@makefully/adaptfully 3.10.0 → 3.12.0

package/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 All notable changes to this project are documented in this file.
 
+## 3.12.0 — 2026-07-23
+
+### Added
+
+- **`adaptfully google-publish`** — import a Google Play service-account JSON into `assets/meta/deployments/android/google.json` (or `--deployment` / `--output`) and ensure `manifest.json` has `"type": "google"`.
+- **`adaptfully apple-publish`** — prompt for (or accept) App Store Connect credentials and write `assets/meta/deployments/ios/apple.json` with `"type": "apple"` on the deployment manifest.
+- **Publish helpers update `.gitignore`** — `steam-publish` / `google-publish` / `apple-publish` append standard `assets/meta/deployments/**` credential ignore patterns (and any custom `--output` under the project) so secrets are less likely to be committed.
+
+### Changed
+
+- **`adaptfully steam-publish`** replaces the credential CLI formerly named `steam-auth` (runtime plugin `steam-auth` is unchanged). `adaptfully steam-auth` still works as a deprecated alias.
+- Steam publish also ensures the deployment `manifest.json` has `"type": "steam"`.
+
+## 3.11.0 — 2026-07-23
+
+### Added
+
+- **Layered icon validation** — build/deploy/release zips always include `meta/icon-foreground.png` and `meta/icon-background.png`. When project icons are missing under `assets/meta/`, Adaptfully **warns** (does not fail) and ships packaged placeholder icons from `lib/assets/`.
+- **`resolveMetaIcons` / `appendMetaIcons`** — exported helpers for resolving project vs placeholder icon paths.
+
+### Changed
+
+- Legacy meta packaging skips re-adding icon filenames so placeholders and project icons are not duplicated in the zip.
+
 ## 3.10.0 — 2026-07-17
 
 ### Added
@@ -13,6 +37,7 @@ All notable changes to this project are documented in this file.
 
 - **Builder family defaults** — `android` / `ios` / `ios-sim` (and `-dev`) resolve to Wrapfully family **`capacitor`**. Explicit `packager: "cordova"` still selects Cordova for that platform. Composite `cordova` / `apple` routes are not used.
 - **`resolveBuildSpec`** includes `socialLogin: boolean`.
+- **Single-target Wrapfully POSTs** go to the target route (`/android/build`, `/ios/release`, …) instead of the family route (`/capacitor/...`), so OS relay and existing target routes keep working.
 
 ## 3.9.0 — 2026-07-15
 

package/README.md

@@ -26,7 +26,9 @@ adaptfully build steam                        # prebuild + zip and send to Wrapf
 adaptfully deploy web                         # prebuild + POST to Wrapfully for each of web's deployments
 adaptfully deploy web --deployment web-prod   # deploy to a single named deployment
 adaptfully deploy steam                       # prebuild + POST to Wrapfully steam builder
-adaptfully steam-auth                         # one-time: log in with steamcmd → assets/meta/deployments/steam/steam.json
+adaptfully steam-publish                      # one-time: log in with steamcmd → assets/meta/deployments/steam/steam.json
+adaptfully google-publish --from ./sa.json    # one-time: import Play service account → deployments/android/google.json
+adaptfully apple-publish                      # one-time: write App Store Connect creds → deployments/ios/apple.json
 ```
 
 | Stage | What it does |
@@ -34,7 +36,9 @@ adaptfully steam-auth                         # one-time: log in with steamcmd
 | `prebuild` | Copy `deploy/` to `output/<platform>-prebuild/` and inject registrations into `config.htmlInjections` |
 | `build` | Prebuild, then POST the result to Wrapfully (artifact zip only) |
 | `deploy` | POST the prior build artifact from `./output/` to each configured deployment (or `--deployment`) |
-| `steam-auth` | One-time local setup: install steamcmd, interactive login, write the `steam` deployment's `steam.json` |
+| `steam-publish` | One-time local setup: install steamcmd, interactive login, write the `steam` deployment's `steam.json` (also updates `.gitignore`) |
+| `google-publish` | One-time local setup: import a Play Console service-account JSON into the `android` deployment folder (also updates `.gitignore`) |
+| `apple-publish` | One-time local setup: write App Store Connect credentials into the `ios` deployment folder (also updates `.gitignore`) |
 
 `wrapfully-deploy` is a compatibility alias for `adaptfully deploy` when invoked with a Wrapfully builder name (`steam`, `win`, `android`, etc.).
 
@@ -253,8 +257,10 @@ For web-only hosting (no Wrapfully), stop after prebuild and upload `output/web-
 Run from your project root:
 
