@mpgd/cli 0.35.0 → 0.36.1

package/dist/android-bundle-signer.d.ts

@@ -0,0 +1,2 @@
+/** Recheck the signer of these AAB bytes before persisting or submitting them. */
+export declare function inspectAndroidBundleSigner(aabFile: string): Promise<string>;

package/dist/android-bundle-signer.js

@@ -0,0 +1,38 @@
+import path from 'node:path';
+import { runReleaseProcess } from './deploy-process.js';
+import { artifactInspectionEnvironment } from './artifact-inspection-environment.js';
+const signerPattern = /\bSHA256:\s*((?:[A-Fa-f0-9]{2}:){31}[A-Fa-f0-9]{2})/u;
+const timeoutMs = 60_000;
+const maxOutputBytes = 1024 * 1024;
+/** Recheck the signer of these AAB bytes before persisting or submitting them. */
+export async function inspectAndroidBundleSigner(aabFile) {
+    const bundle = path.resolve(aabFile);
+    const options = {
+        cwd: path.dirname(bundle),
+        timeoutMs,
+        maxOutputBytes,
+        environment: artifactInspectionEnvironment(),
+    };
+    const verified = await runReleaseProcess({
+        ...options,
+        command: 'jarsigner',
+        args: ['-verify', '-verbose', bundle],
+    });
+    if (verified.truncated || !/\bjar verified\./u.test(verified.output)
+        || /jar is unsigned|contains unsigned entries|has expired/iu.test(verified.output)) {
+        throw new Error('Android App Bundle JAR signature verification failed.');
+    }
+    const certificate = await runReleaseProcess({
+        ...options,
+        command: 'keytool',
+        args: ['-J-Duser.language=en', '-printcert', '-jarfile', bundle],
+    });
+    const signer = /\bSigner #1:/u.test(certificate.output)
+        ? signerPattern.exec(certificate.output)?.[1]
+        : undefined;
+    if (certificate.truncated || /\bSigner #2:/u.test(certificate.output)
+        || signer === undefined) {
+        throw new Error('Android App Bundle must have exactly one inspectable signer.');
+    }
+    return signer.replaceAll(':', '').toLowerCase();
+}

package/dist/android-signing-session.d.ts

@@ -0,0 +1,22 @@
+export interface AndroidUploadSigningInput {
+  readonly keystoreFile: string;
+  readonly storePassword: string;
+  readonly keyAlias: string;
+  readonly keyPassword: string;
+  readonly expectedCertSha256: string;
+  readonly environment?: NodeJS.ProcessEnv;
+  readonly signal?: AbortSignal;
+  readonly temporaryParent?: string;
+}
+export interface AndroidUploadSigningSession {
+  readonly environment: NodeJS.ProcessEnv;
+  readonly expectedCertSha256: string;
+  readonly temporaryKeystore: string;
+  readonly gradleInitScript: string;
+  readonly secretValues: readonly string[];
+  dispose(): void;
+}
+/** Restore one upload key to an owned temporary path and preflight its identity. */
+export declare function prepareAndroidUploadSigningSession(input: AndroidUploadSigningInput): Promise<AndroidUploadSigningSession>;
+/** Always remove the restored key after a build, failure, or cancellation. */
+export declare function withAndroidUploadSigningSession<T>(input: AndroidUploadSigningInput, action: (session: AndroidUploadSigningSession) => Promise<T>): Promise<T>;

