kasy-cli 1.17.0 → 1.19.0

package/lib/commands/new.js

@@ -29,7 +29,7 @@ function openUrl(url) {
   } catch (_) {}
 }
 const ui = require('../utils/ui');
-const { printBanner, infoBox, successBox } = require('../utils/brand');
+const { printBanner, successBox, paintLime } = require('../utils/brand');
 const fs = require('fs-extra');
 const { createTranslator } = require('../utils/i18n');
 const { getStoredLanguage, setStoredLanguage } = require('../utils/license');
@@ -42,7 +42,7 @@ const {
   runChecks,
   hasRequiredFailures,
 } = require('../utils/checks');
-const { normalizeBackend, getVisibleFeatures } = require('../scaffold/catalog');
+const { normalizeBackend, getVisibleFeatures, FEATURE_CATALOG } = require('../scaffold/catalog');
 
 // Audience gate: set KASY_INTERNAL=1 to reveal beta/internal features.
 const KASY_AUDIENCE = process.env.KASY_INTERNAL === '1' ? 'internal' : 'public';
@@ -50,9 +50,10 @@ const { generateFirebaseProject } = require('../scaffold/backends/firebase/gener
 const { generateSupabaseProject } = require('../scaffold/backends/supabase/generator');
 const { generateApiProject } = require('../scaffold/backends/api/generator');
 const { createProjectAndGetKeys, setupLinkedProject, checkLoggedIn, getOrgsList, getProjectsByOrg, getProjectKeys } = require('../scaffold/backends/supabase/deploy');
-const { writeSupabaseGoogleAuthOptions, readSupabaseGoogleCredentials, getGoogleClientSecretViaGcloud } = require('../scaffold/shared/post-build');
+const { writeSupabaseGoogleAuthOptions, readSupabaseGoogleCredentials, getGoogleClientSecretViaGcloud, flutterfireConfigure, writeGoogleAuthOptions, writeGoogleIosUrlScheme } = require('../scaffold/shared/post-build');
 const { toPackageName } = require('../scaffold/backends/firebase/tokens');
 const { setupFromScratch, setupExistingProject, listBillingAccounts, listGcpOrganizations, checkGcloudAuth, getGcloudInstallInstructions, enableAuthProviders, registerDebugSha1 } = require('../scaffold/backends/firebase/setup-from-scratch');
+const { enableAuthViaFirebaseCli } = require('../scaffold/backends/firebase/enable-auth-via-cli');
 const { createFcmServiceAccountKey } = require('../scaffold/shared/fcm-service-account');
 
 // Região padrão para criação de projetos Supabase via API.
@@ -83,11 +84,9 @@ async function promptBillingAccountIfNeeded(tr, onCancel) {
   };
 
   if (!billingList.accounts?.length) {
-    ui.note(tr('new.firebase.q.billingAccount.context'));
     return askManualId();
   }
 
-  ui.note(tr('new.firebase.q.billingAccount.context'));
   const billingAccountId = await ui.select({
     message: tr('new.firebase.q.billingAccount'),
     initialValue: billingList.accounts[0].id,
@@ -188,31 +187,12 @@ function printPrerequisites(tr, backend, firebaseSetupMode = 'existing', checkRe
   }
 }
 
-function printSummary(tr, answers) {
-  const modules = answers.modules.length > 0
-    ? answers.modules.join(', ')
-    : tr('new.firebase.confirm.none');
-
-  const backendLabel = { firebase: '🔥 Firebase', supabase: '🟢 Supabase', api: '🔗 API REST' }[answers.backend] || answers.backend;
-
-  const rows = [
-    `${kleur.dim(tr('new.firebase.confirm.app') + ':')}        ${kleur.white(answers.appName)}`,
-    `${kleur.dim('Bundle:')}        ${kleur.white(answers.bundleId)}`,
-    `${kleur.dim('Backend:')}       ${kleur.white(backendLabel)}`,
-  ];
-  if (answers.firebaseProjectId) rows.push(`${kleur.dim('Firebase:')}      ${kleur.white(answers.firebaseProjectId)}`);
-  if (answers.supabaseUrl)       rows.push(`${kleur.dim('Supabase URL:')}  ${kleur.white(answers.supabaseUrl)}`);
-  if (answers.apiBaseUrl)        rows.push(`${kleur.dim('API URL:')}       ${kleur.white(answers.apiBaseUrl)}`);
-  rows.push(`${kleur.dim(tr('new.firebase.confirm.modules') + ':')}     ${kleur.white(modules)}`);
-
-  console.log(infoBox(`📦 ${tr('new.firebase.confirm.title')}`, rows.join('\n')));
-}
-
 const STEP_LABELS = {
   'project-setup':  { en: 'Project configured',                     pt: 'Projeto configurado',                   es: 'Proyecto configurado' },
   'pub-get':        { en: 'Packages installed',                      pt: 'Pacotes instalados',                    es: 'Paquetes instalados' },
   'slang':          { en: 'Translations generated',                  pt: 'Traducoes geradas',                     es: 'Traducciones generadas' },
   'build-runner':   { en: 'Code generated (Riverpod / Freezed)',      pt: 'Codigo gerado (Riverpod / Freezed)',     es: 'Codigo generado (Riverpod / Freezed)' },
+  'dart-fix':       { en: 'Lints auto-fixed',                          pt: 'Avisos de estilo corrigidos',           es: 'Lints corregidos automaticamente' },
   'flutterfire':    { en: 'Firebase configured (flutterfire)',        pt: 'Firebase configurado (flutterfire)',    es: 'Firebase configurado (flutterfire)' },
   'Service Account key': { en: 'Service Account key',                pt: 'Chave de servico',                      es: 'Clave de servicio' },
   'firebase_key.json': { en: 'Service account key copied', pt: 'Chave de conta de servico copiada', es: 'Clave de cuenta de servicio copiada' },
@@ -232,6 +212,7 @@ const STEP_LABELS = {
   'supabase db push':  { en: 'Database migrated',    pt: 'Banco migrado',        es: 'Base de datos migrada' },
   'anonymous sign-in': { en: 'Anonymous sign-in enabled', pt: 'Login anonimo ativado', es: 'Inicio de sesion anonimo activado' },
   'google sign-in': { en: 'Google Sign-In enabled', pt: 'Google Sign-In ativado', es: 'Google Sign-In activado' },
+  'apple sign-in': { en: 'Apple Sign-In ready (configure credentials before testing — kasy.dev/docs/apple)', pt: 'Apple Sign-In preparado (configure as credenciais antes de testar — kasy.dev/docs/apple)', es: 'Apple Sign-In listo (configura las credenciales antes de probar — kasy.dev/docs/apple)' },
   'google-auth-options': { en: 'Google client IDs written', pt: 'Client IDs do Google gravados', es: 'Client IDs de Google escritos' },
   'ios-url-scheme': { en: 'iOS URL scheme registered', pt: 'URL scheme iOS registrado', es: 'URL scheme iOS registrado' },
   'google-ios-url-scheme': { en: 'iOS Google URL scheme registered', pt: 'URL scheme Google iOS registrado', es: 'URL scheme Google iOS registrado' },
@@ -253,6 +234,7 @@ const STEP_LABELS = {
   'service-account': { en: 'Service account key created', pt: 'Chave de conta de servico criada', es: 'Clave de cuenta de servicio creada' },
   'firestore': { en: 'Firestore database created', pt: 'Banco Firestore criado', es: 'Base de datos Firestore creada' },
   'storage': { en: 'Firebase Storage bucket created', pt: 'Bucket Firebase Storage criado', es: 'Bucket Firebase Storage creado' },
+  'storage-cors': { en: 'CORS enabled on Storage (web images)', pt: 'CORS ativado no Storage (imagens na web)', es: 'CORS activado en Storage (imágenes en web)' },
 };
 
