kasy-cli 1.34.0 → 1.36.0

package/lib/scaffold/backends/patch-base-hashes.json

@@ -0,0 +1,66 @@
+{
+  "api/android/app/src/main/AndroidManifest.xml": "0579c57068ee50d43837ef9c7bee884b6232e92975301c8305ce389282f68291",
+  "api/ios/Runner/AppDelegate.swift": "9f1027a03ad1fef2dab45464fbd7e98364b6a9cb6d2a6abe770ee9c45fa19122",
+  "api/lib/core/data/api/storage_api.dart": "d77fecc6923ea9544b6ec20571dcab5c8f3d38be81ec618b0cf4f1b08be7bbae",
+  "api/lib/core/data/api/user_api.dart": "06f491ebf4548b87431e2d6983148f4082e120ec7d6a928108cba954d16d8c56",
+  "api/lib/core/data/entities/json_converters.dart": "92a5efd595a03a862fa03e77ab3ca3d556523d0c9e0daca6e296e35d24b760a8",
+  "api/lib/core/data/entities/user_entity.dart": "5c1e56e4be3ba2ed95cdcd276112a02b526f2a3fa7ee5bba08a3ec2b51153688",
+  "api/lib/environments.dart": "c41f0843a4d627b717579eec5607b7ff5c16369bdd4b2a82e081058a20ffb7a5",
+  "api/lib/features/ai_chat/api/ai_chat_api.dart": "749047d30390e8d624c5a17d421096b05651e28b34a42071a9b73efc71d0a5f7",
+  "api/lib/features/ai_chat/api/ai_chat_conversation_entity.dart": "1c4e4223e802d7fe8e93d9e7a09fcc6be81a41792d722e8b7e697837cde4737f",
+  "api/lib/features/ai_chat/api/ai_chat_message_entity.dart": "5aca4fdb5b1c38df04c9d377c6e6eeb6930ef85b2a32689fe6403e7cc7645373",
+  "api/lib/features/ai_chat/providers/ai_chat_notifier.dart": "f16ea3f3266e63a5591ceff9bc1900845f0b96e9bbbc5463ec6ab894f878eae3",
+  "api/lib/features/authentication/api/authentication_api_interface.dart": "ef9219237babd73e4b3ac148a24ebbbdf39ab98166d21f578c359074b528e5da",
+  "api/lib/features/authentication/api/authentication_api.dart": "8b460722bb3bee7eee015f34aaa39c1c97cb264df1024b2855060dac232c620a",
+  "api/lib/features/authentication/repositories/authentication_repository.dart": "8e98ca0d39df3aac1dab159e6bdfe8d2bbb8e43931459984eb4ecfb676698ca2",
+  "api/lib/features/feedbacks/api/entities/feature_request_entity.dart": "e72c683c7321bf1f3c19fc1c6d54c6964bd99970e87c9ff31d8918efa93f0090",
+  "api/lib/features/feedbacks/api/entities/feature_vote_entity.dart": "a13ccfc493d8f5277beffc8e28f77ec322ab0c0a56358c3669353206b7c6756b",
+  "api/lib/features/feedbacks/api/feature_request_api.dart": "a741395509b95e8cae135bc8bdcca1ba0d48785b1e1b201732219659d271346b",
+  "api/lib/features/feedbacks/api/feature_vote_api.dart": "89dcaeea29460a7f219c2ede3759707b45066272fe6837c29a40f3d79fade4e9",
+  "api/lib/features/notifications/api/device_api.dart": "0d6bccb6813cceec29c54220daac9d0cd35687c4fa9f10ffde07dad88b204ed3",
+  "api/lib/features/notifications/api/entities/device_entity.dart": "54fce6274c5fe60ba663d8693e0c9d88fd6cd6fcd9ec906e021621a2e51176b7",
+  "api/lib/features/notifications/api/entities/notifications_entity.dart": "f9ee62111a6f122657e105df317f1f5f803e3a525a96686c0a2728ff02cd8964",
+  "api/lib/features/notifications/api/notifications_api.dart": "30cdb1bc52c3249b2cda6b1c7eb7fb6a977db5744da5a9c2980784f41e75d9e7",
+  "api/lib/features/onboarding/api/entities/user_info_entity.dart": "cd5aabc68310025f3ab9676cab126e1f755431f9e8752f868ee9fcd6f5892ce2",
+  "api/lib/features/onboarding/api/user_infos_api.dart": "cf728bcef364259912ee1e87151c4f791faee0c0d49232c9af260bb5681bd429",
+  "api/lib/features/onboarding/models/user_info.dart": "946fd34a33b630a34a3b6248594cbca717f4fab9d23f669510145b9032bd1321",
+  "api/lib/features/onboarding/repositories/user_infos_repository.dart": "487a5177dcaed7f87e613b2b4f04329c4995274e6a52809d4917c037cb3c3c55",
+  "api/lib/features/settings/ui/components/admin/admin_users_api.dart": "0ffb232ffb193154c0366d6f7da0ca499b3e06fed4fd71af572b8dc53ecd844e",
+  "api/lib/features/settings/ui/widgets/avatar_utils.dart": "bb9126409bbbb245f2dec613bd096ac53c208a56bd55f3d2ab2599e43534904f",
+  "api/lib/features/subscriptions/api/entities/subscription_entity.dart": "20c1d75ed9d88acb96e94a592dcb4de0f63c792302ea07df53cebbdeb6d0cf7e",
+  "api/lib/features/subscriptions/api/stripe_backend_api.dart": "e370bd05211462f2fc94c69af1749eb5330f997e9ec5e73e5c4e119999bf666f",
+  "api/lib/features/subscriptions/api/subscription_api.dart": "c7484c9301d16245748025a3d420a89397e9e956b2211b7ed001c073ff2e4449",
+  "api/README.md": "1f30fc1ebf8fe02df6f3ee2f94c17f4bb4952abd5b125312d2c43eb6374eb354",
