@daemux/store-automator 0.7.0 → 0.7.1

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "App Store & Google Play automation for Flutter apps",
-    "version": "0.7.0"
+    "version": "0.7.1"
   },
   "plugins": [
     {
       "name": "store-automator",
       "source": "./plugins/store-automator",
       "description": "3 agents for app store publishing: reviewer, meta-creator, media-designer",
-      "version": "0.7.0",
+      "version": "0.7.1",
       "keywords": ["flutter", "app-store", "google-play", "fastlane", "codemagic"]
     }
   ]

package/README.md

@@ -27,7 +27,7 @@ npm install @daemux/store-automator
 
 The postinstall script will:
 
-1. Prompt for MCP server tokens (Stitch, Cloudflare, Codemagic)
+1. Prompt for bundle ID and MCP server tokens (Stitch, Cloudflare, Codemagic)
 2. Configure `.mcp.json` with MCP servers (Playwright, mobile-mcp, Stitch, Cloudflare, Codemagic)
 3. Install the plugin marketplace and register agents
 4. Copy `CLAUDE.md` template to `.claude/CLAUDE.md`
@@ -122,13 +122,14 @@ For CI/CD environments or scripted setups, pass tokens as CLI flags to skip inte
 
 ```bash
 npx @daemux/store-automator \
+  --bundle-id=com.company.app \
   --codemagic-token=YOUR_CM_TOKEN \
   --stitch-key=YOUR_STITCH_KEY \
   --cloudflare-token=YOUR_CF_TOKEN \
   --cloudflare-account-id=YOUR_CF_ACCOUNT_ID
 ```
 
-Any tokens provided via flags will skip the corresponding interactive prompt. If all four tokens are provided, the entire interactive session is skipped.
+Any tokens provided via flags will skip the corresponding interactive prompt. If all four tokens are provided, the entire interactive session is skipped. The bundle ID, if provided, is automatically written to `bundle_id` and `package_name` in `ci.config.yaml`.
 
 ## CLI Options
 
@@ -142,6 +143,9 @@ Options:
   -v, --version                  Show version number
   -h, --help                     Show help
 
+App Configuration:
+  --bundle-id=ID                 Bundle ID / Package Name (e.g., com.company.app)
+
 MCP Token Flags (skip interactive prompts):
   --codemagic-token=TOKEN        Codemagic API token
   --stitch-key=KEY               Stitch MCP API key

package/bin/cli.mjs

@@ -27,12 +27,13 @@ function flagValue(arg, prefix) {
   return arg.startsWith(prefix) ? arg.slice(prefix.length) : undefined;
 }
 
-const tokenFlags = {
+const valueFlags = {
   '--codemagic-token=': 'codemagicToken',
   '--codemagic-team-id=': 'codemagicTeamId',
   '--stitch-key=': 'stitchApiKey',
   '--cloudflare-token=': 'cloudflareToken',
   '--cloudflare-account-id=': 'cloudflareAccountId',
+  '--bundle-id=': 'bundleId',
 };
 
 for (const arg of args) {
@@ -42,7 +43,7 @@ for (const arg of args) {
   if ((v = flagValue(arg, '--workflow=')) !== undefined) { cmWorkflowId = v; continue; }
 
   let matched = false;
-  for (const [prefix, key] of Object.entries(tokenFlags)) {
+  for (const [prefix, key] of Object.entries(valueFlags)) {
     if ((v = flagValue(arg, prefix)) !== undefined) {
       cliTokens[key] = v;
       matched = true;
@@ -86,6 +87,9 @@ Options:
   -v, --version                  Show version number
   -h, --help                     Show help
 
+App Configuration:
+  --bundle-id=ID                 Bundle ID / Package Name (e.g., com.company.app)
+
 MCP Token Flags (skip interactive prompts):
   --codemagic-token=TOKEN        Codemagic API token
   --codemagic-team-id=ID         Codemagic Team ID (from Teams page)
@@ -115,7 +119,7 @@ Examples:
   npx @daemux/store-automator --github-setup           Configure GitHub Actions
 
 Non-interactive install (CI/CD):
-  npx @daemux/store-automator --codemagic-token=TOKEN --codemagic-team-id=ID --stitch-key=KEY
+  npx @daemux/store-automator --bundle-id=com.company.app --codemagic-token=TOKEN --codemagic-team-id=ID --stitch-key=KEY
   npx @daemux/store-automator --cloudflare-token=TOKEN --cloudflare-account-id=ID`);
       process.exit(0);
       break; // eslint: no-fallthrough

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daemux/store-automator",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Full App Store & Google Play automation for Flutter apps with Claude Code agents",
   "type": "module",
   "bin": {

package/plugins/store-automator/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "store-automator",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "App Store & Google Play automation agents for Flutter app publishing",
   "author": {
     "name": "Daemux"

package/src/ci-config.mjs

@@ -5,6 +5,8 @@ const CI_CONFIG_FILE = 'ci.config.yaml';
 const FIELD_PATTERNS = {
   app_id: /^(\s*app_id:\s*)"[^"]*"/m,
   team_id: /^(\s*team_id:\s*)"[^"]*"/m,
+  bundle_id: /^(\s*bundle_id:\s*)"[^"]*"/m,
+  package_name: /^(\s*package_name:\s*)"[^"]*"/m,
 };
 
 function writeCiField(projectDir, field, value) {
@@ -16,7 +18,8 @@ function writeCiField(projectDir, field, value) {
     const content = readFileSync(configPath, 'utf8');
     if (!pattern.test(content)) return false;
 
