kasy-cli 1.21.9 → 1.22.0

package/lib/scaffold/backends/api/patch/lib/features/onboarding/models/user_info.dart

@@ -1,11 +1,11 @@
 import 'package:kasy_kit/features/onboarding/api/entities/user_info_entity.dart';
 
 enum UserInfoKeys {
-  genre,
+  gender,
   age,
 }
 
-enum Genre {
+enum Gender {
   male,
   female,
   none,
@@ -44,11 +44,11 @@ class UserAgeInfo extends UserInfoDetail<AgeRange> {
   }
 
   factory UserAgeInfo.fromString(String value) {
-    final sexe = AgeRange.values.firstWhere(
+    final range = AgeRange.values.firstWhere(
       (element) => element.name == value,
       orElse: () => AgeRange.none,
     );
-    return UserAgeInfo(sexe);
+    return UserAgeInfo(range);
   }
 
   
@@ -62,32 +62,32 @@ class UserAgeInfo extends UserInfoDetail<AgeRange> {
 }
 
 /// ======================================
-/// user genre info
+/// user gender info
 /// ======================================
-class UserSexeInfo extends UserInfoDetail<Genre> {
-  UserSexeInfo(super.value);
+class UserGenderInfo extends UserInfoDetail<Gender> {
+  UserGenderInfo(super.value);
 
-  factory UserSexeInfo.fromEntity(UserInfoEntity entity) {
-    final value = Genre.values.firstWhere(
+  factory UserGenderInfo.fromEntity(UserInfoEntity entity) {
+    final value = Gender.values.firstWhere(
       (element) => element.name == entity.value,
-      orElse: () => Genre.none,
+      orElse: () => Gender.none,
     );
-    return UserSexeInfo(value);
+    return UserGenderInfo(value);
   }
 
-  factory UserSexeInfo.fromString(String value) {
-    final genre = Genre.values.firstWhere(
+  factory UserGenderInfo.fromString(String value) {
+    final gender = Gender.values.firstWhere(
       (element) => element.name == value,
-      orElse: () => Genre.none,
+      orElse: () => Gender.none,
     );
-    return UserSexeInfo(genre);
+    return UserGenderInfo(gender);
   }
 
   
   
   @override
   UserInfoEntity toEntity(String userId) => UserInfoEntity(
-        key: UserInfoKeys.genre.name,
+        key: UserInfoKeys.gender.name,
         value: value.name,
         userId: userId,
       );

package/lib/scaffold/backends/api/patch/lib/features/onboarding/ui/components/onboarding_att_setup.dart

@@ -6,7 +6,8 @@ import 'package:kasy_kit/core/data/api/tracking_api.dart';
 import 'package:kasy_kit/core/states/user_state_notifier.dart';
 import 'package:kasy_kit/features/onboarding/ui/widgets/onboarding_background.dart';
 import 'package:kasy_kit/features/onboarding/ui/widgets/onboarding_illustration_scaffold.dart';
-import 'package:kasy_kit/features/subscription/repositories/subscription_repository.dart';
+import 'package:kasy_kit/features/onboarding/ui/widgets/onboarding_module_mockups.dart';
+import 'package:kasy_kit/features/subscriptions/repositories/subscription_repository.dart';
 import 'package:kasy_kit/i18n/translations.g.dart';
 import 'package:permission_handler/permission_handler.dart';
 
@@ -29,10 +30,10 @@ class AttPermissionStep extends ConsumerWidget {
 
     return OnboardingBackground(
       child: OnboardingIllustrationScaffold(
-        progress: 0.9,
+        step: 6,
         title: translations.title,
         description: translations.description,
-        imageAsset: 'assets/images/onboarding/img3.jpg',
+        image: const TrackingPermissionMockup(),
         footerActions: [
           KasyButton(
             label: translations.continue_button,

package/lib/scaffold/backends/api/patch/lib/features/onboarding/ui/widgets/onboarding_radio_question.dart

