@makefully/adaptfully 4.3.0 → 5.0.1

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to this project are documented in this file.
 
+## 5.0.1 — 2026-09-17
+
+### Changed
+
+- **`google-auth`** requires `config.googleClientId` (no built-in Entanglement client id default).
+- **`social-auth`** no longer falls back to `config.googleClientId` for Capgo `webClientId` — use `platforms.<name>.socialLogin.google.webClientId` only.
+- Docs: browser GIS vs Capacitor Google client ids are documented as separate fan-out surfaces.
+
+## 5.0.0 — 2026-09-11
+
+### Changed
+
+- **Breaking:** Wrapfully extracts always land in `output/<platform>/` (including single-platform `build` / `release` / `deploy`). Sequential runs no longer overwrite siblings. Deploy still falls back to a legacy flat `output/` artifact if present.
+
 ## 4.3.0 — 2026-09-11
 
 ### Added

package/README.md

@@ -30,7 +30,7 @@ adaptfully prebuild web                       # deploy/ → output/web-prebuild/
 adaptfully build steam                        # Yap /yap/wrapfully chore → artifact zip
 adaptfully deploy web --deployment web-prod   # Yap deploy chore
 adaptfully release android --encrypt          # optional envelope encryption
-adaptfully release steam,android,ios          # sequential platforms; extracts to output/<platform>/
+adaptfully release steam,android,ios          # sequential platforms; each → output/<platform>/
 adaptfully release --platforms steam,android  # same, flag form
 adaptfully steam-publish                      # one-time: log in with steamcmd → assets/meta/deployments/steam/steam.json
 ```
@@ -47,7 +47,7 @@ adaptfully steam-publish                      # one-time: log in with steamcmd
 | `android-keystore` | One-time local setup: generate debug/release keystores and write `android` `build.json` (also updates `.gitignore`) |
 | `apple-signing` | One-time local setup: CSR → Apple `.cer` → `.p12` / provisioning profiles under `ios/apple/` (also updates `.gitignore`) |
 
-Comma-separated platforms (or `--platforms`) run **sequentially**. Multi-platform extracts go to `output/<platform>/` so sibling results are not overwritten; only that folder’s prior `artifacts/` / status files are cleared before each extract. A single platform still extracts to `output/` for backward compatibility.
+Comma-separated platforms (or `--platforms`) run **sequentially**. Build/deploy/release extracts always go to `output/<platform>/` so sibling results are not overwritten; only that folder’s prior `artifacts/` / status files are cleared before each extract.
 
 **Server** means the Showfully Yap base (`SHOWFULLY_SERVER` / `wrapfully.json` `showfullyServer` or `server`), default `https://make.makefullystudios.com/`. Wrapfully workers claim chores with a separate service token.
 
@@ -136,7 +136,7 @@ Games should call `adaptfully.has('analytics')` before `get` during rollout if o
 
 | Plugin key | Registration | Runtime |
 |------------|--------------|---------|
-| `google-auth` | `adaptfully.register('auth', adaptfully.auth.Google)` | Web, Android, iOS |
+| `google-auth` | `adaptfully.register('auth', adaptfully.auth.Google)` | Web (Google Identity Services) |
 | `steam-auth` | `adaptfully.register('auth', adaptfully.auth.Steam)` | Steam / Electron (via [steamworks.js](https://github.com/ceifa/steamworks.js)) |
 | `social-auth` | `adaptfully.register('auth', adaptfully.auth.Social)` | Capacitor (via [@capgo/capacitor-social-login](https://github.com/Cap-go/capacitor-social-login)) |
 | `dev-auth` | `adaptfully.register('auth', adaptfully.auth.Dev)` | Local / testing |
@@ -188,6 +188,13 @@ Android/iOS Wrapfully builds use the **`capacitor`** builder family. Cordova/Pho
 
 **`social-auth` requires `packager: "capacitor"`** and `platforms.<name>.socialLogin` (Capgo provider client IDs). Wrapfully installs `@capgo/capacitor-social-login` when building.
