@geekmidas/cli 10.0.0-alpha.33 → 10.0.0-alpha.35

package/dist/index.cjs

@@ -2,10 +2,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_discover = require("./discover-CroTIm0K.cjs");
-const require_config = require("./config-DMpzmsQL.cjs");
+const require_config = require("./config-DgAHy8nY.cjs");
 const require_workspace = require("./workspace-CAJk6UmC.cjs");
 const require_storage = require("./storage-C2JC31V9.cjs");
-const require_workspace$1 = require("./workspace-C8TbIWxO.cjs");
+const require_workspace$1 = require("./workspace-CRjZkCTW.cjs");
 const require_OpenApiTsGenerator = require("./OpenApiTsGenerator-D1nhN98m.cjs");
 const require_openapi = require("./openapi.cjs");
 const require_ready = require("./ready-CXhoutix.cjs");
@@ -42,7 +42,7 @@ let _geekmidas_constructs_subscribers = require("@geekmidas/constructs/subscribe
 let _geekmidas_constructs_topic = require("@geekmidas/constructs/topic");
 let node_dns_promises = require("node:dns/promises");
 //#region package.json
-var version = "10.0.0-alpha.33";
+var version = "10.0.0-alpha.35";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -1092,9 +1092,9 @@ async function workspaceDevCommand(workspace, options) {
 		...reconciled.env
 	};
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-BkytlJlU.cjs"));
+		const { prepareDevDatabases } = await Promise.resolve().then(() => require("./migrate-nlvT-GnY.cjs"));
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await Promise.resolve().then(() => require("./migrate-BkytlJlU.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await Promise.resolve().then(() => require("./migrate-nlvT-GnY.cjs")).then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$10.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -1124,6 +1124,13 @@ async function workspaceDevCommand(workspace, options) {
 	for (const appName of buildOrder) {
 		const app = workspace.apps[appName];
 		if (!app) continue;
+		if (app.type === "mobile") {
+			const own = reconciled.plan.resources.find((r) => r.kind === "mobile-app" && require_config.appKey(r.id) === appName);
+			const scheme = own ? reconciled.env[own.envKey] : void 0;
+			const device = Object.entries(reconciled.env).find(([key]) => key.endsWith("_DEVICE_URL"))?.[1];
+			logger$10.log(`   ${appName.padEnd(width)}  ${scheme ? `${scheme}://` : "mobile"}${device ? ` — devices reach ${new URL(device).hostname}` : ""}`);
+			continue;
+		}
 		const local = `http://localhost:${app.port}`;
 		const url = Object.entries(appUrls).find(([id]) => require_config.appKey(id) === appName)?.[1];
 		logger$10.log(`   ${appName.padEnd(width)}  ${url ? `${url} -> ${local}` : local}`);
@@ -3107,6 +3114,7 @@ const PROVISIONERS = {
 		context.deferred.push(...statementsFor({
 			id: declaration.id,
 			database: postgres.databaseName,
+			ownsDatabase: true,
 			runtime,
 			owner,
 			...reads ? { reader: (0, _geekmidas_db_pg_roles.readerRole)(runtime) } : {},
@@ -3317,9 +3325,13 @@ const PROVISIONERS = {
 		if (!url) throw new SurfaceHasNoAddress(declaration.id);
 		const origins = [...new Set((0, _geekmidas_manifest.dependentsOf)(context.manifest, declaration.id).map((caller) => context.addresses?.[caller]).filter((address) => Boolean(address)))].sort();
 		const domain = (0, _geekmidas_manifest.cookieDomain)([url, ...origins]);
+		const schemes = (0, _geekmidas_manifest.dependentsOf)(context.manifest, declaration.id).flatMap((caller) => {
