@mpgd/cli 0.61.1 → 0.63.0

package/dist/native-deploy-run.d.ts

@@ -24,6 +24,8 @@ export interface RunNativeDeploymentInput {
   readonly signal?: AbortSignal;
   /** Called only after a newly built target has an immutable, committed build record. */
   readonly onBuildRecorded?: (target: NativeDeployTarget) => void;
+  /** Receives the Crashlytics dSYM upload outcome; defaults to `console.warn`. */
+  readonly onCrashSymbolsReport?: (message: string) => void;
 }
 /** Reserve once, build only missing targets, then submit the recorded binaries. */
 export declare function runNativeDeployment(input: RunNativeDeploymentInput): Promise<NativeReleaseStatus>;

package/dist/native-deploy-run.js

@@ -4,10 +4,11 @@ import path from 'node:path';
 import { doctorNativeDeployment, readNativeDeployCredentialNames, readNativeDeployTargetProfile, } from './deploy-planning.js';
 import { withAndroidUploadSigningSession } from './android-signing-session.js';
 import { withIosSigningSession } from './ios-signing-session.js';
-import { assertSettledAndroidReleaseOptions, submitRecordedNativeTarget, } from './native-deploy-submission.js';
+import { assertSettledAndroidReleaseOptions, submitRecordedNativeTarget, withRecordedR8Mapping, } from './native-deploy-submission.js';
 import { isNativeSubmissionSettled, readNativeReleaseStatus, recordNativeReleaseBuild, reserveNativeRelease, } from './release-state.js';
 import { installPinnedReleaseDependencies, pinNativeDeploymentPlan, runPinnedNativeBuild, withPinnedReleaseWorkspace, } from './release-workspace.js';
 import { inspectAndroidBundleSigner } from './android-bundle-signer.js';
+import { uploadCrashSymbolsForDeployRun } from './crash-symbols-upload.js';
 import { assertPlayReleaseConfirmed, assertPlayReleaseRequest, } from './play-release-options.js';
 const gitAuthEnvironmentNames = ['GITHUB_TOKEN', 'GH_TOKEN', 'GIT_ASKPASS'];
 /** Reserve once, build only missing targets, then submit the recorded binaries. */
@@ -45,7 +46,7 @@ export async function runNativeDeployment(input) {
         }
     }
     // Refuse changed Play options for a committed release before any build work.
-    assertSettledAndroidReleaseOptions(existing?.submissions.android, input.androidRelease);
+    assertSettledAndroidReleaseOptions(existing?.submissions.android, withRecordedR8Mapping(input.androidRelease, existing?.builds.android, input.plan.gameRoot));
     const pendingSteps = existing === undefined
         ? {
             buildTargets: input.plan.targets.map((entry) => entry.target),
@@ -123,20 +124,35 @@ export async function runNativeDeployment(input) {
             ...(input.signal === undefined ? {} : { signal: input.signal }),
         });
     }
+    // A --mapping-file that differs from the mapping recorded with the Android
+    // build is refused here, before any target (iOS may come first) is submitted.
+    status = await readNativeReleaseStatus({
+        gameRoot: input.plan.gameRoot,
+        gameId: input.gameId,
+        releaseKey: input.releaseKey,
+        environment,
+        ...(input.signal === undefined ? {} : { signal: input.signal }),
+    });
+    withRecordedR8Mapping(input.androidRelease, status.builds.android, input.plan.gameRoot);
+    let fresh = true;
     for (const entry of input.plan.targets) {
-        status = await readNativeReleaseStatus({
-            gameRoot: input.plan.gameRoot,
-            gameId: input.gameId,
-            releaseKey: input.releaseKey,
-            environment,
-            ...(input.signal === undefined ? {} : { signal: input.signal }),
-        });
+        // The status read above serves the first target; later ones re-read it.
+        if (!fresh) {
+            status = await readNativeReleaseStatus({
+                gameRoot: input.plan.gameRoot,
+                gameId: input.gameId,
+                releaseKey: input.releaseKey,
+                environment,
+                ...(input.signal === undefined ? {} : { signal: input.signal }),
+            });
