {
-	if (!options.monorepo) return [];
-	const packageName = `@${options.name}/models`;
+function generateExpoAppFiles(options) {
+	if (!options.monorepo || options.template !== "fullstack") return [];
+	const packageName = `@${options.name}/app`;
+	const apiPackage = `@${options.name}/api`;
+	const modelsPackage = `@${options.name}/models`;
+	const slug = options.name.toLowerCase().replace(/[^a-z0-9-]/g, "-");
+	const scheme = slug.replace(/-/g, "");
+	const bundleId = `com.${scheme}.app`;
 	const packageJson = {
 		name: packageName,
 		version: "0.0.1",
+		main: "expo-router/entry",
 		private: true,
-		type: "module",
-		exports: { "./*": "./src/*.ts" },
-		scripts: { typecheck: "tsc --noEmit" },
-		dependencies: {},
-		devDependencies: { typescript: "~5.8.2" }
-	};
-	const tsConfig = {
-		extends: "../../tsconfig.json",
-		compilerOptions: {
-			noEmit: true,
-			allowImportingTsExtensions: true
+		scripts: {
+			dev: "gkm exec -- expo start -c",
+			ios: "expo start --ios",
+			android: "expo start --android",
+			web: "expo start --web",
+			typecheck: "tsc --noEmit"
 		},
-		include: ["src/**/*.ts"],
-		exclude: ["node_modules", "dist"]
+		dependencies: {
+			[apiPackage]: "workspace:*",
+			[modelsPackage]: "workspace:*",
+			"@better-auth/expo": "~1.2.0",
+			"@geekmidas/client": GEEKMIDAS_VERSIONS["@geekmidas/client"],
+			"@geekmidas/envkit": GEEKMIDAS_VERSIONS["@geekmidas/envkit"],
+			"@react-navigation/native": "^7.1.0",
+			"@tanstack/react-query": "~5.80.0",
+			"better-auth": "~1.2.0",
+			expo: "~55.0.0",
+			"expo-constants": "~55.0.0",
+			"expo-dev-client": "~55.0.0",
+			"expo-linking": "~55.0.0",
+			"expo-router": "~55.0.0",
+			"expo-secure-store": "~14.2.0",
+			"expo-splash-screen": "~55.0.0",
+			"expo-status-bar": "~55.0.0",
+			nativewind: "~4.2.0",
+			react: "19.2.0",
+			"react-dom": "19.2.0",
+			"react-native": "0.83.6",
+			"react-native-gesture-handler": "~2.30.0",
+			"react-native-reanimated": "~4.2.0",
+			"react-native-safe-area-context": "~5.6.0",
+			"react-native-screens": "~4.23.0",
+			"react-native-web": "~0.21.0",
+			tailwindcss: "~3.4.0"
+		},
+		devDependencies: {
+			"@babel/core": "^7.25.0",
+			"@types/react": "~19.0.0",
+			typescript: "~5.8.2"
+		}
 	};
-	const commonTs = `import { z } from 'zod';
-
-// ============================================
-// Common Schemas
-// ============================================
-
-export const IdSchema = z.uuid();
+	const appConfig = `import type { ConfigContext, ExpoConfig } from '@expo/config';
 
-export const IdParamsSchema = z.object({
-  id: IdSchema,
-});
-
-export const TimestampsSchema = z.object({
-  createdAt: z.coerce.date(),
-  updatedAt: z.coerce.date(),
-});
+/**
+ * Expo runtime config. Public env vars (\`EXPO_PUBLIC_*\`) are inlined
+ * at build time; everything else is read at runtime from \`extra\`.
+ */
+export default function config(_context: ConfigContext): ExpoConfig {
+  return {
+    name: '${options.name}',
+    slug: '${slug}',
+    version: '0.0.1',
+    orientation: 'portrait',
+    icon: './assets/icon.png',
+    scheme: '${scheme}',
+    userInterfaceStyle: 'automatic',
+    newArchEnabled: true,
+    ios: {
+      supportsTablet: true,
+      bundleIdentifier: '${bundleId}',
+    },
+    android: {
+      package: '${bundleId}',
+      adaptiveIcon: {
+        foregroundImage: './assets/adaptive-icon.png',
+        backgroundColor: '#ffffff',
+      },
+      edgeToEdgeEnabled: true,
+    },
+    web: {
+      output: 'static',
+    },
+    plugins: [
+      'expo-router',
+      'expo-secure-store',
+      [
+        'expo-splash-screen',
+        {
+          image: './assets/splash.png',
+          imageWidth: 200,
+          resizeMode: 'contain',
+          backgroundColor: '#ffffff',
+        },
+      ],
+    ],
+    experiments: {
+      typedRoutes: true,
+    },
+  };
+}
+`;
+	const easJson = {
+		cli: {
+			version: ">= 10.2.1",
+			appVersionSource: "remote"
+		},
+		build: {
+			dev: {
+				developmentClient: true,
+				distribution: "internal",
+				environment: "development",
+				env: {
+					EXPO_PUBLIC_API_URL: "http://localhost:3000",
+					EXPO_PUBLIC_AUTH_URL: "http://localhost:3002"
+				}
+			},
+			preview: {
+				distribution: "internal",
+				environment: "preview",
+				env: {
+					EXPO_PUBLIC_API_URL: "https://api.example.com",
+					EXPO_PUBLIC_AUTH_URL: "https://auth.example.com"
+				}
+			},
+			production: {
+				autoIncrement: true,
+				environment: "production",
+				env: {
+					EXPO_PUBLIC_API_URL: "https://api.example.com",
+					EXPO_PUBLIC_AUTH_URL: "https://auth.example.com"
+				}
+			}
+		}
+	};
+	const babelConfig = `module.exports = function (api) {
