kasy-cli 1.32.0 → 1.34.0

package/lib/utils/facebook.js

@@ -0,0 +1,162 @@
+/**
+ * Facebook Login helpers, shared by `kasy facebook` and `kasy configure`.
+ *
+ * Facebook needs values in two places:
+ *   - Client side (the app): App ID + Client Token in iOS Info.plist and Android
+ *     strings.xml (build-time). Same for every backend.
+ *   - Backend provider (server side): App ID + App Secret on Firebase (Identity
+ *     Toolkit) or Supabase (Management API). Configured by the backend writers.
+ *
+ * The Meta-side work (create the app, get App ID / Client Token / App Secret, set
+ * OAuth redirect URIs and JS domains) has no automation API — it stays manual and
+ * is guided by `kasy facebook`. This module owns the native-file read/write and the
+ * ~/.kasy/facebook.json credential cache so future projects reuse the values.
+ */
+
+const os = require('node:os');
+const path = require('node:path');
+const fs = require('fs-extra');
+
+const CONFIG_DIR = path.join(os.homedir(), '.kasy');
+const FACEBOOK_CONFIG_PATH = path.join(CONFIG_DIR, 'facebook.json');
+
+// ── Native build-time files (Info.plist + strings.xml) ──────────────────────
+
+function readFacebookCurrent(content, kind) {
+  if (kind === 'plist') {
+    const appId = content.match(/<key>FacebookAppID<\/key>\s*<string>([^<]*)<\/string>/);
+    const token = content.match(/<key>FacebookClientToken<\/key>\s*<string>([^<]*)<\/string>/);
+    return { appId: (appId?.[1] || '').trim(), token: (token?.[1] || '').trim() };
+  }
+  // strings.xml
+  const appId = content.match(/<string name="facebook_app_id"[^>]*>([^<]*)<\/string>/);
+  const token = content.match(/<string name="facebook_client_token"[^>]*>([^<]*)<\/string>/);
+  return { appId: (appId?.[1] || '').trim(), token: (token?.[1] || '').trim() };
+}
+
+function isFacebookPlaceholder(value) {
+  return !value || /^0+$/.test(value);
+}
+
+async function readFacebookState(projectDir) {
+  const plistPath = path.join(projectDir, 'ios', 'Runner', 'Info.plist');
+  const stringsPath = path.join(projectDir, 'android', 'app', 'src', 'main', 'res', 'values', 'strings.xml');
+  const state = { appId: '', token: '', plistExists: false, stringsExists: false };
+  if (await fs.pathExists(plistPath)) {
+    state.plistExists = true;
+    const plistRead = readFacebookCurrent(await fs.readFile(plistPath, 'utf8'), 'plist');
+    if (!isFacebookPlaceholder(plistRead.appId)) state.appId = plistRead.appId;
+    if (!isFacebookPlaceholder(plistRead.token)) state.token = plistRead.token;
+  }
+  if (await fs.pathExists(stringsPath)) {
+    state.stringsExists = true;
+    const stringsRead = readFacebookCurrent(await fs.readFile(stringsPath, 'utf8'), 'strings');
+    // Prefer plist value when both exist; only fall back if plist was placeholder.
+    if (!state.appId && !isFacebookPlaceholder(stringsRead.appId)) state.appId = stringsRead.appId;
+    if (!state.token && !isFacebookPlaceholder(stringsRead.token)) state.token = stringsRead.token;
+  }
+  return state;
+}
+
+async function writeFacebookCredentials(projectDir, appId, clientToken) {
+  const plistPath = path.join(projectDir, 'ios', 'Runner', 'Info.plist');
+  const stringsPath = path.join(projectDir, 'android', 'app', 'src', 'main', 'res', 'values', 'strings.xml');
+  const results = { plist: 'skipped', strings: 'skipped' };
+
+  if (appId && (await fs.pathExists(plistPath))) {
+    let plist = await fs.readFile(plistPath, 'utf8');
+    plist = plist.replace(
+      /(<key>FacebookAppID<\/key>\s*<string>)[^<]*(<\/string>)/,
+      `$1${appId}$2`,
+    );
+    if (clientToken) {
+      plist = plist.replace(
+        /(<key>FacebookClientToken<\/key>\s*<string>)[^<]*(<\/string>)/,
+        `$1${clientToken}$2`,
+      );
+    }
+    // CFBundleURLSchemes — replace `fb<zeros>` with `fb<appId>` so deep links work.
+    plist = plist.replace(/<string>fb0+<\/string>/, `<string>fb${appId}</string>`);
+    await fs.outputFile(plistPath, plist, 'utf8');
+    results.plist = 'ok';
+  } else if (appId) {
+    results.plist = 'missing_file';
+  }
+
+  if (appId && (await fs.pathExists(stringsPath))) {
+    let xml = await fs.readFile(stringsPath, 'utf8');
+    xml = xml.replace(
+      /(<string name="facebook_app_id"[^>]*>)[^<]*(<\/string>)/,
+      `$1${appId}$2`,
+    );
+    if (clientToken) {
+      xml = xml.replace(
+        /(<string name="facebook_client_token"[^>]*>)[^<]*(<\/string>)/,
+        `$1${clientToken}$2`,
+      );
+    }
+    // fb_login_protocol_scheme — set if present.