+        }
+        fresh = false;
         if (status.builds[entry.target] === undefined) {
             throw new Error(`${entry.target} has no verified build after the native build stage.`);
         }
         const submission = status.submissions[entry.target];
         if (submission !== undefined && isNativeSubmissionSettled(submission.status)) {
-            assertSettledAndroidReleaseOptions(submission, input.androidRelease);
+            assertSettledAndroidReleaseOptions(submission, withRecordedR8Mapping(input.androidRelease, status.builds.android, input.plan.gameRoot));
             continue;
         }
         await submitRecordedNativeTarget({
@@ -156,6 +172,21 @@ export async function runNativeDeployment(input) {
             ...(input.signal === undefined ? {} : { signal: input.signal }),
         });
     }
+    // Crashlytics dSYMs of the recorded iOS build, once, only after every store
+    // submission went through (a failed or cancelled run reports its own error
+    // at once; the next run or `mpgd deploy symbols` uploads them). A slow upload
+    // never delays a submission, and the step never throws: a failure is
+    // reported and retryable.
+    if (input.plan.targets.some((entry) => entry.target === 'ios')
+        && input.signal?.aborted !== true) {
+        await uploadCrashSymbolsForDeployRun({
+            gameRoot: input.plan.gameRoot,
+            gameId: input.gameId,
+            releaseKey: input.releaseKey,
+            environment,
+            ...(input.signal === undefined ? {} : { signal: input.signal }),
+        }, input.onCrashSymbolsReport);
+    }
     return readNativeReleaseStatus({
         gameRoot: input.plan.gameRoot,
         gameId: input.gameId,
@@ -232,6 +263,23 @@ async function buildAndRecordTarget(input, workspace, target, reserved, environm
         const manifestLocation = `.mpgd/releases/${input.releaseKey}/${target}-manifest-${sha256(built.releaseManifest)}.json`;
         const artifactFile = persistImmutableFile(input.plan.gameRoot, artifactLocation, built.artifact);
         const manifestFile = persistImmutableFile(input.plan.gameRoot, manifestLocation, built.releaseManifest);
+        // Crash symbols travel with the artifact (and the workflow's release bundle).
+        const persistSymbol = (source, name) => {
+            const location = `.mpgd/releases/${input.releaseKey}/${target}-${name.replace('{sha}', sha256(source))}`;
+            return { file: persistImmutableFile(input.plan.gameRoot, location, source), location };
+        };
+        const r8Mapping = built.symbols?.r8Mapping === undefined
+            ? undefined
+            : persistSymbol(built.symbols.r8Mapping, 'mapping-{sha}.txt');
+        const crashlytics = built.symbols?.crashlytics;
+        const crashlyticsSymbols = crashlytics === undefined
+            ? undefined
+            : {
+                dsymArchive: persistSymbol(crashlytics.dsymArchive, 'dsyms-{sha}.zip'),
+                dsyms: crashlytics.dsyms,
+                uploadTool: persistSymbol(crashlytics.uploadTool, 'upload-symbols-{sha}'),
+                googleServiceInfo: persistSymbol(crashlytics.googleServiceInfo, 'GoogleService-Info-{sha}.plist'),
+            };
         const configDigest = createHash('sha256').update(JSON.stringify({
             gameGitSha: workspace.input.gameGitSha,
             lockfileSha256: workspace.input.lockfileSha256,
@@ -268,6 +316,8 @@ async function buildAndRecordTarget(input, workspace, target, reserved, environm
             expectedReleaseManifestSha256: sha256(manifestFile),
             inspectedAppId: planned.appId,
             ...(target === 'android' ? { inspectedSignerSha256 } : { inspectedTeamId: signerOrTeam }),
+            ...(r8Mapping === undefined ? {} : { r8Mapping }),
+            ...(crashlyticsSymbols === undefined ? {} : { crashlyticsSymbols }),
             environment,
             ...(input.signal === undefined ? {} : { signal: input.signal }),
         });