+  "supabase/android/app/src/main/AndroidManifest.xml": "0579c57068ee50d43837ef9c7bee884b6232e92975301c8305ce389282f68291",
+  "supabase/ios/Runner/AppDelegate.swift": "9f1027a03ad1fef2dab45464fbd7e98364b6a9cb6d2a6abe770ee9c45fa19122",
+  "supabase/lib/core/data/api/storage_api.dart": "d77fecc6923ea9544b6ec20571dcab5c8f3d38be81ec618b0cf4f1b08be7bbae",
+  "supabase/lib/core/data/api/user_api.dart": "06f491ebf4548b87431e2d6983148f4082e120ec7d6a928108cba954d16d8c56",
+  "supabase/lib/core/data/entities/json_converters.dart": "92a5efd595a03a862fa03e77ab3ca3d556523d0c9e0daca6e296e35d24b760a8",
+  "supabase/lib/core/data/entities/user_entity.dart": "5c1e56e4be3ba2ed95cdcd276112a02b526f2a3fa7ee5bba08a3ec2b51153688",
+  "supabase/lib/environments.dart": "c41f0843a4d627b717579eec5607b7ff5c16369bdd4b2a82e081058a20ffb7a5",
+  "supabase/lib/features/ai_chat/api/ai_chat_api.dart": "749047d30390e8d624c5a17d421096b05651e28b34a42071a9b73efc71d0a5f7",
+  "supabase/lib/features/ai_chat/api/ai_chat_conversation_entity.dart": "1c4e4223e802d7fe8e93d9e7a09fcc6be81a41792d722e8b7e697837cde4737f",
+  "supabase/lib/features/ai_chat/api/ai_chat_message_entity.dart": "5aca4fdb5b1c38df04c9d377c6e6eeb6930ef85b2a32689fe6403e7cc7645373",
+  "supabase/lib/features/ai_chat/providers/ai_chat_notifier.dart": "f16ea3f3266e63a5591ceff9bc1900845f0b96e9bbbc5463ec6ab894f878eae3",
+  "supabase/lib/features/authentication/api/authentication_api.dart": "8b460722bb3bee7eee015f34aaa39c1c97cb264df1024b2855060dac232c620a",
+  "supabase/lib/features/authentication/repositories/authentication_repository.dart": "8e98ca0d39df3aac1dab159e6bdfe8d2bbb8e43931459984eb4ecfb676698ca2",
+  "supabase/lib/features/feedbacks/api/entities/feature_request_entity.dart": "e72c683c7321bf1f3c19fc1c6d54c6964bd99970e87c9ff31d8918efa93f0090",
+  "supabase/lib/features/feedbacks/api/entities/feature_vote_entity.dart": "a13ccfc493d8f5277beffc8e28f77ec322ab0c0a56358c3669353206b7c6756b",
+  "supabase/lib/features/feedbacks/api/feature_request_api.dart": "a741395509b95e8cae135bc8bdcca1ba0d48785b1e1b201732219659d271346b",
+  "supabase/lib/features/feedbacks/api/feature_vote_api.dart": "89dcaeea29460a7f219c2ede3759707b45066272fe6837c29a40f3d79fade4e9",
+  "supabase/lib/features/notifications/api/device_api.dart": "0d6bccb6813cceec29c54220daac9d0cd35687c4fa9f10ffde07dad88b204ed3",
+  "supabase/lib/features/notifications/api/entities/device_entity.dart": "54fce6274c5fe60ba663d8693e0c9d88fd6cd6fcd9ec906e021621a2e51176b7",
+  "supabase/lib/features/notifications/api/entities/notifications_entity.dart": "f9ee62111a6f122657e105df317f1f5f803e3a525a96686c0a2728ff02cd8964",
+  "supabase/lib/features/notifications/api/notifications_api.dart": "30cdb1bc52c3249b2cda6b1c7eb7fb6a977db5744da5a9c2980784f41e75d9e7",
+  "supabase/lib/features/onboarding/api/entities/user_info_entity.dart": "cd5aabc68310025f3ab9676cab126e1f755431f9e8752f868ee9fcd6f5892ce2",
+  "supabase/lib/features/onboarding/api/user_infos_api.dart": "cf728bcef364259912ee1e87151c4f791faee0c0d49232c9af260bb5681bd429",
+  "supabase/lib/features/onboarding/models/user_info.dart": "946fd34a33b630a34a3b6248594cbca717f4fab9d23f669510145b9032bd1321",
+  "supabase/lib/features/onboarding/repositories/user_infos_repository.dart": "487a5177dcaed7f87e613b2b4f04329c4995274e6a52809d4917c037cb3c3c55",
+  "supabase/lib/features/settings/ui/components/admin/admin_users_api.dart": "0ffb232ffb193154c0366d6f7da0ca499b3e06fed4fd71af572b8dc53ecd844e",
+  "supabase/lib/features/settings/ui/widgets/avatar_utils.dart": "bb9126409bbbb245f2dec613bd096ac53c208a56bd55f3d2ab2599e43534904f",
+  "supabase/lib/features/subscriptions/api/entities/subscription_entity.dart": "20c1d75ed9d88acb96e94a592dcb4de0f63c792302ea07df53cebbdeb6d0cf7e",
+  "supabase/lib/features/subscriptions/api/stripe_backend_api.dart": "e370bd05211462f2fc94c69af1749eb5330f997e9ec5e73e5c4e119999bf666f",
+  "supabase/lib/features/subscriptions/api/subscription_api.dart": "c7484c9301d16245748025a3d420a89397e9e956b2211b7ed001c073ff2e4449",
+  "supabase/lib/google_auth_options.dart": "9d3ab9be5928f3100b9b217864d916edd1223d186e60ed130c35628812cace66",
+  "supabase/README.md": "1f30fc1ebf8fe02df6f3ee2f94c17f4bb4952abd5b125312d2c43eb6374eb354"
+}