package/dist/android-signing-session.js

@@ -0,0 +1,198 @@
+import { chmodSync, copyFileSync, mkdtempSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { runReleaseProcess } from './deploy-process.js';
+const fingerprintPattern = /^[0-9A-F]{64}$/u;
+const maximumKeystoreBytes = 64 * 1024 * 1024;
+const initScript = `gradle.beforeProject { project ->
+  if (project.path != ':app') return
+  project.pluginManager.withPlugin('com.android.application') {
+    def android = project.extensions.getByName('android')
+    def signing = android.signingConfigs.findByName('mpgdUpload')
+      ?: android.signingConfigs.create('mpgdUpload')
+    signing.storeFile = project.file(System.getenv('MPGD_ANDROID_SIGNING_KEYSTORE'))
+    signing.storePassword = System.getenv('MPGD_ANDROID_SIGNING_STORE_PASSWORD')
+    signing.keyAlias = System.getenv('MPGD_ANDROID_SIGNING_KEY_ALIAS')
+    signing.keyPassword = System.getenv('MPGD_ANDROID_SIGNING_KEY_PASSWORD')
+    android.buildTypes.getByName('release').signingConfig = signing
+  }
+}
+gradle.projectsEvaluated {
+  def app = gradle.rootProject.findProject(':app')
+  if (app == null || app.extensions.findByName('android') == null
+      || app.extensions.getByName('android').buildTypes.getByName('release').signingConfig?.name
+        != 'mpgdUpload') {
+    throw new GradleException('The game shell did not accept mpgd upload signing.')
+  }
+}
+`;
+/** Restore one upload key to an owned temporary path and preflight its identity. */
+export async function prepareAndroidUploadSigningSession(input) {
+    const expectedCertSha256 = input.expectedCertSha256.replace(/:/gu, '').toUpperCase();
+    const keyAlias = input.keyAlias.trim();
+    if (!fingerprintPattern.test(expectedCertSha256) || keyAlias === ''
+        || input.storePassword === '' || input.keyPassword === '') {
+        throw new Error('Android upload signing requires an alias, passwords and SHA-256 certificate.');
+    }
+    const source = path.resolve(input.keystoreFile);
+    let sourceStat;
+    try {
+        sourceStat = statSync(source);
+    }
+    catch {
+        throw new Error(`Android upload keystore is missing or unreadable: ${source}`);
+    }
+    if (!sourceStat.isFile() || sourceStat.size < 1 || sourceStat.size > maximumKeystoreBytes) {
+        throw new Error('Android upload keystore must be a nonempty regular file under 64 MiB.');
+    }
+    const parent = input.temporaryParent ?? tmpdir();
+    const ownedRoot = mkdtempSync(path.join(parent, 'mpgd-android-upload-'));
+    const temporaryKeystore = path.join(ownedRoot, 'upload-keystore');
+    const gradleInitScript = path.join(ownedRoot, 'upload-signing.init.gradle');
+    const environment = {
+        ...(input.environment ?? process.env),
+        MPGD_ANDROID_SIGNING_KEYSTORE: temporaryKeystore,
+        MPGD_ANDROID_SIGNING_STORE_PASSWORD: input.storePassword,
+        MPGD_ANDROID_SIGNING_KEY_ALIAS: keyAlias,
+        MPGD_ANDROID_SIGNING_KEY_PASSWORD: input.keyPassword,
+        MPGD_ANDROID_SIGNING_INIT_SCRIPT: gradleInitScript,
+        MPGD_ANDROID_UPLOAD_CERT_SHA256: expectedCertSha256,
+    };
+    delete environment.MPGD_ANDROID_UPLOAD_KEYSTORE;
+    const secretValues = [input.storePassword, input.keyPassword];
+    try {
+        if (process.platform !== 'win32') {
+            chmodSync(ownedRoot, 0o700);
+        }
+        copyFileSync(source, temporaryKeystore);
+        chmodSync(temporaryKeystore, 0o600);
+        const javaHome = environment.JAVA_HOME?.trim();
+        const keytoolExecutable = process.platform === 'win32' ? 'keytool.exe' : 'keytool';
+        const keytool = javaHome === undefined || javaHome === ''
+            ? keytoolExecutable
+            : path.join(javaHome, 'bin', keytoolExecutable);
+        const listed = await runReleaseProcess({
+            command: keytool,
+            args: [
+                '-J-Duser.language=en',
+                '-list',
+                '-v',
+                '-keystore',
+                temporaryKeystore,
+                '-alias',
+                keyAlias,
+                '-storepass:env',
+                'MPGD_ANDROID_SIGNING_STORE_PASSWORD',
