@makefully/adaptfully 4.1.0 → 4.2.0

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project are documented in this file.
 
+## 4.2.0 — 2026-09-08
+
+### Changed
+
+- **Build / deploy / release** submit **Showfully Yap** chores (`POST /yap/wrapfully`) instead of direct Wrapfully HTTP. Requires a Showfully PAT (`SHOWFULLY_PAT` / `wrapfully.json` `accessToken`).
+- Server URL defaults to Showfully (`https://make.makefullystudios.com/`); `wrapfully.json` may set `showfullyServer` or `server`.
+
+### Added
+
+- Optional `--encrypt` / `"encrypt": true` chore envelope encryption (default Wrapfully fleet public key; override with `--encrypt-public-key`).
+- `wrapfully.json` routing fields appended to Yap zips (`stage`, `route`, `platformKey`, `gameId`, `deploymentKey`).
+
 ## 4.1.0 — 2026-09-04
 
 ### Added

package/README.md

@@ -21,29 +21,34 @@ Games register platform services before load and retrieve them in-game. Adaptful
 ### Pipeline stages
 
 ```bash
-adaptfully prebuild web                       # deploy/ → output/web-prebuild/
-adaptfully build steam                        # prebuild + zip and send to Wrapfully (default deployment)
-adaptfully deploy web                         # prebuild + POST to Wrapfully for each of web's deployments
-adaptfully deploy web --deployment web-prod   # deploy to a single named deployment
-adaptfully deploy steam                       # prebuild + POST to Wrapfully steam builder
+# wrapfully.json (gitignored) or env — Showfully PAT required for build/deploy/release:
+#   { "accessToken": "sfpat_…", "server": "https://make.makefullystudios.com/" }
+#   optional: "encrypt": true
+
+export SHOWFULLY_PAT=sfpat_…
+adaptfully prebuild web                       # deploy/ → output/web-prebuild/ (local only)
+adaptfully build steam                        # Yap /yap/wrapfully chore → artifact zip
+adaptfully deploy web --deployment web-prod   # Yap deploy chore
+adaptfully release android --encrypt          # optional envelope encryption
 adaptfully steam-publish                      # one-time: log in with steamcmd → assets/meta/deployments/steam/steam.json
-adaptfully google-publish --from ./sa.json    # one-time: import Play service account → deployments/android/google.json
-adaptfully apple-publish                      # one-time: write App Store Connect creds → deployments/ios/apple.json
-adaptfully android-keystore                   # one-time: generate keystores + android build.json
-adaptfully apple-signing                      # one-time: CSR / .p12 / provisioning files under ios/apple/
 ```
 
 | Stage | What it does |
 |-------|----------------|
 | `prebuild` | Copy `deploy/` to `output/<platform>-prebuild/` and inject registrations into `config.htmlInjections` |
-| `build` | Prebuild, then POST the result to Wrapfully (artifact zip only) |
-| `deploy` | POST the prior build artifact from `./output/` to each configured deployment (or `--deployment`) |
+| `build` | Prebuild, then submit a **Showfully Yap** `wrapfully` chore (PAT required); poll until the artifact zip returns |
+| `deploy` | Submit a Yap deploy chore with the prior build artifact + deployment credentials |
+| `release` | Yap release chore (build + configured deployments on Wrapfully) |
 | `steam-publish` | One-time local setup: install steamcmd, interactive login, write the `steam` deployment's `steam.json` (also updates `.gitignore`) |
 | `google-publish` | One-time local setup: import a Play Console service-account JSON into the `android` deployment folder (also updates `.gitignore`) |
 | `apple-publish` | One-time local setup: write App Store Connect credentials into the `ios` deployment folder (also updates `.gitignore`) |
 | `android-keystore` | One-time local setup: generate debug/release keystores and write `android` `build.json` (also updates `.gitignore`) |
 | `apple-signing` | One-time local setup: CSR → Apple `.cer` → `.p12` / provisioning profiles under `ios/apple/` (also updates `.gitignore`) |
 
+**Server** means the Showfully Yap base (`SHOWFULLY_SERVER` / `wrapfully.json` `showfullyServer` or `server`), default `https://make.makefullystudios.com/`. Wrapfully workers claim chores with a separate service token.
+
+**Encryption (optional):** `--encrypt` or `"encrypt": true` wraps the chore to the Makefully Wrapfully fleet public key (override with `--encrypt-public-key`). Results are decrypted locally with an ephemeral `resultPriv` kept only for that chore.
+
 First-time walkthroughs (manual steps + helper skip markers): [docs/credentials/](docs/credentials/README.md).
 