+			const app = context.manifest[caller];
+			return app?.kind === "mobile-app" ? (0, _geekmidas_manifest.mobileOrigins)((0, _geekmidas_manifest.schemeBase)(context.project, app.scheme)) : [];
+		});
 		return { provides: {
 			[(0, _geekmidas_manifest.provideKey)(declaration.id, "url")]: url,
-			[(0, _geekmidas_manifest.provideKey)(declaration.id, "trustedOrigins")]: origins.join(","),
+			[(0, _geekmidas_manifest.provideKey)(declaration.id, "trustedOrigins")]: [...origins, ...schemes].join(","),
 			...domain ? { [(0, _geekmidas_manifest.provideKey)(declaration.id, "cookieDomain")]: domain } : {}
 		} };
 	}
@@ -3342,6 +3354,7 @@ function statementsFor(options) {
 		owner,
 		...reader ? { reader } : {},
 		schema,
+		...options.ownsDatabase ? { database } : {},
 		passwords: {
 			runtime: derivedPassword(context, runtime),
 			owner: derivedPassword(context, owner),
@@ -8009,11 +8022,11 @@ function routesGlob(structure) {
 	}
 }
 /**
-* Plain ids — `Database`, not `Beetlefit`.
+* Plain ids — `Database`, not `Shop`.
 *
 * The workspace `name` already scopes every physical name
-* (`production-beetlefit-database`), so an id that carried the project too
-* would say it twice: `production-beetlefit-beetlefit-cache`. Within a
+* (`production-shop-database`), so an id that carried the project too
+* would say it twice: `production-shop-shop-cache`. Within a
 * workspace the constructs are declared once, at its root, so there is no
 * second app's `Database` to collide with.
 */
@@ -8739,30 +8752,32 @@ const TOOLCHAIN_VERSIONS = {
 	"@storybook/react-vite": "^10.6.0"
 };
 /**
-* The Expo app's packages, which track an Expo SDK release (55) rather than
-* their own latest: SDK 55 is tested against exactly these, React Native and
+* The Expo app's packages, which track an Expo SDK release (57) rather than
+* their own latest: SDK 57 is tested against exactly these, React Native and
 * React included, so they move when the SDK does.
 */
 const EXPO_VERSIONS = {
-	expo: "~55.0.0",
-	"expo-constants": "~55.0.0",
-	"expo-dev-client": "~55.0.0",
-	"expo-linking": "~55.0.0",
-	"expo-router": "~55.0.0",
-	"expo-splash-screen": "~55.0.0",
-	"expo-status-bar": "~55.0.0",
-	"expo-secure-store": "~14.2.0",
-	react: "19.2.0",
-	"react-dom": "19.2.0",
-	"react-native": "0.83.6",
-	"react-native-gesture-handler": "~2.30.0",
-	"react-native-reanimated": "~4.2.0",
-	"react-native-safe-area-context": "~5.6.0",
-	"react-native-screens": "~4.23.0",
+	expo: "~57.0.26",
+	"expo-constants": "~57.0.20",
+	"expo-dev-client": "~57.0.19",
+	"expo-device": "~57.0.2",
+	"expo-linking": "~57.0.11",
+	"expo-router": "~57.0.24",
+	"expo-splash-screen": "~57.0.9",
+	"expo-status-bar": "~57.0.1",
+	"expo-secure-store": "~57.0.4",
+	react: "19.2.3",
+	"react-dom": "19.2.3",
+	"react-native": "0.86.3",
+	"react-native-gesture-handler": "~2.32.0",
+	"react-native-reanimated": "4.5.1",
+	"react-native-worklets": "0.10.1",
+	"react-native-safe-area-context": "~5.7.0",
+	"react-native-screens": "~4.26.0",
 	"react-native-web": "~0.21.0",
 	"@react-navigation/native": "^7.1.0",
 	"@babel/core": "^7.25.0",
-	"@types/react": "~19.0.0",
+	"@types/react": "~19.2.2",
 	nativewind: "~4.2.0",
 	tailwindcss: "~3.4.0"
 };
@@ -8794,26 +8809,26 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.33",
-	"@geekmidas/auth": "~10.0.0-alpha.33",
