@makefully/adaptfully 3.11.0 → 3.12.0

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to this project are documented in this file.
 
+## 3.12.0 — 2026-07-23
+
+### Added
+
+- **`adaptfully google-publish`** — import a Google Play service-account JSON into `assets/meta/deployments/android/google.json` (or `--deployment` / `--output`) and ensure `manifest.json` has `"type": "google"`.
+- **`adaptfully apple-publish`** — prompt for (or accept) App Store Connect credentials and write `assets/meta/deployments/ios/apple.json` with `"type": "apple"` on the deployment manifest.
+- **Publish helpers update `.gitignore`** — `steam-publish` / `google-publish` / `apple-publish` append standard `assets/meta/deployments/**` credential ignore patterns (and any custom `--output` under the project) so secrets are less likely to be committed.
+
+### Changed
+
+- **`adaptfully steam-publish`** replaces the credential CLI formerly named `steam-auth` (runtime plugin `steam-auth` is unchanged). `adaptfully steam-auth` still works as a deprecated alias.
+- Steam publish also ensures the deployment `manifest.json` has `"type": "steam"`.
+
 ## 3.11.0 — 2026-07-23
 
 ### Added

package/README.md

@@ -26,7 +26,9 @@ adaptfully build steam                        # prebuild + zip and send to Wrapf
 adaptfully deploy web                         # prebuild + POST to Wrapfully for each of web's deployments
 adaptfully deploy web --deployment web-prod   # deploy to a single named deployment
 adaptfully deploy steam                       # prebuild + POST to Wrapfully steam builder
-adaptfully steam-auth                         # one-time: log in with steamcmd → assets/meta/deployments/steam/steam.json
+adaptfully steam-publish                      # one-time: log in with steamcmd → assets/meta/deployments/steam/steam.json
+adaptfully google-publish --from ./sa.json    # one-time: import Play service account → deployments/android/google.json
+adaptfully apple-publish                      # one-time: write App Store Connect creds → deployments/ios/apple.json
 ```
 
 | Stage | What it does |
@@ -34,7 +36,9 @@ adaptfully steam-auth                         # one-time: log in with steamcmd
 | `prebuild` | Copy `deploy/` to `output/<platform>-prebuild/` and inject registrations into `config.htmlInjections` |
 | `build` | Prebuild, then POST the result to Wrapfully (artifact zip only) |
 | `deploy` | POST the prior build artifact from `./output/` to each configured deployment (or `--deployment`) |
-| `steam-auth` | One-time local setup: install steamcmd, interactive login, write the `steam` deployment's `steam.json` |
+| `steam-publish` | One-time local setup: install steamcmd, interactive login, write the `steam` deployment's `steam.json` (also updates `.gitignore`) |
+| `google-publish` | One-time local setup: import a Play Console service-account JSON into the `android` deployment folder (also updates `.gitignore`) |
+| `apple-publish` | One-time local setup: write App Store Connect credentials into the `ios` deployment folder (also updates `.gitignore`) |
 
 `wrapfully-deploy` is a compatibility alias for `adaptfully deploy` when invoked with a Wrapfully builder name (`steam`, `win`, `android`, etc.).
 
@@ -253,8 +257,10 @@ For web-only hosting (no Wrapfully), stop after prebuild and upload `output/web-
 Run from your project root:
 
 ```bash
-npx adaptfully <prebuild|build|deploy> <platform> [server] [mode]
-npx adaptfully steam-auth [--username U] [--password P] [--output path]
+npx adaptfully <prebuild|build|deploy|release> <platform> [server] [mode]
+npx adaptfully steam-publish [--username U] [--password P] [--deployment steam] [--output path]
+npx adaptfully google-publish [--from service-account.json] [--deployment android] [--output path]
+npx adaptfully apple-publish [--deployment ios] [--category C] [--identity I] [--username U] [--password P]
 ```
 
 | Stage | Description |
@@ -520,7 +526,14 @@ Place keystore files in `assets/meta/deployments/<deployment>/android/`. Include
 }
 ```
 
