@mpgd/cli 0.59.0 → 0.61.1

package/dist/native-deploy-run.d.ts

@@ -2,6 +2,7 @@ import type { PlatformVersionLedger } from '@mpgd/target-config';
 import { type NativeDeploymentPlan, type NativeDeployTarget } from './deploy-planning.js';
 import { type NativeStoreCredential } from './native-deploy-submission.js';
 import { type NativeReleaseStatus } from './release-state.js';
+import { type PlayReleaseRequest } from './play-release-options.js';
 export interface RunNativeDeploymentInput {
   readonly plan: NativeDeploymentPlan;
   readonly releaseKey: string;
@@ -14,6 +15,11 @@ export interface RunNativeDeploymentInput {
   /** Required only when no game ledger exists on release-state. */
   readonly initialLedger?: PlatformVersionLedger;
   readonly approved: boolean;
+  /** Google Play track, status, rollout and notes for the Android target. */
+  readonly androidRelease?: PlayReleaseRequest;
+  /** Confirms a production release or staged rollout (`--confirm-production`). */
+  readonly confirmProduction?: boolean;
+  readonly onDraftAppFallback?: (track: string) => void;
   readonly environment?: NodeJS.ProcessEnv;
   readonly signal?: AbortSignal;
   /** Called only after a newly built target has an immutable, committed build record. */

package/dist/native-deploy-run.js

@@ -4,16 +4,24 @@ import path from 'node:path';
 import { doctorNativeDeployment, readNativeDeployCredentialNames, readNativeDeployTargetProfile, } from './deploy-planning.js';
 import { withAndroidUploadSigningSession } from './android-signing-session.js';
 import { withIosSigningSession } from './ios-signing-session.js';
-import { submitRecordedNativeTarget, } from './native-deploy-submission.js';
+import { assertSettledAndroidReleaseOptions, submitRecordedNativeTarget, } from './native-deploy-submission.js';
 import { isNativeSubmissionSettled, readNativeReleaseStatus, recordNativeReleaseBuild, reserveNativeRelease, } from './release-state.js';
 import { installPinnedReleaseDependencies, pinNativeDeploymentPlan, runPinnedNativeBuild, withPinnedReleaseWorkspace, } from './release-workspace.js';
 import { inspectAndroidBundleSigner } from './android-bundle-signer.js';
+import { assertPlayReleaseConfirmed, assertPlayReleaseRequest, } from './play-release-options.js';
 const gitAuthEnvironmentNames = ['GITHUB_TOKEN', 'GH_TOKEN', 'GIT_ASKPASS'];
 /** Reserve once, build only missing targets, then submit the recorded binaries. */
 export async function runNativeDeployment(input) {
     if (!input.approved) {
         throw new Error('Native deployment requires explicit internal-test approval.');
     }
+    if (input.androidRelease !== undefined) {
+        // Refuse an unconfirmed production release before reserving or building anything.
+        assertPlayReleaseRequest(input.androidRelease);
+        if (input.plan.targets.some((entry) => entry.target === 'android')) {
+            assertPlayReleaseConfirmed(input.androidRelease, input.confirmProduction === true);
+        }
+    }
     const environment = input.environment ?? process.env;
     const pinned = await pinNativeDeploymentPlan(input.plan, input.kit, {
         environment,
@@ -36,6 +44,8 @@ export async function runNativeDeployment(input) {
             throw error;
         }
     }
+    // Refuse changed Play options for a committed release before any build work.
+    assertSettledAndroidReleaseOptions(existing?.submissions.android, input.androidRelease);
     const pendingSteps = existing === undefined
         ? {
             buildTargets: input.plan.targets.map((entry) => entry.target),
@@ -126,6 +136,7 @@ export async function runNativeDeployment(input) {
         }
         const submission = status.submissions[entry.target];
         if (submission !== undefined && isNativeSubmissionSettled(submission.status)) {
+            assertSettledAndroidReleaseOptions(submission, input.androidRelease);
             continue;
         }
         await submitRecordedNativeTarget({
@@ -134,6 +145,13 @@ export async function runNativeDeployment(input) {
             releaseKey: input.releaseKey,
             credential: readStoreCredential(input.plan, entry.target, environment),
             approved: input.approved,
+            ...(input.androidRelease === undefined ? {} : { androidRelease: input.androidRelease }),
+            ...(input.confirmProduction === undefined ? {} : {
+                confirmProduction: input.confirmProduction,
+            }),
+            ...(input.onDraftAppFallback === undefined ? {} : {
+                onDraftAppFallback: input.onDraftAppFallback,
+            }),
             environment,
             ...(input.signal === undefined ? {} : { signal: input.signal }),
         });