 const STEP_PROGRESS = {
@@ -260,6 +242,7 @@ const STEP_PROGRESS = {
   'pub-get':       { en: 'Installing packages… (may take a few minutes)',        pt: 'Instalando pacotes… (pode levar alguns minutos)',        es: 'Instalando paquetes… (puede tardar varios minutos)' },
   'slang':         { en: 'Generating translations…',                             pt: 'Gerando traducoes…',                                     es: 'Generando traducciones…' },
   'build-runner':  { en: 'Generating code (Riverpod / Freezed)… (may take a few minutes)', pt: 'Gerando codigo (Riverpod / Freezed)… (pode demorar)', es: 'Generando codigo (Riverpod / Freezed)… (puede tardar)' },
+  'dart-fix':      { en: 'Auto-fixing lints…',                                              pt: 'Corrigindo avisos de estilo…',                          es: 'Corrigiendo lints automaticamente…' },
   'flutterfire':   { en: 'Connecting to Firebase…',                 pt: 'Conectando ao Firebase…',                es: 'Conectando a Firebase…' },
   'deploy':        { en: 'Deploying backend to Firebase…',          pt: 'Publicando backend no Firebase…',        es: 'Desplegando backend en Firebase…' },
   'gcp-project':   { en: 'Creating GCP project…',                   pt: 'Criando projeto GCP…',                    es: 'Creando proyecto GCP…' },
@@ -273,6 +256,7 @@ const STEP_PROGRESS = {
   'service-account': { en: 'Creating service account key…',         pt: 'Criando chave de conta de servico…',      es: 'Creando clave de cuenta de servicio…' },
   'firestore':     { en: 'Creating Firestore database…',            pt: 'Criando banco Firestore…',                es: 'Creando base de datos Firestore…' },
   'storage':       { en: 'Creating Firebase Storage bucket…',       pt: 'Criando bucket Firebase Storage…',        es: 'Creando bucket Firebase Storage…' },
+  'storage-cors':  { en: 'Enabling CORS on Storage…',                pt: 'Ativando CORS no Storage…',               es: 'Activando CORS en Storage…' },
   'deploy-retry-wait':   { en: 'Waiting 4 min for GCP permissions to propagate… (do not close terminal)', pt: 'Aguardando 4 min para permissões do GCP propagarem… (não feche o terminal)', es: 'Esperando 4 min para propagar permisos de GCP… (no cierres la terminal)' },
   'deploy-retry-wait-2': { en: 'Retrying with updated permissions, 2 more min… (almost there!)', pt: 'Tentando novamente com permissões atualizadas, mais 2 min… (quase lá!)', es: 'Reintentando con permisos actualizados, 2 min más… (¡casi listo!)' },
 };
@@ -324,32 +308,46 @@ function printCreateFromScratchStatus(result, tr) {
 
 function printSuccessCard(tr, answers, targetDir) {
   const folderName = path.basename(targetDir);
-  const consoleUrl = answers.backend === 'firebase' && answers.firebaseProjectId
-    ? `https://console.firebase.google.com/project/${answers.firebaseProjectId}`
-    : answers.backend === 'supabase'
-      ? 'https://supabase.com/dashboard'
-      : answers.apiBaseUrl || null;
 
   const lines = [];
+
+  if (answers.modules?.length > 0) {
+    const byId = Object.fromEntries(FEATURE_CATALOG.map((f) => [f.id, f]));
+    const visible = answers.modules.filter((id) => byId[id]);
+    if (visible.length > 0) {
+      lines.push(paintLime(`✓ ${tr('new.success.featuresInstalled')}`));
+      for (const id of visible) {
+        const name = byId[id]?.displayName || id;
+        lines.push(`   ${kleur.dim('•')} ${name}`);
+      }
+      lines.push('');
+    }
+  }
+
   lines.push(kleur.bold(tr('new.success.nextSteps')));
   lines.push('');
-  lines.push(`${kleur.dim('1.')} ${kleur.dim(tr('new.success.step.cd'))}`);
+
+  let stepNum = 1;
+  lines.push(`${kleur.dim(`${stepNum++}.`)} ${kleur.dim(tr('new.success.step.cd'))}`);
   lines.push(`   ${kleur.cyan(`cd ${folderName}`)}`);
-  let stepNum = 2;
+  lines.push('');
+
   if (answers.backend === 'firebase') {
-    lines.push('');
     lines.push(`${kleur.dim(`${stepNum++}.`)} ${kleur.dim(tr('new.success.step.deploy'))}`);
     lines.push(`   ${kleur.cyan('kasy deploy')}`);
+    lines.push('');
   }
+
+  lines.push(`${kleur.dim(`${stepNum++}.`)} ${kleur.dim(tr('new.success.step.configure'))}`);
+  lines.push(`   ${kleur.cyan('kasy configure')}`);
   lines.push('');
+
   lines.push(`${kleur.dim(`${stepNum++}.`)} ${kleur.dim(tr('new.success.step.run'))}`);
-  lines.push(`   ${kleur.cyan('kasy run')}`);
-  lines.push(`   ${kleur.dim(tr('new.success.step.run.vscode'))}`);
-  if (consoleUrl) {
-    lines.push('');
-    lines.push(`${kleur.dim(`${stepNum}.`)} ${kleur.dim(tr('new.success.step.console'))}`);
-    lines.push(`   ${kleur.cyan(consoleUrl)}`);
-  }
+  lines.push(`   ${kleur.cyan('kasy run')}  ${kleur.dim(tr('new.success.step.run.vscode'))}`);
+  lines.push('');
+
+  lines.push(`${kleur.dim(`${stepNum++}.`)} ${kleur.dim(tr('new.success.step.docs'))}`);
+  lines.push(`   ${kleur.cyan('https://kasy.dev/docs')}`);
 
   console.log(successBox(`🎉 ${tr('new.success.title')}`, lines.join('\n')));
 }
@@ -464,9 +462,9 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
       message: tr('new.q.backend'),
       initialValue: 'firebase',
       options: [
-        { value: 'firebase', label: '🔥 Firebase', hint: tr('new.q.backend.firebase.desc') },
-        { value: 'supabase', label: '🟢 Supabase', hint: tr('new.q.backend.supabase.desc') },
-        { value: 'api',      label: '🔗 API REST', hint: tr('new.q.backend.api.desc') },
+        { value: 'firebase', label: '🔥 Firebase' },
+        { value: 'supabase', label: '🟢 Supabase' },
+        { value: 'api',      label: '🔗 API REST' },
       ],
       onCancel: cancel,
     });
@@ -504,59 +502,38 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
     }
   }
 