 ```bash
-npx adaptfully <prebuild|build|deploy> <platform> [server] [mode]
-npx adaptfully steam-auth [--username U] [--password P] [--output path]
+npx adaptfully <prebuild|build|deploy|release> <platform> [server] [mode]
+npx adaptfully steam-publish [--username U] [--password P] [--deployment steam] [--output path]
+npx adaptfully google-publish [--from service-account.json] [--deployment android] [--output path]
+npx adaptfully apple-publish [--deployment ios] [--category C] [--identity I] [--username U] [--password P]
 ```
 
 | Stage | Description |
@@ -363,7 +369,7 @@ mygame/
 
 The selected deployment's folder is shipped as `meta/publish/` in the zip, so per-platform credential file names (`build.json`, `sftp.json`, `steam.json`, `apple.json`, `google.json`, `ms.json`, `android/`, `ms/`) live inside `assets/meta/deployments/<key>/`.
 
-Icons (`icon-foreground.png`, `icon-background.png`) are required for mobile, desktop, and Steam builds.
+Icons (`icon-foreground.png`, `icon-background.png`) are required for mobile, desktop, and Steam builds. If either file is missing from `assets/meta/`, Adaptfully **warns** and ships packaged placeholder icons for that build so Wrapfully can still run.
 
 ### Icons
 
@@ -378,6 +384,8 @@ The build server composites the foreground over the background, applies a bindin
 
 **Recommended format:** 1536×1536 pixel square PNGs for both files. Images with other dimensions are scaled to 1536×1536 automatically, but matching the target size produces the sharpest results.
 
+Missing icons do not fail the Adaptfully client: check the `WARNING missing layered icon(s)` log line and replace the placeholders before a store release.
+
 ## Configuration
 
 Build settings are read from `package.json`. The client merges any `wrapfully.json` fields into `package.json`'s `config` object before sending.
@@ -518,7 +526,14 @@ Place keystore files in `assets/meta/deployments/<deployment>/android/`. Include
 }
 ```
 
-To deploy to Google Play, also include `assets/meta/deployments/<deployment>/google.json`:
+To deploy to Google Play, also include `assets/meta/deployments/<deployment>/google.json`. The easiest path is:
+
+```bash
+npx adaptfully google-publish --from ./path/to/play-service-account.json
+# defaults to assets/meta/deployments/android/google.json (+ manifest type "google")
+```
+
+The file looks like:
 
 ```json
 {
@@ -560,7 +575,14 @@ Include `assets/meta/deployments/<deployment>/build.json` with iOS signing setti
 }
 ```
 
-To deploy to the App Store, include `assets/meta/deployments/<deployment>/apple.json`:
+To deploy to the App Store, include `assets/meta/deployments/<deployment>/apple.json`. The easiest path is:
+
+```bash
+npx adaptfully apple-publish
+# defaults to assets/meta/deployments/ios/apple.json (+ manifest type "apple")
+```
+
+The file looks like:
 
 ```json
 {
@@ -579,7 +601,7 @@ Set `packager: "cordova"` on an `android` or `ios` platform to use Cordova inste
 
 `steam-dev` builds debug Electron binaries for Windows, Mac, and Linux without uploading to Steam. No `steam.json` credentials are required.
 
-For release uploads, run **`adaptfully steam-auth`** once on your machine. It installs steamcmd if needed, logs you in interactively (enter a Steam Guard code if prompted), and writes `assets/meta/deployments/steam/steam.json`:
+For release uploads, run **`adaptfully steam-publish`** once on your machine. It installs steamcmd if needed, logs you in interactively (enter a Steam Guard code if prompted), and writes `assets/meta/deployments/steam/steam.json`:
 
 ```json
 {
@@ -593,7 +615,7 @@ For release uploads, run **`adaptfully steam-auth`** once on your machine. It in
 
 Accounts **without** Steam Guard only need `username`, `password`, and `configVdf`. Accounts **with** Steam Guard also include the `ssfn` sentry file so the Wrapfully server can log in without a live 2FA prompt.
 
-Re-run `adaptfully steam-auth` if Steam invalidates the token (new machine, password change, or expired guard).
+Re-run `adaptfully steam-publish` if Steam invalidates the token (new machine, password change, or expired guard).
 
 For Steamworks / `steam-auth` client builds, set `platforms.<name>.steamId`. For Steam **uploads**, set `steamId` on the deployment’s `manifest.json` (see Wrapfully). Those are independent: you can deploy without steam-auth, or use steam-auth without uploading.
 