-	"@geekmidas/cache": "~10.0.0-alpha.33",
-	"@geekmidas/client": "~10.0.0-alpha.33",
-	"@geekmidas/cloud": "~10.0.0-alpha.33",
-	"@geekmidas/constructs": "~10.0.0-alpha.33",
-	"@geekmidas/db": "~10.0.0-alpha.33",
-	"@geekmidas/emailkit": "~10.0.0-alpha.33",
-	"@geekmidas/envkit": "~10.0.0-alpha.33",
-	"@geekmidas/errors": "~10.0.0-alpha.33",
-	"@geekmidas/events": "~10.0.0-alpha.33",
-	"@geekmidas/logger": "~10.0.0-alpha.33",
-	"@geekmidas/manifest": "~10.0.0-alpha.33",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.33",
-	"@geekmidas/schema": "~10.0.0-alpha.33",
-	"@geekmidas/services": "~10.0.0-alpha.33",
-	"@geekmidas/storage": "~10.0.0-alpha.33",
-	"@geekmidas/studio": "~10.0.0-alpha.33",
-	"@geekmidas/telescope": "~10.0.0-alpha.33",
-	"@geekmidas/testkit": "~10.0.0-alpha.33",
+	"@geekmidas/audit": "~10.0.0-alpha.35",
+	"@geekmidas/auth": "~10.0.0-alpha.35",
+	"@geekmidas/cache": "~10.0.0-alpha.35",
+	"@geekmidas/client": "~10.0.0-alpha.35",
+	"@geekmidas/cloud": "~10.0.0-alpha.35",
+	"@geekmidas/constructs": "~10.0.0-alpha.35",
+	"@geekmidas/db": "~10.0.0-alpha.35",
+	"@geekmidas/emailkit": "~10.0.0-alpha.35",
+	"@geekmidas/envkit": "~10.0.0-alpha.35",
+	"@geekmidas/errors": "~10.0.0-alpha.35",
+	"@geekmidas/events": "~10.0.0-alpha.35",
+	"@geekmidas/logger": "~10.0.0-alpha.35",
+	"@geekmidas/manifest": "~10.0.0-alpha.35",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.35",
+	"@geekmidas/schema": "~10.0.0-alpha.35",
+	"@geekmidas/services": "~10.0.0-alpha.35",
+	"@geekmidas/storage": "~10.0.0-alpha.35",
+	"@geekmidas/studio": "~10.0.0-alpha.35",
+	"@geekmidas/telescope": "~10.0.0-alpha.35",
+	"@geekmidas/testkit": "~10.0.0-alpha.35",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -9535,8 +9550,7 @@ function generateExpoAppFiles(options) {
 	const apiPackage = `@${options.name}/api`;
 	const modelsPackage = `@${options.name}/models`;
 	const slug = options.name.toLowerCase().replace(/[^a-z0-9-]/g, "-");
-	const scheme = slug.replace(/-/g, "");
-	const bundleId = `com.${scheme}.app`;
+	const scheme = (0, _geekmidas_manifest.schemeBase)(options.name);
 	const packageJson = {
 		name: packageName,
 		version: "0.0.1",
@@ -9561,6 +9575,7 @@ function generateExpoAppFiles(options) {
 			expo: EXPO_VERSIONS["expo"],
 			"expo-constants": EXPO_VERSIONS["expo-constants"],
 			"expo-dev-client": EXPO_VERSIONS["expo-dev-client"],
+			"expo-device": EXPO_VERSIONS["expo-device"],
 			"expo-linking": EXPO_VERSIONS["expo-linking"],
 			"expo-router": EXPO_VERSIONS["expo-router"],
 			"expo-secure-store": EXPO_VERSIONS["expo-secure-store"],
@@ -9572,6 +9587,7 @@ function generateExpoAppFiles(options) {
 			"react-native": EXPO_VERSIONS["react-native"],
 			"react-native-gesture-handler": EXPO_VERSIONS["react-native-gesture-handler"],
 			"react-native-reanimated": EXPO_VERSIONS["react-native-reanimated"],
+			"react-native-worklets": EXPO_VERSIONS["react-native-worklets"],
 			"react-native-safe-area-context": EXPO_VERSIONS["react-native-safe-area-context"],
 			"react-native-screens": EXPO_VERSIONS["react-native-screens"],
 			"react-native-web": EXPO_VERSIONS["react-native-web"],
@@ -9584,27 +9600,53 @@ function generateExpoAppFiles(options) {
 		}
 	};
 	const appConfig = `import type { ConfigContext, ExpoConfig } from '@expo/config';
+import { EnvironmentParser } from '@geekmidas/envkit';
 
