@geekmidas/cli 10.0.0-alpha.34 → 10.0.0-alpha.36

package/dist/index.mjs

@@ -1,10 +1,10 @@
 #!/usr/bin/env -S npx tsx
 import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { c as isPartitionedRoutes, i as ConstructGenerator, t as discover } from "./discover-CMxesskG.mjs";
-import { a as loadConfig, c as parseModuleConfig, i as loadAppConfig, l as appKey, r as getAppNameFromCwd, s as loadWorkspaceConfig, u as derivedApps } from "./config-Du8AQJRK.mjs";
+import { a as loadConfig, c as parseModuleConfig, i as loadAppConfig, l as appKey, r as getAppNameFromCwd, s as loadWorkspaceConfig, u as derivedApps } from "./config-Dss1WwtH.mjs";
 import { D as assertDeployedStage, E as TEST_STAGE, O as deployedProblems, T as InvalidStages, a as getAppBuildOrder, b as getDeployTargetError, k as stageProblems, m as stripPublicPrefix, o as getAppGkmConfig, p as getPublicEnvPrefix, t as allConstructGlobs, x as isDeployTargetSupported } from "./workspace-CsL76tpc.mjs";
 import { c as getKeyPath, i as setCustomSecret, n as readStageSecrets, o as toEmbeddableSecrets, r as secretsExist, s as writeStageSecrets, t as maskPassword } from "./storage-BjTLjDDp.mjs";
-import { _ as findAvailablePort, b as loadSecretsForApp, c as applyPostgres, d as cacheBackendFor, f as eventsBackendFor, g as createEntryWrapper, h as createCredentialsPreload, i as reconcileWorkspace, l as resourceName, m as storageBackendFor, n as constructGlobs, o as COMPOSE_PATH, p as providerOf, r as derivedContainers, s as LOCAL_CA_PATH, t as backendsOf, u as rootSite, v as isPortAvailable, x as prepareEntryCredentials, y as loadEnvFiles } from "./workspace-DB2YHgOl.mjs";
+import { _ as findAvailablePort, b as loadSecretsForApp, c as applyPostgres, d as cacheBackendFor, f as eventsBackendFor, g as createEntryWrapper, h as createCredentialsPreload, i as reconcileWorkspace, l as resourceName, m as storageBackendFor, n as constructGlobs, o as COMPOSE_PATH, p as providerOf, r as derivedContainers, s as LOCAL_CA_PATH, t as backendsOf, u as rootSite, v as isPortAvailable, x as prepareEntryCredentials, y as loadEnvFiles } from "./workspace-EmXwO2qM.mjs";
 import { n as EndpointGenerator, r as runtimeFor } from "./OpenApiTsGenerator-hDINScnz.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
 import { a as writeTestHarness, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, o as cacheBackendsIn, s as driversFor, t as TEST_READY_ENV } from "./ready-D1BCiaYU.mjs";
@@ -19,7 +19,7 @@ import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve } from "node:path";
 import { execFile, execSync, spawn } from "node:child_process";
-import { cacheTable, canonicalId, cloudName, cookieDomain, dependentsOf, kebabCase, migrationFolder, provideKey, provisionOrder, scopedName, serviceKey } from "@geekmidas/manifest";
+import { cacheTable, canonicalId, cloudName, cookieDomain, dependentsOf, kebabCase, migrationFolder, mobileOrigins, provideKey, provisionOrder, schemeBase, scopedName, serviceKey } from "@geekmidas/manifest";
 import fg from "fast-glob";
 import chokidar from "chokidar";
 import { createCipheriv, createHash, randomBytes } from "node:crypto";
@@ -37,7 +37,7 @@ import { Subscriber } from "@geekmidas/constructs/subscribers";
 import { Topic } from "@geekmidas/constructs/topic";
 import { lookup } from "node:dns/promises";
 //#region package.json
-var version = "10.0.0-alpha.34";
+var version = "10.0.0-alpha.36";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -1087,9 +1087,9 @@ async function workspaceDevCommand(workspace, options) {
 		...reconciled.env
 	};
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-BbhXxQer.mjs");
