create-shopify-firebase-app 2.0.5 → 2.1.0

package/lib/index.js

@@ -22,10 +22,15 @@ import { fileURLToPath } from "node:url";
 import { execSync, spawn } from "node:child_process";
 import prompts from "prompts";
 import { provisionFirebase } from "./provision.js";
+import { preflight } from "./preflight.js";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const TEMPLATES_DIR = path.join(__dirname, "..", "templates");
 
+// Shopify rejects any app name containing "Shopify", and the app name is
+// derived from the project name — so the default must derive to a valid one.
+const DEFAULT_PROJECT_NAME = "my-store-app";
+
 // ─── ANSI helpers (no chalk dependency) ──────────────────────────────────
 const c = {
   reset: "\x1b[0m",
@@ -111,6 +116,76 @@ function parseTomlField(tomlPath, field) {
   }
 }
 
+// ─── Shopify credential helpers ──────────────────────────────────────────
+
+function matchValue(text, re) {
+  const m = String(text || "").match(re);
+  return m ? m[1].replace(/^["']|["']$/g, "") : null;
+}
+
+/**
+ * Read Client ID + Client Secret from the linked Shopify app.
+ * `shopify app env show` runs non-interactively and prints both, so the user
+ * never has to paste the secret by hand.
+ */
+function readShopifyEnv(outputDir) {
+  let output = "";
+  try {
+    output = execSync(`shopify app env show --path "${outputDir}"`, {
+      encoding: "utf8",
+      cwd: outputDir,
+      timeout: 120000,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+  } catch (e) {
+    // The CLI can exit non-zero while still having printed the values
+    output = `${e.stdout || ""}\n${e.stderr || ""}`;
+  }
+  return {
+    apiKey: matchValue(output, /SHOPIFY_API_KEY=(\S+)/),
+    apiSecret: matchValue(output, /SHOPIFY_API_SECRET=(\S+)/),
+  };
+}
+
+/** Never echo a full secret — show the prefix and the length only. */
+function maskSecret(secret) {
+  const s = String(secret || "");
+  const shown = s.slice(0, 8);
+  return `${shown}${"*".repeat(Math.max(0, s.length - shown.length))} (${s.length} chars)`;
+}
+
+// ─── App name helpers ────────────────────────────────────────────────────
+// Shopify rejects app names containing "Shopify" (case-insensitive) with:
+//   App name cannot contain "Shopify"
+
+/** Strip the reserved word and tidy whitespace. Never returns an empty name. */
+function sanitizeAppName(name) {
+  const cleaned = String(name || "")
+    .replace(/shopify/gi, "")
+    .replace(/\s+/g, " ")
+    .replace(/^[\s\-_.]+|[\s\-_.]+$/g, "")
+    .trim();
+  return cleaned || "My Store App";
+}
+
+/** Turn "my-store-app" into a valid Shopify app name: "My Store App". */
+function deriveAppName(projectName) {
+  const titled = String(projectName || "")
+    .replace(/[-_.]+/g, " ")
+    .replace(/\b\w/g, (ch) => ch.toUpperCase());
+  return sanitizeAppName(titled);
+}
+
+/** Inline validation for the app name prompt. */
+function validateAppName(v) {
+  const name = String(v || "").trim();
+  if (!name) return "Required";
+  if (/shopify/i.test(name)) {
+    return 'Shopify rejects app names containing "Shopify" — try "My Store App"';
+  }
+  return true;
+}
+
 function listFirebaseProjects() {
   try {
     const output = execSync("firebase projects:list --json", {
@@ -130,6 +205,51 @@ function listFirebaseProjects() {
   return [];
 }
 
+/**
+ * Signed-in Google accounts, newest-first as firebase-tools reports them.
+ * Only emails are read — the raw payload also carries OAuth tokens.
+ */
+function listFirebaseAccounts() {
+  try {
+    const output = execSync("firebase login:list --json", {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+    });
+    const data = JSON.parse(output);
+    if (data.status === "success" && Array.isArray(data.result)) {
+      return data.result
+        .map((a) => a?.user?.email)
+        .filter((email) => typeof email === "string" && email.length > 0);
+    }
+  } catch {}
+  return [];
+}
+
+async function useFirebaseAccount(email) {
+  try {
+    execSync(`firebase login:use ${email}`, {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    return true;
+  } catch (e) {
+    // Picking the account that is already active exits non-zero and reports it
+    // on stdout, not stderr — that is a no-op, not a failure
+    const out = `${e?.stdout || ""}${e?.stderr || ""}`;
+    return /already using account/i.test(out);
+  }
+}
+
+/** Attach Firebase resources to a project that already exists in Google Cloud. */
+async function addFirebaseToProject(projectId) {
+  try {
+    await exec(`firebase projects:addfirebase ${projectId}`);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 async function createFirebaseProject(projectId, displayName) {
   try {
     await exec(`firebase projects:create "${projectId}" --display-name "${displayName}"`);
@@ -165,9 +285,22 @@ function parseArgs(argv) {
 }
 
