@makefully/adaptfully 3.15.1 → 3.16.1

package/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 All notable changes to this project are documented in this file.
 
+## 3.16.1 — 2026-09-03
+
+### Fixed
+
+- **`adaptfully build` signing credentials** — Capacitor/Cordova zip builds now package `assets/meta/deployments/<canonical>/` (e.g. `ios-dev` → `ios`) so Wrapfully can sign device IPAs. Previously only `release` shipped deployment folders, so `ios:dev-build` arrived on the Mac without `apple/development.*`.
+
+## 3.16.0 — 2026-09-02
+
+### Added
+
+- **Apple-only iOS `social-auth`** — `providers.google: false` + `providers.apple: true` no longer requires `google.webClientId`. On iOS, missing `apple.clientId` defaults to the platform `packageName`; runtime also falls back to `window.gameConfig.packageName`.
+- **Publish gitignore** — ignore `assets/meta/deployments/**/apple/` (`.p12` / `.mobileprovision`).
+
+### Docs
+
+- Registrations are owned by prebuild HTML markers (do not double-inline at compile time).
+- Capacitor iOS signing is file-based under `apple/` (not Cordova-era `build.json` ios fields).
+
 ## 3.15.1 — 2026-09-01
 
 ### Fixed

package/README.md

@@ -63,7 +63,7 @@ A **platform** (`config.platforms.<key>`) describes *how* to build — registrat
 
 > **Back-compat:** projects with no `assets/meta/deployments/` directory keep the legacy behavior — the entire `assets/meta/` tree (including `assets/meta/publish/`) is shipped as `meta/`, and a single set of credentials is read from `meta/publish/`.
 
-Place `<!-- adaptfully -->` / `<!-- /adaptfully -->` markers in your HTML templates where registrations should be injected (typically between split bundle scripts, before `account.js` runs).
+Place `<!-- adaptfully -->` / `<!-- /adaptfully -->` markers in your HTML templates where registrations should be injected (typically between split bundle scripts, before `account.js` runs). **Do not also inline Adaptfully auth scripts at game compile time** — prebuild/release owns the marker block for each platform.
 
 ```javascript
 // Injected into deploy/index.html for the target platform (before game code):
@@ -224,7 +224,11 @@ The renderer `steam-auth` plugin reads the Steam ID from that bridge. When Steam
 
 When `social-auth` is registered on a **`capacitor`** platform, Adaptfully prebuild writes **`social-login-config.js`** (`window.__ADAPTFULLY_SOCIAL_LOGIN__`) from `platforms.<name>.socialLogin`. Wrapfully installs [`@capgo/capacitor-social-login`](https://github.com/Cap-go/capacitor-social-login) and syncs it into the native project (same role as `steamworks.js` for Electron).
 
-The runtime plugin calls Capgo `SocialLogin.initialize` / `login` / `logout` / `isLoggedIn`. Default provider is `google` on Android and `apple` on iOS when both are enabled (override with `socialLogin.defaultProvider`). Optional config keys:
+The runtime plugin calls Capgo `SocialLogin.initialize` / `login` / `logout` / `isLoggedIn`. Default provider is `google` on Android and `apple` on iOS when both are enabled (override with `socialLogin.defaultProvider`).
+
+**Apple-only iOS** (`providers.google: false`, `providers.apple: true`) is supported — Google `webClientId` is not required. On iOS, if `apple.clientId` is omitted, Adaptfully defaults it to the platform `packageName` (Capgo uses this as a plugin label on native iOS, not an Apple Services ID). On Android, Apple Sign-In still requires `apple.clientId`. At runtime, an empty Apple `clientId` also falls back to `window.gameConfig.packageName`.
+
+Optional config keys:
 
 | Key | Default | Purpose |
 |-----|---------|---------|
@@ -604,29 +608,21 @@ The file looks like:
 
 #### Apple (`ios`, `ios-dev`, `ios-sim`, `mac`)
 
-Include `assets/meta/deployments/<deployment>/build.json` with iOS signing settings:
+**Capacitor iOS** signing is file-based under the deployment folder (not the Cordova-style `build.json` `ios.*` identity fields):
 
-```json
-{
-  "ios": {
-    "debug": {
-      "codeSignIdentity": "iPhone Development",
-      "provisioningProfile": "(your development provisioning profile id)",
-      "developmentTeam": "(your team id)",
-      "packageType": "development",
-      "automaticProvisioning": false
-    },
-    "release": {
-      "codeSignIdentity": "iPhone Distribution",
-      "provisioningProfile": "(your distribution provisioning profile id)",
-      "developmentTeam": "(your team id)",
-      "packageType": "app-store",
-      "automaticProvisioning": false
-    }
-  }
-}
+```
+assets/meta/deployments/<deployment>/
+  apple.json
+  apple/distribution.p12              # release
+  apple/app-store.mobileprovision     # release
+  apple/development.p12               # ios-dev device
+  apple/development.mobileprovision   # ios-dev device
 ```
 