 `wrapfully-deploy` is a compatibility alias for `adaptfully deploy` when invoked with a Wrapfully builder name (`steam`, `win`, `android`, etc.).

package/lib/node/choreCrypto.js

@@ -0,0 +1,197 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import {Readable, PassThrough} from 'node:stream';
+import {pipeline} from 'node:stream/promises';
+import archiver from 'archiver';
+import unzipper from 'unzip-stream';
+import {
+    WRAPFULLY_DEFAULT_KID,
+    WRAPFULLY_DEFAULT_PUBLIC_KEY,
+} from './wrapfullyDefaultPublicKey.js';
+
+const
+    ENVELOPE_DATA = 'wrapfully.enc',
+    ENVELOPE_KEY = 'wrapfully.key.enc',
+    ENVELOPE_META = 'wrapfully-crypto.json',
+    RESULT_DATA = 'result.enc',
+    RESULT_KEY = 'result.key.enc',
+    ALG = 'RSA-OAEP-SHA256+AES-256-GCM';
+
+function aesEncrypt (plaintext) {
+    const key = crypto.randomBytes(32);
+    const iv = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+    const enc = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    const tag = cipher.getAuthTag();
+
+    return {key, ciphertext: Buffer.concat([iv, tag, enc])};
+}
+
+function aesDecrypt (key, blob) {
+    const iv = blob.subarray(0, 12);
+    const tag = blob.subarray(12, 28);
+    const data = blob.subarray(28);
+    const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+
+    decipher.setAuthTag(tag);
+
+    return Buffer.concat([decipher.update(data), decipher.final()]);
+}
+
+function wrapKey (aesKey, publicKeyPem) {
+    return crypto.publicEncrypt(
+        {
+            key: publicKeyPem,
+            padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
+            oaepHash: 'sha256',
+        },
+        aesKey,
+    );
+}
+
+function unwrapKey (wrapped, privateKeyPem) {
+    return crypto.privateDecrypt(
+        {
+            key: privateKeyPem,
+            padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
+            oaepHash: 'sha256',
+        },
+        wrapped,
+    );
+}
+
+export function generateResultKeyPair () {
+    const {publicKey, privateKey} = crypto.generateKeyPairSync('rsa', {
+        modulusLength: 2048,
+        publicKeyEncoding: {type: 'spki', format: 'pem'},
+        privateKeyEncoding: {type: 'pkcs8', format: 'pem'},
+    });
+
+    return {publicKey, privateKey};
+}
+
+export function resolveEncryptPublicKey (wrapfullyConfig = {}, cliPublicKey) {
+    if (cliPublicKey) {
+        if (cliPublicKey.includes('BEGIN PUBLIC KEY')) {
+            return {pem: cliPublicKey.trim(), kid: wrapfullyConfig.encryptKid || 'override'};
+        }
+        return {
+            pem: fs.readFileSync(cliPublicKey, 'utf8').trim(),
+            kid: wrapfullyConfig.encryptKid || 'override',
+        };
+    }
+    if (wrapfullyConfig.encryptPublicKey) {
+        const value = wrapfullyConfig.encryptPublicKey;
+
+        if (String(value).includes('BEGIN PUBLIC KEY')) {
+            return {pem: String(value).trim(), kid: wrapfullyConfig.encryptKid || 'override'};
+        }
+        return {
+            pem: fs.readFileSync(value, 'utf8').trim(),
+            kid: wrapfullyConfig.encryptKid || 'override',
+        };
+    }
+
+    return {pem: WRAPFULLY_DEFAULT_PUBLIC_KEY.trim(), kid: WRAPFULLY_DEFAULT_KID};
+}
+
+async function bufferFromStream (stream) {
+    const chunks = [];
+
+    for await (const chunk of stream) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+
+    return Buffer.concat(chunks);
+}
+
+async function zipToBuffer (appendFn) {
+    const archive = archiver('zip', {zlib: {level: 0}});
+    const pass = new PassThrough();
+    const chunks = [];
+
+    archive.pipe(pass);
+    pass.on('data', (c) => chunks.push(c));
+
+    const done = new Promise((resolve, reject) => {
+        pass.on('end', resolve);
+        pass.on('error', reject);
+        archive.on('error', reject);
+    });
+
+    await appendFn(archive);
+    await archive.finalize();
+    await done;
+
+    return Buffer.concat(chunks);
+}
+
+/**
+ * Wrap an inner zip stream/buffer in a Yap-safe envelope for Wrapfully workers.
+ */
+export async function createEnvelopeFromInnerZip (innerZip, {publicKeyPem, kid, resultKeyPair}) {
+    const innerBuf = Buffer.isBuffer(innerZip) ? innerZip : await bufferFromStream(innerZip);
+    const {key, ciphertext} = aesEncrypt(innerBuf);
+    const wrapped = wrapKey(key, publicKeyPem);
+    const meta = {
+        kid,
+        alg: ALG,
+        resultPub: resultKeyPair.publicKey,
+    };
+
+    const zip = await zipToBuffer(async (archive) => {
+        archive.append(ciphertext, {name: ENVELOPE_DATA});
+        archive.append(wrapped, {name: ENVELOPE_KEY});
+        archive.append(JSON.stringify(meta, null, 2), {name: ENVELOPE_META});
+        archive.append(resultKeyPair.publicKey, {name: 'resultPub.pem'});
+    });
+
+    return {zip, resultPriv: resultKeyPair.privateKey, kid};
+}
+
+/**
+ * Decrypt a completed Yap result envelope into a plaintext zip Buffer.
+ */
+export async function decryptResultEnvelope (resultZipBuf, resultPrivPem) {
+    if (!resultPrivPem) {
+        throw new Error('Missing resultPriv for encrypted Wrapfully chore download.');
+    }
+
+    const tmp = path.join(os.tmpdir(), `adaptfully-result-${Date.now().toString(16)}`);
+
+    fs.mkdirSync(tmp, {recursive: true});
+    try {
+        await pipeline(Readable.from(resultZipBuf), unzipper.Extract({path: tmp}));
+        if (!fs.existsSync(path.join(tmp, RESULT_DATA))) {
+            // Not an envelope — return as-is
+            return resultZipBuf;
+        }
+        const ciphertext = fs.readFileSync(path.join(tmp, RESULT_DATA));
+        const wrapped = fs.readFileSync(path.join(tmp, RESULT_KEY));
+        const aesKey = unwrapKey(wrapped, resultPrivPem);
+
+        return aesDecrypt(aesKey, ciphertext);
+    } finally {
+        fs.rmSync(tmp, {recursive: true, force: true});
+    }
+}
+
+export function isResultEnvelopeBuffer (buf) {
+    // Weak check — PK zip; decryptResultEnvelope falls back if members missing
+    return Buffer.isBuffer(buf) && buf.length > 4 && buf[0] === 0x50 && buf[1] === 0x4b;
+}
+
+export {
+    ENVELOPE_DATA,
+    ENVELOPE_KEY,
+    ENVELOPE_META,
+    RESULT_DATA,
+    RESULT_KEY,
+    ALG,
+    aesEncrypt,
+    aesDecrypt,
+    wrapKey,
+    unwrapKey,
+};

