@daemux/store-automator 0.6.0 → 0.7.1

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "App Store & Google Play automation for Flutter apps",
-    "version": "0.6.0"
+    "version": "0.7.1"
   },
   "plugins": [
     {
       "name": "store-automator",
       "source": "./plugins/store-automator",
       "description": "3 agents for app store publishing: reviewer, meta-creator, media-designer",
-      "version": "0.6.0",
+      "version": "0.7.1",
       "keywords": ["flutter", "app-store", "google-play", "fastlane", "codemagic"]
     }
   ]

package/README.md

@@ -27,7 +27,7 @@ npm install @daemux/store-automator
 
 The postinstall script will:
 
-1. Prompt for MCP server tokens (Stitch, Cloudflare, Codemagic)
+1. Prompt for bundle ID and MCP server tokens (Stitch, Cloudflare, Codemagic)
 2. Configure `.mcp.json` with MCP servers (Playwright, mobile-mcp, Stitch, Cloudflare, Codemagic)
 3. Install the plugin marketplace and register agents
 4. Copy `CLAUDE.md` template to `.claude/CLAUDE.md`
@@ -122,13 +122,14 @@ For CI/CD environments or scripted setups, pass tokens as CLI flags to skip inte
 
 ```bash
 npx @daemux/store-automator \
+  --bundle-id=com.company.app \
   --codemagic-token=YOUR_CM_TOKEN \
   --stitch-key=YOUR_STITCH_KEY \
   --cloudflare-token=YOUR_CF_TOKEN \
   --cloudflare-account-id=YOUR_CF_ACCOUNT_ID
 ```
 
-Any tokens provided via flags will skip the corresponding interactive prompt. If all four tokens are provided, the entire interactive session is skipped.
+Any tokens provided via flags will skip the corresponding interactive prompt. If all four tokens are provided, the entire interactive session is skipped. The bundle ID, if provided, is automatically written to `bundle_id` and `package_name` in `ci.config.yaml`.
 
 ## CLI Options
 
@@ -142,6 +143,9 @@ Options:
   -v, --version                  Show version number
   -h, --help                     Show help
 
+App Configuration:
+  --bundle-id=ID                 Bundle ID / Package Name (e.g., com.company.app)
+
 MCP Token Flags (skip interactive prompts):
   --codemagic-token=TOKEN        Codemagic API token
   --stitch-key=KEY               Stitch MCP API key

package/bin/cli.mjs

@@ -27,11 +27,13 @@ function flagValue(arg, prefix) {
   return arg.startsWith(prefix) ? arg.slice(prefix.length) : undefined;
 }
 
-const tokenFlags = {
+const valueFlags = {
   '--codemagic-token=': 'codemagicToken',
+  '--codemagic-team-id=': 'codemagicTeamId',
   '--stitch-key=': 'stitchApiKey',
   '--cloudflare-token=': 'cloudflareToken',
   '--cloudflare-account-id=': 'cloudflareAccountId',
+  '--bundle-id=': 'bundleId',
 };
 
 for (const arg of args) {
@@ -41,7 +43,7 @@ for (const arg of args) {
   if ((v = flagValue(arg, '--workflow=')) !== undefined) { cmWorkflowId = v; continue; }
 
   let matched = false;
-  for (const [prefix, key] of Object.entries(tokenFlags)) {
+  for (const [prefix, key] of Object.entries(valueFlags)) {
     if ((v = flagValue(arg, prefix)) !== undefined) {
       cliTokens[key] = v;
       matched = true;
@@ -85,8 +87,12 @@ Options:
   -v, --version                  Show version number
   -h, --help                     Show help
 
+App Configuration:
+  --bundle-id=ID                 Bundle ID / Package Name (e.g., com.company.app)
+
 MCP Token Flags (skip interactive prompts):
   --codemagic-token=TOKEN        Codemagic API token
+  --codemagic-team-id=ID         Codemagic Team ID (from Teams page)
   --stitch-key=KEY               Stitch MCP API key
   --cloudflare-token=TOKEN       Cloudflare API token
   --cloudflare-account-id=ID     Cloudflare account ID
@@ -113,7 +119,7 @@ Examples:
   npx @daemux/store-automator --github-setup           Configure GitHub Actions
 
 Non-interactive install (CI/CD):
-  npx @daemux/store-automator --codemagic-token=TOKEN --stitch-key=KEY
+  npx @daemux/store-automator --bundle-id=com.company.app --codemagic-token=TOKEN --codemagic-team-id=ID --stitch-key=KEY
   npx @daemux/store-automator --cloudflare-token=TOKEN --cloudflare-account-id=ID`);
       process.exit(0);
       break; // eslint: no-fallthrough

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daemux/store-automator",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "description": "Full App Store & Google Play automation for Flutter apps with Claude Code agents",
   "type": "module",
   "bin": {

package/plugins/store-automator/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "store-automator",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "description": "App Store & Google Play automation agents for Flutter app publishing",
   "author": {
     "name": "Daemux"

package/plugins/store-automator/agents/devops.md

@@ -44,7 +44,7 @@ The Codemagic pipeline runs two parallel workflows on push to `main`:
 
 ### Token Configuration
 
-The Codemagic API token is auto-configured via the codemagic MCP server in `.mcp.json` (set during install). You do not need to resolve the token manually -- all MCP tool calls authenticate automatically. If the codemagic MCP server is missing from `.mcp.json`, instruct the user to re-run `npx @daemux/store-automator` or add `--codemagic-token=TOKEN` to configure it.
+The Codemagic API token and Team ID are auto-configured via the codemagic MCP server in `.mcp.json` (set during install). You do not need to resolve the token manually -- all MCP tool calls authenticate automatically. The `CODEMAGIC_TEAM_ID` env var enables default team resolution for team-scoped tools (`list_builds`, `get_team`, `list_team_members`, `create_variable_group`, `setup_asc_credentials`, `setup_code_signing`). If the codemagic MCP server is missing from `.mcp.json`, instruct the user to re-run `npx @daemux/store-automator` or add `--codemagic-token=TOKEN --codemagic-team-id=ID` to configure it.
 
 ### Triggering Builds
 
@@ -76,20 +76,20 @@ Build states: `queued` -> `preparing` -> `building` -> `testing` -> `publishing`
 | `start_build` | Start a new build |
 | `get_build` | Get details of a specific build |
 | `cancel_build` | Cancel a running build |
-| `list_builds` | List builds for a team (V3 API) |
+| `list_builds` | List builds for a team (V3 API, uses default team if omitted) |
 | `get_artifact_url` | Get the download URL for a build artifact |
 | `create_public_artifact_url` | Create a time-limited public URL for an artifact |
 | `list_caches` | List build caches for an application |
 | `delete_caches` | Delete build caches for an application |
-| `setup_asc_credentials` | Create variable group with App Store Connect credentials |
-| `setup_code_signing` | Create variable group with iOS code signing cert and profile |
+| `setup_asc_credentials` | Create variable group with ASC credentials (uses default team if omitted) |
+| `setup_code_signing` | Create variable group with iOS signing (uses default team if omitted) |
 | `get_user` | Get the current authenticated user info |
 | `list_teams` | List all teams the user belongs to |
-| `get_team` | Get details of a specific team |
-| `list_team_members` | List members of a specific team |
+| `get_team` | Get details of a specific team (uses default team if omitted) |
+| `list_team_members` | List members of a team (uses default team if omitted) |
 | `list_variable_groups` | List variable groups for a team or application |
 | `get_variable_group` | Get details of a specific variable group |
-| `create_variable_group` | Create a new variable group |
+| `create_variable_group` | Create a new variable group (uses default team if omitted) |
 | `update_variable_group` | Update a variable group name or security setting |
 | `delete_variable_group` | Delete a variable group |
 | `list_variables` | List variables in a variable group |
@@ -366,7 +366,7 @@ Analyze Firestore usage patterns and optimize queries, indexes, and security rul
 