-    const updated = content.replace(pattern, `$1"${value}"`);
+    const safeValue = value.replace(/\$/g, '$$$$');
+    const updated = content.replace(pattern, `$1"${safeValue}"`);
     if (updated === content) return false;
 
     writeFileSync(configPath, updated, 'utf8');
@@ -33,3 +36,11 @@ export function writeCiAppId(projectDir, appId) {
 export function writeCiTeamId(projectDir, teamId) {
   return writeCiField(projectDir, 'team_id', teamId);
 }
+
+export function writeCiBundleId(projectDir, bundleId) {
+  return writeCiField(projectDir, 'bundle_id', bundleId);
+}
+
+export function writeCiPackageName(projectDir, packageName) {
+  return writeCiField(projectDir, 'package_name', packageName);
+}

package/src/install.mjs

@@ -12,7 +12,7 @@ import { promptForTokens } from './prompt.mjs';
 import { getMcpServers, writeMcpJson, updateMcpAppId, updateMcpTeamId } from './mcp-setup.mjs';
 import { installClaudeMd, installCiTemplates, installFirebaseTemplates } from './templates.mjs';
 import { findAppByRepo, addApp, normalizeRepoUrl } from './codemagic-api.mjs';
-import { writeCiAppId, writeCiTeamId } from './ci-config.mjs';
+import { writeCiAppId, writeCiTeamId, writeCiBundleId, writeCiPackageName } from './ci-config.mjs';
 
 function checkClaudeCli() {
   const result = exec('command -v claude') || exec('which claude');
@@ -183,6 +183,12 @@ export async function runInstall(scope, isPostinstall = false, cliTokens = {}) {
   installCiTemplates(projectDir, packageDir);
   installFirebaseTemplates(projectDir, packageDir);
 
+  if (tokens.bundleId) {
+    const written = writeCiBundleId(projectDir, tokens.bundleId);
+    if (written) console.log(`Bundle ID set in ci.config.yaml: ${tokens.bundleId}`);
+    writeCiPackageName(projectDir, tokens.bundleId);
+  }
+
   await setupCodemagicApp(projectDir, tokens.codemagicToken, tokens.codemagicTeamId);
 
   const scopeLabel = scope === 'user' ? 'global' : 'project';

package/src/prompt.mjs

@@ -22,8 +22,16 @@ function allTokensProvided(cliTokens) {
   );
 }
 
+function allPromptsProvided(cliTokens) {
+  return (
+    cliTokens.bundleId !== undefined &&
+    allTokensProvided(cliTokens)
+  );
+}
+
 export async function promptForTokens(cliTokens = {}) {
   const result = {
+    bundleId: cliTokens.bundleId ?? '',
     stitchApiKey: cliTokens.stitchApiKey ?? '',
     cloudflareToken: cliTokens.cloudflareToken ?? '',
     cloudflareAccountId: cliTokens.cloudflareAccountId ?? '',
@@ -31,14 +39,14 @@ export async function promptForTokens(cliTokens = {}) {
     codemagicTeamId: cliTokens.codemagicTeamId ?? '',
   };
 
-  if (allTokensProvided(cliTokens)) {
-    console.log('All MCP tokens provided via CLI flags, skipping prompts.');
+  if (allPromptsProvided(cliTokens)) {
+    console.log('All configuration provided via CLI flags, skipping prompts.');
     return result;
   }
 
   if (!isInteractive()) {
-    console.log('Non-interactive terminal detected, skipping token prompts.');
-    console.log('Run "npx store-automator" manually to configure MCP tokens.');
+    console.log('Non-interactive terminal detected, skipping prompts.');
+    console.log('Run "npx store-automator" manually to configure.');
     return result;
   }
 
@@ -47,12 +55,28 @@ export async function promptForTokens(cliTokens = {}) {
     output: process.stdout,
   });
 
-  console.log('');
-  console.log('MCP Server Configuration');
-  console.log('Press Enter to skip any token you do not have yet.');
   console.log('');
 
   try {
+    if (cliTokens.bundleId === undefined) {
+      console.log('App Configuration');
+      console.log('');
+      result.bundleId = await ask(
+        rl,
+        'Bundle ID / Package Name (e.g., com.company.app): '
+      );
+      console.log('');
+    }
+
+    if (allTokensProvided(cliTokens)) {
+      console.log('All MCP tokens provided via CLI flags.');
+      return result;
+    }
+
+    console.log('MCP Server Configuration');
+    console.log('Press Enter to skip any token you do not have yet.');
+    console.log('');
+
     if (cliTokens.stitchApiKey === undefined) {
       result.stitchApiKey = await ask(
         rl,