package/lib/node/config.js

@@ -1,6 +1,8 @@
 import fs from 'node:fs/promises';
 
-const DEFAULT_SERVER = 'http://localhost:9633/';
+const DEFAULT_SHOWFULLY_SERVER = process.env.SHOWFULLY_DEV
+    ? 'http://localhost:9630/'
+    : 'https://make.makefullystudios.com/';
 
 /**
  * @param {string} [projectRoot='.']
@@ -29,14 +31,53 @@ export async function loadProjectConfig(projectRoot = '.') {
 }
 
 /**
- * @param {{ server?: string }} wrapfullyConfig
+ * Showfully Yap base URL (not Wrapfully HTTP).
+ * @param {{ server?: string, showfullyServer?: string }} wrapfullyConfig
  * @param {string} [cliServer]
  */
 export function resolveServerUrl(wrapfullyConfig, cliServer) {
     return (
         cliServer
-        || process.env.WRAPFULLY_SERVER
+        || process.env.SHOWFULLY_SERVER
+        || wrapfullyConfig.showfullyServer
         || wrapfullyConfig.server
-        || DEFAULT_SERVER
+        || process.env.WRAPFULLY_SERVER
+        || DEFAULT_SHOWFULLY_SERVER
     ).replace(/\/?$/, '/');
 }
+
+/**
+ * Required PAT for Yap submit/poll/download.
+ * @param {{ accessToken?: string, showfullyPat?: string }} wrapfullyConfig
+ * @param {string} [cliToken]
+ */
+export function resolveAccessToken(wrapfullyConfig = {}, cliToken) {
+    const token = (
+        cliToken
+        || process.env.SHOWFULLY_PAT
+        || process.env.WRAPFULLY_ACCESS_TOKEN
+        || wrapfullyConfig.accessToken
+        || wrapfullyConfig.showfullyPat
+        || ''
+    ).trim();
+
+    if (!token) {
+        throw new Error(
+            'Showfully PAT required. Set SHOWFULLY_PAT or wrapfully.json "accessToken" '
+            + '(Settings → API tokens on play.makefullystudios.com).',
+        );
+    }
+
+    return token;
+}
+
+/**
+ * @param {{ encrypt?: boolean }} wrapfullyConfig
+ * @param {boolean} [cliEncrypt]
+ */
+export function resolveEncryptFlag(wrapfullyConfig = {}, cliEncrypt) {
+    if (typeof cliEncrypt === 'boolean') {
+        return cliEncrypt;
+    }
+    return !!wrapfullyConfig.encrypt;
+}