@@ -7,6 +7,7 @@ import 'package:kasy_kit/core/theme/theme.dart';
 import 'package:kasy_kit/core/widgets/responsive_layout.dart';
 import 'package:kasy_kit/features/onboarding/ui/widgets/onboarding_background.dart';
 import 'package:kasy_kit/features/onboarding/ui/widgets/onboarding_progress.dart';
+import 'package:kasy_kit/features/onboarding/ui/widgets/onboarding_step_header.dart';
 import 'package:kasy_kit/features/onboarding/ui/widgets/onboarding_sticky_footer.dart';
 import 'package:kasy_kit/features/onboarding/ui/widgets/selectable_row_tile.dart';
 
@@ -18,9 +19,11 @@ typedef OnOptionIdSelected = void Function(String id);
 
 typedef OnValidate = void Function(String? key);
 
-/// Single choice question with radio buttons
+/// Single choice question with selectable tiles, matching the clean‑premium
+/// onboarding layout (shared header, left‑aligned title, sticky footer).
 class OnboardingRadioQuestion extends ConsumerStatefulWidget {
-  final double? progress;
+  final int step;
+  final int totalSteps;
   final String title;
   final String description;
   final String btnText;
@@ -37,7 +40,8 @@ class OnboardingRadioQuestion extends ConsumerStatefulWidget {
     required this.btnText,
     required this.optionIds,
     required this.optionBuilder,
-    this.progress,
+    required this.step,
+    this.totalSteps = kOnboardingSteps,
     this.onOptionIdSelected,
     this.onValidate,
     this.reassuranceBuilder,
@@ -54,61 +58,68 @@ class _OnboardingRadioQuestionState
 
   @override
   Widget build(BuildContext context) {
+    const gutter = KasySpacing.lg;
+
     final scrollBody = Column(
-      crossAxisAlignment: CrossAxisAlignment.stretch,
+      crossAxisAlignment: CrossAxisAlignment.start,
       children: [
-        if (widget.progress != null)
-          OnboardingProgress(value: widget.progress!),
+        OnboardingStepHeader(step: widget.step, totalSteps: widget.totalSteps),
         Padding(
-          padding: const EdgeInsets.fromLTRB(
-            KasySpacing.md,
-            KasySpacing.xl,
-            KasySpacing.md,
-            0,
-          ),
+          padding: const EdgeInsets.fromLTRB(gutter, KasySpacing.lg, gutter, 0),
           child: MoveFadeAnim(
-            delayInMs: 100,
+            delayInMs: 120,
             child: Text(
               widget.title,
-              textAlign: TextAlign.center,
-              style: context.textTheme.headlineLarge?.copyWith(
+              textAlign: TextAlign.start,
+              style: context.textTheme.headlineMedium?.copyWith(
                 color: context.colors.onBackground,
+                fontSize: 26,
+                fontWeight: FontWeight.w700,
+                letterSpacing: -0.2,
+                height: 1.2,
               ),
             ),
           ),
         ),
         Padding(
           padding: const EdgeInsets.fromLTRB(
+            gutter,
+            KasySpacing.smd,
+            gutter,
             KasySpacing.lg,
-            KasySpacing.md,
-            KasySpacing.lg,
-            KasySpacing.xl,
           ),
           child: MoveFadeAnim(
             delayInMs: 200,
             child: Text(
               widget.description,
-              textAlign: TextAlign.center,
+              textAlign: TextAlign.start,
               style: context.textTheme.bodyLarge?.copyWith(
-                color: context.colors.onBackground.withValues(alpha: 0.6),
+                color: context.colors.muted,
+                height: 1.45,
               ),
             ),
           ),
         ),
         Padding(
-          padding: const EdgeInsets.symmetric(horizontal: KasySpacing.md),
+          padding: const EdgeInsets.symmetric(horizontal: gutter),
           child: OnboardingSelectableRowGroup(
             physics: const NeverScrollableScrollPhysics(),
-            options: widget.optionIds
-                .map(
+            options: widget.optionIds.map(
               (e) {
                 final index = widget.optionIds.indexOf(e);
                 return Animate(
                   effects: [
                     FadeEffect(
-                      delay: Duration(milliseconds: 300 + index * 100),
-                      duration: const Duration(milliseconds: 550),
-                      curve: Curves.easeInOut,
+                      delay: Duration(milliseconds: 280 + index * 80),
+                      duration: const Duration(milliseconds: 450),
+                      curve: Curves.easeOut,
+                    ),
+                    MoveEffect(
+                      delay: Duration(milliseconds: 280 + index * 80),
+                      duration: const Duration(milliseconds: 450),
+                      curve: Curves.easeOut,
+                      begin: const Offset(0, 24),
+                      end: Offset.zero,
                     ),
                   ],
                   child: widget.optionBuilder(e, e == selectedChoiceId),
@@ -153,8 +164,7 @@ class _OnboardingRadioQuestionState
           ),
           DeviceSizeBuilder(
             builder: (device) => OnboardingStickyFooter(
-              maxContentWidth:
-                  device == DeviceType.small ? null : 600,
+              maxContentWidth: device == DeviceType.small ? null : 600,
               children: [
                 KasyButton(
                   label: widget.btnText,

