@yoonion/mimi-seed-mcp 0.21.4 → 0.21.6

package/dist/appstore/auth.d.ts

@@ -43,7 +43,9 @@ export declare function normalizeVendorNumber(vendorNumber?: string): string | u
 export declare function mergeAppStoreCredentials(existing: AppStoreCredentials | null, primary: AppStoreKey, vendorNumber?: string): AppStoreCredentials;
 export declare function getAppStoreCredentials(): AppStoreCredentials | null;
 export declare function saveAppStoreCredentials(creds: AppStoreCredentials): void;
-export declare function generateToken(creds: AppStoreCredentials): Promise<string>;
+export declare function generateToken(creds: AppStoreKey): Promise<string>;
+/** 테스트용 — 캐시 초기화. */
+export declare function clearAppStoreTokenCache(): void;
 export declare function getAuthHeaders(): Promise<Record<string, string> | null>;
 /**
  * 매출 리포트용 헤더 — reportsKey 가 있으면 그걸로, 없으면 최상위 키로 폴백.

package/dist/appstore/auth.js

@@ -86,12 +86,37 @@ export async function generateToken(creds) {
         .setAudience('appstoreconnect-v1')
         .sign(key);
 }
+/** 토큰 수명(20분) 중 이만큼 남으면 새로 서명한다 — 긴 업로드 도중 만료되지 않게. */
+const TOKEN_REFRESH_MARGIN_MS = 5 * 60 * 1000;
+const TOKEN_LIFETIME_MS = 19 * 60 * 1000; // iat 를 60초 당겨 서명하므로 실제 잔여는 19분
+/**
+ * 키별 JWT 캐시. 예전엔 요청마다 PKCS8 import + ES256 서명을 다시 했다 (매출 DAILY 조회는 최대 62회 연속).
+ * 캐시 키에 privateKey 자체를 포함해 키 교체·재등록 시 자동으로 무효화된다.
+ */
+const tokenCache = new Map();
+function cachedToken(key) {
+    const cacheKey = `${key.issuerId}\u0000${key.keyId}\u0000${key.privateKey}`;
+    const hit = tokenCache.get(cacheKey);
+    if (hit && hit.expiresAt - Date.now() > TOKEN_REFRESH_MARGIN_MS)
+        return hit.token;
+    const token = generateToken(key);
+    tokenCache.set(cacheKey, { token, expiresAt: Date.now() + TOKEN_LIFETIME_MS });
+    // 서명 실패는 캐시하지 않는다 — 다음 호출이 다시 시도해 원인 메시지를 받게.
+    token.catch(() => {
+        if (tokenCache.get(cacheKey)?.token === token)
+            tokenCache.delete(cacheKey);
+    });
+    return token;
+}
+/** 테스트용 — 캐시 초기화. */
+export function clearAppStoreTokenCache() {
+    tokenCache.clear();
+}
 export async function getAuthHeaders() {
     const creds = getAppStoreCredentials();
     if (!creds)
         return null;
-    const token = await generateToken(creds);
-    return { Authorization: `Bearer ${token}` };
+    return { Authorization: `Bearer ${await cachedToken(creds)}` };
 }
 /**
  * 매출 리포트용 헤더 — reportsKey 가 있으면 그걸로, 없으면 최상위 키로 폴백.
@@ -105,12 +130,12 @@ export async function getReportsAuthHeaders() {
         return null;
     if (creds.reportsKey) {
         return {
-            headers: { Authorization: `Bearer ${await generateToken(creds.reportsKey)}` },
+            headers: { Authorization: `Bearer ${await cachedToken(creds.reportsKey)}` },
             source: 'reportsKey',
         };
     }
     return {
-        headers: { Authorization: `Bearer ${await generateToken(creds)}` },
+        headers: { Authorization: `Bearer ${await cachedToken(creds)}` },
         source: 'default',
     };
 }

package/dist/appstore/client.d.ts

@@ -18,4 +18,5 @@ export interface AppStoreVerifyResult {
  */
 export declare function verifyAppStoreCredentials(creds?: import("./auth.js").AppStoreCredentials | null): Promise<AppStoreVerifyResult>;
 export declare function apiPatch(path: string, body: unknown): Promise<any>;
+/** 201 Created — 본문에 created entity. 일부 엔드포인트는 204 (→ { ok: true }). */
 export declare function apiPost(path: string, body: unknown): Promise<any>;

