kasy-cli 1.2.1

package/lib/commands/check.js

@@ -0,0 +1,240 @@
+/**
+ * `kasy check` — push notifications diagnostic.
+ *
+ * Verifies whether the push notification stack is correctly configured
+ * for the current project (Supabase backend only — Firebase uses ADC automatically).
+ *
+ * Checks:
+ *   1. Project is linked (supabase/.temp/project-ref exists)
+ *   2. FIREBASE_SERVICE_ACCOUNT_JSON secret is set
+ *   3. FIREBASE_PROJECT_ID secret is set
+ *   4. Edge function send-push-notification is deployed
+ *
+ * Auto-fix (--fix flag):
+ *   Generates FIREBASE_SERVICE_ACCOUNT_JSON automatically via gcloud and sets it.
+ */
+
+const path = require('node:path');
+const fs = require('fs-extra');
+const kleur = require('kleur');
+const oraPackage = require('ora');
+const { exec } = require('node:child_process');
+const { promisify } = require('node:util');
+
+const { getStoredLanguage } = require('../utils/license');
+const { createFcmServiceAccountKey } = require('../scaffold/shared/fcm-service-account');
+const { setSupabaseSecrets } = require('../scaffold/backends/supabase/deploy');
+
+const ora = oraPackage.default || oraPackage;
+const execAsync = promisify(exec);
+
+// ── Helpers ───────────────────────────────────────────────────────────────────
+
+async function runCmd(cmd, cwd) {
+  try {
+    const { stdout } = await execAsync(cmd, { cwd, maxBuffer: 2 * 1024 * 1024 });
+    return { ok: true, stdout: stdout.trim() };
+  } catch (err) {
+    return { ok: false, error: err.message, stdout: (err.stdout || '').trim() };
+  }
+}
+
+function ok(label, detail)      { console.log(`  ${kleur.green('✓')}  ${label}${detail ? kleur.gray(` — ${detail}`) : ''}`); }
+function fail(label, detail)    { console.log(`  ${kleur.red('✗')}  ${kleur.red(label)}${detail ? kleur.gray(` — ${detail}`) : ''}`); }
+function warn(label, detail)    { console.log(`  ${kleur.yellow('⚠')}  ${kleur.yellow(label)}${detail ? kleur.gray(` — ${detail}`) : ''}`); }
+function info(label)            { console.log(`  ${kleur.gray('–')}  ${kleur.gray(label)}`); }
+
+/**
+ * Read the linked Supabase project ref.
+ */
+async function readProjectRef(projectDir) {
+  const refPath = path.join(projectDir, 'supabase', '.temp', 'project-ref');
+  if (!(await fs.pathExists(refPath))) return null;
+  try { return (await fs.readFile(refPath, 'utf8')).trim() || null; } catch { return null; }
+}
+
+/**
+ * Read Firebase project ID from android/app/google-services.json.
+ */
+async function readFirebaseProjectId(projectDir) {
+  const gsPath = path.join(projectDir, 'android', 'app', 'google-services.json');
+  if (!(await fs.pathExists(gsPath))) return null;
+  try {
+    const data = await fs.readJson(gsPath);
+    return data?.project_info?.project_id || null;
+  } catch { return null; }
+}
+
+/**
+ * List Supabase secrets names (not values) for the linked project.
+ * Returns a Set of secret names, or null if the command fails.
+ */
+async function listSecretNames(projectDir) {
+  const result = await runCmd('supabase secrets list', projectDir);
+  if (!result.ok) return null;
+  const names = new Set();
+  for (const line of result.stdout.split('\n')) {
+    const name = line.trim().split(/\s+/)[0];
+    if (name && name !== 'Name' && name !== '---') names.add(name);
+  }
+  return names;
+}
+
+/**
+ * List deployed Supabase function names.
+ * Returns a Set of function names, or null if the command fails.