+    xml = xml.replace(
+      /(<string name="fb_login_protocol_scheme"[^>]*>)[^<]*(<\/string>)/,
+      `$1fb${appId}$2`,
+    );
+    await fs.outputFile(stringsPath, xml, 'utf8');
+    results.strings = 'ok';
+  } else if (appId) {
+    results.strings = 'missing_file';
+  }
+
+  return results;
+}
+
+// ── Credential cache (~/.kasy/facebook.json) ────────────────────────────────
+
+/** Load cached Facebook credentials. Returns null if absent or without an App ID. */
+async function loadFacebookCreds() {
+  try {
+    if (!(await fs.pathExists(FACEBOOK_CONFIG_PATH))) return null;
+    const data = await fs.readJson(FACEBOOK_CONFIG_PATH);
+    if (!data || !data.appId) return null;
+    return data;
+  } catch {
+    return null;
+  }
+}
+
+/** Persist Facebook credentials (App ID + Client Token + App Secret) with 0600. */
+async function saveFacebookCreds({ appId, clientToken, appSecret }) {
+  await fs.ensureDir(CONFIG_DIR);
+  await fs.writeJson(
+    FACEBOOK_CONFIG_PATH,
+    { appId, clientToken: clientToken || '', appSecret: appSecret || '' },
+    { spaces: 2 },
+  );
+  try {
+    await fs.chmod(FACEBOOK_CONFIG_PATH, 0o600);
+  } catch {
+    /* ignore */
+  }
+}
+
+/** Set `withFacebookWebSignin` to the given boolean in the project's features.dart. */
+async function setFacebookWebFlag(projectDir, value) {
+  const file = path.join(projectDir, 'lib', 'core', 'config', 'features.dart');
+  if (!(await fs.pathExists(file))) return { ok: false, missing: true };
+  let content = await fs.readFile(file, 'utf8');
+  const re = /const bool withFacebookWebSignin\s*=\s*(?:true|false)\s*;/;
+  if (!re.test(content)) return { ok: false, missing: true };
+  content = content.replace(re, `const bool withFacebookWebSignin = ${value};`);
+  await fs.writeFile(file, content, 'utf8');
+  return { ok: true };
+}
+
+module.exports = {
+  FACEBOOK_CONFIG_PATH,
+  readFacebookCurrent,
+  isFacebookPlaceholder,
+  readFacebookState,
+  writeFacebookCredentials,
+  loadFacebookCreds,
+  saveFacebookCreds,
+  setFacebookWebFlag,
+};

package/lib/utils/i18n/messages-en.js

@@ -372,6 +372,60 @@ module.exports = {
     'configure.settingSecrets': 'Setting {count} Firebase Secret(s)…',
     'configure.savedSecrets': '{count} Firebase Secret(s) set',
     'configure.secretFailed': 'Could not set secret {key}. Run manually: firebase functions:secrets:set {key}',
+    'cli.command.appleWeb.description': 'Configure Sign in with Apple on the WEB (Firebase or Supabase) using the credentials you created on Apple',
+    'appleWeb.title': 'Apple Sign-In on Web',
+    'appleWeb.notKasyProject': 'This folder does not look like a Kasy project (no kit_setup.json). Enter the project folder and run again.',
+    'appleWeb.missingProjectId': 'Could not find the project ID in kit_setup.json. Generate the project with the CLI before configuring Apple web.',
+    'appleWeb.required': 'Required',
+    'appleWeb.useSaved': 'Use your saved Apple credentials ({id})?',
+    'appleWeb.serviceIdPrompt': 'Apple Service ID (the OAuth client_id):',
+    'appleWeb.teamIdPrompt': 'Apple Team ID:',
+    'appleWeb.keyIdPrompt': 'Key ID of the .p8 key:',
+    'appleWeb.p8Prompt': 'Path to the .p8 file (Sign In with Apple):',
+    'appleWeb.p8ReadError': 'Could not read the .p8 file at that path.',
+    'appleWeb.incomplete': 'Missing data to configure (Service ID, Team ID, Key ID and .p8). Try again.',
+    'appleWeb.configuringFirebase': 'Configuring Apple web on Firebase…',
+    'appleWeb.configuringSupabase': 'Signing the secret and configuring Apple web on Supabase…',
+    'appleWeb.firebaseOk': 'Apple web configured on Firebase (it re-signs the secret itself, never expires).',
+    'appleWeb.supabaseOk': 'Apple web configured on Supabase.',
+    'appleWeb.failed': 'Could not configure Apple web.',
+    'appleWeb.flagUpdated': 'Apple button on web enabled (withAppleWebSignin = true).',
+    'appleWeb.flagMissing': 'Backend configured, but withAppleWebSignin was not found in features.dart to enable the button.',
+    'appleWeb.returnUrlNote': 'Make sure your Service ID Return URL on Apple is exactly:',
+    'appleWeb.manualTitle': 'Manual step on Apple',
+    'appleWeb.expiresNote': 'The Supabase secret expires in ~6 months. Run `kasy apple-web` again to renew (it reuses the saved .p8).',
+    'appleWeb.backendApi': 'API REST backend: auth lives on your server. Set up Sign in with Apple JS on your backend (Service ID + secret). The CLI has nowhere to store it.',
+    'appleWeb.apiDone': 'API backend: nothing to automate here. See the steps above.',