 | File | Purpose |
 |------|---------|
-| `ci.config.yaml` | Single source of truth for all CI/CD config |
+| `ci.config.yaml` | Single source of truth for all CI/CD config (includes team_id, app_id) |
 | `codemagic.yaml` | Generated from template -- do not edit directly |
 | `templates/codemagic.template.yaml` | Codemagic workflow template |
 | `scripts/generate.sh` | Generates codemagic.yaml from ci.config.yaml |

package/src/ci-config.mjs

@@ -2,17 +2,24 @@ import { readFileSync, writeFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 
 const CI_CONFIG_FILE = 'ci.config.yaml';
-const APP_ID_PATTERN = /^(\s*app_id:\s*)"[^"]*"/m;
+const FIELD_PATTERNS = {
+  app_id: /^(\s*app_id:\s*)"[^"]*"/m,
+  team_id: /^(\s*team_id:\s*)"[^"]*"/m,
+  bundle_id: /^(\s*bundle_id:\s*)"[^"]*"/m,
+  package_name: /^(\s*package_name:\s*)"[^"]*"/m,
+};
 
-export function writeCiAppId(projectDir, appId) {
+function writeCiField(projectDir, field, value) {
   const configPath = join(projectDir, CI_CONFIG_FILE);
   if (!existsSync(configPath)) return false;
 
   try {
+    const pattern = FIELD_PATTERNS[field];
     const content = readFileSync(configPath, 'utf8');
-    if (!APP_ID_PATTERN.test(content)) return false;
+    if (!pattern.test(content)) return false;
 
-    const updated = content.replace(APP_ID_PATTERN, `$1"${appId}"`);
+    const safeValue = value.replace(/\$/g, '$$$$');
+    const updated = content.replace(pattern, `$1"${safeValue}"`);
     if (updated === content) return false;
 
     writeFileSync(configPath, updated, 'utf8');
@@ -21,3 +28,19 @@ export function writeCiAppId(projectDir, appId) {
     return false;
   }
 }
+
+export function writeCiAppId(projectDir, appId) {
+  return writeCiField(projectDir, 'app_id', appId);
+}
+
+export function writeCiTeamId(projectDir, teamId) {
+  return writeCiField(projectDir, 'team_id', teamId);
+}
+
+export function writeCiBundleId(projectDir, bundleId) {
+  return writeCiField(projectDir, 'bundle_id', bundleId);
+}
+
+export function writeCiPackageName(projectDir, packageName) {
+  return writeCiField(projectDir, 'package_name', packageName);
+}

package/src/codemagic-api.mjs

@@ -50,8 +50,10 @@ export async function findAppByRepo(token, repoUrl) {
   }) || null;
 }
 
-export async function addApp(token, repoUrl) {
-  return cmFetch(token, 'POST', '/apps', { repositoryUrl: repoUrl });
+export async function addApp(token, repoUrl, teamId) {
+  const body = { repositoryUrl: repoUrl };
+  if (teamId) body.teamId = teamId;
+  return cmFetch(token, 'POST', '/apps', body);
 }
 
 export async function startBuild(token, appId, workflowId, branch) {

package/src/codemagic-setup.mjs

@@ -1,8 +1,10 @@
 import { findAppByRepo, addApp, startBuild, getBuildStatus, normalizeRepoUrl } from './codemagic-api.mjs';
 import { exec, resolveToken } from './utils.mjs';
 import { execFileSync } from 'child_process';
-import { writeCiAppId } from './ci-config.mjs';
-import { updateMcpAppId } from './mcp-setup.mjs';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { writeCiAppId, writeCiTeamId } from './ci-config.mjs';
+import { updateMcpAppId, updateMcpTeamId } from './mcp-setup.mjs';
 
 const POLL_INTERVAL_MS = 30_000;
 const POLL_TIMEOUT_MS = 15 * 60 * 1000;
@@ -94,6 +96,24 @@ async function pollBuildStatus(token, buildId) {
   return 'timeout';
 }
 
+function resolveCliTeamId() {
+  const prefix = '--codemagic-team-id=';
+  for (const arg of process.argv) {
+    if (arg.startsWith(prefix)) return arg.slice(prefix.length);
+  }
+  return undefined;
+}
+
+function readCiTeamId() {
+  try {
+    const content = readFileSync(join(process.cwd(), 'ci.config.yaml'), 'utf8');
+    const match = content.match(/^\s*team_id:\s*"([^"]+)"/m);
+    return match ? match[1] : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 export async function runCodemagicSetup(options) {
   const {
     tokenArg = '',
@@ -105,8 +125,10 @@ export async function runCodemagicSetup(options) {
 
   const token = resolveToken(tokenArg);
   const repoUrl = resolveRepoUrl();
+  const teamId = resolveCliTeamId() || readCiTeamId();
 
   console.log(`Repository: ${repoUrl}`);
+  if (teamId) console.log(`Team ID: ${teamId}`);
   console.log('Checking Codemagic for existing app...');
 
   let app = await findAppByRepo(token, repoUrl);
@@ -115,7 +137,7 @@ export async function runCodemagicSetup(options) {
     console.log(`App already registered: ${app.appName || app._id}`);
   } else {
     console.log('App not found. Adding to Codemagic...');
-    app = await addApp(token, repoUrl);
+    app = await addApp(token, repoUrl, teamId);
     console.log(`App added: ${app.appName || app._id}`);
 
     console.log('Setting up GitHub webhook...');
@@ -126,6 +148,11 @@ export async function runCodemagicSetup(options) {
   const appIdWritten = writeCiAppId(process.cwd(), appId);
   updateMcpAppId(process.cwd(), appId);
 
+  if (teamId) {
+    writeCiTeamId(process.cwd(), teamId);
+    updateMcpTeamId(process.cwd(), teamId);
+  }
+
   if (!trigger) {
     console.log('\nSetup complete. Use --trigger to start a build.\n');
     if (appIdWritten) {

package/src/install.mjs

@@ -9,10 +9,10 @@ import {
 } from './utils.mjs';
 import { injectEnvVars, injectStatusLine } from './settings.mjs';
 import { promptForTokens } from './prompt.mjs';
-import { getMcpServers, writeMcpJson, updateMcpAppId } from './mcp-setup.mjs';
+import { getMcpServers, writeMcpJson, updateMcpAppId, updateMcpTeamId } from './mcp-setup.mjs';
 import { installClaudeMd, installCiTemplates, installFirebaseTemplates } from './templates.mjs';
 import { findAppByRepo, addApp, normalizeRepoUrl } from './codemagic-api.mjs';
-import { writeCiAppId } from './ci-config.mjs';
+import { writeCiAppId, writeCiTeamId, writeCiBundleId, writeCiPackageName } from './ci-config.mjs';
 
 function checkClaudeCli() {
   const result = exec('command -v claude') || exec('which claude');
@@ -112,7 +112,7 @@ function setupGitHubActions(codemagicToken) {
   }
 }
 