package/templates/codemagic.template.yaml

@@ -19,14 +19,12 @@ workflows:
         PRICE_TIER: "${PRICE_TIER}"
         SUBMIT_FOR_REVIEW: "${SUBMIT_FOR_REVIEW}"
         AUTOMATIC_RELEASE: "${AUTOMATIC_RELEASE}"
-      ios_signing:
-        distribution_type: app_store
-        bundle_identifier: "${BUNDLE_ID}"
+        FASTLANE_ENABLE_BETA_DELIVER_SYNC_SCREENSHOTS: "1"
+        APP_ROOT: "${APP_ROOT}"
     cache:
       cache_paths:
-        - $HOME/.codemagic_keys
         - $HOME/.gem
-        - ios/vendor/bundle
+        - ${APP_ROOT}/ios/vendor/bundle
     triggering:
       events:
         - push
@@ -34,15 +32,20 @@ workflows:
         - pattern: main
           include: true
     scripts:
+      - name: Link Fastlane directories
+        script: |
+          ln -sfn "$CM_BUILD_DIR/fastlane/ios" "$CM_BUILD_DIR/$APP_ROOT/ios/fastlane"
+          ln -sfn "$CM_BUILD_DIR/fastlane" "$CM_BUILD_DIR/$APP_ROOT/fastlane"
+
       - name: Ensure CERTIFICATE_PRIVATE_KEY
         script: |
-          KEY_FILE="$HOME/.codemagic_keys/ios_dist_private_key"
-          mkdir -p "$HOME/.codemagic_keys"
+          KEY_FILE="$CM_BUILD_DIR/creds/ios_dist_private_key"
           if [ -f "$KEY_FILE" ]; then
-            echo "Reusing cached CERTIFICATE_PRIVATE_KEY"
+            echo "Using CERTIFICATE_PRIVATE_KEY from repo creds/"
           else
-            echo "Generating new CERTIFICATE_PRIVATE_KEY"
-            ssh-keygen -t rsa -b 2048 -m PEM -f "$KEY_FILE" -q -N ""
+            echo "ERROR: creds/ios_dist_private_key not found in repo."
+            echo "Generate it with: ssh-keygen -t rsa -b 2048 -m PEM -f creds/ios_dist_private_key -q -N ''"
+            exit 1
           fi
           echo "CERTIFICATE_PRIVATE_KEY<<DELIMITER" >> $CM_ENV
           cat "$KEY_FILE" >> $CM_ENV
@@ -57,17 +60,141 @@ workflows:
           cat "$CM_BUILD_DIR/$P8_KEY_PATH" >> $CM_ENV
           echo "" >> $CM_ENV
           echo "KEYDELIMITER" >> $CM_ENV
+          # Write P8 key to temp file once for all Fastlane steps
+          P8_TMP="/tmp/fastlane_api_key.p8"
+          cat "$CM_BUILD_DIR/$P8_KEY_PATH" > "$P8_TMP"
+          echo "FASTLANE_API_KEY_PATH=$P8_TMP" >> $CM_ENV
+
+      - name: Install Fastlane
+        script: |
+          cd $CM_BUILD_DIR/$APP_ROOT/ios
+          gem install bundler
+          bundle install
+
+      - name: Ensure app record exists
+        script: |
+          echo "=== Checking if $BUNDLE_ID exists in App Store Connect ==="
+
+          # First try: list apps filtering by bundle ID
+          echo "--- Running: app-store-connect apps list --bundle-id-identifier $BUNDLE_ID ---"
+          APP_JSON=$(app-store-connect apps list \
+            --bundle-id-identifier "$BUNDLE_ID" \
+            --strict-match-identifier \
+            --json 2>/tmp/asc_apps_err.log || true)
+
+          echo "Apps list stderr:"
+          cat /tmp/asc_apps_err.log 2>/dev/null || true
+          echo "Apps list stdout (first 500 chars):"
+          echo "$APP_JSON" | head -c 500
+
+          EXISTING=$(echo "$APP_JSON" | python3 -c "import sys,json; data=json.load(sys.stdin); apps=data if isinstance(data,list) else []; print('yes' if len(apps)>0 else 'no')" 2>/dev/null || echo "no")
+
+          echo "App exists result: $EXISTING"
+
+          if [ "$EXISTING" = "yes" ]; then
+            echo "App record found for $BUNDLE_ID"
+          else
+            echo ""
+            echo "=========================================="
+            echo "BUILD STOPPED - APP RECORD NOT DETECTED"
+            echo "=========================================="
+            echo ""
+            echo "The app-store-connect CLI could not find $BUNDLE_ID."
+            echo "If you already created the app in App Store Connect,"
+            echo "this may be an API propagation delay or permission issue."
+            echo ""
+            echo "Retrying with verbose output..."
+            app-store-connect apps list --json 2>&1 | python3 -c "import sys,json;data=json.load(sys.stdin);apps=data if isinstance(data,list) else [];print(f'Total apps: {len(apps)}');[print(f'  App: {a.get(\"attributes\",{}).get(\"name\",\"?\")} | Bundle: {a.get(\"attributes\",{}).get(\"bundleId\",\"?\")} | ID: {a.get(\"id\",\"?\")}') for a in apps[:10]]" 2>&1 || true
+            exit 1
+          fi
+
+      - name: Upload iOS metadata and screenshots
+        script: |
+          cd $CM_BUILD_DIR/$APP_ROOT/ios
+          bundle exec fastlane upload_metadata_ios
+
+      - name: Sync IAP and subscriptions
+        script: |
+          FORCE_FLAG=""
+          if [ ! -f "$CM_BUILD_DIR/.codemagic/ios_iap_synced" ]; then
+            FORCE_FLAG="--force"
+            echo "First IAP sync detected - forcing upload"
+          fi
+          if ./scripts/check_changed.sh $FORCE_FLAG fastlane/iap_config.json; then
+            cd $CM_BUILD_DIR/$APP_ROOT/ios
+            bundle exec fastlane sync_iap
+            # Create marker after successful sync
+            if [ -n "$FORCE_FLAG" ]; then
+              mkdir -p "$CM_BUILD_DIR/.codemagic"
+              touch "$CM_BUILD_DIR/.codemagic/ios_iap_synced"
+              cd "$CM_BUILD_DIR"
+              git add .codemagic/ios_iap_synced
+              git commit -m "chore: mark iOS IAP sync complete [skip ci]" || true
+              git push origin HEAD || true
+              echo "iOS IAP sync marker committed"
+            fi
+          else
+            echo "IAP config unchanged - skipping"
+          fi
 