+    'appleWeb.allDone': 'Done! Apple Sign-In on the web is configured.',
+    'appleWeb.notFirebase': 'Apple Sign-In on the web is currently supported only on the Firebase backend (signInWithPopup). On Supabase it is roadmap (native iOS is already set up by `kasy new`); on the API backend auth lives on your server.',
+    'appleWeb.notFirebaseDone': 'Nothing to configure here for Apple web on this backend.',
+    'cli.command.facebook.description': 'Configure Facebook Login (Firebase/Supabase + native files) and guide the manual Meta steps',
+    'facebook.title': 'Facebook Login',
+    'facebook.notKasyProject': 'This folder does not look like a Kasy project (no kit_setup.json). Enter the project folder and run again.',
+    'facebook.metaTitle': 'Manual step on Meta',
+    'facebook.metaIntro': 'Create an app on Meta for Developers (Consumer) and grab: App ID, Client Token (Settings → Advanced) and App Secret (Settings → Basic). Add the Facebook Login product.',
+    'facebook.metaOpenLabel': 'Open the Meta dashboard to create/open your app:',
+    'facebook.metaOpenConfirm': 'Open the Meta dashboard now?',
+    'facebook.useSaved': 'Use your saved Facebook credentials ({id})?',
+    'facebook.required': 'Required',
+    'facebook.appIdPrompt': 'Meta App ID:',
+    'facebook.clientTokenPrompt': 'Meta Client Token:',
+    'facebook.appSecretPrompt': 'Meta App Secret (for the backend provider):',
+    'facebook.incomplete': 'App ID is missing. Try again.',
+    'facebook.nativeOk': 'App ID and Client Token written to Info.plist and strings.xml.',
+    'facebook.nativeMissing': 'Could not find Info.plist/strings.xml to write (run after the native platforms are generated).',
+    'facebook.configuringFirebase': 'Enabling the Facebook provider on Firebase…',
+    'facebook.configuringSupabase': 'Enabling the Facebook provider on Supabase…',
+    'facebook.firebaseOk': 'Facebook provider enabled on Firebase.',
+    'facebook.supabaseOk': 'Facebook provider enabled on Supabase.',
+    'facebook.backendFailed': 'Could not enable the Facebook provider on the backend.',
+    'facebook.backendApi': 'API REST backend: auth lives on your server. Set up Facebook Login on your backend (App ID + App Secret).',
+    'facebook.missingProjectId': 'Could not find the project ID in kit_setup.json. Skipped the backend part (native files were written).',
+    'facebook.noSecret': 'Without an App Secret I skipped the backend part. Run `kasy facebook` with the App Secret to enable the provider.',
+    'facebook.redirectNote': 'On Meta (Facebook Login → Settings), add this Valid OAuth Redirect URI:',
+    'facebook.flagUpdated': 'Facebook button on web enabled (withFacebookWebSignin = true).',
+    'facebook.webRoadmap': 'Facebook Login on web for Supabase is not wired yet (roadmap). Native (iOS/Android) already works.',
+    'facebook.allDone': 'Done! Facebook Login is configured.',
     'cli.command.check.description': 'Check push notifications setup (use --fix to fix it)',
     'deploy.q.project': 'Firebase Project ID:',
     'deploy.q.serviceAccount': 'Path to service account JSON:',
@@ -506,6 +560,8 @@ module.exports = {
     'doctor.ios.googleUrlSchemeSkipped': 'Google Sign-In iOS URL scheme check skipped (GoogleService-Info.plist not found)',
     'doctor.ios.appleSignInEntitlementOk': 'Apple Sign-In entitlement configured',
     'doctor.ios.appleSignInEntitlementMissing': 'Apple Sign-In entitlement missing — add Sign In with Apple capability in Xcode',
+    'doctor.appleWeb.ok': 'Apple Sign-In on web configured',
+    'doctor.appleWeb.pending': 'Apple Sign-In on web not configured (run `kasy apple-web`). iOS already works.',
     'doctor.ios.facebookOk': 'Facebook credentials configured (iOS)',
     'doctor.ios.facebookPlaceholders': 'Facebook credentials are still placeholders — update FacebookAppID and FacebookClientToken in Info.plist',
     'doctor.ios.facebookSkipped': 'Facebook credential check skipped (no FacebookAppID in Info.plist)',
@@ -741,6 +797,12 @@ module.exports = {
     'new.success.bundleId': 'App identifier (bundle ID)',
     'new.success.bundleId.hint': "Your app's unique identifier on Android, iOS and Firebase (push).",
     'new.success.api.serverContracts': 'API backend: you must implement the server contracts (delete account, AI chat and push). See patch/README.md',
+    'new.appleWeb.autoConfigured': 'Apple Sign-In on web configured automatically (reused your saved credentials).',
+    'new.success.appleWeb.configured': 'Apple Sign-In on web: configured',
+    'new.success.appleWeb.pending': 'Apple Sign-In on web: not configured yet (run `kasy apple-web`). iOS already works.',