+ */
+async function listDeployedFunctions(projectDir) {
+  const result = await runCmd('supabase functions list', projectDir);
+  if (!result.ok) return null;
+  const names = new Set();
+  for (const line of result.stdout.split('\n')) {
+    const parts = line.trim().split(/\s+/);
+    if (parts[0] && parts[0] !== 'Name' && parts[0] !== '---') names.add(parts[0]);
+  }
+  return names;
+}
+
+// ── Main ──────────────────────────────────────────────────────────────────────
+
+/**
+ * @param {object} options
+ * @param {string}  [options.directory] - project directory (default: cwd)
+ * @param {boolean} [options.fix]       - auto-fix missing configuration
+ * @param {string}  [options.language]
+ */
+async function runCheck(options = {}) {
+  const projectDir = path.resolve(options.directory || '.');
+
+  console.log(kleur.bold(`\n  Kasy Check — Push Notifications\n`));
+
+  // ── Detect backend ────────────────────────────────────────────────────────
+  const isFirebase = await fs.pathExists(path.join(projectDir, 'firebase.json'));
+  const isSupabase = await fs.pathExists(path.join(projectDir, 'supabase'));
+
+  if (isFirebase && !isSupabase) {
+    ok('Firebase backend');
+    info('Firebase usa Application Default Credentials — nenhuma configuração extra necessária.');
+    console.log('');
+    // APNs Key is still required for iOS push — show reminder even for Firebase backend.
+    const firebaseProjectId = await readFirebaseProjectId(projectDir);
+    console.log(kleur.bold().yellow(`  ⚠  Push iOS requer APNs Key (não verificável via CLI)`));
+    console.log(kleur.gray(`     Firebase Console → Cloud Messaging → app iOS → Chave de autenticação APNs`));
+    if (firebaseProjectId) {
+      console.log(kleur.cyan(`     https://console.firebase.google.com/project/${firebaseProjectId}/settings/cloudmessaging`));
+    }
+    console.log('');
+    return;
+  }
+
+  if (!isSupabase) {
+    console.error(kleur.red(`  ✗ Diretório não parece ser um projeto Kasy.\n`));
+    process.exit(1);
+  }
+
+  // ── 1. Project linked? ────────────────────────────────────────────────────
+  const projectRef = await readProjectRef(projectDir);
+  if (!projectRef) {
+    fail('Projeto Supabase não vinculado', 'execute: supabase link --project-ref SEU_REF');
+    console.log('');
+    process.exit(1);
+  }
+  ok('Projeto vinculado', projectRef);
+
+  // ── Read secrets list ─────────────────────────────────────────────────────
+  const spinner = ora(kleur.gray('  Verificando secrets…')).start();
+  const secrets = await listSecretNames(projectDir);
+  spinner.stop();
+
+  if (!secrets) {
+    warn('Não foi possível listar secrets', 'verifique: supabase login');
+  }
+
+  // ── 2. FIREBASE_PROJECT_ID ────────────────────────────────────────────────
+  const firebaseProjectId = await readFirebaseProjectId(projectDir);
+  if (secrets) {
+    if (secrets.has('FIREBASE_PROJECT_ID')) {
+      ok('FIREBASE_PROJECT_ID configurado');
+    } else {
+      fail('FIREBASE_PROJECT_ID ausente');
+      if (firebaseProjectId) {
+        console.log(kleur.gray(`    Corrija: supabase secrets set FIREBASE_PROJECT_ID="${firebaseProjectId}"`));
+        if (options.fix) {
+          const r = await runCmd(`supabase secrets set FIREBASE_PROJECT_ID="${firebaseProjectId}"`, projectDir);
+          r.ok
+            ? ok('FIREBASE_PROJECT_ID → configurado automaticamente')
+            : fail('FIREBASE_PROJECT_ID → falhou ao configurar', r.error);
+        }
+      }
+    }
+  }
+
+  // ── 3. FIREBASE_SERVICE_ACCOUNT_JSON ─────────────────────────────────────
+  if (secrets) {
+    if (secrets.has('FIREBASE_SERVICE_ACCOUNT_JSON')) {
+      ok('FIREBASE_SERVICE_ACCOUNT_JSON configurado');
+    } else {