+`adaptfully build` (zip-only) still packages this deployment folder for Capacitor/Cordova so device debug builds can sign. The `.p12` passphrase must match `MAC_KEYCHAIN_PASSWORD` on the Mac Wrapfully host. Team ID and profile UUID are read from the `.mobileprovision`. Enable **Sign in with Apple** on the App ID when using Capgo Apple auth.
+
+Optional `build.json` may still be present for tooling compatibility; Capacitor does not require its `ios.*` code-sign fields.
+
 To deploy to the App Store, include `assets/meta/deployments/<deployment>/apple.json`. The easiest path is:
 
 ```bash
@@ -638,13 +634,14 @@ The file looks like:
 
 ```json
 {
-  "category": "(your app's category)",
-  "identity": "(your team identity)",
-  "username": "(your username)",
-  "password": "(your password)"
+  "category": "public.app-category.games",
+  "identity": "(your team id)",
+  "username": "(Apple ID email)",
+  "password": "(app-specific password)"
 }
 ```
 
+iOS IPA upload uses `username` + `password` via `xcrun altool --upload-app`. `category` / `identity` matter more for macOS Electron signing/notarization.
 #### Cordova
 
 Set `packager: "cordova"` on an `android` or `ios` platform to use Cordova instead of Capacitor. Requires the Android and Apple package requirements above.

package/lib/node/archive.js

@@ -144,7 +144,8 @@ function createZipStream(deployFolder, contents, options = {}) {
 }
 
 /**
- * Game source zip for /build and /release (no credentials unless release).
+ * Game source zip for /build (and legacy callers). Include `deploymentDirs` when
+ * the builder needs signing credentials (e.g. Capacitor ios-dev).
  *
  * @param {string} deployFolder
  * @param {string} contents

package/lib/node/deploy.js

@@ -71,7 +71,11 @@ export async function send(gameId, contents, server, stage, family, deployFolder
     } else if (stage === 'release') {
         archiveStream = createReleaseArchive(deployFolder, contents, options.deploymentDirs ?? [], { log });
     } else {
-        archiveStream = createSourceArchive(deployFolder, contents, { log });
+        archiveStream = createSourceArchive(deployFolder, contents, {
+            log,
+            publishDir: options.publishDir,
+            deploymentDirs: options.deploymentDirs,
+        });
     }
 
     const url = resolveWrapfullyUrl(server, stage, family, gameId, platformKey, options.deploymentKey);

package/lib/node/index.js

@@ -52,6 +52,7 @@ export {
     resolveFamilyFromTarget,
     resolvePlatformKey,
     resolvePlatformRegistrationsByKey,
+    resolveBuildCredentialDirs,
     resolvePublishDir,
     resolveRegistrationAssets,
 } from './registrations.js';

package/lib/node/packagers/capacitor.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { Packager } from './base.js';
+import { resolvePlatformConfig } from '../platform-config.js';
 
 const CAPACITOR_CSP = '<meta http-equiv="Content-Security-Policy" content="default-src * \'self\' data: blob: \'unsafe-inline\' \'unsafe-eval\'; style-src * \'self\' \'unsafe-inline\'; script-src * \'self\' \'unsafe-inline\' \'unsafe-eval\'; connect-src *; img-src * data: blob:; media-src * data: blob:; frame-src *;" />';
 
@@ -17,24 +18,40 @@ export function resolvePlatformSocialLogin(platformKey, pkg) {
     return pkg.config?.platforms?.[platformKey]?.socialLogin;
 }
 
+/**
+ * @param {string} platformKey
+ */
+function isIosPlatformKey(platformKey) {
+    return platformKey === 'ios'
+        || platformKey === 'ios-dev'
+        || platformKey === 'ios-sim'
+        || String(platformKey).startsWith('ios');
+}
+
 /**
  * @param {object} socialLogin
  * @param {string} platformKey
+ * @param {{ packageName?: string }} [options]
  */
-function normalizeSocialLoginConfig(socialLogin = {}, platformKey) {
+export function normalizeSocialLoginConfig(socialLogin = {}, platformKey, options = {}) {