+  api.cache(true);
+  return {
+    presets: [
+      ['babel-preset-expo', { jsxImportSource: 'nativewind' }],
+      'nativewind/babel',
+    ],
+  };
+};
+`;
+	const metroConfig = `const { getDefaultConfig } = require('expo/metro-config');
+const { withNativeWind } = require('nativewind/metro');
+
+const config = getDefaultConfig(__dirname);
+
+module.exports = withNativeWind(config, { input: './global.css' });
+`;
+	const tsConfig = {
+		extends: "expo/tsconfig.base",
+		compilerOptions: {
+			strict: true,
+			allowImportingTsExtensions: true,
+			types: ["nativewind/types"],
+			paths: {
+				"@/*": ["./*"],
+				[modelsPackage]: ["../../packages/models/src"],
+				[`${modelsPackage}/*`]: ["../../packages/models/src/*"],
+				[`${apiPackage}/client`]: ["../../apps/api/.gkm/openapi.ts"]
+			}
+		},
+		include: [
+			"**/*.ts",
+			"**/*.tsx",
+			".expo/types/**/*.ts",
+			"expo-env.d.ts",
+			"nativewind-env.d.ts"
+		]
+	};
+	const tailwindConfig = `import type { Config } from 'tailwindcss';
+
+export default {
+  content: ['./app/**/*.{ts,tsx}', './components/**/*.{ts,tsx}'],
+  presets: [require('nativewind/preset')],
+  theme: {
+    extend: {},
+  },
+  plugins: [],
+} satisfies Config;
+`;
+	const globalCss = `@tailwind base;
+@tailwind components;
+@tailwind utilities;
+`;
+	const expoEnvDts = `/// <reference types="expo/types" />\n`;
+	const nativewindEnvDts = `/// <reference types="nativewind/types" />\n`;
+	const configTs = `import { EnvironmentParser } from '@geekmidas/envkit';
+
+/**
+ * Public app config. EXPO_PUBLIC_* vars are inlined into the bundle at
+ * build time, so they're safe to read in client code.
+ */
+const envParser = new EnvironmentParser({
+  EXPO_PUBLIC_API_URL: process.env.EXPO_PUBLIC_API_URL,
+  EXPO_PUBLIC_AUTH_URL: process.env.EXPO_PUBLIC_AUTH_URL,
+});
+
+export const config = envParser
+  .create((get) => ({
+    apiUrl: get('EXPO_PUBLIC_API_URL').string(),
+    authUrl: get('EXPO_PUBLIC_AUTH_URL').string(),
+  }))
+  .parse();
+`;
+	const queryClientTs = `import { QueryClient } from '@tanstack/react-query';
+
+export const queryClient = new QueryClient({
+  defaultOptions: {
+    queries: {
+      staleTime: 60 * 1000,
+    },
+  },
+});
+`;
+	const authClientTs = `import { expoClient } from '@better-auth/expo/client';
+import { magicLinkClient } from 'better-auth/client/plugins';
+import { createAuthClient } from 'better-auth/react';
+import * as SecureStore from 'expo-secure-store';
+
+import { config } from '@/config.ts';
+
+export const STORAGE_PREFIX = '${scheme}';
+export const COOKIE_STORE_KEY = \`\${STORAGE_PREFIX}_cookie\`;
+
+export const authClient = createAuthClient({
+  baseURL: config.authUrl,
+  plugins: [
+    expoClient({
+      scheme: '${scheme}',
+      storagePrefix: STORAGE_PREFIX,
+      storage: SecureStore,
+    }),
+    magicLinkClient(),
+  ],
+});
+
+export const { signIn, useSession } = authClient;
+
+export async function signOut() {
+  try {
+    await authClient.signOut();
+  } finally {
+    await SecureStore.deleteItemAsync(COOKIE_STORE_KEY);
+  }
+}
+`;
+	const apiTs = `import { createApi } from '${apiPackage}/client';
+
+import { config } from '@/config.ts';
+import { authClient } from './auth-client.ts';
+import { queryClient } from './query-client.ts';
+
+export function createAppApi(options?: { headers?: Record<string, string> }) {
+  return createApi({
+    baseURL: config.apiUrl,
+    queryClient,
+    headers: options?.headers,
+    onRequest: (cfg) => {
+      const cookie = authClient.getCookie();
+      const next = { ...cfg, credentials: 'omit' as const };
+      if (cookie) {
+        return {
+          ...next,
+          headers: { ...(next.headers ?? {}), Cookie: cookie },
+        };
+      }
+      return next;
+    },
+  });
+}
+`;
+	const apiContextTsx = `import { createContext, type ReactNode, use } from 'react';
+import type { createAppApi } from './api.ts';
+
+export type Api = ReturnType<typeof createAppApi>;
+
+const ApiContext = createContext<Api | null>(null);
+
+export function ApiProvider({
+  api,
+  children,
+}: {
+  api: Api;
+  children: ReactNode;
+}) {
+  return <ApiContext.Provider value={api}>{children}</ApiContext.Provider>;
+}
+
+export function useApi(): Api {
+  const api = use(ApiContext);
+  if (!api) {
+    throw new Error('useApi must be used within an ApiProvider');
+  }
+  return api;
+}
+`;
+	const layoutTsx = `import '../global.css';
+
+import { QueryClientProvider } from '@tanstack/react-query';
+import { Stack, useRouter, useSegments } from 'expo-router';
+import { StatusBar } from 'expo-status-bar';
+import { useEffect, useMemo } from 'react';
+import 'react-native-reanimated';