package/dist/native-deploy-submission.d.ts

@@ -50,6 +50,12 @@ export declare function isNativeDeployApproved(plan: Pick<NativeDeploymentPlan,
 * Google Play options must fail instead of being skipped as done.
 */
 export declare function assertSettledAndroidReleaseOptions(checkpoint: NativeSubmissionCheckpoint | undefined, androidRelease: PlayReleaseRequest | undefined): void;
+/**
+* The Google Play request with the R8 mapping recorded with the build: it is
+* used when no `--mapping-file` is given, and an explicit one must have the
+* same bytes. A build without a recorded mapping keeps the request as it is.
+*/
+export declare function withRecordedR8Mapping(request: PlayReleaseRequest | undefined, record: Pick<ImmutableNativeBuildRecord, 'r8Mapping'> | undefined, gameRoot: string): PlayReleaseRequest | undefined;
 /** Resume exactly one verified build; never rebuild or allocate another version here. */
 export declare function submitRecordedNativeTarget(input: SubmitRecordedNativeTargetInput): Promise<NativeSubmissionCheckpoint>;
 /** Verify one recorded Android build and print its Play edit without any store call. */
@@ -57,3 +63,5 @@ export declare function planRecordedAndroidSubmission(input: Omit<SubmitRecorded
 export declare function submitRecordedNativeTargetWithPorts(input: SubmitRecordedNativeTargetInput, ports: NativeSubmissionPorts): Promise<NativeSubmissionCheckpoint>;
 /** Validate the workflow-restored manifest against the immutable release-state hash. */
 export declare function verifyRecordedReleaseManifest(gameRoot: string, record: Pick<ImmutableNativeBuildRecord, 'artifactLocation' | 'releaseManifestSha256' | 'target'>): void;
+/** A recorded game-relative file, resolved without leaving the game directory. */
+export declare function resolveRecordedArtifact(gameRoot: string, recordedLocation: string): string;