 /**
- * Expo runtime config. Public env vars (\`EXPO_PUBLIC_*\`) are inlined
- * at build time; everything else is read at runtime from \`extra\`.
+ * What the app is built with, from the environment \`gkm\` injects — the
+ * \`MobileApp\` construct's \`.dependsOn([api, auth])\` is where every value
+ * here comes from, so none of it is written down.
+ *
+ * - \`APP_SCHEME\`: the URL scheme for this stage — \`${scheme}\` deployed,
+ *   \`${scheme}-dev\` locally, so a development build and the store build on
+ *   one phone never answer each other's links.
+ * - \`EXPO_PUBLIC_API_URL\` / \`EXPO_PUBLIC_AUTH_URL\`: where the servers
+ *   answer. Locally that is their own port on \`localhost\`, which
+ *   \`config.ts\` points at the machine Metro was served from.
+ *
+ * Read at runtime from \`Constants.expoConfig.extra.config\` — see \`config.ts\`.
  */
-export default function config(_context: ConfigContext): ExpoConfig {
+const config = new EnvironmentParser({ ...process.env })
+  .create((get) => ({
+    scheme: get('APP_SCHEME').string(),
+    apiUrl: get('EXPO_PUBLIC_API_URL').string(),
+    authUrl: get('EXPO_PUBLIC_AUTH_URL').string(),
+  }))
+  .parse();
+
+export type Config = typeof config;
+
+// A bundle id and an Android package allow no hyphens; one per scheme, so
+// each stage installs beside the others.
+const bundleId = \`com.\${config.scheme.replace(/[^a-z0-9]/g, '')}.app\`;
+
+export default function expoConfig({ config: base }: ConfigContext): ExpoConfig {
   return {
+    ...base,
     name: '${options.name}',
     slug: '${slug}',
     version: '0.0.1',
     orientation: 'portrait',
     icon: './assets/icon.png',
-    scheme: '${scheme}',
+    scheme: config.scheme,
     userInterfaceStyle: 'automatic',
     newArchEnabled: true,
     ios: {
       supportsTablet: true,
-      bundleIdentifier: '${bundleId}',
+      bundleIdentifier: bundleId,
     },
     android: {
-      package: '${bundleId}',
+      package: bundleId,
       adaptiveIcon: {
         foregroundImage: './assets/adaptive-icon.png',
         backgroundColor: '#ffffff',
@@ -9630,6 +9672,7 @@ export default function config(_context: ConfigContext): ExpoConfig {
     experiments: {
       typedRoutes: true,
     },
+    extra: { ...base.extra, config },
   };
 }
 `;
@@ -9642,16 +9685,13 @@ export default function config(_context: ConfigContext): ExpoConfig {
 			dev: {
 				developmentClient: true,
 				distribution: "internal",
-				environment: "development",
-				env: {
-					EXPO_PUBLIC_API_URL: "http://localhost:3000",
-					EXPO_PUBLIC_AUTH_URL: "http://localhost:3002"
-				}
+				environment: "development"
 			},
 			preview: {
 				distribution: "internal",
 				environment: "preview",
 				env: {
+					APP_SCHEME: scheme,
 					EXPO_PUBLIC_API_URL: "https://api.example.com",
 					EXPO_PUBLIC_AUTH_URL: "https://auth.example.com"
 				}
@@ -9660,6 +9700,7 @@ export default function config(_context: ConfigContext): ExpoConfig {
 				autoIncrement: true,
 				environment: "production",
 				env: {
+					APP_SCHEME: scheme,
 					EXPO_PUBLIC_API_URL: "https://api.example.com",
 					EXPO_PUBLIC_AUTH_URL: "https://auth.example.com"
 				}
@@ -9721,23 +9762,49 @@ export default {
 `;
 	const expoEnvDts = `/// <reference types="expo/types" />\n`;
 	const nativewindEnvDts = `/// <reference types="nativewind/types" />\n`;
-	const configTs = `import { EnvironmentParser } from '@geekmidas/envkit';
+	const configTs = `import Constants from 'expo-constants';
+import * as Device from 'expo-device';
+import { Platform } from 'react-native';
+
+import type { Config } from './app.config.ts';
+
+const built = Constants.expoConfig?.extra?.config as Config;
+
+/** The host this device loaded the bundle from: Metro's, as the device sees it. */
+const metro = (Constants.expoConfig?.hostUri ?? '').split(':')[0];
 