-  // ── App identity: name + bundle ID — first things first ────────────────────
-  let core;
-  if (yes) {
-    if (!hasExplicitDir) {
-      ui.log.error('--yes requires an app name: kasy new MyApp --yes');
-      ui.cancel(tr('new.firebase.error.aborted'));
-      process.exit(1);
-    }
-    const appName = path.basename(targetDir);
-    const slug = appName
+  // Helper: slug → bundle id (e.g. "MeuApp" → "com.meuapp.app")
+  const deriveBundleId = (name) => {
+    const trimmed = (name || '').trim();
+    if (!trimmed) return 'com.example.app';
+    const slug = trimmed
       .normalize('NFD')
       .replace(/[̀-ͯ]/g, '')
       .toLowerCase()
       .replace(/[^a-z0-9]/g, '');
-    const bundleId = (slug && !/^\d/.test(slug)) ? `com.${slug}.app` : 'com.example.app';
-    core = { appName, bundleId };
-    ui.log.info(`App: ${kleur.white(appName)}`);
-    ui.log.info(`Bundle: ${kleur.white(bundleId)}`);
+    if (!slug || /^\d/.test(slug)) return 'com.example.app';
+    return `com.${slug}.app`;
+  };
+
+  // ── App name — derived from argv when given, otherwise asked once ──────────
+  let core;
+  if (hasExplicitDir) {
+    // `kasy new MeuApp` — use the argument as the name; don't ask again.
+    const appName = path.basename(targetDir);
+    core = { appName, bundleId: deriveBundleId(appName) };
+    ui.log.info(`App: ${kleur.white(core.appName)}`);
+  } else if (yes) {
+    ui.log.error('--yes requires an app name: kasy new MyApp --yes');
+    ui.cancel(tr('new.firebase.error.aborted'));
+    process.exit(1);
   } else {
     const appName = await ui.text({
       message: tr('new.firebase.q.appName'),
       placeholder: tr('new.firebase.q.appName.hint'),
-      initialValue: hasExplicitDir ? path.basename(targetDir) : '',
       validate: (v) => (v && v.trim() ? undefined : tr('new.firebase.q.appName.required')),
       onCancel: cancel,
     });
-
-    const defaultBundleId = (() => {
-      const name = (appName || '').trim();
-      if (!name) return 'com.example.app';
-      const slug = name
-        .normalize('NFD')
-        .replace(/[̀-ͯ]/g, '')
-        .toLowerCase()
-        .replace(/[^a-z0-9]/g, '');
-      if (!slug || /^\d/.test(slug)) return 'com.example.app';
-      return `com.${slug}.app`;
-    })();
-
-    const bundleId = await ui.text({
-      message: tr('new.firebase.q.bundleId'),
-      placeholder: tr('new.firebase.q.bundleId.hint'),
-      initialValue: defaultBundleId,
-      validate: (v) => {
-        if (!v || !v.trim()) return tr('new.firebase.q.bundleId.required');
-        return /^[a-zA-Z][\w]*(\.[a-zA-Z][\w]*)+$/.test(v.trim())
-          ? undefined
-          : tr('new.firebase.q.bundleId.invalid');
-      },
-      onCancel: cancel,
-    });
-
-    core = { appName, bundleId };
+    core = { appName, bundleId: deriveBundleId(appName) };
   }
 
   // Resolve targetDir now that we have the app name
@@ -571,10 +548,99 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
     }
   }
 
-  // ── Firebase setup mode (create vs existing) ────────────────────────────────
-  // Firebase backend: full setup. Supabase/API: Firebase only for push notifications (FCM).
-  let firebaseSetupMode = 'existing';
+  // ── Wizard mode — Quick (zero config, recommended) or Step-by-step (all options) ─
+  let isQuick = yes; // --yes implies Quick mode
   if (!yes) {
+    const wizardMode = await ui.select({
+      message: tr('new.q.mode'),
+      initialValue: 'quick',
+      options: [
+        { value: 'quick',    label: tr('new.q.mode.quick') },
+        { value: 'advanced', label: tr('new.q.mode.advanced') },
+      ],
+      onCancel: cancel,
+    });
+    isQuick = wizardMode === 'quick';
+  }
+
+  // ── gcloud is required for Quick mode (creates GCP project + enables Auth via API) ─
+  // Failing here, before the project is generated, is much friendlier than dying mid-flow.
+  if (isQuick) {
+    const gcloudCheck = await checkGcloudAuth();
+    if (!gcloudCheck.ok) {
+      ui.log.error(tr('new.firebase.create.gcloudRequired'));
+      if (gcloudCheck.missing === 'gcloud') {
+        const instructions = getGcloudInstallInstructions();
+        const noteLines = [tr('new.firebase.create.installTitle')];
+        if (instructions.install) noteLines.push(`${tr('new.firebase.create.installCommand')}:\n  ${kleur.cyan(instructions.install)}`);
+        if (instructions.hint) noteLines.push(instructions.hint);
+        noteLines.push(`${tr('new.firebase.create.installAfter')}:\n  ${kleur.cyan(instructions.after)}`);
+        noteLines.push(`${tr('new.firebase.create.installUrl')}: ${instructions.url}`);
+        ui.note(noteLines.join('\n\n'));
+      } else {
+        ui.note(tr('new.firebase.create.authCommand'));
+      }
+      ui.cancel(tr('new.firebase.error.aborted'));
+      process.exit(1);
+    }
+
+    // ── Billing account check — Firebase needs an active billing account (Blaze) ─
+    // Without it, project creation succeeds but Storage and Cloud Functions fail later.
+    // Catching it here saves the user from a confusing mid-flow error.
+    const ensureBilling = async () => {
+      const billing = await listBillingAccounts();
+      if (billing.ok && billing.accounts?.length > 0) return true;
+      const billingUrl = 'https://console.cloud.google.com/billing/create';
+      ui.log.warn(tr('new.firebase.billing.required'));
+      ui.note(`${tr('new.firebase.billing.create.steps')}\n${kleur.cyan(billingUrl)}`);
+      openUrl(billingUrl);
+      const ready = await ui.confirm({
+        message: tr('new.firebase.billing.created.ready'),
+        initialValue: true,
+        onCancel: cancel,
+      });
+      if (!ready) {
+        ui.cancel(tr('new.firebase.error.aborted'));
+        process.exit(0);
+      }
+      const recheck = await listBillingAccounts();
+      if (!recheck.ok || !recheck.accounts?.length) {
+        ui.log.error(tr('new.firebase.billing.stillMissing'));
+        ui.cancel(tr('new.firebase.error.aborted'));
+        process.exit(1);
+      }
+      return true;
+    };
+    await ensureBilling();
+  }
+
+  // Visible section header for Advanced — helps the user track where they are.
+  const section = (key) => {
+    if (!isQuick) ui.log.info(paintLime(`── ${tr(key)} ──`));
+  };
+
+  // ── Bundle ID — Quick uses derived value silently; Step-by-step lets user override ─
+  section('new.advanced.section.config');
+  if (!isQuick) {
+    const bundleId = await ui.text({
+      message: tr('new.firebase.q.bundleId'),
+      placeholder: tr('new.firebase.q.bundleId.hint'),
+      initialValue: core.bundleId,
+      validate: (v) => {
+        if (!v || !v.trim()) return tr('new.firebase.q.bundleId.required');
+        return /^[a-zA-Z][\w]*(\.[a-zA-Z][\w]*)+$/.test(v.trim())
+          ? undefined
+          : tr('new.firebase.q.bundleId.invalid');
+      },
+      onCancel: cancel,
+    });
+    core.bundleId = bundleId;
+  }
+
+  // ── Firebase setup mode — Quick always creates a new project ───────────────
+  // (--yes implies Quick, so it also defaults to creating a fresh project.)
+  let firebaseSetupMode = 'create';
+  if (!isQuick) {
     if (backend === 'firebase') {
       firebaseSetupMode = await ui.select({
         message: tr('new.firebase.q.setupMode'),
@@ -599,25 +665,13 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
     }
   }
 