package/lib/scaffold/backends/supabase/edge-functions/stripe-webhook/index.ts

@@ -101,11 +101,13 @@ Deno.serve(async (req: Request) => {
     const item = sub.items?.data?.[0];
     const priceId = item?.price?.id ?? "";
     const ms = periodEndMs(sub);
+    const trialMs = sub.trial_end ? sub.trial_end * 1000 : null;
     const now = new Date().toISOString();
     const payload = {
       status: statusFromStripe(sub),
       last_update_date: now,
       period_end_date: ms ? new Date(ms).toISOString() : null,
+      trial_end: trialMs ? new Date(trialMs).toISOString() : null,
       sku_id: priceId,
       offer_id: priceId,
       store: "STRIPE",

package/lib/scaffold/backends/supabase/migrations/20240101000007_welcome_notification.sql

@@ -1,35 +1,36 @@
--- Send a welcome notification when the user's first device is registered.
+-- Send a welcome notification ONCE per account when a device is registered.
 --
 -- Why on device registration and not on user creation?
--- At user creation time no device token exists yet. By firing on the first
--- INSERT into `devices` we guarantee the locale is set and the notification
--- can be localised accurately.
+-- At user creation time no device token exists yet. By firing on INSERT into
+-- `devices` we guarantee the locale is set and the notification can be localised
+-- accurately.
 --
--- notify_user = false: the user is already inside the app at registration
--- time, so no push is needed — the notification is saved to the DB only.
+-- Why a `welcome_sent` flag and not a device count?
+-- Logout removes the device row and login re-creates it, so a device count
+-- ("is this the first device?") sees a brand-new first device on every
+-- re-login and re-sent the welcome each time. A one-shot flag on the user,
+-- claimed atomically, sends it exactly once for the life of the account.
 --
--- Anonymous users (no email in public.users) are skipped.
--- The message is localised using the `locale` field of public.users.
+-- notify_user = false: the user is already inside the app at registration time,
+-- so no push is needed — the notification is saved to the DB only.
+--
+-- Anonymous users (no email in public.users) are skipped until they have one.
+
+-- One-time welcome guard (idempotent so re-running the migration is safe).
+ALTER TABLE public.users
+  ADD COLUMN IF NOT EXISTS welcome_sent boolean NOT NULL DEFAULT false;
 
 CREATE OR REPLACE FUNCTION public.trigger_welcome_notification()
 RETURNS TRIGGER AS $$
 DECLARE
-  v_email  text;
-  v_locale text;
-  v_count  int;
-  v_title  text;
-  v_body   text;
+  v_email   text;
+  v_locale  text;
+  v_claimed int;
+  v_title   text;
+  v_body    text;
 BEGIN
-  -- Only fire for the very first device of this user.
-  SELECT COUNT(*) INTO v_count
-  FROM public.devices
-  WHERE user_id = NEW.user_id AND id != NEW.id;
-
-  IF v_count > 0 THEN
-    RETURN NEW;
-  END IF;
-
-  -- Skip anonymous users (no email set yet).
+  -- Skip anonymous users (no email yet); they get welcomed once they have one,
+  -- WITHOUT consuming the one-time claim below.
   SELECT email, locale INTO v_email, v_locale
   FROM public.users
   WHERE id = NEW.user_id;
@@ -38,6 +39,18 @@ BEGIN
     RETURN NEW;
   END IF;
 
+  -- Atomically claim the one-time welcome: flip welcome_sent to true only if it
+  -- isn't already. ROW_COUNT is 1 for the very first claim, 0 for any later
+  -- device registration — including one re-created after a logout/login cycle.
+  UPDATE public.users
+  SET welcome_sent = true
+  WHERE id = NEW.user_id AND welcome_sent = false;
+
+  GET DIAGNOSTICS v_claimed = ROW_COUNT;
+  IF v_claimed = 0 THEN
+    RETURN NEW;
+  END IF;
+
   -- Localised welcome message (falls back to English).
   IF v_locale = 'pt' THEN
     v_title := 'Bem-vindo!';

package/lib/scaffold/backends/supabase/migrations/20240101000014_subscription_trial_end.sql

@@ -0,0 +1,6 @@
+-- Adds trial_end to subscriptions so trial periods are persisted and the app
+-- can detect an active trial. Mirrors the Firebase backend, where the Stripe
+-- webhook writes trial_end (RevenueCat trials are read from the SDK, not the DB).
+-- Idempotent: safe to run on a fresh project or an already-deployed database.
+ALTER TABLE public.subscriptions
+  ADD COLUMN IF NOT EXISTS trial_end TIMESTAMPTZ;

package/lib/scaffold/backends/supabase/patch/lib/features/authentication/api/authentication_api.dart