 // ─── File helpers ────────────────────────────────────────────────────────
+
+// Build artifacts and local state that must never leak from templates/ into a
+// scaffolded project — a stray node_modules/ here would be copied verbatim.
+const COPY_EXCLUDE = new Set([
+  "node_modules",
+  "lib",
+  "package-lock.json",
+  ".env",
+  ".firebase",
+  ".DS_Store",
+]);
+
 function copyDirSync(src, dest) {
   fs.mkdirSync(dest, { recursive: true });
   for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
+    if (COPY_EXCLUDE.has(entry.name)) continue;
     const srcPath = path.join(src, entry.name);
     const destPath = path.join(dest, entry.name);
     if (entry.isDirectory()) copyDirSync(srcPath, destPath);
@@ -193,6 +326,88 @@ function substituteVars(filePath, vars) {
   fs.writeFileSync(filePath, content);
 }
 
+// ─── Template rendering ──────────────────────────────────────────────────
+
+/**
+ * Render shopify.app.toml from the pristine template.
+ *
+ * Always rendered from templates/ — never re-substituted in place. The
+ * placeholders are consumed by the first write, so a second pass over the
+ * generated file would silently leave the earlier (empty) values behind.
+ */
+function renderAppToml(outputDir, config) {
+  const tomlPath = path.join(outputDir, "shopify.app.toml");
+
+  // Keep the identity fields the Shopify CLI writes when an app is linked
+  const preserved = [];
+  for (const field of ["handle", "organization_id"]) {
+    const val = parseTomlField(tomlPath, field);
+    if (val) preserved.push(`${field} = "${val}"`);
+  }
+
+  const vars = {
+    "{{APP_NAME}}": config.appName,
+    "{{API_KEY}}": config.apiKey || "",
+    "{{SCOPES}}": config.scopes,
+    "{{APP_URL}}": config.appUrl || "",
+  };
+
+  let content = fs.readFileSync(
+    path.join(TEMPLATES_DIR, "shopify.app.toml"),
+    "utf8",
+  );
+  for (const [key, val] of Object.entries(vars)) {
+    content = content.replaceAll(key, val);
+  }
+  if (preserved.length > 0) {
+    content = content.replace(/^client_id = .*$/m, (line) =>
+      [line, ...preserved].join("\n"),
+    );
+  }
+
+  fs.writeFileSync(tomlPath, content);
+}
+
+// The embedded pages App Bridge configures itself from
+const WEB_PAGES = ["index.html", "products.html", "settings.html", "polaris.html"];
+
+/**
+ * Re-render the HTML pages from the pristine templates.
+ * App Bridge reads the client ID from <meta name="shopify-api-key">, so these
+ * must be rewritten once the real credentials are known — rendering them from
+ * the template (rather than substituting in place) means the placeholders can
+ * never be consumed early.
+ */
+function renderWebPages(outputDir, config) {
+  const vars = {
+    "{{APP_NAME}}": config.appName,
+    "{{API_KEY}}": config.apiKey || "",
+    "{{APP_URL}}": config.appUrl || "",
+  };
+  for (const page of WEB_PAGES) {
+    const src = path.join(TEMPLATES_DIR, "web", page);
+    if (!fs.existsSync(src)) continue;
+    let content = fs.readFileSync(src, "utf8");
+    for (const [key, val] of Object.entries(vars)) {
+      content = content.replaceAll(key, val);
+    }
+    fs.writeFileSync(path.join(outputDir, "web", page), content);
+  }
+}
+
+/** Write functions/.env — regenerated whenever credentials change. */
+function writeFunctionsEnv(outputDir, config) {
+  const envContent = [
+    `SHOPIFY_API_KEY=${config.apiKey || ""}`,
+    `SHOPIFY_API_SECRET=${config.apiSecret || ""}`,
+    `SCOPES=${config.scopes}`,
+    `APP_URL=${config.appUrl || ""}`,
+    "",
+  ].join("\n");
+  fs.mkdirSync(path.join(outputDir, "functions"), { recursive: true });
+  fs.writeFileSync(path.join(outputDir, "functions", ".env"), envContent);
+}
+
 // ─── Scaffold ────────────────────────────────────────────────────────────
 function scaffold(outputDir, config) {
   // 1. Copy shared files (firebase.json, firestore, gitignore, extensions)
@@ -208,11 +423,8 @@ function scaffold(outputDir, config) {
     path.join(outputDir, "functions"),
   );
 
-  // 4. Copy shopify.app.toml
-  fs.copyFileSync(
-    path.join(TEMPLATES_DIR, "shopify.app.toml"),
-    path.join(outputDir, "shopify.app.toml"),
-  );
+  // 4. Render shopify.app.toml (re-rendered later once credentials are known)
+  renderAppToml(outputDir, config);
 
   // 5. Rename dotfiles (npm strips leading dots on publish)
   const renames = [
@@ -225,37 +437,12 @@ function scaffold(outputDir, config) {
     if (fs.existsSync(src)) fs.renameSync(src, dest);
   }
 