package/dist/native-deploy-submission.d.ts

@@ -1,6 +1,7 @@
 import type { NativeDeploymentPlan } from './deploy-planning.js';
 import { checkpointNativeSubmission, readNativeReleaseStatus, reclaimNativeSubmission, releaseNativeSubmissionLease, type ImmutableNativeBuildRecord, type NativeSubmissionCheckpoint } from './release-state.js';
-import { submitVerifiedAndroidBundle } from './play-internal-submission.js';
+import { submitVerifiedAndroidBundle, type PlaySubmissionPlan } from './play-internal-submission.js';
+import { type PlayReleaseRequest } from './play-release-options.js';
 import { submitVerifiedIosBuild } from './testflight-submission.js';
 export type NativeStoreCredential = {
   readonly target: 'android';
@@ -19,6 +20,12 @@ export interface SubmitRecordedNativeTargetInput {
   readonly releaseKey: string;
   readonly credential: NativeStoreCredential;
   readonly approved: boolean;
+  /** Google Play track, status, rollout, notes and mapping; defaults to internal/completed. */
+  readonly androidRelease?: PlayReleaseRequest;
+  /** Confirms a production release or staged rollout (`--confirm-production`). */
+  readonly confirmProduction?: boolean;
+  /** Called when Play accepts only a draft because the app was never published. */
+  readonly onDraftAppFallback?: (track: string) => void;
   /** Allows the same caller to continue an in-process attempt without taking over its lease. */
   readonly attemptId?: string;
   readonly environment?: NodeJS.ProcessEnv;
@@ -33,8 +40,20 @@ export interface NativeSubmissionPorts {
   readonly submitAndroid: typeof submitVerifiedAndroidBundle;
   readonly submitIos: typeof submitVerifiedIosBuild;
 }
+/**
+* `--approve`, or the profile's `preapproved-internal-test`. That preapproval
+* covers only the internal track: any other Google Play track needs `--approve`.
+*/
+export declare function isNativeDeployApproved(plan: Pick<NativeDeploymentPlan, 'approval'>, approveFlag: boolean, androidRelease?: Pick<PlayReleaseRequest, 'track'>): boolean;
+/**
+* A committed Android release is never re-sent, so a request with other
+* Google Play options must fail instead of being skipped as done.
+*/
+export declare function assertSettledAndroidReleaseOptions(checkpoint: NativeSubmissionCheckpoint | undefined, androidRelease: PlayReleaseRequest | undefined): void;
 /** Resume exactly one verified build; never rebuild or allocate another version here. */
 export declare function submitRecordedNativeTarget(input: SubmitRecordedNativeTargetInput): Promise<NativeSubmissionCheckpoint>;
+/** Verify one recorded Android build and print its Play edit without any store call. */
+export declare function planRecordedAndroidSubmission(input: Omit<SubmitRecordedNativeTargetInput, 'credential' | 'approved'>, readStatus?: typeof readNativeReleaseStatus): Promise<PlaySubmissionPlan>;
 export declare function submitRecordedNativeTargetWithPorts(input: SubmitRecordedNativeTargetInput, ports: NativeSubmissionPorts): Promise<NativeSubmissionCheckpoint>;
 /** Validate the workflow-restored manifest against the immutable release-state hash. */
 export declare function verifyRecordedReleaseManifest(gameRoot: string, record: Pick<ImmutableNativeBuildRecord, 'artifactLocation' | 'releaseManifestSha256' | 'target'>): void;