+
+import { authClient } from '@/lib/auth-client.ts';
+import { ApiProvider } from '@/lib/api-context.tsx';
+import { createAppApi } from '@/lib/api.ts';
+import { queryClient } from '@/lib/query-client.ts';
+
+function AuthGate({ children }: { children: React.ReactNode }) {
+  const router = useRouter();
+  const segments = useSegments();
+  const { data: session, isPending } = authClient.useSession();
+
+  useEffect(() => {
+    if (isPending) return;
+    const onAuthRoute = segments[0] === 'login';
+    if (!session && !onAuthRoute) {
+      router.replace('/login');
+    } else if (session && onAuthRoute) {
+      router.replace('/');
+    }
+  }, [isPending, session, segments, router]);
+
+  return <>{children}</>;
+}
+
+export default function RootLayout() {
+  const api = useMemo(() => createAppApi(), []);
+
+  return (
+    <QueryClientProvider client={queryClient}>
+      <ApiProvider api={api}>
+        <AuthGate>
+          <Stack screenOptions={{ headerShown: false }}>
+            <Stack.Screen name="index" />
+            <Stack.Screen name="login" />
+          </Stack>
+        </AuthGate>
+        <StatusBar style="auto" />
+      </ApiProvider>
+    </QueryClientProvider>
+  );
+}
+`;
+	const indexTsx = `import { Pressable, Text, View } from 'react-native';
+import { SafeAreaView } from 'react-native-safe-area-context';
+
+import { signOut, useSession } from '@/lib/auth-client.ts';
+import { useApi } from '@/lib/api-context.tsx';
+
+export default function Home() {
+  const { data: session } = useSession();
+  const api = useApi();
+  const { data: health } = api.useQuery('GET /health', {});
+
+  return (
+    <SafeAreaView className="flex-1 bg-white">
+      <View className="flex-1 items-center justify-center gap-4 px-6">
+        <Text className="text-3xl font-bold text-slate-900">
+          Welcome to ${options.name}
+        </Text>
+        {session ? (
+          <Text className="text-sm text-slate-500">
+            Signed in as {session.user.email}
+          </Text>
+        ) : null}
+        {health ? (
+          <Text className="text-xs text-slate-400">
+            API: {JSON.stringify(health)}
+          </Text>
+        ) : null}
+        <Pressable
+          onPress={signOut}
+          className="mt-4 rounded-lg bg-slate-900 px-6 py-3"
+        >
+          <Text className="font-semibold text-white">Sign out</Text>
+        </Pressable>
+      </View>
+    </SafeAreaView>
+  );
+}
+`;
+	const loginTsx = `import * as Linking from 'expo-linking';
+import { useState } from 'react';
+import {
+  KeyboardAvoidingView,
+  Platform,
+  Pressable,
+  Text,
+  TextInput,
+  View,
+} from 'react-native';
+import { SafeAreaView } from 'react-native-safe-area-context';
+
+import { authClient } from '@/lib/auth-client.ts';
+
+const EMAIL_RE = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;
+
+export default function LoginScreen() {
+  const [email, setEmail] = useState('');
+  const [submitting, setSubmitting] = useState(false);
+  const [sent, setSent] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  async function handleSubmit() {
+    if (!EMAIL_RE.test(email.trim())) {
+      setError('Enter a valid email address');
+      return;
+    }
+    setError(null);
+    setSubmitting(true);
+
+    const callbackURL = Linking.createURL('/').replace(/^(\\w+):\\/\\/\\//, '$1://');
+    try {
+      const result = await authClient.signIn.magicLink({
+        email: email.trim(),
+        callbackURL,
+      });
+      if (result.error) {
+        setError(result.error.message ?? 'Could not send magic link');
+        return;
+      }
+      setSent(true);
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Something went wrong');
+    } finally {
+      setSubmitting(false);
+    }
+  }
+
+  if (sent) {
+    return (
+      <SafeAreaView className="flex-1 bg-white">
+        <View className="flex-1 items-center justify-center px-6">
+          <Text className="text-2xl font-bold text-slate-900">
+            Check your inbox
+          </Text>
+          <Text className="mt-3 text-center text-slate-500">
+            We sent a sign-in link to {email.trim()}
+          </Text>
+        </View>
+      </SafeAreaView>
+    );
+  }
+
+  return (
+    <SafeAreaView className="flex-1 bg-white">
+      <KeyboardAvoidingView
+        behavior={Platform.OS === 'ios' ? 'padding' : undefined}
+        className="flex-1"
+      >
+        <View className="flex-1 justify-center px-6">
+          <Text className="text-3xl font-bold text-slate-900">Sign in</Text>
+          <Text className="mt-1 text-sm text-slate-500">
+            We'll email you a one-time sign-in link.