-  // 6. Variable substitution
-  const vars = {
-    "{{APP_NAME}}": config.appName,
-    "{{API_KEY}}": config.apiKey || "",
-    "{{API_SECRET}}": config.apiSecret || "",
-    "{{SCOPES}}": config.scopes,
-    "{{PROJECT_ID}}": config.projectId || "",
-    "{{APP_URL}}": config.appUrl || "",
-  };
-
-  const templateFiles = [
-    "shopify.app.toml",
-    "web/index.html",
-    "web/products.html",
-    "web/settings.html",
-    "web/polaris.html",
-  ];
-
-  for (const relPath of templateFiles) {
-    substituteVars(path.join(outputDir, relPath), vars);
-  }
+  // 6. Render the frontend pages (re-rendered later once credentials are known —
+  //    App Bridge reads the client ID from the shopify-api-key meta tag)
+  renderWebPages(outputDir, config);
 
   // 7. Generate functions/.env
-  const envContent = [
-    `SHOPIFY_API_KEY=${config.apiKey || ""}`,
-    `SHOPIFY_API_SECRET=${config.apiSecret || ""}`,
-    `SCOPES=${config.scopes}`,
-    `APP_URL=${config.appUrl || ""}`,
-    "",
-  ].join("\n");
-  fs.writeFileSync(path.join(outputDir, "functions", ".env"), envContent);
+  writeFunctionsEnv(outputDir, config);
 
   // 8. Generate .firebaserc
   if (config.projectId) {
@@ -279,31 +466,139 @@ function scaffold(outputDir, config) {
 }
 
 // ─── Update credentials after Shopify app creation ───────────────────────
+// The wizard scaffolds before the Firebase project and the Shopify app exist,
+// so shopify.app.toml is first written with empty values — and its
+// placeholders are gone by then. Re-render from the pristine template rather
+// than substituting placeholders that no longer exist. This write is
+// authoritative: it is the final word on client_id and every URL.
 function updateCredentials(outputDir, config) {
-  const vars = {
-    "{{API_KEY}}": config.apiKey || "",
-    "{{API_SECRET}}": config.apiSecret || "",
-    "{{APP_URL}}": config.appUrl || "",
-  };
+  renderAppToml(outputDir, config);
+  renderWebPages(outputDir, config);
+  writeFunctionsEnv(outputDir, config);
 
-  // Update shopify.app.toml
-  substituteVars(path.join(outputDir, "shopify.app.toml"), vars);
+  // Verify — an empty client_id or a relative URL means the generated app
+  // config is non-functional in the Partner Dashboard
+  const tomlPath = path.join(outputDir, "shopify.app.toml");
+  const clientId = parseTomlField(tomlPath, "client_id");
+  const appUrl = parseTomlField(tomlPath, "application_url");
+  const absolute = !!appUrl && appUrl.startsWith("https://");
 
-  // Update functions/.env
-  const envContent = [
-    `SHOPIFY_API_KEY=${config.apiKey || ""}`,
-    `SHOPIFY_API_SECRET=${config.apiSecret || ""}`,
-    `SCOPES=${config.scopes}`,
-    `APP_URL=${config.appUrl || ""}`,
-    "",
-  ].join("\n");
-  fs.writeFileSync(path.join(outputDir, "functions", ".env"), envContent);
+  if (clientId && absolute) {
+    ok(`App config written — ${c.dim}${appUrl}${c.reset}`);
+  } else {
+    if (!clientId) warn("shopify.app.toml has no client_id — set it manually");
+    if (!absolute) warn("shopify.app.toml has no absolute application_url — set it manually");
+  }
 }
 
 // ═══════════════════════════════════════════════════════════════════════════
 // ─── MAIN FLOW ───────────────────────────────────────────────────────────
 // ═══════════════════════════════════════════════════════════════════════════
 
