@mpgd/cli 0.58.0 → 0.61.0

package/dist/index.js

@@ -33,7 +33,10 @@ import { runMicrosoftStoreSubmissionPreflight } from './microsoft-store-submissi
 import { defaultOfflinePlaytestArtifactDir, defaultOfflinePlaytestMaximumBytes, defaultOfflinePlaytestOutputDir, runOfflinePlaytestPackaging, } from './offline-playtest.js';
 import { targetConfigExtensionsFileEnv, targetConfigMatrixFileEnv } from './target-config-env.js';
 import { readStoreCredential, runNativeDeployment } from './native-deploy-run.js';
-import { submitRecordedNativeTarget } from './native-deploy-submission.js';
+import { isNativeDeployApproved, planRecordedAndroidSubmission, submitRecordedNativeTarget, } from './native-deploy-submission.js';
+import { createPlayReleaseRequest, parsePlayUserFraction, readPlayReleaseNotesFile, } from './play-release-options.js';
+import { promotePlayRelease } from './play-release-promote.js';
+import { changePlayRollout } from './play-release-rollout.js';
 import { readNativeReleaseStatus as readNativeReleaseStatusForCli } from './release-state.js';
 export { renderGameAcceptanceMarkdown, resolveGameAcceptanceReleaseManifestFile, runGameAcceptance, defaultGameAcceptanceCommandTimeoutMs, maximumGameplayE2EReportBytes, } from './game-acceptance.js';
 export { maximumPerformanceEvidenceBytes, preparePerformanceAcceptance, readPerformanceAcceptanceEvidence, validatePerformanceBudget, } from './performance-acceptance.js';
@@ -43,8 +46,11 @@ export { installPinnedReleaseDependencies, pinNativeDeploymentPlan, preparePinne
 export { withAndroidUploadSigningSession, } from './android-signing-session.js';
 export { checkpointNativeSubmission, readNativeReleaseStatus, reclaimNativeSubmission, releaseNativeSubmissionLease, recordNativeReleaseBuild, reserveNativeRelease, } from './release-state.js';
 export { runNativeDeployment, readStoreCredential, } from './native-deploy-run.js';
-export { submitRecordedNativeTarget, } from './native-deploy-submission.js';
-export { PlaySubmissionUncertainError, submitVerifiedAndroidBundle, } from './play-internal-submission.js';
+export { planRecordedAndroidSubmission, submitRecordedNativeTarget, } from './native-deploy-submission.js';
+export { PlaySubmissionUncertainError, planVerifiedAndroidBundleSubmission, submitVerifiedAndroidBundle, } from './play-internal-submission.js';
+export { createPlayReleaseRequest, defaultPlayReleaseRequest, maximumPlayReleaseNoteCharacters, parsePlayReleaseNotes, } from './play-release-options.js';
+export { PlayPromoteUncertainError, promotePlayRelease, } from './play-release-promote.js';
+export { PlayRolloutUncertainError, changePlayRollout, } from './play-release-rollout.js';
 export { IosSubmissionUncertainError, submitVerifiedIosBuild, } from './testflight-submission.js';
 export { createBrowserGameplayE2EDriver, } from './browser-gameplay-e2e.js';
 export { collectGameplayE2EPathEvidence, defaultGameplayE2EReportFile, maximumGameplayE2EStates, parseGameplayE2EPlan, readGameplayE2EPlan, renderGameplayE2EMarkdown, resolveGameplayE2EReportFile, runGameplayE2E, } from './gameplay-e2e.js';
@@ -446,7 +452,35 @@ const deployCommand = defineI18n({
                 'game-id': { type: 'string', required: true, description: 'Explicit release ledger game ID.' },
                 release: { type: 'string', required: true, description: 'Explicit release ID.' },
                 target: { type: 'string', required: true, description: 'android or ios.' },
-                approve: { type: 'boolean', required: false, description: 'Approve internal test submission.' },
+                approve: { type: 'boolean', required: false, description: 'Approve the store submission; needed for any Play track but internal.' },
+                track: {
+                    type: 'string', required: false,
+                    description: 'Android: Google Play track (internal, alpha, beta, production or a closed-testing track name); defaults to internal.',
+                },
+                status: {
+                    type: 'string', required: false,
+                    description: 'Android: release status draft, completed (default) or inProgress (staged rollout).',
+                },
+                'user-fraction': {
+                    type: 'string', required: false,
+                    description: 'Android: staged rollout fraction for --status inProgress, greater than 0 and less than 1.',
+                },