+          </Text>
+
+          <Text className="mt-6 text-xs font-semibold uppercase text-slate-500">
+            Email
+          </Text>
+          <TextInput
+            value={email}
+            onChangeText={(v) => {
+              setEmail(v);
+              if (error) setError(null);
+            }}
+            autoCapitalize="none"
+            autoCorrect={false}
+            keyboardType="email-address"
+            placeholder="you@example.com"
+            placeholderTextColor="#94a3b8"
+            editable={!submitting}
+            className="mt-2 rounded-lg border border-slate-300 px-4 py-3"
+          />
+          {error ? (
+            <Text className="mt-2 text-sm text-red-600">{error}</Text>
+          ) : null}
+
+          <Pressable
+            onPress={handleSubmit}
+            disabled={submitting}
+            className="mt-6 items-center rounded-lg bg-slate-900 py-4 disabled:opacity-60"
+          >
+            <Text className="font-semibold text-white">
+              {submitting ? 'Sending…' : 'Email me a sign-in link'}
+            </Text>
+          </Pressable>
+        </View>
+      </KeyboardAvoidingView>
+    </SafeAreaView>
+  );
+}
+`;
+	const gitignore = `node_modules/
+.expo/
+dist/
+*.log
+.env*.local
+ios/
+android/
+.eas/
+`;
+	return [
+		{
+			path: "apps/app/package.json",
+			content: `${JSON.stringify(packageJson, null, 2)}\n`
+		},
+		{
+			path: "apps/app/app.config.ts",
+			content: appConfig
+		},
+		{
+			path: "apps/app/eas.json",
+			content: `${JSON.stringify(easJson, null, 2)}\n`
+		},
+		{
+			path: "apps/app/babel.config.js",
+			content: babelConfig
+		},
+		{
+			path: "apps/app/metro.config.js",
+			content: metroConfig
+		},
+		{
+			path: "apps/app/tsconfig.json",
+			content: `${JSON.stringify(tsConfig, null, 2)}\n`
+		},
+		{
+			path: "apps/app/tailwind.config.ts",
+			content: tailwindConfig
+		},
+		{
+			path: "apps/app/global.css",
+			content: globalCss
+		},
+		{
+			path: "apps/app/expo-env.d.ts",
+			content: expoEnvDts
+		},
+		{
+			path: "apps/app/nativewind-env.d.ts",
+			content: nativewindEnvDts
+		},
+		{
+			path: "apps/app/config.ts",
+			content: configTs
+		},
+		{
+			path: "apps/app/lib/query-client.ts",
+			content: queryClientTs
+		},
+		{
+			path: "apps/app/lib/auth-client.ts",
+			content: authClientTs
+		},
+		{
+			path: "apps/app/lib/api.ts",
+			content: apiTs
+		},
+		{
+			path: "apps/app/lib/api-context.tsx",
+			content: apiContextTsx
+		},
+		{
+			path: "apps/app/app/_layout.tsx",
+			content: layoutTsx
+		},
+		{
+			path: "apps/app/app/index.tsx",
+			content: indexTsx
+		},
+		{
+			path: "apps/app/app/login.tsx",
+			content: loginTsx
+		},
+		{
+			path: "apps/app/.gitignore",
+			content: gitignore
+		}
+	];
+}
+
+//#endregion
+//#region src/init/generators/models.ts
+/**
+* Generate packages/models for shared Zod schemas (monorepo only)
+*/
+function generateModelsPackage(options) {
+	if (!options.monorepo) return [];
+	const packageName = `@${options.name}/models`;
+	const packageJson = {
+		name: packageName,
+		version: "0.0.1",
+		private: true,
+		type: "module",
+		exports: { "./*": "./src/*.ts" },
+		scripts: { typecheck: "tsc --noEmit" },
+		dependencies: {},
+		devDependencies: { typescript: "~5.8.2" }
+	};
+	const tsConfig = {
+		extends: "../../tsconfig.json",
+		compilerOptions: {
+			noEmit: true,
+			allowImportingTsExtensions: true
+		},
+		include: ["src/**/*.ts"],
+		exclude: ["node_modules", "dist"]
+	};
+	const commonTs = `import { z } from 'zod';
+
+// ============================================
+// Common Schemas
+// ============================================
+
+export const IdSchema = z.uuid();
+
+export const IdParamsSchema = z.object({
+  id: IdSchema,
+});
+
+export const TimestampsSchema = z.object({
+  createdAt: z.coerce.date(),
+  updatedAt: z.coerce.date(),
+});
 
 export const PaginationSchema = z.object({
   page: z.coerce.number().int().positive().default(1),
@@ -8111,6 +8888,43 @@ export default defineConfig({
 	return files;
 }
 /**
+* Generate the frontend app entry for the workspace config based on the
+* selected `frontendFramework`. Defaults to Next.js for backwards compat.