       - name: Set up iOS code signing
         script: |
-          app-store-connect fetch-signing-files "$BUNDLE_ID" \
-            --type IOS_APP_STORE --create
           keychain initialize
-          app-store-connect certificates list \
-            --type IOS_DISTRIBUTION \
-            --certificate-key=@env:CERTIFICATE_PRIVATE_KEY --save
+
+          # Attempt to fetch or create signing files.
+          if app-store-connect fetch-signing-files "$BUNDLE_ID" \
+            --type IOS_APP_STORE \
+            --certificate-key=@env:CERTIFICATE_PRIVATE_KEY \
+            --create 2>/tmp/signing_err.log; then
+            echo "Signing files fetched successfully"
+          else
+            cat /tmp/signing_err.log
+            echo ""
+            echo "Signing failed. Deleting ALL distribution certs..."
+
+            for CERT_TYPE in IOS_DISTRIBUTION DISTRIBUTION; do
+              CERT_IDS=$(app-store-connect certificates list \
+                --type "$CERT_TYPE" --json 2>/dev/null \
+                | python3 -c "
+          import sys, json
+          certs = json.load(sys.stdin)
+          for c in certs:
+              print(c.get('id', ''))
+          " 2>/dev/null || true)
+
+              for CID in $CERT_IDS; do
+                if [ -n "$CID" ]; then
+                  echo "Deleting $CERT_TYPE cert: $CID"
+                  app-store-connect certificates delete "$CID" || true
+                fi
+              done
+            done
+
+            echo "Waiting 15s for Apple API propagation..."
+            sleep 15
+
+            # Verify certs are gone
+            REMAINING=$(app-store-connect certificates list \
+              --type DISTRIBUTION --json 2>/dev/null \
+              | python3 -c "import sys,json; print(len(json.load(sys.stdin)))" 2>/dev/null || echo "?")
+            echo "Remaining DISTRIBUTION certs: $REMAINING"
+
+            echo "Retrying fetch-signing-files..."
+            app-store-connect fetch-signing-files "$BUNDLE_ID" \
+              --type IOS_APP_STORE \
+              --certificate-key=@env:CERTIFICATE_PRIVATE_KEY \
+              --create
+          fi
+
+          # Verify signing artifacts exist
+          P12_COUNT=$(ls /Users/builder/Library/MobileDevice/Certificates/*.p12 2>/dev/null | wc -l)
+          if [ "$P12_COUNT" -eq 0 ]; then
+            echo "ERROR: No .p12 certificates found after signing setup"
+            exit 1
+          fi
+
           keychain add-certificates
-          xcode-project use-profiles
+          xcode-project use-profiles --project $APP_ROOT/ios/Runner.xcodeproj
 
       - name: Manage iOS version
         script: |
@@ -84,50 +211,29 @@ workflows:
       - name: Set Flutter version
         script: |
           BUILD_NUMBER=$(($(app-store-connect get-latest-app-store-build-number "$BUNDLE_ID" 2>/dev/null || echo "0") + 1))
-          if [ -z "$APP_VERSION" ] || [ "$APP_VERSION" = "" ]; then
+          if [ -z "$APP_VERSION" ]; then
             APP_VERSION="1.0.0"
           fi
-          sed -i '' "s/^version:.*/version: ${APP_VERSION}+${BUILD_NUMBER}/" pubspec.yaml
+          # Normalize to semver (1.0 -> 1.0.0, 1 -> 1.0.0)
+          PARTS=$(echo "$APP_VERSION" | tr '.' '\n' | wc -l | tr -d ' ')
+          if [ "$PARTS" -eq 1 ]; then APP_VERSION="${APP_VERSION}.0.0"; fi
+          if [ "$PARTS" -eq 2 ]; then APP_VERSION="${APP_VERSION}.0"; fi
+          sed -i '' "s/^version:.*/version: ${APP_VERSION}+${BUILD_NUMBER}/" $APP_ROOT/pubspec.yaml
           echo "Building: $APP_VERSION+$BUILD_NUMBER"
 
       - name: Flutter packages
-        script: flutter pub get
+        script: cd $CM_BUILD_DIR/$APP_ROOT && flutter pub get
 
       - name: Build iOS
-        script: flutter build ipa --release --export-options-plist=/tmp/export.plist
-
-      - name: Install Fastlane
-        script: |
-          cd ios
-          gem install bundler
-          bundle install
-
-      - name: Create app record (idempotent)
-        script: |
-          cd ios
-          bundle exec fastlane produce create \
-            -u "$APPLE_ID" \
-            -a "$BUNDLE_ID" \
-            --app_name "$APP_NAME" \
-            --sku "$SKU" \
-            || true
-
-      - name: Deploy to App Store
-        script: |
-          cd ios
-          bundle exec fastlane deploy_ios
+        script: cd $CM_BUILD_DIR/$APP_ROOT && flutter build ipa --release --export-options-plist=/Users/builder/export_options.plist
 
-      - name: Sync IAP and subscriptions
+      - name: Upload IPA to App Store
         script: |
-          if ./scripts/check_changed.sh fastlane/iap_config.json; then
-            cd ios
-            bundle exec fastlane sync_iap
-          else
-            echo "IAP config unchanged - skipping"
-          fi
+          cd $CM_BUILD_DIR/$APP_ROOT/ios
+          bundle exec fastlane upload_binary_ios
 
     artifacts:
-      - build/ios/ipa/*.ipa
+      - ${APP_ROOT}/build/ios/ipa/*.ipa
       - /tmp/xcodebuild_logs/*.log
 
