npm - @makefully/adaptfully - Versions diffs - 3.15.0 → 3.16.0 - Mend

@makefully/adaptfully 3.15.0 → 3.16.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/CHANGELOG.md +18 -0
package/README.md +23 -26
package/lib/node/packagers/base.js +93 -23
package/lib/node/packagers/capacitor.js +29 -5
package/lib/node/packagers/index.js +6 -1
package/lib/node/publish-credentials.js +1 -0
package/lib/runtime/auth/social-auth.js +3 -1
package/package.json +1 -1

package/CHANGELOG.md CHANGED Viewed

@@ -2,6 +2,24 @@
 All notable changes to this project are documented in this file.
+## 3.16.0 — 2026-09-02
+### Added
+- **Apple-only iOS `social-auth`** — `providers.google: false` + `providers.apple: true` no longer requires `google.webClientId`. On iOS, missing `apple.clientId` defaults to the platform `packageName`; runtime also falls back to `window.gameConfig.packageName`.
+- **Publish gitignore** — ignore `assets/meta/deployments/**/apple/` (`.p12` / `.mobileprovision`).
+### Docs
+- Registrations are owned by prebuild HTML markers (do not double-inline at compile time).
+- Capacitor iOS signing is file-based under `apple/` (not Cordova-era `build.json` ios fields).
+## 3.15.1 — 2026-09-01
+### Fixed
+- **Capacitor/Cordova HTML injection** — packager `<meta>` tags (CSP, viewport) are injected into `<head>`; script tags stay in the body `<!-- adaptfully -->` slot. Fixes browsers ignoring CSP delivered outside `<head>`.
 ## 3.15.0 — 2026-08-24
 ### Added

package/README.md CHANGED Viewed

@@ -63,7 +63,7 @@ A **platform** (`config.platforms.<key>`) describes *how* to build — registrat
 > **Back-compat:** projects with no `assets/meta/deployments/` directory keep the legacy behavior — the entire `assets/meta/` tree (including `assets/meta/publish/`) is shipped as `meta/`, and a single set of credentials is read from `meta/publish/`.
-Place `<!-- adaptfully -->` / `<!-- /adaptfully -->` markers in your HTML templates where registrations should be injected (typically between split bundle scripts, before `account.js` runs).
+Place `<!-- adaptfully -->` / `<!-- /adaptfully -->` markers in your HTML templates where registrations should be injected (typically between split bundle scripts, before `account.js` runs). **Do not also inline Adaptfully auth scripts at game compile time** — prebuild/release owns the marker block for each platform.
 ```javascript
 // Injected into deploy/index.html for the target platform (before game code):
@@ -224,7 +224,11 @@ The renderer `steam-auth` plugin reads the Steam ID from that bridge. When Steam
 When `social-auth` is registered on a **`capacitor`** platform, Adaptfully prebuild writes **`social-login-config.js`** (`window.__ADAPTFULLY_SOCIAL_LOGIN__`) from `platforms.<name>.socialLogin`. Wrapfully installs [`@capgo/capacitor-social-login`](https://github.com/Cap-go/capacitor-social-login) and syncs it into the native project (same role as `steamworks.js` for Electron).
-The runtime plugin calls Capgo `SocialLogin.initialize` / `login` / `logout` / `isLoggedIn`. Default provider is `google` on Android and `apple` on iOS when both are enabled (override with `socialLogin.defaultProvider`). Optional config keys:
+The runtime plugin calls Capgo `SocialLogin.initialize` / `login` / `logout` / `isLoggedIn`. Default provider is `google` on Android and `apple` on iOS when both are enabled (override with `socialLogin.defaultProvider`).
+**Apple-only iOS** (`providers.google: false`, `providers.apple: true`) is supported — Google `webClientId` is not required. On iOS, if `apple.clientId` is omitted, Adaptfully defaults it to the platform `packageName` (Capgo uses this as a plugin label on native iOS, not an Apple Services ID). On Android, Apple Sign-In still requires `apple.clientId`. At runtime, an empty Apple `clientId` also falls back to `window.gameConfig.packageName`.