package/dist/native-deploy-submission.js

@@ -2,7 +2,8 @@ import { createHash, randomBytes } from 'node:crypto';
 import { readFileSync, realpathSync, statSync } from 'node:fs';
 import path from 'node:path';
 import { checkpointNativeSubmission, freshSubmissionLeaseExpiresAt, isNativeSubmissionSettled, readNativeReleaseStatus, reclaimNativeSubmission, releaseNativeSubmissionLease, } from './release-state.js';
-import { PlaySubmissionUncertainError, submitVerifiedAndroidBundle, } from './play-internal-submission.js';
+import { planVerifiedAndroidBundleSubmission, PlaySubmissionUncertainError, submitVerifiedAndroidBundle, } from './play-internal-submission.js';
+import { assertPlayReleaseConfirmed, assertPlayReleaseRequest, defaultPlayReleaseRequest, defaultPlayTrack, playReleaseRequestDigest, } from './play-release-options.js';
 import { IosSubmissionUncertainError, submitVerifiedIosBuild, } from './testflight-submission.js';
 const productionPorts = {
     readStatus: readNativeReleaseStatus,
@@ -12,23 +13,56 @@ const productionPorts = {
     submitAndroid: submitVerifiedAndroidBundle,
     submitIos: submitVerifiedIosBuild,
 };
+/**
+ * `--approve`, or the profile's `preapproved-internal-test`. That preapproval
+ * covers only the internal track: any other Google Play track needs `--approve`.
+ */
+export function isNativeDeployApproved(plan, approveFlag, androidRelease) {
+    const internalOnly = androidRelease === undefined || androidRelease.track === defaultPlayTrack;
+    return approveFlag || (plan.approval === 'preapproved-internal-test' && internalOnly);
+}
+/**
+ * A committed Android release is never re-sent, so a request with other
+ * Google Play options must fail instead of being skipped as done.
+ */
+export function assertSettledAndroidReleaseOptions(checkpoint, androidRelease) {
+    if (checkpoint?.target === 'android' && isNativeSubmissionSettled(checkpoint.status)
+        && checkpoint.playReleaseSha256
+            !== playReleaseRequestDigest(androidRelease ?? defaultPlayReleaseRequest)) {
+        throw new Error('This release was already committed to Google Play with other release options; '
+            + 'change it with "mpgd deploy rollout" or submit a new release.');
+    }
+}
 /** Resume exactly one verified build; never rebuild or allocate another version here. */
 export async function submitRecordedNativeTarget(input) {
     return submitRecordedNativeTargetWithPorts(input, productionPorts);
 }
-export async function submitRecordedNativeTargetWithPorts(input, ports) {
-    const target = input.credential.target;
+/** Verify one recorded Android build and print its Play edit without any store call. */
+export async function planRecordedAndroidSubmission(input, readStatus = readNativeReleaseStatus) {
+    const recorded = await readRecordedSubmission(input, 'android', readStatus);
+    if (input.environment?.MPGD_VERIFY_RELEASE_MANIFEST === '1') {
+        verifyRecordedReleaseManifest(input.plan.gameRoot, recorded.record);
+    }
+    return planVerifiedAndroidBundleSubmission({
+        record: recorded.record,
+        aabFile: recorded.artifactFile,
+        packageName: recorded.planned.appId,
+        ...(input.androidRelease === undefined ? {} : { release: input.androidRelease }),
+        ...(input.signal === undefined ? {} : { signal: input.signal }),
+    });
+}
+async function readRecordedSubmission(input, target, readStatus) {
     const planned = input.plan.targets.find((entry) => entry.target === target);
-    if (planned === undefined || !input.approved) {
+    if (planned === undefined) {
         throw new Error('Native store submission requires a planned target and explicit approval.');
     }
-    const stateInput = {
+    const status = await readStatus({
         gameRoot: input.plan.gameRoot,
         gameId: input.gameId,
+        releaseKey: input.releaseKey,
         ...(input.environment === undefined ? {} : { environment: input.environment }),
         ...(input.signal === undefined ? {} : { signal: input.signal }),
-    };
-    const status = await ports.readStatus({ ...stateInput, releaseKey: input.releaseKey });
+    });
     if (status.plan.targetConfigDigest !== input.plan.targetConfigSha256
         || status.plan.gameId !== input.gameId
         || status.plan.targets[target] === undefined) {
@@ -44,7 +78,41 @@ export async function submitRecordedNativeTargetWithPorts(input, ports) {