 
+Google client IDs are **not** interchangeable across plugins:
+
+| Surface | Config | Notes |
+|---------|--------|--------|
+| Browser GIS (`google-auth`) | `config.googleClientId` (via your config registration / bridge) | OAuth **Web** client whose authorized JavaScript origins include the site origin |
+| Capacitor Capgo (`social-auth`) | `platforms.<name>.socialLogin.google.webClientId` | Server / web client id for native Google Sign-In — do **not** put this in `googleClientId` |
+
 ```json
 {
   "config": {
@@ -220,6 +227,19 @@ Android/iOS Wrapfully builds use the **`capacitor`** builder family. Cordova/Pho
 }
 ```
 
+#### Google auth (`google-auth`)
+
+Browser-only plugin using [Google Identity Services](https://developers.google.com/identity/oauth2/web/guides/overview) (`accounts.google.com/gsi/client`). Requires `config.googleClientId` — there is no built-in default. GIS authorized origins are **per OAuth client**; reusing `socialLogin.google.webClientId` here is a common failure mode when mobile and web need different clients.
+
+Optional config keys:
+
+| Key | Default | Purpose |
+|-----|---------|---------|
+| `googleClientId` | *(required)* | Browser GIS OAuth client id |
+| `googleTokenKey` | `adaptfully_google_token` | `sessionStorage` key for the access token |
+| `googleScopes` | `openid email profile` | OAuth scopes |
+| `autoLoginStorageKey` | `lastLoggedIn` | Storage key written with the user id on login |
+
 #### Steam auth (`steam-auth`)
 
 When `steam-auth` is registered on an **`electron`** platform, Adaptfully prebuild writes:
@@ -242,6 +262,8 @@ The runtime plugin calls Capgo `SocialLogin.initialize` / `login` / `logout` / `
 
 **Apple-only iOS** (`providers.google: false`, `providers.apple: true`) is supported — Google `webClientId` is not required. On iOS, if `apple.clientId` is omitted, Adaptfully defaults it to the platform `packageName` (Capgo uses this as a plugin label on native iOS, not an Apple Services ID). On Android, Apple Sign-In still requires `apple.clientId`. At runtime, an empty Apple `clientId` also falls back to `window.gameConfig.packageName`.
 
+Google Sign-In on Capacitor reads **`socialLogin.google.webClientId` only** (via `social-login-config.js`). It does not fall back to `config.googleClientId`.
+
 Optional config keys:
 
 | Key | Default | Purpose |
@@ -283,7 +305,7 @@ import {
 
 ## Wrapfully deploy
 
-After prebuild, the build and deploy stages zip `output/<platform>-prebuild/` and POST it to a Wrapfully build server. Artifacts are saved to `./output/`.
+After prebuild, the build and deploy stages zip `output/<platform>-prebuild/` and POST it to a Wrapfully build server. Artifacts are saved to `./output/<platform>/`.
 
 ## Quick start
 
@@ -322,7 +344,7 @@ npx adaptfully apple-publish [--deployment ios] [--category C] [--identity I] [-
 |----------|---------|-------------|
 | `platform` | — | Platform key from `config.platforms` (`web`, `steam`, etc.) |
 | `server` | see below | Wrapfully server base URL (`build` and `deploy` only) |
-| `mode` | `extract` | `extract` unpacks the response zip into `./output/`; any other value saves `./output/{name}-{version}-{builder}.zip` |
+| `mode` | `extract` | `extract` unpacks the response zip into `./output/<platform>/`; any other value saves `./output/<platform>/{name}-{version}-{builder}.zip` |
 
 Examples:
 
@@ -402,7 +424,9 @@ mygame/
 │   └── index.html
 ├── output/
 │   ├── web-prebuild/     # after adaptfully prebuild web
-│   └── steam-prebuild/   # after adaptfully prebuild steam
+│   ├── steam-prebuild/   # after adaptfully prebuild steam
+│   ├── web/              # after adaptfully build/release web
+│   └── steam/            # after adaptfully build/release steam
 └── assets/
     └── meta/                    # shared files packaged as meta/ in the zip
         ├── icon-foreground.png
@@ -727,7 +751,7 @@ To sign the app, place your certificate at `assets/meta/deployments/<deployment>
 
 ## Response
 
-The server responds with a zip stream containing build artifacts (`.apk`, `.aab`, `.ipa`, `.app`, `.exe`, etc.) and optional status files. By default the client extracts this into `./output/`. Use a non-`extract` mode value to save the raw response zip instead.
+The server responds with a zip stream containing build artifacts (`.apk`, `.aab`, `.ipa`, `.app`, `.exe`, etc.) and optional status files. By default the client extracts this into `./output/<platform>/`. Use a non-`extract` mode value to save the raw response zip instead.
 
 Every build also includes `wrapfully-status.json` with structured `success`, `warn`, and `error` events. The client prints these after extraction and exits with code 1 if any errors were reported, so build failures do not crash the server silently.