package/dist/appstore/client.js

@@ -1,34 +1,14 @@
-import { getAuthHeaders, getAppStoreCredentials, generateToken } from './auth.js';
-import { friendlyAppStoreError } from './errors.js';
+import { getAppStoreCredentials, generateToken } from './auth.js';
+import { authHeadersOrThrow, apiRequest, V1_BASE } from './http.js';
 import { fetchWithTimeout } from '../lib/http.js';
 /**
  * App Store Connect API v1 래퍼
  * https://developer.apple.com/documentation/appstoreconnectapi
  */
-const BASE = 'https://api.appstoreconnect.apple.com/v1';
+const BASE = V1_BASE;
 export async function apiGet(path, params) {
-    const headers = await getAuthHeaders();
-    if (!headers)
-        throw new Error([
-            '❌ App Store Connect 인증이 필요해.',
-            '',
-            '터미널에서 실행:',
-            '  npx -p @yoonion/mimi-seed-mcp mimi-seed-appstore-auth',
-            '',
-            'API Key가 필요해:',
-            '  App Store Connect > Users and Access > Integrations > Keys',
-        ].join('\n'));
-    const url = new URL(`${BASE}${path}`);
-    if (params) {
-        for (const [k, v] of Object.entries(params))
-            url.searchParams.set(k, v);
-    }
-    const res = await fetchWithTimeout(url.toString(), { headers });
-    if (!res.ok) {
-        const body = await res.text();
-        throw friendlyAppStoreError(res.status, body);
-    }
-    return res.json();
+    const query = params ? `?${new URLSearchParams(params).toString()}` : '';
+    return apiRequest(BASE, `${path}${query}`, await authHeadersOrThrow(), { method: 'GET' });
 }
 /**
  * appstore.json 자격증명 유효성 단계별 검증 (creds → sign → auth → api).
@@ -85,46 +65,17 @@ export async function verifyAppStoreCredentials(creds = getAppStoreCredentials()
     };
 }
 export async function apiPatch(path, body) {
-    const headers = await getAuthHeaders();
-    if (!headers)
-        throw new Error([
-            '❌ App Store Connect 인증이 필요해.',
-            '',
-            '터미널에서 실행:',
-            '  npx -p @yoonion/mimi-seed-mcp mimi-seed-appstore-auth',
-        ].join('\n'));
-    const res = await fetchWithTimeout(`${BASE}${path}`, {
+    return apiRequest(BASE, path, await authHeadersOrThrow(), {
         method: 'PATCH',
-        headers: { ...headers, 'Content-Type': 'application/json' },
+        headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify(body),
     });
-    if (!res.ok) {
-        const text = await res.text();
-        throw friendlyAppStoreError(res.status, text);
-    }
-    // 204 No Content 가능
-    const text = await res.text();
-    return text ? JSON.parse(text) : { ok: true };
 }
+/** 201 Created — 본문에 created entity. 일부 엔드포인트는 204 (→ { ok: true }). */
 export async function apiPost(path, body) {
-    const headers = await getAuthHeaders();
-    if (!headers)
-        throw new Error([
-            '❌ App Store Connect 인증이 필요해.',
-            '',
-            '터미널에서 실행:',
-            '  npx -p @yoonion/mimi-seed-mcp mimi-seed-appstore-auth',
-        ].join('\n'));
-    const res = await fetchWithTimeout(`${BASE}${path}`, {
+    return apiRequest(BASE, path, await authHeadersOrThrow(), {
         method: 'POST',
-        headers: { ...headers, 'Content-Type': 'application/json' },
+        headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify(body),
     });
-    if (!res.ok) {
-        const text = await res.text();
-        throw friendlyAppStoreError(res.status, text);
-    }
-    // 201 Created — 본문에 created entity. 일부 엔드포인트는 204
-    const text = await res.text();
-    return text ? JSON.parse(text) : { ok: true };
 }

package/dist/appstore/http.d.ts

@@ -1,5 +1,10 @@
 export declare const V1_BASE = "https://api.appstoreconnect.apple.com/v1";
 export declare const V2_BASE = "https://api.appstoreconnect.apple.com/v2";
+/**
+ * 타입 없는 ASC 응답 — apiGet/apiPost/apiPatch 가 예전부터 `res.json()`(any)을 그대로 돌려줬고
+ * 호출부가 그 형태에 기대고 있다. 새 코드는 apiRequest<T> 에 구체 타입을 넘길 것.
+ */
+export type UntypedAscJson = any;
 export type AppStoreProductType = 'subscription' | 'consumable' | 'non_consumable';
 export declare function authHeadersOrThrow(): Promise<Record<string, string>>;
 export declare function apiRequest<T>(base: string, resourcePath: string, authHeaders: Record<string, string>, init: RequestInit): Promise<T>;