-  // ── Wizard mode — Quick (few questions) or Full (all options) ───────────────
-  // Asked after app name + setup context are clear, so the user understands what it controls.
-  let isQuick = yes; // --yes implies Quick mode
-  if (!yes) {
-    const wizardMode = await ui.select({
-      message: tr('new.q.mode'),
-      initialValue: 'quick',
-      options: [
-        { value: 'quick',    label: tr('new.q.mode.quick') },
-        { value: 'advanced', label: tr('new.q.mode.advanced') },
-      ],
-      onCancel: cancel,
-    });
-    isQuick = wizardMode === 'quick';
+  // ── Backend-specific prerequisites — only shown in Step-by-step mode ──────
+  // Quick mode hides this list: it intimidates beginners and the CLI handles
+  // most prerequisites automatically (gcloud check below, billing prompt, etc.).
+  if (!isQuick) {
+    printPrerequisites(tr, backend, firebaseSetupMode, backendCheckResults);
   }
 
-  // ── Backend-specific prerequisites (dynamic: only show what's not yet verified) ─
-  printPrerequisites(tr, backend, firebaseSetupMode, backendCheckResults);
-
   // ── Firebase project ID (if using an existing project) ──────────────────────
   if (!yes) {
     const needFirebaseProjectId =
@@ -639,19 +693,12 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
       core.firebaseProjectId = firebaseProjectId;
     }
   } else {
-    let firebaseProjectId = projectHint?.trim() || '';
-    if (!firebaseProjectId && backend === 'firebase') {
-      const pid = await ui.text({
-        message: tr('new.firebase.q.projectId'),
-        placeholder: tr('new.firebase.q.projectId.hint'),
-        validate: (v) => (v && v.trim() ? undefined : tr('new.firebase.q.projectId.required')),
-        onCancel: cancel,
-      });
-      firebaseProjectId = pid?.trim() || '';
-    }
-    if (firebaseProjectId) {
-      core.firebaseProjectId = firebaseProjectId;
-      ui.log.info(`Project: ${kleur.white(firebaseProjectId)}`);
+    // --yes mode: if --project was passed, reuse that existing project.
+    // Otherwise stay in 'create' mode and let setupFromScratch handle creation silently.
+    if (projectHint?.trim()) {
+      firebaseSetupMode = 'existing';
+      core.firebaseProjectId = projectHint.trim();
+      ui.log.info(`Project: ${kleur.white(core.firebaseProjectId)}`);
     }
   }
 
@@ -674,11 +721,13 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
   // ── Firebase: create from scratch (when selected) ─────────────────────────
   let firebaseIncludeWeb = true;
   if (backend === 'firebase' && firebaseSetupMode === 'create') {
-    firebaseIncludeWeb = await ui.confirm({
-      message: tr('new.firebase.create.includeWeb'),
-      initialValue: true,
-      onCancel: cancel,
-    });
+    if (!isQuick) {
+      firebaseIncludeWeb = await ui.confirm({
+        message: tr('new.firebase.create.includeWeb'),
+        initialValue: true,
+        onCancel: cancel,
+      });
+    }
     const gcloudCheck = await checkGcloudAuth();
     if (!gcloudCheck.ok) {
       ui.log.error(tr('new.firebase.create.gcloudRequired'));
@@ -701,30 +750,55 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
         onCancel: cancel,
       });
     } else {
+      // Warn about duration + network before the org/billing prompts so the user
+      // can step away (or check the wifi) before the long-running call starts.
+      ui.log.info(tr('new.firebase.create.estimatedTime'));
       const selectedOrgId = await promptOrganizationIfNeeded(tr, cancel);
       let selectedBillingId = await promptBillingAccountIfNeeded(tr, cancel);
-      ui.log.info(`${tr('new.firebase.create.estimatedTime')}\n${tr('new.internet.warning')}`);
-      const ps1 = ui.makeTimedStepper();
+      const ps1 = ui.makeQuickStepper({ color: paintLime });
       ps1.next(tr('new.firebase.create.creating'));
-      const setupResult = await setupFromScratch(core.appName.trim(), core.bundleId.trim(), {
+      const ps1OnProgress = (key, data) => {
+        if (key === 'wait-propagate') {
+          ps1.next(tr('new.firebase.create.waitPropagate'));
+        } else if (key === 'firestore') {
+          ps1.next(stepProgress('firestore', language));
+        } else if (key === 'storage') {
+          ps1.next(stepProgress('storage', language));
+        } else if (key === 'storage-cors') {
+          ps1.next(stepProgress('storage-cors', language));
+        } else if (key === 'storage-cors-warn') {
+          ps1.stop();
+          ui.log.warn(`Storage CORS: ${(data?.error || '').slice(0, 80)}\n${kleur.cyan(data?.url || '')}`);
+        } else if (key === 'auth-providers-warn') {
+          ps1.stop();
+          ui.log.warn(`${tr('new.firebase.interactive.authWarn')}\n${kleur.cyan(data?.url || '')}`);
+        }
+      };
+      let setupResult = await setupFromScratch(core.appName.trim(), core.bundleId.trim(), {
         includeWeb: firebaseIncludeWeb,
         region: firebaseRegion,
         tr,
         billingAccountId: selectedBillingId || undefined,
         organizationId: selectedOrgId || undefined,
-        onProgress: (key, data) => {
-          if (key === 'wait-propagate') {
-            ps1.next(tr('new.firebase.create.waitPropagate'));
-          } else if (key === 'firestore') {
-            ps1.next(stepProgress('firestore', language));
-          } else if (key === 'storage') {
-            ps1.next(stepProgress('storage', language));
-          } else if (key === 'auth-providers-warn') {
-            ps1.stop();
-            ui.log.warn(`${tr('new.firebase.interactive.authWarn')}\n${kleur.cyan(data?.url || '')}`);
-          }
-        },
+        onProgress: ps1OnProgress,
       });
+
+      // Silent retry for transient billing-quota errors (propagation delay,
+      // race between createProject and linkBilling). Keeps the same spinner
+      // line so the user doesn't see the red error if it succeeds on retry.
+      if (!setupResult.ok && setupResult.billingFailed && setupResult.billingQuotaError && setupResult.projectId) {
+        ps1.update(tr('new.firebase.create.billingWait'));
+        await new Promise((r) => setTimeout(r, 15000));
+        setupResult = await setupFromScratch(core.appName.trim(), core.bundleId.trim(), {
+          includeWeb: firebaseIncludeWeb,
+          region: firebaseRegion,
+          tr,
+          resumeFromBilling: { projectId: setupResult.projectId },
+          billingAccountId: selectedBillingId || undefined,
+          organizationId: selectedOrgId || undefined,
+          onProgress: ps1OnProgress,
+        });
+      }
       const askReady = async (readyKey) => {
         const ok = await ui.confirm({
           message: tr(readyKey),
@@ -748,26 +822,25 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
         ui.log.info(`Project ID: ${core.firebaseProjectId}`);
         printCreateFromScratchStatus(setupResult, tr);
         const authUrl = `https://console.firebase.google.com/project/${core.firebaseProjectId}/authentication/providers`;
-        if (setupResult.authEnabled && !setupResult.googleSignInSkipped) {
-          // Email/Password, Anonymous AND Google Sign-In were all enabled automatically — skip prompt.
-        } else {
-          // At least one provider needs manual activation.
-          const step1Key = setupResult.googleSignInSkipped
-            ? 'new.firebase.create.beforeContinue.step1'
-            : 'new.firebase.create.beforeContinue.step1.noAuth';
-          const readyKey = setupResult.googleSignInSkipped
-            ? 'new.firebase.create.beforeContinue.ready'
-            : 'new.firebase.create.beforeContinue.ready.noAuth';
-          showBeforeContinue(step1Key, authUrl);
+        // Stay silent when Google is the only thing missing — the post-flutterfire
+        // retry will activate it once the OAuth Web Client exists. We only warn
+        // here when Email/Anonymous themselves failed (which is the rare path).
+        if (!setupResult.authEnabled) {
+          showBeforeContinue('new.firebase.create.beforeContinue.step1.noAuth', authUrl);
           openUrl(authUrl);
-          await askReady(readyKey);
+          if (!isQuick) {
+            await askReady('new.firebase.create.beforeContinue.ready.noAuth');
+          }
         }
 