+            ],
+            cwd: ownedRoot,
+            environment,
+            timeoutMs: 30_000,
+            signal: input.signal,
+            secretValues,
+            captureMachineStdout: true,
+        });
+        if (listed.truncated || listed.machineStdout === undefined) {
+            throw new Error('Android upload certificate inspection output was truncated.');
+        }
+        const observed = /\bSHA256:\s*((?:[0-9A-Fa-f]{2}:){31}[0-9A-Fa-f]{2})/u
+            .exec(listed.machineStdout)?.[1]?.replace(/:/gu, '').toUpperCase();
+        if (observed !== expectedCertSha256) {
+            throw new Error('Android upload keystore certificate does not match the expected SHA-256.');
+        }
+        const typeListing = await runReleaseProcess({
+            command: keytool,
+            args: [
+                '-J-Duser.language=en',
+                '-list',
+                '-keystore',
+                temporaryKeystore,
+                '-storepass:env',
+                'MPGD_ANDROID_SIGNING_STORE_PASSWORD',
+            ],
+            cwd: ownedRoot,
+            environment,
+            timeoutMs: 30_000,
+            signal: input.signal,
+            secretValues,
+            captureMachineStdout: true,
+        });
+        if (typeListing.truncated || typeListing.machineStdout === undefined) {
+            throw new Error('Android upload keystore type inspection output was truncated.');
+        }
+        // -list -v with -alias omits the keystore type. PKCS12 ignores a distinct
+        // key password during -certreq, so Gradle must receive the store password.
+        if (/^Keystore type:\s*PKCS12\s*$/imu.test(typeListing.machineStdout)
+            && input.keyPassword !== input.storePassword) {
+            throw new Error('PKCS12 upload signing requires the key password to equal the store password.');
+        }
+        await runReleaseProcess({
+            command: keytool,
+            args: [
+                '-J-Duser.language=en',
+                '-certreq',
+                '-keystore',
+                temporaryKeystore,
+                '-alias',
+                keyAlias,
+                '-file',
+                path.join(ownedRoot, 'upload.csr'),
+                '-storepass:env',
+                'MPGD_ANDROID_SIGNING_STORE_PASSWORD',
+                '-keypass:env',
+                'MPGD_ANDROID_SIGNING_KEY_PASSWORD',
+            ],
+            cwd: ownedRoot,
+            environment,
+            timeoutMs: 30_000,
+            signal: input.signal,
+            secretValues,
+        });
+        writeFileSync(gradleInitScript, initScript, { flag: 'wx', mode: 0o600 });
+        return {
+            environment,
+            expectedCertSha256,
+            temporaryKeystore,
+            gradleInitScript,
+            secretValues,
+            dispose() {
+                removeOwnedSigningRoot(ownedRoot);
+            },
+        };
+    }
+    catch (error) {
+        try {
+            removeOwnedSigningRoot(ownedRoot);
+        }
+        catch (cleanupError) {
+            throw new AggregateError([error, cleanupError], 'Android upload signing preparation and cleanup both failed.');
+        }
+        throw error;
+    }
+}
+/** Always remove the restored key after a build, failure, or cancellation. */
+export async function withAndroidUploadSigningSession(input, action) {
+    const session = await prepareAndroidUploadSigningSession(input);
+    let outcome;
+    try {
+        outcome = { ok: true, value: await action(session) };
+    }
+    catch (error) {
+        outcome = { ok: false, error };
+    }
+    try {
+        session.dispose();
+    }
+    catch (cleanupError) {
+        if (!outcome.ok) {
+            throw new AggregateError([outcome.error, cleanupError], 'Android upload signing action and cleanup both failed.');
+        }
+        throw cleanupError;
+    }
+    if (!outcome.ok) {
+        throw outcome.error;
+    }
+    return outcome.value;
+}
+function removeOwnedSigningRoot(root) {
+    rmSync(root, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 });
+}