package/lib/node/deploy.js

@@ -1,37 +1,150 @@
 import axios from 'axios';
 import fs from 'node:fs';
 import path from 'node:path';
-import { pipeline } from 'node:stream/promises';
+import {Readable} from 'node:stream';
+import {pipeline} from 'node:stream/promises';
 import unzipper from 'unzip-stream';
-import { createDeployArchive, createReleaseArchive, createSourceArchive } from './archive.js';
-import { clearStaleBuildExtract } from './artifacts.js';
-import { listHtmlFilesRecursive } from './fs-utils.js';
-import { printBuildReport } from './report.js';
+import {createDeployArchive, createReleaseArchive, createSourceArchive} from './archive.js';
+import {clearStaleBuildExtract} from './artifacts.js';
+import {listHtmlFilesRecursive} from './fs-utils.js';
+import {printBuildReport} from './report.js';
+import {
+    createEnvelopeFromInnerZip,
+    decryptResultEnvelope,
+    generateResultKeyPair,
+    resolveEncryptPublicKey,
+} from './choreCrypto.js';
+
+const POLL_MS = 5000;
 
 /**
  * @param {string} gameId
  * @param {string} platformKey
  */
-function buildInfoParam(gameId, platformKey) {
+export function buildInfoParam (gameId, platformKey) {
     return platformKey && platformKey !== gameId ? `${gameId}_${platformKey}` : gameId;
 }
 
 /**
- * @param {string} server
- * @param {'build' | 'deploy' | 'release'} stage
- * @param {string} family
- * @param {string} gameId
- * @param {string} platformKey
- * @param {string} [deploymentKey]
+ * Build wrapfully.json routing config appended to the Yap zip.
  */
-function resolveWrapfullyUrl(server, stage, family, gameId, platformKey, deploymentKey) {
-    const info = buildInfoParam(gameId, platformKey);
+export function buildWrapfullyJobConfig (stage, family, gameId, platformKey, deploymentKey) {
+    /** @type {Record<string, string>} */
+    const job = {
+        stage,
+        route: family,
+        platformKey,
+        gameId,
+    };
 
     if (stage === 'deploy') {
-        return `${server}deploy/${deploymentKey}/${info}`;
+        if (!deploymentKey) {
+            throw new Error('deploy stage requires deploymentKey');
+        }
+        job.deploymentKey = deploymentKey;
+    }
+
+    return job;
+}
+
+async function streamToBuffer (stream) {
+    const chunks = [];
+
+    for await (const chunk of stream) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+
+    return Buffer.concat(chunks);
+}
+
+async function sleep (ms) {
+    await new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+/**
+ * Submit zip to Showfully Yap, poll until complete, return result zip Buffer.
+ */
+export async function submitWrapfullyChore ({
+    server,
+    accessToken,
+    zipBuffer,
+    log = console.log,
+}) {
+    const base = server.replace(/\/?$/, '/');
+    const submitUrl = `${base}yap/wrapfully`;
+    const headers = {
+        Authorization: `Bearer ${accessToken}`,
+        'Content-Type': 'application/zip',
+    };
+
+    log(`adaptfully: POST ${submitUrl}`);
+
+    let submitJson;
+
+    try {
+        const {data} = await axios.post(submitUrl, zipBuffer, {
+            maxRedirects: 0,
+            headers,
+            maxBodyLength: Infinity,
+            maxContentLength: Infinity,
+            validateStatus: () => true,
+        });
+
+        submitJson = data;
+    } catch (err) {
+        if (/** @type {NodeJS.ErrnoException} */ (err).code === 'ECONNREFUSED') {
+            throw new Error(`Cannot connect to Showfully server "${server}"`);
+        }
+        throw err;
+    }
+
+    if (submitJson?.errors?.length) {
+        throw new Error(submitJson.errors[0]);
+    }
+    if (!submitJson?.choreId) {
+        throw new Error('Showfully did not return a choreId');
+    }
+
+    const {choreId} = submitJson;
+
+    log(`adaptfully: chore ${choreId} submitted; waiting…`);
+
+    for (;;) {
+        const statusUrl = `${base}yap/wrapfully/${encodeURIComponent(choreId)}/status`;
+        const {data: status} = await axios.get(statusUrl, {
+            headers: {Authorization: `Bearer ${accessToken}`},
+            validateStatus: () => true,
+        });
+
+        if (status?.state === 'complete') {
+            break;
+        }
+        if (status?.state === 'error' || status?.errors?.length) {
+            throw new Error(status.errors?.[0] || `Chore ${choreId} failed`);
+        }
+
+        log(`adaptfully: ${status?.status || status?.state || 'waiting'}…`);
+        await sleep(POLL_MS);
+    }
+
+    log(`adaptfully: downloading chore ${choreId}`);
+    const downloadUrl = `${base}yap/wrapfully/${encodeURIComponent(choreId)}`;
+    const {data, headers: resHeaders} = await axios.get(downloadUrl, {
+        headers: {Authorization: `Bearer ${accessToken}`},
+        responseType: 'arraybuffer',
+        maxContentLength: Infinity,
+        validateStatus: () => true,
+    });
+
+    const ctype = resHeaders['content-type'] || '';
+
+    if (ctype.includes('application/json')) {
+        const json = JSON.parse(Buffer.from(data).toString('utf8'));
+
+        throw new Error(json.errors?.[0] || 'Chore download returned JSON');
     }
 