@@ -1,3 +1,4 @@
+import 'dart:async';
 import 'dart:convert';
 import 'package:crypto/crypto.dart';
 import 'package:firebase_auth/firebase_auth.dart' as fb_auth;
@@ -11,6 +12,8 @@ import 'package:kasy_kit/core/data/api/base_api_exceptions.dart';
 import 'package:kasy_kit/core/data/entities/user_entity.dart';
 import 'package:kasy_kit/environments.dart';
 import 'package:kasy_kit/google_auth_options.dart';
+import 'package:kasy_kit/features/authentication/api/auth_web_support.dart'
+    if (dart.library.js_interop) 'package:kasy_kit/features/authentication/api/auth_web_support_web.dart';
 import 'package:kasy_kit/features/authentication/api/authentication_api_interface.dart';
 import 'package:kasy_kit/features/authentication/repositories/exceptions/authentication_exceptions.dart';
 import 'package:sign_in_with_apple/sign_in_with_apple.dart';
@@ -34,7 +37,41 @@ class SupabaseAuthenticationApi implements AuthenticationApi {
   });
 
   @override
-  Future<void> init() async {}
+  Future<void> init() async {
+    if (!kIsWeb) return;
+    // Complete a pending mobile-web Google redirect sign-in. Firebase handled the
+    // full-page redirect (we reuse its web OAuth client to mint the Google ID
+    // token — see [signinWithGoogle]), so on return we exchange that token for a
+    // Supabase session. No-op when no redirect is pending or a session already
+    // exists.
+    try {
+      final result = await fb_auth.FirebaseAuth.instance.getRedirectResult();
+      final idToken = (result.credential as fb_auth.OAuthCredential?)?.idToken;
+      if (idToken != null && client.auth.currentUser == null) {
+        await client.auth.signInWithIdToken(
+          provider: OAuthProvider.google,
+          idToken: idToken,
+        );
+      }
+    } catch (e) {
+      _logger.w('Google redirect sign-in completion failed: $e');
+    }
+  }
+
+  /// Mobile-web Google sign-in: start a full-page Firebase redirect instead of a
+  /// popup. Mobile browsers handle popups unreliably (the result is often lost
+  /// when the browser reclaims the backgrounded opener tab), leaving the app
+  /// stuck "signing in". The Supabase session is established at startup by [init]
+  /// via getRedirectResult. The page is navigating away as soon as
+  /// [signInWithRedirect] resolves, so this future intentionally never completes
+  /// — the caller stays in its loading state until the browser leaves.
+  /// See [isMobileWebBrowser].
+  Future<Credentials> _googleSignInWithRedirectWeb() async {
+    await fb_auth.FirebaseAuth.instance.signInWithRedirect(
+      fb_auth.GoogleAuthProvider(),
+    );
+    return Completer<Credentials>().future;
+  }
 
   @override
   Future<void> recoverPassword(String email) {
@@ -225,6 +262,7 @@ Note: wait a minute after enabling anonymous sign-in before trying again. It tak
   @override
   Future<Credentials> signinWithGoogle() async {
     if (kIsWeb) {
+      if (isMobileWebBrowser()) return _googleSignInWithRedirectWeb();
       // google_sign_in v7 can't do imperative auth on web. Get the Google ID token
       // via Firebase's popup (zero manual config — reuses the Firebase web OAuth
       // client + authorized domains, which the kit already sets up) and sign into
@@ -368,9 +406,21 @@ Note: wait a minute after enabling anonymous sign-in before trying again. It tak
   @override
   Future<Credentials> signupFromAnonymousWithGoogle() async {
     if (kIsWeb) {
-      // Web: get the Google ID token via Firebase's popup (see signinWithGoogle) and
-      // link it to the current anonymous Supabase user.
+      if (isMobileWebBrowser()) return _googleSignInWithRedirectWeb();
+      // Web: get the Google ID token via Firebase's popup (see signinWithGoogle).
       final idToken = await _googleIdTokenFromWebPopup();
+      // On web the app runs in authRequired mode, so there is usually no anonymous
+      // Supabase session to link to (the user state is just a local placeholder).
+      // Linking without a session sends the anon key, which has no `sub`, and Supabase
+      // rejects it with "missing sub claim". When there's no session, sign in normally
+      // — it creates the account from the Google id_token. Mirrors the Firebase backend.
+      if (client.auth.currentUser == null) {
+        final res = await client.auth.signInWithIdToken(
+          provider: OAuthProvider.google,
+          idToken: idToken,
+        );
+        return Credentials(id: res.user!.id, token: res.session?.accessToken ?? '');
+      }
       try {
         final response = await client.auth.linkIdentityWithIdToken(
           provider: OAuthProvider.google,
@@ -605,6 +655,35 @@ Note: wait a minute after enabling anonymous sign-in before trying again. It tak
   Future<String?> getCurrentUserDisplayName() async =>
       client.auth.currentUser?.userMetadata?['full_name'] as String?;
 