 /**
- * Public app config. EXPO_PUBLIC_* vars are inlined into the bundle at
- * build time, so they're safe to read in client code.
+ * A private address on the local network — what a phone on the same Wi-Fi
+ * reaches this machine on. A tunnel's \`*.exp.direct\` host is not one: a
+ * tunnel forwards only Metro, so the servers are not behind it.
  */
-const envParser = new EnvironmentParser({
-  EXPO_PUBLIC_API_URL: process.env.EXPO_PUBLIC_API_URL,
-  EXPO_PUBLIC_AUTH_URL: process.env.EXPO_PUBLIC_AUTH_URL,
-});
+const isLan = (host: string) =>
+  /^10\\./.test(host) ||
+  /^192\\.168\\./.test(host) ||
+  /^172\\.(1[6-9]|2\\d|3[01])\\./.test(host);
 
-export const config = envParser
-  .create((get) => ({
-    apiUrl: get('EXPO_PUBLIC_API_URL').string(),
-    authUrl: get('EXPO_PUBLIC_AUTH_URL').string(),
-  }))
-  .parse();
+/** \`localhost\` from inside the Android emulator is the emulator itself. */
+const isAndroidEmulator = Platform.OS === 'android' && !Device.isDevice;
+
+/**
+ * A server's URL as this device reaches it.
+ *
+ * Locally the servers are injected as \`http://localhost:<port>\`. That is this
+ * device only on the iOS simulator. The Android emulator reaches this machine
+ * at \`10.0.2.2\`, and a phone at the LAN address Metro was served from.
+ * Deployed URLs have no \`localhost\` in them and pass through untouched.
+ */
+export function reachable(url: string): string {
+  const host = isLan(metro) ? metro : isAndroidEmulator ? '10.0.2.2' : undefined;
+  if (!host) return url;
+  return url.replace(/\\/\\/(localhost|127\\.0\\.0\\.1)(?=[:/]|$)/, \`//\${host}\`);
+}
+
+export const config = {
+  scheme: built.scheme,
+  apiUrl: reachable(built.apiUrl),
+  authUrl: reachable(built.authUrl),
+};
 `;
 	const queryClientTs = `import { QueryClient } from '@tanstack/react-query';
 
@@ -9749,21 +9816,23 @@ export const queryClient = new QueryClient({
   },
 });
 `;
-	const authClientTs = `import { expoClient } from '@better-auth/expo/client';
+	const authClientTs = `import { expoClient, getSetCookie } from '@better-auth/expo/client';
 import { magicLinkClient } from 'better-auth/client/plugins';
 import { createAuthClient } from 'better-auth/react';
+import * as Linking from 'expo-linking';
 import * as SecureStore from 'expo-secure-store';
+import { useEffect } from 'react';
 
 import { config } from '@/config.ts';
 