+    'new.facebook.autoConfigured': 'Facebook Login configured automatically (reused your saved credentials).',
+    'new.success.facebook.configured': 'Facebook Login: configured',
+    'new.success.facebook.pending': 'Facebook Login: not configured yet (run `kasy facebook`).',
     'new.success.nextSteps': 'Next steps:',
     'new.success.step.cd': 'Go to your project folder:',
     'new.success.step.deploy': 'Push the server to Firebase (DB + functions):',

package/lib/utils/i18n/messages-es.js

@@ -374,6 +374,60 @@ module.exports = {
     'configure.settingSecrets': 'Guardando {count} Firebase Secret(s)…',
     'configure.savedSecrets': '{count} Firebase Secret(s) guardado(s)',
     'configure.secretFailed': 'No pude guardar el secret {key}. Ejecuta manualmente: firebase functions:secrets:set {key}',
+    'cli.command.appleWeb.description': 'Configura el inicio de sesión con Apple en la WEB (Firebase o Supabase) con las credenciales que creaste en Apple',
+    'appleWeb.title': 'Inicio de sesión con Apple en la Web',
+    'appleWeb.notKasyProject': 'Esta carpeta no parece un proyecto Kasy (no encontré kit_setup.json). Entra a la carpeta del proyecto y vuelve a ejecutar.',
+    'appleWeb.missingProjectId': 'No encontré el ID del proyecto en kit_setup.json. Genera el proyecto con la CLI antes de configurar Apple web.',
+    'appleWeb.required': 'Campo obligatorio',
+    'appleWeb.useSaved': '¿Usar las credenciales de Apple guardadas ({id})?',
+    'appleWeb.serviceIdPrompt': 'Apple Service ID (el client_id de OAuth):',
+    'appleWeb.teamIdPrompt': 'Apple Team ID:',
+    'appleWeb.keyIdPrompt': 'Key ID de la clave .p8:',
+    'appleWeb.p8Prompt': 'Ruta del archivo .p8 (Sign In with Apple):',
+    'appleWeb.p8ReadError': 'No pude leer el archivo .p8 en esa ruta.',
+    'appleWeb.incomplete': 'Faltan datos para configurar (Service ID, Team ID, Key ID y .p8). Inténtalo de nuevo.',
+    'appleWeb.configuringFirebase': 'Configurando Apple web en Firebase…',
+    'appleWeb.configuringSupabase': 'Firmando el secret y configurando Apple web en Supabase…',
+    'appleWeb.firebaseOk': 'Apple web configurado en Firebase (vuelve a firmar el secret solo, no expira).',
+    'appleWeb.supabaseOk': 'Apple web configurado en Supabase.',
+    'appleWeb.failed': 'No pude configurar Apple web.',
+    'appleWeb.flagUpdated': 'Botón de Apple en la web activado (withAppleWebSignin = true).',
+    'appleWeb.flagMissing': 'Configuré el backend, pero no encontré withAppleWebSignin en features.dart para activar el botón.',
+    'appleWeb.returnUrlNote': 'Verifica que el Return URL de tu Service ID en Apple sea exactamente:',
+    'appleWeb.manualTitle': 'Paso manual en Apple',
+    'appleWeb.expiresNote': 'El secret de Supabase expira en ~6 meses. Ejecuta `kasy apple-web` de nuevo para renovar (reutiliza la .p8 guardada).',
+    'appleWeb.backendApi': 'Backend API REST: la autenticación vive en tu servidor. Configura Sign in with Apple JS en tu backend (Service ID + secret). La CLI no tiene dónde guardarlo.',
+    'appleWeb.apiDone': 'Backend API: nada que automatizar aquí. Mira los pasos de arriba.',
+    'appleWeb.allDone': '¡Listo! El inicio de sesión con Apple en la web está configurado.',
+    'appleWeb.notFirebase': 'El inicio de sesión con Apple en la web hoy solo se admite en el backend Firebase (signInWithPopup). En Supabase es roadmap (iOS nativo ya está configurado por `kasy new`); en el backend API la autenticación vive en tu servidor.',
+    'appleWeb.notFirebaseDone': 'Nada que configurar aquí para Apple web en este backend.',
+    'cli.command.facebook.description': 'Configura el inicio de sesión con Facebook (Firebase/Supabase + archivos nativos) y guía los pasos manuales en Meta',
+    'facebook.title': 'Inicio de sesión con Facebook',
+    'facebook.notKasyProject': 'Esta carpeta no parece un proyecto Kasy (no encontré kit_setup.json). Entra a la carpeta del proyecto y vuelve a ejecutar.',
+    'facebook.metaTitle': 'Paso manual en Meta',
+    'facebook.metaIntro': 'Crea una app en Meta for Developers (Consumer) y obtén: App ID, Client Token (Settings → Advanced) y App Secret (Settings → Basic). Agrega el producto Facebook Login.',
+    'facebook.metaOpenLabel': 'Abre el panel de Meta para crear/abrir tu app:',
+    'facebook.metaOpenConfirm': '¿Abrir el panel de Meta ahora?',
+    'facebook.useSaved': '¿Usar las credenciales de Facebook guardadas ({id})?',
+    'facebook.required': 'Campo obligatorio',
+    'facebook.appIdPrompt': 'Meta App ID:',
+    'facebook.clientTokenPrompt': 'Meta Client Token:',