-async function setupCodemagicApp(projectDir, codemagicToken) {
+async function setupCodemagicApp(projectDir, codemagicToken, codemagicTeamId) {
   if (!codemagicToken) return;
 
   let repoUrl;
@@ -130,7 +130,7 @@ async function setupCodemagicApp(projectDir, codemagicToken) {
   try {
     let app = await findAppByRepo(codemagicToken, repoUrl);
     if (!app) {
-      app = await addApp(codemagicToken, repoUrl);
+      app = await addApp(codemagicToken, repoUrl, codemagicTeamId);
       console.log(`Codemagic app created: ${app.appName || app._id}`);
     } else {
       console.log(`Codemagic app found: ${app.appName || app._id}`);
@@ -142,6 +142,11 @@ async function setupCodemagicApp(projectDir, codemagicToken) {
     }
 
     updateMcpAppId(projectDir, app._id);
+
+    if (codemagicTeamId) {
+      writeCiTeamId(projectDir, codemagicTeamId);
+      updateMcpTeamId(projectDir, codemagicTeamId);
+    }
   } catch (err) {
     console.log(`Codemagic auto-setup skipped: ${err.message || err}`);
   }
@@ -178,7 +183,13 @@ export async function runInstall(scope, isPostinstall = false, cliTokens = {}) {
   installCiTemplates(projectDir, packageDir);
   installFirebaseTemplates(projectDir, packageDir);
 
-  await setupCodemagicApp(projectDir, tokens.codemagicToken);
+  if (tokens.bundleId) {
+    const written = writeCiBundleId(projectDir, tokens.bundleId);
+    if (written) console.log(`Bundle ID set in ci.config.yaml: ${tokens.bundleId}`);
+    writeCiPackageName(projectDir, tokens.bundleId);
+  }
+
+  await setupCodemagicApp(projectDir, tokens.codemagicToken, tokens.codemagicTeamId);
 
   const scopeLabel = scope === 'user' ? 'global' : 'project';
   console.log(`Configuring ${scopeLabel} settings...`);

package/src/mcp-setup.mjs

@@ -34,6 +34,7 @@ export function getMcpServers(tokens) {
 
   if (tokens.codemagicToken) {
     const codemagicEnv = { CODEMAGIC_API_TOKEN: tokens.codemagicToken };
+    if (tokens.codemagicTeamId) codemagicEnv.CODEMAGIC_TEAM_ID = tokens.codemagicTeamId;
     if (tokens.codemagicAppId) codemagicEnv.CODEMAGIC_APP_ID = tokens.codemagicAppId;
     servers.codemagic = {
       command: 'npx',
@@ -77,14 +78,14 @@ export function writeMcpJson(projectDir, servers) {
   }
 }
 
-export function updateMcpAppId(projectDir, appId) {
+function updateMcpEnvVar(projectDir, envKey, value) {
   const mcpPath = join(projectDir, '.mcp.json');
   if (!existsSync(mcpPath)) return false;
 
   try {
     const data = readJson(mcpPath);
     if (!data.mcpServers?.codemagic?.env) return false;
-    data.mcpServers.codemagic.env.CODEMAGIC_APP_ID = appId;
+    data.mcpServers.codemagic.env[envKey] = value;
     writeJson(mcpPath, data);
     return true;
   } catch {
@@ -92,6 +93,14 @@ export function updateMcpAppId(projectDir, appId) {
   }
 }
 
+export function updateMcpAppId(projectDir, appId) {
+  return updateMcpEnvVar(projectDir, 'CODEMAGIC_APP_ID', appId);
+}
+
+export function updateMcpTeamId(projectDir, teamId) {
+  return updateMcpEnvVar(projectDir, 'CODEMAGIC_TEAM_ID', teamId);
+}
+
 export function removeMcpServers(projectDir) {
   const mcpPath = join(projectDir, '.mcp.json');
   if (!existsSync(mcpPath)) return;

package/src/prompt.mjs

@@ -17,26 +17,36 @@ function allTokensProvided(cliTokens) {
     cliTokens.stitchApiKey !== undefined &&
     cliTokens.cloudflareToken !== undefined &&
     cliTokens.cloudflareAccountId !== undefined &&
-    cliTokens.codemagicToken !== undefined
+    cliTokens.codemagicToken !== undefined &&
+    cliTokens.codemagicTeamId !== undefined
+  );
+}
+
+function allPromptsProvided(cliTokens) {
+  return (
+    cliTokens.bundleId !== undefined &&
+    allTokensProvided(cliTokens)
   );
 }
 
 export async function promptForTokens(cliTokens = {}) {
   const result = {
+    bundleId: cliTokens.bundleId ?? '',
     stitchApiKey: cliTokens.stitchApiKey ?? '',
     cloudflareToken: cliTokens.cloudflareToken ?? '',
     cloudflareAccountId: cliTokens.cloudflareAccountId ?? '',
     codemagicToken: cliTokens.codemagicToken ?? '',
+    codemagicTeamId: cliTokens.codemagicTeamId ?? '',
   };
 
-  if (allTokensProvided(cliTokens)) {
-    console.log('All MCP tokens provided via CLI flags, skipping prompts.');
+  if (allPromptsProvided(cliTokens)) {
+    console.log('All configuration provided via CLI flags, skipping prompts.');
     return result;
   }
 
   if (!isInteractive()) {
-    console.log('Non-interactive terminal detected, skipping token prompts.');
-    console.log('Run "npx store-automator" manually to configure MCP tokens.');
+    console.log('Non-interactive terminal detected, skipping prompts.');
+    console.log('Run "npx store-automator" manually to configure.');
     return result;
   }
 
@@ -45,12 +55,28 @@ export async function promptForTokens(cliTokens = {}) {
     output: process.stdout,
   });
 
-  console.log('');
-  console.log('MCP Server Configuration');
-  console.log('Press Enter to skip any token you do not have yet.');
   console.log('');
 
   try {
+    if (cliTokens.bundleId === undefined) {
+      console.log('App Configuration');
+      console.log('');
+      result.bundleId = await ask(
+        rl,
+        'Bundle ID / Package Name (e.g., com.company.app): '
+      );
+      console.log('');
+    }
+
+    if (allTokensProvided(cliTokens)) {
+      console.log('All MCP tokens provided via CLI flags.');
+      return result;
+    }
+
+    console.log('MCP Server Configuration');
+    console.log('Press Enter to skip any token you do not have yet.');
+    console.log('');
+
     if (cliTokens.stitchApiKey === undefined) {
       result.stitchApiKey = await ask(
         rl,
@@ -79,6 +105,13 @@ export async function promptForTokens(cliTokens = {}) {
       );
     }
 