 

package/lib/node/artifacts.js

@@ -17,18 +17,17 @@ export function buildOutputDir(pkg, outputRoot = 'output') {
 }
 
 /**
- * Where a platform's Wrapfully zip is extracted.
- * Multi-platform runs use `output/<platformKey>/` so siblings are not overwritten.
- * Single-platform runs keep `output/` for backward compatibility.
+ * Where a platform's Wrapfully zip is extracted: always `output/<platformKey>/`
+ * so sequential single-platform and multi-platform runs share one layout.
+ * Without a platform key, falls back to `outputRoot`.
  *
  * @param {string} outputRoot
  * @param {string} [platformKey]
- * @param {{ multiPlatform?: boolean }} [options]
  * @returns {string}
  */
-export function resolveExtractRoot(outputRoot, platformKey, options = {}) {
+export function resolveExtractRoot(outputRoot, platformKey) {
     const root = path.resolve(outputRoot);
-    if (options.multiPlatform && platformKey) {
+    if (platformKey) {
         return path.join(root, platformKey);
     }
     return root;
@@ -55,9 +54,10 @@ export function clearStaleBuildExtract(extractRoot = 'output') {
 
 /**
  * Resolve the artifact directory from a prior `adaptfully build` (or compatible zip extract).
+ * Prefers `output/<platform>/`; still accepts a legacy flat `output/` extract.
  *
  * @param {{ name: string, version: string, config?: { outputFolder?: string } }} pkg
- * @param {{ outputRoot?: string, platformKey?: string, multiPlatform?: boolean }} [options]
+ * @param {{ outputRoot?: string, platformKey?: string }} [options]
  * @returns {string}
  */
 export function resolveBuildArtifactDir(pkg, options = {}) {
@@ -65,7 +65,7 @@ export function resolveBuildArtifactDir(pkg, options = {}) {
     const candidates = [];
 
     if (options.platformKey) {
-        candidates.push(resolveExtractRoot(outputRoot, options.platformKey, { multiPlatform: true }));
+        candidates.push(resolveExtractRoot(outputRoot, options.platformKey));
     }
     candidates.push(outputRoot);
 

package/lib/node/pipeline.js

@@ -49,7 +49,7 @@ export function resolveWrapfullyRoute(buildSpec) {
 /**
  * @param {AdaptfullyStage} stage
  * @param {string} platformKey
- * @param {{ pkg: object, deployFolder: string, server?: string, mode?: string, deployment?: string, artifactPath?: string, log?: (message: string) => void, outputRoot?: string, accessToken?: string, encrypt?: boolean, encryptPublicKey?: string, wrapfullyConfig?: object, extractRoot?: string, multiPlatform?: boolean }} options
+ * @param {{ pkg: object, deployFolder: string, server?: string, mode?: string, deployment?: string, artifactPath?: string, log?: (message: string) => void, outputRoot?: string, accessToken?: string, encrypt?: boolean, encryptPublicKey?: string, wrapfullyConfig?: object, extractRoot?: string }} options
  */
 export async function runAdaptfullyStage(stage, platformKey, options) {
     if (!VALID_STAGES.has(stage)) {
@@ -62,7 +62,7 @@ export async function runAdaptfullyStage(stage, platformKey, options) {
     let deployments = resolveDeploymentsForPlatform(platformKey, pkg);
     const outputRoot = buildOutputDir(pkg, options.outputRoot);
     const extractRoot = options.extractRoot
-        ?? resolveExtractRoot(outputRoot, platformKey, { multiPlatform: options.multiPlatform === true });
+        ?? resolveExtractRoot(outputRoot, platformKey);
 
     if (options.deployment) {
         if (!deployments.includes(options.deployment)) {
@@ -85,7 +85,6 @@ export async function runAdaptfullyStage(stage, platformKey, options) {
         artifactPath = resolveBuildArtifactDir(pkg, {
             outputRoot: options.outputRoot,
             platformKey,
-            multiPlatform: options.multiPlatform,
         });
     }
 
@@ -198,7 +197,7 @@ export async function runAdaptfullyStage(stage, platformKey, options) {
 
 /**
  * Run a stage for one or more platforms sequentially.
- * Multi-platform extracts land in `output/<platformKey>/` so outputs do not overwrite.
+ * Each platform extracts to `output/<platformKey>/`.