-To deploy to Google Play, also include `assets/meta/deployments/<deployment>/google.json`:
+To deploy to Google Play, also include `assets/meta/deployments/<deployment>/google.json`. The easiest path is:
+
+```bash
+npx adaptfully google-publish --from ./path/to/play-service-account.json
+# defaults to assets/meta/deployments/android/google.json (+ manifest type "google")
+```
+
+The file looks like:
 
 ```json
 {
@@ -562,7 +575,14 @@ Include `assets/meta/deployments/<deployment>/build.json` with iOS signing setti
 }
 ```
 
-To deploy to the App Store, include `assets/meta/deployments/<deployment>/apple.json`:
+To deploy to the App Store, include `assets/meta/deployments/<deployment>/apple.json`. The easiest path is:
+
+```bash
+npx adaptfully apple-publish
+# defaults to assets/meta/deployments/ios/apple.json (+ manifest type "apple")
+```
+
+The file looks like:
 
 ```json
 {
@@ -581,7 +601,7 @@ Set `packager: "cordova"` on an `android` or `ios` platform to use Cordova inste
 
 `steam-dev` builds debug Electron binaries for Windows, Mac, and Linux without uploading to Steam. No `steam.json` credentials are required.
 
-For release uploads, run **`adaptfully steam-auth`** once on your machine. It installs steamcmd if needed, logs you in interactively (enter a Steam Guard code if prompted), and writes `assets/meta/deployments/steam/steam.json`:
+For release uploads, run **`adaptfully steam-publish`** once on your machine. It installs steamcmd if needed, logs you in interactively (enter a Steam Guard code if prompted), and writes `assets/meta/deployments/steam/steam.json`:
 
 ```json
 {
@@ -595,7 +615,7 @@ For release uploads, run **`adaptfully steam-auth`** once on your machine. It in
 
 Accounts **without** Steam Guard only need `username`, `password`, and `configVdf`. Accounts **with** Steam Guard also include the `ssfn` sentry file so the Wrapfully server can log in without a live 2FA prompt.
 
-Re-run `adaptfully steam-auth` if Steam invalidates the token (new machine, password change, or expired guard).
+Re-run `adaptfully steam-publish` if Steam invalidates the token (new machine, password change, or expired guard).
 
 For Steamworks / `steam-auth` client builds, set `platforms.<name>.steamId`. For Steam **uploads**, set `steamId` on the deployment’s `manifest.json` (see Wrapfully). Those are independent: you can deploy without steam-auth, or use steam-auth without uploading.
 