package/lib/node/apple-publish.js

@@ -0,0 +1,156 @@
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import readline from 'node:readline/promises';
+import { stdin as input, stdout as output } from 'node:process';
+import {
+    defaultDeploymentCredentialPath,
+    ensureDeploymentManifest,
+    ensurePublishCredentialsGitignore,
+    parsePublishCredentialArgv,
+} from './publish-credentials.js';
+
+/**
+ * @param {string} [projectRoot]
+ * @param {string} [deploymentKey='ios']
+ */
+export function defaultApplePublishPath(projectRoot = '.', deploymentKey = 'ios') {
+    return defaultDeploymentCredentialPath(projectRoot, deploymentKey, 'apple.json');
+}
+
+/**
+ * @param {{ category: string, identity: string, username: string, password: string }} auth
+ */
+export function buildApplePublishJson(auth) {
+    return {
+        category: String(auth.category).trim(),
+        identity: String(auth.identity).trim(),
+        username: String(auth.username).trim(),
+        password: String(auth.password),
+    };
+}
+
+/**
+ * @param {unknown} raw
+ * @returns {{ category: string, identity: string, username: string, password: string }}
+ */
+export function validateApplePublishJson(raw) {
+    if (raw == null || typeof raw !== 'object' || Array.isArray(raw)) {
+        throw new Error('Apple credentials must be a JSON object.');
+    }
+
+    const json = /** @type {Record<string, unknown>} */ (raw);
+    const required = ['category', 'identity', 'username', 'password'];
+    const missing = required.filter((key) => {
+        const value = json[key];
+        return value == null || String(value).trim() === '';
+    });
+
+    if (missing.length) {
+        throw new Error(`Apple credentials JSON is missing required field(s): ${missing.join(', ')}.`);
+    }
+
+    return buildApplePublishJson({
+        category: /** @type {string} */ (json.category),
+        identity: /** @type {string} */ (json.identity),
+        username: /** @type {string} */ (json.username),
+        password: /** @type {string} */ (json.password),
+    });
+}
+
+/**
+ * @param {{
+ *   category?: string,
+ *   identity?: string,
+ *   username?: string,
+ *   password?: string,
+ *   from?: string,
+ *   output?: string,
+ *   deployment?: string,
+ *   projectRoot?: string,
+ *   log?: (message: string) => void,
+ * }} [options]
+ */
+export async function runApplePublish(options = {}) {
+    const log = options.log ?? console.log;
+    const projectRoot = options.projectRoot ?? '.';
+    const deploymentKey = options.deployment ?? 'ios';
+    const outputPath = path.resolve(
+        options.output ?? defaultApplePublishPath(projectRoot, deploymentKey),
+    );
+
+    /** @type {{ category: string, identity: string, username: string, password: string }} */
+    let appleJson;
+
+    if (options.from) {
+        const fromPath = path.resolve(options.from);
+        let raw;
+
+        try {
+            raw = JSON.parse(await fsp.readFile(fromPath, 'utf8'));
+        } catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            throw new Error(`Unable to read Apple credentials JSON at "${fromPath}": ${message}`);
+        }
+
+        appleJson = validateApplePublishJson(raw);
+    } else {
+        let category = options.category ?? process.env.APPLE_CATEGORY;
+        let identity = options.identity ?? process.env.APPLE_IDENTITY;
+        let username = options.username
+            ?? process.env.APPLE_ID
+            ?? process.env.APPLE_USERNAME;
+        let password = options.password
+            ?? process.env.APPLE_APP_SPECIFIC_PASSWORD
+            ?? process.env.APPLE_PASSWORD;
+
+        if (!category || !identity || !username || !password) {
+            const rl = readline.createInterface({ input, output });
+
+            try {
+                if (!category) {
+                    category = String(await rl.question('App Store category: ')).trim();
+                }
+                if (!identity) {
+                    identity = String(await rl.question('Apple team identity (e.g. TEAMID): ')).trim();
+                }
+                if (!username) {
+                    username = String(await rl.question('Apple ID username: ')).trim();
+                }
+                if (!password) {
+                    password = String(
+                        await rl.question('Apple app-specific password: '),
+                    );
+                }
+            } finally {
+                rl.close();
+            }
+        }
+
+        appleJson = validateApplePublishJson({
+            category,
+            identity,
+            username,
+            password,
+        });
+    }
+
+    await fsp.mkdir(path.dirname(outputPath), { recursive: true });
+    await fsp.writeFile(outputPath, `${JSON.stringify(appleJson, null, 4)}\n`);
+    await ensureDeploymentManifest(path.dirname(outputPath), 'apple', log);
+    await ensurePublishCredentialsGitignore(projectRoot, {
+        extraPaths: [outputPath],
+        log,
+    });
+
+    log(`adaptfully: wrote ${outputPath}`);
+    log(`adaptfully: Apple ID ${appleJson.username} (identity ${appleJson.identity})`);
+
+    return { outputPath, appleJson, deploymentKey };
+}
+
+/**
+ * @param {string[]} [argv]
+ */
+export async function applePublishFromCli(argv = process.argv) {
+    return runApplePublish(parsePublishCredentialArgv(argv));
+}

package/lib/node/archive.js

@@ -1,9 +1,9 @@
 import archiver from 'archiver';
 import fs from 'node:fs';
 import path from 'node:path';
+import { appendMetaIcons, isMetaIconFilename, META_DIR } from './icons.js';
 
 const
-    META_DIR = 'assets/meta',
     DEPLOYMENTS_DIRNAME = 'deployments',
     PUBLISH_DIRNAME = 'publish';
 
@@ -38,6 +38,9 @@ function appendMeta(zip, publishDir, deploymentDirs = [], options = {}) {
         log = options.log ?? (() => {}),
         metaDir = path.resolve(META_DIR);
 
+    // Always ship layered icons (project files or Adaptfully placeholders).
+    appendMetaIcons(zip, { metaDir, log });
+
     if (!fs.existsSync(metaDir)) {
         log(`adaptfully: meta dir missing at ${metaDir}; skipping credentials`);
         return;
@@ -46,7 +49,17 @@ function appendMeta(zip, publishDir, deploymentDirs = [], options = {}) {
     const deploymentsRoot = path.join(metaDir, DEPLOYMENTS_DIRNAME);
 
     if (!fs.existsSync(deploymentsRoot)) {
-        appendDirectory(zip, metaDir, 'meta');
+        for (const entry of fs.readdirSync(metaDir, { withFileTypes: true })) {
+            if (isMetaIconFilename(entry.name)) {
+                continue;
+            }
+            const fullPath = path.join(metaDir, entry.name);
+            if (entry.isDirectory()) {
+                appendDirectory(zip, fullPath, `meta/${entry.name}`);
+            } else {
+                zip.file(fullPath, { name: `meta/${entry.name}` });
+            }
+        }
         return;
     }
 