package/dist/artifact-inspection-environment.d.ts

@@ -0,0 +1,2 @@
+/** Artifact inspectors need tool locations, never release-state or signing credentials. */
+export declare function artifactInspectionEnvironment(source?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;

package/dist/artifact-inspection-environment.js

@@ -0,0 +1,31 @@
+const allowedInspectionEnvironmentNames = [
+    'PATH',
+    'Path',
+    'HOME',
+    'TMPDIR',
+    'TMP',
+    'TEMP',
+    'LANG',
+    'LC_ALL',
+    'LC_CTYPE',
+    'JAVA_HOME',
+    'ANDROID_HOME',
+    'ANDROID_SDK_ROOT',
+    'DEVELOPER_DIR',
+    'SDKROOT',
+    'SystemRoot',
+    'windir',
+    'PATHEXT',
+    'USERPROFILE',
+];
+/** Artifact inspectors need tool locations, never release-state or signing credentials. */
+export function artifactInspectionEnvironment(source = process.env) {
+    const result = {};
+    for (const name of allowedInspectionEnvironmentNames) {
+        const value = source[name];
+        if (value !== undefined) {
+            result[name] = value;
+        }
+    }
+    return result;
+}

package/dist/asc-pin.json

@@ -0,0 +1,26 @@
+{
+  "repository": "rorkai/App-Store-Connect-CLI",
+  "version": "5.5.0",
+  "assets": {
+    "darwin-arm64": {
+      "name": "asc_5.5.0_macOS_arm64",
+      "sha256": "8d0c38ad9c7e3094d2fc9b7b5a86d7c9a08fd2b36a3df081aefbf60503035b29"
+    },
+    "darwin-x64": {
+      "name": "asc_5.5.0_macOS_amd64",
+      "sha256": "296553af9cd63f9f93782f22dc12077c3d6678ee57cf52e05aee7e850fe13f63"
+    },
+    "linux-arm64": {
+      "name": "asc_5.5.0_linux_arm64",
+      "sha256": "c8f6d0adf7ca3ad41391adda3c83ff2023b921f4f9b077c6498c6d18b39aaebd"
+    },
+    "linux-x64": {
+      "name": "asc_5.5.0_linux_amd64",
+      "sha256": "712b29762c7ad8c2624bccc9752a30ff3c1d4c5b4cb689a00680f45081939239"
+    },
+    "win32-x64": {
+      "name": "asc_5.5.0_windows_amd64.exe",
+      "sha256": "52d1eb290139570b377b8fca439c84be7275934209dd342bb2a8b44f14e00c89"
+    }
+  }
+}

package/dist/capacitor-shell-starter.d.ts

@@ -24,12 +24,34 @@ export interface CapacitorShellStarterPlan {
 * never rewritten by this initializer.
 */
 export declare function planCapacitorShellStarter(input: CapacitorShellStarterInput): CapacitorShellStarterPlan;
+export declare function assertCapacitorAppId(appId: string): void;
 export declare function applyCapacitorShellStarter(plan: CapacitorShellStarterPlan, installStagedFile?: (temporary: string, destination: string) => void): void;
 export interface CapacitorShellCommandRunner {
   run(command: string, args: readonly string[], cwd: string): void;
 }
 /** Materialize only missing native projects after the non-destructive plan is applied. */
 export declare function materializeCapacitorShellStarter(plan: CapacitorShellStarterPlan, runner?: CapacitorShellCommandRunner): void;
+/**
+* Backup rules for API < 31 (android:fullBackupContent). Every data domain is
+* excluded so nothing from the app's private storage reaches a backup even
+* if a game later turns android:allowBackup back on.
+*/
+export declare const androidBackupRulesXml: string;
+/**
+* Data extraction rules for API 31+ (android:dataExtractionRules). Android 12
+* ignores android:allowBackup="false" for device-to-device transfer on some
+* devices, so cloud backup and device transfer each exclude every domain.
+*/
+export declare const androidDataExtractionRulesXml: string;
+/** Manifest application attributes that opt the shell out of backups. */
+export declare const androidManifestBackupAttributes: readonly (readonly [string, string])[];
+/**
+* Set the backup opt-out attributes on the manifest application node and bind
+* the tools namespace on the manifest root. Existing values are replaced in
+* place; the attribute group keeps the indentation of the first attribute so
+* the result is stable across repeated runs.
+*/
+export declare function applyAndroidManifestBackupPolicy(manifest: string): string;
 /** Fail closed when a Release plist hardcodes values independently of Xcode build settings. */
 export declare function assertIosReleasePlistIdentity(source: string): void;
 export declare function assertAndroidReleaseDisplayName(shellApp: string, expectedDisplayName: string): void;

