@makefully/adaptfully 5.1.1 → 5.1.2

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to this project are documented in this file.
 
+## 5.1.2 — 2026-11-10
+
+### Fixed
+
+- **Deploy preserveArtifacts** — `adaptfully deploy` no longer deletes `artifacts/` and `wrapfully-build.json` before packaging the prior build extract, so the IPA/AAB survives into the deploy chore.
+- **Apple PKCS#12 export** — `apple-signing` (and iOS credential docs) export `.p12` with PBE-SHA1-3DES + SHA1 MAC so macOS `security import` accepts the passphrase.
+
 ## 5.1.1 — 2026-11-05
 
 ### Added

package/docs/credentials/ios.md

@@ -104,8 +104,11 @@ Skip this if step 1 already exported `development.p12` / `distribution.p12`.
 ```bash
 # From the folder that has private.key and the downloaded .cer
 openssl x509 -in Certificates.cer -inform DER -out cert.pem -outform PEM
-openssl pkcs12 -export -inkey private.key -in cert.pem -out development.p12
+openssl pkcs12 -export -inkey private.key -in cert.pem -out development.p12 \
+  -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES -macalg sha1
 # or distribution.p12 — use the matching kind
+# (AES-256 / SHA-256 PKCS#12 often fails macOS `security import` with a false
+# "wrong password?" MAC error — stick to the classic algorithms above.)
 ```
 
 Move the `.p12` to `assets/meta/deployments/ios/apple/`.

package/lib/node/apple-signing.js

@@ -156,26 +156,28 @@ export async function exportAppleP12(options) {
     const pemPath = `${options.cerPath}.pem`;
     await run(['x509', '-in', options.cerPath, '-inform', 'DER', '-out', pemPath, '-outform', 'PEM']);
 
+    // Prefer classic PBEwithSHA1And3-KeyTripleDES + SHA1 MAC. OpenSSL's newer
+    // AES-256 / SHA-256 PKCS#12 defaults often fail macOS `security import`
+    // with "MAC verification failed (wrong password?)" even when the passphrase
+    // is correct.
+    const exportArgs = (certIn) => [
+        'pkcs12',
+        '-export',
+        '-inkey', options.keyPath,
+        '-in', certIn,
+        '-out', options.p12Path,
+        '-passout', `pass:${options.p12Password}`,
+        '-keypbe', 'PBE-SHA1-3DES',
+        '-certpbe', 'PBE-SHA1-3DES',
+        '-macalg', 'sha1',
+    ];
+
     try {
-        await run([
-            'pkcs12',
-            '-export',
-            '-inkey', options.keyPath,
-            '-in', pemPath,
-            '-out', options.p12Path,
-            '-passout', `pass:${options.p12Password}`,
-        ]);
+        await run(exportArgs(pemPath));
     } catch (derErr) {
         // Some downloads are already PEM
         try {
-            await run([
-                'pkcs12',
-                '-export',
-                '-inkey', options.keyPath,
-                '-in', options.cerPath,
-                '-out', options.p12Path,
-                '-passout', `pass:${options.p12Password}`,
-            ]);
+            await run(exportArgs(options.cerPath));
         } catch {
             throw derErr;
         }

package/lib/node/artifacts.js

@@ -38,15 +38,22 @@ export function resolveExtractRoot(outputRoot, platformKey) {
  * Remove prior extract artifacts in `extractRoot` only (artifacts/, status,
  * manifest). Does not wipe sibling platform folders under output/.
  *
+ * Deploy packages from the prior build extract in place — pass
+ * `{ preserveArtifacts: true }` so the IPA/AAB and manifest are not deleted
+ * before `createDeployArchive` runs.
+ *
  * @param {string} [extractRoot='output']
+ * @param {{ preserveArtifacts?: boolean }} [options]
  */
-export function clearStaleBuildExtract(extractRoot = 'output') {
+export function clearStaleBuildExtract(extractRoot = 'output', options = {}) {
     const root = path.resolve(extractRoot);
-    const stalePaths = [
-        path.join(root, 'artifacts'),
-        path.join(root, MANIFEST_NAME),
-        path.join(root, STATUS_NAME),
-    ];
+    const stalePaths = options.preserveArtifacts
+        ? [path.join(root, STATUS_NAME)]
+        : [
+            path.join(root, 'artifacts'),
+            path.join(root, MANIFEST_NAME),
+            path.join(root, STATUS_NAME),
+        ];
 
     for (const stalePath of stalePaths) {
         fs.rmSync(stalePath, { recursive: true, force: true });

package/lib/node/deploy.js

@@ -257,7 +257,11 @@ export async function send (
 
     if (mode === 'extract') {
         fs.mkdirSync(extractRoot, { recursive: true });
-        clearStaleBuildExtract(extractRoot);
+        // Deploy zips from extractRoot itself; wiping artifacts/manifest here
+        // deleted the IPA before createDeployArchive could package it.
+        clearStaleBuildExtract(extractRoot, {
+            preserveArtifacts: stage === 'deploy',
+        });
     }
 
     let archiveStream;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@makefully/adaptfully",
-    "version": "5.1.1",
+    "version": "5.1.2",
     "description": "Platform abstraction and Wrapfully deploy client for Makefully games",
     "type": "module",
     "main": "./lib/node/index.js",