+                'release-notes': {
+                    type: 'string', required: false,
+                    description: 'Android: release notes file, Play Console <en-US>…</en-US> blocks or JSON; 500 characters per language.',
+                },
+                'confirm-production': {
+                    type: 'boolean', required: false,
+                    description: 'Android: confirm a production release or staged rollout.',
+                },
+                'mapping-file': {
+                    type: 'string', required: false,
+                    description: 'Android: R8 mapping.txt of this exact build, uploaded as its deobfuscation file.',
+                },
+                'dry-run': {
+                    type: 'boolean', required: false,
+                    description: 'Android: verify the build and print the planned Play edit without any store call.',
+                },
             },
             run: async (ctx) => {
                 const game = readOptionalString(ctx.values.game);
@@ -455,12 +489,136 @@ const deployCommand = defineI18n({
                 if (target !== 'android' && target !== 'ios') {
                     throw new Error('--target must be android or ios.');
                 }
+                const androidRelease = await readPlayReleaseOptions(ctx.values, target === 'android');
+                const gameId = readRequiredCliOption(ctx.values['game-id'], '--game-id');
+                const releaseKey = readRequiredCliOption(ctx.values.release, '--release');
+                if (ctx.values['dry-run'] === true) {
+                    if (target !== 'android') {
+                        throw new Error('--dry-run is available for --target android.');
+                    }
+                    const planned = await planRecordedAndroidSubmission({
+                        plan, gameId, releaseKey,
+                        ...(androidRelease === undefined ? {} : { androidRelease }),
+                    });
+                    console.info(JSON.stringify(planned, null, 2));
+                    return;
+                }
                 const result = await submitRecordedNativeTarget({
                     plan,
-                    gameId: readRequiredCliOption(ctx.values['game-id'], '--game-id'),
-                    releaseKey: readRequiredCliOption(ctx.values.release, '--release'),
+                    gameId,
+                    releaseKey,
                     credential: readStoreCredential(plan, target, process.env),
-                    approved: isDeployApproved(plan, ctx.values.approve === true),
+                    approved: isNativeDeployApproved(plan, ctx.values.approve === true, androidRelease),
+                    ...(androidRelease === undefined ? {} : { androidRelease }),
+                    ...(ctx.values['confirm-production'] === true ? { confirmProduction: true } : {}),
+                    onDraftAppFallback: reportPlayDraftAppFallback,
+                });
+                console.info(JSON.stringify(result, null, 2));
+            },
+        }),
+        rollout: defineI18n({
+            name: 'rollout',
+            description: 'Update, halt, resume or complete a Google Play release already on a track.',
+            resource: commandResource({
+                en: 'Update, halt, resume or complete a Google Play release already on a track.',
+                ko: '트랙에 이미 있는 Google Play 릴리스의 배포 비율을 변경·중지·재개·완료합니다.',
+            }),
+            args: {
+                plan: { type: 'string', required: true, description: 'Saved deployment plan JSON (package ID and credential).' },
+                game: { type: 'string', required: false, description: 'Current game directory if the plan moved.' },
+                track: { type: 'string', required: true, description: 'Google Play track whose release changes; no other track is touched.' },
+                action: { type: 'string', required: true, description: 'update, halt, resume or complete.' },
+                'version-code': { type: 'string', required: false, description: 'Release to change; defaults to the only release the action applies to.' },
+                'user-fraction': { type: 'string', required: false, description: 'New rollout fraction for update (or resume), greater than 0 and less than 1.' },
+                approve: { type: 'boolean', required: false, description: 'Approve the rollout change.' },