         throw new Error('Store submission requires a matching immutable native build record.');
     }
     const artifactFile = resolveRecordedArtifact(input.plan.gameRoot, record.artifactLocation);
+    return { planned, record, artifactFile, status };
+}
+export async function submitRecordedNativeTargetWithPorts(input, ports) {
+    const target = input.credential.target;
+    const planned = input.plan.targets.find((entry) => entry.target === target);
+    if (planned === undefined || !input.approved) {
+        throw new Error('Native store submission requires a planned target and explicit approval.');
+    }
+    const androidRelease = input.androidRelease ?? defaultPlayReleaseRequest;
+    if (target === 'android') {
+        // Refuse an invalid or unconfirmed production/staged request before the
+        // release state is read or a checkpoint is written.
+        assertPlayReleaseRequest(androidRelease);
+        assertPlayReleaseConfirmed(androidRelease, input.confirmProduction === true);
+    }
+    const releaseDigest = target === 'android' ? playReleaseRequestDigest(androidRelease) : undefined;
+    const stateInput = {
+        gameRoot: input.plan.gameRoot,
+        gameId: input.gameId,
+        ...(input.environment === undefined ? {} : { environment: input.environment }),
+        ...(input.signal === undefined ? {} : { signal: input.signal }),
+    };
+    const { record, artifactFile, status } = await readRecordedSubmission(input, target, ports.readStatus);
     let checkpoint = status.submissions[target];
+    assertSettledAndroidReleaseOptions(checkpoint, androidRelease);
+    // An attempt that never checkpointed a Play edit changed nothing remotely,
+    // so its release options may still be corrected.
+    const optionsReplaceable = checkpoint?.status === 'started'
+        && checkpoint.remoteEditId === undefined && checkpoint.remoteUploadId === undefined
+        && checkpoint.remoteBuildId === undefined;
+    if (checkpoint !== undefined && checkpoint.playReleaseSha256 !== releaseDigest
+        && !optionsReplaceable) {
+        throw new Error('This submission was started with other Google Play release options (track, status, '
+            + 'fraction, notes or mapping); re-run it with the same options before changing them.');
+    }
     if (checkpoint !== undefined && isNativeSubmissionSettled(checkpoint.status)) {
         return checkpoint;
     }
@@ -70,6 +138,7 @@ export async function submitRecordedNativeTargetWithPorts(input, ports) {
                 attemptId: randomBytes(16).toString('hex'),
                 leaseExpiresAt: freshSubmissionLeaseExpiresAt(),
                 status: 'started',
+                ...(releaseDigest === undefined ? {} : { playReleaseSha256: releaseDigest }),
             },
         })).checkpoint;
     }
@@ -90,6 +159,17 @@ export async function submitRecordedNativeTargetWithPorts(input, ports) {
         throw new Error('Submission checkpoint no longer matches its immutable build.');
     }
     let activeCheckpoint = checkpoint;
+    if (activeCheckpoint.playReleaseSha256 !== releaseDigest) {
+        const { playReleaseSha256: _replaced, ...withoutDigest } = activeCheckpoint;
+        activeCheckpoint = (await ports.checkpoint({
+            ...stateInput,
+            checkpoint: {
+                ...withoutDigest,
+                ...(releaseDigest === undefined ? {} : { playReleaseSha256: releaseDigest }),
+                leaseExpiresAt: freshSubmissionLeaseExpiresAt(),
+            },
+        })).checkpoint;
+    }
     const save = async (patch) => {
         activeCheckpoint = (await ports.checkpoint({
             ...stateInput,
@@ -122,6 +202,13 @@ export async function submitRecordedNativeTargetWithPorts(input, ports) {
                 onEditCreated: async (editId) => {
                     await save({ status: 'edit-open', remoteEditId: editId });
                 },
+                ...(input.androidRelease === undefined ? {} : { release: input.androidRelease }),
+                ...(input.confirmProduction === undefined ? {} : {
+                    confirmProduction: input.confirmProduction,
+                }),
+                ...(input.onDraftAppFallback === undefined ? {} : {
+                    onDraftAppFallback: input.onDraftAppFallback,
+                }),
                 ...(input.signal === undefined ? {} : { signal: input.signal }),
             });
         }