-    return `${server}${family}/${stage}/${info}`;
+    return Buffer.from(data);
 }
 
 /**
@@ -41,23 +154,45 @@ function resolveWrapfullyUrl(server, stage, family, gameId, platformKey, deploym
  * @param {'build' | 'deploy' | 'release'} stage
  * @param {string} family
  * @param {string} deployFolder
- * @param {{ name: string, version: string }} pkg
+ * @param {{ name: string, version: string, config?: object }} pkg
  * @param {'extract' | string} mode
- * @param {{ log?: (message: string) => void, publishDir?: string, deploymentDirs?: string[], platformKey?: string, deploymentKey?: string, artifactPath?: string }} [options]
+ * @param {{
+ *   log?: (message: string) => void,
+ *   publishDir?: string,
+ *   deploymentDirs?: string[],
+ *   platformKey?: string,
+ *   deploymentKey?: string,
+ *   artifactPath?: string,
+ *   accessToken?: string,
+ *   encrypt?: boolean,
+ *   encryptPublicKey?: string,
+ *   wrapfullyConfig?: object,
+ * }} [options]
  */
-export async function send(gameId, contents, server, stage, family, deployFolder, pkg, mode = 'extract', options = {}) {
+export async function send (
+    gameId,
+    contents,
+    server,
+    stage,
+    family,
+    deployFolder,
+    pkg,
+    mode = 'extract',
+    options = {},
+) {
     const log = options.log ?? console.log;
     const platformKey = options.platformKey ?? family;
     const outputRoot = pkg.config?.outputFolder || 'output';
+    const accessToken = options.accessToken;
+
+    if (!accessToken) {
+        throw new Error('accessToken (Showfully PAT) is required for Yap wrapfully chores');
+    }
 
     if (mode === 'extract') {
         clearStaleBuildExtract(outputRoot);
     }
 
-    const destination = mode === 'extract'
-        ? unzipper.Extract({ path: `${outputRoot}/`, concurrency: 1 })
-        : fs.createWriteStream(`${outputRoot}/${pkg.name}-${pkg.version}-${stage}-${family}.zip`);
-
     let archiveStream;
 
     if (stage === 'deploy') {
@@ -67,9 +202,9 @@ export async function send(gameId, contents, server, stage, family, deployFolder
         if (!options.deploymentKey) {
             throw new Error('deploy stage requires options.deploymentKey');
         }
-        archiveStream = createDeployArchive(options.artifactPath, options.publishDir, contents, { log });
+        archiveStream = createDeployArchive(options.artifactPath, options.publishDir, contents, {log});
     } else if (stage === 'release') {
-        archiveStream = createReleaseArchive(deployFolder, contents, options.deploymentDirs ?? [], { log });
+        archiveStream = createReleaseArchive(deployFolder, contents, options.deploymentDirs ?? [], {log});
     } else {
         archiveStream = createSourceArchive(deployFolder, contents, {
             log,
@@ -78,33 +213,95 @@ export async function send(gameId, contents, server, stage, family, deployFolder
         });
     }
 
-    const url = resolveWrapfullyUrl(server, stage, family, gameId, platformKey, options.deploymentKey);
-    log(`adaptfully: POST ${url}`);
-
     if (stage !== 'deploy') {
         const htmlFiles = listHtmlFilesRecursive(deployFolder);
+
         log(`adaptfully: sending ${htmlFiles.length} HTML file(s) from ${path.resolve(deployFolder)}`);
     }
 
