@makefully/adaptfully 5.0.5 → 5.0.7

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to this project are documented in this file.
 
+## 5.0.7 — 2026-10-07
+
+### Added
+
+- Gitignore patterns for `assets/meta/deployments/**/s3.json` and `**/showfully.json`.
+- Docs for web deploy via SFTP (atomic `cleanRemote`), AWS S3, and Showfully folder (credential shapes consumed by Wrapfully).
+
+## 5.0.6 — 2026-10-07
+
+### Changed
+
+- **`google-auth`** persists the GIS access token in **`localStorage`** by default (was `sessionStorage`), so web sign-in survives browser restarts until explicit logout or Google silent reauth fails. Opt back into tab-only tokens with `config.googleTokenStorage: 'sessionStorage'`. Existing `sessionStorage` tokens are migrated once on read.
+
 ## 5.0.5 — 2026-10-06
 
 ### Changed

package/README.md

@@ -236,7 +236,8 @@ Optional config keys:
 | Key | Default | Purpose |
 |-----|---------|---------|
 | `googleClientId` | *(required)* | Browser GIS OAuth client id |
-| `googleTokenKey` | `adaptfully_google_token` | `sessionStorage` key for the access token |
+| `googleTokenKey` | `adaptfully_google_token` | Storage key for the GIS access token |
+| `googleTokenStorage` | `localStorage` | `localStorage` (survives browser restart) or `sessionStorage` (tab-only) |
 | `googleScopes` | `openid email profile` | OAuth scopes |
 | `autoLoginStorageKey` | `lastLoggedIn` | Storage key written with the user id on login |
 
@@ -436,11 +437,17 @@ mygame/
             │   └── sftp.json
             ├── web-prod/
             │   └── sftp.json
+            ├── web-s3-prod/
+            │   ├── manifest.json   # { "type": "s3" }
+            │   └── s3.json
+            ├── web-showfully/
+            │   ├── manifest.json   # { "type": "showfully" }
+            │   └── showfully.json
             └── steam/           # default deployment for the `steam` platform
                 └── steam.json
 ```
 
-The selected deployment's folder is shipped as `meta/publish/` in the zip, so per-platform credential file names (`build.json`, `sftp.json`, `steam.json`, `apple.json`, `google.json`, `ms.json`, `android/`, `ms/`) live inside `assets/meta/deployments/<key>/`.
+The selected deployment's folder is shipped as `meta/publish/` in the zip, so per-platform credential file names (`build.json`, `sftp.json`, `s3.json`, `showfully.json`, `steam.json`, `apple.json`, `google.json`, `ms.json`, `android/`, `ms/`) live inside `assets/meta/deployments/<key>/`.
 
 Icons (`icon-foreground.png`, `icon-background.png`) are required for mobile, desktop, and Steam builds. If either file is missing from `assets/meta/`, Adaptfully **warns** and ships packaged placeholder icons for that build so Wrapfully can still run.
 
@@ -717,7 +724,9 @@ Release `win` builds can be signed with `assets/meta/deployments/<deployment>/ms
 
 #### Web (`web` / `webapp`)
 
-`adaptfully deploy web` prebuilds and POSTs to the Wrapfully **`webapp`** builder (same conduit as Steam). Put an `sftp.json` in each web deployment folder (e.g. `assets/meta/deployments/web-prod/sftp.json`); the selected deployment is zipped as `meta/publish/sftp.json` for Wrapfully to deploy via SFTP. The inner key stays the builder name (`webapp`).
+`adaptfully deploy web` prebuilds and POSTs to the Wrapfully **`webapp`** builder (same conduit as Steam). Each web deployment folder under `assets/meta/deployments/<key>/` is zipped as `meta/publish/` for Wrapfully. Set `manifest.json` `"type"` to `sftp`, `s3`, or `showfully` (or rely on the credential filename). The inner settings key stays the builder name (`webapp`).
+
+**SFTP** — `sftp.json`:
 