package/dist/native-shell-ios-push-files.d.ts

@@ -0,0 +1,9 @@
+import type { IosPushWiringInput } from './native-shell-store-policy.js';
+/**
+* The iOS project files `inspectIosPushWiring` reads, from a shell's
+* `ios/App` directory (the Xcode project directory): the project, a reader
+* for files inside that directory, and the Swift sources of the App group.
+* Symbolic links and paths that leave the directory are never followed.
+* Undefined when the shell has no readable Xcode project.
+*/
+export declare function readIosPushWiringInput(iosProjectDirectory: string): IosPushWiringInput | undefined;

package/dist/native-shell-ios-push-files.js

@@ -0,0 +1,65 @@
+import { existsSync, lstatSync, readdirSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+/** Swift files read at most from the App group: a guard against a pathological tree. */
+const maxSwiftSources = 2_000;
+/**
+ * The iOS project files `inspectIosPushWiring` reads, from a shell's
+ * `ios/App` directory (the Xcode project directory): the project, a reader
+ * for files inside that directory, and the Swift sources of the App group.
+ * Symbolic links and paths that leave the directory are never followed.
+ * Undefined when the shell has no readable Xcode project.
+ */
+export function readIosPushWiringInput(iosProjectDirectory) {
+    const project = readContainedFile(iosProjectDirectory, 'App.xcodeproj/project.pbxproj');
+    if (project === undefined) {
+        return undefined;
+    }
+    return {
+        project,
+        readProjectFile: (relative) => readContainedFile(iosProjectDirectory, relative),
+        swiftSources: listContainedSwiftFiles(iosProjectDirectory, 'App')
+            .map((relative) => readContainedFile(iosProjectDirectory, relative) ?? ''),
+    };
+}
+/** A regular file inside `root` by its relative path, or undefined when missing or unsafe. */
+function readContainedFile(root, relative) {
+    const file = path.resolve(root, relative);
+    const within = path.relative(root, file);
+    if (within === '' || within.startsWith('..') || path.isAbsolute(within)) {
+        return undefined;
+    }
+    let current = root;
+    for (const segment of within.split(path.sep)) {
+        current = path.join(current, segment);
+        if (!existsSync(current) || lstatSync(current).isSymbolicLink()) {
+            return undefined;
+        }
+    }
+    return lstatSync(file).isFile() ? readFileSync(file, 'utf8') : undefined;
+}
+function listContainedSwiftFiles(root, relativeRoot) {
+    const pending = [relativeRoot];
+    const files = [];
+    while (pending.length > 0) {
+        const relative = pending.pop() ?? '';
+        const full = path.join(root, relative);
+        if (!existsSync(full) || lstatSync(full).isSymbolicLink() || !lstatSync(full).isDirectory()) {
+            continue;
+        }
+        for (const entry of readdirSync(full, { withFileTypes: true })) {
+            const child = path.join(relative, entry.name);
+            // The web bundle Capacitor copies into the App group holds no Swift.
+            if (entry.isDirectory() && child !== path.join(relativeRoot, 'public')) {
+                pending.push(child);
+            }
+            else if (entry.isFile() && entry.name.endsWith('.swift')) {
+                files.push(child);
+                if (files.length >= maxSwiftSources) {
+                    // Enough to find the delegates; the rest is not read.
+                    return files.sort();
+                }
+            }
+        }
+    }
+    return files.sort();
+}