package/dist/capacitor-shell-starter.js

@@ -31,12 +31,7 @@ export function planCapacitorShellStarter(input) {
     if (!lstatSync(gameRoot).isDirectory()) {
         throw new Error('Capacitor shell game root must be a directory.');
     }
-    if (!appIdPattern.test(input.appId)) {
-        throw new Error('Capacitor app ID must be a lowercase reverse-domain identifier.');
-    }
-    if (input.appId.split('.').some((segment) => javaKeywords.has(segment))) {
-        throw new Error('Capacitor app ID cannot contain Java keyword segments.');
-    }
+    assertCapacitorAppId(input.appId);
     if (input.displayName.trim() !== input.displayName
         || input.displayName.length === 0 || input.displayName.length > 80) {
         throw new Error('Capacitor display name must be 1-80 characters without outer whitespace.');
@@ -349,6 +344,14 @@ export function planCapacitorShellStarter(input) {
         nativePlatformsToAdd,
     };
 }
+export function assertCapacitorAppId(appId) {
+    if (!appIdPattern.test(appId)) {
+        throw new Error('Capacitor app ID must be a lowercase reverse-domain identifier.');
+    }
+    if (appId.split('.').some((segment) => javaKeywords.has(segment))) {
+        throw new Error('Capacitor app ID cannot contain Java keyword segments.');
+    }
+}
 export function applyCapacitorShellStarter(plan, installStagedFile = renameSync) {
     const staged = plan.files.filter((file) => !plan.nativePlatformsToAdd.some((platform) => file.path.startsWith(`${shellPath}/${platform}/`))).map((file) => {
         const destination = safeDestination(plan.gameRoot, file.path);
@@ -447,10 +450,14 @@ export function materializeCapacitorShellStarter(plan, runner = { run: runComman
     runner.run('pnpm', ['install', '--no-frozen-lockfile'], plan.gameRoot);
     runner.run('pnpm', ['--dir', shellPath, 'install', '--ignore-workspace', '--no-frozen-lockfile'], plan.gameRoot);
     for (const platform of plan.nativePlatformsToAdd) {
-        if (!existsSync(path.join(plan.gameRoot, shellPath, platform))) {
+        const generatedNow = !existsSync(path.join(plan.gameRoot, shellPath, platform));
+        if (generatedNow) {
             runner.run('pnpm', ['--dir', shellPath, 'cap', 'add', platform], plan.gameRoot);
         }
         const manifest = readJsonObject(path.join(plan.gameRoot, shellPath, 'mpgd.native-shell.json'));
+        if (platform === 'android' && generatedNow) {
+            materializeAndroidBackupPolicy(plan.gameRoot);
+        }
         if (platform === 'ios') {
             materializeIosArchiveScheme(plan.gameRoot);
             const relative = `${shellPath}/ios/App/App/Info-Smoke.plist`;
@@ -470,6 +477,122 @@ export function materializeCapacitorShellStarter(plan, runner = { run: runComman
         throw new Error('Capacitor shell changed during installation; rerun the initializer.');
     }
 }
+const androidToolsNamespace = 'http://schemas.android.com/tools';
+const androidBackupDomains = ['root', 'file', 'database', 'sharedpref', 'external'];
+const androidBackupExcludes = androidBackupDomains
+    .map((domain) => `<exclude domain="${domain}" path="." />`);
+/**
+ * Backup rules for API < 31 (android:fullBackupContent). Every data domain is
+ * excluded so nothing from the app's private storage reaches a backup even
+ * if a game later turns android:allowBackup back on.
+ */
+export const androidBackupRulesXml = [
+    '<?xml version="1.0" encoding="utf-8"?>',
+    '<!--',
+    '  Generated by mpgd target init capacitor. WebView storage and the',
+    '  game-services SharedPreferences save store hold player data, so the whole',
+    '  private data tree stays out of Android backups.',
+    '-->',
+    '<full-backup-content>',
+    ...androidBackupExcludes.map((line) => `    ${line}`),
+    '</full-backup-content>',
+    '',
+].join('\n');
+/**
+ * Data extraction rules for API 31+ (android:dataExtractionRules). Android 12
+ * ignores android:allowBackup="false" for device-to-device transfer on some
+ * devices, so cloud backup and device transfer each exclude every domain.
+ */
+export const androidDataExtractionRulesXml = [
+    '<?xml version="1.0" encoding="utf-8"?>',
+    '<!--',
+    '  Generated by mpgd target init capacitor. WebView storage and the',
+    '  game-services SharedPreferences save store hold player data, so neither',
+    '  cloud backup nor Android 12+ device-to-device transfer may copy them.',