package/lib/node/apple-publish.js

@@ -0,0 +1,156 @@
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import readline from 'node:readline/promises';
+import { stdin as input, stdout as output } from 'node:process';
+import {
+    defaultDeploymentCredentialPath,
+    ensureDeploymentManifest,
+    ensurePublishCredentialsGitignore,
+    parsePublishCredentialArgv,
+} from './publish-credentials.js';
+
+/**
+ * @param {string} [projectRoot]
+ * @param {string} [deploymentKey='ios']
+ */
+export function defaultApplePublishPath(projectRoot = '.', deploymentKey = 'ios') {
+    return defaultDeploymentCredentialPath(projectRoot, deploymentKey, 'apple.json');
+}
+
+/**
+ * @param {{ category: string, identity: string, username: string, password: string }} auth
+ */
+export function buildApplePublishJson(auth) {
+    return {
+        category: String(auth.category).trim(),
+        identity: String(auth.identity).trim(),
+        username: String(auth.username).trim(),
+        password: String(auth.password),
+    };
+}
+
+/**
+ * @param {unknown} raw
+ * @returns {{ category: string, identity: string, username: string, password: string }}
+ */
+export function validateApplePublishJson(raw) {
+    if (raw == null || typeof raw !== 'object' || Array.isArray(raw)) {
+        throw new Error('Apple credentials must be a JSON object.');
+    }
+
+    const json = /** @type {Record<string, unknown>} */ (raw);
+    const required = ['category', 'identity', 'username', 'password'];
+    const missing = required.filter((key) => {
+        const value = json[key];
+        return value == null || String(value).trim() === '';
+    });
+
+    if (missing.length) {
+        throw new Error(`Apple credentials JSON is missing required field(s): ${missing.join(', ')}.`);
+    }
+
+    return buildApplePublishJson({
+        category: /** @type {string} */ (json.category),
+        identity: /** @type {string} */ (json.identity),
+        username: /** @type {string} */ (json.username),
+        password: /** @type {string} */ (json.password),
+    });
+}
+
+/**
+ * @param {{
+ *   category?: string,
+ *   identity?: string,
+ *   username?: string,
+ *   password?: string,
+ *   from?: string,
+ *   output?: string,
+ *   deployment?: string,
+ *   projectRoot?: string,
+ *   log?: (message: string) => void,
+ * }} [options]
+ */
+export async function runApplePublish(options = {}) {
+    const log = options.log ?? console.log;
+    const projectRoot = options.projectRoot ?? '.';
+    const deploymentKey = options.deployment ?? 'ios';
+    const outputPath = path.resolve(
+        options.output ?? defaultApplePublishPath(projectRoot, deploymentKey),
+    );
+
+    /** @type {{ category: string, identity: string, username: string, password: string }} */
+    let appleJson;
+
+    if (options.from) {
+        const fromPath = path.resolve(options.from);
+        let raw;
+
+        try {
+            raw = JSON.parse(await fsp.readFile(fromPath, 'utf8'));
+        } catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            throw new Error(`Unable to read Apple credentials JSON at "${fromPath}": ${message}`);
+        }
+
+        appleJson = validateApplePublishJson(raw);
+    } else {
+        let category = options.category ?? process.env.APPLE_CATEGORY;
+        let identity = options.identity ?? process.env.APPLE_IDENTITY;
+        let username = options.username
+            ?? process.env.APPLE_ID
+            ?? process.env.APPLE_USERNAME;
+        let password = options.password
+            ?? process.env.APPLE_APP_SPECIFIC_PASSWORD
+            ?? process.env.APPLE_PASSWORD;
+
+        if (!category || !identity || !username || !password) {
+            const rl = readline.createInterface({ input, output });
+
+            try {
+                if (!category) {
+                    category = String(await rl.question('App Store category: ')).trim();
+                }
+                if (!identity) {
+                    identity = String(await rl.question('Apple team identity (e.g. TEAMID): ')).trim();
+                }
+                if (!username) {
+                    username = String(await rl.question('Apple ID username: ')).trim();
+                }
+                if (!password) {
+                    password = String(
+                        await rl.question('Apple app-specific password: '),
+                    );
+                }
+            } finally {
+                rl.close();
+            }
+        }
+
+        appleJson = validateApplePublishJson({
+            category,
+            identity,
+            username,
+            password,
+        });
+    }
+
+    await fsp.mkdir(path.dirname(outputPath), { recursive: true });
+    await fsp.writeFile(outputPath, `${JSON.stringify(appleJson, null, 4)}\n`);
+    await ensureDeploymentManifest(path.dirname(outputPath), 'apple', log);
+    await ensurePublishCredentialsGitignore(projectRoot, {
+        extraPaths: [outputPath],
+        log,
+    });
+
+    log(`adaptfully: wrote ${outputPath}`);
+    log(`adaptfully: Apple ID ${appleJson.username} (identity ${appleJson.identity})`);
+
+    return { outputPath, appleJson, deploymentKey };
+}
+
+/**
+ * @param {string[]} [argv]
+ */
+export async function applePublishFromCli(argv = process.argv) {
+    return runApplePublish(parsePublishCredentialArgv(argv));
+}