+    'facebook.appSecretPrompt': 'Meta App Secret (para el proveedor del backend):',
+    'facebook.incomplete': 'Falta el App ID. Inténtalo de nuevo.',
+    'facebook.nativeOk': 'App ID y Client Token escritos en Info.plist y strings.xml.',
+    'facebook.nativeMissing': 'No encontré Info.plist/strings.xml para escribir (ejecuta después de generar las plataformas nativas).',
+    'facebook.configuringFirebase': 'Habilitando el proveedor de Facebook en Firebase…',
+    'facebook.configuringSupabase': 'Habilitando el proveedor de Facebook en Supabase…',
+    'facebook.firebaseOk': 'Proveedor de Facebook habilitado en Firebase.',
+    'facebook.supabaseOk': 'Proveedor de Facebook habilitado en Supabase.',
+    'facebook.backendFailed': 'No pude habilitar el proveedor de Facebook en el backend.',
+    'facebook.backendApi': 'Backend API REST: la autenticación vive en tu servidor. Configura Facebook Login en tu backend (App ID + App Secret).',
+    'facebook.missingProjectId': 'No encontré el ID del proyecto en kit_setup.json. Omití la parte del backend (los archivos nativos se escribieron).',
+    'facebook.noSecret': 'Sin App Secret omití la parte del backend. Ejecuta `kasy facebook` con el App Secret para habilitar el proveedor.',
+    'facebook.redirectNote': 'En Meta (Facebook Login → Settings), agrega este Valid OAuth Redirect URI:',
+    'facebook.flagUpdated': 'Botón de Facebook en la web activado (withFacebookWebSignin = true).',
+    'facebook.webRoadmap': 'El inicio de sesión con Facebook en la web para Supabase aún no viene activado (roadmap). El nativo (iOS/Android) ya funciona.',
+    'facebook.allDone': '¡Listo! El inicio de sesión con Facebook está configurado.',
     'cli.command.check.description': 'Verifica si las notificaciones push están configuradas (usa --fix para arreglar)',
     'deploy.q.project': 'Firebase Project ID:',
     'deploy.q.serviceAccount': 'Ruta al service account JSON:',
@@ -508,6 +562,8 @@ module.exports = {
     'doctor.ios.googleUrlSchemeSkipped': 'Check del URL scheme iOS de Google Sign-In omitido (GoogleService-Info.plist ausente)',
     'doctor.ios.appleSignInEntitlementOk': 'Entitlement de Apple Sign-In configurado',
     'doctor.ios.appleSignInEntitlementMissing': 'Entitlement de Apple Sign-In ausente — agrega la capability Sign In with Apple en Xcode',
+    'doctor.appleWeb.ok': 'Inicio de sesión con Apple en la web configurado',
+    'doctor.appleWeb.pending': 'Inicio de sesión con Apple en la web no configurado (ejecuta `kasy apple-web`). iOS ya funciona.',
     'doctor.ios.facebookOk': 'Credenciales de Facebook configuradas (iOS)',
     'doctor.ios.facebookPlaceholders': 'Credenciales de Facebook son aún placeholders — actualiza FacebookAppID y FacebookClientToken en Info.plist',
     'doctor.ios.facebookSkipped': 'Check de credenciales de Facebook omitido (FacebookAppID ausente en Info.plist)',
@@ -741,6 +797,12 @@ module.exports = {
     'new.success.bundleId': 'Identificador de la app (bundle ID)',
     'new.success.bundleId.hint': 'Identificador único de tu app en Android, iOS y Firebase (push).',
     'new.success.api.serverContracts': 'Backend API: debes implementar los contratos del servidor (eliminar cuenta, IA chat y push). Consulta patch/README.md',
+    'new.appleWeb.autoConfigured': 'Inicio de sesión con Apple en la web configurado automáticamente (se reutilizaron tus credenciales guardadas).',
+    'new.success.appleWeb.configured': 'Inicio de sesión con Apple en la web: configurado',
+    'new.success.appleWeb.pending': 'Inicio de sesión con Apple en la web: falta configurar (ejecuta `kasy apple-web`). iOS ya funciona.',
+    'new.facebook.autoConfigured': 'Inicio de sesión con Facebook configurado automáticamente (se reutilizaron tus credenciales guardadas).',
+    'new.success.facebook.configured': 'Inicio de sesión con Facebook: configurado',
+    'new.success.facebook.pending': 'Inicio de sesión con Facebook: falta configurar (ejecuta `kasy facebook`).',
     'new.success.nextSteps': 'Próximos pasos:',
     'new.success.step.cd': 'Ve a la carpeta del proyecto:',
     'new.success.step.deploy': 'Sube el servidor a Firebase (DB + funciones):',

package/lib/utils/i18n/messages-pt.js

@@ -372,6 +372,60 @@ module.exports = {
     'configure.settingSecrets': 'Gravando {count} Firebase Secret(s)…',
     'configure.savedSecrets': '{count} Firebase Secret(s) gravado(s)',
     'configure.secretFailed': 'Não consegui gravar o secret {key}. Rode manualmente: firebase functions:secrets:set {key}',
+    'cli.command.appleWeb.description': 'Configura o login com Apple na WEB (Firebase ou Supabase) com as credenciais que você criou na Apple',