-    const { data } = await axios.post(url, archiveStream, {
-        maxRedirects: 0,
-        responseType: 'stream',
-    });
+    // Append wrapfully.json routing into the archive by rebuilding into a buffer.
+    const job = buildWrapfullyJobConfig(stage, family, gameId, platformKey, options.deploymentKey);
+    const innerChunks = [];
 
-    archiveStream.on('close', () => {
-        log('adaptfully: upload complete');
-    });
+    // Re-pack: read archiveStream into zip, add wrapfully.json
+    // Archiver streams aren't easily mutable — collect then use yazl-free approach:
+    // pipe archive to buffer, unzip to tmp, add file, rezip is heavy.
+    // Simpler: createSourceArchive already finalized as stream — append via second archiver
+    // that copies entries is complex. Instead append wrapfully.json by concatenating
+    // a sidecar zip is wrong. Best: write wrapfully.json into deploy folder meta before
+    // archive... but that mutates disk.
+    //
+    // Practical approach matching Dutifully: build archive, buffer it, then use a new
+    // archiver that includes the buffer as... no that's nested.
+    //
+    // Use jszip-like: buffer the created archive by consuming stream, then use
+    // adm-zip equivalent — we have unzipper. Extract to tmp, write wrapfully.json, rezip.
+
+    const tmpRoot = path.join(outputRoot, `.adaptfully-yap-${Date.now().toString(16)}`);
 
+    fs.mkdirSync(tmpRoot, {recursive: true});
     try {
-        await pipeline(data, destination);
-    } catch (err) {
-        if (/** @type {NodeJS.ErrnoException} */ (err).code === 'ECONNREFUSED') {
-            console.error(`Cannot connect to Wrapfully server "${server}"`);
-            process.exit(1);
-        }
-        throw err;
+        await pipeline(archiveStream, unzipper.Extract({path: tmpRoot, concurrency: 1}));
+        fs.writeFileSync(path.join(tmpRoot, 'wrapfully.json'), JSON.stringify(job, null, 2));
+
+        const {default: archiver} = await import('archiver');
+        const {PassThrough} = await import('node:stream');
+        const archive = archiver('zip', {zlib: {level: 0}});
+        const pass = new PassThrough();
+
+        archive.pipe(pass);
+        pass.on('data', (c) => innerChunks.push(c));
+
+        const done = new Promise((resolve, reject) => {
+            pass.on('end', resolve);
+            pass.on('error', reject);
+            archive.on('error', reject);
+        });
+
+        archive.directory(tmpRoot, false);
+        await archive.finalize();
+        await done;
+    } finally {
+        fs.rmSync(tmpRoot, {recursive: true, force: true});
+    }
+
+    let uploadBuffer = Buffer.concat(innerChunks);
+    let resultPriv = null;
+
+    if (options.encrypt) {
+        const {pem, kid} = resolveEncryptPublicKey(
+            options.wrapfullyConfig || {},
+            options.encryptPublicKey,
+        );
+        const resultKeyPair = generateResultKeyPair();
+        const envelope = await createEnvelopeFromInnerZip(uploadBuffer, {
+            publicKeyPem: pem,
+            kid,
+            resultKeyPair,
+        });
+
+        uploadBuffer = envelope.zip;
+        resultPriv = envelope.resultPriv;
+        log(`adaptfully: encrypting chore with kid "${kid}"`);
+    }
+
+    let resultBuffer = await submitWrapfullyChore({
+        server,
+        accessToken,
+        zipBuffer: uploadBuffer,
+        log,
+    });
+
+    if (resultPriv) {
+        resultBuffer = await decryptResultEnvelope(resultBuffer, resultPriv);
     }
 
+    const destination = mode === 'extract'
+        ? unzipper.Extract({path: `${outputRoot}/`, concurrency: 1})
+        : fs.createWriteStream(`${outputRoot}/${pkg.name}-${pkg.version}-${stage}-${family}.zip`);
+
+    await pipeline(Readable.from(resultBuffer), destination);
+
     if (mode === 'extract') {
         printBuildReport(`${stage}-${family}`, pkg);
     }

package/lib/node/pipeline.js

@@ -1,5 +1,5 @@
 import path from 'node:path';
-import { loadProjectConfig, resolveServerUrl } from './config.js';
+import { loadProjectConfig, resolveServerUrl, resolveAccessToken, resolveEncryptFlag } from './config.js';
 import { send } from './deploy.js';
 import { resolveBuildArtifactDir } from './artifacts.js';
 import { prebuildPlatform } from './prebuild.js';
@@ -44,7 +44,7 @@ export function resolveWrapfullyRoute(buildSpec) {
 /**
  * @param {AdaptfullyStage} stage
  * @param {string} platformKey
- * @param {{ pkg: object, deployFolder: string, server?: string, mode?: string, deployment?: string, artifactPath?: string, log?: (message: string) => void, outputRoot?: string }} options
+ * @param {{ pkg: object, deployFolder: string, server?: string, mode?: string, deployment?: string, artifactPath?: string, log?: (message: string) => void, outputRoot?: string, accessToken?: string, encrypt?: boolean, encryptPublicKey?: string, wrapfullyConfig?: object }} options
  */
 export async function runAdaptfullyStage(stage, platformKey, options) {
     if (!VALID_STAGES.has(stage)) {
@@ -103,7 +103,7 @@ export async function runAdaptfullyStage(stage, platformKey, options) {
 