package/lib/scaffold/backends/api/patch/lib/features/settings/ui/components/admin/admin_users_api.dart

@@ -0,0 +1,100 @@
+import 'package:dio/dio.dart';
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:kasy_kit/core/data/api/base_api_exceptions.dart';
+import 'package:kasy_kit/core/data/api/http_client.dart';
+
+/// One row of the admin Users table, as returned by `GET /admin/users`. Your
+/// backend MUST verify the caller's `role == "admin"` (and return 403 otherwise)
+/// before serving this — it is never readable by a non-admin client.
+///
+/// This file mirrors the shared admin data-layer contract (see the Firebase
+/// version): the public surface — [AdminUser], [AdminUsersResult] and
+/// [adminUsersApiProvider] — is identical across backends so the Users tab UI
+/// stays the same; only the body of [AdminUsersApi.fetch] differs.
+class AdminUser {
+  final String id;
+  final String? email;
+  final String? name;
+  final DateTime? createdAt;
+  final bool subscriber;
+
+  const AdminUser({
+    required this.id,
+    required this.subscriber,
+    this.email,
+    this.name,
+    this.createdAt,
+  });
+
+  factory AdminUser.fromMap(Map<String, dynamic> m) {
+    final createdMillis = m['createdAt'];
+    return AdminUser(
+      id: (m['id'] as String?) ?? '',
+      email: m['email'] as String?,
+      name: m['name'] as String?,
+      createdAt: createdMillis is num
+          ? DateTime.fromMillisecondsSinceEpoch(createdMillis.toInt())
+          : null,
+      subscriber: m['subscriber'] == true,
+    );
+  }
+}
+
+/// The full (bounded) set of users plus collection metadata. The UI searches,
+/// sorts and paginates this list locally, so those interactions are instant.
+class AdminUsersResult {
+  final List<AdminUser> users;
+  final int totalUsers;
+  final bool truncated;
+
+  const AdminUsersResult({
+    required this.users,
+    required this.totalUsers,
+    required this.truncated,
+  });
+}
+
+final adminUsersApiProvider = Provider<AdminUsersApi>(
+  (ref) => AdminUsersApi(client: ref.read(httpClientProvider)),
+);
+
+/// REST endpoint expected:
+///   GET /admin/users
+///     Auth: Authorization Bearer token (attached automatically). The server
+///       MUST verify the caller's role == "admin" and return 403 otherwise.
+///     Response 200: {
+///       "users": [
+///         {"id": "...", "email": "a@b.com"|null, "name": "Ana"|null,
+///          "createdAt": 1700000000000 (epoch millis)|null, "subscriber": true}
+///       ],
+///       "totalUsers": 142,        // true size of the collection
+///       "truncated": false        // true when more users exist than returned
+///     }
+///   Return the most-recent users (bounded, e.g. 1000); the app does the
+///   search / sort / pagination locally so those interactions are instant.
+class AdminUsersApi {
+  final HttpClient _client;
+
+  AdminUsersApi({required HttpClient client}) : _client = client;
+
+  /// Loads the users for the admin console. Returns the whole bounded set in one
+  /// call; the UI handles search/sort/pagination on the client.
+  Future<AdminUsersResult> fetch() async {
+    try {
+      final response = await _client.get('/admin/users');
+      final data = Map<String, dynamic>.from(response.data as Map);
+      final rawUsers = (data['users'] as List?) ?? const [];
+      return AdminUsersResult(
+        users: rawUsers
+            .map((e) => AdminUser.fromMap(Map<String, dynamic>.from(e as Map)))
+            .toList(),
+        totalUsers: (data['totalUsers'] as num?)?.toInt() ?? 0,
+        truncated: data['truncated'] == true,
+      );
+    } on DioException catch (e) {
+      throw ApiError.fromDioException(e);
+    } catch (e, s) {
+      throw ApiError(code: 0, message: '$e: $s');
+    }
+  }
+}

package/lib/scaffold/backends/api/patch/lib/features/{subscription → subscriptions}/api/entities/subscription_entity.dart