package/dist/appstore/products.js

@@ -1,31 +1,19 @@
 // App Store Connect — 인앱 구매(IAP v2)·자동 갱신 구독 생성.
 // appstore/tools.ts 가 이 모듈을 그대로 re-export 한다 — 호출부는 tools.js 경로를 계속 쓴다.
-import { getAuthHeaders } from './auth.js';
+import { apiRequest, authHeadersOrThrow, V2_BASE } from './http.js';
 import { apiGet, apiPost } from './client.js';
-import { fetchWithTimeout } from '../lib/http.js';
 import { encodePathSegment } from '../lib/url-path.js';
 // ─── 인앱 구매 (IAP) 생성 ───
 // 2023년 출시된 IAP v2 API (POST /v2/inAppPurchases) 사용.
 // 흐름: (1) IAP draft 생성 → (2) 로컬라이제이션 → (3) priceSchedule → (4) submission(선택).
 // 가격은 territory별 pricePoint ID 기반 — IAP를 만든 뒤 GET /pricePoints로 조회해 매칭.
 // 자동 제출(submission)은 권장 가이드라인 (스크린샷·리뷰 노트 등)이 충족돼야 통과.
-const IAP_V2_BASE = 'https://api.appstoreconnect.apple.com/v2';
 async function apiPostV2(path, body) {
-    const headers = await getAuthHeaders();
-    if (!headers) {
-        throw new Error('App Store Connect 인증 필요 — npx -p @yoonion/mimi-seed-mcp mimi-seed-appstore-auth');
-    }
-    const res = await fetchWithTimeout(`${IAP_V2_BASE}${path}`, {
+    return apiRequest(V2_BASE, path, await authHeadersOrThrow(), {
         method: 'POST',
-        headers: { ...headers, 'Content-Type': 'application/json' },
+        headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify(body),
     });
-    if (!res.ok) {
-        const text = await res.text();
-        throw new Error(`App Store v2 ${res.status}: ${text}`);
-    }
-    const text = await res.text();
-    return text ? JSON.parse(text) : { ok: true };
 }
 async function findClosestPricePoint(resourceUrl, territory, targetPrice) {
     // resourceUrl 예: '/inAppPurchases/{id}/pricePoints' 또는 '/subscriptions/{id}/pricePoints'

package/dist/appstore/sales.js

@@ -152,6 +152,28 @@ export function eachDate(startDate, endDate, maxDays) {
 }
 /** DAILY 는 하루에 리포트 하나라, 범위 조회는 날짜별 호출을 합치는 수밖에 없다. */
 const MAX_DAILY_RANGE = 62;
+const SALES_FETCH_CONCURRENCY = 4;
+/** 순서를 보존하며 최대 `limit` 개씩 동시에 실행한다. 하나라도 실패하면 그 에러로 reject. */
+async function mapWithConcurrency(items, limit, fn) {
+    const out = new Array(items.length);
+    let next = 0;
+    let failed = false;
+    const worker = async () => {
+        // 하나가 실패하면 결과 전체가 버려지므로 새 요청을 더 시작하지 않는다.
+        while (!failed && next < items.length) {
+            const i = next++;
+            try {
+                out[i] = await fn(items[i]);
+            }
+            catch (error) {
+                failed = true;
+                throw error;
+            }
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+    return out;
+}
 export async function getSalesReport(options) {
     const vendorNumber = resolveVendorNumber(options.vendorNumber);
     const frequency = options.frequency ?? 'DAILY';
@@ -162,22 +184,25 @@ export async function getSalesReport(options) {
     const datesWithData = [];
     const datesWithoutData = [];
     const rows = [];
-    for (const reportDate of reportDates) {
-        const result = await fetchReport('/salesReports', {
-            'filter[frequency]': frequency,
-            'filter[reportType]': options.reportType ?? 'SALES',
-            'filter[reportSubType]': options.reportSubType ?? 'SUMMARY',
-            'filter[vendorNumber]': vendorNumber,
-            'filter[reportDate]': reportDate,
-            'filter[version]': options.version ?? '1_0',
-        });
+    // 일자별 리포트는 서로 독립이라 동시에 받는다. 상한은 ASC 레이트 리밋(시간당 ~3600)에 비해
+    // 충분히 낮게 두고, 결과는 날짜 순서를 유지해 합친다. 429 는 fetchWithTimeout 이 재시도한다.
+    const results = await mapWithConcurrency(reportDates, SALES_FETCH_CONCURRENCY, (reportDate) => fetchReport('/salesReports', {
+        'filter[frequency]': frequency,
+        'filter[reportType]': options.reportType ?? 'SALES',
+        'filter[reportSubType]': options.reportSubType ?? 'SUMMARY',
+        'filter[vendorNumber]': vendorNumber,
+        'filter[reportDate]': reportDate,
+        'filter[version]': options.version ?? '1_0',
+    }));
+    results.forEach((result, i) => {
+        const reportDate = reportDates[i];
         if (result.notFound || result.rows.length === 0)
             datesWithoutData.push(reportDate);
         else {
             datesWithData.push(reportDate);
             rows.push(...result.rows);
         }
-    }
+    });
     const lines = rows.map(toSalesLine);
     const proceedsByCurrency = {};
     let paidUnits = 0;