-export const STORAGE_PREFIX = '${scheme}';
+export const STORAGE_PREFIX = config.scheme;
 export const COOKIE_STORE_KEY = \`\${STORAGE_PREFIX}_cookie\`;
 
 export const authClient = createAuthClient({
   baseURL: config.authUrl,
   plugins: [
     expoClient({
-      scheme: '${scheme}',
+      scheme: config.scheme,
       storagePrefix: STORAGE_PREFIX,
       storage: SecureStore,
     }),
@@ -9773,6 +9842,36 @@ export const authClient = createAuthClient({
 
 export const { signIn, useSession } = authClient;
 
+/**
+ * Sign in from the emailed link.
+ *
+ * The link opens in the phone's browser, which is what receives the session
+ * cookie — not the app. The auth server's Expo plugin carries the cookie on the
+ * redirect back into the app (\`?cookie=\`), and this stores it where the
+ * Expo client keeps its own, merged with what is already there, then tells the
+ * client the session changed. The Expo client does this itself only for a
+ * sign-in it opened (social); a link opened from mail arrives as a deep link.
+ *
+ * Called once, from the root layout.
+ */
+export function useSessionFromLink() {
+  const url = Linking.useLinkingURL();
+
+  useEffect(() => {
+    const cookie = url ? Linking.parse(url).queryParams?.cookie : undefined;
+    if (typeof cookie !== 'string') return;
+
+    void (async () => {
+      const previous = await SecureStore.getItemAsync(COOKIE_STORE_KEY);
+      await SecureStore.setItemAsync(
+        COOKIE_STORE_KEY,
+        getSetCookie(cookie, previous ?? undefined),
+      );
+      authClient.$store.notify('$sessionSignal');
+    })();
+  }, [url]);
+}
+
 export async function signOut() {
   try {
     await authClient.signOut();
@@ -9839,7 +9938,7 @@ import { StatusBar } from 'expo-status-bar';
 import { useEffect, useMemo } from 'react';
 import 'react-native-reanimated';
 
-import { authClient } from '@/lib/auth-client.ts';
+import { authClient, useSessionFromLink } from '@/lib/auth-client.ts';
 import { ApiProvider } from '@/lib/api-context.tsx';
 import { createAppApi } from '@/lib/api.ts';
 import { queryClient } from '@/lib/query-client.ts';
@@ -9864,6 +9963,8 @@ function AuthGate({ children }: { children: React.ReactNode }) {
 
 export default function RootLayout() {
   const api = useMemo(() => createAppApi(), []);
+  // The emailed sign-in link comes back as a deep link carrying the session.
+  useSessionFromLink();
 