       } else {
         ps1.fail(tr('new.firebase.create.failed'));
         let lastResult = setupResult;
         while (lastResult.billingFailed && lastResult.projectId) {
-          ui.log.error(`${tr('new.firebase.create.failed')}: ${lastResult.error}`);
+          const errLine = lastResult.billingQuotaError
+            ? tr('new.firebase.create.billingQuotaError')
+            : `${tr('new.firebase.create.failed')}: ${lastResult.error}`;
+          ui.log.error(errLine);
           ui.note(
             `${kleur.cyan(lastResult.billingManualLink)}\n\n${tr('new.firebase.create.billingRetry.hint')}`,
             tr('new.firebase.create.billingRetry.title')
@@ -784,7 +857,7 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
           }
           ui.log.message(tr('new.firebase.create.billingRetry.retrying'));
           selectedBillingId = await promptBillingAccountIfNeeded(tr, cancel);
-          const ps2 = ui.makeTimedStepper();
+          const ps2 = ui.makeQuickStepper({ color: paintLime });
           ps2.next(tr('new.firebase.create.creating'));
           lastResult = await setupFromScratch(core.appName.trim(), core.bundleId.trim(), {
                 includeWeb: firebaseIncludeWeb,
@@ -809,19 +882,14 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
             ui.log.info(`Project ID: ${core.firebaseProjectId}`);
             printCreateFromScratchStatus(lastResult, tr);
             const authUrl = `https://console.firebase.google.com/project/${core.firebaseProjectId}/authentication/providers`;
-            if (lastResult.authEnabled && !lastResult.googleSignInSkipped) {
-              // All three providers enabled automatically — skip prompt.
-            } else {
-              const step1Key = lastResult.googleSignInSkipped
-                ? 'new.firebase.create.beforeContinue.step1'
-                : 'new.firebase.create.beforeContinue.step1.noAuth';
-              const lastReadyKey = lastResult.googleSignInSkipped
-                ? 'new.firebase.create.beforeContinue.ready'
-                : 'new.firebase.create.beforeContinue.ready.noAuth';
-              showBeforeContinue(step1Key, authUrl);
+            if (!lastResult.authEnabled) {
+              showBeforeContinue('new.firebase.create.beforeContinue.step1.noAuth', authUrl);
               openUrl(authUrl);
-              await askReady(lastReadyKey);
+              if (!isQuick) {
+                await askReady('new.firebase.create.beforeContinue.ready.noAuth');
+              }
             }
+            // Google Sign-In status is reported after flutterfire (retry path).
 
             break;
           } else {
@@ -874,10 +942,11 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
         onCancel: cancel,
       });
     } else {
+      // Warn before the org/billing prompts so the user is ready for the long call.
+      ui.log.info(tr('new.firebase.create.estimatedTime'));
       const selectedOrgId = await promptOrganizationIfNeeded(tr, cancel);
       const selectedBillingId = await promptBillingAccountIfNeeded(tr, cancel);
-      ui.log.info(tr('new.internet.warning'));
-      const ps3 = ui.makeTimedStepper();
+      const ps3 = ui.makeQuickStepper({ color: paintLime });
       ps3.next(tr('new.firebase.create.creatingPush'));
       const setupResult = await setupFromScratch(core.appName.trim(), core.bundleId.trim(), {
         includeWeb: true,
@@ -926,15 +995,19 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
   let supabaseExistingResult = null;
 
   if (backend === 'supabase') {
-    supabaseCreate = await ui.select({
-      message: tr('new.supabase.q.create'),
-      initialValue: true,
-      options: [
-        { value: true,  label: tr('new.supabase.q.create.create') },
-        { value: false, label: tr('new.supabase.q.create.existing') },
-      ],
-      onCancel: cancel,
-    });
+    if (isQuick) {
+      supabaseCreate = true;
+    } else {
+      supabaseCreate = await ui.select({
+        message: tr('new.supabase.q.create'),
+        initialValue: true,
+        options: [
+          { value: true,  label: tr('new.supabase.q.create.create') },
+          { value: false, label: tr('new.supabase.q.create.existing') },
+        ],
+        onCancel: cancel,
+      });
+    }
 
     const showLoginRequired = () => {
       ui.log.warn(`${tr('new.supabase.loginRequired')}\n${kleur.cyan(tr('new.supabase.loginCommand'))}`);
@@ -971,12 +1044,19 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
           });
           supabaseRegion = region || DEFAULT_SUPABASE_REGION;
         }
-        const dbPassword = await ui.password({
-          message: tr('new.supabase.q.dbPassword'),
-          validate: (v) => (v && v.length >= 6 ? undefined : tr('new.supabase.q.dbPassword.required')),
-          onCancel: cancel,
-        });
-        supabaseDbPassword = dbPassword;
+        if (isQuick) {
+          // Quick mode: generate a strong password and save to .kasy/supabase.json after build.
+          // The user can read it from there or rotate later via Supabase dashboard.
+          supabaseDbPassword = crypto.randomBytes(18).toString('base64')
+            .replace(/[+/=]/g, '')
+            .slice(0, 24);
+        } else {
+          supabaseDbPassword = await ui.password({
+            message: tr('new.supabase.q.dbPassword'),
+            validate: (v) => (v && v.length >= 6 ? undefined : tr('new.supabase.q.dbPassword.required')),
+            onCancel: cancel,
+          });
+        }
         ui.log.info(tr('new.internet.warning'));
         const createSpinner = ui.timedSpinner();
         createSpinner.start(tr('new.supabase.creating'));
@@ -1075,7 +1155,7 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
 