+    'appleWeb.title': 'Login com Apple na Web',
+    'appleWeb.notKasyProject': 'Esta pasta não parece um projeto Kasy (não achei kit_setup.json). Entre na pasta do projeto e rode de novo.',
+    'appleWeb.missingProjectId': 'Não encontrei o ID do projeto no kit_setup.json. Gere o projeto pela CLI antes de configurar o Apple web.',
+    'appleWeb.required': 'Campo obrigatório',
+    'appleWeb.useSaved': 'Usar as credenciais Apple salvas ({id})?',
+    'appleWeb.serviceIdPrompt': 'Apple Service ID (o client_id do OAuth):',
+    'appleWeb.teamIdPrompt': 'Apple Team ID:',
+    'appleWeb.keyIdPrompt': 'Key ID da chave .p8:',
+    'appleWeb.p8Prompt': 'Caminho do arquivo .p8 (Sign In with Apple):',
+    'appleWeb.p8ReadError': 'Não consegui ler o arquivo .p8 nesse caminho.',
+    'appleWeb.incomplete': 'Faltam dados pra configurar (Service ID, Team ID, Key ID e .p8). Tente de novo.',
+    'appleWeb.configuringFirebase': 'Configurando Apple web no Firebase…',
+    'appleWeb.configuringSupabase': 'Assinando o secret e configurando Apple web no Supabase…',
+    'appleWeb.firebaseOk': 'Apple web configurado no Firebase (ele re-assina o secret sozinho, não expira).',
+    'appleWeb.supabaseOk': 'Apple web configurado no Supabase.',
+    'appleWeb.failed': 'Não consegui configurar o Apple web.',
+    'appleWeb.flagUpdated': 'Botão Apple na web ligado (withAppleWebSignin = true).',
+    'appleWeb.flagMissing': 'Configurei o backend, mas não achei withAppleWebSignin em features.dart pra ligar o botão.',
+    'appleWeb.returnUrlNote': 'Confira que o Return URL do seu Service ID na Apple é exatamente:',
+    'appleWeb.manualTitle': 'Passo manual na Apple',
+    'appleWeb.expiresNote': 'O secret do Supabase expira em ~6 meses. Rode `kasy apple-web` de novo pra renovar (ele reaproveita a .p8 salva).',
+    'appleWeb.backendApi': 'Backend API REST: a autenticação é do seu servidor. Configure o Sign in with Apple JS no seu backend (Service ID + secret). A CLI não tem onde gravar.',
+    'appleWeb.apiDone': 'Backend API: nada pra automatizar aqui. Veja os passos acima.',
+    'appleWeb.allDone': 'Pronto! O login com Apple na web está configurado.',
+    'appleWeb.notFirebase': 'Login com Apple na web hoje é suportado só no backend Firebase (signInWithPopup). No Supabase é roadmap (o iOS nativo já está configurado pelo `kasy new`); no backend API a auth é do seu servidor.',
+    'appleWeb.notFirebaseDone': 'Nada a configurar aqui pra Apple web neste backend.',
+    'cli.command.facebook.description': 'Configura o login com Facebook (Firebase/Supabase + arquivos nativos) e guia os passos manuais na Meta',
+    'facebook.title': 'Login com Facebook',
+    'facebook.notKasyProject': 'Esta pasta não parece um projeto Kasy (não achei kit_setup.json). Entre na pasta do projeto e rode de novo.',
+    'facebook.metaTitle': 'Passo manual na Meta',
+    'facebook.metaIntro': 'Crie um app no Meta for Developers (Consumer) e pegue: App ID, Client Token (Settings → Advanced) e App Secret (Settings → Basic). Ative o produto Facebook Login.',
+    'facebook.metaOpenLabel': 'Abra o painel da Meta pra criar/abrir seu app:',
+    'facebook.metaOpenConfirm': 'Abrir o painel da Meta agora?',
+    'facebook.useSaved': 'Usar as credenciais do Facebook salvas ({id})?',
+    'facebook.required': 'Campo obrigatório',
+    'facebook.appIdPrompt': 'Meta App ID:',
+    'facebook.clientTokenPrompt': 'Meta Client Token:',
+    'facebook.appSecretPrompt': 'Meta App Secret (pro provedor do backend):',
+    'facebook.incomplete': 'Faltou o App ID. Tente de novo.',
+    'facebook.nativeOk': 'App ID e Client Token gravados no Info.plist e strings.xml.',
+    'facebook.nativeMissing': 'Não achei Info.plist/strings.xml pra gravar (rode depois de gerar as plataformas nativas).',
+    'facebook.configuringFirebase': 'Habilitando o provedor Facebook no Firebase…',
+    'facebook.configuringSupabase': 'Habilitando o provedor Facebook no Supabase…',
+    'facebook.firebaseOk': 'Provedor Facebook habilitado no Firebase.',
+    'facebook.supabaseOk': 'Provedor Facebook habilitado no Supabase.',
+    'facebook.backendFailed': 'Não consegui habilitar o provedor Facebook no backend.',
+    'facebook.backendApi': 'Backend API REST: a autenticação é do seu servidor. Configure o Facebook Login no seu backend (App ID + App Secret).',
+    'facebook.missingProjectId': 'Não encontrei o ID do projeto no kit_setup.json. Pulei a parte do backend (os arquivos nativos foram gravados).',