   return (
     <QueryClientProvider client={queryClient}>
@@ -10385,7 +10486,20 @@ function rootConstructDependencies(options) {
 		pg: DEPENDENCY_VERSIONS.pg,
 		...options.constructs.uploads ? { "@geekmidas/storage": v["@geekmidas/storage"] } : {},
 		...options.constructs.mail ? { "@geekmidas/emailkit": v["@geekmidas/emailkit"] } : {},
-		...options.constructs.cache ? { "@geekmidas/cache": v["@geekmidas/cache"] } : {}
+		...options.constructs.cache ? { "@geekmidas/cache": v["@geekmidas/cache"] } : {},
+		...options.frontendFramework === "expo" ? { "@better-auth/expo": DEPENDENCY_VERSIONS["better-auth"] } : {}
+	};
+}
+/**
+* What `test/factories/` imports at the root: the factory and faker, and
+* Kysely's types where the root does not already install it for the
+* constructs.
+*/
+function rootFactoryDependencies(options) {
+	return {
+		"@geekmidas/testkit": GEEKMIDAS_VERSIONS["@geekmidas/testkit"],
+		"@faker-js/faker": DEPENDENCY_VERSIONS["@faker-js/faker"],
+		...options.template === "fullstack" ? {} : { kysely: DEPENDENCY_VERSIONS.kysely }
 	};
 }
 /**
@@ -10427,6 +10541,7 @@ function generateMonorepoFiles(options, _template) {
 			turbo: DEPENDENCY_VERSIONS["turbo"],
 			typescript: TOOLCHAIN_VERSIONS["typescript"],
 			vitest: TOOLCHAIN_VERSIONS["vitest"],
+			...options.constructs.database ? rootFactoryDependencies(options) : {},
 			...deploy.devDependencies
 		}
 	};
@@ -10849,6 +10964,26 @@ export const api = new RestApi('Api', {
 `
 	});
 	const variant = frontendFramework === "tanstack-start" ? "{ path: 'apps/web', variant: 'tanstack' }" : frontendFramework === "expo" ? void 0 : "{ path: 'apps/web', variant: 'next' }";
+	if (frontendFramework === "expo") files.push({
+		path: "constructs/app.ts",
+		content: `import { MobileApp } from '@geekmidas/constructs/mobile-app';
+import { api } from './api.ts';
+import { auth } from './auth.ts';
+
+/**
+ * The mobile app — a construct like a site, which is what makes it an app.
+ *
+ * \`.dependsOn()\` is the single fact behind what a mobile app otherwise has
+ * written down by hand: its API and auth URLs, its URL scheme per stage, the
+ * scheme in the auth server's trusted origins, Better Auth's Expo plugin, and
+ * sign-in links a phone can open.
+ */
+export const app = new MobileApp('App', { path: 'apps/app' }).dependsOn([
+  api,
+  auth,
+]);
+`
+	});
 	if (variant !== void 0) files.push({
 		path: "constructs/site.ts",
 		content: `import { StaticSite } from '@geekmidas/constructs/site';
@@ -12055,7 +12190,7 @@ describe('example', () => {
 function generateTestFactoryFiles(options) {
 	if (!options.constructs.database) return [];
 	const db = databaseFor();
-	const schema = options.monorepo ? `@${options.name}/constructs/database.ts` : "../../src/constructs/database.ts";
+	const schema = options.monorepo && options.template === "fullstack" ? `@${options.name}/constructs/database.ts` : options.monorepo ? `../../${options.apiPath}/src/constructs/database.ts` : "../../src/constructs/database.ts";
 	return [{
 		path: `test/factories/${(0, _geekmidas_manifest.kebabCase)(db.id)}.ts`,
 		content: `import type { Kysely } from 'kysely';
@@ -15023,7 +15158,7 @@ var NoStoredSecrets = class extends Error {
 	}
 };
 async function reconcile(secrets, workspace, stage) {
-	const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-C8TbIWxO.cjs")).then((n) => n.workspace_exports);
+	const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-CRjZkCTW.cjs")).then((n) => n.workspace_exports);
 	const result = require_reconcile.reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 	return result ? {
 		secrets: result.secrets,
@@ -15422,7 +15557,7 @@ async function testCommand(options = {}) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-BkytlJlU.cjs"));
+	const { migrateAndSeed } = await Promise.resolve().then(() => require("./migrate-nlvT-GnY.cjs"));
 	const { discover } = await Promise.resolve().then(() => require("./discover-CroTIm0K.cjs")).then((n) => n.discover_exports);
 	const sources = {};
 	const manifest = await discover({
@@ -15867,7 +16002,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-BkytlJlU.cjs"));
+		const { migrateCommand } = await Promise.resolve().then(() => require("./migrate-nlvT-GnY.cjs"));
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -15881,7 +16016,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-BkytlJlU.cjs"));
+		const { seedCommand } = await Promise.resolve().then(() => require("./migrate-nlvT-GnY.cjs"));
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -15895,7 +16030,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-BkytlJlU.cjs"));
+		const { migrationCommand } = await Promise.resolve().then(() => require("./migrate-nlvT-GnY.cjs"));
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -16063,7 +16198,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-C8TbIWxO.cjs")).then((n) => n.workspace_exports);
+		const { derivedContainers } = await Promise.resolve().then(() => require("./workspace-CRjZkCTW.cjs")).then((n) => n.workspace_exports);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -16122,7 +16257,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-JhvrmjQp.cjs"));
+		const { deployGithubCommand } = await Promise.resolve().then(() => require("./github-tZmMZ7td.cjs"));
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));