+                'confirm-production': { type: 'boolean', required: false, description: 'Confirm a production change or a running staged rollout.' },
+                'dry-run': { type: 'boolean', required: false, description: 'Read the track and print the planned update; the edit is discarded.' },
+            },
+            run: async (ctx) => {
+                const game = readOptionalString(ctx.values.game);
+                const plan = readNativeDeploymentPlan(readRequiredCliOption(ctx.values.plan, '--plan'), game === undefined ? undefined : path.resolve(game));
+                const android = plan.targets.find((entry) => entry.target === 'android');
+                if (android === undefined) {
+                    throw new Error('The deployment plan has no Android target.');
+                }
+                const dryRun = ctx.values['dry-run'] === true;
+                if (!dryRun && ctx.values.approve !== true) {
+                    throw new Error('Changing a Google Play rollout requires --approve.');
+                }
+                const action = readRequiredCliOption(ctx.values.action, '--action');
+                const versionCode = readOptionalString(ctx.values['version-code']);
+                const userFraction = readOptionalString(ctx.values['user-fraction']);
+                if (versionCode !== undefined && !/^[1-9]\d{0,15}$/u.test(versionCode)) {
+                    throw new Error('--version-code must be a positive integer.');
+                }
+                const credential = readStoreCredential(plan, 'android', process.env);
+                if (credential.target !== 'android') {
+                    throw new Error('Google Play rollout needs the Android submission credential.');
+                }
+                const result = await changePlayRollout({
+                    packageName: android.appId,
+                    serviceAccountFile: credential.serviceAccountFile,
+                    track: readRequiredCliOption(ctx.values.track, '--track'),
+                    action,
+                    ...(versionCode === undefined ? {} : { versionCode: Number(versionCode) }),
+                    ...(userFraction === undefined ? {} : { userFraction: parsePlayUserFraction(userFraction) }),
+                    ...(ctx.values['confirm-production'] === true ? { confirmProduction: true } : {}),
+                    dryRun,
+                });
+                console.info(JSON.stringify(result, null, 2));
+            },
+        }),
+        promote: defineI18n({
+            name: 'promote',
+            description: 'Promote a Google Play release from one track to another without uploading.',
+            resource: commandResource({
+                en: 'Promote a Google Play release from one track to another without uploading.',
+                ko: '업로드 없이 Google Play 릴리스를 다른 트랙으로 승격합니다.',
+            }),
+            args: {
+                plan: { type: 'string', required: true, description: 'Saved deployment plan JSON (package ID and credential).' },
+                game: { type: 'string', required: false, description: 'Current game directory if the plan moved.' },
+                from: { type: 'string', required: true, description: 'Source Google Play track holding the tested release.' },
+                to: { type: 'string', required: true, description: 'Target Google Play track; the only track that changes.' },
+                'version-code': { type: 'string', required: false, description: "Version code to promote; defaults to the source track's only completed release." },
+                status: { type: 'string', required: false, description: 'Target release status: completed (default), draft or inProgress (staged rollout).' },
+                'user-fraction': { type: 'string', required: false, description: 'Staged rollout fraction for --status inProgress, greater than 0 and less than 1.' },
+                'release-notes': { type: 'string', required: false, description: "Release notes file; defaults to the source release's notes." },
+                approve: { type: 'boolean', required: false, description: 'Approve the promotion.' },
+                'confirm-production': { type: 'boolean', required: false, description: 'Confirm a production promotion or staged rollout.' },
+                'dry-run': { type: 'boolean', required: false, description: 'Read both tracks and print the planned update; the edit is discarded.' },