+		const { prepareDevDatabases } = await import("./migrate-CT8b3nt_.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-BbhXxQer.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await import("./migrate-CT8b3nt_.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$10.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -1119,6 +1119,13 @@ async function workspaceDevCommand(workspace, options) {
 	for (const appName of buildOrder) {
 		const app = workspace.apps[appName];
 		if (!app) continue;
+		if (app.type === "mobile") {
+			const own = reconciled.plan.resources.find((r) => r.kind === "mobile-app" && appKey(r.id) === appName);
+			const scheme = own ? reconciled.env[own.envKey] : void 0;
+			const device = Object.entries(reconciled.env).find(([key]) => key.endsWith("_DEVICE_URL"))?.[1];
+			logger$10.log(`   ${appName.padEnd(width)}  ${scheme ? `${scheme}://` : "mobile"}${device ? ` — devices reach ${new URL(device).hostname}` : ""}`);
+			continue;
+		}
 		const local = `http://localhost:${app.port}`;
 		const url = Object.entries(appUrls).find(([id]) => appKey(id) === appName)?.[1];
 		logger$10.log(`   ${appName.padEnd(width)}  ${url ? `${url} -> ${local}` : local}`);
@@ -3313,9 +3320,13 @@ const PROVISIONERS = {
 		if (!url) throw new SurfaceHasNoAddress(declaration.id);
 		const origins = [...new Set(dependentsOf(context.manifest, declaration.id).map((caller) => context.addresses?.[caller]).filter((address) => Boolean(address)))].sort();
 		const domain = cookieDomain([url, ...origins]);
+		const schemes = dependentsOf(context.manifest, declaration.id).flatMap((caller) => {
+			const app = context.manifest[caller];
+			return app?.kind === "mobile-app" ? mobileOrigins(schemeBase(context.project, app.scheme)) : [];
+		});
 		return { provides: {
 			[provideKey(declaration.id, "url")]: url,
-			[provideKey(declaration.id, "trustedOrigins")]: origins.join(","),
+			[provideKey(declaration.id, "trustedOrigins")]: [...origins, ...schemes].join(","),
 			...domain ? { [provideKey(declaration.id, "cookieDomain")]: domain } : {}
 		} };
 	}
@@ -8000,11 +8011,11 @@ function routesGlob(structure) {
 	}
 }
 /**
-* Plain ids — `Database`, not `Beetlefit`.
+* Plain ids — `Database`, not `Shop`.
 *
 * The workspace `name` already scopes every physical name
-* (`production-beetlefit-database`), so an id that carried the project too
-* would say it twice: `production-beetlefit-beetlefit-cache`. Within a
+* (`production-shop-database`), so an id that carried the project too
+* would say it twice: `production-shop-shop-cache`. Within a
 * workspace the constructs are declared once, at its root, so there is no
 * second app's `Database` to collide with.
 */
@@ -8730,30 +8741,32 @@ const TOOLCHAIN_VERSIONS = {
 	"@storybook/react-vite": "^10.6.0"
 };
 /**
-* The Expo app's packages, which track an Expo SDK release (55) rather than
-* their own latest: SDK 55 is tested against exactly these, React Native and
+* The Expo app's packages, which track an Expo SDK release (57) rather than
+* their own latest: SDK 57 is tested against exactly these, React Native and
 * React included, so they move when the SDK does.
 */
 const EXPO_VERSIONS = {
-	expo: "~55.0.0",
-	"expo-constants": "~55.0.0",
-	"expo-dev-client": "~55.0.0",
-	"expo-linking": "~55.0.0",
-	"expo-router": "~55.0.0",
-	"expo-splash-screen": "~55.0.0",
-	"expo-status-bar": "~55.0.0",
-	"expo-secure-store": "~14.2.0",
-	react: "19.2.0",
-	"react-dom": "19.2.0",
-	"react-native": "0.83.6",
-	"react-native-gesture-handler": "~2.30.0",
-	"react-native-reanimated": "~4.2.0",
-	"react-native-safe-area-context": "~5.6.0",
-	"react-native-screens": "~4.23.0",
+	expo: "~57.0.26",
+	"expo-constants": "~57.0.20",
+	"expo-dev-client": "~57.0.19",
+	"expo-device": "~57.0.2",
+	"expo-linking": "~57.0.11",
+	"expo-router": "~57.0.24",
+	"expo-splash-screen": "~57.0.9",
+	"expo-status-bar": "~57.0.1",
+	"expo-secure-store": "~57.0.4",
+	react: "19.2.3",
+	"react-dom": "19.2.3",
+	"react-native": "0.86.3",
+	"react-native-gesture-handler": "~2.32.0",