+      fail('FIREBASE_SERVICE_ACCOUNT_JSON ausente');
+
+      if (options.fix && firebaseProjectId) {
+        const fixSpinner = ora(kleur.cyan('  Gerando e configurando chave FCM…')).start();
+        const fcmResult = await createFcmServiceAccountKey(firebaseProjectId);
+        fixSpinner.stop();
+
+        if (fcmResult.ok) {
+          const secretSteps = await setSupabaseSecrets(projectDir, {
+            firebaseProjectId,
+            firebaseServiceAccountJson: fcmResult.json,
+          });
+          const setStep = secretSteps.find((s) => s.name === 'secret FIREBASE_SERVICE_ACCOUNT_JSON');
+          setStep?.ok
+            ? ok('FIREBASE_SERVICE_ACCOUNT_JSON → configurado automaticamente')
+            : fail('FIREBASE_SERVICE_ACCOUNT_JSON → falhou ao configurar', setStep?.error);
+        } else {
+          fail('FIREBASE_SERVICE_ACCOUNT_JSON → não foi possível gerar chave', fcmResult.error);
+          console.log(kleur.gray(`    Manual: Firebase Console → Configurações → Contas de serviço → Gerar chave`));
+          console.log(kleur.gray(`    Depois: supabase secrets set FIREBASE_SERVICE_ACCOUNT_JSON='$(cat chave.json)'`));
+        }
+      } else {
+        console.log(kleur.gray(`    Corrija automaticamente: kasy check --fix`));
+        console.log(kleur.gray(`    Ou manualmente: Firebase Console → Configurações → Contas de serviço → Gerar chave`));
+        console.log(kleur.gray(`    Depois: supabase secrets set FIREBASE_SERVICE_ACCOUNT_JSON='$(cat chave.json)'`));
+      }
+    }
+  }
+
+  // ── 4. Edge function send-push-notification ────────────────────────────────
+  const fnSpinner = ora(kleur.gray('  Verificando edge functions…')).start();
+  const functions = await listDeployedFunctions(projectDir);
+  fnSpinner.stop();
+
+  if (!functions) {
+    warn('Não foi possível listar edge functions', 'verifique: supabase login');
+  } else if (functions.has('send-push-notification')) {
+    ok('Edge function send-push-notification deployada');
+  } else {
+    fail('Edge function send-push-notification não deployada');
+    if (options.fix) {
+      const deploySpinner = ora(kleur.cyan('  Publicando send-push-notification…')).start();
+      const r = await runCmd('supabase functions deploy send-push-notification', projectDir);
+      deploySpinner.stop();
+      r.ok
+        ? ok('send-push-notification → deployada automaticamente')
+        : fail('send-push-notification → falhou no deploy', r.error);
+    } else {
+      console.log(kleur.gray(`    Corrija automaticamente: kasy check --fix`));
+      console.log(kleur.gray(`    Ou manualmente: supabase functions deploy send-push-notification`));
+    }
+  }
+
+  // ── 5. APNs reminder ─────────────────────────────────────────────────────
+  console.log('');
+  console.log(kleur.bold().yellow(`  ⚠  Push iOS requer APNs Key (não verificável via CLI)`));
+  console.log(kleur.gray(`     Firebase Console → Cloud Messaging → app iOS → Chave de autenticação APNs`));
+  if (firebaseProjectId) {
+    console.log(kleur.cyan(`     https://console.firebase.google.com/project/${firebaseProjectId}/settings/cloudmessaging`));
+  }
+  console.log('');
+}
+
+module.exports = { runCheck };

package/lib/commands/codemagic.js

@@ -0,0 +1,161 @@
+'use strict';
+
+const path = require('node:path');
+const kleur = require('kleur');
+const prompts = require('prompts');
+const { createTranslator, detectDefaultLanguage } = require('../utils/i18n');
+const { isKasyFlutterProject, openUrl } = require('../utils/apple-release');
+const { validateGoogleIosUrlScheme } = require('../scaffold/shared/post-build');
+const {
+  codemagicReleaseDocPath,
+  writeCodemagicEnv,
+  validateCodemagicSetup,
+  triggerBuild,
+  getBuildStatus,
+  URL_CODEMAGIC_APPS,