+  @override
+  Future<String?> getCurrentUserPhotoUrl() async {
+    final meta = client.auth.currentUser?.userMetadata;
+    return (meta?['avatar_url'] ?? meta?['picture']) as String?;
+  }
+
+  @override
+  Future<List<String>> getLinkedProviders() async {
+    // Supabase exposes the linked identities in app_metadata['providers'].
+    final raw = client.auth.currentUser?.appMetadata['providers'];
+    if (raw is! List) return const [];
+    return raw.map((p) => p.toString()).toList();
+  }
+
+  @override
+  Future<void> setPassword(String password) async {
+    // Supabase keeps the same user; sets/updates the password so a social-only
+    // account can also sign in with email + password.
+    await client.auth.updateUser(UserAttributes(password: password));
+  }
+
+  // Supabase auto-links identities with the same (confirmed) email on sign-in,
+  // so there is no manual-link step: nothing to offer and nothing to do.
+  @override
+  Future<List<String>> linkableSocialProviders() async => const [];
+
+  @override
+  Future<void> linkSocialProvider(String provider) => Future.value();
+
   String _normalizePhoneNumber(String phoneNumber) {
     String normalized = phoneNumber.replaceAll(RegExp(r'\D'), '');
     if (!normalized.startsWith('+')) {

package/lib/scaffold/backends/supabase/patch/lib/features/authentication/repositories/authentication_repository.dart

@@ -68,6 +68,22 @@ abstract class AuthenticationRepository {
   /// Returns the display name of the authenticated user.
   Future<String?> getCurrentUserDisplayName();
 
+  /// Returns the photo URL of the current user (e.g. Google picture), or null.
+  Future<String?> getCurrentUserPhotoUrl();
+
+  /// Returns all sign-in providers linked to the current account.
+  Future<List<String>> getLinkedProviders();
+
+  /// Sets or updates an email/password credential for the current user, so a
+  /// social-only account can also sign in with email + password.
+  Future<void> setPassword(String password);
+
+  /// Social providers the current user can still link to their account.
+  Future<List<String>> linkableSocialProviders();
+
+  /// Links a social provider to the current account.
+  Future<void> linkSocialProvider(String provider);
+
   /// Signin with Google Play Games account on Android
   Future<void> signinWithGooglePlayGames();
 
@@ -268,6 +284,26 @@ class HttpAuthenticationRepository implements AuthenticationRepository {
   Future<String?> getCurrentUserDisplayName() =>
       _authenticationApi.getCurrentUserDisplayName();
 
+  @override
+  Future<String?> getCurrentUserPhotoUrl() =>
+      _authenticationApi.getCurrentUserPhotoUrl();
+
+  @override
+  Future<List<String>> getLinkedProviders() =>
+      _authenticationApi.getLinkedProviders();
+
+  @override
+  Future<void> setPassword(String password) =>
+      _authenticationApi.setPassword(password);
+
+  @override
+  Future<List<String>> linkableSocialProviders() =>
+      _authenticationApi.linkableSocialProviders();
+
+  @override
+  Future<void> linkSocialProvider(String provider) =>
+      _authenticationApi.linkSocialProvider(provider);
+
   @override
   Future<void> signinWithGooglePlayGames() async {
     try {

package/lib/scaffold/backends/supabase/patch/lib/features/subscriptions/api/entities/subscription_entity.dart

@@ -37,6 +37,7 @@ sealed class SubscriptionEntity with _$SubscriptionEntity {
     @JsonKey(name: 'creation_date') DateTime? creationDate,
     @JsonKey(name: 'last_update_date') DateTime? lastUpdateDate,
     @JsonKey(name: 'period_end_date') DateTime? periodEndDate,
+    @JsonKey(name: 'trial_end') DateTime? trialEnd,
     @JsonKey(name: 'status') required SubscriptionStatus status,
     @JsonKey(name: 'store', unknownEnumValue: SubscriptionStore.unknown)
     SubscriptionStore? store,

package/lib/scaffold/generate.js

@@ -86,11 +86,50 @@ const { FIREBASE_SOURCE_DIR } = require('./shared/backend-config');
  * @param {object}   [options.moduleAnswers={}]
  * @param {Function} [options.onProgress]  - Callback to update the spinner in the CLI.
  * @param {object}   [options.deploy]      - Used by the Firebase postBuild hook.
+ * @param {boolean}  [options.offline=false] - Validation mode: never touch the
+ *   network or the live Firebase project. Skips flutterfire configure, the Google
+ *   auth/iOS/SW patches it feeds, and the Firestore rules deploy; writes a
+ *   compilable stub for firebase_options_dev.dart so `flutter analyze` still works.
  * @param {object}   [hooks={}]
  * @param {Function|null} [hooks.applyBackendSetup]
  * @param {Function|null} [hooks.postBuild]
  * @returns {Promise<{steps: object[], packageName: string, appName: string, bundleId: string, firebaseProjectId: string}>}
  */
+
+/**
+ * Writes a compilable placeholder for lib/firebase_options_dev.dart, the file
+ * `flutterfire configure` normally generates from the real Firebase project.
+ *
+ * Used only by offline validation (`npm run validate:backends`): every backend's
+ * main.dart imports this file (Firebase powers FCM/remote config everywhere), so
+ * without it `flutter analyze` fails with "uri doesn't exist". The stub exposes
+ * the single member main.dart uses — DefaultFirebaseOptions.currentPlatform — with
+ * dummy values, so the analyzer type-checks the whole project without any network.
+ */
+async function writeFirebaseOptionsDevStub(targetDir) {
+  const stub = `// Offline validation stub written by \`npm run validate:backends\`.
+// NOT shipped to clients: \`kasy new\` runs \`flutterfire configure\`, which
+// generates the real file from their Firebase project. Present only so
+// \`flutter analyze\` can type-check without touching the network.
+// ignore_for_file: type=lint
+import 'package:firebase_core/firebase_core.dart' show FirebaseOptions;
+
+class DefaultFirebaseOptions {
+  static FirebaseOptions get currentPlatform => const FirebaseOptions(
+        apiKey: 'offline-validation-stub',
+        appId: 'offline-validation-stub',
+        messagingSenderId: 'offline-validation-stub',
+        projectId: 'offline-validation-stub',
+      );
+}
+`;
+  await fs.outputFile(
+    path.join(targetDir, 'lib', 'firebase_options_dev.dart'),
+    stub,
+    'utf8',
+  );
+}
+
 async function generateProject(targetDir, backend, options, hooks = {}) {
   const {
     appName,
@@ -102,6 +141,7 @@ async function generateProject(targetDir, backend, options, hooks = {}) {
     includeWeb = true,
     language = 'en',
     deferGoogleAuthPatches = false,
+    offline = false,
   } = options;
 