+    'facebook.noSecret': 'Sem App Secret, pulei a parte do backend. Rode `kasy facebook` com o App Secret pra habilitar o provedor.',
+    'facebook.redirectNote': 'Na Meta (Facebook Login → Settings), adicione este Valid OAuth Redirect URI:',
+    'facebook.flagUpdated': 'Botão Facebook na web ligado (withFacebookWebSignin = true).',
+    'facebook.webRoadmap': 'Login Facebook na web no Supabase ainda não vem ligado (roadmap). O nativo (iOS/Android) já funciona.',
+    'facebook.allDone': 'Pronto! O Facebook Login está configurado.',
     'cli.command.check.description': 'Confere se as notificações push estão configuradas (use --fix para corrigir)',
     'deploy.q.project': 'Firebase Project ID:',
     'deploy.q.serviceAccount': 'Caminho para o service account JSON:',
@@ -506,6 +560,8 @@ module.exports = {
     'doctor.ios.googleUrlSchemeSkipped': 'Check do URL scheme iOS do Google Sign-In ignorado (GoogleService-Info.plist ausente)',
     'doctor.ios.appleSignInEntitlementOk': 'Entitlement do Apple Sign-In configurado',
     'doctor.ios.appleSignInEntitlementMissing': 'Entitlement do Apple Sign-In ausente — adicione a capability Sign In with Apple no Xcode',
+    'doctor.appleWeb.ok': 'Login com Apple na web configurado',
+    'doctor.appleWeb.pending': 'Login com Apple na web não configurado (rode `kasy apple-web`). O iOS já funciona.',
     'doctor.ios.facebookOk': 'Credenciais do Facebook configuradas (iOS)',
     'doctor.ios.facebookPlaceholders': 'Credenciais do Facebook ainda são placeholders — atualize FacebookAppID e FacebookClientToken no Info.plist',
     'doctor.ios.facebookSkipped': 'Check das credenciais do Facebook ignorado (FacebookAppID ausente no Info.plist)',
@@ -741,6 +797,12 @@ module.exports = {
     'new.success.bundleId': 'Identificador do app (bundle ID)',
     'new.success.bundleId.hint': 'Identificador único do seu app no Android, iOS e Firebase (push).',
     'new.success.api.serverContracts': 'Backend API: você precisa implementar os contratos do servidor (excluir conta, IA chat e push). Veja patch/README.md',
+    'new.appleWeb.autoConfigured': 'Login com Apple na web configurado automaticamente (credenciais salvas reaproveitadas).',
+    'new.success.appleWeb.configured': 'Login com Apple na web: configurado',
+    'new.success.appleWeb.pending': 'Login com Apple na web: falta configurar (rode `kasy apple-web`). O iOS já funciona.',
+    'new.facebook.autoConfigured': 'Login com Facebook configurado automaticamente (credenciais salvas reaproveitadas).',
+    'new.success.facebook.configured': 'Login com Facebook: configurado',
+    'new.success.facebook.pending': 'Login com Facebook: falta configurar (rode `kasy facebook`).',
     'new.success.nextSteps': 'Próximos passos:',
     'new.success.step.cd': 'Entre na pasta do projeto:',
     'new.success.step.deploy': 'Suba o servidor pro Firebase (banco + funções):',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kasy-cli",
-  "version": "1.32.0",
+  "version": "1.34.0",
   "description": "CLI for scaffolding production-ready Flutter SaaS apps with Firebase, Supabase, or API REST backends.",
   "bin": {
     "kasy": "./bin/kasy.js"
@@ -31,7 +31,7 @@
     "access": "public"
   },
   "scripts": {
-    "prepack": "node scripts/check-feature-patches.js && node scripts/bundle-template.js && node test/generated-matches-kit.test.js && node test/supabase-verify-jwt.test.js && node test/supabase-cors.test.js && node test/supabase-google-web.test.js && node test/backend-pubspec-local-reminders.test.js && node test/stripe-webhook-orphan-guard.test.js && node test/facebook-strip.test.js && node test/path-provider-pin.test.js && node test/features-flags-parity.test.js",
+    "prepack": "node scripts/check-feature-patches.js && node scripts/bundle-template.js && node test/generated-matches-kit.test.js && node test/supabase-verify-jwt.test.js && node test/supabase-cors.test.js && node test/supabase-google-web.test.js && node test/backend-pubspec-local-reminders.test.js && node test/stripe-webhook-orphan-guard.test.js && node test/facebook-strip.test.js && node test/path-provider-pin.test.js && node test/features-flags-parity.test.js && node test/apple-web.test.js && node test/facebook.test.js",
     "start": "node ./bin/kasy.js",
     "setup": "node ./bin/kasy.js setup",
     "doctor": "node ./bin/kasy.js doctor",

package/templates/firebase/AGENTS.md

@@ -0,0 +1,87 @@
+# AGENTS.md — working in this codebase
+
+This project was generated with the **Kasy** kit. This file orients any AI coding
+assistant (Claude Code, Cursor, GitHub Copilot, …). Read it before generating
+code. Claude Code users: `CLAUDE.md` points here.