+	"react-native-reanimated": "4.5.1",
+	"react-native-worklets": "0.10.1",
+	"react-native-safe-area-context": "~5.7.0",
+	"react-native-screens": "~4.26.0",
 	"react-native-web": "~0.21.0",
 	"@react-navigation/native": "^7.1.0",
 	"@babel/core": "^7.25.0",
-	"@types/react": "~19.0.0",
+	"@types/react": "~19.2.2",
 	nativewind: "~4.2.0",
 	tailwindcss: "~3.4.0"
 };
@@ -8785,26 +8798,26 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.34",
-	"@geekmidas/auth": "~10.0.0-alpha.34",
-	"@geekmidas/cache": "~10.0.0-alpha.34",
-	"@geekmidas/client": "~10.0.0-alpha.34",
-	"@geekmidas/cloud": "~10.0.0-alpha.34",
-	"@geekmidas/constructs": "~10.0.0-alpha.34",
-	"@geekmidas/db": "~10.0.0-alpha.34",
-	"@geekmidas/emailkit": "~10.0.0-alpha.34",
-	"@geekmidas/envkit": "~10.0.0-alpha.34",
-	"@geekmidas/errors": "~10.0.0-alpha.34",
-	"@geekmidas/events": "~10.0.0-alpha.34",
-	"@geekmidas/logger": "~10.0.0-alpha.34",
-	"@geekmidas/manifest": "~10.0.0-alpha.34",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.34",
-	"@geekmidas/schema": "~10.0.0-alpha.34",
-	"@geekmidas/services": "~10.0.0-alpha.34",
-	"@geekmidas/storage": "~10.0.0-alpha.34",
-	"@geekmidas/studio": "~10.0.0-alpha.34",
-	"@geekmidas/telescope": "~10.0.0-alpha.34",
-	"@geekmidas/testkit": "~10.0.0-alpha.34",
+	"@geekmidas/audit": "~10.0.0-alpha.36",
+	"@geekmidas/auth": "~10.0.0-alpha.36",
+	"@geekmidas/cache": "~10.0.0-alpha.36",
+	"@geekmidas/client": "~10.0.0-alpha.36",
+	"@geekmidas/cloud": "~10.0.0-alpha.36",
+	"@geekmidas/constructs": "~10.0.0-alpha.36",
+	"@geekmidas/db": "~10.0.0-alpha.36",
+	"@geekmidas/emailkit": "~10.0.0-alpha.36",
+	"@geekmidas/envkit": "~10.0.0-alpha.36",
+	"@geekmidas/errors": "~10.0.0-alpha.36",
+	"@geekmidas/events": "~10.0.0-alpha.36",
+	"@geekmidas/logger": "~10.0.0-alpha.36",
+	"@geekmidas/manifest": "~10.0.0-alpha.36",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.36",
+	"@geekmidas/schema": "~10.0.0-alpha.36",
+	"@geekmidas/services": "~10.0.0-alpha.36",
+	"@geekmidas/storage": "~10.0.0-alpha.36",
+	"@geekmidas/studio": "~10.0.0-alpha.36",
+	"@geekmidas/telescope": "~10.0.0-alpha.36",
+	"@geekmidas/testkit": "~10.0.0-alpha.36",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -9526,8 +9539,7 @@ function generateExpoAppFiles(options) {
 	const apiPackage = `@${options.name}/api`;
 	const modelsPackage = `@${options.name}/models`;
 	const slug = options.name.toLowerCase().replace(/[^a-z0-9-]/g, "-");
-	const scheme = slug.replace(/-/g, "");
-	const bundleId = `com.${scheme}.app`;
+	const scheme = schemeBase(options.name);
 	const packageJson = {
 		name: packageName,
 		version: "0.0.1",
@@ -9552,6 +9564,7 @@ function generateExpoAppFiles(options) {
 			expo: EXPO_VERSIONS["expo"],
 			"expo-constants": EXPO_VERSIONS["expo-constants"],
 			"expo-dev-client": EXPO_VERSIONS["expo-dev-client"],
+			"expo-device": EXPO_VERSIONS["expo-device"],
 			"expo-linking": EXPO_VERSIONS["expo-linking"],
 			"expo-router": EXPO_VERSIONS["expo-router"],
 			"expo-secure-store": EXPO_VERSIONS["expo-secure-store"],
@@ -9563,6 +9576,7 @@ function generateExpoAppFiles(options) {
 			"react-native": EXPO_VERSIONS["react-native"],
 			"react-native-gesture-handler": EXPO_VERSIONS["react-native-gesture-handler"],
 			"react-native-reanimated": EXPO_VERSIONS["react-native-reanimated"],
+			"react-native-worklets": EXPO_VERSIONS["react-native-worklets"],
 			"react-native-safe-area-context": EXPO_VERSIONS["react-native-safe-area-context"],
 			"react-native-screens": EXPO_VERSIONS["react-native-screens"],
 			"react-native-web": EXPO_VERSIONS["react-native-web"],
@@ -9575,27 +9589,51 @@ function generateExpoAppFiles(options) {
 		}
 	};
 	const appConfig = `import type { ConfigContext, ExpoConfig } from '@expo/config';
+import { EnvironmentParser } from '@geekmidas/envkit';
 