         log(
             `adaptfully: ${stage} ${platformKey} → ${buildSpec.family} `
-            + `(${buildSpec.targets.join(', ')}) via /${wrapfullyRoute}/release`,
+            + `(${buildSpec.targets.join(', ')}) via Yap /yap/wrapfully (route ${wrapfullyRoute}/release)`,
         );
 
         log(
@@ -125,6 +125,10 @@ export async function runAdaptfullyStage(stage, platformKey, options) {
                 log,
                 platformKey,
                 deploymentDirs: deploymentDirs.map((dir) => path.resolve(dir)),
+                accessToken: options.accessToken,
+                encrypt: options.encrypt,
+                encryptPublicKey: options.encryptPublicKey,
+                wrapfullyConfig: options.wrapfullyConfig,
             },
         );
 
@@ -142,7 +146,7 @@ export async function runAdaptfullyStage(stage, platformKey, options) {
         log(
             `adaptfully: ${stage} ${platformKey} → `
             + `${deploymentKey === 'zip' ? 'artifact zip' : `deployment "${deploymentKey}"`} `
-            + `via Wrapfully /${wrapfullyRoute}/${wrapStage} (${buildSpec.family})`,
+            + `via Yap /yap/wrapfully (route ${wrapfullyRoute}/${wrapStage}, ${buildSpec.family})`,
         );
 
         if (deploymentDirs.length) {
@@ -169,6 +173,10 @@ export async function runAdaptfullyStage(stage, platformKey, options) {
                 platformKey,
                 deploymentKey: wrapStage === 'deploy' ? deploymentKey : undefined,
                 artifactPath,
+                accessToken: options.accessToken,
+                encrypt: options.encrypt,
+                encryptPublicKey: options.encryptPublicKey,
+                wrapfullyConfig: options.wrapfullyConfig,
             },
         );
 
@@ -194,7 +202,7 @@ export async function adaptfullyFromCli(argv = process.argv) {
     }
 
     const stage = command;
-    const { positionals, deployment, artifactPath } = parseStageArgs(argv.slice(3));
+    const { positionals, deployment, artifactPath, encrypt, encryptPublicKey } = parseStageArgs(argv.slice(3));
     const platformKey = positionals[0];
     const cliServer = positionals[1];
     const mode = positionals[2] ?? 'extract';
@@ -202,7 +210,8 @@ export async function adaptfullyFromCli(argv = process.argv) {
     if (!stage || !platformKey) {
         throw new Error(
             'Usage:\n'
-            + '  adaptfully <prebuild|build|deploy|release> <platform> [server] [mode] [--deployment <key>] [--artifact <path>]\n'
+            + '  adaptfully <prebuild|build|deploy|release> <platform> [showfullyServer] [mode]\n'
+            + '    [--deployment <key>] [--artifact <path>] [--encrypt] [--encrypt-public-key <pem|path>]\n'
             + '  adaptfully steam-publish [--username U] [--password P] [--deployment steam] [--output path]\n'
             + '  adaptfully google-publish [--from service-account.json] [--deployment android] [--output path]\n'
             + '  adaptfully apple-publish [--deployment ios] [--category C] [--identity I] [--username U] [--password P]\n'
@@ -211,12 +220,18 @@ export async function adaptfullyFromCli(argv = process.argv) {
             + '\n'
             + 'Stages:\n'
             + '  prebuild  Copy deploy/ and apply platform registrations → output/<platform>-prebuild/\n'
-            + '  build     prebuild + POST /{target|family}/build (zip artifact only)\n'
-            + '  deploy    POST /deploy/{key} with prior artifact + deployment credentials\n'
-            + '  release   prebuild + POST /{target|family}/release (build + configured deployments)\n'
+            + '  build     prebuild + POST /yap/wrapfully (zip artifact only; Showfully PAT required)\n'
+            + '  deploy    Yap deploy chore with prior artifact + deployment credentials\n'
+            + '  release   Yap release chore (build + configured deployments)\n'
             + '\n'
             + '  --deployment <key>  Target a single named deployment.\n'
             + '  --artifact <path>   Prior build artifact directory (deploy only; default: ./output/ after build).\n'
+            + '  --encrypt           Envelope-encrypt chore to Wrapfully (optional; default key embedded).\n'
+            + '  --encrypt-public-key <pem|path>  Override Wrapfully public key when encrypting.\n'
+            + '\n'
+            + 'Auth / server (wrapfully.json or env):\n'
+            + '  SHOWFULLY_PAT / accessToken   required PAT from play.makefullystudios.com Settings\n'
+            + '  SHOWFULLY_SERVER / server     Showfully Yap base (default https://make.makefullystudios.com/)\n'
             + '\n'
             + 'Publish credential helpers (one-time local setup):\n'
             + '  steam-publish     Install steamcmd if needed, log in, write steam deployment steam.json\n'
@@ -229,6 +244,8 @@ export async function adaptfullyFromCli(argv = process.argv) {
 