     const providers = socialLogin.providers ?? { google: true, apple: true };
     const googleEnabled = providers.google !== false;
     const appleEnabled = providers.apple !== false;
 
     let defaultProvider = socialLogin.defaultProvider;
     if (!defaultProvider) {
-        if (platformKey === 'ios' || platformKey === 'ios-dev' || platformKey === 'ios-sim') {
+        if (isIosPlatformKey(platformKey)) {
             defaultProvider = appleEnabled ? 'apple' : 'google';
         } else {
             defaultProvider = googleEnabled ? 'google' : 'apple';
         }
     }
 
+    const apple = { ...(socialLogin.apple ?? {}) };
+    if (appleEnabled && !apple.clientId && options.packageName && isIosPlatformKey(platformKey)) {
+        apple.clientId = options.packageName;
+    }
+
     return {
         providers: {
             google: googleEnabled,
@@ -43,7 +60,7 @@ function normalizeSocialLoginConfig(socialLogin = {}, platformKey) {
             twitter: providers.twitter === true,
         },
         google: socialLogin.google ?? {},
-        apple: socialLogin.apple ?? {},
+        apple,
         defaultProvider,
         platform: platformKey,
     };
@@ -52,7 +69,7 @@ function normalizeSocialLoginConfig(socialLogin = {}, platformKey) {
 /**
  * @param {object} config
  */
-function validateSocialLoginConfig(config) {
+export function validateSocialLoginConfig(config) {
     const { providers, google, apple } = config;
 
     if (!providers.google && !providers.apple) {
@@ -83,6 +100,10 @@ export class CapacitorPackager extends Packager {
     /** @type {string[]} */
     static defaultPlatforms = ['ios', 'android'];
 
+    #socialLoginPackageName() {
+        return resolvePlatformConfig(this.pkg, this.platformKey).packageName;
+    }
+
     validate() {
         super.validate();
 
@@ -98,6 +119,7 @@ export class CapacitorPackager extends Packager {
             const config = normalizeSocialLoginConfig(
                 socialLogin ?? this.pkg.config?.socialLogin,
                 this.platformKey ?? 'android',
+                { packageName: this.#socialLoginPackageName() },
             );
             validateSocialLoginConfig(config);
         }
@@ -113,7 +135,9 @@ export class CapacitorPackager extends Packager {
             const socialLogin = resolvePlatformSocialLogin(this.platformKey, this.pkg)
                 ?? this.pkg.config?.socialLogin
                 ?? {};
-            const config = normalizeSocialLoginConfig(socialLogin, this.platformKey);
+            const config = normalizeSocialLoginConfig(socialLogin, this.platformKey, {
+                packageName: this.#socialLoginPackageName(),
+            });
             const content = `window.__ADAPTFULLY_SOCIAL_LOGIN__ = ${JSON.stringify(config, null, 4)};\n`;
             fs.writeFileSync(path.join(dest, 'social-login-config.js'), content);
             this.log('adaptfully: write social-login-config.js (social-auth)');

package/lib/node/packagers/index.js

@@ -4,7 +4,12 @@ import { ElectronPackager } from './electron.js';
 import { Packager, VALID_PACKAGERS } from './base.js';
 import { WebPackager } from './web.js';
 
-export { CapacitorPackager, resolvePlatformSocialLogin } from './capacitor.js';
+export {
+    CapacitorPackager,
+    normalizeSocialLoginConfig,
+    resolvePlatformSocialLogin,
+    validateSocialLoginConfig,
+} from './capacitor.js';
 export { CordovaPackager } from './cordova.js';
 export {
     ElectronPackager,

package/lib/node/pipeline.js

@@ -4,6 +4,7 @@ import { send } from './deploy.js';
 import { resolveBuildArtifactDir } from './artifacts.js';
 import { prebuildPlatform } from './prebuild.js';
 import {
+    resolveBuildCredentialDirs,
     resolveBuildSpec,
     resolveDeploymentsForPlatform,
     resolvePublishDir,