@@ -54,6 +67,9 @@ function appendMeta(zip, publishDir, deploymentDirs = [], options = {}) {
         if (entry.name === DEPLOYMENTS_DIRNAME || entry.name === PUBLISH_DIRNAME) {
             continue;
         }
+        if (isMetaIconFilename(entry.name)) {
+            continue;
+        }
 
         const fullPath = path.join(metaDir, entry.name);
         if (entry.isDirectory()) {

package/lib/node/google-publish.js

@@ -0,0 +1,112 @@
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import {
+    defaultDeploymentCredentialPath,
+    ensureDeploymentManifest,
+    ensurePublishCredentialsGitignore,
+    parsePublishCredentialArgv,
+    promptRequired,
+} from './publish-credentials.js';
+
+const GOOGLE_REQUIRED_FIELDS = [
+    'type',
+    'project_id',
+    'private_key',
+    'client_email',
+];
+
+/**
+ * @param {string} [projectRoot]
+ * @param {string} [deploymentKey='android']
+ */
+export function defaultGooglePublishPath(projectRoot = '.', deploymentKey = 'android') {
+    return defaultDeploymentCredentialPath(projectRoot, deploymentKey, 'google.json');
+}
+
+/**
+ * @param {unknown} raw
+ * @returns {Record<string, unknown>}
+ */
+export function validateGoogleServiceAccount(raw) {
+    if (raw == null || typeof raw !== 'object' || Array.isArray(raw)) {
+        throw new Error('Google Play credentials must be a JSON object (service account key).');
+    }
+
+    /** @type {Record<string, unknown>} */
+    const json = { .../** @type {Record<string, unknown>} */ (raw) };
+
+    if (json.type != null && json.type !== 'service_account') {
+        throw new Error(
+            `Google service account JSON type must be "service_account" (got ${JSON.stringify(json.type)}).`,
+        );
+    }
+
+    const missing = GOOGLE_REQUIRED_FIELDS.filter((key) => {
+        const value = json[key];
+        return value == null || String(value).trim() === '';
+    });
+
+    if (missing.length) {
+        throw new Error(
+            `Google service account JSON is missing required field(s): ${missing.join(', ')}.`,
+        );
+    }
+
+    return json;
+}
+
+/**
+ * @param {{
+ *   from?: string,
+ *   output?: string,
+ *   deployment?: string,
+ *   projectRoot?: string,
+ *   log?: (message: string) => void,
+ * }} [options]
+ */
+export async function runGooglePublish(options = {}) {
+    const log = options.log ?? console.log;
+    const projectRoot = options.projectRoot ?? '.';
+    const deploymentKey = options.deployment ?? 'android';
+    const outputPath = path.resolve(
+        options.output ?? defaultGooglePublishPath(projectRoot, deploymentKey),
+    );
+
+    const fromPath = path.resolve(
+        await promptRequired(
+            'Path to Google Play service account JSON: ',
+            options.from ?? process.env.GOOGLE_APPLICATION_CREDENTIALS,
+        ),
+    );
+
+    let raw;
+
+    try {
+        raw = JSON.parse(await fsp.readFile(fromPath, 'utf8'));
+    } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Unable to read Google service account JSON at "${fromPath}": ${message}`);
+    }
+
+    const googleJson = validateGoogleServiceAccount(raw);
+
+    await fsp.mkdir(path.dirname(outputPath), { recursive: true });
+    await fsp.writeFile(outputPath, `${JSON.stringify(googleJson, null, 4)}\n`);
+    await ensureDeploymentManifest(path.dirname(outputPath), 'google', log);
+    await ensurePublishCredentialsGitignore(projectRoot, {
+        extraPaths: [outputPath],
+        log,
+    });
+
+    log(`adaptfully: wrote ${outputPath}`);
+    log(`adaptfully: imported service account ${googleJson.client_email}`);
+
+    return { outputPath, googleJson, deploymentKey };
+}
+
+/**
+ * @param {string[]} [argv]
+ */
+export async function googlePublishFromCli(argv = process.argv) {
+    return runGooglePublish(parsePublishCredentialArgv(argv));
+}

package/lib/node/icons.js

@@ -0,0 +1,97 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { getPackageRoot } from './paths.js';
+
+export const META_DIR = 'assets/meta';
+export const ICON_FOREGROUND = 'icon-foreground.png';
+export const ICON_BACKGROUND = 'icon-background.png';
+
+const ICON_FILES = [ICON_FOREGROUND, ICON_BACKGROUND];
+
+/**
+ * Absolute path to a packaged Adaptfully placeholder icon.
+ * @param {string} filename
+ */
+export function resolvePlaceholderIconPath(filename) {
+    return path.join(getPackageRoot(), 'lib', 'assets', filename);
+}
+
+/**
+ * @param {string} [metaDir=META_DIR]
+ */
+export function resolveMetaIconPaths(metaDir = META_DIR) {
+    const root = path.resolve(metaDir);
+    return {
+        metaDir: root,
+        foreground: path.join(root, ICON_FOREGROUND),
+        background: path.join(root, ICON_BACKGROUND),
+    };
+}
+
+/**
+ * Resolve layered icon paths for Wrapfully packaging. Warns (does not throw) when
+ * project icons are missing and falls back to Adaptfully placeholders.
+ *
+ * @param {{ metaDir?: string, log?: (message: string) => void }} [options]
+ * @returns {{
+ *   metaDir: string,
+ *   foreground: string,
+ *   background: string,
+ *   missing: string[],
+ *   usedPlaceholders: boolean,
+ * }}
+ */
+export function resolveMetaIcons(options = {}) {
+    const log = options.log ?? console.log;
+    const { metaDir, foreground, background } = resolveMetaIconPaths(options.metaDir);
+    /** @type {string[]} */
+    const missing = [];
+    let resolvedForeground = foreground;
+    let resolvedBackground = background;
+
+    if (!fs.existsSync(foreground)) {
+        missing.push(ICON_FOREGROUND);
+        resolvedForeground = resolvePlaceholderIconPath(ICON_FOREGROUND);
+    }
+    if (!fs.existsSync(background)) {
+        missing.push(ICON_BACKGROUND);
+        resolvedBackground = resolvePlaceholderIconPath(ICON_BACKGROUND);
+    }
+
+    if (missing.length > 0) {
+        log(
+            `adaptfully: WARNING missing layered icon(s) in ${metaDir}: ${missing.join(', ')}. `
+            + 'Using Adaptfully placeholder icons for this build.',
+        );
+    }
+
+    return {
+        metaDir,
+        foreground: resolvedForeground,
+        background: resolvedBackground,
+        missing,
+        usedPlaceholders: missing.length > 0,
+    };
+}
+
+/**
+ * Append layered icons to a zip under meta/. Uses project icons when present;
+ * otherwise warns and ships Adaptfully placeholders.
+ *
+ * @param {import('archiver').Archiver} zip
+ * @param {{ metaDir?: string, log?: (message: string) => void }} [options]
+ * @returns {ReturnType<typeof resolveMetaIcons>}
+ */
+export function appendMetaIcons(zip, options = {}) {
+    const resolved = resolveMetaIcons(options);
+    zip.file(resolved.foreground, { name: `meta/${ICON_FOREGROUND}` });
+    zip.file(resolved.background, { name: `meta/${ICON_BACKGROUND}` });
+    return resolved;
+}
+
+/**
+ * @param {string} name
+ */
+export function isMetaIconFilename(name) {
+    return ICON_FILES.includes(name);
+}