+
+## What this is
+
+A production-ready Flutter app (web, iOS, Android) built on the **Kasy design
+system** and a **feature-first** architecture. It was generated with **one**
+backend — Firebase, Supabase, or a REST API. Only the **data layer** differs
+between backends; the UI, state, i18n and design system are identical. So almost
+everything below is backend-agnostic.
+
+## Golden rules (every time)
+
+1. **Use the design system, never raw values.** No hardcoded `fontSize`,
+   `Color(0x…)`, `Colors.*`, or literal padding / radius / icon sizes. Use
+   `context.textTheme.*` / `KasyTextTheme.*`, `context.colors.*`,
+   `KasySpacing.*`, `KasyRadius.*`, `KasyIconSize.*`. Full reference:
+   **`DESIGN_SYSTEM.md`**.
+2. **Use kit components, not raw Material.** `KasyButton` (not
+   ElevatedButton / TextButton), `showKasyConfirmDialog` (not AlertDialog),
+   `showKasyToast` (not SnackBar), plus `KasyCard`, `KasyTextField`,
+   `KasyScreen`, etc.
+3. **The Home screen is the visual reference** — clean, minimal, lots of
+   surface, one accent colour used sparingly. New screens should mirror it.
+4. **English everywhere** in code, comments and identifiers. **No hardcoded
+   user-facing strings** — use slang i18n (`context.t.…`).
+5. **Package imports only**: `import 'package:kasy_kit/…';`, never relative.
+6. **Zero analyzer issues.** Run `flutter analyze` and fix everything before
+   considering a change done.
+
+## Architecture (feature-first, three layers)
+
+```
+lib/
+├── components/   # Kasy design-system widgets (KasyButton, KasyCard, …)
+├── core/         # cross-cutting: theme/, data/, states/, security/, widgets/, i18n
+└── features/
+    └── <feature>/
+        ├── api/           # data source (Firebase / Supabase / REST) → returns entities
+        ├── repositories/  # entities → domain models (business logic)
+        ├── providers/     # Riverpod notifiers → immutable page state
+        └── ui/            # pages, components (use provider + domain), widgets (dumb)
+```
+
+- **Data flow:** `api → repository → provider (notifier) → ui`. Only repositories
+  use api classes. The api returns entities; repositories return domain models.
+- **State:** a Riverpod notifier exposes an immutable (freezed) state; the view
+  `ref.watch`es it and triggers actions. Use `.when` / `.map` for
+  data / loading / error.
+- **Backend note:** the `api` layer is the only backend-specific code. A new
+  data-backed feature follows the same `api → repo → provider` chain the
+  existing features use.
+
+## Building a screen or component — checklist
+
+1. Read `DESIGN_SYSTEM.md` (tokens, typography roles, components).
+2. Reuse a kit component before building one. Wrap new pages in `KasyScreen`
+   (or mirror an existing page's scaffold).
+3. Use semantic typography roles (`pageTitle`, `sectionTitle`, `rowTitle`, …)
+   and tokens for **every** size, colour and spacing.
+4. Strings via `context.t.*` (add keys to the i18n JSON, never inline text).
+5. `flutter analyze` clean. Optional: `dart run tool/design_check.dart` flags
+   any raw values that slipped into `lib/features`.
+
+## Platform notes (native-only features)
+
+Some features only work on a real iOS / Android build and are gated with
+`kIsWeb`. They never run on web; where the user explicitly triggers them, a
+"native app only" toast is shown instead of failing silently.
+
+- **In-app review / store rating** — sends the user to the App Store / Play
+  Store. It is never shown on web. **iOS requires the numeric App Store ID**:
+  run `kasy configure` and fill `App Store ID (numeric)`. Android works
+  automatically from the package name. Until the ID is set, iOS store review
+  throws at runtime.
+- **Push / FCM token, notification permission** — native APIs; on web the admin
+  actions surface the "native app only" toast.
+
+## Optional design guard-rail
+
+`dart run tool/design_check.dart` scans `lib/features` for raw values
+(hardcoded fonts / colours / Material widgets). It is **opt-in and
+non-blocking** — relax it, wire it into CI, or delete it freely. Per-line
+escape hatch: `// design-check: ignore`.

package/templates/firebase/CLAUDE.md

@@ -0,0 +1,16 @@
+# CLAUDE.md
+
+This project shares one AI-guidance file across tools. **Read `AGENTS.md`** in
+this directory first — it defines the architecture, the Kasy design system, and
+the conventions to follow before generating any code.
+
+Quick reminders:
+
+- Use design-system tokens, never raw values — see `DESIGN_SYSTEM.md`
+  (`context.textTheme.*`, `context.colors.*`, `KasySpacing.*`, `KasyRadius.*`,
+  `KasyIconSize.*`).
+- Use Kasy components (`KasyButton`, `KasyCard`, `showKasyToast`,
+  `showKasyConfirmDialog`, …), not raw Material.
+- The Home screen is the visual reference: clean, minimal, one accent colour.
+- English in code; user strings via `context.t.*` (slang i18n).
+- Run `flutter analyze` and keep it clean.