   const { applyBackendSetup = null, postBuild = null } = hooks;
@@ -361,9 +401,18 @@ async function generateProject(targetDir, backend, options, hooks = {}) {
     steps.push({ name: 'build-runner', skipped: true });
   }
 
-  onProgress('flutterfire');
-  const ffResult = await flutterfireConfigure(targetDir, firebaseProjectId, { includeWeb });
-  steps.push({ name: 'flutterfire', ok: ffResult.ok, detail: ffResult.ok ? null : ffResult.error });
+  // Offline validation never touches the network or the live Firebase project, so
+  // skip flutterfire and write a compilable stub for the file it would generate.
+  // ffResult.ok stays false → the flutterfire-dependent patches below are skipped.
+  let ffResult = { ok: false };
+  if (offline) {
+    await writeFirebaseOptionsDevStub(targetDir);
+    steps.push({ name: 'flutterfire', skipped: true, detail: 'offline (stub written)' });
+  } else {
+    onProgress('flutterfire');
+    ffResult = await flutterfireConfigure(targetDir, firebaseProjectId, { includeWeb });
+    steps.push({ name: 'flutterfire', ok: ffResult.ok, detail: ffResult.ok ? null : ffResult.error });
+  }
 
   // After flutterfire: patch Android, iOS and Web config files.
   if (ffResult.ok) {
@@ -421,7 +470,7 @@ async function generateProject(targetDir, backend, options, hooks = {}) {
   // ONLY for FCM push — there is no Firestore there, so deploying firestore:rules
   // is incoherent (it targets a database that doesn't exist) and just hangs for
   // minutes. The data layer for those backends is Supabase/the REST API.
-  if (backend === 'firebase' && firebaseProjectId) {
+  if (!offline && backend === 'firebase' && firebaseProjectId) {
     onProgress('firestore-rules');
     const rulesResult = await deployFirestoreRules(targetDir, firebaseProjectId);
     steps.push({ name: 'firestore-rules', ok: rulesResult.ok, detail: rulesResult.ok ? null : rulesResult.error });

package/lib/utils/i18n/messages-en.js

@@ -336,6 +336,25 @@ module.exports = {
     'new.firebase.success.deployStep': '• Deploy backend (from inside the project folder):',
 
     'cli.command.deploy.description': 'Publish the server to Firebase or Supabase',
+    'cli.command.releaseVersion.description': 'Announce a new app version to existing users (Firebase Remote Config)',
+    'releaseVersion.intro': 'Announce version → Firebase Remote Config',
+    'releaseVersion.notKasy': 'Not a Kasy project (kit_setup.json not found).',
+    'releaseVersion.noFirebase': 'This command needs a Firebase project (firebase.json not found). Run it inside a project with the Firebase backend.',
+    'releaseVersion.noProject': 'Could not detect the Firebase project. Pass --project <id>.',
+    'releaseVersion.current': 'Installed version (pubspec): {version}',
+    'releaseVersion.detectedProject': 'Firebase project: {id}',
+    'releaseVersion.qVersion': 'Which version is now live in the stores?',
+    'releaseVersion.qForced': 'Force this update? (blocks the app until the user updates)',
+    'releaseVersion.forcedHint': 'Only force when an old version is truly broken — a wrong value locks every user out.',
+    'releaseVersion.summaryOptional': 'Optional update → app_latest_version = {version}',
+    'releaseVersion.summaryForced': 'FORCED update → app_min_version = {version} (+ app_latest_version)',
+    'releaseVersion.qConfirm': 'Publish this to Firebase Remote Config?',
+    'releaseVersion.fetching': 'Reading current Remote Config…',
+    'releaseVersion.deploying': 'Publishing to Remote Config…',
+    'releaseVersion.done': 'Done — {version} is live in Remote Config.',
+    'releaseVersion.failed': 'Failed to update Remote Config (is the Firebase CLI installed and are you logged in? try: firebase login).',
+    'releaseVersion.badVersion': 'Enter a valid SemVer like 1.4.0',
+    'releaseVersion.aborted': 'Aborted.',
     'cli.command.configure.description': 'Configure optional keys (RevenueCat, Sentry, Mixpanel...) — skippable, picks up where you left off',
     'configure.title': 'App credential setup',
     'configure.notKasyProject': 'This folder is not a Kasy project (no pubspec.yaml). Cd into the project and run again.',
@@ -1134,6 +1153,10 @@ module.exports = {
     'update.success': 'Feature "{module}" updated successfully.',
     'update.componentsSuccess': 'Base components updated successfully.',
     'update.coreSuccess': 'Core files updated successfully.',
+    'update.mergeHint.title': 'Merge your changes with what is new',
+    'update.mergeHint.body': '{count} file(s) changed. Check with `git diff`. If you had customized any, just merge yours with the new version.',
+    'update.mergeHint.aiPrompt': 'With AI: paste into your assistant → "I ran kasy update; merge my changes from the previous commit with the new kit version in these files, keeping both."',
+    'update.mergeHint.seeAgents': 'Step by step in the project AGENTS.md.',
     'check.intro': 'Kasy Check — Push Notifications',
     'check.firebase.detected': 'Firebase backend',
     'check.firebase.adcInfo': 'Firebase uses Application Default Credentials — no extra setup needed.',