+  URL_CODEMAGIC_API,
+} = require('../utils/codemagic-release');
+
+async function assertProject(projectDir, t) {
+  if (!(await isKasyFlutterProject(projectDir))) {
+    throw new Error(t('codemagic.error.notProject'));
+  }
+}
+
+async function runConfigure(directory, options = {}) {
+  const lang = options.language || detectDefaultLanguage();
+  const t = createTranslator(lang);
+  const projectDir = path.resolve(directory || '.');
+
+  await assertProject(projectDir, t);
+
+  console.log(kleur.bold(`\n${t('codemagic.configure.title')}\n`));
+  console.log(kleur.dim(`  ${t('codemagic.configure.doc')}: ${codemagicReleaseDocPath(lang)}\n`));
+  console.log(kleur.yellow(`  ${t('codemagic.configure.checklist')}\n`));
+
+  console.log(kleur.cyan(t('codemagic.configure.openingLinks')));
+  openUrl(URL_CODEMAGIC_API);
+  openUrl(URL_CODEMAGIC_APPS);
+
+  const response = await prompts(
+    [
+      {
+        type: 'password',
+        name: 'token',
+        message: t('codemagic.configure.q.token'),
+        validate: (v) => (v && v.trim().length > 0 ? true : t('codemagic.configure.q.required')),
+      },
+      {
+        type: 'text',
+        name: 'appId',
+        message: t('codemagic.configure.q.appId'),
+        validate: (v) => (v && v.trim().length > 0 ? true : t('codemagic.configure.q.required')),
+      },
+      {
+        type: 'text',
+        name: 'workflowId',
+        message: t('codemagic.configure.q.workflowId'),
+        initial: 'ios-workflow',
+      },
+      {
+        type: 'text',
+        name: 'branch',
+        message: t('codemagic.configure.q.branch'),
+        initial: 'main',
+      },
+    ],
+    { onCancel: () => { throw new Error(t('codemagic.configure.cancelled')); } }
+  );
+
+  await writeCodemagicEnv(projectDir, {
+    token: response.token.trim(),
+    appId: response.appId.trim(),
+    workflowId: response.workflowId.trim() || 'ios-workflow',
+    branch: response.branch.trim() || 'main',
+  });
+
+  console.log(kleur.green(`\n✓ ${t('codemagic.configure.success')}`));
+  console.log(kleur.cyan(`\n  ${t('codemagic.configure.next')}: kasy codemagic release\n`));
+}
+
+async function runRelease(directory, options = {}) {
+  const t = createTranslator(options.language || detectDefaultLanguage());
+  const projectDir = path.resolve(directory || '.');
+
+  await assertProject(projectDir, t);
+
+  const validation = await validateCodemagicSetup(projectDir);
+  if (!validation.ok) {
+    console.log(kleur.red(`\n✗ ${t('codemagic.error.notConfigured')}\n`));
+    if (validation.issues.includes('missing_yaml')) {
+      console.log(kleur.dim(`  ${t('codemagic.error.addCi')}\n`));
+    }
+    if (validation.issues.includes('missing_env')) {
+      console.log(kleur.dim(`  ${t('codemagic.error.runConfigure')}\n`));
+    }
+    process.exitCode = 1;
+    return;
+  }
+
+  const googleScheme = await validateGoogleIosUrlScheme(projectDir);
+  if (!googleScheme.ok) {
+    console.log(kleur.red(`\n✗ ${t('codemagic.error.googleUrlScheme')}\n`));
+    console.log(kleur.dim(`  ${googleScheme.error}`));
+    console.log(kleur.cyan(`  ${t('ios.error.googleUrlSchemeHint')}\n`));
+    process.exitCode = 1;
+    return;
+  }
+
+  console.log(kleur.bold(`\n${t('codemagic.release.title')}\n`));
+
+  try {
+    const result = await triggerBuild(projectDir, validation.env);
+    const buildId = result.buildId || result._id;
+    if (buildId) {
+      console.log(kleur.green(`✓ ${t('codemagic.release.triggered')}`));
+      console.log(kleur.cyan(`  Build ID: ${buildId}`));
+      console.log(kleur.dim(`  https://codemagic.io/builds/${buildId}\n`));
+    } else {
+      console.log(kleur.green(`✓ ${t('codemagic.release.triggered')}\n`));
+    }
+  } catch (err) {