+            },
+            run: async (ctx) => {
+                const game = readOptionalString(ctx.values.game);
+                const plan = readNativeDeploymentPlan(readRequiredCliOption(ctx.values.plan, '--plan'), game === undefined ? undefined : path.resolve(game));
+                const android = plan.targets.find((entry) => entry.target === 'android');
+                if (android === undefined) {
+                    throw new Error('The deployment plan has no Android target.');
+                }
+                const dryRun = ctx.values['dry-run'] === true;
+                const versionCode = readOptionalString(ctx.values['version-code']);
+                if (versionCode !== undefined && !/^[1-9]\d{0,15}$/u.test(versionCode)) {
+                    throw new Error('--version-code must be a positive integer.');
+                }
+                const status = readOptionalString(ctx.values.status);
+                const userFraction = readOptionalString(ctx.values['user-fraction']);
+                const notesFile = readOptionalString(ctx.values['release-notes']);
+                const credential = readStoreCredential(plan, 'android', process.env);
+                if (credential.target !== 'android') {
+                    throw new Error('Google Play promote needs the Android submission credential.');
+                }
+                const result = await promotePlayRelease({
+                    packageName: android.appId,
+                    serviceAccountFile: credential.serviceAccountFile,
+                    fromTrack: readRequiredCliOption(ctx.values.from, '--from'),
+                    toTrack: readRequiredCliOption(ctx.values.to, '--to'),
+                    ...(versionCode === undefined ? {} : { versionCode: Number(versionCode) }),
+                    ...(status === undefined ? {} : { status: status }),
+                    ...(userFraction === undefined ? {} : { userFraction: parsePlayUserFraction(userFraction) }),
+                    ...(notesFile === undefined ? {} : { releaseNotes: readPlayReleaseNotesFile(notesFile) }),
+                    ...(ctx.values['confirm-production'] === true ? { confirmProduction: true } : {}),
+                    approved: ctx.values.approve === true,
+                    dryRun,
                 });
                 console.info(JSON.stringify(result, null, 2));
             },
@@ -482,11 +640,32 @@ const deployCommand = defineI18n({
                     type: 'string', required: false,
                     description: 'Initial version ledger JSON; only for the first release.',
                 },
-                approve: { type: 'boolean', required: false, description: 'Approve internal test submission.' },
+                approve: { type: 'boolean', required: false, description: 'Approve the store submission; needed for any Play track but internal.' },
+                track: {
+                    type: 'string', required: false,
+                    description: 'Android: Google Play track (internal, alpha, beta, production or a closed-testing track name); defaults to internal.',
+                },
+                status: {
+                    type: 'string', required: false,
+                    description: 'Android: release status draft, completed (default) or inProgress (staged rollout).',
+                },
+                'user-fraction': {
+                    type: 'string', required: false,
+                    description: 'Android: staged rollout fraction for --status inProgress, greater than 0 and less than 1.',
+                },
+                'release-notes': {
+                    type: 'string', required: false,
+                    description: 'Android: release notes file, Play Console <en-US>…</en-US> blocks or JSON; 500 characters per language.',
+                },
+                'confirm-production': {
+                    type: 'boolean', required: false,
+                    description: 'Android: confirm a production release or staged rollout.',
+                },
             },
             run: async (ctx) => {
                 const game = readOptionalString(ctx.values.game);
                 const plan = readNativeDeploymentPlan(readRequiredCliOption(ctx.values.plan, '--plan'), game === undefined ? undefined : path.resolve(game));
+                const androidRelease = await readPlayReleaseOptions(ctx.values, plan.targets.some((entry) => entry.target === 'android'));
