Deploy for the first time

One command puts everything on your Firebase project: the Cloud Functions, the security rules and indexes, and the website. It asks a few questions, each with a default.

Before you start

The dependencies are installed (Install) and the project has its alias and web settings (Configure a project).
You are signed in to the Firebase CLI (firebase login) and the project has an alias in .firebaserc (firebase use --add). Name it default for your development project and production for the live one: the website can only be built and deployed from the deploy for those two aliases.
The project is on the Blaze plan, and you can turn on Google Cloud services in it (Owner or Editor). The first deploy turns on the services the functions need, such as Cloud Functions, Cloud Build and Eventarc: see A first deploy to a new project for the list.
You run the deploy in a terminal. Anywhere else (a script, CI) it prints the options instead of asking.

Run the guided deploy

npm run deploy

Press Enter to take the default shown in brackets.

Which Firebase project? Your .firebaserc aliases. The first time, the default is the project chosen with firebase use, else the default alias.
Set it up now? A project with no Arc CMS settings yet is offered a short setup. Answer yes, then:
- Only by Arc CMS (its own website or app): it asks whether to publish the website on the project's main site, and carries on.
- Shared with another app: it sets up a database, website, bucket and folder of Arc CMS's own, prints the commands that create them, and stops. Create them, then run npm run deploy again. See Sharing a Firebase project.
It then shows the settings it will use: the database, the website, the storage bucket and the app users.
What to deploy? It builds the functions first, then lists the choices. Pick Everything: functions, database rules and indexes, storage rules, website. The other choices, including "only the functions changed since the last deploy", are for later deploys: see Deploy.
Deploy? A summary shows the project, the config file, what is deployed and the exact command. For a production project (one marked --production=yes, the alias production, or an id with a part prod, production or live, such as my-site-prod) you type the project id instead of pressing Enter.

Without questions: npm run deploy:dev builds and deploys everything to the default project and publishes the pages, and npm run deploy:prod does the same for production (asking only for its id when that project is marked production). To deploy from CI, see Deploy from CI.

What it deploys, in order

The functions region. With no functions deployed yet, the functions are set to run in the database's region, so every database call stays close (see Regions). It is saved in arccms.config.json and in src/environments/arc-install.ts: commit arc-install.ts afterwards (git ignores arccms.config.json). The website is built after this check, so it calls the functions in their region.
The website build. npm run build, with the web settings of the project being deployed (see Dev, staging and production).
One Firebase deploy of the arccms functions, the Firestore rules and indexes, the storage rules and the hosting files. Before the rules go out, scripts/arc-rules-build.mjs combines the core rules and indexes with your app's own into .arc-build/. When the project has generated settings (firebase.{projectId}.json), the deploy uses them.
A retry of any function that failed or that Google's per-minute limit on changes held back. A first deploy creates every function at once, so this is common: it waits about a minute and deploys just those, twice at most. The database triggers fail at first while Google sets up Eventarc for the project; for those it waits 5 minutes. If something still fails, the website is not deployed, and the deploy says what to run (see A first deploy to a new project).
A reachability check of every callable function it created.
The generated pages. It publishes the static pages, the content pages, the sitemap and the feeds to the site.

Storage rules are skipped when Arc CMS shares the default bucket with another app, and the website is skipped when hosting is off for the project.

Plain firebase deploy skips your install settings (its database, website and bucket), the functions build and the retries. Always deploy through npm run deploy.

Check that it worked

The deploy ends with Done:, the choice and the project. Any other ending says what failed.
No line says a new callable is blocked. If one does, delete that function in the Firebase console and deploy again: a fresh create grants the access. See Troubleshooting.
In the Firebase console, Functions lists functions named arccms- followed by the function name.
Your site opens at https://YOUR_PROJECT.web.app. Then create the first admin: Create the first admin.

Next time, deploy only what changed: Deploy only what changed.