package/lib/node/google-publish.js

@@ -0,0 +1,112 @@
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import {
+    defaultDeploymentCredentialPath,
+    ensureDeploymentManifest,
+    ensurePublishCredentialsGitignore,
+    parsePublishCredentialArgv,
+    promptRequired,
+} from './publish-credentials.js';
+
+const GOOGLE_REQUIRED_FIELDS = [
+    'type',
+    'project_id',
+    'private_key',
+    'client_email',
+];
+
+/**
+ * @param {string} [projectRoot]
+ * @param {string} [deploymentKey='android']
+ */
+export function defaultGooglePublishPath(projectRoot = '.', deploymentKey = 'android') {
+    return defaultDeploymentCredentialPath(projectRoot, deploymentKey, 'google.json');
+}
+
+/**
+ * @param {unknown} raw
+ * @returns {Record<string, unknown>}
+ */
+export function validateGoogleServiceAccount(raw) {
+    if (raw == null || typeof raw !== 'object' || Array.isArray(raw)) {
+        throw new Error('Google Play credentials must be a JSON object (service account key).');
+    }
+
+    /** @type {Record<string, unknown>} */
+    const json = { .../** @type {Record<string, unknown>} */ (raw) };
+
+    if (json.type != null && json.type !== 'service_account') {
+        throw new Error(
+            `Google service account JSON type must be "service_account" (got ${JSON.stringify(json.type)}).`,
+        );
+    }
+
+    const missing = GOOGLE_REQUIRED_FIELDS.filter((key) => {
+        const value = json[key];
+        return value == null || String(value).trim() === '';
+    });
+
+    if (missing.length) {
+        throw new Error(
+            `Google service account JSON is missing required field(s): ${missing.join(', ')}.`,
+        );
+    }
+
+    return json;
+}
+
+/**
+ * @param {{
+ *   from?: string,
+ *   output?: string,
+ *   deployment?: string,
+ *   projectRoot?: string,
+ *   log?: (message: string) => void,
+ * }} [options]
+ */
+export async function runGooglePublish(options = {}) {
+    const log = options.log ?? console.log;
+    const projectRoot = options.projectRoot ?? '.';
+    const deploymentKey = options.deployment ?? 'android';
+    const outputPath = path.resolve(
+        options.output ?? defaultGooglePublishPath(projectRoot, deploymentKey),
+    );
+
+    const fromPath = path.resolve(
+        await promptRequired(
+            'Path to Google Play service account JSON: ',
+            options.from ?? process.env.GOOGLE_APPLICATION_CREDENTIALS,
+        ),
+    );
+
+    let raw;
+
+    try {
+        raw = JSON.parse(await fsp.readFile(fromPath, 'utf8'));
+    } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Unable to read Google service account JSON at "${fromPath}": ${message}`);
+    }
+
+    const googleJson = validateGoogleServiceAccount(raw);
+
+    await fsp.mkdir(path.dirname(outputPath), { recursive: true });
+    await fsp.writeFile(outputPath, `${JSON.stringify(googleJson, null, 4)}\n`);
+    await ensureDeploymentManifest(path.dirname(outputPath), 'google', log);
+    await ensurePublishCredentialsGitignore(projectRoot, {
+        extraPaths: [outputPath],
+        log,
+    });
+
+    log(`adaptfully: wrote ${outputPath}`);
+    log(`adaptfully: imported service account ${googleJson.client_email}`);
+
+    return { outputPath, googleJson, deploymentKey };
+}
+
+/**
+ * @param {string[]} [argv]
+ */
+export async function googlePublishFromCli(argv = process.argv) {
+    return runGooglePublish(parsePublishCredentialArgv(argv));
+}

package/lib/node/index.js

@@ -50,12 +50,35 @@ export {
     resolveRegistrationAssets,
 } from './registrations.js';
 export { printBuildReport } from './report.js';
+export {
+    defaultDeploymentCredentialPath,
+    ensureDeploymentManifest,
+    ensurePublishCredentialsGitignore,
+    parsePublishCredentialArgv,
+    promptRequired,
+    PUBLISH_CREDENTIAL_GITIGNORE_PATTERNS,
+} from './publish-credentials.js';
 export {
     buildSteamPublishJson,
     collectSteamAuthFiles,
     defaultSteamPublishPath,
     defaultSteamcmdCacheDir,
     ensureSteamcmd,
+    runSteamPublish,
+    steamPublishFromCli,
     runSteamAuth,
     steamAuthFromCli,
-} from './steam-auth.js';
+} from './steam-publish.js';
+export {
+    defaultGooglePublishPath,
+    googlePublishFromCli,
+    runGooglePublish,
+    validateGoogleServiceAccount,
+} from './google-publish.js';
+export {
+    applePublishFromCli,
+    buildApplePublishJson,
+    defaultApplePublishPath,
+    runApplePublish,
+    validateApplePublishJson,
+} from './apple-publish.js';