package/lib/node/index.js

@@ -2,7 +2,17 @@ export { buildOutputDir, clearStaleBuildExtract, resolveBuildArtifactDir } from
 export { createArchive, createDeployArchive, createReleaseArchive, createSourceArchive } from './archive.js';
 export { loadProjectConfig, resolveServerUrl } from './config.js';
 export { send } from './deploy.js';
-export { adaptfullyFromCli, parseStageArgs, runAdaptfullyStage } from './pipeline.js';
+export {
+    appendMetaIcons,
+    ICON_BACKGROUND,
+    ICON_FOREGROUND,
+    isMetaIconFilename,
+    META_DIR,
+    resolveMetaIconPaths,
+    resolveMetaIcons,
+    resolvePlaceholderIconPath,
+} from './icons.js';
+export { adaptfullyFromCli, parseStageArgs, resolveWrapfullyRoute, runAdaptfullyStage } from './pipeline.js';
 export { prebuildPlatform, prebuildOutputDir, resolveHtmlInjections } from './prebuild.js';
 export { getPackageRoot, getRuntimeDir, resolveRuntimeScript } from './paths.js';
 export {
@@ -40,12 +50,35 @@ export {
     resolveRegistrationAssets,
 } from './registrations.js';
 export { printBuildReport } from './report.js';
+export {
+    defaultDeploymentCredentialPath,
+    ensureDeploymentManifest,
+    ensurePublishCredentialsGitignore,
+    parsePublishCredentialArgv,
+    promptRequired,
+    PUBLISH_CREDENTIAL_GITIGNORE_PATTERNS,
+} from './publish-credentials.js';
 export {
     buildSteamPublishJson,
     collectSteamAuthFiles,
     defaultSteamPublishPath,
     defaultSteamcmdCacheDir,
     ensureSteamcmd,
+    runSteamPublish,
+    steamPublishFromCli,
     runSteamAuth,
     steamAuthFromCli,
-} from './steam-auth.js';
+} from './steam-publish.js';
+export {
+    defaultGooglePublishPath,
+    googlePublishFromCli,
+    runGooglePublish,
+    validateGoogleServiceAccount,
+} from './google-publish.js';
+export {
+    applePublishFromCli,
+    buildApplePublishJson,
+    defaultApplePublishPath,
+    runApplePublish,
+    validateApplePublishJson,
+} from './apple-publish.js';

package/lib/node/pipeline.js

@@ -8,11 +8,33 @@ import {
     resolveDeploymentsForPlatform,
     resolvePublishDir,
 } from './registrations.js';
-import { steamAuthFromCli } from './steam-auth.js';
+import { steamPublishFromCli } from './steam-publish.js';
+import { googlePublishFromCli } from './google-publish.js';
+import { applePublishFromCli } from './apple-publish.js';
 
 /** @typedef {'prebuild' | 'build' | 'deploy' | 'release'} AdaptfullyStage */
 
 const VALID_STAGES = new Set(['prebuild', 'build', 'deploy', 'release']);
+const PUBLISH_COMMANDS = {
+    'steam-publish': steamPublishFromCli,
+    'google-publish': googlePublishFromCli,
+    'apple-publish': applePublishFromCli,
+};
+
+/**
+ * Wrapfully URL path segment for build/release.
+ * Single-target platforms post to the target route (`android`, `ios`, …) so OS relay
+ * and long-standing target routes work; multi-target platforms post to the family
+ * (`electron`, …).
+ *
+ * @param {{ family: string, targets: string[] }} buildSpec
+ */
+export function resolveWrapfullyRoute(buildSpec) {
+    if (buildSpec.targets.length === 1) {
+        return buildSpec.targets[0];
+    }
+    return buildSpec.family;
+}
 
 /**
  * @param {AdaptfullyStage} stage
@@ -69,10 +91,15 @@ export async function runAdaptfullyStage(stage, platformKey, options) {
     /** @type {{ deploymentKey: string, stage: string, family: string }[]} */
     const sent = [];
 
+    const wrapfullyRoute = resolveWrapfullyRoute(buildSpec);
+
     if (stage === 'release') {
         const deploymentDirs = deployments.map((key) => resolvePublishDir(key));
 