@@ -130,6 +131,9 @@ export async function runAdaptfullyStage(stage, platformKey, options) {
     for (const deploymentKey of deployments) {
         const publishDir = deploymentKey === 'zip' ? undefined : resolvePublishDir(deploymentKey);
         const wrapStage = stage === 'deploy' ? 'deploy' : 'build';
+        const deploymentDirs = wrapStage === 'build'
+            ? resolveBuildCredentialDirs(platformKey, pkg)
+            : [];
 
         log(
             `adaptfully: ${stage} ${platformKey} → `
@@ -137,6 +141,14 @@ export async function runAdaptfullyStage(stage, platformKey, options) {
             + `via Wrapfully /${wrapfullyRoute}/${wrapStage} (${buildSpec.family})`,
         );
 
+        if (deploymentDirs.length) {
+            log(
+                `adaptfully: build signing credentials → ${
+                    deploymentDirs.map((dir) => path.resolve(dir)).join(', ')
+                }`,
+            );
+        }
+
         await send(
             gameId,
             contents,
@@ -149,6 +161,7 @@ export async function runAdaptfullyStage(stage, platformKey, options) {
             {
                 log,
                 publishDir,
+                deploymentDirs,
                 platformKey,
                 deploymentKey: wrapStage === 'deploy' ? deploymentKey : undefined,
                 artifactPath,

package/lib/node/publish-credentials.js

@@ -12,6 +12,7 @@ export const PUBLISH_CREDENTIAL_GITIGNORE_PATTERNS = [
     'assets/meta/deployments/**/apple.json',
     'assets/meta/deployments/**/ms.json',
     'assets/meta/deployments/**/android/',
+    'assets/meta/deployments/**/apple/',
     'assets/meta/deployments/**/ms/',
 ];
 

package/lib/node/registrations.js

@@ -345,6 +345,30 @@ export function resolvePublishDir(deploymentKey, metaDir = 'assets/meta') {
     return path.join(metaDir, 'deployments', deploymentKey);
 }
 
+const BUILD_SIGNING_PACKAGERS = new Set(['capacitor', 'cordova']);
+
+/**
+ * Credential folders to ship with `adaptfully build` (zip artifact) when the
+ * Wrapfully builder needs signing material — e.g. ios-dev → deployments/ios.
+ * Upload-only targets (SFTP, Play, ASC) are not included.
+ *
+ * @param {string} platformKey
+ * @param {object} pkg
+ * @param {string} [metaDir='assets/meta']
+ * @returns {string[]} Absolute paths to existing deployment dirs
+ */
+export function resolveBuildCredentialDirs(platformKey, pkg, metaDir = 'assets/meta') {
+    const platform = pkg?.config?.platforms?.[platformKey];
+    const packager = platform?.packager;
+    if (!BUILD_SIGNING_PACKAGERS.has(packager)) {
+        return [];
+    }
+
+    const credentialKey = DEFAULT_BUILDER_PLATFORMS[platformKey] ?? platformKey;
+    const dir = path.resolve(resolvePublishDir(credentialKey, metaDir));
+    return fs.existsSync(dir) ? [dir] : [];
+}
+
 const ELECTRON_TARGETS = new Set([
     'win', 'win-dev', 'mac', 'mac-dev', 'linux', 'linux-dev',
 ]);

package/lib/runtime/auth/social-auth.js

@@ -119,7 +119,9 @@
 
             if (config.providers?.apple !== false) {
                 options.apple = {
-                    clientId: config.apple?.clientId || '',
+                    clientId: config.apple?.clientId
+                        || window.gameConfig?.packageName
+                        || '',
                     redirectUrl: config.apple?.redirectUrl,
                     useProperTokenExchange: config.apple?.useProperTokenExchange !== false,
                     useBroadcastChannel: config.apple?.useBroadcastChannel !== false,

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@makefully/adaptfully",
-    "version": "3.15.1",
+    "version": "3.16.1",
     "description": "Platform abstraction and Wrapfully deploy client for Makefully games",
     "type": "module",
     "main": "./lib/node/index.js",