   // ── Firebase existing project: enable APIs + create Firestore/Storage ───
   if (backend === 'firebase' && firebaseSetupMode === 'existing' && core.firebaseProjectId) {
-    const ps4 = ui.makeTimedStepper();
+    const ps4 = ui.makeQuickStepper({ color: paintLime });
     ps4.next(stepProgress('enable-apis', language));
     const existingSetup = await setupExistingProject(core.firebaseProjectId, {
       onProgress: (key, data) => {
@@ -1088,6 +1168,11 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
           ps4.next(stepProgress('firestore', language));
         } else if (key === 'storage') {
           ps4.next(stepProgress('storage', language));
+        } else if (key === 'storage-cors') {
+          ps4.next(stepProgress('storage-cors', language));
+        } else if (key === 'storage-cors-warn') {
+          ps4.stop();
+          ui.log.warn(`Storage CORS: ${(data?.error || '').slice(0, 80)}\n${kleur.cyan(data?.url || '')}`);
         } else if (key === 'auth-providers-warn') {
           ps4.stop();
           ui.log.warn(`${tr('new.firebase.interactive.authWarn')}\n${kleur.cyan(data?.url || '')}`);
@@ -1124,21 +1209,12 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
     // --with flag was passed: use those modules directly, skip preset prompt.
     modules = preselectedModules;
   } else if (isQuick) {
-    // Quick mode: show preset picker (no multiselect).
-    const preset = await ui.select({
-      message: tr('new.q.preset'),
-      initialValue: 'starter',
-      options: [
-        { value: 'starter', label: tr('new.q.preset.starter') },
-        { value: 'saas',    label: tr('new.q.preset.saas') },
-        { value: 'content', label: tr('new.q.preset.content') },
-        { value: 'full',    label: tr('new.q.preset.full') },
-        { value: 'none',    label: tr('new.q.preset.none') },
-      ],
-      onCancel: cancel,
-    });
-    modules = MODULE_PRESETS[preset] || [];
+    // Quick mode: ship all features by default. Facebook is excluded because
+    // it requires App ID + token that we can't auto-generate — the user adds
+    // it later with `kasy add facebook` when they have the credentials.
+    modules = (MODULE_PRESETS.full || []).filter((m) => m !== 'facebook');
   } else {
+    section('new.advanced.section.features');
     // Advanced mode: full multiselect — built from catalog, filtered by audience + backend.
     const visibleFeatures = getVisibleFeatures({ audience: KASY_AUDIENCE, backend });
 
@@ -1174,10 +1250,15 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
       }
     }
 
+    // Pre-select everything available except Facebook — faster than ticking
+    // 8 boxes; user just deselects what they don't want.
+    const defaultSelected = moduleOptions
+      .map((o) => o.value)
+      .filter((id) => id !== 'facebook');
     const rawModules = await ui.multiselect({
       message: tr('new.firebase.q.modules'),
       options: moduleOptions,
-      initialValues: [],
+      initialValues: defaultSelected,
       required: false,
       onCancel: cancel,
     });
@@ -1188,79 +1269,105 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
     modules = [...new Set([...modules, 'web'])];
   }
 
+  // ── Credentials shortcut for Advanced ─────────────────────────────────────
+  // Default: defer (no prompts). Matches Quick's "scaffold first, secrets later"
+  // philosophy. User can opt-in to enter everything inline if they prefer.
+  let configureCredsNow = false;
+  if (!isQuick) {
+    const FEATURES_WITH_CREDS = ['revenuecat', 'sentry', 'analytics', 'llm_chat', 'facebook'];
+    if (modules.some((m) => FEATURES_WITH_CREDS.includes(m))) {
+      section('new.advanced.section.creds');
+      configureCredsNow = await ui.confirm({
+        message: tr('new.advanced.q.configureCredsNow'),
+        initialValue: false,
+        onCancel: cancel,
+      });
+    }
+  }
+  const askCreds = !isQuick && configureCredsNow;
+
   // ── Module-specific questions ───────────────────────────────────────────
   const moduleAnswers = {};
 
   if (modules.includes('revenuecat')) {
-    // Three keys, all optional, but we require at least one. The kasy run
-    // command picks the right key based on the device:
-    //   simulator/emulator → RC_TEST_KEY
-    //   physical iOS       → RC_IOS_PROD_KEY (falls back to test if missing)
-    //   physical Android   → RC_ANDROID_PROD_KEY (falls back to test if missing)
-    moduleAnswers.rcTestKey = ((await ui.text({
-      message: tr('new.firebase.q.revenuecat.test'),
-      validate: (v) => {
-        const s = (v || '').trim();
-        if (!s) return undefined;
-        return /^test_/.test(s) ? undefined : tr('new.firebase.q.revenuecat.test.invalid');
-      },
-      onCancel: cancel,
-    })) || '').trim();
-    moduleAnswers.rcIosProdKey = ((await ui.text({
-      message: tr('new.firebase.q.revenuecat.iosProd'),
-      validate: (v) => {
-        const s = (v || '').trim();
-        if (!s) return undefined;
-        return /^appl_/.test(s) ? undefined : tr('new.firebase.q.revenuecat.iosProd.invalid');
-      },
-      onCancel: cancel,
-    })) || '').trim();
-    moduleAnswers.rcAndroidProdKey = ((await ui.text({
-      message: tr('new.firebase.q.revenuecat.androidProd'),
-      validate: (v) => {
-        const s = (v || '').trim();
-        if (!s) return undefined;
-        return /^goog_/.test(s) ? undefined : tr('new.firebase.q.revenuecat.androidProd.invalid');
-      },
-      onCancel: cancel,
-    })) || '').trim();
-    if (!moduleAnswers.rcTestKey && !moduleAnswers.rcIosProdKey && !moduleAnswers.rcAndroidProdKey) {
-      // Non-blocking: user can fill .env later. Just warn so they're not surprised.
-      ui.log.warn(tr('new.firebase.q.revenuecat.atLeastOne'));
+    if (!askCreds) {
+      // Defer mode: scaffold with empty keys + default paywall; user fills
+      // them later via `kasy configure revenuecat`.
+      moduleAnswers.rcTestKey = '';
+      moduleAnswers.rcIosProdKey = '';
+      moduleAnswers.rcAndroidProdKey = '';
+      moduleAnswers.defaultPaywall = 'basic';
+    } else {
+      // Three keys, all optional, but we require at least one. The kasy run
+      // command picks the right key based on the device:
+      //   simulator/emulator → RC_TEST_KEY
+      //   physical iOS       → RC_IOS_PROD_KEY (falls back to test if missing)
+      //   physical Android   → RC_ANDROID_PROD_KEY (falls back to test if missing)
+      moduleAnswers.rcTestKey = ((await ui.text({
+        message: tr('new.firebase.q.revenuecat.test'),
+        validate: (v) => {
+          const s = (v || '').trim();
+          if (!s) return undefined;
+          return /^test_/.test(s) ? undefined : tr('new.firebase.q.revenuecat.test.invalid');
+        },
+        onCancel: cancel,
+      })) || '').trim();
+      moduleAnswers.rcIosProdKey = ((await ui.text({
+        message: tr('new.firebase.q.revenuecat.iosProd'),
+        validate: (v) => {
+          const s = (v || '').trim();
+          if (!s) return undefined;
+          return /^appl_/.test(s) ? undefined : tr('new.firebase.q.revenuecat.iosProd.invalid');
+        },
+        onCancel: cancel,
+      })) || '').trim();
+      moduleAnswers.rcAndroidProdKey = ((await ui.text({
+        message: tr('new.firebase.q.revenuecat.androidProd'),
+        validate: (v) => {
+          const s = (v || '').trim();
+          if (!s) return undefined;
+          return /^goog_/.test(s) ? undefined : tr('new.firebase.q.revenuecat.androidProd.invalid');
+        },
+        onCancel: cancel,
+      })) || '').trim();
+      if (!moduleAnswers.rcTestKey && !moduleAnswers.rcIosProdKey && !moduleAnswers.rcAndroidProdKey) {
+        // Non-blocking: user can fill .env later. Just warn so they're not surprised.
+        ui.log.warn(tr('new.firebase.q.revenuecat.atLeastOne'));
+      }
+      moduleAnswers.defaultPaywall = await ui.select({
+        message: tr('new.firebase.q.paywall'),
+        initialValue: 'basic',
+        options: [
+          { value: 'basic',      label: 'Basic (list of plans)' },
+          { value: 'withSwitch', label: 'With trial switch' },
+          { value: 'basicRow',   label: 'Row + comparison table' },
+          { value: 'minimal',    label: 'Minimal (benefits + CTA)' },
+        ],
+        onCancel: cancel,
+      });
     }
-    moduleAnswers.defaultPaywall = await ui.select({
-      message: tr('new.firebase.q.paywall'),
-      initialValue: 'basic',
-      options: [
-        { value: 'basic',      label: 'Basic (list of plans)' },
-        { value: 'withSwitch', label: 'With trial switch' },
-        { value: 'basicRow',   label: 'Row + comparison table' },
-        { value: 'minimal',    label: 'Minimal (benefits + CTA)' },
-      ],
-      onCancel: cancel,
-    });
   }
 