   android-release:
@@ -136,6 +242,9 @@ workflows:
     instance_type: mac_mini_m4
     environment:
       flutter: stable
+      groups:
+        - google_play_credentials
+        - android_keystore
       vars:
         PACKAGE_NAME: "${PACKAGE_NAME}"
         APP_NAME: "${APP_NAME}"
@@ -148,11 +257,12 @@ workflows:
         APPLE_KEY_ID: "${APPLE_KEY_ID}"
         APPLE_ISSUER_ID: "${APPLE_ISSUER_ID}"
         P8_KEY_PATH: "${P8_KEY_PATH}"
+        APP_ROOT: "${APP_ROOT}"
     cache:
       cache_paths:
         - $HOME/.gem
         - $HOME/.gradle/caches
-        - android/vendor/bundle
+        - ${APP_ROOT}/android/vendor/bundle
     triggering:
       events:
         - push
@@ -160,11 +270,21 @@ workflows:
         - pattern: main
           include: true
     scripts:
+      - name: Link Fastlane directories
+        script: |
+          ln -sfn "$CM_BUILD_DIR/fastlane/android" "$CM_BUILD_DIR/$APP_ROOT/android/fastlane"
+          ln -sfn "$CM_BUILD_DIR/fastlane" "$CM_BUILD_DIR/$APP_ROOT/fastlane"
+
       - name: Ensure Android upload keystore
         script: |
-          KEYSTORE_PATH="$CM_BUILD_DIR/android/upload.keystore"
+          KEYSTORE_PATH="$CM_BUILD_DIR/$APP_ROOT/android/upload.keystore"
+          CREDS_PATH="$CM_BUILD_DIR/creds/android_upload.keystore"
+          GENERATED=false
           if [ -f "$KEYSTORE_PATH" ]; then
             echo "Using existing upload keystore from repo"
+          elif [ -f "$CREDS_PATH" ]; then
+            echo "Restoring upload keystore from creds/"
+            cp "$CREDS_PATH" "$KEYSTORE_PATH"
           else
             echo "Generating new upload keystore..."
             keytool -genkey -v \
@@ -177,8 +297,18 @@ workflows:
               -storepass "$KEYSTORE_PASSWORD" \
               -keypass "$KEYSTORE_PASSWORD" \
               -dname "CN=Upload Key, O=Developer, C=US"
+            GENERATED=true
+          fi
+          # Always ensure creds/ backup exists
+          mkdir -p "$CM_BUILD_DIR/creds"
+          if [ ! -f "$CREDS_PATH" ] || ! cmp -s "$KEYSTORE_PATH" "$CREDS_PATH"; then
+            cp "$KEYSTORE_PATH" "$CREDS_PATH"
+            echo "Keystore backed up to creds/android_upload.keystore"
+          fi
+          # Commit keystore files if newly generated
+          if [ "$GENERATED" = "true" ]; then
             cd "$CM_BUILD_DIR"
-            git add android/upload.keystore
+            git add --force $APP_ROOT/android/upload.keystore creds/android_upload.keystore
             git commit -m "chore: add Android upload keystore [skip ci]"
             git push origin HEAD
             echo "Upload keystore generated and committed to repo"
@@ -194,27 +324,124 @@ workflows:
           pip3 install PyJWT cryptography requests
           export SA_JSON="$CM_BUILD_DIR/$GOOGLE_SA_JSON_PATH"
           export PACKAGE_NAME="$PACKAGE_NAME"
-          RESULT=$(python3 scripts/check_google_play.py)
-          READY=$(echo "$RESULT" | python3 -c "import sys,json; print(str(json.load(sys.stdin)['ready']).lower())")
+          RESULT=$(python3 scripts/check_google_play.py 2>/dev/null || echo '{"ready":false}')
+          READY=$(echo "$RESULT" | python3 -c "import sys,json; print(str(json.load(sys.stdin).get('ready',False)).lower())" 2>/dev/null || echo "false")
           if [ "$READY" != "true" ]; then
             echo "GOOGLE_PLAY_READY=false" >> $CM_ENV
-            MISSING_STEPS=$(echo "$RESULT" | python3 -c "import sys,json; print('\n'.join(json.load(sys.stdin)['missing_steps']))")
-            cat > $CM_BUILD_DIR/HOW_TO_GOOGLE_PLAY.md << GUIDE
-          # Google Play Setup - Remaining Manual Steps
-
-          Your Android AAB is in the build artifacts. Complete these steps, then push again:
-
-          $MISSING_STEPS
-
-          ## After completing all steps:
-          Just \`git push\` again - Codemagic will publish automatically.
-          GUIDE
+            printf '%s\n' \
+              "# Google Play Setup - Manual Steps Required" \
+              "" \
+              "Your Android AAB is available in the build artifacts above." \
+              "" \
+              "## Steps to complete" \
+              "" \
+              "1. **Go to Google Play Console** - https://play.google.com/console" \
+              "2. **Create your app** (if not already created) with the correct package name" \
+              "3. **Upload the AAB** from build artifacts to an internal testing track" \
+              "4. **Complete the Store Listing** - Add title, descriptions, screenshots, and app icon" \
+              "5. **Complete the Content Rating** questionnaire" \
+              "6. **Set up Pricing and Distribution**" \
+              "7. **Complete the Data Safety** form" \
+              "8. **Review and roll out** the internal testing release" \
+              "" \
+              "## After completing all steps" \
+              "Just git push again - Codemagic will publish automatically on subsequent builds." \
+              > "$CM_BUILD_DIR/HOW_TO_GOOGLE_PLAY.md"
             echo "Google Play not ready - see HOW_TO_GOOGLE_PLAY.md in artifacts"
           else
             echo "GOOGLE_PLAY_READY=true" >> $CM_ENV
+            # Detect first store sync: if marker file doesn't exist, force IAP/data safety upload
+            if [ ! -f "$CM_BUILD_DIR/.codemagic/android_store_synced" ]; then
+              echo "FIRST_STORE_SYNC=true" >> $CM_ENV
+              echo "First store sync detected - IAP and data safety will be force-uploaded"
+            else
+              echo "FIRST_STORE_SYNC=false" >> $CM_ENV
+              echo "Marker found - using change detection for IAP/data safety"
+            fi
             echo "Google Play ready for automated publishing"
           fi
 