package/lib/node/pipeline.js

@@ -8,11 +8,18 @@ import {
     resolveDeploymentsForPlatform,
     resolvePublishDir,
 } from './registrations.js';
-import { steamAuthFromCli } from './steam-auth.js';
+import { steamPublishFromCli } from './steam-publish.js';
+import { googlePublishFromCli } from './google-publish.js';
+import { applePublishFromCli } from './apple-publish.js';
 
 /** @typedef {'prebuild' | 'build' | 'deploy' | 'release'} AdaptfullyStage */
 
 const VALID_STAGES = new Set(['prebuild', 'build', 'deploy', 'release']);
+const PUBLISH_COMMANDS = {
+    'steam-publish': steamPublishFromCli,
+    'google-publish': googlePublishFromCli,
+    'apple-publish': applePublishFromCli,
+};
 
 /**
  * Wrapfully URL path segment for build/release.
@@ -161,7 +168,12 @@ export async function adaptfullyFromCli(argv = process.argv) {
     const command = argv[2];
 
     if (command === 'steam-auth') {
-        return steamAuthFromCli(argv);
+        console.warn('adaptfully: "steam-auth" CLI is deprecated; use "steam-publish" instead.');
+        return steamPublishFromCli(argv);
+    }
+
+    if (PUBLISH_COMMANDS[command]) {
+        return PUBLISH_COMMANDS[command](argv);
     }
 
     const stage = command;
@@ -174,7 +186,9 @@ export async function adaptfullyFromCli(argv = process.argv) {
         throw new Error(
             'Usage:\n'
             + '  adaptfully <prebuild|build|deploy|release> <platform> [server] [mode] [--deployment <key>] [--artifact <path>]\n'
-            + '  adaptfully steam-auth [--username U] [--password P] [--output path]\n'
+            + '  adaptfully steam-publish [--username U] [--password P] [--deployment steam] [--output path]\n'
+            + '  adaptfully google-publish [--from service-account.json] [--deployment android] [--output path]\n'
+            + '  adaptfully apple-publish [--deployment ios] [--category C] [--identity I] [--username U] [--password P]\n'
             + '\n'
             + 'Stages:\n'
             + '  prebuild  Copy deploy/ and apply platform registrations → output/<platform>-prebuild/\n'
@@ -185,7 +199,10 @@ export async function adaptfullyFromCli(argv = process.argv) {
             + '  --deployment <key>  Target a single named deployment.\n'
             + '  --artifact <path>   Prior build artifact directory (deploy only; default: ./output/ after build).\n'
             + '\n'
-            + '  steam-auth  Install steamcmd if needed, log in interactively, write steam deployment steam.json',
+            + 'Publish credential helpers (one-time local setup):\n'
+            + '  steam-publish   Install steamcmd if needed, log in, write steam deployment steam.json\n'
+            + '  google-publish  Import a Play service-account JSON into the android deployment folder\n'
+            + '  apple-publish   Write App Store Connect credentials into the ios deployment folder',
         );
     }
 