@@ -15,6 +15,17 @@ enum SubscriptionStatus {
   CANCELLED,
 }
 
+/// Where the subscription was purchased (its origin). `STRIPE` means it was
+/// bought on the web via Stripe. Used to route the user to the correct
+/// management flow regardless of the device they are currently on.
+enum SubscriptionStore {
+  PLAY_STORE,
+  APPLE_STORE,
+  EARLY_BIRD,
+  STRIPE,
+  unknown,
+}
+
 
 @freezed
 sealed class SubscriptionEntity with _$SubscriptionEntity {
@@ -26,6 +37,8 @@ sealed class SubscriptionEntity with _$SubscriptionEntity {
     @JsonKey(name: 'last_update_date') DateTime? lastUpdateDate,
     @JsonKey(name: 'period_end_date') DateTime? periodEndDate,
     @JsonKey(name: 'status') required SubscriptionStatus status,
+    @JsonKey(name: 'store', unknownEnumValue: SubscriptionStore.unknown)
+    SubscriptionStore? store,
   }) = SubscriptionEntityData;
 
   factory SubscriptionEntity.fromJson(Map<String, Object?> json) =>

package/lib/scaffold/backends/api/patch/lib/features/subscriptions/api/stripe_backend_api.dart

@@ -0,0 +1,60 @@
+import 'package:dio/dio.dart';
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:kasy_kit/core/data/api/http_client.dart';
+import 'package:kasy_kit/features/subscriptions/api/stripe_product.dart';
+
+final stripeBackendApiProvider = Provider<StripeBackendApi>(
+  (ref) => StripeBackendApi(client: ref.read(httpClientProvider)),
+);
+
+/// Talks to the Stripe backend (your own server). The user identity must be
+/// taken server-side from the authenticated request (the Bearer token attached
+/// by [HttpClient]) — never trusted from the request body. This file replaces
+/// the Firebase version so the rest of the Stripe client code stays
+/// backend-agnostic.
+///
+/// Your backend must expose these endpoints (see Stripe-Guia.md):
+///   GET  /stripe/list-prices      -> active recurring prices (offer list)
+///   POST /stripe/checkout-session -> { url } hosted Checkout session
+///   POST /stripe/portal-session   -> { url } Customer Portal session
+/// and a Stripe webhook that writes the `subscriptions` record (store=STRIPE).
+class StripeBackendApi {
+  final HttpClient _client;
+
+  StripeBackendApi({required HttpClient client}) : _client = client;
+
+  /// Active recurring prices, mapped to paywall offers.
+  Future<List<StripeProduct>> listPrices() async {
+    final Response res = await _client.get('/stripe/list-prices');
+    final list = (res.data as List).cast<dynamic>();
+    return list
+        .map((e) => StripeProduct.fromJson(Map<String, dynamic>.from(e as Map)))
+        .toList();
+  }
+
+  /// Create a hosted Checkout session for [priceId] and return its URL.
+  Future<String> createCheckoutSession({
+    required String priceId,
+    String? successUrl,
+    String? cancelUrl,
+  }) async {
+    final Response res = await _client.post(
+      '/stripe/checkout-session',
+      data: {
+        'priceId': priceId,
+        if (successUrl != null) 'successUrl': successUrl,
+        if (cancelUrl != null) 'cancelUrl': cancelUrl,
+      },
+    );
+    return (res.data as Map)['url'] as String;
+  }
+
+  /// Create a Customer Portal session (manage / cancel) and return its URL.
+  Future<String> createPortalSession({String? returnUrl}) async {
+    final Response res = await _client.post(
+      '/stripe/portal-session',
+      data: {if (returnUrl != null) 'returnUrl': returnUrl},
+    );
+    return (res.data as Map)['url'] as String;
+  }
+}

package/lib/scaffold/backends/api/patch/lib/features/{subscription → subscriptions}/api/subscription_api.dart