package/dist/auth/google-auth.d.ts

@@ -101,19 +101,6 @@ export type RefreshStatus = {
     status: 'unauthenticated';
     error: AuthErrorPayload;
 };
-/**
- * 저장된 access_token이 만료/곧만료면 refresh_token으로 silent 갱신 시도.
- * - 갱신 성공 시 tokens.json 업데이트
- * - refresh_token 자체가 invalid한 경우 'expired_refresh_failed' 반환
- * - 토큰 자체가 없으면 'unauthenticated'
- *
- * MCP 도구와 CLI 양쪽에서 공유.
- */
-/**
- * 사전 갱신 마진. 기존 60_000(1분)에서 300_000(5분)으로 상향 — Google OAuth access_token 의
- * 통상 lifetime 이 1h 이므로, 5분 마진으로 매 도구 호출 시 만료 임박 시 사전 갱신해
- * "토큰 만료 → 도구 fail → 재호출" 의 단절 마찰 제거. 5분 마진은 평균 도구 작업 시간을 흡수.
- */
 export declare function ensureFreshAccessToken(marginMs?: number, profile?: string): Promise<RefreshStatus>;
 /**
  * 저장된 로그인이 어느 Google 계정인지. 로그인 때 기록한 값을 우선 쓰고, 기록이 없는 구 토큰은

package/dist/auth/google-auth.js

@@ -439,7 +439,19 @@ export function startAuth(clientId, clientSecret, options = {}) {
  * 통상 lifetime 이 1h 이므로, 5분 마진으로 매 도구 호출 시 만료 임박 시 사전 갱신해
  * "토큰 만료 → 도구 fail → 재호출" 의 단절 마찰 제거. 5분 마진은 평균 도구 작업 시간을 흡수.
  */
-export async function ensureFreshAccessToken(marginMs = 300_000, profile) {
+// 같은 프로세스에서 병렬 툴 호출이 동시에 만료 임박을 보면 각자 refresh 하고 tokens.json 을
+// 경쟁적으로 덮어썼다. 진행 중인 갱신을 프로필별로 공유해 refresh 를 1회로 합친다.
+const inflightRefresh = new Map();
+export function ensureFreshAccessToken(marginMs = 300_000, profile) {
+    const key = `${profile ?? ''}\u0000${marginMs}`;
+    const running = inflightRefresh.get(key);
+    if (running)
+        return running;
+    const promise = ensureFreshAccessTokenOnce(marginMs, profile).finally(() => inflightRefresh.delete(key));
+    inflightRefresh.set(key, promise);
+    return promise;
+}
+async function ensureFreshAccessTokenOnce(marginMs, profile) {
     const tokens = getStoredTokens(profile);
     if (!tokens) {
         return {

package/dist/core/checks/release-doctor/fcm.d.ts

@@ -0,0 +1,3 @@
+import type { ProjectFile, ReleaseDoctorFinding } from './types.js';
+export declare const FCM_HINT: RegExp;
+export declare function fcmFindings(files: ProjectFile[], sources: ProjectFile[], root: string, now: Date): Promise<ReleaseDoctorFinding[]>;