-        log(`adaptfully: ${stage} ${platformKey} → ${buildSpec.family} (${buildSpec.targets.join(', ')})`);
+        log(
+            `adaptfully: ${stage} ${platformKey} → ${buildSpec.family} `
+            + `(${buildSpec.targets.join(', ')}) via /${wrapfullyRoute}/release`,
+        );
 
         log(
             `adaptfully: release deployments → ${
@@ -85,7 +112,7 @@ export async function runAdaptfullyStage(stage, platformKey, options) {
             contents,
             options.server,
             'release',
-            buildSpec.family,
+            wrapfullyRoute,
             prebuiltDir,
             pkg,
             options.mode ?? 'extract',
@@ -107,7 +134,7 @@ export async function runAdaptfullyStage(stage, platformKey, options) {
         log(
             `adaptfully: ${stage} ${platformKey} → `
             + `${deploymentKey === 'zip' ? 'artifact zip' : `deployment "${deploymentKey}"`} `
-            + `via Wrapfully ${buildSpec.family}`,
+            + `via Wrapfully /${wrapfullyRoute}/${wrapStage} (${buildSpec.family})`,
         );
 
         await send(
@@ -115,7 +142,7 @@ export async function runAdaptfullyStage(stage, platformKey, options) {
             contents,
             options.server,
             wrapStage,
-            buildSpec.family,
+            wrapfullyRoute,
             prebuiltDir,
             pkg,
             options.mode ?? 'extract',
@@ -141,7 +168,12 @@ export async function adaptfullyFromCli(argv = process.argv) {
     const command = argv[2];
 
     if (command === 'steam-auth') {
-        return steamAuthFromCli(argv);
+        console.warn('adaptfully: "steam-auth" CLI is deprecated; use "steam-publish" instead.');
+        return steamPublishFromCli(argv);
+    }
+
+    if (PUBLISH_COMMANDS[command]) {
+        return PUBLISH_COMMANDS[command](argv);
     }
 
     const stage = command;
@@ -154,18 +186,23 @@ export async function adaptfullyFromCli(argv = process.argv) {
         throw new Error(
             'Usage:\n'
             + '  adaptfully <prebuild|build|deploy|release> <platform> [server] [mode] [--deployment <key>] [--artifact <path>]\n'
-            + '  adaptfully steam-auth [--username U] [--password P] [--output path]\n'
+            + '  adaptfully steam-publish [--username U] [--password P] [--deployment steam] [--output path]\n'
+            + '  adaptfully google-publish [--from service-account.json] [--deployment android] [--output path]\n'
+            + '  adaptfully apple-publish [--deployment ios] [--category C] [--identity I] [--username U] [--password P]\n'
             + '\n'
             + 'Stages:\n'
             + '  prebuild  Copy deploy/ and apply platform registrations → output/<platform>-prebuild/\n'
-            + '  build     prebuild + POST /{family}/build (zip artifact only)\n'
+            + '  build     prebuild + POST /{target|family}/build (zip artifact only)\n'
             + '  deploy    POST /deploy/{key} with prior artifact + deployment credentials\n'
-            + '  release   prebuild + POST /{family}/release (build + configured deployments)\n'
+            + '  release   prebuild + POST /{target|family}/release (build + configured deployments)\n'
             + '\n'
             + '  --deployment <key>  Target a single named deployment.\n'
             + '  --artifact <path>   Prior build artifact directory (deploy only; default: ./output/ after build).\n'
             + '\n'
-            + '  steam-auth  Install steamcmd if needed, log in interactively, write steam deployment steam.json',
+            + 'Publish credential helpers (one-time local setup):\n'
+            + '  steam-publish   Install steamcmd if needed, log in, write steam deployment steam.json\n'
+            + '  google-publish  Import a Play service-account JSON into the android deployment folder\n'
+            + '  apple-publish   Write App Store Connect credentials into the ios deployment folder',
         );
     }
 