@@ -1,6 +1,6 @@
 import 'package:kasy_kit/core/data/api/base_api_exceptions.dart';
 import 'package:kasy_kit/core/data/api/http_client.dart';
-import 'package:kasy_kit/features/subscription/api/entities/subscription_entity.dart';
+import 'package:kasy_kit/features/subscriptions/api/entities/subscription_entity.dart';
 import 'package:dio/dio.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:logger/logger.dart';

package/lib/scaffold/backends/api/pubspec.yaml.tpl

@@ -93,7 +93,6 @@ flutter:
   assets:
     - .env
     - assets/images/
-    - assets/images/onboarding/
     - assets/icons/
 flutter_launcher_icons:
   image_path: assets/images/icon.png
@@ -108,15 +107,15 @@ flutter_launcher_icons:
     background_color: "#01171f"
     theme_color: "#01171f"
 flutter_native_splash:
-  color: "#FFFFFF"
-  color_dark: "#000000"
+  color: "#FAF9FC"
+  color_dark: "#0C0A14"
   fullscreen: true
   ios: true
   android: true
   image: assets/images/splash_logo_light.png
   image_dark: assets/images/splash_logo_dark.png
   android_12:
-    color: "#FFFFFF"
-    color_dark: "#000000"
+    color: "#FAF9FC"
+    color_dark: "#0C0A14"
     image: assets/images/splash_logo_light_android12.png
     image_dark: assets/images/splash_logo_dark_android12.png

package/lib/scaffold/backends/firebase/deploy.js

@@ -256,11 +256,17 @@ async function writeFirebaseRc(projectDir, firebaseProjectId) {
  * These must exist in Secret Manager before `firebase deploy` runs,
  * otherwise firebase-tools prompts interactively and hangs in non-TTY environments.
  */
-const REQUIRED_SECRETS = ['META_ACCESS_TOKEN', 'META_DATASET_ID', 'REVENUECAT_WEBHOOK_KEY', 'LLM_API_KEY'];
+const REQUIRED_SECRETS = ['META_ACCESS_TOKEN', 'META_DATASET_ID', 'REVENUECAT_WEBHOOK_KEY', 'AI_API_KEY', 'STRIPE_SECRET_KEY', 'STRIPE_WEBHOOK_SECRET'];
 
 /**
- * Create each required secret if it doesn't exist yet.
- * Uses the real value when provided, otherwise falls back to 'placeholder'.
+ * Ensure every required secret exists AND holds a value, so `firebase deploy` never
+ * blocks waiting for one. A secret has two layers: the "container" and its versions.
+ * A container can exist with zero enabled versions (e.g. created by hand but never
+ * filled) — in that state `firebase deploy` still aborts with
+ * "Secret Manager has no latest version of ...". Checking only the container (describe)
+ * misses this, so we also verify there is an enabled version and add a placeholder when
+ * there isn't. The user replaces placeholders with real values later via `kasy configure`.
+ *
  * Uses gcloud to avoid firebase-tools interactive prompts.
  * Non-fatal: if a secret can't be created (e.g. API not enabled yet) we continue anyway.
  *
@@ -268,22 +274,87 @@ const REQUIRED_SECRETS = ['META_ACCESS_TOKEN', 'META_DATASET_ID', 'REVENUECAT_WE
  * @param {Record<string,string>} [secretValues] - map of secret name → real value (optional)
  */
 async function ensureSecretsExist(firebaseProjectId, secretValues = {}) {
+  const escape = (v) => v.replace(/'/g, "'\\''");
   for (const secret of REQUIRED_SECRETS) {
-    const check = await run(`gcloud secrets describe ${secret} --project=${firebaseProjectId}`);
-    if (!check.ok) {
-      const value = secretValues[secret]?.trim() || 'placeholder';
+    const realValue = secretValues[secret]?.trim();
+    const exists = (await run(`gcloud secrets describe ${secret} --project=${firebaseProjectId}`)).ok;
+
+    if (!exists) {
+      // No container yet — create it with the real value, or a placeholder so deploy never blocks.
+      const value = realValue || 'placeholder';
+      await run(
+        `printf '${escape(value)}' | gcloud secrets create ${secret} --data-file=- --replication-policy=automatic --project=${firebaseProjectId}`
+      );
+      continue;
+    }
+
+    // Container exists. Does it hold an enabled version (an actual value)?
+    const versions = await run(`gcloud secrets versions list ${secret} --format='value(state)' --project=${firebaseProjectId}`);
+    const hasEnabledVersion = versions.ok && /enabled/i.test(versions.stdout);
+
+    if (realValue) {
+      // User provided a real value — always add it as the latest version.
       await run(
-        `printf '${value.replace(/'/g, "'\\''")}' | gcloud secrets create ${secret} --data-file=- --replication-policy=automatic --project=${firebaseProjectId}`
+        `printf '${escape(realValue)}' | gcloud secrets versions add ${secret} --data-file=- --project=${firebaseProjectId}`
       );
-    } else if (secretValues[secret]?.trim()) {
-      // Secret exists but user provided a real value — update it.
+    } else if (!hasEnabledVersion) {
+      // Container exists but is empty — add a placeholder so deploy never blocks.
       await run(
-        `printf '${secretValues[secret].trim().replace(/'/g, "'\\''")}' | gcloud secrets versions add ${secret} --data-file=- --project=${firebaseProjectId}`
+        `printf 'placeholder' | gcloud secrets versions add ${secret} --data-file=- --project=${firebaseProjectId}`
       );
     }
   }
 }
 