+    console.error(kleur.red(`\n✗ ${err.message}\n`));
+    process.exitCode = 1;
+  }
+}
+
+async function runStatus(buildId, directory, options = {}) {
+  const t = createTranslator(options.language || detectDefaultLanguage());
+  const projectDir = path.resolve(directory || '.');
+
+  await assertProject(projectDir, t);
+
+  const validation = await validateCodemagicSetup(projectDir);
+  if (!validation.env?.CODEMAGIC_API_TOKEN) {
+    console.log(kleur.red(`\n✗ ${t('codemagic.error.runConfigure')}\n`));
+    process.exitCode = 1;
+    return;
+  }
+
+  if (!buildId) {
+    console.log(kleur.yellow(`\n${t('codemagic.status.usage')}\n`));
+    process.exitCode = 1;
+    return;
+  }
+
+  try {
+    const result = await getBuildStatus(buildId, validation.env.CODEMAGIC_API_TOKEN);
+    console.log(kleur.bold(`\n${t('codemagic.status.title')}: ${buildId}\n`));
+    console.log(JSON.stringify(result, null, 2));
+    console.log('');
+  } catch (err) {
+    console.error(kleur.red(`\n✗ ${err.message}\n`));
+    process.exitCode = 1;
+  }
+}
+
+module.exports = {
+  runConfigure,
+  runRelease,
+  runStatus,
+};

package/lib/commands/deploy.js

@@ -0,0 +1,257 @@
+/**
+ * `kasy deploy` — deploy backend.
+ *
+ * Detects which backend the project uses and runs the appropriate deploy:
+ *
+ *   Firebase  — detected via firebase.json
+ *              Auto-detects project ID from .firebaserc.
+ *              Uses existing gcloud authentication — no service account key needed.
+ *
+ *   Supabase  — detected via supabase/.temp/project-ref
+ *              Deploys all edge functions, ensures FIREBASE_SERVICE_ACCOUNT_JSON
+ *              secret is set (generates automatically via gcloud if missing),
+ *              and shows APNs reminder.
+ */
+
+const path = require('node:path');
+const fs = require('fs-extra');
+const kleur = require('kleur');
+const prompts = require('prompts');
+const oraPackage = require('ora');
+
+const { createTranslator } = require('../utils/i18n');
+const { getStoredLanguage } = require('../utils/license');
+const { runDeploy: runFirebaseDeploy } = require('../scaffold/backends/firebase/deploy');
+const { deployFunctions, setSupabaseSecrets, linkProject } = require('../scaffold/backends/supabase/deploy');
+const { createFcmServiceAccountKey } = require('../scaffold/shared/fcm-service-account');
+
+const ora = oraPackage.default || oraPackage;
+
+// ── Helpers ───────────────────────────────────────────────────────────────────
+
+function printStep(ok, skipped, label, detail) {
+  const icon = ok ? kleur.green('✓') : skipped ? kleur.gray('–') : kleur.red('✗');
+  const msg  = ok ? label : skipped ? kleur.gray(label) : kleur.red(label);
+  console.log(`  ${icon} ${msg}${detail ? kleur.gray(` — ${detail.split('\n')[0]}`) : ''}`);
+}
+
+/**
+ * Read the Firebase project ID from android/app/google-services.json.
+ * This file is always present in kasy-generated projects.
+ */
+async function readFirebaseProjectId(projectDir) {
+  const gsPath = path.join(projectDir, 'android', 'app', 'google-services.json');
+  if (!(await fs.pathExists(gsPath))) return null;
+  try {
+    const data = await fs.readJson(gsPath);
+    return data?.project_info?.project_id || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Read the linked Supabase project ref from supabase/.temp/project-ref.
+ */
+async function readSupabaseProjectRef(projectDir) {
+  const refPath = path.join(projectDir, 'supabase', '.temp', 'project-ref');
+  if (!(await fs.pathExists(refPath))) return null;
+  try {
+    return (await fs.readFile(refPath, 'utf8')).trim() || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Check whether FIREBASE_SERVICE_ACCOUNT_JSON is already set in Supabase secrets.