+// ─── Shopify steps ───────────────────────────────────────────────────────
+
+/** Sign in to Shopify. Uses the CLI's device-code flow — no token pasting. */
+async function shopifyLogin() {
+  info("Signing in to Shopify...");
+  info(`${c.dim}A browser window opens — approve the code shown below.${c.reset}`);
+  console.log();
+  try {
+    await execInteractive("shopify auth login");
+    ok("Signed in to Shopify");
+    return true;
+  } catch {
+    warn("Shopify sign-in did not complete");
+    return false;
+  }
+}
+
+/**
+ * Create (or link) the Shopify app and read its credentials back.
+ * Runs before Firebase so the Client ID and Secret exist by the time any
+ * config file is written — the ordering is what makes this hands-free.
+ */
+async function linkShopifyApp(outputDir, config) {
+  try {
+    await execInteractive(`shopify app config link --path "${outputDir}"`, outputDir);
+  } catch {
+    // The CLI can exit non-zero even after the app was created successfully
+    warn("Shopify CLI exited with a warning");
+  }
+
+  // The CLI occasionally writes the TOML to the parent directory instead
+  for (const dir of [outputDir, path.dirname(outputDir)]) {
+    if (config.apiKey) break;
+    try {
+      for (const f of fs.readdirSync(dir).filter((n) => n.endsWith(".toml"))) {
+        const filePath = path.join(dir, f);
+        const clientId = parseTomlField(filePath, "client_id");
+        if (clientId && clientId !== "{{API_KEY}}" && clientId.length > 5) {
+          config.apiKey = clientId;
+          if (dir !== outputDir) {
+            try {
+              if (!fs.existsSync(path.join(outputDir, f))) {
+                fs.renameSync(filePath, path.join(outputDir, f));
+              } else {
+                fs.unlinkSync(filePath);
+              }
+            } catch {}
+          }
+          break;
+        }
+      }
+    } catch {}
+  }
+
+  // `shopify app env show` is non-interactive and returns BOTH values, so the
+  // Client Secret never has to be pasted by hand.
+  const env = readShopifyEnv(outputDir);
+  if (!config.apiKey && env.apiKey) config.apiKey = env.apiKey;
+  if (env.apiSecret) config.apiSecret = env.apiSecret;
+
+  if (config.apiKey) ok(`Client ID:     ${c.cyan}${config.apiKey}${c.reset}`);
+  if (config.apiSecret) ok(`Client Secret: ${c.dim}${maskSecret(config.apiSecret)}${c.reset}`);
+}
+
+// ─── Deploy steps ────────────────────────────────────────────────────────
+
+/** `--force` — a fresh project otherwise stalls on the artifact-policy prompt. */
+async function deployFirebase(outputDir, projectId) {
+  info("Deploying hosting, functions and Firestore rules...");
+  info(`${c.dim}First deploy builds four containers — this takes a few minutes.${c.reset}`);
+  try {
+    await execInteractive(
+      `firebase deploy --project=${projectId} --force`,
+      outputDir,
+    );
+    ok("Deployed to Firebase");
+    return true;
+  } catch {
+    warn("Firebase deploy failed");
+    info(`Retry with: ${c.cyan}cd ${path.basename(outputDir)} && firebase deploy --force${c.reset}`);
+    return false;
+  }
+}
+
+/** Push the live URLs to Shopify so the app is installable. */
+async function deployShopifyApp(outputDir) {
+  info("Registering the live URLs with Shopify...");
+  try {
+    await execInteractive(
+      `shopify app deploy --path "${outputDir}" --allow-updates ` +
+        `--message "Deployed to Firebase"`,
+      outputDir,
+    );
+    ok("Shopify app updated");
+    return true;
+  } catch {
+    warn("Could not update the Shopify app");
+    info("If that said you are not a member of the organization, the app was");
+    info(`created under a different Shopify account — run ${c.cyan}shopify auth login${c.reset}`);
+    info(`Retry with: ${c.cyan}cd ${path.basename(outputDir)} && shopify app deploy${c.reset}`);
+    return false;
+  }
+}
+
 export async function run(argv) {
   const args = parseArgs(argv);
 
@@ -338,6 +633,26 @@ export async function run(argv) {
   console.log(`  ${c.dim}Build Shopify apps for free — serverless, zero-framework${c.reset}`);
 
   // ═══════════════════════════════════════════════════════════════════
+  // Step 0 — check the toolchain before anything slow or stateful runs,
+  // so nothing fails six minutes in because a CLI was missing.
+  // (preflight prints its own section header)
+  const health = await preflight({ autoInstall: !!args.yes });
+  if (!health.ok) {
+    console.log();
+    fail("Cannot continue until the problems above are resolved.");
+    console.log();
+    return;
+  }
+
+  // ═══════════════════════════════════════════════════════════════════
+  // Step 1 — Shopify sign-in comes first: every later step needs it.
+  if (!args["skip-shopify"]) {
+    section("Sign In to Shopify");
+    await shopifyLogin();
+  }
+
+  // ═══════════════════════════════════════════════════════════════════
+  // Step 2 — which kind of app
   section("Choose Your Template");
 
   const { appTemplate } = await prompts({
@@ -358,21 +673,9 @@ export async function run(argv) {
     ],
   }, { onCancel });
 
-  // ── Extension-only: delegate to Shopify CLI ───────────────────────
+  // ── Extension-only: hand straight over to the Shopify CLI ─────────
   if (appTemplate === "extension") {
     console.log();
-    if (!hasCommand("shopify")) {
-      info("Installing Shopify CLI...");
-      try {
-        await exec("npm install -g @shopify/cli");
-        ok("Shopify CLI installed");
-      } catch {
-        fail("Could not install Shopify CLI");
-        info("Install manually: npm i -g @shopify/cli");
-        info("Then run: shopify app init");
-        return;
-      }
-    }
     info("Launching Shopify CLI...");
     console.log();
     try {
@@ -404,7 +707,7 @@ export async function run(argv) {
       type: "text",
       name: "projectName",
       message: "Project directory name",
-      initial: "my-shopify-app",
+      initial: DEFAULT_PROJECT_NAME,
       validate: (v) => {
         if (!v.trim()) return "Required";
         if (/[^a-zA-Z0-9._-]/.test(v)) return "Use only letters, numbers, dots, hyphens, underscores";
@@ -415,11 +718,13 @@ export async function run(argv) {
   }
 