                 const infoFile = path.join(packageRoot, 'dist/native-build-info.json');
                 const info = readJsonForCli(infoFile, 'native builder metadata');
                 assertJsonObject(info, 'native builder package metadata');
@@ -512,7 +691,10 @@ const deployCommand = defineI18n({
                     ...(initialLedgerFile === undefined ? {} : {
                         initialLedger: assertPlatformVersionLedger(readJsonForCli(path.resolve(initialLedgerFile), 'initial version ledger')),
                     }),
-                    approved: isDeployApproved(plan, ctx.values.approve === true),
+                    approved: isNativeDeployApproved(plan, ctx.values.approve === true, androidRelease),
+                    ...(androidRelease === undefined ? {} : { androidRelease }),
+                    ...(ctx.values['confirm-production'] === true ? { confirmProduction: true } : {}),
+                    onDraftAppFallback: reportPlayDraftAppFallback,
                     ...(recordedBuildMarker === undefined ? {} : {
                         onBuildRecorded: (target) => {
                             writeFileSync(recordedBuildMarker, target, { flag: 'wx', mode: 0o600 });
@@ -1628,8 +1810,8 @@ const targetCommand = defineI18n({
                     ko: '프로덕션 HTTPS Game Services 기본 URL.',
                 },
                 providers: {
-                    en: 'Comma-separated provider IDs. play-billing (Android) and storekit (iOS) install the kit store plugin into the shell and the game, register it with cap sync, and wire an unwired template gateway; notifications installs the Firebase messaging and local notifications plugins for Android and iOS and wires a template gateway; other IDs are recorded only.',
-                    ko: '쉼표로 구분한 provider ID. play-billing(Android)과 storekit(iOS)은 키트 스토어 플러그인을 셸과 게임에 설치하고 cap sync로 등록하며, 연결되지 않은 템플릿 게이트웨이를 연결합니다. notifications는 Android·iOS용 Firebase 메시징과 로컬 알림 플러그인을 설치하고 템플릿 게이트웨이를 연결합니다. 다른 ID는 기록만 합니다.',
+                    en: 'Comma-separated provider IDs. play-billing (Android) and storekit (iOS) install the kit store plugin into the shell and the game, register it with cap sync, and wire an unwired template gateway; notifications installs the Firebase messaging and local notifications plugins for Android and iOS and wires a template gateway; crash-reporting installs the Firebase Crashlytics plugin into the shell and its Gradle plugin into a new Android project; other IDs are recorded only.',
+                    ko: '쉼표로 구분한 provider ID. play-billing(Android)과 storekit(iOS)은 키트 스토어 플러그인을 셸과 게임에 설치하고 cap sync로 등록하며, 연결되지 않은 템플릿 게이트웨이를 연결합니다. notifications는 Android·iOS용 Firebase 메시징과 로컬 알림 플러그인을 설치하고 템플릿 게이트웨이를 연결합니다. crash-reporting은 Firebase Crashlytics 플러그인을 셸에, Crashlytics Gradle 플러그인을 새 Android 프로젝트에 설치합니다. 다른 ID는 기록만 합니다.',
                 },
             }),
             args: {
@@ -1677,7 +1859,7 @@ const targetCommand = defineI18n({
                 providers: {
                     type: 'string',
                     required: false,
-                    description: 'Comma-separated provider IDs. play-billing (Android) and storekit (iOS) install the kit store plugin into the shell and the game, register it with cap sync, and wire an unwired template gateway; notifications installs the Firebase messaging and local notifications plugins for Android and iOS and wires a template gateway; other IDs are recorded only.',
+                    description: 'Comma-separated provider IDs. play-billing (Android) and storekit (iOS) install the kit store plugin into the shell and the game, register it with cap sync, and wire an unwired template gateway; notifications installs the Firebase messaging and local notifications plugins for Android and iOS and wires a template gateway; crash-reporting installs the Firebase Crashlytics plugin into the shell and its Gradle plugin into a new Android project; other IDs are recorded only.',
                 },
             },
             run: (ctx) => {
@@ -1729,6 +1911,11 @@ const targetCommand = defineI18n({
                             + plan.notificationPlugins.map((plugin) => `${plugin.packageName}@${plugin.version}`).join(', ')
                             + ` into the shell for android and ios${dryRun ? '; cap add or cap sync registers them' : ''}.`);
                     }