+ */
+async function isServiceAccountJsonSet(projectDir) {
+  const { exec } = require('node:child_process');
+  const { promisify } = require('node:util');
+  const execAsync = promisify(exec);
+  try {
+    const { stdout } = await execAsync('supabase secrets list', {
+      cwd: projectDir,
+      maxBuffer: 2 * 1024 * 1024,
+    });
+    return stdout.includes('FIREBASE_SERVICE_ACCOUNT_JSON');
+  } catch {
+    return false;
+  }
+}
+
+// ── Firebase deploy ───────────────────────────────────────────────────────────
+
+async function deployFirebase(projectDir, options, tr) {
+  const cancel = () => { console.log(''); process.exit(0); };
+
+  // Auto-detect Firebase Project ID
+  let firebaseProjectId = options.project;
+  if (!firebaseProjectId) {
+    const rcPath = path.join(projectDir, '.firebaserc');
+    if (await fs.pathExists(rcPath)) {
+      try {
+        const rc = await fs.readJson(rcPath);
+        const detected = rc.projects?.default;
+        if (detected) {
+          firebaseProjectId = detected;
+          console.log(kleur.gray(`  ${tr('deploy.detected.project')} ${kleur.cyan(detected)}`));
+        }
+      } catch (_) {}
+    }
+  }
+  if (!firebaseProjectId) {
+    const { pid } = await prompts(
+      { type: 'text', name: 'pid', message: tr('deploy.q.project') },
+      { onCancel: cancel }
+    );
+    firebaseProjectId = pid?.trim();
+    if (!firebaseProjectId) process.exit(0);
+  }
+
+  // Read region — check kit_setup.json first, fall back to legacy .kasy/config.json
+  let functionsRegion = 'us-central1';
+  const kitSetupPath = path.join(projectDir, 'kit_setup.json');
+  const legacyConfigPath = path.join(projectDir, '.kasy', 'config.json');
+  for (const p of [kitSetupPath, legacyConfigPath]) {
+    if (await fs.pathExists(p)) {
+      try {
+        const config = await fs.readJson(p);
+        if (config.functionsRegion) { functionsRegion = config.functionsRegion; break; }
+      } catch (_) {}
+    }
+  }
+
+  console.log('');
+  const spinner = ora(kleur.cyan('Deploying Firebase...')).start();
+  let steps;
+  try {
+    steps = await runFirebaseDeploy(projectDir, null, firebaseProjectId, {
+      functionsRegion,
+      onProgress: (key) => { spinner.text = kleur.cyan(key); },
+    });
+    spinner.stop();
+  } catch (err) {
+    spinner.fail(kleur.red(err.message));
+    throw err;
+  }
+
+  if (steps?.length) {
+    console.log('');
+    for (const s of steps) {
+      printStep(s.ok, s.skipped, s.name, s.detail);
+    }
+    console.log('');
+  }
+
+  // ── APNs reminder — required for iOS push notifications ──────────────────
+  // Cannot be automated: the .p8 key only exists in Apple Developer Portal.