 /**
- * Expo runtime config. Public env vars (\`EXPO_PUBLIC_*\`) are inlined
- * at build time; everything else is read at runtime from \`extra\`.
+ * What the app is built with, from the environment \`gkm\` injects — the
+ * \`MobileApp\` construct's \`.dependsOn([api, auth])\` is where every value
+ * here comes from, so none of it is written down.
+ *
+ * - \`APP_SCHEME\`: the URL scheme — \`${scheme}\`, the same on every stage.
+ * - \`EXPO_PUBLIC_API_URL\` / \`EXPO_PUBLIC_AUTH_URL\`: where the servers
+ *   answer. Locally that is their own port on \`localhost\`, which
+ *   \`config.ts\` points at the machine Metro was served from.
+ *
+ * Read at runtime from \`Constants.expoConfig.extra.config\` — see \`config.ts\`.
  */
-export default function config(_context: ConfigContext): ExpoConfig {
+const config = new EnvironmentParser({ ...process.env })
+  .create((get) => ({
+    scheme: get('APP_SCHEME').string(),
+    apiUrl: get('EXPO_PUBLIC_API_URL').string(),
+    authUrl: get('EXPO_PUBLIC_AUTH_URL').string(),
+  }))
+  .parse();
+
+export type Config = typeof config;
+
+// A bundle id and an Android package allow no hyphens; one per scheme, so
+// each stage installs beside the others.
+const bundleId = \`com.\${config.scheme.replace(/[^a-z0-9]/g, '')}.app\`;
+
+export default function expoConfig({ config: base }: ConfigContext): ExpoConfig {
   return {
+    ...base,
     name: '${options.name}',
     slug: '${slug}',
     version: '0.0.1',
     orientation: 'portrait',
     icon: './assets/icon.png',
-    scheme: '${scheme}',
+    scheme: config.scheme,
     userInterfaceStyle: 'automatic',
     newArchEnabled: true,
     ios: {
       supportsTablet: true,
-      bundleIdentifier: '${bundleId}',
+      bundleIdentifier: bundleId,
     },
     android: {
-      package: '${bundleId}',
+      package: bundleId,
       adaptiveIcon: {
         foregroundImage: './assets/adaptive-icon.png',
         backgroundColor: '#ffffff',
@@ -9621,6 +9659,7 @@ export default function config(_context: ConfigContext): ExpoConfig {
     experiments: {
       typedRoutes: true,
     },
+    extra: { ...base.extra, config },
   };
 }
 `;
@@ -9633,16 +9672,13 @@ export default function config(_context: ConfigContext): ExpoConfig {
 			dev: {
 				developmentClient: true,
 				distribution: "internal",
-				environment: "development",
-				env: {
-					EXPO_PUBLIC_API_URL: "http://localhost:3000",
-					EXPO_PUBLIC_AUTH_URL: "http://localhost:3002"
-				}
+				environment: "development"
 			},
 			preview: {
 				distribution: "internal",
 				environment: "preview",
 				env: {
+					APP_SCHEME: scheme,
 					EXPO_PUBLIC_API_URL: "https://api.example.com",
 					EXPO_PUBLIC_AUTH_URL: "https://auth.example.com"
 				}
@@ -9651,6 +9687,7 @@ export default function config(_context: ConfigContext): ExpoConfig {
 				autoIncrement: true,
 				environment: "production",
 				env: {
+					APP_SCHEME: scheme,
 					EXPO_PUBLIC_API_URL: "https://api.example.com",
 					EXPO_PUBLIC_AUTH_URL: "https://auth.example.com"
 				}
@@ -9712,23 +9749,49 @@ export default {
 `;
 	const expoEnvDts = `/// <reference types="expo/types" />\n`;
 	const nativewindEnvDts = `/// <reference types="nativewind/types" />\n`;
-	const configTs = `import { EnvironmentParser } from '@geekmidas/envkit';
+	const configTs = `import Constants from 'expo-constants';
+import * as Device from 'expo-device';
+import { Platform } from 'react-native';
+
+import type { Config } from './app.config.ts';
+
+const built = Constants.expoConfig?.extra?.config as Config;
+
+/** The host this device loaded the bundle from: Metro's, as the device sees it. */
+const metro = (Constants.expoConfig?.hostUri ?? '').split(':')[0];
 