package/lib/node/publish-credentials.js

@@ -0,0 +1,220 @@
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import readline from 'node:readline/promises';
+import { stdin as input, stdout as output } from 'node:process';
+
+/** Patterns that should never be committed from deployment credential folders. */
+export const PUBLISH_CREDENTIAL_GITIGNORE_PATTERNS = [
+    'assets/meta/deployments/**/sftp.json',
+    'assets/meta/deployments/**/steam.json',
+    'assets/meta/deployments/**/build.json',
+    'assets/meta/deployments/**/google.json',
+    'assets/meta/deployments/**/apple.json',
+    'assets/meta/deployments/**/ms.json',
+    'assets/meta/deployments/**/android/',
+    'assets/meta/deployments/**/ms/',
+];
+
+const GITIGNORE_SECTION_HEADER = '# Adaptfully publish credentials — do not commit';
+
+/**
+ * @param {string} [projectRoot]
+ * @param {string} deploymentKey
+ * @param {string} filename
+ */
+export function defaultDeploymentCredentialPath(projectRoot = '.', deploymentKey, filename) {
+    return path.resolve(
+        projectRoot,
+        'assets',
+        'meta',
+        'deployments',
+        deploymentKey,
+        filename,
+    );
+}
+
+/**
+ * @param {string} content
+ * @returns {Set<string>}
+ */
+function gitignoreLineSet(content) {
+    return new Set(
+        content
+            .split(/\r?\n/)
+            .map((line) => line.trim())
+            .filter((line) => line && !line.startsWith('#')),
+    );
+}
+
+/**
+ * Ensure project `.gitignore` ignores Adaptfully deployment credential files.
+ * Idempotent: only appends missing patterns. Optionally also ignores a specific
+ * credential file path (e.g. custom `--output`).
+ *
+ * @param {string} [projectRoot='.']
+ * @param {{
+ *   extraPaths?: string[],
+ *   log?: (message: string) => void,
+ * }} [options]
+ */
+export async function ensurePublishCredentialsGitignore(projectRoot = '.', options = {}) {
+    const log = options.log ?? console.log;
+    const root = path.resolve(projectRoot);
+    const gitignorePath = path.join(root, '.gitignore');
+
+    let content = '';
+    let existed = true;
+
+    try {
+        content = await fsp.readFile(gitignorePath, 'utf8');
+    } catch {
+        existed = false;
+        content = '';
+    }
+
+    const existing = gitignoreLineSet(content);
+    /** @type {string[]} */
+    const toAdd = [];
+
+    for (const pattern of PUBLISH_CREDENTIAL_GITIGNORE_PATTERNS) {
+        if (!existing.has(pattern)) {
+            toAdd.push(pattern);
+            existing.add(pattern);
+        }
+    }
+
+    for (const extra of options.extraPaths ?? []) {
+        const absolute = path.resolve(extra);
+        const relative = path.relative(root, absolute).replace(/\\/g, '/');
+
+        if (!relative || relative.startsWith('..')) {
+            // Outside the project — skip; can't usefully gitignore it here.
+            continue;
+        }
+
+        if (!existing.has(relative)) {
+            toAdd.push(relative);
+            existing.add(relative);
+        }
+    }
+
+    if (toAdd.length === 0) {
+        return { gitignorePath, added: [], created: false, updated: false };
+    }
+
+    const needsHeader = !content.includes(GITIGNORE_SECTION_HEADER);
+    const prefix = content.length === 0 || content.endsWith('\n') ? '' : '\n';
+    const section = [
+        needsHeader ? GITIGNORE_SECTION_HEADER : null,
+        ...toAdd,
+        '',
+    ].filter((line) => line != null).join('\n');
+
+    await fsp.writeFile(gitignorePath, `${content}${prefix}${section}`);
+
+    if (!existed) {
+        log(`adaptfully: created ${gitignorePath} with publish credential ignores`);
+    } else {
+        log(`adaptfully: updated ${gitignorePath} (+${toAdd.length} credential ignore${toAdd.length === 1 ? '' : 's'})`);
+    }
+
+    return { gitignorePath, added: toAdd, created: !existed, updated: true };
+}
+
+/**
+ * Ensure deployment folder has a manifest.json with the given deployer type.
+ * Creates the file when missing; updates `type` when wrong; leaves other fields intact.
+ *
+ * @param {string} deploymentDir
+ * @param {string} type
+ * @param {(message: string) => void} [log]
+ */
+export async function ensureDeploymentManifest(deploymentDir, type, log = console.log) {
+    const manifestPath = path.join(deploymentDir, 'manifest.json');
+    /** @type {Record<string, unknown>} */
+    let manifest = {};
+
+    try {
+        manifest = JSON.parse(await fsp.readFile(manifestPath, 'utf8'));
+    } catch {
+        // create below
+    }
+
+    if (manifest.type === type) {
+        return { manifestPath, created: false, updated: false };
+    }
+
+    const previous = manifest.type;
+    manifest.type = type;
+    await fsp.mkdir(deploymentDir, { recursive: true });
+    await fsp.writeFile(manifestPath, `${JSON.stringify(manifest, null, 4)}\n`);
+
+    if (previous == null) {
+        log(`adaptfully: wrote ${manifestPath} with type "${type}"`);
+        return { manifestPath, created: true, updated: false };
+    }
+
+    log(`adaptfully: updated ${manifestPath} type "${previous}" → "${type}"`);
+    return { manifestPath, created: false, updated: true };
+}
+
+/**
+ * @param {string} prompt
+ * @param {string} [existing]
+ * @returns {Promise<string>}
+ */
+export async function promptRequired(prompt, existing) {
+    if (existing != null && String(existing).trim() !== '') {
+        return String(existing).trim();
+    }
+
+    const rl = readline.createInterface({ input, output });
+
+    try {
+        const value = String(await rl.question(prompt)).trim();
+        if (!value) {
+            throw new Error(`${prompt.replace(/:\s*$/, '')} is required.`);
+        }
+        return value;
+    } finally {
+        rl.close();
+    }
+}
+
+/**
+ * Parse shared CLI flags used by publish credential helpers.
+ * @param {string[]} argv
+ * @param {number} [startIndex=3]
+ */
+export function parsePublishCredentialArgv(argv, startIndex = 3) {
+    /** @type {Record<string, string>} */
+    const options = {
+        projectRoot: '.',
+    };
+
+    for (let i = startIndex; i < argv.length; i++) {
+        const arg = argv[i];
+
+        if (arg === '--from' && argv[i + 1]) {
+            options.from = argv[++i];
+        } else if (arg === '--output' && argv[i + 1]) {
+            options.output = argv[++i];
+        } else if (arg === '--deployment' && argv[i + 1]) {
+            options.deployment = argv[++i];
+        } else if (arg === '--project-root' && argv[i + 1]) {
+            options.projectRoot = argv[++i];
+        } else if (arg === '--steamcmd-dir' && argv[i + 1]) {
+            options.steamcmdDir = argv[++i];
+        } else if (arg === '--category' && argv[i + 1]) {
+            options.category = argv[++i];
+        } else if (arg === '--identity' && argv[i + 1]) {
+            options.identity = argv[++i];
+        } else if (arg === '--username' && argv[i + 1]) {
+            options.username = argv[++i];
+        } else if (arg === '--password' && argv[i + 1]) {
+            options.password = argv[++i];
+        }
+    }
+
+    return options;
+}