+/**
+ * Cloud Functions declare non-secret config via defineString()/defineInt()/etc. In
+ * non-interactive mode `firebase deploy` aborts if such a param has no value AND no
+ * usable default (an empty-string default isn't reliably honored across firebase-tools
+ * versions). To make deploy never block on missing config, we ensure functions/.env has
+ * an (empty) entry for every declared param. The user fills real values later via
+ * `kasy configure`; an empty value keeps the documented "unset" behavior.
+ *
+ * Non-fatal: any failure here is swallowed so it never breaks a deploy.
+ */
+async function ensureEnvParamsExist(projectDir) {
+  try {
+    const srcDir = path.join(projectDir, 'functions', 'src');
+    if (!(await fs.pathExists(srcDir))) return;
+
+    // Collect every defineString/Int/Boolean/List param name from the functions source.
+    const params = new Set();
+    const walk = async (dir) => {
+      for (const entry of await fs.readdir(dir, { withFileTypes: true })) {
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) { await walk(full); continue; }
+        if (!/\.(ts|js)$/.test(entry.name)) continue;
+        const code = await fs.readFile(full, 'utf8');
+        const re = /define(?:String|Int|Boolean|List)\(\s*["']([A-Z0-9_]+)["']/g;
+        let m;
+        while ((m = re.exec(code)) !== null) params.add(m[1]);
+      }
+    };
+    await walk(srcDir);
+    if (params.size === 0) return;
+
+    const envPath = path.join(projectDir, 'functions', '.env');
+    let content = (await fs.pathExists(envPath)) ? await fs.readFile(envPath, 'utf8') : '';
+    const existing = new Set(
+      content.split('\n').map((l) => l.trim()).filter((l) => l && !l.startsWith('#'))
+        .map((l) => (l.includes('=') ? l.slice(0, l.indexOf('=')).trim() : ''))
+        .filter(Boolean)
+    );
+
+    const missing = [...params].filter((p) => !existing.has(p));
+    if (missing.length === 0) return;
+    if (content && !content.endsWith('\n')) content += '\n';
+    content += missing.map((p) => `${p}=`).join('\n') + '\n';
+    await fs.outputFile(envPath, content, 'utf8');
+  } catch (_) {
+    // Never let env-bootstrap break a deploy.
+  }
+}
+
 /**
  * Get the numeric project number for a GCP project ID.
  */
@@ -867,6 +938,9 @@ async function runDeploy(projectDir, serviceAccountPath, firebaseProjectId, { on
   // Running this before waitForApis caused silent failures when the API was still
   // propagating — the deploy would then fail because the secrets didn't exist yet.
   await ensureSecretsExist(firebaseProjectId, secretValues);
+  // Bootstrap empty entries for any defineString/etc. config param so deploy never
+  // blocks asking for one (e.g. STRIPE_PRODUCT_ID). Real values come later via configure.
+  await ensureEnvParamsExist(projectDir);
 