+    if (result.codemagicToken && cliTokens.codemagicTeamId === undefined) {
+      result.codemagicTeamId = await ask(
+        rl,
+        'Codemagic Team ID (optional, from Teams page): '
+      );
+    }
+
     return result;
   } finally {
     rl.close();

package/templates/ci.config.yaml.template

@@ -59,6 +59,7 @@ web:
 # Find app_id in your Codemagic dashboard URL: codemagic.io/app/{app_id}
 # API token is stored in .mcp.json (codemagic MCP server, set during install)
 codemagic:
+  team_id: ""                   # Team ID from Codemagic Teams page
   app_id: ""
   workflows:
     - ios-release

package/templates/codemagic.template.yaml

@@ -19,14 +19,12 @@ workflows:
         PRICE_TIER: "${PRICE_TIER}"
         SUBMIT_FOR_REVIEW: "${SUBMIT_FOR_REVIEW}"
         AUTOMATIC_RELEASE: "${AUTOMATIC_RELEASE}"
-      ios_signing:
-        distribution_type: app_store
-        bundle_identifier: "${BUNDLE_ID}"
+        FASTLANE_ENABLE_BETA_DELIVER_SYNC_SCREENSHOTS: "1"
+        APP_ROOT: "${APP_ROOT}"
     cache:
       cache_paths:
-        - $HOME/.codemagic_keys
         - $HOME/.gem
-        - ios/vendor/bundle
+        - ${APP_ROOT}/ios/vendor/bundle
     triggering:
       events:
         - push
@@ -34,15 +32,20 @@ workflows:
         - pattern: main
           include: true
     scripts:
+      - name: Link Fastlane directories
+        script: |
+          ln -sfn "$CM_BUILD_DIR/fastlane/ios" "$CM_BUILD_DIR/$APP_ROOT/ios/fastlane"
+          ln -sfn "$CM_BUILD_DIR/fastlane" "$CM_BUILD_DIR/$APP_ROOT/fastlane"
+
       - name: Ensure CERTIFICATE_PRIVATE_KEY
         script: |
-          KEY_FILE="$HOME/.codemagic_keys/ios_dist_private_key"
-          mkdir -p "$HOME/.codemagic_keys"
+          KEY_FILE="$CM_BUILD_DIR/creds/ios_dist_private_key"
           if [ -f "$KEY_FILE" ]; then
-            echo "Reusing cached CERTIFICATE_PRIVATE_KEY"
+            echo "Using CERTIFICATE_PRIVATE_KEY from repo creds/"
           else
-            echo "Generating new CERTIFICATE_PRIVATE_KEY"
-            ssh-keygen -t rsa -b 2048 -m PEM -f "$KEY_FILE" -q -N ""
+            echo "ERROR: creds/ios_dist_private_key not found in repo."
+            echo "Generate it with: ssh-keygen -t rsa -b 2048 -m PEM -f creds/ios_dist_private_key -q -N ''"
+            exit 1
           fi
           echo "CERTIFICATE_PRIVATE_KEY<<DELIMITER" >> $CM_ENV
           cat "$KEY_FILE" >> $CM_ENV
@@ -57,17 +60,141 @@ workflows:
           cat "$CM_BUILD_DIR/$P8_KEY_PATH" >> $CM_ENV
           echo "" >> $CM_ENV
           echo "KEYDELIMITER" >> $CM_ENV
+          # Write P8 key to temp file once for all Fastlane steps
+          P8_TMP="/tmp/fastlane_api_key.p8"
+          cat "$CM_BUILD_DIR/$P8_KEY_PATH" > "$P8_TMP"
+          echo "FASTLANE_API_KEY_PATH=$P8_TMP" >> $CM_ENV
+
+      - name: Install Fastlane
+        script: |
+          cd $CM_BUILD_DIR/$APP_ROOT/ios
+          gem install bundler
+          bundle install
+
+      - name: Ensure app record exists
+        script: |
+          echo "=== Checking if $BUNDLE_ID exists in App Store Connect ==="
+
+          # First try: list apps filtering by bundle ID
+          echo "--- Running: app-store-connect apps list --bundle-id-identifier $BUNDLE_ID ---"
+          APP_JSON=$(app-store-connect apps list \
+            --bundle-id-identifier "$BUNDLE_ID" \
+            --strict-match-identifier \
+            --json 2>/tmp/asc_apps_err.log || true)
+
+          echo "Apps list stderr:"
+          cat /tmp/asc_apps_err.log 2>/dev/null || true
+          echo "Apps list stdout (first 500 chars):"
+          echo "$APP_JSON" | head -c 500
+
+          EXISTING=$(echo "$APP_JSON" | python3 -c "import sys,json; data=json.load(sys.stdin); apps=data if isinstance(data,list) else []; print('yes' if len(apps)>0 else 'no')" 2>/dev/null || echo "no")
+
+          echo "App exists result: $EXISTING"
+
+          if [ "$EXISTING" = "yes" ]; then
+            echo "App record found for $BUNDLE_ID"
+          else
+            echo ""
+            echo "=========================================="
+            echo "BUILD STOPPED - APP RECORD NOT DETECTED"
+            echo "=========================================="
+            echo ""
+            echo "The app-store-connect CLI could not find $BUNDLE_ID."
+            echo "If you already created the app in App Store Connect,"
+            echo "this may be an API propagation delay or permission issue."
+            echo ""
+            echo "Retrying with verbose output..."
+            app-store-connect apps list --json 2>&1 | python3 -c "import sys,json;data=json.load(sys.stdin);apps=data if isinstance(data,list) else [];print(f'Total apps: {len(apps)}');[print(f'  App: {a.get(\"attributes\",{}).get(\"name\",\"?\")} | Bundle: {a.get(\"attributes\",{}).get(\"bundleId\",\"?\")} | ID: {a.get(\"id\",\"?\")}') for a in apps[:10]]" 2>&1 || true
+            exit 1
+          fi
+
+      - name: Upload iOS metadata and screenshots
+        script: |
+          cd $CM_BUILD_DIR/$APP_ROOT/ios
+          bundle exec fastlane upload_metadata_ios
+
+      - name: Sync IAP and subscriptions
+        script: |
+          FORCE_FLAG=""
+          if [ ! -f "$CM_BUILD_DIR/.codemagic/ios_iap_synced" ]; then
+            FORCE_FLAG="--force"
+            echo "First IAP sync detected - forcing upload"
+          fi
+          if ./scripts/check_changed.sh $FORCE_FLAG fastlane/iap_config.json; then
+            cd $CM_BUILD_DIR/$APP_ROOT/ios
+            bundle exec fastlane sync_iap
+            # Create marker after successful sync
+            if [ -n "$FORCE_FLAG" ]; then
+              mkdir -p "$CM_BUILD_DIR/.codemagic"
+              touch "$CM_BUILD_DIR/.codemagic/ios_iap_synced"
+              cd "$CM_BUILD_DIR"
+              git add .codemagic/ios_iap_synced
+              git commit -m "chore: mark iOS IAP sync complete [skip ci]" || true
+              git push origin HEAD || true
+              echo "iOS IAP sync marker committed"
+            fi
+          else
+            echo "IAP config unchanged - skipping"
+          fi
 