package/lib/utils/i18n/messages-es.js

@@ -338,6 +338,25 @@ module.exports = {
     'new.firebase.success.deployStep': '• Desplegar backend (desde dentro de la carpeta del proyecto):',
 
     'cli.command.deploy.description': 'Publica el servidor en Firebase o Supabase',
+    'cli.command.releaseVersion.description': 'Avisa a los usuarios actuales sobre una nueva versión de la app (Firebase Remote Config)',
+    'releaseVersion.intro': 'Anunciar versión → Firebase Remote Config',
+    'releaseVersion.notKasy': 'No es un proyecto Kasy (kit_setup.json no encontrado).',
+    'releaseVersion.noFirebase': 'Este comando necesita un proyecto Firebase (firebase.json no encontrado). Ejecútalo dentro de un proyecto con backend Firebase.',
+    'releaseVersion.noProject': 'No se pudo detectar el proyecto Firebase. Usa --project <id>.',
+    'releaseVersion.current': 'Versión instalada (pubspec): {version}',
+    'releaseVersion.detectedProject': 'Proyecto Firebase: {id}',
+    'releaseVersion.qVersion': '¿Qué versión está publicada ya en las tiendas?',
+    'releaseVersion.qForced': '¿Forzar esta actualización? (bloquea la app hasta que el usuario actualice)',
+    'releaseVersion.forcedHint': 'Solo fuerza cuando una versión antigua esté realmente rota — un valor incorrecto bloquea a todos los usuarios.',
+    'releaseVersion.summaryOptional': 'Actualización opcional → app_latest_version = {version}',
+    'releaseVersion.summaryForced': 'Actualización OBLIGATORIA → app_min_version = {version} (+ app_latest_version)',
+    'releaseVersion.qConfirm': '¿Publicar esto en Firebase Remote Config?',
+    'releaseVersion.fetching': 'Leyendo el Remote Config actual…',
+    'releaseVersion.deploying': 'Publicando en Remote Config…',
+    'releaseVersion.done': 'Listo — {version} está activo en Remote Config.',
+    'releaseVersion.failed': 'No se pudo actualizar Remote Config (¿está instalado el Firebase CLI y has iniciado sesión? prueba: firebase login).',
+    'releaseVersion.badVersion': 'Ingresa un SemVer válido, como 1.4.0',
+    'releaseVersion.aborted': 'Cancelado.',
     'cli.command.configure.description': 'Configura claves opcionales (RevenueCat, Sentry, Mixpanel...) — puede omitir, recuerda lo que falta',
     'configure.title': 'Configuración de claves del app',
     'configure.notKasyProject': 'Esta carpeta no es un proyecto Kasy (no se encontró pubspec.yaml). Entra en la carpeta del proyecto y ejecuta de nuevo.',
@@ -1132,6 +1151,10 @@ module.exports = {
     'update.success': 'Feature "{module}" actualizada exitosamente.',
     'update.componentsSuccess': 'Componentes base actualizados exitosamente.',
     'update.coreSuccess': 'Archivos de core actualizados exitosamente.',
+    'update.mergeHint.title': 'Combina tus cambios con lo nuevo',
+    'update.mergeHint.body': '{count} archivo(s) cambiaron. Revisa con `git diff`. Si habías personalizado alguno, solo combina el tuyo con la versión nueva.',
+    'update.mergeHint.aiPrompt': 'Con IA: pega en tu asistente → "Ejecuté kasy update; combina mis cambios del commit anterior con la versión nueva del kit en estos archivos, manteniendo ambos."',
+    'update.mergeHint.seeAgents': 'Paso a paso en el AGENTS.md del proyecto.',
     'check.intro': 'Kasy Check — Notificaciones Push',
     'check.firebase.detected': 'Backend Firebase',
     'check.firebase.adcInfo': 'Firebase usa Application Default Credentials — no requiere configuración extra.',

package/lib/utils/i18n/messages-pt.js

@@ -336,6 +336,25 @@ module.exports = {
     'new.firebase.success.deployStep': '• Deploy do backend (de dentro da pasta do projeto):',
 