+    '-->',
+    '<data-extraction-rules>',
+    '    <cloud-backup>',
+    ...androidBackupExcludes.map((line) => `        ${line}`),
+    '    </cloud-backup>',
+    '    <device-transfer>',
+    ...androidBackupExcludes.map((line) => `        ${line}`),
+    '    </device-transfer>',
+    '</data-extraction-rules>',
+    '',
+].join('\n');
+/** Manifest application attributes that opt the shell out of backups. */
+export const androidManifestBackupAttributes = [
+    ['android:allowBackup', 'false'],
+    ['android:fullBackupContent', '@xml/backup_rules'],
+    ['android:dataExtractionRules', '@xml/data_extraction_rules'],
+    ['tools:targetApi', 's'],
+];
+/**
+ * Opt a freshly generated Android project out of cloud backups and Android
+ * 12+ device-to-device transfers. The Capacitor template enables
+ * android:allowBackup, which would copy WebView storage and the game-services
+ * SharedPreferences save store into Google backups; only a project created by
+ * this run is touched, never an existing game-owned shell.
+ */
+function materializeAndroidBackupPolicy(gameRoot) {
+    const manifestFile = safeDestination(gameRoot, `${shellPath}/android/app/src/main/AndroidManifest.xml`);
+    if (!existsSync(manifestFile) || !lstatSync(manifestFile).isFile()) {
+        return;
+    }
+    const resources = [
+        ['backup_rules.xml', androidBackupRulesXml],
+        ['data_extraction_rules.xml', androidDataExtractionRulesXml],
+    ];
+    for (const [name, content] of resources) {
+        const resource = safeDestination(gameRoot, `${shellPath}/android/app/src/main/res/xml/${name}`);
+        if (!existsSync(resource)) {
+            mkdirSync(path.dirname(resource), { recursive: true });
+            writeFileSync(resource, content);
+        }
+    }
+    const source = readFileSync(manifestFile, 'utf8');
+    const hardened = applyAndroidManifestBackupPolicy(source);
+    if (hardened !== source) {
+        writeFileSync(manifestFile, hardened);
+    }
+}
+function xmlAttributePattern(name) {
+    return new RegExp(`(\\s*)${name.replaceAll('.', '\\.')}\\s*=\\s*(?:"[^"]*"|'[^']*')`, 'u');
+}
+/**
+ * Set the backup opt-out attributes on the manifest application node and bind
+ * the tools namespace on the manifest root. Existing values are replaced in
+ * place; the attribute group keeps the indentation of the first attribute so
+ * the result is stable across repeated runs.
+ */
+export function applyAndroidManifestBackupPolicy(manifest) {
+    const root = /<manifest\b[^>]*?>/u.exec(manifest);
+    const application = /<application\b[^>]*?\/?>/u.exec(manifest);
+    if (root === null || application === null || application.index < root.index) {
+        return manifest;
+    }
+    let rootTag = root[0];
+    if (!/\sxmlns:tools\s*=/u.test(rootTag)) {
+        const androidNamespace = /\sxmlns:android\s*=\s*(?:"[^"]*"|'[^']*')/u.exec(rootTag);
+        const toolsNamespace = ` xmlns:tools="${androidToolsNamespace}"`;
+        rootTag = androidNamespace === null
+            ? rootTag.replace(/^<manifest\b/u, `<manifest${toolsNamespace}`)
+            : `${rootTag.slice(0, androidNamespace.index + androidNamespace[0].length)}${toolsNamespace}${rootTag.slice(androidNamespace.index + androidNamespace[0].length)}`;
+    }
+    let applicationTag = application[0];
+    const existing = xmlAttributePattern('android:allowBackup').exec(applicationTag);
+    const separator = existing?.[1] !== undefined && existing[1] !== ''
+        ? existing[1]
+        : (/^<application(\s+)\S/u.exec(applicationTag)?.[1] ?? ' ');
+    for (const [name] of androidManifestBackupAttributes) {
+        applicationTag = applicationTag.replace(xmlAttributePattern(name), '');
+    }
+    const attributes = androidManifestBackupAttributes
+        .map(([name, value]) => `${separator}${name}="${value}"`)
+        .join('');
+    applicationTag = applicationTag.replace(/^<application\b/u, `<application${attributes}`);
+    return `${manifest.slice(0, root.index)}${rootTag}${manifest.slice(root.index + root[0].length, application.index)}${applicationTag}${manifest.slice(application.index + application[0].length)}`;
+}
 function materializeIosArchiveScheme(gameRoot) {
     const schemeRelative = `${shellPath}/ios/App/App.xcodeproj/xcshareddata/xcschemes/App.xcscheme`;
     const schemeFile = safeDestination(gameRoot, schemeRelative);