+Optional config keys:
 | Key | Default | Purpose |
 |-----|---------|---------|
@@ -604,29 +608,21 @@ The file looks like:
 #### Apple (`ios`, `ios-dev`, `ios-sim`, `mac`)
-Include `assets/meta/deployments/<deployment>/build.json` with iOS signing settings:
+**Capacitor iOS** signing is file-based under the deployment folder (not the Cordova-style `build.json` `ios.*` identity fields):
-```json
-{
-  "ios": {
-    "debug": {
-      "codeSignIdentity": "iPhone Development",
-      "provisioningProfile": "(your development provisioning profile id)",
-      "developmentTeam": "(your team id)",
-      "packageType": "development",
-      "automaticProvisioning": false
-    },
-    "release": {
-      "codeSignIdentity": "iPhone Distribution",
-      "provisioningProfile": "(your distribution provisioning profile id)",
-      "developmentTeam": "(your team id)",
-      "packageType": "app-store",
-      "automaticProvisioning": false
-    }
-  }
-}
+```
+assets/meta/deployments/<deployment>/
+  apple.json
+  apple/distribution.p12              # release
+  apple/app-store.mobileprovision     # release
+  apple/development.p12               # ios-dev device
+  apple/development.mobileprovision   # ios-dev device
 ```
+The `.p12` passphrase must match `MAC_KEYCHAIN_PASSWORD` on the Mac Wrapfully host. Team ID and profile UUID are read from the `.mobileprovision`. Enable **Sign in with Apple** on the App ID when using Capgo Apple auth.
+Optional `build.json` may still be present for tooling compatibility; Capacitor does not require its `ios.*` code-sign fields.
 To deploy to the App Store, include `assets/meta/deployments/<deployment>/apple.json`. The easiest path is:
 ```bash
@@ -638,13 +634,14 @@ The file looks like:
 ```json
 {
-  "category": "(your app's category)",
-  "identity": "(your team identity)",
-  "username": "(your username)",
-  "password": "(your password)"
+  "category": "public.app-category.games",
+  "identity": "(your team id)",
+  "username": "(Apple ID email)",
+  "password": "(app-specific password)"
 }
 ```
+iOS IPA upload uses `username` + `password` via `xcrun altool --upload-app`. `category` / `identity` matter more for macOS Electron signing/notarization.
 #### Cordova
 Set `packager: "cordova"` on an `android` or `ios` platform to use Cordova instead of Capacitor. Requires the Android and Apple package requirements above.

package/lib/node/packagers/base.js CHANGED Viewed

@@ -11,6 +11,8 @@ export const VALID_PACKAGERS = ['web', 'electron', 'cordova', 'capacitor'];
 const PACKAGER_MARKER = '<!-- adaptfully-packager -->';
 const PACKAGER_END_MARKER = '<!-- /adaptfully-packager -->';
+const HEAD_PACKAGER_MARKER = '<!-- adaptfully-packager-head -->';
+const HEAD_PACKAGER_END_MARKER = '<!-- /adaptfully-packager-head -->';
 /**
  * @typedef {Object} PackagerOptions
@@ -58,21 +60,64 @@ function writeGameConfig(dest, platformKey, pkg, log) {
 /**
  * @param {string} html
+ * @param {string} marker
+ * @param {string} endMarker
  * @param {string} injection
  */
-function injectPackagerExtras(html, injection) {
-    if (!injection) {
-        return html;
-    }
+function replaceMarkedBlock(html, marker, endMarker, injection) {
     const markerPattern = new RegExp(
-        `${escapeRegExp(PACKAGER_MARKER)}[\\s\\S]*?${escapeRegExp(PACKAGER_END_MARKER)}\\n?`,
+        `${escapeRegExp(marker)}[\\s\\S]*?${escapeRegExp(endMarker)}\\n?`,
     );
     if (markerPattern.test(html)) {
         return html.replace(markerPattern, injection);
     }
+    if (html.includes(marker)) {
+        return html.replace(marker, `${injection}${marker}`);
+    }
+    return html;
+}
+/**
+ * @param {string} html
+ * @param {string} injection
+ */
+function injectHeadPackagerExtras(html, injection) {
+    if (!injection) {
+        return html;
+    }
+    let updated = replaceMarkedBlock(html, HEAD_PACKAGER_MARKER, HEAD_PACKAGER_END_MARKER, injection);
+    if (updated === html && html.includes('</head>')) {
+        updated = html.replace('</head>', `${injection}</head>`);
+    } else if (updated === html) {
+        throw new Error(
+            'Cannot inject packager head extras: HTML needs '
+            + `${HEAD_PACKAGER_MARKER}…${HEAD_PACKAGER_END_MARKER} or </head>`,
+        );
+    }
+    return updated;
+}
+/**
+ * @param {string} html
+ * @param {string} injection
+ */
+function injectBodyPackagerExtras(html, injection) {
+    if (!injection) {
+        return html;
+    }
+    let updated = replaceMarkedBlock(html, PACKAGER_MARKER, PACKAGER_END_MARKER, injection);
+    if (updated !== html) {