 /**
- * Public app config. EXPO_PUBLIC_* vars are inlined into the bundle at
- * build time, so they're safe to read in client code.
+ * A private address on the local network — what a phone on the same Wi-Fi
+ * reaches this machine on. A tunnel's \`*.exp.direct\` host is not one: a
+ * tunnel forwards only Metro, so the servers are not behind it.
  */
-const envParser = new EnvironmentParser({
-  EXPO_PUBLIC_API_URL: process.env.EXPO_PUBLIC_API_URL,
-  EXPO_PUBLIC_AUTH_URL: process.env.EXPO_PUBLIC_AUTH_URL,
-});
+const isLan = (host: string) =>
+  /^10\\./.test(host) ||
+  /^192\\.168\\./.test(host) ||
+  /^172\\.(1[6-9]|2\\d|3[01])\\./.test(host);
 
-export const config = envParser
-  .create((get) => ({
-    apiUrl: get('EXPO_PUBLIC_API_URL').string(),
-    authUrl: get('EXPO_PUBLIC_AUTH_URL').string(),
-  }))
-  .parse();
+/** \`localhost\` from inside the Android emulator is the emulator itself. */
+const isAndroidEmulator = Platform.OS === 'android' && !Device.isDevice;
+
+/**
+ * A server's URL as this device reaches it.
+ *
+ * Locally the servers are injected as \`http://localhost:<port>\`. That is this
+ * device only on the iOS simulator. The Android emulator reaches this machine
+ * at \`10.0.2.2\`, and a phone at the LAN address Metro was served from.
+ * Deployed URLs have no \`localhost\` in them and pass through untouched.
+ */
+export function reachable(url: string): string {
+  const host = isLan(metro) ? metro : isAndroidEmulator ? '10.0.2.2' : undefined;
+  if (!host) return url;
+  return url.replace(/\\/\\/(localhost|127\\.0\\.0\\.1)(?=[:/]|$)/, \`//\${host}\`);
+}
+
+export const config = {
+  scheme: built.scheme,
+  apiUrl: reachable(built.apiUrl),
+  authUrl: reachable(built.authUrl),
+};
 `;
 	const queryClientTs = `import { QueryClient } from '@tanstack/react-query';
 