package/dist/native-deploy-submission.js

@@ -1,5 +1,5 @@
 import { createHash, randomBytes } from 'node:crypto';
-import { readFileSync, realpathSync, statSync } from 'node:fs';
+import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs';
 import path from 'node:path';
 import { checkpointNativeSubmission, freshSubmissionLeaseExpiresAt, isNativeSubmissionSettled, readNativeReleaseStatus, reclaimNativeSubmission, releaseNativeSubmissionLease, } from './release-state.js';
 import { planVerifiedAndroidBundleSubmission, PlaySubmissionUncertainError, submitVerifiedAndroidBundle, } from './play-internal-submission.js';
@@ -33,6 +33,35 @@ export function assertSettledAndroidReleaseOptions(checkpoint, androidRelease) {
             + 'change it with "mpgd deploy rollout" or submit a new release.');
     }
 }
+/**
+ * The Google Play request with the R8 mapping recorded with the build: it is
+ * used when no `--mapping-file` is given, and an explicit one must have the
+ * same bytes. A build without a recorded mapping keeps the request as it is.
+ */
+export function withRecordedR8Mapping(request, record, gameRoot) {
+    const recorded = record?.r8Mapping;
+    if (recorded === undefined) {
+        return request;
+    }
+    if (request?.mappingSha256 !== undefined) {
+        if (request.mappingSha256 !== recorded.sha256) {
+            throw new Error(`--mapping-file differs from the R8 mapping recorded with this build (${recorded.location}, `
+                + `sha256 ${recorded.sha256}); omit it to use the recorded mapping.`);
+        }
+        return request;
+    }
+    // A missing file is reported when the submission hashes it; an existing one
+    // must not resolve outside the game through a symlink.
+    const candidate = path.resolve(gameRoot, recorded.location);
+    const mappingFile = existsSync(candidate)
+        ? resolveRecordedArtifact(gameRoot, recorded.location)
+        : candidate;
+    return {
+        ...(request ?? defaultPlayReleaseRequest),
+        mappingFile,
+        mappingSha256: recorded.sha256,
+    };
+}
 /** Resume exactly one verified build; never rebuild or allocate another version here. */
 export async function submitRecordedNativeTarget(input) {
     return submitRecordedNativeTargetWithPorts(input, productionPorts);
@@ -43,11 +72,12 @@ export async function planRecordedAndroidSubmission(input, readStatus = readNati
     if (input.environment?.MPGD_VERIFY_RELEASE_MANIFEST === '1') {
         verifyRecordedReleaseManifest(input.plan.gameRoot, recorded.record);
     }
+    const release = withRecordedR8Mapping(input.androidRelease, recorded.record, input.plan.gameRoot);
     return planVerifiedAndroidBundleSubmission({
         record: recorded.record,
         aabFile: recorded.artifactFile,
         packageName: recorded.planned.appId,
-        ...(input.androidRelease === undefined ? {} : { release: input.androidRelease }),
+        ...(release === undefined ? {} : { release }),
         ...(input.signal === undefined ? {} : { signal: input.signal }),
     });
 }
@@ -86,14 +116,13 @@ export async function submitRecordedNativeTargetWithPorts(input, ports) {
     if (planned === undefined || !input.approved) {
         throw new Error('Native store submission requires a planned target and explicit approval.');
     }
-    const androidRelease = input.androidRelease ?? defaultPlayReleaseRequest;
     if (target === 'android') {
         // Refuse an invalid or unconfirmed production/staged request before the
         // release state is read or a checkpoint is written.
-        assertPlayReleaseRequest(androidRelease);
-        assertPlayReleaseConfirmed(androidRelease, input.confirmProduction === true);
+        const requested = input.androidRelease ?? defaultPlayReleaseRequest;
+        assertPlayReleaseRequest(requested);
+        assertPlayReleaseConfirmed(requested, input.confirmProduction === true);
     }
-    const releaseDigest = target === 'android' ? playReleaseRequestDigest(androidRelease) : undefined;
     const stateInput = {
         gameRoot: input.plan.gameRoot,
         gameId: input.gameId,
@@ -101,6 +130,12 @@ export async function submitRecordedNativeTargetWithPorts(input, ports) {
         ...(input.signal === undefined ? {} : { signal: input.signal }),
     };
     const { record, artifactFile, status } = await readRecordedSubmission(input, target, ports.readStatus);
+    // The build's recorded R8 mapping goes with it, the same way --mapping-file does.
+    const effectiveAndroidRelease = target === 'android'
+        ? withRecordedR8Mapping(input.androidRelease, record, input.plan.gameRoot)
+        : undefined;
+    const androidRelease = effectiveAndroidRelease ?? defaultPlayReleaseRequest;
+    const releaseDigest = target === 'android' ? playReleaseRequestDigest(androidRelease) : undefined;
     let checkpoint = status.submissions[target];
     assertSettledAndroidReleaseOptions(checkpoint, androidRelease);
     // An attempt that never checkpointed a Play edit changed nothing remotely,
@@ -116,6 +151,12 @@ export async function submitRecordedNativeTargetWithPorts(input, ports) {
     if (checkpoint !== undefined && isNativeSubmissionSettled(checkpoint.status)) {
         return checkpoint;
     }
+    if (record.r8Mapping !== undefined && effectiveAndroidRelease?.mappingFile !== undefined
+        && !existsSync(effectiveAndroidRelease.mappingFile)) {
+        throw new Error(`The R8 mapping recorded with this build is missing: ${record.r8Mapping.location}. Restore `
+            + 'the release bundle (.mpgd/releases/<release>) next to the bundle, or pass the same file '
+            + 'with --mapping-file.');
+    }
     if (input.environment?.MPGD_VERIFY_RELEASE_MANIFEST === '1') {
         verifyRecordedReleaseManifest(input.plan.gameRoot, record);
     }
@@ -202,7 +243,7 @@ export async function submitRecordedNativeTargetWithPorts(input, ports) {
                 onEditCreated: async (editId) => {
                     await save({ status: 'edit-open', remoteEditId: editId });
                 },
-                ...(input.androidRelease === undefined ? {} : { release: input.androidRelease }),
+                ...(effectiveAndroidRelease === undefined ? {} : { release: effectiveAndroidRelease }),
                 ...(input.confirmProduction === undefined ? {} : {
                     confirmProduction: input.confirmProduction,
                 }),
@@ -316,7 +357,8 @@ export function verifyRecordedReleaseManifest(gameRoot, record) {
         throw new Error('Restored release manifest differs from the immutable build record.');
     }
 }
-function resolveRecordedArtifact(gameRoot, recordedLocation) {
+/** A recorded game-relative file, resolved without leaving the game directory. */
+export function resolveRecordedArtifact(gameRoot, recordedLocation) {
     if (path.isAbsolute(recordedLocation)) {
         throw new Error('Native artifact location must be game-relative.');
     }