+*/
+function generateFrontendAppEntry(options) {
+	switch (options.frontendFramework) {
+		case "tanstack-start": return `web: {
+      type: 'web',
+      framework: 'tanstack-start',
+      path: 'apps/web',
+      port: 3001,
+      dependencies: ['api', 'auth'],
+      config: {
+        client: './src/config/client.ts',
+        server: './src/config/server.ts',
+      },
+    },`;
+		case "expo": return `app: {
+      type: 'mobile',
+      framework: 'expo',
+      path: 'apps/app',
+      port: 8081,
+      dependencies: ['api', 'auth'],
+    },`;
+		default: return `web: {
+      type: 'web',
+      framework: 'nextjs',
+      path: 'apps/web',
+      port: 3001,
+      dependencies: ['api', 'auth'],
+      config: {
+        client: './src/config/client.ts',
+        server: './src/config/server.ts',
+      },
+    },`;
+	}
+}
+/**
 * Generate gkm.config.ts with defineWorkspace for fullstack template
 */
 function generateWorkspaceConfig(options) {
@@ -8151,20 +8965,10 @@ export default defineWorkspace({
       port: 3002,
       entry: './src/index.ts',
       framework: 'better-auth',
-      envParser: './src/config/env#envParser',
-      logger: './src/config/logger#logger',
-    },
-    web: {
-      type: 'frontend',
-      framework: 'nextjs',
-      path: 'apps/web',
-      port: 3001,
-      dependencies: ['api', 'auth'],
-      config: {
-        client: './src/config/client.ts',
-        server: './src/config/server.ts',
-      },
+      envParser: './src/config/env#envParser',
+      logger: './src/config/logger#logger',
     },
+    ${generateFrontendAppEntry(options)}
   },
   shared: {
     packages: ['packages/*'],
@@ -9067,6 +9871,26 @@ const templateChoices = [{
 	description: "Monorepo with API + Next.js + shared models"
 }];
 /**
+* Frontend framework choices for the fullstack template prompt.
+*/
+const frontendFrameworkChoices = [
+	{
+		title: "Next.js",
+		value: "nextjs",
+		description: "React server components, app router (default)"
+	},
+	{
+		title: "TanStack Start",
+		value: "tanstack-start",
+		description: "File-based router on Vite + Nitro"
+	},
+	{
+		title: "Expo",
+		value: "expo",
+		description: "React Native mobile app (iOS + Android)"
+	}
+];
+/**
 * Logger type choices for prompts
 */
 const loggerTypeChoices = [{
@@ -11174,6 +11998,382 @@ node_modules/
 	];
 }
 
+//#endregion
+//#region src/init/generators/web-tanstack.ts
+/**
+* Generate TanStack Start web app files for the fullstack template.
+*
+* Mirrors the Next.js scaffold (apps/web) but on Vite + TanStack Start +
+* TanStack Router with the `VITE_` env-var convention.
+*/
+function generateTanStackWebFiles(options) {
+	if (!options.monorepo || options.template !== "fullstack") return [];
+	const packageName = `@${options.name}/web`;
+	const apiPackage = `@${options.name}/api`;
+	const modelsPackage = `@${options.name}/models`;
+	const uiPackage = `@${options.name}/ui`;
+	const packageJson = {
+		name: packageName,
+		version: "0.0.1",
+		private: true,
+		type: "module",
+		scripts: {
+			dev: "gkm exec -- vite dev",
+			build: "gkm exec -- vite build",
+			start: "node .output/server/index.mjs",
+			typecheck: "tsc --noEmit"
+		},
+		dependencies: {
+			[apiPackage]: "workspace:*",
+			[modelsPackage]: "workspace:*",
+			[uiPackage]: "workspace:*",
+			"@geekmidas/client": GEEKMIDAS_VERSIONS["@geekmidas/client"],
+			"@geekmidas/envkit": GEEKMIDAS_VERSIONS["@geekmidas/envkit"],
+			"@tanstack/react-query": "~5.80.0",
+			"@tanstack/react-router": "^1.87.0",
+			"@tanstack/react-start": "^1.87.0",
+			"better-auth": "~1.2.0",
+			react: "~19.2.0",
+			"react-dom": "~19.2.0"
+		},
+		devDependencies: {
+			"@geekmidas/cli": GEEKMIDAS_VERSIONS["@geekmidas/cli"],
+			"@tailwindcss/vite": "^4.0.0",
+			"@tanstack/router-plugin": "^1.87.0",
+			"@types/node": "~22.0.0",
+			"@types/react": "~19.0.0",
+			"@types/react-dom": "~19.0.0",
+			"@vitejs/plugin-react": "^4.3.4",
+			tailwindcss: "^4.0.0",
+			tsx: "~4.20.0",
+			typescript: "~5.8.2",
+			vite: "^7.0.0",
+			"vite-tsconfig-paths": "~5.1.0"
+		}
+	};
+	const viteConfig = `import { Credentials } from '@geekmidas/envkit/credentials';
+import tailwindcss from '@tailwindcss/vite';
+import { tanstackStart } from '@tanstack/react-start/plugin/vite';
+import viteReact from '@vitejs/plugin-react';
+import { defineConfig } from 'vite';
+import tsconfigPaths from 'vite-tsconfig-paths';
+
+export default defineConfig({
+  server: {
+    port: Number(Credentials.PORT ?? 3001),
+  },
+  // VITE_* vars are inlined automatically; no manual loadEnv needed.