   // ── App name ──────────────────────────────────────────────────────
+  // Derived from the project name, minus the reserved word "Shopify"
   const { appName } = await prompts({
     type: "text",
     name: "appName",
     message: "App name (shown in Shopify admin)",
-    initial: projectName.replace(/[-_.]/g, " ").replace(/\b\w/g, (c) => c.toUpperCase()),
+    initial: deriveAppName(projectName),
+    validate: validateAppName,
   }, { onCancel });
 
   // ── API scopes ────────────────────────────────────────────────────
@@ -489,6 +794,46 @@ export async function run(argv) {
   info(`${c.dim}Frontend: 4 pages — Dashboard, Products, Settings, Components${c.reset}`);
 
   // ═══════════════════════════════════════════════════════════════════
+  // Step 4 — register the Shopify app FIRST. Creating it here is what mints
+  // the Client ID and Secret, so every file written later already has them.
+  section("Create Your Shopify App");
+
+  if (!args["skip-shopify"]) {
+    info("The Shopify CLI will ask which organization to use,");
+    info(`and let you ${c.bold}create a new app${c.reset} or pick an existing one.`);
+    console.log();
+    await linkShopifyApp(outputDir, config);
+  }
+
+  // ── Fallbacks — only ask for whatever could not be read ───────────
+  if (!config.apiKey) {
+    console.log();
+    info(`Find it at: ${c.cyan}https://partners.shopify.com${c.reset} → Apps → Client credentials`);
+    const res = await prompts({
+      type: "text",
+      name: "apiKey",
+      message: `Client ID ${c.dim}(API Key)${c.reset}`,
+      validate: (v) => (v.trim() ? true : "Required"),
+    }, { onCancel });
+    config.apiKey = res.apiKey;
+  }
+
+  if (!config.apiSecret) {
+    console.log();
+    info("The Client Secret could not be read automatically.");
+    info(`Find it at: ${c.cyan}https://partners.shopify.com${c.reset} → your app → Client credentials`);
+    console.log();
+    const { apiSecret } = await prompts({
+      type: "password",
+      name: "apiSecret",
+      message: "Client Secret (API Secret)",
+      validate: (v) => (v.trim() ? true : "Required"),
+    }, { onCancel });
+    config.apiSecret = apiSecret;
+  }
+
+  // ═══════════════════════════════════════════════════════════════════
+  // Step 5 — Firebase, now that the credentials already exist
   section("Firebase Setup");
 
   // ── Ensure Firebase CLI ───────────────────────────────────────────
@@ -505,34 +850,63 @@ export async function run(argv) {
 
   if (hasCommand("firebase")) {
     // ── Firebase login ──────────────────────────────────────────────
+    // Ask the account store directly. Inferring auth from an empty project
+    // list is wrong: a signed-in account with no projects yet looks identical
+    // to being signed out.
     info("Checking Firebase authentication...");
-    const projects = listFirebaseProjects();
-    if (projects.length > 0) {
-      ok("Firebase authenticated");
-    } else {
+    let accounts = listFirebaseAccounts();
+
+    if (accounts.length === 0) {
       info("Opening browser for Firebase login...");
       try {
         await execInteractive("firebase login");
-        ok("Logged into Firebase");
       } catch {
         warn("Firebase login failed — run 'firebase login' manually later");
       }
+      accounts = listFirebaseAccounts();
+    }
+
+    if (accounts.length === 0) {
+      warn("Not signed in to Firebase");
+    } else if (accounts.length === 1) {
+      ok(`Firebase account: ${c.cyan}${accounts[0]}${c.reset}`);
+    } else {
+      // Several accounts are signed in — mirror `firebase login:use`
+      const { account } = await prompts({
+        type: "select",
+        name: "account",
+        message: "Which Google account should own this project?",
+        choices: accounts.map((email) => ({ title: email, value: email })),
+      }, { onCancel });
+
+      if (account && (await useFirebaseAccount(account))) {
+        ok(`Firebase account: ${c.cyan}${account}${c.reset}`);
+      } else if (account) {
+        warn(`Could not switch account — continuing as ${accounts[0]}`);
+      }
     }
 
     // ── Project selection ───────────────────────────────────────────
+    // Same shape as `firebase init`: create, pick an existing one, adopt a
+    // plain Google Cloud project, or type an ID.
     const freshProjects = listFirebaseProjects();
     const fbChoices = [
       { title: `${c.cyan}[create a new project]${c.reset}`, value: "__create__" },
     ];
 