       - name: Set up iOS code signing
         script: |
-          app-store-connect fetch-signing-files "$BUNDLE_ID" \
-            --type IOS_APP_STORE --create
           keychain initialize
-          app-store-connect certificates list \
-            --type IOS_DISTRIBUTION \
-            --certificate-key=@env:CERTIFICATE_PRIVATE_KEY --save
+
+          # Attempt to fetch or create signing files.
+          if app-store-connect fetch-signing-files "$BUNDLE_ID" \
+            --type IOS_APP_STORE \
+            --certificate-key=@env:CERTIFICATE_PRIVATE_KEY \
+            --create 2>/tmp/signing_err.log; then
+            echo "Signing files fetched successfully"
+          else
+            cat /tmp/signing_err.log
+            echo ""
+            echo "Signing failed. Deleting ALL distribution certs..."
+
+            for CERT_TYPE in IOS_DISTRIBUTION DISTRIBUTION; do
+              CERT_IDS=$(app-store-connect certificates list \
+                --type "$CERT_TYPE" --json 2>/dev/null \
+                | python3 -c "
+          import sys, json
+          certs = json.load(sys.stdin)
+          for c in certs:
+              print(c.get('id', ''))
+          " 2>/dev/null || true)
+
+              for CID in $CERT_IDS; do
+                if [ -n "$CID" ]; then
+                  echo "Deleting $CERT_TYPE cert: $CID"
+                  app-store-connect certificates delete "$CID" || true
+                fi
+              done
+            done
+
+            echo "Waiting 15s for Apple API propagation..."
+            sleep 15
+
+            # Verify certs are gone
+            REMAINING=$(app-store-connect certificates list \
+              --type DISTRIBUTION --json 2>/dev/null \
+              | python3 -c "import sys,json; print(len(json.load(sys.stdin)))" 2>/dev/null || echo "?")
+            echo "Remaining DISTRIBUTION certs: $REMAINING"
+
+            echo "Retrying fetch-signing-files..."
+            app-store-connect fetch-signing-files "$BUNDLE_ID" \
+              --type IOS_APP_STORE \
+              --certificate-key=@env:CERTIFICATE_PRIVATE_KEY \
+              --create
+          fi
+
+          # Verify signing artifacts exist
+          P12_COUNT=$(ls /Users/builder/Library/MobileDevice/Certificates/*.p12 2>/dev/null | wc -l)
+          if [ "$P12_COUNT" -eq 0 ]; then
+            echo "ERROR: No .p12 certificates found after signing setup"
+            exit 1
+          fi
+
           keychain add-certificates
-          xcode-project use-profiles
+          xcode-project use-profiles --project $APP_ROOT/ios/Runner.xcodeproj
 
       - name: Manage iOS version
         script: |
@@ -84,50 +211,29 @@ workflows:
       - name: Set Flutter version
         script: |
           BUILD_NUMBER=$(($(app-store-connect get-latest-app-store-build-number "$BUNDLE_ID" 2>/dev/null || echo "0") + 1))
-          if [ -z "$APP_VERSION" ] || [ "$APP_VERSION" = "" ]; then
+          if [ -z "$APP_VERSION" ]; then
             APP_VERSION="1.0.0"
           fi
-          sed -i '' "s/^version:.*/version: ${APP_VERSION}+${BUILD_NUMBER}/" pubspec.yaml
+          # Normalize to semver (1.0 -> 1.0.0, 1 -> 1.0.0)
+          PARTS=$(echo "$APP_VERSION" | tr '.' '\n' | wc -l | tr -d ' ')
+          if [ "$PARTS" -eq 1 ]; then APP_VERSION="${APP_VERSION}.0.0"; fi
+          if [ "$PARTS" -eq 2 ]; then APP_VERSION="${APP_VERSION}.0"; fi
+          sed -i '' "s/^version:.*/version: ${APP_VERSION}+${BUILD_NUMBER}/" $APP_ROOT/pubspec.yaml
           echo "Building: $APP_VERSION+$BUILD_NUMBER"
 
       - name: Flutter packages
-        script: flutter pub get
+        script: cd $CM_BUILD_DIR/$APP_ROOT && flutter pub get
 
       - name: Build iOS
-        script: flutter build ipa --release --export-options-plist=/tmp/export.plist
-
-      - name: Install Fastlane
-        script: |
-          cd ios
-          gem install bundler
-          bundle install
-
-      - name: Create app record (idempotent)
-        script: |
-          cd ios
-          bundle exec fastlane produce create \
-            -u "$APPLE_ID" \
-            -a "$BUNDLE_ID" \
-            --app_name "$APP_NAME" \
-            --sku "$SKU" \
-            || true
-
-      - name: Deploy to App Store
-        script: |
-          cd ios
-          bundle exec fastlane deploy_ios
+        script: cd $CM_BUILD_DIR/$APP_ROOT && flutter build ipa --release --export-options-plist=/Users/builder/export_options.plist
 
-      - name: Sync IAP and subscriptions
+      - name: Upload IPA to App Store
         script: |
-          if ./scripts/check_changed.sh fastlane/iap_config.json; then
-            cd ios
-            bundle exec fastlane sync_iap
-          else
-            echo "IAP config unchanged - skipping"
-          fi
+          cd $CM_BUILD_DIR/$APP_ROOT/ios
+          bundle exec fastlane upload_binary_ios
 
     artifacts:
-      - build/ios/ipa/*.ipa
+      - ${APP_ROOT}/build/ios/ipa/*.ipa
       - /tmp/xcodebuild_logs/*.log
 