+  envPrefix: 'VITE_',
+  plugins: [
+    tsconfigPaths({ root: import.meta.dirname }),
+    tailwindcss(),
+    tanstackStart(),
+    viteReact(),
+  ],
+});
+`;
+	const tsConfig = {
+		extends: "../../tsconfig.json",
+		compilerOptions: {
+			lib: [
+				"dom",
+				"dom.iterable",
+				"ES2022"
+			],
+			allowJs: true,
+			skipLibCheck: true,
+			strict: true,
+			noEmit: true,
+			allowImportingTsExtensions: true,
+			esModuleInterop: true,
+			module: "ESNext",
+			moduleResolution: "bundler",
+			resolveJsonModule: true,
+			isolatedModules: true,
+			jsx: "preserve",
+			incremental: true,
+			baseUrl: ".",
+			types: ["vite/client"],
+			paths: {
+				"~/*": ["./src/*", "../../packages/ui/src/*"],
+				[modelsPackage]: ["../../packages/models/src"],
+				[`${modelsPackage}/*`]: ["../../packages/models/src/*"],
+				[uiPackage]: ["../../packages/ui/src"],
+				[`${uiPackage}/*`]: ["../../packages/ui/src/*"],
+				[`${apiPackage}/client`]: ["../../apps/api/.gkm/openapi.ts"]
+			}
+		},
+		include: [
+			"**/*.ts",
+			"**/*.tsx",
+			"src/routeTree.gen.ts"
+		],
+		exclude: [
+			"node_modules",
+			".output",
+			".vinxi",
+			"dist"
+		]
+	};
+	const queryClientTs = `import { QueryClient } from '@tanstack/react-query';
+
+function makeQueryClient() {
+  return new QueryClient({
+    defaultOptions: {
+      queries: {
+        staleTime: 60 * 1000,
+      },
+    },
+  });
+}
+
+let browserQueryClient: QueryClient | undefined = undefined;
+
+export function getQueryClient() {
+  if (typeof window === 'undefined') {
+    return makeQueryClient();
+  }
+  if (!browserQueryClient) browserQueryClient = makeQueryClient();
+  return browserQueryClient;
+}
+`;
+	const clientConfigTs = `import { EnvironmentParser } from '@geekmidas/envkit';
+
+// Client config - VITE_* vars are inlined at build time.
+const envParser = new EnvironmentParser({
+  VITE_API_URL: import.meta.env.VITE_API_URL,
+  VITE_AUTH_URL: import.meta.env.VITE_AUTH_URL,
+});
+
+export const clientConfig = envParser
+  .create((get) => ({
+    apiUrl: get('VITE_API_URL').string(),
+    authUrl: get('VITE_AUTH_URL').string(),
+  }))
+  .parse();
+`;
+	const serverConfigTs = `import { EnvironmentParser } from '@geekmidas/envkit';
+
+// Server config - all env vars (server-side only, not exposed to browser).
+// Access these only in TanStack Start server functions / server routes.
+const envParser = new EnvironmentParser({ ...process.env });
+
+export const serverConfig = envParser
+  .create((_get) => ({
+    // Add server-only secrets here
+    // Example: stripeSecretKey: _get('STRIPE_SECRET_KEY').string(),
+  }))
+  .parse();
+`;
+	const authClientTs = `import { magicLinkClient } from 'better-auth/client/plugins';
+import { createAuthClient } from 'better-auth/react';
+import { clientConfig } from '~/config/client.ts';
+
+export const authClient = createAuthClient({
+  baseURL: clientConfig.authUrl,
+  plugins: [magicLinkClient()],
+});
+
+export const { signIn, signUp, signOut, useSession, magicLink } = authClient;
+`;
+	const apiIndexTs = `import { createApi } from '${apiPackage}/client';
+import { clientConfig } from '~/config/client.ts';
+import { getQueryClient } from '~/lib/query-client.ts';
+
+export function createAppApi(options?: { headers?: Record<string, string> }) {
+  return createApi({
+    baseURL: clientConfig.apiUrl,
+    queryClient: getQueryClient(),
+    headers: options?.headers,
+    onRequest: (config) => ({ ...config, credentials: 'include' }),
+  });
+}
+
+export const api = createAppApi();
+`;
+	const routerTs = `import { createRouter } from '@tanstack/react-router';
+import { routeTree } from './routeTree.gen.ts';
+
+export function getRouter() {
+  return createRouter({
+    routeTree,
+    scrollRestoration: true,
+    defaultPreload: 'intent',
+  });
+}
+
+declare module '@tanstack/react-router' {
+  interface Register {
+    router: ReturnType<typeof getRouter>;
+  }
+}
+`;
+	const routeTreeGen = `// This file is auto-generated by @tanstack/router-plugin.
+// It will be overwritten on the next \`vite dev\` run.