package/dist/play-product-port.d.ts

@@ -0,0 +1,101 @@
+/**
+* Google Play one-time product port (Android Publisher v3
+* `monetization.onetimeproducts`). The Google SDK lives under
+* adapters/play-publisher; the CLI sees only these shapes.
+* https://developers.google.com/android-publisher/api-ref/rest/v3/monetization.onetimeproducts
+*/
+/** `Money`: whole `units` as a decimal string and `nanos` (10^-9 units). */
+export interface PlayMoney {
+  readonly currencyCode?: string | null | undefined;
+  readonly units?: string | null | undefined;
+  readonly nanos?: number | null | undefined;
+}
+export interface PlayOneTimeProductListing {
+  readonly languageCode?: string | null | undefined;
+  readonly title?: string | null | undefined;
+  readonly description?: string | null | undefined;
+}
+export interface PlayRegionalPricingConfig {
+  readonly regionCode?: string | null | undefined;
+  readonly price?: PlayMoney | undefined;
+  /** `AVAILABLE`, `NO_LONGER_AVAILABLE`, `AVAILABLE_IF_RELEASED`, `AVAILABLE_FOR_OFFERS_ONLY`. */
+  readonly availability?: string | null | undefined;
+}
+export interface PlayNewRegionsConfig {
+  readonly usdPrice?: PlayMoney | undefined;
+  readonly eurPrice?: PlayMoney | undefined;
+  readonly availability?: string | null | undefined;
+}
+export interface PlayPurchaseOption {
+  readonly purchaseOptionId?: string | null | undefined;
+  readonly buyOption?: {
+    readonly legacyCompatible?: boolean | null | undefined;
+    readonly multiQuantityEnabled?: boolean | null | undefined;
+  } | undefined;
+  /** A rent option; the sync never manages one. */
+  readonly rentOption?: Readonly<Record<string, unknown>> | undefined;
+  readonly regionalPricingAndAvailabilityConfigs?: readonly PlayRegionalPricingConfig[] | undefined;
+  readonly newRegionsConfig?: PlayNewRegionsConfig | undefined;
+  /** Output only: `DRAFT`, `ACTIVE`, `INACTIVE` or `INACTIVE_PUBLISHED`. */
+  readonly state?: string | null | undefined;
+  readonly [field: string]: unknown;
+}
+export interface PlayOneTimeProduct {
+  readonly packageName?: string | null | undefined;
+  readonly productId?: string | null | undefined;
+  readonly listings?: readonly PlayOneTimeProductListing[] | undefined;
+  readonly purchaseOptions?: readonly PlayPurchaseOption[] | undefined;
+  readonly taxAndComplianceSettings?: {
+    readonly productTaxCategoryCode?: string | null | undefined;
+    readonly [field: string]: unknown;
+  } | undefined;
+  /** Output only. */
+  readonly regionsVersion?: {
+    readonly version?: string | null | undefined;
+  } | undefined;
+  readonly [field: string]: unknown;
+}
+/** `monetization.convertRegionPrices` response. */
+export interface PlayConvertedPrices {
+  readonly convertedRegionPrices?: Readonly<Record<string, {
+    readonly regionCode?: string | null | undefined;
+    /** Tax inclusive. */
+    readonly price?: PlayMoney | undefined;
+    readonly taxAmount?: PlayMoney | undefined;
+  }>> | null | undefined;
+  readonly convertedOtherRegionsPrice?: {
+    readonly usdPrice?: PlayMoney | undefined;
+    readonly eurPrice?: PlayMoney | undefined;
+  } | undefined;
+  readonly regionVersion?: {
+    readonly version?: string | null | undefined;
+  } | undefined;
+}
+export interface PlayProductCatalogPort {
+  /** Every one-time product of the app (`onetimeproducts.list`, all pages). */
+  listOneTimeProducts(packageName: string, signal?: AbortSignal): Promise<PlayOneTimeProduct[]>;
+  /** Read-only price conversion (`monetization.convertRegionPrices`). */
+  convertRegionPrices(input: {
+    readonly packageName: string;
+    readonly price: PlayMoney;
+    readonly productTaxCategoryCode?: string;
+    readonly signal?: AbortSignal;
+  }): Promise<PlayConvertedPrices>;
+  /** `onetimeproducts.patch`; `allowMissing` creates the product. */
+  patchOneTimeProduct(input: {
+    readonly packageName: string;
+    readonly productId: string;
+    readonly product: PlayOneTimeProduct;
+    readonly updateMask: string;
+    readonly allowMissing: boolean;
+    readonly regionsVersion: string;
+    readonly signal?: AbortSignal;
+  }): Promise<PlayOneTimeProduct>;
+  /** `onetimeproducts.purchaseOptions.batchUpdateStates` with one activate request. */
+  activatePurchaseOption(input: {
+    readonly packageName: string;
+    readonly productId: string;
+    readonly purchaseOptionId: string;
+    readonly signal?: AbortSignal;
+  }): Promise<void>;
+}