 ```json
 {
@@ -735,7 +744,42 @@ Release `win` builds can be signed with `assets/meta/deployments/<deployment>/ms
 }
 ```
 
-See [Wrapfully README](https://github.com/Makefully-Studios/wrapfully-client) for `uploadMode`, `serviceWorker`, `metaWeb`, and `cleanRemote`.
+`path` is the remote site root or a longer subfolder path. With `uploadMode: "direct"` and `cleanRemote: true`, Wrapfully uploads to `[path]-temp`, then deletes the live directory and renames temp → `path` (atomic replace). `cleanRemote` is ignored for `versioned` uploads.
+
+**AWS S3** — `s3.json` + `manifest.json` `{ "type": "s3" }`:
+
+```json
+{
+  "webapp": {
+    "region": "us-east-1",
+    "bucket": "my-games-cdn",
+    "prefix": "",
+    "uploadMode": "direct",
+    "cleanRemote": false,
+    "accessKeyId": "(iam access key)",
+    "secretAccessKey": "(iam secret)"
+  }
+}
+```
+
+`prefix: ""` deploys to the bucket root; `"games/mygame"` deploys under that key prefix. `cleanRemote: true` uses an atomic `prefix-temp` swap (refuses empty prefix unless `allowBucketRootWipe: true`).
+
+**Showfully folder** — `showfully.json` + `manifest.json` `{ "type": "showfully" }`:
+
+```json
+{
+  "webapp": {
+    "server": "https://make.makefullystudios.com/",
+    "folder": "MyGame",
+    "path": "",
+    "accessToken": "sfpat_…"
+  }
+}
+```
+
+`folder` is a top-level Showfully folder name. `path: ""` writes at that folder’s root; `"web"` (or nested) prefixes zip entries under a subfolder. `accessToken` is required (Wrapfully workers cannot reuse the Yap submit PAT).
+
+See [Wrapfully README](https://github.com/Makefully-Studios/wrapfully-client) for `uploadMode`, `serviceWorker`, `metaWeb`, and deployer details.
 
 #### Windows (`win`, `win-dev`, `uwp`)
 

package/lib/node/publish-credentials.js

@@ -6,6 +6,8 @@ import { stdin as input, stdout as output } from 'node:process';
 /** Patterns that should never be committed from deployment credential folders. */
 export const PUBLISH_CREDENTIAL_GITIGNORE_PATTERNS = [
     'assets/meta/deployments/**/sftp.json',
+    'assets/meta/deployments/**/s3.json',
+    'assets/meta/deployments/**/showfully.json',
     'assets/meta/deployments/**/steam.json',
     'assets/meta/deployments/**/build.json',
     'assets/meta/deployments/**/google.json',

package/lib/runtime/auth/google-auth.js

@@ -1,4 +1,4 @@
-/* global google, sessionStorage, window */
+/* global google, localStorage, sessionStorage, window */
 
 (function registerGoogleAuth(ns) {
     const { configValue, getStorage } = ns.auth.helpers;
@@ -6,6 +6,7 @@
     const DEFAULT_SCOPES = 'openid email profile';
     const DEFAULT_TOKEN_KEY = 'adaptfully_google_token';
     const DEFAULT_AUTO_LOGIN_KEY = 'lastLoggedIn';
+    const DEFAULT_TOKEN_STORAGE = 'localStorage';
 
     class GoogleAuthPlugin {
         constructor() {
@@ -32,6 +33,27 @@
             return configValue('googleTokenKey', DEFAULT_TOKEN_KEY);
         }
 
+        /**
+         * Where the GIS access token is persisted.
+         * Default `localStorage` so sign-in survives browser restarts until logout
+         * (or Google silent reauth fails). Use `sessionStorage` for tab-only tokens.
+         */
+        #tokenStorageName() {
+            const raw = configValue('googleTokenStorage', DEFAULT_TOKEN_STORAGE);
+            return raw === 'sessionStorage' ? 'sessionStorage' : 'localStorage';
+        }
+
+        #tokenStore() {
+            try {
+                if (this.#tokenStorageName() === 'sessionStorage') {
+                    return typeof sessionStorage !== 'undefined' ? sessionStorage : null;
+                }
+                return typeof localStorage !== 'undefined' ? localStorage : null;
+            } catch {
+                return null;
+            }
+        }
+
         /**
          * Browser GIS OAuth client id only (`config.googleClientId`).
          * Capacitor / Capgo builds use `platforms.<name>.socialLogin.google.webClientId` instead.
@@ -95,16 +117,91 @@
             this.authenticated = !!(this.user.id && this.user.email);
         }
 
+        #readStoredToken() {
+            const key = this.#tokenKey(),
+                primary = this.#tokenStore();
+            let token = '';
+
+            try {
+                token = (primary && primary.getItem(key)) || '';
+            } catch {
+                token = '';
+            }
+
+            // One-time migrate: older builds kept the token in sessionStorage.
+            if (!token && this.#tokenStorageName() === 'localStorage') {
+                try {
+                    token = (typeof sessionStorage !== 'undefined' && sessionStorage.getItem(key)) || '';
+                    if (token && primary) {
+                        primary.setItem(key, token);
+                        sessionStorage.removeItem(key);
+                    }
+                } catch {
+                    /* ignore quota / private-mode */
+                }
+            }
+
+            return token;
+        }
+
+        #writeStoredToken(token) {
+            const key = this.#tokenKey(),
+                primary = this.#tokenStore();
+
+            try {
+                if (primary) {
+                    primary.setItem(key, token);
+                }
+            } catch {
+                /* ignore */
+            }
+
+            // Drop the legacy session copy so tab-close cannot leave a stale twin.
+            if (this.#tokenStorageName() === 'localStorage') {
+                try {
+                    if (typeof sessionStorage !== 'undefined') {
+                        sessionStorage.removeItem(key);
+                    }
+                } catch {
+                    /* ignore */
+                }
+            }
+        }
+
+        #clearStoredToken() {
+            const key = this.#tokenKey();
+
+            try {
+                this.#tokenStore()?.removeItem(key);
+            } catch {
+                /* ignore */
+            }
+            try {
+                if (typeof sessionStorage !== 'undefined') {
+                    sessionStorage.removeItem(key);
+                }
+            } catch {
+                /* ignore */
+            }
+            try {
+                if (typeof localStorage !== 'undefined') {
+                    localStorage.removeItem(key);
+                }
+            } catch {
+                /* ignore */
+            }
+        }
+
         #clearSession() {
             this.accessToken = '';
             this.user = null;
             this.authenticated = false;
-            sessionStorage.removeItem(this.#tokenKey());
+            this.#clearStoredToken();
         }
 
         #loadStoredToken() {
             if (!this.accessToken) {
-                this.accessToken = sessionStorage.getItem(this.#tokenKey()) || '';
+                this.accessToken = this.#readStoredToken();
             }
         }
 
@@ -126,7 +223,7 @@
                 })
                 .then((data) => {
                     this.accessToken = token;
-                    sessionStorage.setItem(this.#tokenKey(), token);
+                    this.#writeStoredToken(token);
                     this.#applyUserInfo(data);
                     callback();
                 })

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@makefully/adaptfully",
-    "version": "5.0.5",
+    "version": "5.0.7",
     "description": "Platform abstraction and Wrapfully deploy client for Makefully games",
     "type": "module",
     "main": "./lib/node/index.js",