@@ -9740,21 +9803,23 @@ export const queryClient = new QueryClient({
   },
 });
 `;
-	const authClientTs = `import { expoClient } from '@better-auth/expo/client';
+	const authClientTs = `import { expoClient, getSetCookie } from '@better-auth/expo/client';
 import { magicLinkClient } from 'better-auth/client/plugins';
 import { createAuthClient } from 'better-auth/react';
+import * as Linking from 'expo-linking';
 import * as SecureStore from 'expo-secure-store';
+import { useEffect } from 'react';
 
 import { config } from '@/config.ts';
 
-export const STORAGE_PREFIX = '${scheme}';
+export const STORAGE_PREFIX = config.scheme;
 export const COOKIE_STORE_KEY = \`\${STORAGE_PREFIX}_cookie\`;
 
 export const authClient = createAuthClient({
   baseURL: config.authUrl,
   plugins: [
     expoClient({
-      scheme: '${scheme}',
+      scheme: config.scheme,
       storagePrefix: STORAGE_PREFIX,
       storage: SecureStore,
     }),
@@ -9764,6 +9829,36 @@ export const authClient = createAuthClient({
 
 export const { signIn, useSession } = authClient;
 
+/**
+ * Sign in from the emailed link.
+ *
+ * The link opens in the phone's browser, which is what receives the session
+ * cookie — not the app. The auth server's Expo plugin carries the cookie on the
+ * redirect back into the app (\`?cookie=\`), and this stores it where the
+ * Expo client keeps its own, merged with what is already there, then tells the
+ * client the session changed. The Expo client does this itself only for a
+ * sign-in it opened (social); a link opened from mail arrives as a deep link.
+ *
+ * Called once, from the root layout.
+ */
+export function useSessionFromLink() {
+  const url = Linking.useLinkingURL();
+
+  useEffect(() => {
+    const cookie = url ? Linking.parse(url).queryParams?.cookie : undefined;
+    if (typeof cookie !== 'string') return;
+
+    void (async () => {
+      const previous = await SecureStore.getItemAsync(COOKIE_STORE_KEY);
+      await SecureStore.setItemAsync(
+        COOKIE_STORE_KEY,
+        getSetCookie(cookie, previous ?? undefined),
+      );
+      authClient.$store.notify('$sessionSignal');
+    })();
+  }, [url]);
+}
+
 export async function signOut() {
   try {
     await authClient.signOut();
@@ -9830,7 +9925,7 @@ import { StatusBar } from 'expo-status-bar';
 import { useEffect, useMemo } from 'react';
 import 'react-native-reanimated';
 
-import { authClient } from '@/lib/auth-client.ts';
+import { authClient, useSessionFromLink } from '@/lib/auth-client.ts';
 import { ApiProvider } from '@/lib/api-context.tsx';
 import { createAppApi } from '@/lib/api.ts';
 import { queryClient } from '@/lib/query-client.ts';
@@ -9855,6 +9950,8 @@ function AuthGate({ children }: { children: React.ReactNode }) {
 
 export default function RootLayout() {
   const api = useMemo(() => createAppApi(), []);
+  // The emailed sign-in link comes back as a deep link carrying the session.
+  useSessionFromLink();
 