package/lib/node/publish-credentials.js

@@ -0,0 +1,220 @@
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import readline from 'node:readline/promises';
+import { stdin as input, stdout as output } from 'node:process';
+
+/** Patterns that should never be committed from deployment credential folders. */
+export const PUBLISH_CREDENTIAL_GITIGNORE_PATTERNS = [
+    'assets/meta/deployments/**/sftp.json',
+    'assets/meta/deployments/**/steam.json',
+    'assets/meta/deployments/**/build.json',
+    'assets/meta/deployments/**/google.json',
+    'assets/meta/deployments/**/apple.json',
+    'assets/meta/deployments/**/ms.json',
+    'assets/meta/deployments/**/android/',
+    'assets/meta/deployments/**/ms/',
+];
+
+const GITIGNORE_SECTION_HEADER = '# Adaptfully publish credentials — do not commit';
+
+/**
+ * @param {string} [projectRoot]
+ * @param {string} deploymentKey
+ * @param {string} filename
+ */
+export function defaultDeploymentCredentialPath(projectRoot = '.', deploymentKey, filename) {
+    return path.resolve(
+        projectRoot,
+        'assets',
+        'meta',
+        'deployments',
+        deploymentKey,
+        filename,
+    );
+}
+
+/**
+ * @param {string} content
+ * @returns {Set<string>}
+ */
+function gitignoreLineSet(content) {
+    return new Set(
+        content
+            .split(/\r?\n/)
+            .map((line) => line.trim())
+            .filter((line) => line && !line.startsWith('#')),
+    );
+}
+
+/**
+ * Ensure project `.gitignore` ignores Adaptfully deployment credential files.
+ * Idempotent: only appends missing patterns. Optionally also ignores a specific
+ * credential file path (e.g. custom `--output`).
+ *
+ * @param {string} [projectRoot='.']
+ * @param {{
+ *   extraPaths?: string[],
+ *   log?: (message: string) => void,
+ * }} [options]
+ */
+export async function ensurePublishCredentialsGitignore(projectRoot = '.', options = {}) {
+    const log = options.log ?? console.log;
+    const root = path.resolve(projectRoot);
+    const gitignorePath = path.join(root, '.gitignore');
+
+    let content = '';
+    let existed = true;
+
+    try {
+        content = await fsp.readFile(gitignorePath, 'utf8');
+    } catch {
+        existed = false;
+        content = '';
+    }
+
+    const existing = gitignoreLineSet(content);
+    /** @type {string[]} */
+    const toAdd = [];
+
+    for (const pattern of PUBLISH_CREDENTIAL_GITIGNORE_PATTERNS) {
+        if (!existing.has(pattern)) {
+            toAdd.push(pattern);
+            existing.add(pattern);
+        }
+    }
+
+    for (const extra of options.extraPaths ?? []) {
+        const absolute = path.resolve(extra);
+        const relative = path.relative(root, absolute).replace(/\\/g, '/');
+
+        if (!relative || relative.startsWith('..')) {
+            // Outside the project — skip; can't usefully gitignore it here.
+            continue;
+        }
+
+        if (!existing.has(relative)) {
+            toAdd.push(relative);
+            existing.add(relative);
+        }
+    }
+
+    if (toAdd.length === 0) {
+        return { gitignorePath, added: [], created: false, updated: false };
+    }
+
+    const needsHeader = !content.includes(GITIGNORE_SECTION_HEADER);
+    const prefix = content.length === 0 || content.endsWith('\n') ? '' : '\n';
+    const section = [
+        needsHeader ? GITIGNORE_SECTION_HEADER : null,
+        ...toAdd,
+        '',
+    ].filter((line) => line != null).join('\n');
+
+    await fsp.writeFile(gitignorePath, `${content}${prefix}${section}`);
+