+                    if (plan.crashReportingPlugins.length > 0) {
+                        console.info(`${dryRun ? 'Would install' : 'Installed'} crash reporting plugin `
+                            + plan.crashReportingPlugins.map((plugin) => `${plugin.packageName}@${plugin.version}`).join(', ')
+                            + ` into the shell for android and ios${dryRun ? '; cap add or cap sync registers it' : ''}.`);
+                    }
                     for (const warning of plan.warnings) {
                         console.warn(`Warning: ${warning}`);
                     }
@@ -4103,8 +4290,28 @@ function renderHostedPwaVerificationMarkdown(verification) {
         '',
     ].join('\n');
 }
-function isDeployApproved(plan, approveFlag) {
-    return plan.approval === 'preapproved-internal-test' || approveFlag;
+/** Google Play release flags; undefined when none is given (the original internal path). */
+async function readPlayReleaseOptions(values, android) {
+    const track = readOptionalString(values.track);
+    const status = readOptionalString(values.status);
+    const userFraction = readOptionalString(values['user-fraction']);
+    const releaseNotesFile = readOptionalString(values['release-notes']);
+    const mappingFile = readOptionalString(values['mapping-file']);
+    if (track === undefined && status === undefined && userFraction === undefined
+        && releaseNotesFile === undefined && mappingFile === undefined) {
+        return undefined;
+    }
+    if (!android) {
+        throw new Error('--track, --status, --user-fraction, --release-notes and --mapping-file '
+            + 'apply only to an Android (Google Play) target.');
+    }
+    return createPlayReleaseRequest({ track, status, userFraction, releaseNotesFile, mappingFile });
+}
+function reportPlayDraftAppFallback(track) {
+    console.warn(`Google Play accepts only draft releases until this app's first release is rolled out, `
+        + `so the ${track} release is committed as a draft. Open that draft release in Play Console `
+        + 'and roll it out once (docs/GOOGLE_PLAY_RELEASES.md#draft-apps); later submissions can use '
+        + 'their normal status.');
 }
 function readRequiredCliOption(value, label) {
     const read = readOptionalString(value);

package/dist/ios-ipa-inspection.js

@@ -4,6 +4,84 @@ import { existsSync, mkdtempSync, readFileSync, rmSync, statSync } from "node:fs
 import { tmpdir } from "node:os";
 import path from "node:path";
 
+// packages/cli/src/native-shell-store-policy.ts
+function readPlistTopLevelValue(plist, key) {
+  const masked = plist.replace(/<!--[\s\S]*?-->/gu, (comment) => comment.replace(/[^\n]/gu, " "));
+  const marker = new RegExp(`<key>\\s*${escapeRegExp(key)}\\s*</key>\\s*`, "u").exec(masked);
+  if (marker === null) {
+    return void 0;
+  }
+  const start = marker.index + marker[0].length;
+  const open = /^<([A-Za-z]+)\s*(\/?)>/u.exec(masked.slice(start));
+  if (open === null) {
+    throw new Error(`Info.plist key ${key} has no readable value.`);
+  }
+  const tag = open[1] ?? "";
+  if (open[2] === "/") {
+    const end = start + open[0].length;
+    return { start, end, xml: plist.slice(start, end) };
+  }
+  let depth = 0;
+  const tags = new RegExp(`<(/?)${tag}\\b[^>]*?(/?)>`, "gu");
+  tags.lastIndex = start;
+  for (let match = tags.exec(masked); match !== null; match = tags.exec(masked)) {
+    if (match[2] === "/") {
+      continue;
+    }
+    depth += match[1] === "/" ? -1 : 1;
+    if (depth === 0) {
+      const end = match.index + match[0].length;
+      return { start, end, xml: plist.slice(start, end) };
+    }
+  }
+  throw new Error(`Info.plist key ${key} has an unclosed value.`);
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+}
+var iosPortrait = "UIInterfaceOrientationPortrait";
+var iosPortraitUpsideDown = "UIInterfaceOrientationPortraitUpsideDown";
+var iosLandscape = [
+  "UIInterfaceOrientationLandscapeLeft",
+  "UIInterfaceOrientationLandscapeRight"
+];
+var iosIpadOrientations = [
+  iosPortrait,
+  iosPortraitUpsideDown,
+  ...iosLandscape
+];
+var iosAppPrivacyManifestXml = [
+  '<?xml version="1.0" encoding="UTF-8"?>',
+  '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+  '<plist version="1.0">',
+  "<dict>",
+  "	<key>NSPrivacyTracking</key>",
+  "	<false/>",
+  "	<key>NSPrivacyTrackingDomains</key>",
+  "	<array/>",
+  "	<key>NSPrivacyCollectedDataTypes</key>",