   // Quick IAM readiness check: if the two critical grants (Eventarc + Storage) are
   // already confirmed in IAM, skip the entire grant block below.  On re-deploy this
@@ -938,10 +1012,10 @@ async function runIamSetup(firebaseProjectId, projectNumber, functionsRegion = '
       waitForServiceAccount(gcfSa, firebaseProjectId),
       waitForServiceAccount(cloudBuildAgentSa, firebaseProjectId),
       waitForServiceAccount(cloudRunSa, firebaseProjectId),
-      // eventarcSa recebe role abaixo — precisa existir antes do grant.
-      // Em projetos novos pode demorar até 30s após identity create.
+      // eventarcSa gets its role below — it must exist before the grant.
+      // On new projects it can take up to 30s after identity create.
       waitForServiceAccount(eventarcSa, firebaseProjectId),
-      // pubsubSa é necessário para triggers Firestore v2 (Eventarc usa Pub/Sub para entregar eventos).
+      // pubsubSa is required for Firestore v2 triggers (Eventarc uses Pub/Sub to deliver events).
       waitForServiceAccount(pubsubSa, firebaseProjectId),
     ]);
 

package/lib/scaffold/backends/firebase/generator.js

@@ -1,12 +1,12 @@
 /**
  * Firebase project generator.
  *
- * Wrapper fino sobre generateProject().
- * A lógica de geração comum (cópia, pub get, slang, build_runner, flutterfire)
- * vive em cli/lib/scaffold/generate.js.
+ * Thin wrapper over generateProject().
+ * The common generation logic (copy, pub get, slang, build_runner, flutterfire)
+ * lives in cli/lib/scaffold/generate.js.
  *
- * Hook específico:
- *   postBuild → runDeploy (opcional, controlado por options.deploy)
+ * Specific hook:
+ *   postBuild → runDeploy (optional, controlled by options.deploy)
  */
 
 const { generateProject } = require('../../generate');

package/lib/scaffold/backends/firebase/tokens.js

@@ -21,7 +21,7 @@ const ORIGINAL_SHORT_NAME = 'appfirebase';
 
 /**
  * Normalize app name to a valid Dart package name.
- * "Meu App Incrível" → "meu_app_incrivel"
+ * "My Café App" → "my_cafe_app"
  */
 function toPackageName(appName) {
   return (appName || '')
@@ -52,8 +52,8 @@ function bundleIdToPath(bundleId) {
 
 const ORIGINAL_BUNDLE_ID_PATH = bundleIdToPath(ORIGINAL_BUNDLE_ID);
 
-// Facebook — só caracteres permitidos no URL scheme da Apple (RFC1738).
-// Sem credenciais no `kasy new`, mantém estes placeholders (login FB não funciona até trocar).
+// Facebook — only the characters allowed in Apple's URL scheme (RFC1738).
+// Without credentials in `kasy new`, keep these placeholders (FB login won't work until replaced).
 const FB_APP_ID_PLACEHOLDER = '000000000000000';
 const FB_CLIENT_TOKEN_PLACEHOLDER = '00000000000000000000000000000000';
 
@@ -91,7 +91,7 @@ function buildTokens({ appName, bundleId, fbAppId, fbToken, defaultPaywall = 'ba
     [`"${ORIGINAL_SHORT_NAME}"`]: `"${shortName}"`,
     // pubspec.yaml name field
     [`name: ${ORIGINAL_PACKAGE}`]: `name: ${packageName}`,
-    // Facebook (placeholders → user values ou mantém placeholder válido p/ App Store)
+    // Facebook (placeholders → user values, or keep a valid placeholder for the App Store)
     [FB_APP_ID_PLACEHOLDER]: fbAppId?.trim() || FB_APP_ID_PLACEHOLDER,
     [`fb${FB_APP_ID_PLACEHOLDER}`]: fbAppId?.trim() ? `fb${fbAppId.trim()}` : `fb${FB_APP_ID_PLACEHOLDER}`,
     [FB_CLIENT_TOKEN_PLACEHOLDER]: fbToken?.trim() || FB_CLIENT_TOKEN_PLACEHOLDER,