package/dist/core/checks/release-doctor/fcm.js

@@ -0,0 +1,270 @@
+// Release Doctor Firebase Cloud Messaging legacy API / firebase-admin topic check.
+// Internal to Release Doctor — import the public API (scanReleaseDoctor, report types) from ../release-doctor.js.
+import path from 'node:path';
+import { lockedPackageVersion, lockfileDirectories, readText } from '../lockfile.js';
+import { unique } from './util.js';
+// Firebase Cloud Messaging legacy surfaces.
+// - Legacy HTTP/XMPP send (fcm/send) was deprecated 2023-06-20 and shut down from 2024-07-22; the replacement is
+//   the HTTP v1 API.
+// - Instance ID server APIs (iid.googleapis.com, incl. legacy topic management) and device group management
+//   (fcm.googleapis.com/fcm/notification and its aliases) are decommissioned 2027-09-29 (FCM troubleshooting FAQ).
+// - firebase-admin (Node) 14.5.0 moved subscribeToTopic/unsubscribeFromTopic off Instance ID onto the FCM v1 topic
+//   subscription API and added deprecated *Legacy escape hatches that still use Instance ID. The FAQ lists Node
+//   Admin SDK <= 14.4.0 as impacted. firebase-admin 14.x declares engines.node >= 22.
+const FCM_LEGACY_SEND_SOURCE = 'https://firebase.google.com/docs/cloud-messaging/send/v1-api';
+const FCM_DEPRECATION_SOURCE = 'https://firebase.google.com/docs/cloud-messaging/troubleshooting#fcm-26-deprecation';
+const FCM_INSTANCE_ID_DECOMMISSION = '2027-09-29';
+const FIREBASE_ADMIN_TOPICS_SOURCE = 'https://github.com/firebase/firebase-admin-node/releases/tag/v14.5.0';
+const FIREBASE_ADMIN_TOPICS_VERSION = [14, 5, 0];
+const FIREBASE_ADMIN_14_NODE = '22';
+const FCM_LEGACY_SEND = /\b(?:fcm\.googleapis\.com\/fcm\/send|gcm-http\.googleapis\.com\/gcm\/send)\b/;
+const FCM_INSTANCE_ID = /\biid\.googleapis\.com\b/;
+const FCM_DEVICE_GROUP = /\bfcm\.googleapis\.com\/(?:fcm\/|gcm\/|iid\/)?notification\b/;
+const FCM_LEGACY_TOPIC_METHOD = /\b(?:subscribeToTopicLegacy|unsubscribeFromTopicLegacy)\b/;
+export const FCM_HINT = new RegExp([FCM_LEGACY_SEND, FCM_INSTANCE_ID, FCM_DEVICE_GROUP, FCM_LEGACY_TOPIC_METHOD]
+    .map((re) => re.source).join('|'));
+function compareVersions(left, right) {
+    for (let index = 0; index < Math.max(left.length, right.length); index++) {
+        const difference = (left[index] ?? 0) - (right[index] ?? 0);
+        if (difference !== 0)
+            return difference;
+    }
+    return 0;
+}
+function parseExactVersion(value) {
+    const match = value.trim().match(/^v?(\d+)\.(\d+)\.(\d+)/);
+    return match ? match.slice(1, 4).map((part) => Number.parseInt(part, 10)) : undefined;
+}
+/**
+ * True when no version allowed by the npm range reaches `target` (its highest satisfiable version is lower),
+ * false when some allowed version reaches it, undefined when the range is not a plain semver range.
+ */
+function rangeStaysBelow(range, target) {
+    const alternatives = range.split('||').map((part) => part.trim());
+    for (const alternative of alternatives) {
+        if (alternative === '' || alternative === '*' || /^(?:x|X|latest)$/.test(alternative))
+            return false;
+        let upper;
+        const tighten = (candidate) => {
+            if (!upper || compareVersions(candidate.version, upper.version) < 0)
+                upper = candidate;
+        };
+        const hyphen = alternative.match(/^(\S+)\s+-\s+(\S+)$/);
+        const comparators = hyphen
+            ? [`>=${hyphen[1]}`, `<=${hyphen[2]}`]
+            : alternative.replace(/(>=|<=|>|<|=|\^|~)\s+/g, '$1').split(/\s+/);
+        for (const comparator of comparators) {
+            const match = comparator.match(/^(\^|~|>=|<=|>|<|=|v)?(\d+|[xX*])(?:\.(\d+|[xX*]))?(?:\.(\d+|[xX*]))?(?:[-+][\w.-]*)?$/);
+            if (!match)
+                return undefined;
+            const [, operator = '', majorPart, minorPart, patchPart] = match;
+            const wild = (part) => part === undefined || /^[xX*]$/.test(part);
+            if (wild(majorPart)) {
+                if (operator === '<' || operator === '<=')
+                    return undefined;
+                continue;
+            }
+            const major = Number.parseInt(majorPart, 10);
+            const minor = wild(minorPart) ? undefined : Number.parseInt(minorPart, 10);
+            const patch = wild(patchPart) ? undefined : Number.parseInt(patchPart, 10);