+  "	<array/>",
+  "	<key>NSPrivacyAccessedAPITypes</key>",
+  "	<array/>",
+  "</dict>",
+  "</plist>",
+  ""
+].join("\n");
+var iosPushEntitlementsFile = "App.entitlements";
+var iosPushEntitlementsSetting = `App/${iosPushEntitlementsFile}`;
+var iosPushEntitlementsXml = [
+  '<?xml version="1.0" encoding="UTF-8"?>',
+  '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+  '<plist version="1.0">',
+  "<dict>",
+  "	<key>aps-environment</key>",
+  "	<string>development</string>",
+  "</dict>",
+  "</plist>",
+  ""
+].join("\n");
+var iosPushEntitlementStep = `add the Push Notifications capability to the App target in Xcode, or create ios/App/App/${iosPushEntitlementsFile} with <key>aps-environment</key><string>development</string> and set CODE_SIGN_ENTITLEMENTS = ${iosPushEntitlementsSetting} in the App target's Debug and Release build settings (Xcode signs the value from the provisioning profile, production for the App Store)`;
+
 // tools/target/native-inspection-environment.ts
 var allowedInspectionEnvironmentNames = [
   "PATH",
@@ -89,6 +167,16 @@ ${signingInfo.stderr}`;
   if (signingInfo.status !== 0 || /Signature=adhoc/iu.test(signingText) || !signingText.split(/\r?\n/u).some((line) => line.trim() === expectedTeamLine)) {
     throw new Error("iOS app is not signed for the expected development team.");
   }
+  if (input.expectedApsEnvironment !== void 0) {
+    const entitlements = runner.run("codesign", ["-d", "--entitlements", "-", "--xml", appPath]);
+    if (entitlements.status !== 0) {
+      throw new Error("iOS app entitlements could not be read.");
+    }
+    const problem = iosStorePushEntitlementError(readSignedApsEnvironment(entitlements.stdout));
+    if (problem !== void 0) {
+      throw new Error(problem);
+    }
+  }
   const fields = [
     ["bundleId", "CFBundleIdentifier", input.expectedBundleId],
     ["marketingVersion", "CFBundleShortVersionString", input.expectedMarketingVersion],
@@ -117,6 +205,35 @@ ${signingInfo.stderr}`;
   }
   return { ...observed, teamId: input.expectedTeamId, signed: true };
 }
+function readSignedApsEnvironment(codesignOutput) {
+  const start = codesignOutput.search(/<\?xml|<plist\b/u);
+  if (start === -1) {
+    return codesignOutput.trim() === "" ? void 0 : null;
+  }
+  let value;
+  try {
+    value = readPlistTopLevelValue(codesignOutput.slice(start), "aps-environment")?.xml;
+  } catch {
+    return null;
+  }
+  if (value === void 0) {
+    return void 0;
+  }
+  return /^<string>\s*([^<]*?)\s*<\/string>$/u.exec(value)?.[1] ?? null;
+}
+function iosStorePushEntitlementError(apsEnvironment) {
+  if (apsEnvironment === "production") {
+    return void 0;
+  }
+  const fix = "Enable Push Notifications on the App ID in the Apple Developer account, regenerate the App Store provisioning profile (MPGD_IOS_PROVISIONING_PROFILE_FILE), and rebuild (docs/FIREBASE_NOTIFICATIONS.md#4-ios).";
+  if (apsEnvironment === void 0) {
+    return `The store IPA has no aps-environment entitlement although the shell installs @capacitor-firebase/messaging: the provisioning profile that signed it lacks the Push Notifications capability (the App ID has no push, or the profile was generated before it was enabled), so the app never gets an APNs token. ${fix}`;
+  }
+  if (apsEnvironment === "development") {
+    return `The store IPA is signed with aps-environment = development although it is an App Store build: the export used a development provisioning profile, so its APNs token belongs to the sandbox and production pushes never arrive. Export with the App Store distribution profile. ${fix}`;
+  }
+  return `The store IPA's aps-environment entitlement is ${apsEnvironment === null ? "unreadable" : apsEnvironment}, not production, so production pushes never arrive. ${fix}`;
+}
 function assertNoDebugServer(file) {
   const value = JSON.parse(readFileSync(file, "utf8"));
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
@@ -147,5 +264,7 @@ function runCommand(command, args) {
 export {
   inspectSignedIosApplication,
   inspectSignedIosArchive,
-  inspectSignedIosIpa
+  inspectSignedIosIpa,
+  iosStorePushEntitlementError,
+  readSignedApsEnvironment
 };

package/dist/native-build-info.json

@@ -1,5 +1,5 @@
 {
-  "kitGitSha": "f90c1b77055c4700195f5e393c3c17b6db23f9bc",
+  "kitGitSha": "91eca22c2b6fa735925b3d18da6684422f942d15",
   "kitDirty": false,
-  "packageVersion": "0.58.0"
+  "packageVersion": "0.61.0"
 }