-  // RC web key — only in advanced mode (optional credential, can configure later).
-  if (!isQuick && modules.includes('revenuecat') && modules.includes('web')) {
-    const rcWebKey = await ui.text({
-      message: tr('new.firebase.q.revenuecat.webKey'),
-      validate: (v) => {
-        if (!v || !v.trim()) return undefined; // optional — blank is fine
-        return /^rcb_/.test(v.trim()) ? undefined : tr('new.firebase.q.revenuecat.webKey.invalid');
-      },
-      onCancel: cancel,
-    });
+  // RC web key — only when configuring inline. Otherwise mark scaffolded.
+  if (modules.includes('revenuecat') && modules.includes('web')) {
     moduleAnswers.revenuecatWeb = true;
-    moduleAnswers.rcWebKey = (rcWebKey || '').trim();
-  } else if (modules.includes('revenuecat') && modules.includes('web')) {
-    // Quick mode: mark web billing as included but key will be configured later.
-    moduleAnswers.revenuecatWeb = true;
-    moduleAnswers.rcWebKey = '';
+    if (askCreds) {
+      const rcWebKey = await ui.text({
+        message: tr('new.firebase.q.revenuecat.webKey'),
+        validate: (v) => {
+          if (!v || !v.trim()) return undefined; // optional — blank is fine
+          return /^rcb_/.test(v.trim()) ? undefined : tr('new.firebase.q.revenuecat.webKey.invalid');
+        },
+        onCancel: cancel,
+      });
+      moduleAnswers.rcWebKey = (rcWebKey || '').trim();
+    } else {
+      moduleAnswers.rcWebKey = '';
+    }
   }
 
-  // Sentry DSN — already optional (blank = configure later). Skip in quick mode.
-  if (!isQuick && modules.includes('sentry')) {
+  // Sentry DSN — only when configuring inline.
+  if (askCreds && modules.includes('sentry')) {
     moduleAnswers.sentryDsn = await ui.text({
       message: tr('new.firebase.q.sentry.dsn'),
       validate: (v) => {
@@ -1273,23 +1380,17 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
     });
   }
 
-  // Mixpanel token — already optional. Skip in quick mode.
-  if (!isQuick && modules.includes('analytics')) {
+  // Mixpanel token — only when configuring inline.
+  if (askCreds && modules.includes('analytics')) {
     moduleAnswers.mixpanelToken = await ui.text({
       message: tr('new.firebase.q.mixpanel.token'),
       onCancel: cancel,
     });
   }
 
-  // LLM Chat credentials — skip in quick mode, all fields optional.
-  if (!isQuick && modules.includes('llm_chat')) {
-    const configureLlmNow = await ui.confirm({
-      message: tr('new.q.llm_chat.configureNow'),
-      initialValue: true,
-      onCancel: cancel,
-    });
-
-    if (configureLlmNow) {
+  // LLM Chat credentials.
+  if (modules.includes('llm_chat')) {
+    if (askCreds) {
       moduleAnswers.llmProvider = await ui.select({
         message: tr('add.prompt.llmProvider'),
         initialValue: 'openai',
@@ -1310,36 +1411,33 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
     } else {
       moduleAnswers.llmConfigureLater = true;
     }
-  } else if (isQuick && modules.includes('llm_chat')) {
-    moduleAnswers.llmConfigureLater = true;
   }
 
-  // Facebook — required credentials, always ask.
+  // Facebook — required credentials when inline; scaffold-only otherwise.
   if (modules.includes('facebook')) {
-    moduleAnswers.fbAppId = await ui.text({
-      message: tr('new.firebase.q.facebook.appId'),
-      validate: (v) => {
-        if (!v || !v.trim()) return tr('new.firebase.q.facebook.appId.required');
-        return /^\d+$/.test(v.trim()) ? undefined : tr('new.firebase.q.facebook.appId.invalid');
-      },
-      onCancel: cancel,
-    });
-    moduleAnswers.fbToken = await ui.password({
-      message: tr('new.firebase.q.facebook.token'),
-      validate: (v) => (v && v.trim() ? undefined : tr('new.firebase.q.facebook.token.required')),
-      onCancel: cancel,
-    });
+    if (askCreds) {
+      moduleAnswers.fbAppId = await ui.text({
+        message: tr('new.firebase.q.facebook.appId'),
+        validate: (v) => {
+          if (!v || !v.trim()) return tr('new.firebase.q.facebook.appId.required');
+          return /^\d+$/.test(v.trim()) ? undefined : tr('new.firebase.q.facebook.appId.invalid');
+        },
+        onCancel: cancel,
+      });
+      moduleAnswers.fbToken = await ui.password({
+        message: tr('new.firebase.q.facebook.token'),
+        validate: (v) => (v && v.trim() ? undefined : tr('new.firebase.q.facebook.token.required')),
+        onCancel: cancel,
+      });
+    } else {
+      moduleAnswers.fbAppId = '';
+      moduleAnswers.fbToken = '';
+    }
   }
 
-  // Server secrets (webhook, Meta Ads) — skip in quick mode, configure later via `kasy deploy`.
-  if (!isQuick && modules.includes('revenuecat') && (backend === 'supabase' || backend === 'firebase')) {
-    const configureSecretsNow = await ui.confirm({
-      message: tr('new.firebase.q.secrets.configureNow'),
-      initialValue: true,
-      onCancel: cancel,
-    });
-
-    if (configureSecretsNow) {
+  // Server secrets (webhook, Meta Ads) — only when configuring inline.
+  if (modules.includes('revenuecat') && (backend === 'supabase' || backend === 'firebase')) {
+    if (askCreds) {
       moduleAnswers.rcWebhookKey = await ui.text({
         message: tr('new.firebase.q.revenuecat.webhookKey'),
         initialValue: generateWebhookKey(),
@@ -1361,9 +1459,6 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
     } else {
       moduleAnswers.secretsConfigureLater = true;
     }
-  } else if (isQuick && modules.includes('revenuecat')) {
-    // Quick mode: always defer secrets to `kasy deploy`.
-    moduleAnswers.secretsConfigureLater = true;
   }
 
   // ── Deploy is now a separate command (`kasy deploy`) ─────────────
@@ -1384,25 +1479,13 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
     apiBaseUrl: core.apiBaseUrl?.trim(),
   };
 
-  printSummary(tr, answers);
-
-  if (!yes) {
-    const proceed = await ui.confirm({
-      message: tr('new.firebase.confirm.proceed'),
-      initialValue: true,
-      onCancel: cancel,
-    });
-    if (!proceed) {
-      ui.cancel(tr('prompt.cancelled'));
-      process.exit(0);
-    }
-  }
+  // No mid-flow confirmation: both Quick and Advanced go straight to the
+  // generation step once choices are made. The success card at the end shows
+  // the full summary. Cancel any time with Ctrl+C.
 