+    if (!existed) {
+        log(`adaptfully: created ${gitignorePath} with publish credential ignores`);
+    } else {
+        log(`adaptfully: updated ${gitignorePath} (+${toAdd.length} credential ignore${toAdd.length === 1 ? '' : 's'})`);
+    }
+
+    return { gitignorePath, added: toAdd, created: !existed, updated: true };
+}
+
+/**
+ * Ensure deployment folder has a manifest.json with the given deployer type.
+ * Creates the file when missing; updates `type` when wrong; leaves other fields intact.
+ *
+ * @param {string} deploymentDir
+ * @param {string} type
+ * @param {(message: string) => void} [log]
+ */
+export async function ensureDeploymentManifest(deploymentDir, type, log = console.log) {
+    const manifestPath = path.join(deploymentDir, 'manifest.json');
+    /** @type {Record<string, unknown>} */
+    let manifest = {};
+
+    try {
+        manifest = JSON.parse(await fsp.readFile(manifestPath, 'utf8'));
+    } catch {
+        // create below
+    }
+
+    if (manifest.type === type) {
+        return { manifestPath, created: false, updated: false };
+    }
+
+    const previous = manifest.type;
+    manifest.type = type;
+    await fsp.mkdir(deploymentDir, { recursive: true });
+    await fsp.writeFile(manifestPath, `${JSON.stringify(manifest, null, 4)}\n`);
+
+    if (previous == null) {
+        log(`adaptfully: wrote ${manifestPath} with type "${type}"`);
+        return { manifestPath, created: true, updated: false };
+    }
+
+    log(`adaptfully: updated ${manifestPath} type "${previous}" → "${type}"`);
+    return { manifestPath, created: false, updated: true };
+}
+
+/**
+ * @param {string} prompt
+ * @param {string} [existing]
+ * @returns {Promise<string>}
+ */
+export async function promptRequired(prompt, existing) {
+    if (existing != null && String(existing).trim() !== '') {
+        return String(existing).trim();
+    }
+
+    const rl = readline.createInterface({ input, output });
+
+    try {
+        const value = String(await rl.question(prompt)).trim();
+        if (!value) {
+            throw new Error(`${prompt.replace(/:\s*$/, '')} is required.`);
+        }
+        return value;
+    } finally {
+        rl.close();
+    }
+}
+
+/**
+ * Parse shared CLI flags used by publish credential helpers.
+ * @param {string[]} argv
+ * @param {number} [startIndex=3]
+ */
+export function parsePublishCredentialArgv(argv, startIndex = 3) {
+    /** @type {Record<string, string>} */
+    const options = {
+        projectRoot: '.',
+    };
+
+    for (let i = startIndex; i < argv.length; i++) {
+        const arg = argv[i];
+
+        if (arg === '--from' && argv[i + 1]) {
+            options.from = argv[++i];
+        } else if (arg === '--output' && argv[i + 1]) {
+            options.output = argv[++i];
+        } else if (arg === '--deployment' && argv[i + 1]) {
+            options.deployment = argv[++i];
+        } else if (arg === '--project-root' && argv[i + 1]) {
+            options.projectRoot = argv[++i];
+        } else if (arg === '--steamcmd-dir' && argv[i + 1]) {
+            options.steamcmdDir = argv[++i];
+        } else if (arg === '--category' && argv[i + 1]) {
+            options.category = argv[++i];
+        } else if (arg === '--identity' && argv[i + 1]) {
+            options.identity = argv[++i];
+        } else if (arg === '--username' && argv[i + 1]) {
+            options.username = argv[++i];
+        } else if (arg === '--password' && argv[i + 1]) {
+            options.password = argv[++i];
+        }
+    }
+
+    return options;
+}