-    if (freshProjects.length > 0) {
-      for (const p of freshProjects) {
-        fbChoices.push({
-          title: `${p.displayName} ${c.dim}(${p.projectId})${c.reset}`,
-          value: p.projectId,
-        });
-      }
+    for (const p of freshProjects.sort((a, b) =>
+      a.displayName.localeCompare(b.displayName),
+    )) {
+      fbChoices.push({
+        title: `${p.displayName} ${c.dim}(${p.projectId})${c.reset}`,
+        value: p.projectId,
+      });
     }
+
+    fbChoices.push({
+      title: `${c.dim}[add Firebase to an existing Google Cloud project]${c.reset}`,
+      value: "__addfirebase__",
+    });
     fbChoices.push({ title: `${c.dim}[enter project ID manually]${c.reset}`, value: "__manual__" });
 
     const { firebaseChoice } = await prompts({
@@ -571,6 +945,22 @@ export async function run(argv) {
         }, { onCancel });
         config.projectId = manualId;
       }
+    } else if (firebaseChoice === "__addfirebase__") {
+      const { gcpId } = await prompts({
+        type: "text",
+        name: "gcpId",
+        message: "Google Cloud project ID",
+        validate: (v) => (v.trim() ? true : "Required"),
+      }, { onCancel });
+
+      info(`Adding Firebase to ${c.cyan}${gcpId}${c.reset}...`);
+      if (await addFirebaseToProject(gcpId)) {
+        ok(`Firebase enabled on ${c.cyan}${gcpId}${c.reset}`);
+      } else {
+        warn("Could not add Firebase automatically — continuing with this ID");
+        info(`Manual: firebase projects:addfirebase ${gcpId}`);
+      }
+      config.projectId = gcpId;
     } else if (firebaseChoice === "__manual__") {
       const { manualId } = await prompts({
         type: "text",
@@ -612,163 +1002,6 @@ export async function run(argv) {
     fs.writeFileSync(path.join(outputDir, ".firebaserc"), firebaserc + "\n");
   }
 
-  // ═══════════════════════════════════════════════════════════════════
-  section("Shopify App Setup");
-
-  // ── Ensure Shopify CLI ────────────────────────────────────────────
-  if (!hasCommand("shopify")) {
-    info("Shopify CLI not found — installing...");
-    try {
-      await exec("npm install -g @shopify/cli");
-      ok("Shopify CLI installed");
-    } catch {
-      warn("Could not install Shopify CLI");
-    }
-  }
-
-  if (hasCommand("shopify")) {
-    const { shopifyAction } = await prompts({
-      type: "select",
-      name: "shopifyAction",
-      message: "Shopify app setup",
-      choices: [
-        { title: "Create a new app + link it (recommended)", value: "create" },
-        { title: "Link an existing app", value: "link" },
-        { title: "Skip — I'll configure manually later", value: "skip" },
-      ],
-    }, { onCancel });
-
-    if (shopifyAction !== "skip") {
-      // ── Login ──────────────────────────────────────────────────
-      console.log();
-      info("Logging into Shopify...");
-      info("A browser window will open — sign in to your Partner account.");
-      console.log();
-      try {
-        await execInteractive("shopify auth login");
-        ok("Logged into Shopify");
-      } catch {
-        warn("Shopify login failed — continuing with manual setup");
-      }
-
-      // ── Create / Link app via Shopify CLI ──────────────────────
-      // Must `cd` into project dir — Shopify CLI uses process.cwd(),
-      // not spawn's cwd option, for TOML generation.
-      console.log();
-      if (shopifyAction === "create") {
-        info(`Creating a new Shopify app: ${c.cyan}${appName}${c.reset}`);
-        info(`Select ${c.bold}"Create a new app"${c.reset} when prompted by the CLI.`);
-      } else {
-        info("Select your existing app from the list.");
-      }
-      console.log();
-
-      // Use `cd` to ensure Shopify CLI writes files in the project directory
-      const cdCmd = process.platform === "win32"
-        ? `cd /d "${outputDir}" && shopify app config link`
-        : `cd "${outputDir}" && shopify app config link`;
-
-      try {
-        await execInteractive(cdCmd);
-      } catch {
-        // Shopify CLI may exit non-zero even after creating/linking the app
-        // (e.g. "directory doesn't have a package.json" warning)
-        warn("Shopify CLI exited with a warning");
-      }
-
-      // ── Parse client_id from any TOML (runs regardless of exit code) ──
-      // Check project dir first, then parent dir (Shopify CLI fallback location)
-      const dirsToCheck = [outputDir, path.dirname(outputDir)];
-      for (const dir of dirsToCheck) {
-        if (config.apiKey) break;
-        try {
-          const tomlFiles = fs.readdirSync(dir).filter((f) => f.endsWith(".toml"));
-          for (const f of tomlFiles) {
-            const filePath = path.join(dir, f);
-            const clientId = parseTomlField(filePath, "client_id");
-            if (clientId && clientId !== "{{API_KEY}}" && clientId.length > 5) {
-              config.apiKey = clientId;
-              ok(`Client ID: ${c.cyan}${config.apiKey}${c.reset}`);
-
-              // If TOML was in parent dir (Shopify CLI bug), move it to project dir
-              if (dir !== outputDir) {
-                const destPath = path.join(outputDir, f);
-                try {
-                  // Don't overwrite our template — just read the client_id
-                  if (!fs.existsSync(destPath)) {
-                    fs.renameSync(filePath, destPath);
-                  } else {
-                    // Clean up the stray TOML from parent dir
-                    fs.unlinkSync(filePath);
-                  }
-                  info(`${c.dim}Picked up credentials from Shopify CLI${c.reset}`);
-                } catch {}
-              }
-              break;
-            }
-          }
-        } catch {}
-      }
-
-      if (!config.apiKey) {
-        console.log();
-        info("Could not read Client ID from Shopify CLI output.");
-        const res = await prompts({
-          type: "text",
-          name: "apiKey",
-          message: "Paste your Client ID (from Partner Dashboard → Apps)",
-          validate: (v) => (v.trim() ? true : "Required"),
-        }, { onCancel });
-        config.apiKey = res.apiKey;
-      }
-    }
-
-    // ── Get API Secret (never in TOML) ──────────────────────────────
-    if (!config.apiKey) {
-      console.log();
-      info(`Find credentials at: ${c.cyan}https://partners.shopify.com${c.reset} → Apps → Client credentials`);
-      const res = await prompts({
-        type: "text",
-        name: "apiKey",
-        message: `Client ID ${c.dim}(API Key)${c.reset}`,
-        validate: (v) => (v.trim() ? true : "Required"),
-      }, { onCancel });
-      config.apiKey = res.apiKey;
-    }
-
-    console.log();
-    info("The API Secret is not stored in config files for security.");
-    info(`Find it at: ${c.cyan}https://partners.shopify.com${c.reset} → your app → Client credentials`);
-    console.log();
-    const { apiSecret } = await prompts({
-      type: "password",
-      name: "apiSecret",
-      message: "Client Secret (API Secret)",
-      validate: (v) => (v.trim() ? true : "Required"),
-    }, { onCancel });
-    config.apiSecret = apiSecret;
-
-  } else {
-    // No Shopify CLI — full manual entry
-    info(`Enter your Shopify app credentials (from ${c.cyan}partners.shopify.com${c.reset})`);
-    const creds = await prompts([
-      {
-        type: "text",
-        name: "apiKey",
-        message: `Client ID ${c.dim}(API Key)${c.reset}`,
-        validate: (v) => (v.trim() ? true : "Required"),
-      },
-      {
-        type: "password",
-        name: "apiSecret",
-        message: "Client Secret (API Secret)",
-        validate: (v) => (v.trim() ? true : "Required"),
-      },
-    ], { onCancel });
-    config.apiKey = creds.apiKey;
-    config.apiSecret = creds.apiSecret;
-  }
-
   // ── Write final credentials to files ──────────────────────────────
   updateCredentials(outputDir, config);
 