+  console.log(kleur.bold().yellow(`  ⚠  Push iOS: configure a APNs Key no Firebase Console`));
+  console.log(kleur.gray(`     1. Apple Developer Portal → Keys → criar APNs Key (.p8)`));
+  console.log(kleur.gray(`     2. Firebase Console → Cloud Messaging → app iOS → upload da APNs Key`));
+  console.log(kleur.cyan(`     https://console.firebase.google.com/project/${firebaseProjectId}/settings/cloudmessaging`));
+  console.log('');
+}
+
+// ── Supabase deploy ───────────────────────────────────────────────────────────
+
+async function deploySupabase(projectDir) {
+  console.log('');
+
+  // ── 1. Get project ref ──────────────────────────────────────────────────
+  const projectRef = await readSupabaseProjectRef(projectDir);
+  if (!projectRef) {
+    console.error(kleur.red(`\n  ✗ Projeto Supabase não está vinculado neste diretório.`));
+    console.error(kleur.gray(`    Execute: supabase link --project-ref SEU_PROJECT_REF`));
+    process.exit(1);
+  }
+  console.log(kleur.gray(`  Project ref: ${kleur.cyan(projectRef)}`));
+
+  // ── 2. FCM Service Account JSON ─────────────────────────────────────────
+  const alreadySet = await isServiceAccountJsonSet(projectDir);
+  if (alreadySet) {
+    printStep(true, false, 'FIREBASE_SERVICE_ACCOUNT_JSON já configurado');
+  } else {
+    const firebaseProjectId = await readFirebaseProjectId(projectDir);
+
+    if (firebaseProjectId) {
+      const fcmSpinner = ora(kleur.cyan('Gerando chave FCM (Service Account)…')).start();
+      const fcmResult = await createFcmServiceAccountKey(firebaseProjectId);
+      fcmSpinner.stop();
+
+      if (fcmResult.ok) {
+        // Set the secret via setSupabaseSecrets (reuses existing logic with JSON compaction)
+        const secretSteps = await setSupabaseSecrets(projectDir, {
+          firebaseProjectId,
+          firebaseServiceAccountJson: fcmResult.json,
+        });
+        for (const s of secretSteps) printStep(s.ok, false, s.name, s.error);
+      } else {
+        printStep(false, false, 'FIREBASE_SERVICE_ACCOUNT_JSON', fcmResult.error);
+        console.log(kleur.yellow(`    Configure manualmente: supabase secrets set FIREBASE_SERVICE_ACCOUNT_JSON='...'`));
+      }
+    } else {
+      printStep(false, false, 'FIREBASE_SERVICE_ACCOUNT_JSON', 'google-services.json não encontrado — configure manualmente');
+    }
+  }
+
+  // ── 3. Deploy edge functions ────────────────────────────────────────────
+  const fnSpinner = ora(kleur.cyan('Publicando edge functions…')).start();
+  const fnResult = await deployFunctions(projectDir);
+  fnSpinner.stop();
+
+  if (Array.isArray(fnResult)) {
+    fnResult.forEach((s) => printStep(s.ok, s.skipped, s.name, s.error));
+  } else if (fnResult.skipped) {
+    printStep(true, true, 'edge functions (nenhuma encontrada)');
+  } else {
+    printStep(fnResult.ok, false, 'supabase functions deploy', fnResult.error);
+  }
+
+  // ── 4. APNs reminder ────────────────────────────────────────────────────
+  const firebaseProjectId = await readFirebaseProjectId(projectDir);
+  console.log('');
+  console.log(kleur.bold().yellow(`  ⚠  Push iOS: configure a APNs Key no Firebase Console`));
+  console.log(kleur.gray(`     1. Apple Developer Portal → Keys → criar APNs Key (.p8)`));
+  console.log(kleur.gray(`     2. Firebase Console → Cloud Messaging → app iOS → upload da APNs Key`));
+  if (firebaseProjectId) {
+    console.log(kleur.cyan(`     https://console.firebase.google.com/project/${firebaseProjectId}/settings/cloudmessaging`));
+  }
+  console.log('');
+}
+
+// ── Entry point ───────────────────────────────────────────────────────────────
+
+/**
+ * @param {string} directory - project directory (default: cwd)
+ * @param {object} options
+ * @param {string} [options.project] - Firebase Project ID (overrides auto-detect, Firebase only)
+ * @param {object} ctx
+ * @param {string} [ctx.language]
+ */
+async function runDeployCommand(directory, options = {}, { language: langHint } = {}) {
+  const language = langHint || getStoredLanguage() || 'en';
+  const tr = createTranslator(language);
+
+  const projectDir = path.resolve(directory || '.');
+
+  const isFirebase  = await fs.pathExists(path.join(projectDir, 'firebase.json'));
+  const isSupabase  = await fs.pathExists(path.join(projectDir, 'supabase'));
+
+  if (isFirebase) {
+    await deployFirebase(projectDir, options, tr);
+    return;
+  }
+
+  if (isSupabase) {
+    console.log(kleur.bold(`\n  Deploy — Supabase\n`));
+    await deploySupabase(projectDir);
+    return;
+  }
+
+  console.error(kleur.red(`\n  ✗ ${tr('deploy.error.notProject')}\n`));
+  process.exit(1);
+}
+
+module.exports = { runDeployCommand };