+        return updated;
+    }
     if (html.includes(PACKAGER_MARKER)) {
         return html.replace(PACKAGER_MARKER, `${injection}${PACKAGER_MARKER}`);
     }
@@ -85,17 +130,36 @@ function injectPackagerExtras(html, injection) {
         return html.replace('<!-- scripts -->', `${injection}<!-- scripts -->`);
     }
-    if (html.includes('</head>')) {
-        return html.replace('</head>', `${injection}</head>`);
+    if (html.includes('</body>')) {
+        return html.replace('</body>', `${injection}</body>`);
     }
     throw new Error(
-        'Cannot inject packager extras: HTML needs '
+        'Cannot inject packager body extras: HTML needs '
         + '<!-- adaptfully-packager -->…<!-- /adaptfully-packager -->, '
-        + '<!-- adaptfully -->, <!-- scripts -->, or </head>',
+        + '<!-- adaptfully -->, <!-- scripts -->, or </body>',
     );
 }
+/**
+ * @param {string} html
+ * @param {{ head?: string, body?: string }} injection
+ */
+function injectPackagerExtras(html, injection) {
+    if (!injection?.head && !injection?.body) {
+        return html;
+    }
+    let updated = html;
+    if (injection.head) {
+        updated = injectHeadPackagerExtras(updated, injection.head);
+    }
+    if (injection.body) {
+        updated = injectBodyPackagerExtras(updated, injection.body);
+    }
+    return updated;
+}
 function escapeRegExp(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
@@ -243,22 +307,28 @@ export class Packager {
     /**
      * @param {string[]} headExtras
      * @param {string[]} bodyScripts
-     * @returns {string}
+     * @returns {{ head: string, body: string }}
      */
     formatHtmlInjection(headExtras, bodyScripts) {
-        if (headExtras.length === 0 && bodyScripts.length === 0) {
-            return '';
+        let head = '';
+        if (headExtras.length > 0) {
+            head = `${HEAD_PACKAGER_MARKER}\n`;
+            for (const extra of headExtras) {
+                head += `${extra}\n`;
+            }
+            head += `${HEAD_PACKAGER_END_MARKER}\n`;
         }
-        let block = `${PACKAGER_MARKER}\n`;
-        for (const extra of headExtras) {
-            block += `${extra}\n`;
-        }
-        for (const script of bodyScripts) {
-            block += `${script}\n`;
+        let body = '';
+        if (bodyScripts.length > 0) {
+            body = `${PACKAGER_MARKER}\n`;
+            for (const script of bodyScripts) {
+                body += `${script}\n`;
+            }
+            body += `${PACKAGER_END_MARKER}\n`;
         }
-        block += `${PACKAGER_END_MARKER}\n`;
-        return block;
+        return { head, body };
     }
     /** @param {string} dest */
@@ -268,7 +338,7 @@ export class Packager {
         }
     }
-    /** @returns {string} */
+    /** @returns {{ head: string, body: string }} */
     buildHtmlInjection() {
         const bodyScripts = [];
         if (this.needsGameConfig()) {
@@ -283,7 +353,7 @@ export class Packager {
      */
     applyHtmlExtras(dest, htmlPaths) {
         const injection = this.buildHtmlInjection();
-        if (!injection) {
+        if (!injection.head && !injection.body) {
             return;
         }

package/lib/node/packagers/capacitor.js CHANGED Viewed

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { Packager } from './base.js';
+import { resolvePlatformConfig } from '../platform-config.js';
 const CAPACITOR_CSP = '<meta http-equiv="Content-Security-Policy" content="default-src * \'self\' data: blob: \'unsafe-inline\' \'unsafe-eval\'; style-src * \'self\' \'unsafe-inline\'; script-src * \'self\' \'unsafe-inline\' \'unsafe-eval\'; connect-src *; img-src * data: blob:; media-src * data: blob:; frame-src *;" />';
@@ -17,24 +18,40 @@ export function resolvePlatformSocialLogin(platformKey, pkg) {
     return pkg.config?.platforms?.[platformKey]?.socialLogin;
 }
+/**
+ * @param {string} platformKey
+ */
+function isIosPlatformKey(platformKey) {
+    return platformKey === 'ios'
+        || platformKey === 'ios-dev'
+        || platformKey === 'ios-sim'
+        || String(platformKey).startsWith('ios');
+}
 /**
  * @param {object} socialLogin
  * @param {string} platformKey
+ * @param {{ packageName?: string }} [options]
  */
-function normalizeSocialLoginConfig(socialLogin = {}, platformKey) {
+export function normalizeSocialLoginConfig(socialLogin = {}, platformKey, options = {}) {
     const providers = socialLogin.providers ?? { google: true, apple: true };
     const googleEnabled = providers.google !== false;
     const appleEnabled = providers.apple !== false;