     const { pkg, wrapfullyConfig } = await loadProjectConfig();
     const server = resolveServerUrl(wrapfullyConfig, cliServer);
+    const accessToken = resolveAccessToken(wrapfullyConfig);
+    const encryptFlag = resolveEncryptFlag(wrapfullyConfig, encrypt);
     const deployFolder = pkg.config?.deployFolder || 'deploy';
 
     return runAdaptfullyStage(/** @type {AdaptfullyStage} */ (stage), platformKey, {
@@ -238,18 +255,24 @@ export async function adaptfullyFromCli(argv = process.argv) {
         mode,
         deployment,
         artifactPath,
+        accessToken,
+        encrypt: encryptFlag,
+        encryptPublicKey,
+        wrapfullyConfig,
     });
 }
 
 /**
  * @param {string[]} args
- * @returns {{ positionals: string[], deployment?: string, artifactPath?: string }}
+ * @returns {{ positionals: string[], deployment?: string, artifactPath?: string, encrypt?: boolean, encryptPublicKey?: string }}
  */
 export function parseStageArgs(args) {
     /** @type {string[]} */
     const positionals = [];
     let deployment;
     let artifactPath;
+    let encrypt;
+    let encryptPublicKey;
 
     for (let i = 0; i < args.length; i++) {
         const arg = args[i];
@@ -262,10 +285,16 @@ export function parseStageArgs(args) {
             artifactPath = args[++i];
         } else if (arg.startsWith('--artifact=')) {
             artifactPath = arg.slice('--artifact='.length);
+        } else if (arg === '--encrypt') {
+            encrypt = true;
+        } else if (arg === '--encrypt-public-key' && args[i + 1]) {
+            encryptPublicKey = args[++i];
+        } else if (arg.startsWith('--encrypt-public-key=')) {
+            encryptPublicKey = arg.slice('--encrypt-public-key='.length);
         } else {
             positionals.push(arg);
         }
     }
 
-    return { positionals, deployment, artifactPath };
+    return { positionals, deployment, artifactPath, encrypt, encryptPublicKey };
 }

package/lib/node/wrapfullyDefaultPublicKey.js

@@ -0,0 +1,17 @@
+/**
+ * Default Makefully Wrapfully fleet public key (kid: makefully-wrapfully-1).
+ * Private key lives only on Wrapfully workers (WRAPFULLY_PRIVATE_KEY / cred.json).
+ * Safe to embed in clients — used only to wrap chore AES keys when encrypt: true.
+ */
+export const WRAPFULLY_DEFAULT_KID = 'makefully-wrapfully-1';
+
+export const WRAPFULLY_DEFAULT_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArbQGAXiX+XtnsdS0yUPj
+dgM2Vt8lwDXPtLxzjYD45fr/NEOct0+ECsvr3jyIB/cVCjINpJJyKGEBvZk8woFj
+FgyodSWjJrc1UsomeOz6IcOArWu6GnkFo0jn8R0FN8LOhEl1xjqT7VPzF4jd7/P5
+4WBNeB+wjkY/XBmk5wsNLvGaREp8G4fFfMgDNPpTUy7RB8ezolTiWZH0KgiXZtM8
+yUXk5YBPxTwI28wCB6Om5RGmwozWc66k29qZQRv5d4GRMSM18lMKh3gkjptZRhRD
+D48bKDQwYPX8CWcpl/Q9qm2L0wtikjQWro1NsAreqa3r91wlrsYZ82stYIyKBYhW
+LwIDAQAB
+-----END PUBLIC KEY-----
+`;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@makefully/adaptfully",
-    "version": "4.1.0",
+    "version": "4.2.0",
     "description": "Platform abstraction and Wrapfully deploy client for Makefully games",
     "type": "module",
     "main": "./lib/node/index.js",