package/dist/play-product-port.js

@@ -0,0 +1,7 @@
+/**
+ * Google Play one-time product port (Android Publisher v3
+ * `monetization.onetimeproducts`). The Google SDK lives under
+ * adapters/play-publisher; the CLI sees only these shapes.
+ * https://developers.google.com/android-publisher/api-ref/rest/v3/monetization.onetimeproducts
+ */
+export {};

package/dist/play-sdk-adapter.js

@@ -95,7 +95,74 @@ function wrapPublisher(publisher) {
     }
   };
 }
+function createServiceAccountProductCatalog(serviceAccountFile) {
+  const googleAuth = new auth.GoogleAuth({ keyFile: serviceAccountFile, scopes: [scope] });
+  return wrapProductCatalog(androidpublisher({ version: "v3", auth: googleAuth }));
+}
+function createMockProductCatalog(accessToken, rootUrl) {
+  const oauth = new auth.OAuth2();
+  oauth.setCredentials({ access_token: accessToken });
+  return wrapProductCatalog(androidpublisher({ version: "v3", auth: oauth, rootUrl }));
+}
+function wrapProductCatalog(publisher) {
+  const products = publisher.monetization.onetimeproducts;
+  return {
+    async listOneTimeProducts(packageName, signal) {
+      const all = [];
+      let pageToken;
+      do {
+        const response = await products.list({
+          packageName,
+          pageSize: 1e3,
+          ...pageToken === void 0 ? {} : { pageToken }
+        }, { signal });
+        all.push(...response.data.oneTimeProducts ?? []);
+        const next = response.data.nextPageToken;
+        pageToken = typeof next === "string" && next !== "" ? next : void 0;
+      } while (pageToken !== void 0);
+      return all;
+    },
+    async convertRegionPrices(input) {
+      const response = await publisher.monetization.convertRegionPrices({
+        packageName: input.packageName,
+        requestBody: {
+          price: input.price,
+          ...input.productTaxCategoryCode === void 0 ? {} : { productTaxCategoryCode: input.productTaxCategoryCode }
+        }
+      }, { signal: input.signal });
+      return response.data;
+    },
+    async patchOneTimeProduct(input) {
+      const response = await products.patch({
+        packageName: input.packageName,
+        productId: input.productId,
+        allowMissing: input.allowMissing,
+        updateMask: input.updateMask,
+        "regionsVersion.version": input.regionsVersion,
+        requestBody: input.product
+      }, { retry: false, signal: input.signal });
+      return response.data;
+    },
+    async activatePurchaseOption(input) {
+      await products.purchaseOptions.batchUpdateStates({
+        packageName: input.packageName,
+        productId: input.productId,
+        requestBody: {
+          requests: [{
+            activatePurchaseOptionRequest: {
+              packageName: input.packageName,
+              productId: input.productId,
+              purchaseOptionId: input.purchaseOptionId
+            }
+          }]
+        }
+      }, { retry: false, signal: input.signal });
+    }
+  };
+}
 export {
+  createMockProductCatalog,
   createMockPublisher,
+  createServiceAccountProductCatalog,
   createServiceAccountPublisher
 };