   android-release:
@@ -136,6 +242,9 @@ workflows:
     instance_type: mac_mini_m4
     environment:
       flutter: stable
+      groups:
+        - google_play_credentials
+        - android_keystore
       vars:
         PACKAGE_NAME: "${PACKAGE_NAME}"
         APP_NAME: "${APP_NAME}"
@@ -148,11 +257,12 @@ workflows:
         APPLE_KEY_ID: "${APPLE_KEY_ID}"
         APPLE_ISSUER_ID: "${APPLE_ISSUER_ID}"
         P8_KEY_PATH: "${P8_KEY_PATH}"
+        APP_ROOT: "${APP_ROOT}"
     cache:
       cache_paths:
         - $HOME/.gem
         - $HOME/.gradle/caches
-        - android/vendor/bundle
+        - ${APP_ROOT}/android/vendor/bundle
     triggering:
       events:
         - push
@@ -160,11 +270,21 @@ workflows:
         - pattern: main
           include: true
     scripts:
+      - name: Link Fastlane directories
+        script: |
+          ln -sfn "$CM_BUILD_DIR/fastlane/android" "$CM_BUILD_DIR/$APP_ROOT/android/fastlane"
+          ln -sfn "$CM_BUILD_DIR/fastlane" "$CM_BUILD_DIR/$APP_ROOT/fastlane"
+
       - name: Ensure Android upload keystore
         script: |
-          KEYSTORE_PATH="$CM_BUILD_DIR/android/upload.keystore"
+          KEYSTORE_PATH="$CM_BUILD_DIR/$APP_ROOT/android/upload.keystore"
+          CREDS_PATH="$CM_BUILD_DIR/creds/android_upload.keystore"
+          GENERATED=false
           if [ -f "$KEYSTORE_PATH" ]; then
             echo "Using existing upload keystore from repo"
+          elif [ -f "$CREDS_PATH" ]; then
+            echo "Restoring upload keystore from creds/"
+            cp "$CREDS_PATH" "$KEYSTORE_PATH"
           else
             echo "Generating new upload keystore..."
             keytool -genkey -v \
@@ -177,8 +297,18 @@ workflows:
               -storepass "$KEYSTORE_PASSWORD" \
               -keypass "$KEYSTORE_PASSWORD" \
               -dname "CN=Upload Key, O=Developer, C=US"
+            GENERATED=true
+          fi
+          # Always ensure creds/ backup exists
+          mkdir -p "$CM_BUILD_DIR/creds"
+          if [ ! -f "$CREDS_PATH" ] || ! cmp -s "$KEYSTORE_PATH" "$CREDS_PATH"; then
+            cp "$KEYSTORE_PATH" "$CREDS_PATH"
+            echo "Keystore backed up to creds/android_upload.keystore"
+          fi
+          # Commit keystore files if newly generated
+          if [ "$GENERATED" = "true" ]; then
             cd "$CM_BUILD_DIR"
-            git add android/upload.keystore
+            git add --force $APP_ROOT/android/upload.keystore creds/android_upload.keystore
             git commit -m "chore: add Android upload keystore [skip ci]"
             git push origin HEAD
             echo "Upload keystore generated and committed to repo"
@@ -194,27 +324,124 @@ workflows:
           pip3 install PyJWT cryptography requests
           export SA_JSON="$CM_BUILD_DIR/$GOOGLE_SA_JSON_PATH"
           export PACKAGE_NAME="$PACKAGE_NAME"
-          RESULT=$(python3 scripts/check_google_play.py)
-          READY=$(echo "$RESULT" | python3 -c "import sys,json; print(str(json.load(sys.stdin)['ready']).lower())")
+          RESULT=$(python3 scripts/check_google_play.py 2>/dev/null || echo '{"ready":false}')
+          READY=$(echo "$RESULT" | python3 -c "import sys,json; print(str(json.load(sys.stdin).get('ready',False)).lower())" 2>/dev/null || echo "false")
           if [ "$READY" != "true" ]; then
             echo "GOOGLE_PLAY_READY=false" >> $CM_ENV
-            MISSING_STEPS=$(echo "$RESULT" | python3 -c "import sys,json; print('\n'.join(json.load(sys.stdin)['missing_steps']))")
-            cat > $CM_BUILD_DIR/HOW_TO_GOOGLE_PLAY.md << GUIDE
-          # Google Play Setup - Remaining Manual Steps
-
-          Your Android AAB is in the build artifacts. Complete these steps, then push again:
-
-          $MISSING_STEPS
-
-          ## After completing all steps:
-          Just \`git push\` again - Codemagic will publish automatically.
-          GUIDE
+            printf '%s\n' \
+              "# Google Play Setup - Manual Steps Required" \
+              "" \
+              "Your Android AAB is available in the build artifacts above." \
+              "" \
+              "## Steps to complete" \
+              "" \
+              "1. **Go to Google Play Console** - https://play.google.com/console" \
+              "2. **Create your app** (if not already created) with the correct package name" \
+              "3. **Upload the AAB** from build artifacts to an internal testing track" \
+              "4. **Complete the Store Listing** - Add title, descriptions, screenshots, and app icon" \
+              "5. **Complete the Content Rating** questionnaire" \
+              "6. **Set up Pricing and Distribution**" \
+              "7. **Complete the Data Safety** form" \
+              "8. **Review and roll out** the internal testing release" \
+              "" \
+              "## After completing all steps" \
+              "Just git push again - Codemagic will publish automatically on subsequent builds." \
+              > "$CM_BUILD_DIR/HOW_TO_GOOGLE_PLAY.md"
             echo "Google Play not ready - see HOW_TO_GOOGLE_PLAY.md in artifacts"
           else
             echo "GOOGLE_PLAY_READY=true" >> $CM_ENV
+            # Detect first store sync: if marker file doesn't exist, force IAP/data safety upload
+            if [ ! -f "$CM_BUILD_DIR/.codemagic/android_store_synced" ]; then
+              echo "FIRST_STORE_SYNC=true" >> $CM_ENV
+              echo "First store sync detected - IAP and data safety will be force-uploaded"
+            else
+              echo "FIRST_STORE_SYNC=false" >> $CM_ENV
+              echo "Marker found - using change detection for IAP/data safety"
+            fi
             echo "Google Play ready for automated publishing"
           fi
 
+      - name: Install Fastlane
+        script: |
+          cd $CM_BUILD_DIR/$APP_ROOT/android
+          gem install bundler
+          bundle install
+
+      - name: Upload Android metadata and screenshots
+        script: |
+          if [ "$GOOGLE_PLAY_READY" != "true" ]; then
+            echo "WARNING: Google Play not ready - skipping metadata upload."
+            echo "First AAB must be uploaded manually before metadata can sync."
+            exit 0
+          fi
+          export GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_PATH="$CM_BUILD_DIR/$GOOGLE_SA_JSON_PATH"
+          cd $CM_BUILD_DIR/$APP_ROOT/android
+          if bundle exec fastlane upload_metadata_android; then
+            echo "Metadata uploaded successfully"
+          else
+            echo "WARNING: Metadata upload failed (app may still be in draft state)."
+            echo "Metadata will sync on next build after app leaves draft."
+            echo "Continuing build..."
+          fi
+
+      - name: Sync subscriptions and IAP
+        script: |
+          if [ "$GOOGLE_PLAY_READY" != "true" ]; then
+            echo "WARNING: Google Play not ready - skipping IAP sync."
+            exit 0
+          fi
+          FORCE_FLAG=""
+          if [ "${FIRST_STORE_SYNC:-false}" = "true" ]; then
+            FORCE_FLAG="--force"
+          fi
+          if ./scripts/check_changed.sh $FORCE_FLAG fastlane/iap_config.json; then
+            export GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_PATH="$CM_BUILD_DIR/$GOOGLE_SA_JSON_PATH"
+            cd $CM_BUILD_DIR/$APP_ROOT/android
+            if bundle exec fastlane sync_google_iap 2>&1; then
+              echo "IAP sync completed successfully"
+            else
+              echo "WARNING: IAP sync failed (fastlane-plugin-iap may not be available yet)."
+              echo "IAP products can be configured manually in Google Play Console."
+              echo "Continuing build..."
+            fi
+          else
+            echo "IAP config unchanged - skipping"
+          fi
+
+      - name: Update data safety form
+        script: |
+          if [ "$GOOGLE_PLAY_READY" != "true" ]; then
+            echo "WARNING: Google Play not ready - skipping data safety update."
+            exit 0
+          fi
+          FORCE_FLAG=""
+          if [ "${FIRST_STORE_SYNC:-false}" = "true" ]; then
+            FORCE_FLAG="--force"
+          fi
+          if ./scripts/check_changed.sh $FORCE_FLAG fastlane/data_safety.csv; then
+            export GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_PATH="$CM_BUILD_DIR/$GOOGLE_SA_JSON_PATH"
+            cd $CM_BUILD_DIR/$APP_ROOT/android
+            if bundle exec fastlane update_data_safety 2>&1; then
+              echo "Data safety form updated successfully"
+            else
+              echo "WARNING: Data safety update failed."
+              echo "Data safety can be configured manually in Google Play Console."
+              echo "Continuing build..."
+            fi
+          else
+            echo "Data safety unchanged - skipping"
+          fi
+          # After successful sync, create marker so future builds use change detection
+          if [ "${FIRST_STORE_SYNC:-false}" = "true" ]; then
+            mkdir -p "$CM_BUILD_DIR/.codemagic"
+            touch "$CM_BUILD_DIR/.codemagic/android_store_synced"
+            cd "$CM_BUILD_DIR"
+            git add .codemagic/android_store_synced
+            git commit -m "chore: mark Android store sync complete [skip ci]" || true
+            git push origin HEAD || true
+            echo "Store sync marker committed"
+          fi
+
       - name: Manage Android version
         script: |
           # Read iOS version for consistency (if iOS workflow ran)
@@ -231,68 +458,59 @@ workflows:
           if [ "$GOOGLE_PLAY_READY" != "true" ]; then
             LATEST_BUILD=0
           else
-            LATEST_BUILD=$(google-play get-latest-build-number \
+            export GOOGLE_PLAY_SERVICE_ACCOUNT_CREDENTIALS="$(cat $CM_BUILD_DIR/$GOOGLE_SA_JSON_PATH)"
+            LATEST_BUILD_OUTPUT=$(google-play get-latest-build-number \
               --package-name "$PACKAGE_NAME" \
-              --tracks=production,beta,alpha,internal 2>/dev/null || echo "0")
+              --tracks=production,beta,alpha,internal 2>/dev/null || true)
+            # Extract just the number from output
+            LATEST_BUILD=$(echo "$LATEST_BUILD_OUTPUT" | grep -oE '^[0-9]+$' | tail -1)
+            if [ -z "$LATEST_BUILD" ]; then
+              echo "WARNING: Could not get latest build number from Google Play."
+              echo "Raw output: $LATEST_BUILD_OUTPUT"
+              echo "Falling back to build number 1"
+              LATEST_BUILD=1
+            fi
+            echo "Latest build number from Google Play: $LATEST_BUILD"
           fi
           NEW_BUILD=$(($LATEST_BUILD + 1))
-          if [ -z "$APP_VERSION" ] || [ "$APP_VERSION" = "" ]; then
+          if [ -z "$APP_VERSION" ]; then
             APP_VERSION="1.0.0"
           fi
-          sed -i '' "s/^version:.*/version: ${APP_VERSION}+${NEW_BUILD}/" pubspec.yaml
+          # Normalize to semver (1.0 -> 1.0.0, 1 -> 1.0.0)
+          PARTS=$(echo "$APP_VERSION" | tr '.' '\n' | wc -l | tr -d ' ')
+          if [ "$PARTS" -eq 1 ]; then APP_VERSION="${APP_VERSION}.0.0"; fi
+          if [ "$PARTS" -eq 2 ]; then APP_VERSION="${APP_VERSION}.0"; fi
+          sed -i '' "s/^version:.*/version: ${APP_VERSION}+${NEW_BUILD}/" $APP_ROOT/pubspec.yaml
           echo "ANDROID_VERSION_CODE=$NEW_BUILD" >> $CM_ENV
           echo "Android versionCode: $NEW_BUILD, versionName: $APP_VERSION"
 