+            const partialCeiling = () => minor === undefined
+                ? { version: [major + 1, 0, 0], inclusive: false }
+                : patch === undefined
+                    ? { version: [major, minor + 1, 0], inclusive: false }
+                    : { version: [major, minor, patch], inclusive: true };
+            if (operator === '>' || operator === '>=')
+                continue;
+            if (operator === '<')
+                tighten({ version: [major, minor ?? 0, patch ?? 0], inclusive: false });
+            else if (operator === '<=' || operator === '' || operator === '=' || operator === 'v')
+                tighten(partialCeiling());
+            else if (operator === '~')
+                tighten(minor === undefined ? partialCeiling() : { version: [major, minor + 1, 0], inclusive: false });
+            else if (operator === '^') {
+                tighten(major > 0 || minor === undefined
+                    ? { version: [major + 1, 0, 0], inclusive: false }
+                    : minor > 0 || patch === undefined
+                        ? { version: [0, minor + 1, 0], inclusive: false }
+                        : { version: [0, 0, patch + 1], inclusive: false });
+            }
+        }
+        if (!upper)
+            return false;
+        const reaches = upper.inclusive
+            ? compareVersions(upper.version, target) >= 0
+            : compareVersions(upper.version, target) > 0;
+        if (reaches)
+            return false;
+    }
+    return true;
+}
+async function firebaseAdminEvidence(files, root) {
+    const result = [];
+    for (const file of files.filter((candidate) => /(?:^|\/)package\.json$/.test(candidate.relative)
+        && !candidate.relative.split('/').includes('node_modules'))) {
+        let manifest;
+        try {
+            manifest = JSON.parse(file.text);
+        }
+        catch {
+            continue;
+        }
+        const declared = ['dependencies', 'devDependencies']
+            .map((key) => manifest[key])
+            .map((group) => (group && typeof group === 'object' ? group['firebase-admin'] : undefined))
+            .find((value) => typeof value === 'string');
+        if (!declared)
+            continue;
+        const packageDir = path.dirname(file.absolute);
+        // Ancestors up to the scan root, then on to the repository root (a --path into a workspace monorepo).
+        const directories = await lockfileDirectories(packageDir, root);
+        // 1. The installed copy (hoisted installs put it in an ancestor's node_modules).
+        let resolved;
+        for (const directory of directories) {
+            const text = await readText(path.join(directory, 'node_modules', 'firebase-admin', 'package.json'));
+            if (!text)
+                continue;
+            try {
+                const version = JSON.parse(text).version;
+                if (typeof version === 'string' && parseExactVersion(version)) {
+                    resolved = { file: file.relative, version, source: 'installed' };
+                    break;
+                }
+            }
+            catch {
+                // Keep looking.
+            }
+        }
+        // 2. The nearest lockfile's resolution.
+        if (!resolved) {
+            for (const directory of directories) {
+                const version = (await lockedPackageVersion('firebase-admin', packageDir, directory, declared))?.version;
+                if (version && parseExactVersion(version)) {
+                    resolved = { file: file.relative, version, source: 'lockfile' };
+                    break;
+                }
+            }
+        }
+        if (resolved) {
+            if (compareVersions(parseExactVersion(resolved.version), FIREBASE_ADMIN_TOPICS_VERSION) < 0) {
+                result.push({ ...resolved, major: parseExactVersion(resolved.version)[0] });
+            }
+            continue;
+        }
+        // 3. The declared range, flagged only when no version it allows reaches 14.5.0.
+        if (rangeStaysBelow(declared, FIREBASE_ADMIN_TOPICS_VERSION) === true) {
+            const major = declared.match(/\d+/)?.[0];
+            result.push({ file: file.relative, version: declared, source: 'declared', major: major ? Number.parseInt(major, 10) : undefined });