   return (
     <QueryClientProvider client={queryClient}>
@@ -10376,7 +10473,8 @@ function rootConstructDependencies(options) {
 		pg: DEPENDENCY_VERSIONS.pg,
 		...options.constructs.uploads ? { "@geekmidas/storage": v["@geekmidas/storage"] } : {},
 		...options.constructs.mail ? { "@geekmidas/emailkit": v["@geekmidas/emailkit"] } : {},
-		...options.constructs.cache ? { "@geekmidas/cache": v["@geekmidas/cache"] } : {}
+		...options.constructs.cache ? { "@geekmidas/cache": v["@geekmidas/cache"] } : {},
+		...options.frontendFramework === "expo" ? { "@better-auth/expo": DEPENDENCY_VERSIONS["better-auth"] } : {}
 	};
 }
 /**
@@ -10809,7 +10907,7 @@ export const authDb = database.schema<Record<string, never>, 'AuthDb'>('AuthDb')
 	files.push(usersMigration());
 	files.push({
 		path: "constructs/auth.ts",
-		content: `import { BetterAuth } from '@geekmidas/constructs/auth';
+		content: `${frontendFramework === "expo" ? "import { expo } from '@better-auth/expo';\n" : ""}import { BetterAuth } from '@geekmidas/constructs/auth';
 import { authDb } from './database.ts';
 
 /**
@@ -10824,7 +10922,11 @@ import { authDb } from './database.ts';
 export const auth = new BetterAuth('Auth', {
   path: 'apps/auth',
   database: authDb,
-  basePath: '/api/auth',
+  basePath: '/api/auth',${frontendFramework === "expo" ? `
+  // The mobile app signs in through Better Auth's Expo plugin: it sends its
+  // scheme as the origin, and this is what reads it. The construct refuses to
+  // start without it once a MobileApp depends on this server.
+  options: { plugins: [expo()] },` : ""}
 });
 `
 	});
@@ -10853,6 +10955,26 @@ export const api = new RestApi('Api', {
 `
 	});
 	const variant = frontendFramework === "tanstack-start" ? "{ path: 'apps/web', variant: 'tanstack' }" : frontendFramework === "expo" ? void 0 : "{ path: 'apps/web', variant: 'next' }";
+	if (frontendFramework === "expo") files.push({
+		path: "constructs/app.ts",
+		content: `import { MobileApp } from '@geekmidas/constructs/mobile-app';
+import { api } from './api.ts';
+import { auth } from './auth.ts';
+
+/**
+ * The mobile app — a construct like a site, which is what makes it an app.
+ *
+ * \`.dependsOn()\` is the single fact behind what a mobile app otherwise has
+ * written down by hand: its API and auth URLs, its URL scheme, the
+ * scheme in the auth server's trusted origins, Better Auth's Expo plugin, and
+ * sign-in links a phone can open.
+ */
+export const app = new MobileApp('App', { path: 'apps/app' }).dependsOn([
+  api,
+  auth,
+]);
+`
+	});
 	if (variant !== void 0) files.push({
 		path: "constructs/site.ts",
 		content: `import { StaticSite } from '@geekmidas/constructs/site';
@@ -15027,7 +15149,7 @@ var NoStoredSecrets = class extends Error {
 	}
 };
 async function reconcile(secrets, workspace, stage) {
-	const { derivedContainers } = await import("./workspace-DB2YHgOl.mjs").then((n) => n.a);
+	const { derivedContainers } = await import("./workspace-EmXwO2qM.mjs").then((n) => n.a);
 	const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 	return result ? {
 		secrets: result.secrets,
@@ -15426,7 +15548,7 @@ async function testCommand(options = {}) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-BbhXxQer.mjs");
+	const { migrateAndSeed } = await import("./migrate-CT8b3nt_.mjs");
 	const { discover } = await import("./discover-CMxesskG.mjs").then((n) => n.n);
 	const sources = {};
 	const manifest = await discover({
@@ -15871,7 +15993,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-BbhXxQer.mjs");
+		const { migrateCommand } = await import("./migrate-CT8b3nt_.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -15885,7 +16007,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-BbhXxQer.mjs");
+		const { seedCommand } = await import("./migrate-CT8b3nt_.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -15899,7 +16021,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-BbhXxQer.mjs");
+		const { migrationCommand } = await import("./migrate-CT8b3nt_.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -16067,7 +16189,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./workspace-DB2YHgOl.mjs").then((n) => n.a);
+		const { derivedContainers } = await import("./workspace-EmXwO2qM.mjs").then((n) => n.a);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -16126,7 +16248,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-DN-92LWP.mjs");
+		const { deployGithubCommand } = await import("./github-C99BMxf0.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));