+      - name: Install Fastlane
+        script: |
+          cd $CM_BUILD_DIR/$APP_ROOT/android
+          gem install bundler
+          bundle install
+
+      - name: Upload Android metadata and screenshots
+        script: |
+          if [ "$GOOGLE_PLAY_READY" != "true" ]; then
+            echo "WARNING: Google Play not ready - skipping metadata upload."
+            echo "First AAB must be uploaded manually before metadata can sync."
+            exit 0
+          fi
+          export GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_PATH="$CM_BUILD_DIR/$GOOGLE_SA_JSON_PATH"
+          cd $CM_BUILD_DIR/$APP_ROOT/android
+          if bundle exec fastlane upload_metadata_android; then
+            echo "Metadata uploaded successfully"
+          else
+            echo "WARNING: Metadata upload failed (app may still be in draft state)."
+            echo "Metadata will sync on next build after app leaves draft."
+            echo "Continuing build..."
+          fi
+
+      - name: Sync subscriptions and IAP
+        script: |
+          if [ "$GOOGLE_PLAY_READY" != "true" ]; then
+            echo "WARNING: Google Play not ready - skipping IAP sync."
+            exit 0
+          fi
+          FORCE_FLAG=""
+          if [ "${FIRST_STORE_SYNC:-false}" = "true" ]; then
+            FORCE_FLAG="--force"
+          fi
+          if ./scripts/check_changed.sh $FORCE_FLAG fastlane/iap_config.json; then
+            export GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_PATH="$CM_BUILD_DIR/$GOOGLE_SA_JSON_PATH"
+            cd $CM_BUILD_DIR/$APP_ROOT/android
+            if bundle exec fastlane sync_google_iap 2>&1; then
+              echo "IAP sync completed successfully"
+            else
+              echo "WARNING: IAP sync failed (fastlane-plugin-iap may not be available yet)."
+              echo "IAP products can be configured manually in Google Play Console."
+              echo "Continuing build..."
+            fi
+          else
+            echo "IAP config unchanged - skipping"
+          fi
+
+      - name: Update data safety form
+        script: |
+          if [ "$GOOGLE_PLAY_READY" != "true" ]; then
+            echo "WARNING: Google Play not ready - skipping data safety update."
+            exit 0
+          fi
+          FORCE_FLAG=""
+          if [ "${FIRST_STORE_SYNC:-false}" = "true" ]; then
+            FORCE_FLAG="--force"
+          fi
+          if ./scripts/check_changed.sh $FORCE_FLAG fastlane/data_safety.csv; then
+            export GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_PATH="$CM_BUILD_DIR/$GOOGLE_SA_JSON_PATH"
+            cd $CM_BUILD_DIR/$APP_ROOT/android
+            if bundle exec fastlane update_data_safety 2>&1; then
+              echo "Data safety form updated successfully"
+            else
+              echo "WARNING: Data safety update failed."
+              echo "Data safety can be configured manually in Google Play Console."
+              echo "Continuing build..."
+            fi
+          else
+            echo "Data safety unchanged - skipping"
+          fi
+          # After successful sync, create marker so future builds use change detection
+          if [ "${FIRST_STORE_SYNC:-false}" = "true" ]; then
+            mkdir -p "$CM_BUILD_DIR/.codemagic"
+            touch "$CM_BUILD_DIR/.codemagic/android_store_synced"
+            cd "$CM_BUILD_DIR"
+            git add .codemagic/android_store_synced
+            git commit -m "chore: mark Android store sync complete [skip ci]" || true
+            git push origin HEAD || true
+            echo "Store sync marker committed"
+          fi
+
       - name: Manage Android version
         script: |
           # Read iOS version for consistency (if iOS workflow ran)
@@ -231,68 +458,59 @@ workflows:
           if [ "$GOOGLE_PLAY_READY" != "true" ]; then
             LATEST_BUILD=0
           else
-            LATEST_BUILD=$(google-play get-latest-build-number \
+            export GOOGLE_PLAY_SERVICE_ACCOUNT_CREDENTIALS="$(cat $CM_BUILD_DIR/$GOOGLE_SA_JSON_PATH)"
+            LATEST_BUILD_OUTPUT=$(google-play get-latest-build-number \
               --package-name "$PACKAGE_NAME" \
-              --tracks=production,beta,alpha,internal 2>/dev/null || echo "0")
+              --tracks=production,beta,alpha,internal 2>/dev/null || true)
+            # Extract just the number from output
+            LATEST_BUILD=$(echo "$LATEST_BUILD_OUTPUT" | grep -oE '^[0-9]+$' | tail -1)
+            if [ -z "$LATEST_BUILD" ]; then
+              echo "WARNING: Could not get latest build number from Google Play."
+              echo "Raw output: $LATEST_BUILD_OUTPUT"
+              echo "Falling back to build number 1"
+              LATEST_BUILD=1
+            fi
+            echo "Latest build number from Google Play: $LATEST_BUILD"
           fi
           NEW_BUILD=$(($LATEST_BUILD + 1))
-          if [ -z "$APP_VERSION" ] || [ "$APP_VERSION" = "" ]; then
+          if [ -z "$APP_VERSION" ]; then
             APP_VERSION="1.0.0"
           fi
-          sed -i '' "s/^version:.*/version: ${APP_VERSION}+${NEW_BUILD}/" pubspec.yaml
+          # Normalize to semver (1.0 -> 1.0.0, 1 -> 1.0.0)
+          PARTS=$(echo "$APP_VERSION" | tr '.' '\n' | wc -l | tr -d ' ')
+          if [ "$PARTS" -eq 1 ]; then APP_VERSION="${APP_VERSION}.0.0"; fi
+          if [ "$PARTS" -eq 2 ]; then APP_VERSION="${APP_VERSION}.0"; fi
+          sed -i '' "s/^version:.*/version: ${APP_VERSION}+${NEW_BUILD}/" $APP_ROOT/pubspec.yaml
           echo "ANDROID_VERSION_CODE=$NEW_BUILD" >> $CM_ENV
           echo "Android versionCode: $NEW_BUILD, versionName: $APP_VERSION"
 
       - name: Flutter packages
-        script: flutter pub get
+        script: cd $CM_BUILD_DIR/$APP_ROOT && flutter pub get
 
       - name: Build Android
-        script: flutter build appbundle --release
+        script: cd $CM_BUILD_DIR/$APP_ROOT && flutter build appbundle --release
 