package/dist/native-shell-store-policy.d.ts

@@ -121,3 +121,112 @@ export declare function applyAndroidManifestAdId(manifest: string, usesAds: bool
 export declare function readGameAdvertisingIdPolicy(gameConfig: unknown): 'declared' | 'removed';
 export declare function inspectAndroidManifestAds(manifest: string, usesAds: boolean, advertisingIdPolicy?: 'declared' | 'removed'): readonly NativeShellPolicyIssue[];
 export declare function inspectIosInfoPlistAds(plist: string, usesAds: boolean): readonly NativeShellPolicyIssue[];
+/** The entitlements file of a kit shell's App target, in the App group. */
+export declare const iosPushEntitlementsFile = "App.entitlements";
+/** Its `CODE_SIGN_ENTITLEMENTS` value, relative to the Xcode project directory (`ios/App`). */
+export declare const iosPushEntitlementsSetting = "App/App.entitlements";
+/**
+* The Push Notifications entitlement the Xcode capability writes. Apple:
+* "Xcode sets the value of the entitlement based on your app's current
+* provisioning profile", so `development` here signs as `production` with
+* an App Store profile
+* (https://developer.apple.com/documentation/bundleresources/entitlements/aps-environment).
+*/
+export declare const iosPushEntitlementsXml: string;
+/**
+* The AppDelegate methods `@capacitor-firebase/messaging` documents for iOS:
+* the plugin observes `.capacitorDidRegisterForRemoteNotifications` and hands
+* the APNs token to Firebase, so without them it never gets an FCM token.
+* The plugin README's third method (`didReceiveRemoteNotification`) is left
+* out: the kit sends no silent pushes, and plugin 8.5.2 never calls the
+* completion handler it is given.
+*/
+export declare const iosAppDelegatePushForwardingSwift: readonly string[];
+/** The scene delegate methods that replay a cold-start tap (reference shell, #407). */
+export declare const iosSceneDelegateColdStartSwift: readonly string[];
+/** Whether the shell's package.json installs the Firebase messaging plugin (`--providers notifications`). */
+export declare function shellUsesFirebaseMessaging(shellPackage: unknown): boolean;
+/**
+* Swift source with comments and string literals blanked to spaces, so
+* offsets stay the same and only code is matched. Nested block comments,
+* multi-line strings and raw strings (`#"..."#`) are handled; an
+* interpolation's code inside a string is blanked with it, and a
+* single-line string that runs into a newline ends there, so one the
+* scanner misreads cannot blank the rest of the file.
+*/
+export declare function stripSwiftCommentsAndStrings(source: string): string;
+/**
+* Whether a Swift source's `didRegisterForRemoteNotificationsWithDeviceToken`
+* hands the APNs token on: it posts `.capacitorDidRegisterForRemoteNotifications`
+* (what the messaging plugin observes) or sets Firebase's `apnsToken` itself.
+*/
+export declare function swiftForwardsPushToken(source: string): boolean;
+/** Whether a Swift source declares a scene delegate class. */
+export declare function swiftDeclaresSceneDelegate(source: string): boolean;
+/** Whether a Swift source forwards the scene's cold-start notification response. */
+export declare function swiftForwardsColdStartNotification(source: string): boolean;
+/**
+* Adds the APNs registration forwarding (`iosAppDelegatePushForwardingSwift`)
+* to the `AppDelegate` class. An AppDelegate that already forwards the token
+* is returned unchanged; undefined when the class is not found or already
+* implements a registration callback without the forwarding, which is left
+* to the game.
+*/
+export declare function applyIosAppDelegatePushForwarding(source: string): string | undefined;
+/**
+* Adds the cold-start notification forwarding of the kit reference shell
+* (#407) to Capacitor's `SceneDelegate`: `import UserNotifications`, the
+* call after `SceneDelegateProxy.shared.scene(_:willConnectTo:options:)`,
+* and `iosSceneDelegateColdStartSwift`. A scene delegate that already reads
+* `notificationResponse` is returned unchanged; undefined when it does not
+* have Capacitor's layout, which is left to the game.
+*/
+export declare function applyIosSceneDelegateColdStartForwarding(source: string): string | undefined;
+/** The App target's Release `CODE_SIGN_ENTITLEMENTS`, without quotes, or undefined. */
+export declare function readIosAppReleaseEntitlements(project: string): string | undefined;
+/**
+* The entitlements path a `CODE_SIGN_ENTITLEMENTS` value names, relative to
+* the Xcode project directory, or undefined when it uses another build
+* setting the kit cannot resolve.
+*/
+export declare function resolveIosEntitlementsSetting(value: string): string | undefined;
+/**
+* Adds `App.entitlements` to the App group of a Capacitor-generated project
+* and sets `CODE_SIGN_ENTITLEMENTS` in every App target build configuration.
+* The file is not bundled (no build phase). A project that already points
+* there is returned unchanged; undefined when the project has another layout
+* or another entitlements file, which is left to the game.
+*/
+export declare function applyIosProjectPushEntitlements(project: string): string | undefined;
+/** What `inspectIosPushWiring` reads from the shell's iOS project. */
+export interface IosPushWiringInput {
+  /** `ios/App/App.xcodeproj/project.pbxproj`. */
+  readonly project: string;
+  /**
+  * A file of the iOS project by its path relative to `ios/App` (the Xcode
+  * project directory), or undefined when it is missing or unsafe to read.
+  */
+  readonly readProjectFile: (relative: string) => string | undefined;
+  /** The Swift sources of the App group (`ios/App/App`). */
+  readonly swiftSources: readonly string[];
+}
+export declare const iosPushEntitlementStep: string;
+export declare const iosPushTokenForwardingStep: string;
+export declare const iosPushColdStartStep: string;
+/**
+* What a shell with `@capacitor-firebase/messaging` still lacks on iOS: the
+* `aps-environment` entitlement on the App target's Release configuration,
+* the AppDelegate's APNs token forwarding, and the scene delegate's
+* cold-start tap forwarding (for a shell with a scene delegate). Each is an
+* error: without the first two no push reaches the app, and without the
+* third a tap on a notification while the app is not running opens it
+* without the notification's route. An entitlement the kit cannot follow
+* (`inspectIosPushEntitlement`) is a warning. The forwarding checks are
+* textual: the token must be handed on inside
+* `didRegisterForRemoteNotificationsWithDeviceToken`, and some App source
+* must read `.notificationResponse`.
+*/
+export declare function inspectIosPushWiring(input: IosPushWiringInput): readonly NativeShellPolicyIssue[];
+/** The Firebase config file the messaging plugin reads from the app bundle. */
+export declare const iosFirebaseConfigFile = "GoogleService-Info.plist";
+export declare function inspectIosFirebaseConfig(project: string): readonly NativeShellPolicyIssue[];