+import { rootRouteWithContext } from '@tanstack/react-router';
+
+export const routeTree = rootRouteWithContext()({
+  // Routes are populated by the plugin from src/routes/**.tsx
+} as never);
+`;
+	const rootRouteTsx = `/// <reference types="vite/client" />
+import '~/styles/globals.css';
+
+import { QueryClientProvider } from '@tanstack/react-query';
+import {
+  HeadContent,
+  Outlet,
+  Scripts,
+  createRootRoute,
+} from '@tanstack/react-router';
+import type { ReactNode } from 'react';
+import { getQueryClient } from '~/lib/query-client.ts';
+
+export const Route = createRootRoute({
+  head: () => ({
+    meta: [
+      { charSet: 'utf-8' },
+      { name: 'viewport', content: 'width=device-width, initial-scale=1' },
+      { title: '${options.name}' },
+    ],
+  }),
+  component: RootComponent,
+});
+
+function RootComponent() {
+  const queryClient = getQueryClient();
+  return (
+    <RootDocument>
+      <QueryClientProvider client={queryClient}>
+        <Outlet />
+      </QueryClientProvider>
+    </RootDocument>
+  );
+}
+
+function RootDocument({ children }: { children: ReactNode }) {
+  return (
+    <html lang="en">
+      <head>
+        <HeadContent />
+      </head>
+      <body>
+        {children}
+        <Scripts />
+      </body>
+    </html>
+  );
+}
+`;
+	const indexRouteTsx = `import { createFileRoute } from '@tanstack/react-router';
+import { api } from '~/api/index.ts';
+
+export const Route = createFileRoute('/')({
+  component: HomeComponent,
+});
+
+function HomeComponent() {
+  const { data: health } = api.useQuery('GET /health', {});
+
+  return (
+    <main className="min-h-screen bg-background p-8">
+      <div className="mx-auto max-w-4xl space-y-8">
+        <div className="space-y-2">
+          <h1 className="text-4xl font-bold tracking-tight">
+            Welcome to ${options.name}
+          </h1>
+          <p className="text-muted-foreground">
+            Your TanStack Start app is ready.
+          </p>
+        </div>
+
+        <section className="rounded-lg border p-6">
+          <h2 className="text-xl font-semibold">API Status</h2>
+          {health ? (
+            <pre className="mt-4 rounded bg-muted p-4 text-sm">
+              {JSON.stringify(health, null, 2)}
+            </pre>
+          ) : (
+            <p className="mt-2 text-muted-foreground">Connecting…</p>
+          )}
+        </section>
+      </div>
+    </main>
+  );
+}
+`;
+	const globalsCss = `@import '${uiPackage}/styles';
+
+@source "../..";
+@source "../../../../packages/ui/src";
+`;
+	const gitignore = `.output/
+.vinxi/
+node_modules/
+.env.local
+*.log
+src/routeTree.gen.ts
+`;
+	return [
+		{
+			path: "apps/web/package.json",
+			content: `${JSON.stringify(packageJson, null, 2)}\n`
+		},
+		{
+			path: "apps/web/vite.config.ts",
+			content: viteConfig
+		},
+		{
+			path: "apps/web/tsconfig.json",
+			content: `${JSON.stringify(tsConfig, null, 2)}\n`
+		},
+		{
+			path: "apps/web/src/lib/query-client.ts",
+			content: queryClientTs
+		},
+		{
+			path: "apps/web/src/lib/auth-client.ts",
+			content: authClientTs
+		},
+		{
+			path: "apps/web/src/config/client.ts",
+			content: clientConfigTs
+		},
+		{
+			path: "apps/web/src/config/server.ts",
+			content: serverConfigTs
+		},
+		{
+			path: "apps/web/src/api/index.ts",
+			content: apiIndexTs
+		},
+		{
+			path: "apps/web/src/router.tsx",
+			content: routerTs
+		},
+		{
+			path: "apps/web/src/routeTree.gen.ts",
+			content: routeTreeGen
+		},
+		{
+			path: "apps/web/src/routes/__root.tsx",
+			content: rootRouteTsx
+		},
+		{
+			path: "apps/web/src/routes/index.tsx",
+			content: indexRouteTsx
+		},
+		{
+			path: "apps/web/src/styles/globals.css",
+			content: globalsCss
+		},
+		{
+			path: "apps/web/.gitignore",
+			content: gitignore
+		}
+	];
+}
+
 //#endregion
 //#region src/init/utils.ts
 /**
@@ -11386,6 +12586,13 @@ async function initCommand(projectName, options = {}) {
 			message: "Routes structure:",
 			choices: routesStructureChoices,
 			initial: 0
+		},
+		{
+			type: (_prev, values) => !options.yes && (options.template === "fullstack" || values.template === "fullstack") ? "select" : null,
+			name: "frontendFramework",
+			message: "Frontend framework:",
+			choices: frontendFrameworkChoices,
+			initial: 0
 		}
 	], { onCancel });
 	const name$1 = projectName || options.name || answers.name;
@@ -11427,6 +12634,7 @@ async function initCommand(projectName, options = {}) {
 	const pkgManager = options.pm ? options.pm : options.yes ? "pnpm" : answers.packageManager ?? detectedPkgManager;
 	const deployTarget = options.yes ? "dokploy" : answers.deployTarget ?? "dokploy";
 	const database = services.db;
+	const frontendFramework = isFullstack ? options.yes ? "nextjs" : answers.frontendFramework ?? "nextjs" : void 0;
 	const templateOptions = {
 		name: name$1,
 		template,
@@ -11439,7 +12647,8 @@ async function initCommand(projectName, options = {}) {