+        }
+    }
+    return result;
+}
+function listFiles(files) {
+    const names = unique(files.map((file) => file.relative));
+    return names.length > 3 ? `${names.slice(0, 3).join(', ')} (+${names.length - 3})` : names.join(', ');
+}
+export async function fcmFindings(files, sources, root, now) {
+    const findings = [];
+    const today = now.toISOString().slice(0, 10);
+    const decommissioned = today >= FCM_INSTANCE_ID_DECOMMISSION;
+    const scheduled = decommissioned ? 'decommissioned' : 'decommissions';
+    const scheduledKo = decommissioned ? '종료했습니다' : '종료합니다';
+    const legacySend = sources.filter((file) => FCM_LEGACY_SEND.test(file.text));
+    if (legacySend.length > 0) {
+        findings.push({
+            code: 'FCM_LEGACY_SEND_API',
+            severity: 'warning',
+            title: 'Code calls the shut-down legacy FCM send endpoint',
+            detail: `Found fcm/send in ${listFiles(legacySend)}. Firebase deprecated the legacy HTTP and XMPP send APIs in June 2023 and began shutting them down on 2024-07-22, so these push requests no longer deliver.`,
+            action: 'Send through the FCM HTTP v1 API (projects.messages.send) or a Firebase Admin SDK instead.',
+            file: legacySend[0].relative,
+            sourceUrl: FCM_LEGACY_SEND_SOURCE,
+            ko: {
+                title: '종료된 레거시 FCM 발송 엔드포인트를 호출하는 코드',
+                detail: `${listFiles(legacySend)}에서 fcm/send를 찾았습니다. Firebase는 레거시 HTTP·XMPP 발송 API를 2023년 6월 지원 중단하고 2024-07-22부터 종료했으므로 이 푸시 요청은 전달되지 않습니다.`,
+                action: 'FCM HTTP v1 API(projects.messages.send) 또는 Firebase Admin SDK로 발송하세요.',
+            },
+        });
+    }
+    const instanceId = sources.filter((file) => FCM_INSTANCE_ID.test(file.text));
+    if (instanceId.length > 0) {
+        findings.push({
+            code: 'FCM_INSTANCE_ID_API',
+            severity: decommissioned ? 'warning' : 'info',
+            title: decommissioned
+                ? 'Code calls the decommissioned Instance ID server API'
+                : 'Code calls the deprecated Instance ID server API',
+            detail: `Found iid.googleapis.com in ${listFiles(instanceId)}. Firebase ${scheduled} the Instance ID server APIs (token info, legacy topic management, batch import) on ${FCM_INSTANCE_ID_DECOMMISSION}.`,
+            action: 'Manage topics with the FCM topic subscription API, and validate tokens with an FCM v1 send using validate_only.',
+            file: instanceId[0].relative,
+            sourceUrl: FCM_DEPRECATION_SOURCE,
+            ko: {
+                title: decommissioned
+                    ? '종료된 Instance ID 서버 API를 호출하는 코드'
+                    : '지원 중단된 Instance ID 서버 API를 호출하는 코드',
+                detail: `${listFiles(instanceId)}에서 iid.googleapis.com을 찾았습니다. Firebase는 Instance ID 서버 API(토큰 정보, 레거시 토픽 관리, 일괄 가져오기)를 ${FCM_INSTANCE_ID_DECOMMISSION}에 ${scheduledKo}.`,
+                action: '토픽은 FCM 토픽 구독 API로 관리하고, 토큰 검증은 validate_only를 켠 FCM v1 발송으로 대체하세요.',
+            },
+        });
+    }
+    const deviceGroup = sources.filter((file) => FCM_DEVICE_GROUP.test(file.text));
+    if (deviceGroup.length > 0) {
+        findings.push({
+            code: 'FCM_DEVICE_GROUP_API',
+            severity: decommissioned ? 'warning' : 'info',
+            title: decommissioned
+                ? 'Code calls the decommissioned FCM device group management API'
+                : 'Code calls the deprecated FCM device group management API',
+            detail: `Found fcm/notification in ${listFiles(deviceGroup)}. Firebase ${scheduled} device group management and device group tokens on ${FCM_INSTANCE_ID_DECOMMISSION}.`,
+            action: 'Send to individual registration tokens (or topics) with the FCM v1 API, following Firebase\'s guide for migrating off device groups.',
+            file: deviceGroup[0].relative,
+            sourceUrl: FCM_DEPRECATION_SOURCE,
+            ko: {
+                title: decommissioned
+                    ? '종료된 FCM 기기 그룹 관리 API를 호출하는 코드'
+                    : '지원 중단된 FCM 기기 그룹 관리 API를 호출하는 코드',
+                detail: `${listFiles(deviceGroup)}에서 fcm/notification을 찾았습니다. Firebase는 기기 그룹 관리와 기기 그룹 토큰을 ${FCM_INSTANCE_ID_DECOMMISSION}에 ${scheduledKo}.`,