@@ -796,6 +1029,23 @@ export async function run(argv) {
     }
   }
 
+  // ═══════════════════════════════════════════════════════════════════
+  // Steps 6 and 7 — put it live, then tell Shopify where "live" is.
+  // Doing both here is the difference between a scaffold and a working app.
+  if (config.projectId && !args["no-deploy"]) {
+    section("Going Live");
+
+    const deployed = await deployFirebase(outputDir, config.projectId);
+    config.deployed = deployed;
+
+    if (deployed && config.apiKey) {
+      console.log();
+      await deployShopifyApp(outputDir);
+    } else if (!deployed) {
+      info(`${c.dim}Skipping the Shopify update until the deploy succeeds.${c.reset}`);
+    }
+  }
+
   // ═══════════════════════════════════════════════════════════════════
   section("Finishing Up");
 
@@ -820,9 +1070,11 @@ export async function run(argv) {
 
 // ─── CI / non-interactive mode ──────────────────────────────────────────
 async function runCI(args) {
+  const projectName = args.projectName || DEFAULT_PROJECT_NAME;
   const config = {
-    projectName: args.projectName || "my-shopify-app",
-    appName: args["app-name"] || args.projectName || "My Shopify App",
+    projectName,
+    // Shopify rejects app names containing "Shopify" — sanitise before use
+    appName: sanitizeAppName(args["app-name"] || deriveAppName(projectName)),
     language: args.language === "javascript" ? "javascript" : "typescript",
     apiKey: args["api-key"],
     apiSecret: args["api-secret"],
@@ -862,6 +1114,27 @@ async function runCI(args) {
     }
   }
 