 		apiPath: monorepo ? options.apiPath ?? "apps/api" : "",
 		packageManager: pkgManager,
 		deployTarget,
-		services
+		services,
+		frontendFramework
 	};
 	const targetDir = join(cwd, name$1);
 	const baseTemplate = getTemplate(templateOptions.template);
@@ -11467,7 +12676,7 @@ async function initCommand(projectName, options = {}) {
 	] : [];
 	const dockerFiles = isMonorepo$1 && baseTemplate ? generateDockerFiles(templateOptions, baseTemplate, dbApps) : [];
 	const rootFiles = baseTemplate ? [...generateMonorepoFiles(templateOptions, baseTemplate), ...generateModelsPackage(templateOptions)] : [];
-	const webAppFiles = isFullstack ? generateWebAppFiles(templateOptions) : [];
+	const webAppFiles = isFullstack ? frontendFramework === "tanstack-start" ? generateTanStackWebFiles(templateOptions) : frontendFramework === "expo" ? generateExpoAppFiles(templateOptions) : generateWebAppFiles(templateOptions) : [];
 	const authAppFiles = isFullstack ? generateAuthAppFiles(templateOptions) : [];
 	const uiPackageFiles = isFullstack ? generateUiPackageFiles(templateOptions) : [];
 	for (const { path, content } of rootFiles) {
@@ -11600,7 +12809,15 @@ function printNextSteps(projectName, options, pkgManager) {
 		console.log(`  │   ├── api/          # Backend API`);
 		if (isFullstackTemplate(options.template)) {
 			console.log(`  │   ├── auth/         # Auth service (better-auth)`);
-			console.log(`  │   └── web/          # Next.js frontend`);
+			switch (options.frontendFramework) {
+				case "tanstack-start":
+					console.log(`  │   └── web/          # TanStack Start frontend`);
+					break;
+				case "expo":
+					console.log(`  │   └── app/          # Expo (React Native) app`);
+					break;
+				default: console.log(`  │   └── web/          # Next.js frontend`);
+			}
 		}
 		console.log(`  ├── packages/`);
 		console.log(`  │   ├── models/       # Shared Zod schemas`);
@@ -12075,7 +13292,7 @@ function printSummary(workspace, stage) {
 	logger$1.log("\n✅ Development environment ready!\n");
 	logger$1.log("📋 Apps:");
 	for (const [name$1, app] of Object.entries(workspace.apps)) {
-		const icon = app.type === "frontend" ? "🌐" : "🔧";
+		const icon = app.type === "web" ? "🌐" : app.type === "mobile" ? "📱" : "🔧";
 		logger$1.log(`   ${icon} ${name$1} → http://localhost:${app.port}`);
 	}
 	logger$1.log("\n🚀 Next steps:");
@@ -12434,11 +13651,11 @@ program.command("api").description("Manage REST API endpoints").action(() => {
 	if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 	process.stdout.write("REST API management - coming soon\n");
 });
-program.command("openapi").description("Generate OpenAPI specification from endpoints").action(async () => {
+program.command("openapi").description("Generate OpenAPI specification from endpoints").option("--app <name>", "Workspace mode: generate for a single named backend app").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		await openapiCommand({});
+		await openapiCommand({ app: options.app });
 	} catch (error) {
 		console.error(formatError(error));
 		process.exit(1);
@@ -12549,7 +13766,7 @@ program.command("secrets:push").description("Push secrets to remote provider (SS
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await import("./config.mjs");
 		const { pushSecrets: pushSecrets$1 } = await import("./sync-COnAugP-.mjs");
-		const { reconcileMissingSecrets } = await import("./reconcile-DAAKa0YR.mjs");
+		const { reconcileMissingSecrets } = await import("./reconcile-CYGmqXvq.mjs");
 		const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1 } = await import("./storage-Cs4WBsc4.mjs");
 		const { workspace } = await loadWorkspaceConfig$1();
 		const secrets = await readStageSecrets$1(options.stage, workspace.root);
@@ -12575,7 +13792,7 @@ program.command("secrets:pull").description("Pull secrets from remote provider (
 		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await import("./config.mjs");
 		const { pullSecrets: pullSecrets$1 } = await import("./sync-COnAugP-.mjs");
 		const { writeStageSecrets: writeStageSecrets$1 } = await import("./storage-Cs4WBsc4.mjs");
-		const { reconcileMissingSecrets } = await import("./reconcile-DAAKa0YR.mjs");
+		const { reconcileMissingSecrets } = await import("./reconcile-CYGmqXvq.mjs");
 		const { workspace } = await loadWorkspaceConfig$1();
 		let secrets = await pullSecrets$1(options.stage, workspace);
 		if (!secrets) {
@@ -12600,7 +13817,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig: loadWorkspaceConfig$1 } = await import("./config.mjs");
-		const { reconcileMissingSecrets } = await import("./reconcile-DAAKa0YR.mjs");
+		const { reconcileMissingSecrets } = await import("./reconcile-CYGmqXvq.mjs");
 		const { readStageSecrets: readStageSecrets$1, writeStageSecrets: writeStageSecrets$1 } = await import("./storage-Cs4WBsc4.mjs");
 		const { workspace } = await loadWorkspaceConfig$1();
 		const secrets = await readStageSecrets$1(options.stage, workspace.root);