       - name: Flutter packages
-        script: flutter pub get
+        script: cd $CM_BUILD_DIR/$APP_ROOT && flutter pub get
 
       - name: Build Android
-        script: flutter build appbundle --release
+        script: cd $CM_BUILD_DIR/$APP_ROOT && flutter build appbundle --release
 
-      - name: Install Fastlane
-        script: |
-          cd android
-          gem install bundler
-          bundle install
-
-      - name: Deploy to Google Play
+      - name: Upload AAB to Google Play
         script: |
           if [ "$GOOGLE_PLAY_READY" != "true" ]; then
-            echo "Skipping - Google Play setup incomplete"
-            exit 0
+            echo "============================================"
+            echo "FIRST RUN: AAB built but NOT uploaded."
+            echo "============================================"
+            echo ""
+            echo "Download the AAB from build artifacts and"
+            echo "upload it manually to Google Play Console."
+            echo "See HOW_TO_GOOGLE_PLAY.md in artifacts for"
+            echo "step-by-step instructions."
+            echo ""
+            echo "After completing manual setup, push again"
+            echo "for fully automated publishing."
+            echo "============================================"
+            exit 1
           fi
           export GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_PATH="$CM_BUILD_DIR/$GOOGLE_SA_JSON_PATH"
-          cd android
-          bundle exec fastlane deploy_android
-
-      - name: Sync subscriptions and IAP
-        script: |
-          if [ "$GOOGLE_PLAY_READY" != "true" ]; then
-            echo "Skipping - Google Play setup incomplete"
-            exit 0
-          fi
-          if ./scripts/check_changed.sh fastlane/iap_config.json; then
-            export GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_PATH="$CM_BUILD_DIR/$GOOGLE_SA_JSON_PATH"
-            cd android
-            bundle exec fastlane sync_google_iap
-          else
-            echo "IAP config unchanged - skipping"
-          fi
-
-      - name: Update data safety form
-        script: |
-          if [ "$GOOGLE_PLAY_READY" != "true" ]; then
-            echo "Skipping - Google Play setup incomplete"
-            exit 0
-          fi
-          if ./scripts/check_changed.sh fastlane/data_safety.csv; then
-            export GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_PATH="$CM_BUILD_DIR/$GOOGLE_SA_JSON_PATH"
-            cd android
-            bundle exec fastlane update_data_safety
-          else
-            echo "Data safety unchanged - skipping"
-          fi
+          cd $CM_BUILD_DIR/$APP_ROOT/android
+          bundle exec fastlane upload_binary_android
 
     artifacts:
-      - build/app/outputs/**/*.aab
+      - ${APP_ROOT}/build/app/outputs/**/*.aab
       - $CM_BUILD_DIR/HOW_TO_GOOGLE_PLAY.md

package/templates/fastlane/android/Fastfile.template

@@ -5,26 +5,74 @@ default_platform(:android)
 ROOT_DIR = ENV.fetch("CM_BUILD_DIR", File.expand_path("../..", __FILE__))
 APP_ROOT = ENV.fetch("APP_ROOT", "app")
 
+AAB_PATH = "#{ROOT_DIR}/#{APP_ROOT}/build/app/outputs/bundle/release/app-release.aab"
+
 def metadata_changed?(path)
   !sh("git diff --name-only HEAD~1 -- #{path}").strip.empty?
 rescue StandardError
   true
 end
 