   // ── Generate ────────────────────────────────────────────────────────────
-  // Stepper shows each step closing as ✦ and the next starting as ⠙ — so the
-  // user gets explicit "X done → Y starting" feedback instead of a single
-  // spinner with a mutating message.
-  const stepper = ui.makeTimedStepper();
+  // Quick: single rolling line that mutates message. Advanced: stack each step.
+  const stepper = ui.makeQuickStepper({ color: paintLime });
   // First step started here so even silent prep work shows progress.
   stepper.next(stepProgress('project-setup', language));
 
@@ -1448,6 +1531,10 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
         functionsRegion: firebaseRegion,
         language,
         onProgress,
+        // Google Sign-In is enabled in a later step via Firebase CLI, which is
+        // when the OAuth Web Client + REVERSED_CLIENT_ID get created. Defer the
+        // two patches that depend on those IDs so they don't fail noisily here.
+        deferGoogleAuthPatches: true,
       });
     }
     // Close the last in-flight step. We don't need a label — its own message
@@ -1507,7 +1594,13 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
       // only way to make the client secret available via the Identity Toolkit API.
       // Non-fatal: silently ignored if it fails (e.g. API not yet propagated).
       if (answers.firebaseProjectId) {
-        await enableAuthProviders(answers.firebaseProjectId);
+        const authResult = await enableAuthProviders(answers.firebaseProjectId);
+        if (authResult.ok && !authResult.googleSignInSkipped) {
+          printStepResult({ name: 'google sign-in', ok: true }, language);
+        }
+        if (authResult.appleEnabled) {
+          printStepResult({ name: 'apple sign-in', ok: true }, language);
+        }
       }
 
       // Try to get the Client Secret from Identity Toolkit API (requires gcloud auth)
@@ -1571,6 +1664,31 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
         setupSpinner.error(err.message);
         ui.log.warn(tr('new.supabase.setupManual'));
       }
+
+      // Quick mode generates the DB password automatically — persist it so the
+      // user can recover it later (e.g. to log into Supabase Studio).
+      if (isQuick && supabaseCreate && supabaseDbPassword) {
+        try {
+          const kasyDir = path.join(targetDir, '.kasy');
+          await fs.ensureDir(kasyDir);
+          await fs.writeJson(
+            path.join(kasyDir, 'supabase.json'),
+            { projectRef: supabaseSetupPayload.projectRef, dbPassword: supabaseDbPassword },
+            { spaces: 2 }
+          );
+          const gitignorePath = path.join(targetDir, '.gitignore');
+          const gitignoreEntry = '.kasy/supabase.json';
+          if (await fs.pathExists(gitignorePath)) {
+            const existing = await fs.readFile(gitignorePath, 'utf8');
+            if (!existing.includes(gitignoreEntry)) {
+              await fs.appendFile(gitignorePath, `\n# Supabase auto-generated DB password (credentials — do not commit)\n${gitignoreEntry}\n`, 'utf8');
+            }
+          }
+          ui.log.info(tr('new.supabase.passwordSaved'));
+        } catch (_) {
+          // Non-fatal: user can rotate password via Supabase dashboard if needed.
+        }
+      }
     }
   }
 
@@ -1640,16 +1758,57 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
     );
   }
 
-  // ── APNs reminder (all backends — required for iOS push notifications) ───────
-  // Cannot be automated: the .p8 key only exists in Apple Developer Portal.
-  if (answers.firebaseProjectId) {
-    const apnsUrl = `https://console.firebase.google.com/project/${answers.firebaseProjectId}/settings/cloudmessaging`;
-    ui.log.warn(
-      `${tr('new.apns.warning')}\n${tr('new.apns.step1')}\n${tr('new.apns.step2')}\n${kleur.cyan(apnsUrl)}`
-    );
-    openUrl(apnsUrl);
+  // ── Google + Apple Sign-In: use Firebase CLI for Google (creates OAuth client),
+  // then REST API for Apple as best-effort. ───────────────────────────────────
+  // Firebase CLI's `deploy --only auth` is the only documented path that auto-
+  // creates the OAuth 2.0 Web Client without manual Console clicks — the same
+  // backend that the Console hits internally.
+  // (Supabase backend keeps the REST-only retry — its OAuth client is provisioned
+  // differently via the linked Firebase Web app.)
+  if (backend === 'firebase' && answers.firebaseProjectId && flutterfireStep?.ok) {
+    const googleSpinner = ui.spinner();
+    googleSpinner.start(tr('new.google.enabling'));
+    const cliResult = await enableAuthViaFirebaseCli({
+      projectDir: targetDir,
+      projectId: answers.firebaseProjectId,
+      appName: answers.appName,
+    });
+    googleSpinner.stop(tr('new.google.enabling'));
+    if (cliResult.ok) {
+      printStepResult({ name: 'google sign-in', ok: true }, language);
+
+      // Google deploy created the OAuth Web Client + iOS client. Re-run flutterfire
+      // so google-services.json and GoogleService-Info.plist pick up the new IDs,
+      // then re-apply the two patches that failed during the initial pass.
+      const rerunSpinner = ui.spinner();
+      rerunSpinner.start(tr('new.google.refreshConfigs'));
+      const ffRerun = await flutterfireConfigure(targetDir, answers.firebaseProjectId, {
+        includeWeb: answers.includeWeb !== false,
+      });
+      rerunSpinner.stop(tr('new.google.refreshConfigs'));
+      if (ffRerun.ok) {
+        const gaResult = await writeGoogleAuthOptions(targetDir);
+        printStepResult({ name: 'google-auth-options', ok: gaResult.ok, detail: gaResult.error }, language);
+        const iosResult = await writeGoogleIosUrlScheme(targetDir);
+        printStepResult({ name: 'google-ios-url-scheme', ok: iosResult.ok, detail: iosResult.error }, language);
+      }
+    } else {
+      const authUrl = `https://console.firebase.google.com/project/${answers.firebaseProjectId}/authentication/providers`;
+      const reason = cliResult.error === 'support_email_required'
+        ? tr('new.google.manualHint.noEmail')
+        : tr('new.google.manualHint');
+      ui.log.warn(`${reason}\n${kleur.cyan(authUrl)}`);
+    }
+    // Apple Sign-In remains a best-effort REST POST (no CLI support yet).
+    const appleResult = await enableAuthProviders(answers.firebaseProjectId);
+    if (appleResult.appleEnabled) {
+      printStepResult({ name: 'apple sign-in', ok: true }, language);
+    }
   }
 
+  // APNs key (iOS push) is intentionally not mentioned here — it only becomes
+  // relevant when shipping to iOS, and the docs at kasy.dev/docs/apns explain it.
+
   printSuccessCard(tr, answers, targetDir);
 
   ui.outro(kleur.bold(tr('new.success.title')));