+  // ── Firebase project — provisioning never prompts in CI, so a missing
+  //    project has to be created here or 'firebase use' fails ────────────
+  if (hasCommand("firebase")) {
+    const existing = listFirebaseProjects();
+    const projectExists = existing.some((p) => p.projectId === config.projectId);
+
+    if (!projectExists && args["create-project"]) {
+      info(`Creating Firebase project: ${c.cyan}${config.projectId}${c.reset}...`);
+      const created = await createFirebaseProject(config.projectId, config.appName);
+      if (created) {
+        ok(`Project created: ${c.cyan}${config.projectId}${c.reset}`);
+      } else {
+        fail(`Could not create Firebase project "${config.projectId}"`);
+        info(`Manual: firebase projects:create "${config.projectId}"`);
+      }
+    } else if (!projectExists) {
+      warn(`Firebase project "${config.projectId}" not found in your account`);
+      info("Pass --create-project to create it automatically");
+    }
+  }
+
   if (hasCommand("firebase") && !args["skip-provision"]) {
     info("Setting up Firebase...");
     await provisionFirebase(config, {
@@ -936,7 +1209,7 @@ async function distributeFlow() {
 
   console.log(`  ${c.bold}Before submitting to the App Store:${c.reset}`);
   console.log();
-  console.log(`    ${c.cyan}1.${c.reset} Deploy your app: ${c.cyan}firebase deploy${c.reset}`);
+  console.log(`    ${c.cyan}1.${c.reset} Deploy your app: ${c.cyan}firebase deploy --force${c.reset}`);
   console.log(`    ${c.cyan}2.${c.reset} Test on a development store`);
   console.log(`    ${c.cyan}3.${c.reset} Add your privacy policy URL`);
   console.log(`    ${c.cyan}4.${c.reset} Add your app listing details (description, screenshots)`);
@@ -968,14 +1241,27 @@ function printSuccess(config) {
   console.log(`    ${c.green}✔${c.reset} App Bridge — navigation, toasts, modals, resource picker`);
   console.log(`    ${c.green}✔${c.reset} 4 Cloud Functions — auth, api, webhooks, proxy`);
   console.log();
-  console.log(`  ${c.bold}Deploy:${c.reset}`);
-  console.log();
-  console.log(`    ${c.cyan}cd ${config.projectName}${c.reset}`);
-  console.log(`    ${c.cyan}firebase deploy${c.reset}`);
-  console.log();
-  console.log(`  ${c.bold}Install on your dev store:${c.reset}`);
+  if (config.deployed) {
+    console.log(`  ${c.green}${c.bold}Your app is live.${c.reset} Install it on a dev store:`);
+    console.log();
+    console.log(`    ${c.cyan}${config.appUrl}/auth?shop=YOUR-STORE.myshopify.com${c.reset}`);
+    console.log();
+    console.log(`  ${c.dim}Replace YOUR-STORE with your development store's domain.${c.reset}`);
+  } else {
+    console.log(`  ${c.bold}Deploy when ready:${c.reset}`);
+    console.log();
+    console.log(`    ${c.cyan}cd ${config.projectName}${c.reset}`);
+    // --force is required on a fresh project: a bare deploy exits 1 and leaves
+    // Hosting unreleased when there is nothing to compare against
+    console.log(`    ${c.cyan}firebase deploy --force${c.reset}`);
+    console.log(`    ${c.cyan}shopify app deploy${c.reset}`);
+    console.log();
+    console.log(`  ${c.bold}Then install on your dev store:${c.reset}`);
+    console.log();
+    console.log(`    ${c.cyan}${config.appUrl}/auth?shop=YOUR-STORE.myshopify.com${c.reset}`);
+  }
   console.log();
-  console.log(`    ${c.cyan}${config.appUrl}/auth?shop=YOUR-STORE.myshopify.com${c.reset}`);
+  console.log(`  ${c.bold}Make changes:${c.reset} edit ${c.cyan}web/${c.reset} or ${c.cyan}functions/src/${c.reset}, then ${c.cyan}firebase deploy --force${c.reset}`);
   console.log();
   console.log(`  ${c.bold}Go live:${c.reset}`);
   console.log();
@@ -1006,6 +1292,9 @@ function printHelp() {
     --help, -h               Show this help
     --version, -v            Show version
     --distribute             Open distribution dashboard for your app
+    --yes                    Auto-install any missing CLI tools
+    --skip-shopify           Don't create/link a Shopify app
+    --no-deploy              Scaffold only — skip the two deploy steps
 
   ${c.bold}CI / non-interactive:${c.reset}
 
@@ -1015,6 +1304,7 @@ function printHelp() {
     --scopes=SCOPES          API scopes (default: read_products)
     --language=LANG          typescript or javascript (default: typescript)
     --app-name=NAME          App name shown in Shopify admin
+    --create-project         Create the Firebase project if it doesn't exist
     --skip-provision         Skip Firebase service provisioning
     --firestore-region=LOC   Firestore region (e.g. us-central1)
 
@@ -1031,6 +1321,12 @@ function printHelp() {
       --api-key=abc123 --api-secret=secret \\
       --project-id=my-firebase-project
 
+    ${c.dim}# CI — create the Firebase project too${c.reset}
+    npx create-shopify-firebase-app my-app \\
+      --api-key=abc123 --api-secret=secret \\
+      --project-id=my-new-project --create-project \\
+      --firestore-region=us-central1
+
     ${c.dim}# Go live — open distribution page${c.reset}
     npx create-shopify-firebase-app --distribute