+# Shared upload options reused across Android lanes.
+def base_play_store_options
+  {
+    package_name: ENV["PACKAGE_NAME"],
+    track: ENV.fetch("TRACK", "internal"),
+    json_key: ENV["GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_PATH"]
+  }
+end
+
+def rollout_options
+  {
+    rollout: ENV.fetch("ROLLOUT_FRACTION", "").empty? ? nil : ENV["ROLLOUT_FRACTION"],
+    in_app_update_priority: ENV.fetch("IN_APP_UPDATE_PRIORITY", "3").to_i
+  }
+end
+
 platform :android do
   lane :deploy_android do
-    upload_to_play_store(
-      aab: "#{ROOT_DIR}/#{APP_ROOT}/build/app/outputs/bundle/release/app-release.aab",
-      track: ENV.fetch("TRACK", "internal"),
-      json_key: ENV["GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_PATH"],
+    status = ENV.fetch("RELEASE_STATUS", "draft")
+    opts = base_play_store_options.merge(
+      aab: AAB_PATH,
+      release_status: status,
       skip_upload_metadata: !metadata_changed?("fastlane/metadata/android/"),
       skip_upload_screenshots: !metadata_changed?("fastlane/screenshots/android/"),
       skip_upload_images: !metadata_changed?("fastlane/screenshots/android/"),
       skip_upload_changelogs: false,
-      metadata_path: "#{ROOT_DIR}/fastlane/metadata/android",
-      rollout: ENV.fetch("ROLLOUT_FRACTION", "").empty? ? nil : ENV["ROLLOUT_FRACTION"].to_f,
-      in_app_update_priority: ENV.fetch("IN_APP_UPDATE_PRIORITY", "3").to_i
+      metadata_path: "#{ROOT_DIR}/fastlane/metadata/android"
+    )
+    opts.merge!(rollout_options) unless status == "draft"
+    upload_to_play_store(opts)
+  end
+
+  lane :upload_metadata_android do
+    upload_to_play_store(
+      base_play_store_options.merge(
+        skip_upload_aab: true,
+        skip_upload_apk: true,
+        skip_upload_metadata: false,
+        skip_upload_screenshots: false,
+        skip_upload_images: false,
+        skip_upload_changelogs: true,
+        release_status: "draft",
+        metadata_path: "#{ROOT_DIR}/fastlane/metadata/android"
+      )
+    )
+  end
+
+  lane :upload_binary_android do
+    status = ENV.fetch("RELEASE_STATUS", "draft")
+    opts = base_play_store_options.merge(
+      aab: AAB_PATH,
+      release_status: status,
+      skip_upload_metadata: true,
+      skip_upload_screenshots: true,
+      skip_upload_images: true,
+      skip_upload_changelogs: true
     )
+    # Rollout percentage is only valid for non-draft releases
+    opts.merge!(rollout_options) unless status == "draft"
+    upload_to_play_store(opts)
   end
 
   lane :sync_google_iap do

package/templates/fastlane/android/Pluginfile.template

@@ -1 +1,4 @@
-gem "fastlane-plugin-iap", git: "https://github.com/daemux/fastlane-plugin-iap"
+# fastlane-plugin-iap is not yet published.
+# IAP sync is handled gracefully in codemagic.yaml (non-blocking).
+# Uncomment when the plugin is available:
+# gem "fastlane-plugin-iap", git: "https://github.com/daemux/fastlane-plugin-iap"

package/templates/fastlane/ios/Fastfile.template

@@ -5,6 +5,20 @@ default_platform(:ios)
 ROOT_DIR = ENV.fetch("CM_BUILD_DIR", File.expand_path("../..", __FILE__))
 APP_ROOT = ENV.fetch("APP_ROOT", "app")
 
+# Monkey-patch: Fastlane deliver crashes with "No data" when fetching
+# app_store_review_detail on the first version (fastlane/fastlane#20538).
+# Wrap the method to rescue the RuntimeError gracefully.
+# Require deliver explicitly so the constant is available at parse time.
+require "deliver"
+::Deliver::UploadMetadata.prepend(Module.new do
+  def review_attachment_file(version)
+    super
+  rescue RuntimeError => e
+    raise unless e.message.include?("No data")
+    Fastlane::UI.important("Skipping review attachment: #{e.message} (first version)")
+  end
+end)
+
 def metadata_changed?(path)
   !sh("git diff --name-only HEAD~1 -- #{path}").strip.empty?
 rescue StandardError
@@ -30,26 +44,67 @@ def asc_api_key
   end
 end
 
+# Shared deliver options reused across iOS lanes.
+def base_deliver_options
+  {
+    api_key: asc_api_key,
+    app_identifier: ENV["BUNDLE_ID"],
+    force: true
+  }
+end
+
+def metadata_deliver_options
+  base_deliver_options.merge(
+    metadata_path: "#{ROOT_DIR}/fastlane/metadata",
+    screenshots_path: "#{ROOT_DIR}/fastlane/screenshots/ios",
+    sync_screenshots: true,
+    primary_category: ENV.fetch("PRIMARY_CATEGORY", "UTILITIES"),
+    secondary_category: ENV.fetch("SECONDARY_CATEGORY", "PRODUCTIVITY")
+  )
+end
+
+def submission_options
+  {
+    submit_for_review: ENV.fetch("SUBMIT_FOR_REVIEW", "true") == "true",
+    automatic_release: ENV.fetch("AUTOMATIC_RELEASE", "true") == "true"
+  }
+end
+
 platform :ios do
   lane :deploy_ios do
     deliver(
-      api_key: asc_api_key,
-      app_identifier: ENV["BUNDLE_ID"],
-      ipa: Dir.glob("#{ROOT_DIR}/#{APP_ROOT}/build/ios/ipa/*.ipa").first,
-      skip_metadata: !metadata_changed?("fastlane/metadata/ios/"),
-      skip_screenshots: !metadata_changed?("fastlane/screenshots/ios/"),
-      sync_screenshots: true,
-      metadata_path: "#{ROOT_DIR}/fastlane/metadata/ios",
-      screenshots_path: "#{ROOT_DIR}/fastlane/screenshots/ios",
-      submit_for_review: ENV.fetch("SUBMIT_FOR_REVIEW", "true") == "true",
-      automatic_release: ENV.fetch("AUTOMATIC_RELEASE", "true") == "true",
-      force: true,
-      app_rating_config_path: "#{ROOT_DIR}/fastlane/app_rating_config.json",
-      price_tier: ENV.fetch("PRICE_TIER", "0").to_i,
-      run_precheck_before_submit: true,
-      precheck_include_in_app_purchases: false,
-      primary_category: ENV.fetch("PRIMARY_CATEGORY", "UTILITIES"),
-      secondary_category: ENV.fetch("SECONDARY_CATEGORY", "PRODUCTIVITY")
+      metadata_deliver_options.merge(submission_options).merge(
+        ipa: Dir.glob("#{ROOT_DIR}/#{APP_ROOT}/build/ios/ipa/*.ipa").first,
+        app_rating_config_path: "#{ROOT_DIR}/fastlane/app_rating_config.json",
+        skip_metadata: !metadata_changed?("fastlane/metadata/ios/"),
+        skip_screenshots: !metadata_changed?("fastlane/screenshots/ios/"),
+        run_precheck_before_submit: true,
+        precheck_include_in_app_purchases: false
+      )
+    )
+  end
+
+  lane :upload_metadata_ios do
+    deliver(
+      metadata_deliver_options.merge(
+        skip_binary_upload: true,
+        skip_metadata: false,
+        skip_screenshots: false,
+        run_precheck_before_submit: false,
+        submit_for_review: false
+      )
+    )
+  end
+
+  lane :upload_binary_ios do
+    deliver(
+      base_deliver_options.merge(submission_options).merge(
+        ipa: Dir.glob("#{ROOT_DIR}/#{APP_ROOT}/build/ios/ipa/*.ipa").first,
+        skip_metadata: true,
+        skip_screenshots: true,
+        run_precheck_before_submit: true,
+        precheck_include_in_app_purchases: false
+      )
     )
   end
 

package/templates/fastlane/ios/Pluginfile.template

@@ -1 +1,4 @@
-gem "fastlane-plugin-iap", git: "https://github.com/daemux/fastlane-plugin-iap"
+# fastlane-plugin-iap is not yet published.
+# IAP sync is handled gracefully in codemagic.yaml (non-blocking).
+# Uncomment when the plugin is available:
+# gem "fastlane-plugin-iap", git: "https://github.com/daemux/fastlane-plugin-iap"