package/lib/node/{steam-auth.js → steam-publish.js}

@@ -6,6 +6,12 @@ import path from 'node:path';
 import { pipeline } from 'node:stream/promises';
 import readline from 'node:readline/promises';
 import { stdin as input, stdout as output } from 'node:process';
+import {
+    defaultDeploymentCredentialPath,
+    ensureDeploymentManifest,
+    ensurePublishCredentialsGitignore,
+    parsePublishCredentialArgv,
+} from './publish-credentials.js';
 
 const STEAMCMD_INSTALL = {
     win32: {
@@ -24,9 +30,10 @@ const STEAMCMD_INSTALL = {
 
 /**
  * @param {string} [projectRoot]
+ * @param {string} [deploymentKey='steam']
  */
-export function defaultSteamPublishPath(projectRoot = '.') {
-    return path.resolve(projectRoot, 'assets', 'meta', 'deployments', 'steam', 'steam.json');
+export function defaultSteamPublishPath(projectRoot = '.', deploymentKey = 'steam') {
+    return defaultDeploymentCredentialPath(projectRoot, deploymentKey, 'steam.json');
 }
 
 /**
@@ -245,45 +252,29 @@ export function runSteamcmdLogin(cacheDir, username, password) {
 }
 
 /**
- * @param {string[]} argv
+ * @param {{
+ *   username?: string,
+ *   password?: string,
+ *   output?: string,
+ *   deployment?: string,
+ *   steamcmdDir?: string,
+ *   projectRoot?: string,
+ *   log?: (message: string) => void,
+ * }} [options]
  */
-function parseSteamAuthArgv(argv) {
-    /** @type {Record<string, string>} */
-    const options = {
-        projectRoot: '.',
-    };
-
-    for (let i = 3; i < argv.length; i++) {
-        const arg = argv[i];
-
-        if (arg === '--username' && argv[i + 1]) {
-            options.username = argv[++i];
-        } else if (arg === '--password' && argv[i + 1]) {
-            options.password = argv[++i];
-        } else if (arg === '--output' && argv[i + 1]) {
-            options.output = argv[++i];
-        } else if (arg === '--steamcmd-dir' && argv[i + 1]) {
-            options.steamcmdDir = argv[++i];
-        } else if (arg === '--project-root' && argv[i + 1]) {
-            options.projectRoot = argv[++i];
-        }
-    }
-
-    return options;
-}
-
-/**
- * @param {{ username?: string, password?: string, output?: string, steamcmdDir?: string, projectRoot?: string, log?: (message: string) => void }} [options]
- */
-export async function runSteamAuth(options = {}) {
+export async function runSteamPublish(options = {}) {
     const log = options.log ?? console.log;
+    const projectRoot = options.projectRoot ?? '.';
+    const deploymentKey = options.deployment ?? 'steam';
     const username = options.username
         ?? process.env.STEAM_USERNAME
         ?? process.env.STEAM_BUILD_USERNAME;
     const password = options.password
         ?? process.env.STEAM_PASSWORD
         ?? process.env.STEAM_BUILD_PASSWORD;
-    const outputPath = path.resolve(options.output ?? defaultSteamPublishPath(options.projectRoot ?? '.'));
+    const outputPath = path.resolve(
+        options.output ?? defaultSteamPublishPath(projectRoot, deploymentKey),
+    );
     const cacheDir = options.steamcmdDir ?? defaultSteamcmdCacheDir();
 
     let resolvedUsername = username;
@@ -324,6 +315,11 @@ export async function runSteamAuth(options = {}) {
 
     await fsp.mkdir(path.dirname(outputPath), { recursive: true });
     await fsp.writeFile(outputPath, `${JSON.stringify(steamJson, null, 4)}\n`);
+    await ensureDeploymentManifest(path.dirname(outputPath), 'steam', log);
+    await ensurePublishCredentialsGitignore(projectRoot, {
+        extraPaths: [outputPath],
+        log,
+    });
 
     log(`adaptfully: wrote ${outputPath}`);
     if (authFiles.sentryFileName) {
@@ -332,12 +328,18 @@ export async function runSteamAuth(options = {}) {
         log('adaptfully: no sentry file was created (Steam Guard may be disabled on this account)');
     }
 
-    return { outputPath, steamJson };
+    return { outputPath, steamJson, deploymentKey };
 }
 
 /**
  * @param {string[]} [argv]
  */
-export async function steamAuthFromCli(argv = process.argv) {
-    return runSteamAuth(parseSteamAuthArgv(argv));
+export async function steamPublishFromCli(argv = process.argv) {
+    return runSteamPublish(parsePublishCredentialArgv(argv));
 }
+
+/** @deprecated Use {@link runSteamPublish} */
+export const runSteamAuth = runSteamPublish;
+
+/** @deprecated Use {@link steamPublishFromCli} */
+export const steamAuthFromCli = steamPublishFromCli;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@makefully/adaptfully",
-    "version": "3.11.0",
+    "version": "3.12.0",
     "description": "Platform abstraction and Wrapfully deploy client for Makefully games",
     "type": "module",
     "main": "./lib/node/index.js",