     'cli.command.deploy.description': 'Publica o servidor no Firebase ou Supabase',
+    'cli.command.releaseVersion.description': 'Avisa os usuários atuais sobre uma nova versão do app (Firebase Remote Config)',
+    'releaseVersion.intro': 'Anunciar versão → Firebase Remote Config',
+    'releaseVersion.notKasy': 'Não é um projeto Kasy (kit_setup.json não encontrado).',
+    'releaseVersion.noFirebase': 'Este comando precisa de um projeto Firebase (firebase.json não encontrado). Rode dentro de um projeto com backend Firebase.',
+    'releaseVersion.noProject': 'Não foi possível detectar o projeto Firebase. Passe --project <id>.',
+    'releaseVersion.current': 'Versão instalada (pubspec): {version}',
+    'releaseVersion.detectedProject': 'Projeto Firebase: {id}',
+    'releaseVersion.qVersion': 'Qual versão já está publicada nas lojas?',
+    'releaseVersion.qForced': 'Forçar esta atualização? (bloqueia o app até o usuário atualizar)',
+    'releaseVersion.forcedHint': 'Só force quando uma versão antiga estiver realmente quebrada — um valor errado trava todos os usuários.',
+    'releaseVersion.summaryOptional': 'Atualização opcional → app_latest_version = {version}',
+    'releaseVersion.summaryForced': 'Atualização OBRIGATÓRIA → app_min_version = {version} (+ app_latest_version)',
+    'releaseVersion.qConfirm': 'Publicar isto no Firebase Remote Config?',
+    'releaseVersion.fetching': 'Lendo o Remote Config atual…',
+    'releaseVersion.deploying': 'Publicando no Remote Config…',
+    'releaseVersion.done': 'Pronto — {version} está no ar no Remote Config.',
+    'releaseVersion.failed': 'Falha ao atualizar o Remote Config (o Firebase CLI está instalado e você fez login? tente: firebase login).',
+    'releaseVersion.badVersion': 'Informe um SemVer válido, tipo 1.4.0',
+    'releaseVersion.aborted': 'Cancelado.',
     'cli.command.configure.description': 'Configura chaves opcionais (RevenueCat, Sentry, Mixpanel...) — pode pular, lembra do que falta',
     'configure.title': 'Configuração de chaves do app',
     'configure.notKasyProject': 'Esta pasta não parece um projeto Kasy (não encontrei pubspec.yaml). Entre na pasta do projeto e rode novamente.',
@@ -1132,6 +1151,10 @@ module.exports = {
     'update.success': 'Feature "{module}" atualizada com sucesso.',
     'update.componentsSuccess': 'Componentes base atualizados com sucesso.',
     'update.coreSuccess': 'Arquivos de core atualizados com sucesso.',
+    'update.mergeHint.title': 'Juntar suas mudanças com o que veio novo',
+    'update.mergeHint.body': '{count} arquivo(s) mudaram. Veja com `git diff`. Se você tinha customizado algum, é só juntar o seu com o novo.',
+    'update.mergeHint.aiPrompt': 'Com IA: cole no seu assistente → "Rodei kasy update; junte minhas mudanças do commit anterior com a versão nova do kit nestes arquivos, mantendo as duas coisas."',
+    'update.mergeHint.seeAgents': 'Passo a passo no AGENTS.md do projeto.',
     'check.intro': 'Kasy Check — Notificações Push',
     'check.firebase.detected': 'Backend Firebase',
     'check.firebase.adcInfo': 'Firebase usa Application Default Credentials — nenhuma configuração extra necessária.',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kasy-cli",
-  "version": "1.34.0",
+  "version": "1.36.0",
   "description": "CLI for scaffolding production-ready Flutter SaaS apps with Firebase, Supabase, or API REST backends.",
   "bin": {
     "kasy": "./bin/kasy.js"
@@ -31,14 +31,17 @@
     "access": "public"
   },
   "scripts": {
-    "prepack": "node scripts/check-feature-patches.js && node scripts/bundle-template.js && node test/generated-matches-kit.test.js && node test/supabase-verify-jwt.test.js && node test/supabase-cors.test.js && node test/supabase-google-web.test.js && node test/backend-pubspec-local-reminders.test.js && node test/stripe-webhook-orphan-guard.test.js && node test/facebook-strip.test.js && node test/path-provider-pin.test.js && node test/features-flags-parity.test.js && node test/apple-web.test.js && node test/facebook.test.js",
+    "prepack": "node scripts/check-feature-patches.js && node scripts/check-backend-patches.js && node scripts/bundle-template.js && node test/generated-matches-kit.test.js && node test/supabase-verify-jwt.test.js && node test/supabase-cors.test.js && node test/supabase-google-web.test.js && node test/backend-pubspec-local-reminders.test.js && node test/stripe-webhook-orphan-guard.test.js && node test/facebook-strip.test.js && node test/path-provider-pin.test.js && node test/features-flags-parity.test.js && node test/apple-web.test.js && node test/facebook.test.js",
     "start": "node ./bin/kasy.js",
     "setup": "node ./bin/kasy.js setup",
     "doctor": "node ./bin/kasy.js doctor",
     "features": "node ./bin/kasy.js features",
     "validate": "node ./bin/kasy.js validate --analyze-only",
+    "validate:backends": "node ./scripts/bundle-template.js && node ./scripts/validate-backends.js",
     "extract:patch": "node ./scripts/extract_patch.js",
     "check:firebase": "node ./scripts/check-firebase-template.js",
+    "patch:check": "node ./scripts/check-backend-patches.js",
+    "patch:bless": "node ./scripts/check-backend-patches.js --bless",
     "test": "for f in test/*.test.js; do node \"$f\" || exit 1; done",
     "test:google-ios": "node ./test/google-ios-url-scheme.test.js",
     "test:apple-release": "node ./test/apple-release.test.js",