package/dist/pnpm-build-approvals.d.ts

@@ -0,0 +1,59 @@
+/**
+* pnpm build-script decisions for the dependencies a notifications game adds.
+*
+* pnpm 11 replaced `onlyBuiltDependencies` with `allowBuilds` and fails an
+* install (`ERR_PNPM_IGNORED_BUILDS`) while a dependency's build script is
+* neither allowed (`true`) nor denied (`false`), because `strictDepBuilds`
+* defaults to `true` (https://pnpm.io/settings/build). The notifications
+* starter adds `firebase`, whose tree has two such scripts:
+*
+* - `@firebase/util` `postinstall.js` only matters for Firebase App Hosting:
+*   it reads `FIREBASE_WEBAPP_CONFIG`, may fetch the web app config from
+*   firebase.googleapis.com, and bakes it into `dist/postinstall.*` for
+*   `initializeApp()` without options. The published `dist` already ships the
+*   placeholder that returns `undefined`, and the kit never initializes the web
+*   SDK (it is there so the messaging plugin's web fallback resolves), so the
+*   script is denied: the install stays offline and reproducible.
+* - `protobufjs` `scripts/postinstall.js` only prints a warning when the parent
+*   package declares protobufjs with another semver operator. The game
+*   template already allows it for the Apps in Toss toolchain, so the same
+*   decision is kept here.
+*
+* `packages/cli/test/pnpm-build-approvals.test.ts` records every package with
+* an install script in the starter's Firebase tree and fails when the starter's
+* firebase version moves without that list (and a decision here) being redone.
+*/
+export declare const notificationsBuildApprovals: Readonly<Record<string, boolean>>;
+export type AllowBuildsEdit = {
+  readonly kind: 'covered';
+} | {
+  readonly kind: 'edited';
+  readonly content: string;
+  readonly added: readonly string[];
+} | {
+  readonly kind: 'unsupported';
+  readonly missing: readonly string[];
+};
+/** The package a matcher names: `name`, `name@range`, `@scope/name@range`, or `name@git-url`. */
+export declare function allowBuildsPackageName(matcher: string): string;
+/**
+* Adds an explicit decision for each package in `approvals` that the
+* `pnpm-workspace.yaml` content does not list yet, keeping every existing
+* entry (a game's own decision wins). Only the block-mapping form the game
+* template writes is edited; another form is reported as unsupported so the
+* caller can print the entries instead of rewriting YAML it cannot parse.
+*/
+export declare function addAllowBuilds(content: string, approvals: Readonly<Record<string, boolean>>): AllowBuildsEdit;
+/** The `allowBuilds` block to print when the caller cannot edit the file itself. */
+export declare function allowBuildsSnippet(approvals: Readonly<Record<string, boolean>>): string;
+/**
+* The `pnpm-workspace.yaml` edit a notifications game needs before its
+* install adds `firebase`: the new content when the file can be edited, or a
+* warning with the entries to add when it cannot (no file at the game root,
+* where a parent workspace may govern the install, or a form this edit does
+* not parse).
+*/
+export declare function planNotificationsBuildApprovals(workspace: string | undefined): {
+  readonly content?: string;
+  readonly warning?: string;
+};