package/lib/node/{steam-auth.js → steam-publish.js}

@@ -6,6 +6,12 @@ import path from 'node:path';
 import { pipeline } from 'node:stream/promises';
 import readline from 'node:readline/promises';
 import { stdin as input, stdout as output } from 'node:process';
+import {
+    defaultDeploymentCredentialPath,
+    ensureDeploymentManifest,
+    ensurePublishCredentialsGitignore,
+    parsePublishCredentialArgv,
+} from './publish-credentials.js';
 
 const STEAMCMD_INSTALL = {
     win32: {
@@ -24,9 +30,10 @@ const STEAMCMD_INSTALL = {
 
 /**
  * @param {string} [projectRoot]
+ * @param {string} [deploymentKey='steam']
  */
-export function defaultSteamPublishPath(projectRoot = '.') {
-    return path.resolve(projectRoot, 'assets', 'meta', 'deployments', 'steam', 'steam.json');
+export function defaultSteamPublishPath(projectRoot = '.', deploymentKey = 'steam') {
+    return defaultDeploymentCredentialPath(projectRoot, deploymentKey, 'steam.json');
 }
 
 /**
@@ -245,45 +252,29 @@ export function runSteamcmdLogin(cacheDir, username, password) {
 }
 
 /**
- * @param {string[]} argv
+ * @param {{
+ *   username?: string,
+ *   password?: string,
+ *   output?: string,
+ *   deployment?: string,
+ *   steamcmdDir?: string,
+ *   projectRoot?: string,
+ *   log?: (message: string) => void,
+ * }} [options]
  */
-function parseSteamAuthArgv(argv) {
-    /** @type {Record<string, string>} */
-    const options = {
-        projectRoot: '.',
-    };
-
-    for (let i = 3; i < argv.length; i++) {
-        const arg = argv[i];
-
-        if (arg === '--username' && argv[i + 1]) {
-            options.username = argv[++i];
-        } else if (arg === '--password' && argv[i + 1]) {
-            options.password = argv[++i];
-        } else if (arg === '--output' && argv[i + 1]) {
-            options.output = argv[++i];
-        } else if (arg === '--steamcmd-dir' && argv[i + 1]) {
-            options.steamcmdDir = argv[++i];
-        } else if (arg === '--project-root' && argv[i + 1]) {
-            options.projectRoot = argv[++i];
-        }
-    }
-
-    return options;
-}
-
-/**
- * @param {{ username?: string, password?: string, output?: string, steamcmdDir?: string, projectRoot?: string, log?: (message: string) => void }} [options]
- */
-export async function runSteamAuth(options = {}) {
+export async function runSteamPublish(options = {}) {
     const log = options.log ?? console.log;
+    const projectRoot = options.projectRoot ?? '.';
+    const deploymentKey = options.deployment ?? 'steam';
     const username = options.username
         ?? process.env.STEAM_USERNAME
         ?? process.env.STEAM_BUILD_USERNAME;
     const password = options.password
         ?? process.env.STEAM_PASSWORD
         ?? process.env.STEAM_BUILD_PASSWORD;
-    const outputPath = path.resolve(options.output ?? defaultSteamPublishPath(options.projectRoot ?? '.'));
+    const outputPath = path.resolve(
+        options.output ?? defaultSteamPublishPath(projectRoot, deploymentKey),
+    );
     const cacheDir = options.steamcmdDir ?? defaultSteamcmdCacheDir();
 
     let resolvedUsername = username;
@@ -324,6 +315,11 @@ export async function runSteamAuth(options = {}) {
 
     await fsp.mkdir(path.dirname(outputPath), { recursive: true });
     await fsp.writeFile(outputPath, `${JSON.stringify(steamJson, null, 4)}\n`);
+    await ensureDeploymentManifest(path.dirname(outputPath), 'steam', log);
+    await ensurePublishCredentialsGitignore(projectRoot, {
+        extraPaths: [outputPath],
+        log,
+    });
 
     log(`adaptfully: wrote ${outputPath}`);
     if (authFiles.sentryFileName) {
@@ -332,12 +328,18 @@ export async function runSteamAuth(options = {}) {
         log('adaptfully: no sentry file was created (Steam Guard may be disabled on this account)');
     }
 
-    return { outputPath, steamJson };
+    return { outputPath, steamJson, deploymentKey };
 }
 
 /**
  * @param {string[]} [argv]
  */
-export async function steamAuthFromCli(argv = process.argv) {
-    return runSteamAuth(parseSteamAuthArgv(argv));
+export async function steamPublishFromCli(argv = process.argv) {
+    return runSteamPublish(parsePublishCredentialArgv(argv));
 }
+
+/** @deprecated Use {@link runSteamPublish} */
+export const runSteamAuth = runSteamPublish;
+
+/** @deprecated Use {@link steamPublishFromCli} */
+export const steamAuthFromCli = steamPublishFromCli;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@makefully/adaptfully",
-    "version": "3.10.0",
+    "version": "3.12.0",
     "description": "Platform abstraction and Wrapfully deploy client for Makefully games",
     "type": "module",
     "main": "./lib/node/index.js",