     let defaultProvider = socialLogin.defaultProvider;
     if (!defaultProvider) {
-        if (platformKey === 'ios' || platformKey === 'ios-dev' || platformKey === 'ios-sim') {
+        if (isIosPlatformKey(platformKey)) {
             defaultProvider = appleEnabled ? 'apple' : 'google';
         } else {
             defaultProvider = googleEnabled ? 'google' : 'apple';
         }
     }
+    const apple = { ...(socialLogin.apple ?? {}) };
+    if (appleEnabled && !apple.clientId && options.packageName && isIosPlatformKey(platformKey)) {
+        apple.clientId = options.packageName;
+    }
     return {
         providers: {
             google: googleEnabled,
@@ -43,7 +60,7 @@ function normalizeSocialLoginConfig(socialLogin = {}, platformKey) {
             twitter: providers.twitter === true,
         },
         google: socialLogin.google ?? {},
-        apple: socialLogin.apple ?? {},
+        apple,
         defaultProvider,
         platform: platformKey,
     };
@@ -52,7 +69,7 @@ function normalizeSocialLoginConfig(socialLogin = {}, platformKey) {
 /**
  * @param {object} config
  */
-function validateSocialLoginConfig(config) {
+export function validateSocialLoginConfig(config) {
     const { providers, google, apple } = config;
     if (!providers.google && !providers.apple) {
@@ -83,6 +100,10 @@ export class CapacitorPackager extends Packager {
     /** @type {string[]} */
     static defaultPlatforms = ['ios', 'android'];
+    #socialLoginPackageName() {
+        return resolvePlatformConfig(this.pkg, this.platformKey).packageName;
+    }
     validate() {
         super.validate();
@@ -98,6 +119,7 @@ export class CapacitorPackager extends Packager {
             const config = normalizeSocialLoginConfig(
                 socialLogin ?? this.pkg.config?.socialLogin,
                 this.platformKey ?? 'android',
+                { packageName: this.#socialLoginPackageName() },
             );
             validateSocialLoginConfig(config);
         }
@@ -113,7 +135,9 @@ export class CapacitorPackager extends Packager {
             const socialLogin = resolvePlatformSocialLogin(this.platformKey, this.pkg)
                 ?? this.pkg.config?.socialLogin
                 ?? {};
-            const config = normalizeSocialLoginConfig(socialLogin, this.platformKey);
+            const config = normalizeSocialLoginConfig(socialLogin, this.platformKey, {
+                packageName: this.#socialLoginPackageName(),
+            });
             const content = `window.__ADAPTFULLY_SOCIAL_LOGIN__ = ${JSON.stringify(config, null, 4)};\n`;
             fs.writeFileSync(path.join(dest, 'social-login-config.js'), content);
             this.log('adaptfully: write social-login-config.js (social-auth)');

package/lib/node/packagers/index.js CHANGED Viewed

@@ -4,7 +4,12 @@ import { ElectronPackager } from './electron.js';
 import { Packager, VALID_PACKAGERS } from './base.js';
 import { WebPackager } from './web.js';
-export { CapacitorPackager, resolvePlatformSocialLogin } from './capacitor.js';
+export {
+    CapacitorPackager,
+    normalizeSocialLoginConfig,
+    resolvePlatformSocialLogin,
+    validateSocialLoginConfig,
+} from './capacitor.js';
 export { CordovaPackager } from './cordova.js';
 export {
     ElectronPackager,

package/lib/node/publish-credentials.js CHANGED Viewed

@@ -12,6 +12,7 @@ export const PUBLISH_CREDENTIAL_GITIGNORE_PATTERNS = [
     'assets/meta/deployments/**/apple.json',
     'assets/meta/deployments/**/ms.json',
     'assets/meta/deployments/**/android/',
+    'assets/meta/deployments/**/apple/',
     'assets/meta/deployments/**/ms/',
 ];

package/lib/runtime/auth/social-auth.js CHANGED Viewed

@@ -119,7 +119,9 @@
             if (config.providers?.apple !== false) {
                 options.apple = {
-                    clientId: config.apple?.clientId || '',
+                    clientId: config.apple?.clientId
+                        || window.gameConfig?.packageName
+                        || '',
                     redirectUrl: config.apple?.redirectUrl,
                     useProperTokenExchange: config.apple?.useProperTokenExchange !== false,
                     useBroadcastChannel: config.apple?.useBroadcastChannel !== false,

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
     "name": "@makefully/adaptfully",
-    "version": "3.15.0",
+    "version": "3.16.0",
     "description": "Platform abstraction and Wrapfully deploy client for Makefully games",
     "type": "module",
     "main": "./lib/node/index.js",