-      - name: Install Fastlane
-        script: |
-          cd android
-          gem install bundler
-          bundle install
-
-      - name: Deploy to Google Play
+      - name: Upload AAB to Google Play
         script: |
           if [ "$GOOGLE_PLAY_READY" != "true" ]; then
-            echo "Skipping - Google Play setup incomplete"
-            exit 0
+            echo "============================================"
+            echo "FIRST RUN: AAB built but NOT uploaded."
+            echo "============================================"
+            echo ""
+            echo "Download the AAB from build artifacts and"
+            echo "upload it manually to Google Play Console."
+            echo "See HOW_TO_GOOGLE_PLAY.md in artifacts for"
+            echo "step-by-step instructions."
+            echo ""
+            echo "After completing manual setup, push again"
+            echo "for fully automated publishing."
+            echo "============================================"
+            exit 1
           fi
           export GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_PATH="$CM_BUILD_DIR/$GOOGLE_SA_JSON_PATH"
-          cd android
-          bundle exec fastlane deploy_android
-
-      - name: Sync subscriptions and IAP
-        script: |
-          if [ "$GOOGLE_PLAY_READY" != "true" ]; then
-            echo "Skipping - Google Play setup incomplete"
-            exit 0
-          fi
-          if ./scripts/check_changed.sh fastlane/iap_config.json; then
-            export GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_PATH="$CM_BUILD_DIR/$GOOGLE_SA_JSON_PATH"
-            cd android
-            bundle exec fastlane sync_google_iap
-          else
-            echo "IAP config unchanged - skipping"
-          fi
-
-      - name: Update data safety form
-        script: |
-          if [ "$GOOGLE_PLAY_READY" != "true" ]; then
-            echo "Skipping - Google Play setup incomplete"
-            exit 0
-          fi
-          if ./scripts/check_changed.sh fastlane/data_safety.csv; then
-            export GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_PATH="$CM_BUILD_DIR/$GOOGLE_SA_JSON_PATH"
-            cd android
-            bundle exec fastlane update_data_safety
-          else
-            echo "Data safety unchanged - skipping"
-          fi
+          cd $CM_BUILD_DIR/$APP_ROOT/android
+          bundle exec fastlane upload_binary_android
 
     artifacts:
-      - build/app/outputs/**/*.aab
+      - ${APP_ROOT}/build/app/outputs/**/*.aab
       - $CM_BUILD_DIR/HOW_TO_GOOGLE_PLAY.md

package/templates/fastlane/android/Fastfile.template

@@ -5,26 +5,74 @@ default_platform(:android)
 ROOT_DIR = ENV.fetch("CM_BUILD_DIR", File.expand_path("../..", __FILE__))
 APP_ROOT = ENV.fetch("APP_ROOT", "app")
 
+AAB_PATH = "#{ROOT_DIR}/#{APP_ROOT}/build/app/outputs/bundle/release/app-release.aab"
+
 def metadata_changed?(path)
   !sh("git diff --name-only HEAD~1 -- #{path}").strip.empty?
 rescue StandardError
   true
 end
 
+# Shared upload options reused across Android lanes.
+def base_play_store_options
+  {
+    package_name: ENV["PACKAGE_NAME"],
+    track: ENV.fetch("TRACK", "internal"),
+    json_key: ENV["GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_PATH"]
+  }
+end
+
+def rollout_options
+  {
+    rollout: ENV.fetch("ROLLOUT_FRACTION", "").empty? ? nil : ENV["ROLLOUT_FRACTION"],
+    in_app_update_priority: ENV.fetch("IN_APP_UPDATE_PRIORITY", "3").to_i
+  }
+end
+
 platform :android do
   lane :deploy_android do
-    upload_to_play_store(
-      aab: "#{ROOT_DIR}/#{APP_ROOT}/build/app/outputs/bundle/release/app-release.aab",
-      track: ENV.fetch("TRACK", "internal"),
-      json_key: ENV["GOOGLE_PLAY_SERVICE_ACCOUNT_JSON_PATH"],
+    status = ENV.fetch("RELEASE_STATUS", "draft")
+    opts = base_play_store_options.merge(
+      aab: AAB_PATH,
+      release_status: status,
       skip_upload_metadata: !metadata_changed?("fastlane/metadata/android/"),
       skip_upload_screenshots: !metadata_changed?("fastlane/screenshots/android/"),
       skip_upload_images: !metadata_changed?("fastlane/screenshots/android/"),
       skip_upload_changelogs: false,
-      metadata_path: "#{ROOT_DIR}/fastlane/metadata/android",
-      rollout: ENV.fetch("ROLLOUT_FRACTION", "").empty? ? nil : ENV["ROLLOUT_FRACTION"].to_f,
-      in_app_update_priority: ENV.fetch("IN_APP_UPDATE_PRIORITY", "3").to_i
+      metadata_path: "#{ROOT_DIR}/fastlane/metadata/android"
+    )
+    opts.merge!(rollout_options) unless status == "draft"
+    upload_to_play_store(opts)
+  end
+
+  lane :upload_metadata_android do
+    upload_to_play_store(
+      base_play_store_options.merge(
+        skip_upload_aab: true,
+        skip_upload_apk: true,
+        skip_upload_metadata: false,
+        skip_upload_screenshots: false,
+        skip_upload_images: false,
+        skip_upload_changelogs: true,
+        release_status: "draft",
+        metadata_path: "#{ROOT_DIR}/fastlane/metadata/android"
+      )
+    )
+  end
+
+  lane :upload_binary_android do
+    status = ENV.fetch("RELEASE_STATUS", "draft")
+    opts = base_play_store_options.merge(
+      aab: AAB_PATH,
+      release_status: status,
+      skip_upload_metadata: true,
+      skip_upload_screenshots: true,
+      skip_upload_images: true,
+      skip_upload_changelogs: true
     )
+    # Rollout percentage is only valid for non-draft releases
+    opts.merge!(rollout_options) unless status == "draft"
+    upload_to_play_store(opts)
   end
 