+                action: 'Firebase의 기기 그룹 이전 가이드에 따라 FCM v1 API로 개별 등록 토큰(또는 토픽)에 발송하세요.',
+            },
+        });
+    }
+    const legacyTopic = sources.filter((file) => FCM_LEGACY_TOPIC_METHOD.test(file.text));
+    if (legacyTopic.length > 0) {
+        findings.push({
+            code: 'FCM_LEGACY_TOPIC_METHODS',
+            severity: decommissioned ? 'warning' : 'info',
+            title: 'Code uses the deprecated firebase-admin *Legacy topic methods',
+            detail: `Found subscribeToTopicLegacy / unsubscribeFromTopicLegacy in ${listFiles(legacyTopic)}. These escape hatches keep using the Instance ID API, which Firebase ${scheduled} on ${FCM_INSTANCE_ID_DECOMMISSION}.`,
+            action: 'Call subscribeToTopic / unsubscribeFromTopic instead; since firebase-admin 14.5.0 they use the FCM v1 topic subscription API.',
+            file: legacyTopic[0].relative,
+            sourceUrl: FIREBASE_ADMIN_TOPICS_SOURCE,
+            ko: {
+                title: '지원 중단된 firebase-admin *Legacy 토픽 메서드를 사용하는 코드',
+                detail: `${listFiles(legacyTopic)}에서 subscribeToTopicLegacy / unsubscribeFromTopicLegacy를 찾았습니다. 이 메서드는 Instance ID API를 계속 사용하며, Firebase는 이 API를 ${FCM_INSTANCE_ID_DECOMMISSION}에 ${scheduledKo}.`,
+                action: 'subscribeToTopic / unsubscribeFromTopic을 사용하세요. firebase-admin 14.5.0부터 FCM v1 토픽 구독 API를 사용합니다.',
+            },
+        });
+    }
+    const outdated = await firebaseAdminEvidence(files, root);
+    if (outdated.length > 0) {
+        const first = outdated[0];
+        const sourceLabel = { installed: 'installed', lockfile: 'lockfile', declared: 'declared range' }[first.source];
+        const sourceLabelKo = { installed: '설치됨', lockfile: 'lockfile', declared: '선언 범위' }[first.source];
+        const nodeNote = first.major !== undefined && first.major < 14;
+        findings.push({
+            code: 'FIREBASE_ADMIN_LEGACY_TOPIC_TRANSPORT',
+            severity: decommissioned ? 'warning' : 'info',
+            title: 'firebase-admin before 14.5.0 manages topics through the Instance ID API',
+            detail: `${first.file} uses firebase-admin ${first.version} (${sourceLabel}). From 14.5.0, subscribeToTopic / unsubscribeFromTopic use the FCM v1 topic subscription API; earlier versions call the Instance ID API, which Firebase ${scheduled} on ${FCM_INSTANCE_ID_DECOMMISSION}. Only topic subscription calls are affected.`,
+            action: `Upgrading firebase-admin to 14.5.0 or later is the migration; the method names stay the same. Run your topic subscription tests after upgrading.${nodeNote ? ` firebase-admin 14 requires Node.js ${FIREBASE_ADMIN_14_NODE} or later.` : ''}`,
+            file: first.file,
+            sourceUrl: FCM_DEPRECATION_SOURCE,
+            ko: {
+                title: 'firebase-admin 14.5.0 이전 버전은 Instance ID API로 토픽을 관리함',
+                detail: `${first.file}의 firebase-admin 버전은 ${first.version}(${sourceLabelKo})입니다. 14.5.0부터 subscribeToTopic / unsubscribeFromTopic은 FCM v1 토픽 구독 API를 쓰고, 이전 버전은 Instance ID API를 호출합니다. Firebase는 이 API를 ${FCM_INSTANCE_ID_DECOMMISSION}에 ${scheduledKo}. 토픽 구독 호출만 영향을 받습니다.`,
+                action: `firebase-admin을 14.5.0 이상으로 올리는 것이 마이그레이션입니다. 메서드 이름은 그대로이며, 업그레이드 후 토픽 구독 테스트를 실행하세요.${nodeNote ? ` firebase-admin 14는 Node.js ${FIREBASE_ADMIN_14_NODE} 이상이 필요합니다.` : ''}`,
+            },
+        });
+    }
+    return findings;
+}

package/dist/core/checks/release-doctor/files.d.ts

@@ -0,0 +1,16 @@
+import type { ProjectFile } from './types.js';
+export declare const MAX_SOURCE_FILES = 4000;
+export declare const EXCLUDED_EVIDENCE_DIRS: Set<string>;
+export declare const SAMPLE_ONLY_DIRS: Set<string>;
+export declare const TEST_TARGET_DIR: RegExp;
+/** Codes whose check could not decide; see `coverage.unresolved`. */
+export declare const UNRESOLVED_CODES: Set<string>;
+export declare function walk(root: string, maxSourceFiles?: number, maxDepth?: number): Promise<{
+    files: ProjectFile[];
+    fcmSources: ProjectFile[];
+    sourceScanTruncated: boolean;
+    /** Convention-build roots that could not be read completely. */
+    conventionTruncated: string[];
+}>;
+/** Convention-build sources the Target API net reads: scripts and plugin sources in every JVM build language. */
+export declare const CONVENTION_SOURCE_FILE: RegExp;