  *
  * @param {AdaptfullyStage} stage
  * @param {string[]} platformKeys
@@ -206,21 +205,17 @@ export async function runAdaptfullyStage(stage, platformKey, options) {
  */
 export async function runAdaptfullyStages(stage, platformKeys, options) {
     const log = options.log ?? console.log;
-    const multiPlatform = platformKeys.length > 1;
     /** @type {{ platformKey: string, ok: boolean, result?: object, error?: Error }[]} */
     const results = [];
 
-    if (multiPlatform) {
+    if (platformKeys.length > 1) {
         log(`adaptfully: sequential ${stage} for ${platformKeys.join(', ')}`);
     }
 
     for (const platformKey of platformKeys) {
         log(`adaptfully: ——— ${stage} ${platformKey} ———`);
         try {
-            const result = await runAdaptfullyStage(stage, platformKey, {
-                ...options,
-                multiPlatform,
-            });
+            const result = await runAdaptfullyStage(stage, platformKey, options);
             results.push({ platformKey, ok: true, result });
         } catch (err) {
             const error = err instanceof Error ? err : new Error(String(err));
@@ -286,10 +281,10 @@ export async function adaptfullyFromCli(argv = process.argv) {
             + '  release   Yap release chore (build + configured deployments)\n'
             + '\n'
             + '  Multiple platforms (comma-separated or --platforms) run sequentially.\n'
-            + '  Multi-platform extracts go to output/<platform>/ so siblings are preserved.\n'
+            + '  Extracts always go to output/<platform>/ so siblings are preserved.\n'
             + '\n'
             + '  --deployment <key>  Target a single named deployment.\n'
-            + '  --artifact <path>   Prior build artifact directory (deploy only; default: ./output/ after build).\n'
+            + '  --artifact <path>   Prior build artifact directory (deploy only; default: ./output/<platform>/ after build).\n'
             + '  --encrypt           Envelope-encrypt chore to Wrapfully (optional; default key embedded).\n'
             + '  --encrypt-public-key <pem|path>  Override Wrapfully public key when encrypting.\n'
             + '\n'

package/lib/runtime/auth/google-auth.js

@@ -3,7 +3,6 @@
 (function registerGoogleAuth(ns) {
     const { configValue, getStorage } = ns.auth.helpers;
 
-    const DEFAULT_CLIENT_ID = '225754014403.apps.googleusercontent.com';
     const DEFAULT_SCOPES = 'openid email profile';
     const DEFAULT_TOKEN_KEY = 'adaptfully_google_token';
     const DEFAULT_AUTO_LOGIN_KEY = 'lastLoggedIn';
@@ -33,8 +32,13 @@
             return configValue('googleTokenKey', DEFAULT_TOKEN_KEY);
         }
 
+        /**
+         * Browser GIS OAuth client id only (`config.googleClientId`).
+         * Capacitor / Capgo builds use `platforms.<name>.socialLogin.google.webClientId` instead.
+         */
         #clientId() {
-            return configValue('googleClientId', DEFAULT_CLIENT_ID);
+            const clientId = configValue('googleClientId', '');
+            return typeof clientId === 'string' ? clientId.trim() : '';
         }
 
         #scopes() {
@@ -47,8 +51,17 @@
 
         whenReady(done) {
             const setup = () => {
+                const clientId = this.#clientId();
+                if (!clientId) {
+                    console.error(
+                        'google-auth: config.googleClientId is required '
+                        + '(browser GIS OAuth client; do not reuse socialLogin.google.webClientId).',
+                    );
+                    done({ error: 'google-auth: config.googleClientId is required' });
+                    return;
+                }
                 this.tokenClient = google.accounts.oauth2.initTokenClient({
-                    client_id: this.#clientId(),
+                    client_id: clientId,
                     scope: this.#scopes(),
                     callback: () => {},
                 });

package/lib/runtime/auth/social-auth.js

@@ -107,9 +107,11 @@
             const options = {};
 
             if (config.providers?.google !== false) {
+                // Capgo webClientId comes only from platforms.<name>.socialLogin
+                // (written to __ADAPTFULLY_SOCIAL_LOGIN__). Do not fall back to
+                // config.googleClientId — that key is for browser google-auth / GIS.
                 options.google = {
-                    webClientId: config.google?.webClientId
-                        || configValue('googleClientId', ''),
+                    webClientId: config.google?.webClientId || '',
                     iOSClientId: config.google?.iOSClientId,
                     iOSServerClientId: config.google?.iOSServerClientId
                         || config.google?.webClientId,

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@makefully/adaptfully",
-    "version": "4.3.0",
+    "version": "5.0.1",
     "description": "Platform abstraction and Wrapfully deploy client for Makefully games",
     "type": "module",
     "main": "./lib/node/index.js",