   lane :sync_google_iap do

package/templates/fastlane/android/Pluginfile.template

@@ -1 +1,4 @@
-gem "fastlane-plugin-iap", git: "https://github.com/daemux/fastlane-plugin-iap"
+# fastlane-plugin-iap is not yet published.
+# IAP sync is handled gracefully in codemagic.yaml (non-blocking).
+# Uncomment when the plugin is available:
+# gem "fastlane-plugin-iap", git: "https://github.com/daemux/fastlane-plugin-iap"

package/templates/fastlane/ios/Fastfile.template

@@ -5,6 +5,20 @@ default_platform(:ios)
 ROOT_DIR = ENV.fetch("CM_BUILD_DIR", File.expand_path("../..", __FILE__))
 APP_ROOT = ENV.fetch("APP_ROOT", "app")
 
+# Monkey-patch: Fastlane deliver crashes with "No data" when fetching
+# app_store_review_detail on the first version (fastlane/fastlane#20538).
+# Wrap the method to rescue the RuntimeError gracefully.
+# Require deliver explicitly so the constant is available at parse time.
+require "deliver"
+::Deliver::UploadMetadata.prepend(Module.new do
+  def review_attachment_file(version)
+    super
+  rescue RuntimeError => e
+    raise unless e.message.include?("No data")
+    Fastlane::UI.important("Skipping review attachment: #{e.message} (first version)")
+  end
+end)
+
 def metadata_changed?(path)
   !sh("git diff --name-only HEAD~1 -- #{path}").strip.empty?
 rescue StandardError
@@ -30,26 +44,67 @@ def asc_api_key
   end
 end
 
+# Shared deliver options reused across iOS lanes.
+def base_deliver_options
+  {
+    api_key: asc_api_key,
+    app_identifier: ENV["BUNDLE_ID"],
+    force: true
+  }
+end
+
+def metadata_deliver_options
+  base_deliver_options.merge(
+    metadata_path: "#{ROOT_DIR}/fastlane/metadata",
+    screenshots_path: "#{ROOT_DIR}/fastlane/screenshots/ios",
+    sync_screenshots: true,
+    primary_category: ENV.fetch("PRIMARY_CATEGORY", "UTILITIES"),
+    secondary_category: ENV.fetch("SECONDARY_CATEGORY", "PRODUCTIVITY")
+  )
+end
+
+def submission_options
+  {
+    submit_for_review: ENV.fetch("SUBMIT_FOR_REVIEW", "true") == "true",
+    automatic_release: ENV.fetch("AUTOMATIC_RELEASE", "true") == "true"
+  }
+end
+
 platform :ios do
   lane :deploy_ios do
     deliver(
-      api_key: asc_api_key,
-      app_identifier: ENV["BUNDLE_ID"],
-      ipa: Dir.glob("#{ROOT_DIR}/#{APP_ROOT}/build/ios/ipa/*.ipa").first,
-      skip_metadata: !metadata_changed?("fastlane/metadata/ios/"),
-      skip_screenshots: !metadata_changed?("fastlane/screenshots/ios/"),
-      sync_screenshots: true,
-      metadata_path: "#{ROOT_DIR}/fastlane/metadata/ios",
-      screenshots_path: "#{ROOT_DIR}/fastlane/screenshots/ios",
-      submit_for_review: ENV.fetch("SUBMIT_FOR_REVIEW", "true") == "true",
-      automatic_release: ENV.fetch("AUTOMATIC_RELEASE", "true") == "true",
-      force: true,
-      app_rating_config_path: "#{ROOT_DIR}/fastlane/app_rating_config.json",
-      price_tier: ENV.fetch("PRICE_TIER", "0").to_i,
-      run_precheck_before_submit: true,
-      precheck_include_in_app_purchases: false,
-      primary_category: ENV.fetch("PRIMARY_CATEGORY", "UTILITIES"),
-      secondary_category: ENV.fetch("SECONDARY_CATEGORY", "PRODUCTIVITY")
+      metadata_deliver_options.merge(submission_options).merge(
+        ipa: Dir.glob("#{ROOT_DIR}/#{APP_ROOT}/build/ios/ipa/*.ipa").first,
+        app_rating_config_path: "#{ROOT_DIR}/fastlane/app_rating_config.json",
+        skip_metadata: !metadata_changed?("fastlane/metadata/ios/"),
+        skip_screenshots: !metadata_changed?("fastlane/screenshots/ios/"),
+        run_precheck_before_submit: true,
+        precheck_include_in_app_purchases: false
+      )
+    )
+  end
+
+  lane :upload_metadata_ios do
+    deliver(
+      metadata_deliver_options.merge(
+        skip_binary_upload: true,
+        skip_metadata: false,
+        skip_screenshots: false,
+        run_precheck_before_submit: false,
+        submit_for_review: false
+      )
+    )
+  end
+
+  lane :upload_binary_ios do
+    deliver(
+      base_deliver_options.merge(submission_options).merge(
+        ipa: Dir.glob("#{ROOT_DIR}/#{APP_ROOT}/build/ios/ipa/*.ipa").first,
+        skip_metadata: true,
+        skip_screenshots: true,
+        run_precheck_before_submit: true,
+        precheck_include_in_app_purchases: false
+      )
     )
   end
 

package/templates/fastlane/ios/Pluginfile.template

@@ -1 +1,4 @@
-gem "fastlane-plugin-iap", git: "https://github.com/daemux/fastlane-plugin-iap"
+# fastlane-plugin-iap is not yet published.
+# IAP sync is handled gracefully in codemagic.yaml (non-blocking).
+# Uncomment when the plugin is available:
+# gem "fastlane-plugin-iap", git: "https://github.com/daemux/fastlane-plugin-iap"