package/dist/deploy-planning.d.ts

@@ -0,0 +1,64 @@
+export type NativeDeployTarget = 'android' | 'ios';
+export interface CredentialReference {
+  readonly env: string;
+}
+export interface DeployTargetProfile {
+  readonly destination: 'play-internal' | 'testflight';
+  readonly signingCredential: CredentialReference;
+  readonly submissionCredential: CredentialReference;
+  readonly testGroup?: string;
+}
+export interface DeployProfile {
+  readonly buildProfile: 'production';
+  readonly approval: 'manual' | 'preapproved-internal-test';
+  readonly targets: Partial<Record<NativeDeployTarget, DeployTargetProfile>>;
+}
+export interface DeployConfig {
+  readonly schemaVersion: 1;
+  readonly profiles: Record<string, DeployProfile>;
+}
+export interface PlannedDeployTarget {
+  readonly target: NativeDeployTarget;
+  readonly destination: 'play-internal' | 'testflight';
+  readonly appId: string;
+  readonly testGroup?: string;
+}
+export interface NativeDeploymentPlan {
+  readonly schemaVersion: 1;
+  readonly gameRoot: string;
+  readonly profile: string;
+  readonly buildProfile: 'production';
+  readonly approval: DeployProfile['approval'];
+  readonly targetConfigSha256: string;
+  readonly deployConfigSha256: string;
+  readonly targets: readonly PlannedDeployTarget[];
+}
+export interface DeployDoctorCheck {
+  readonly name: string;
+  readonly status: 'ok' | 'missing' | 'warning';
+  readonly detail: string;
+}
+export interface DeployDoctorResult {
+  readonly checks: readonly DeployDoctorCheck[];
+  readonly healthy: boolean;
+}
+export declare function initializeDeployConfig(game: string): string;
+export declare function planNativeDeployment(input: {
+  readonly game: string;
+  readonly profile: string;
+  readonly targets?: readonly NativeDeployTarget[];
+}): NativeDeploymentPlan;
+export declare function writeNativeDeploymentPlan(file: string, plan: NativeDeploymentPlan): void;
+/** Load a saved plan only if it still equals the game-owned current configuration. */
+export declare function readNativeDeploymentPlan(file: string, gameRootOverride?: string): NativeDeploymentPlan;
+/** Resolve credential references from the one authoritative game-owned profile. */
+export declare function readNativeDeployTargetProfile(plan: NativeDeploymentPlan, target: NativeDeployTarget): DeployTargetProfile;
+/** Credential names across every configured profile, including unselected targets. */
+export declare function readNativeDeployCredentialNames(plan: NativeDeploymentPlan): readonly string[];
+export declare function doctorNativeDeployment(input: {
+  readonly game: string;
+  readonly profile: string;
+  readonly targets?: readonly NativeDeployTarget[];
+  readonly environment?: NodeJS.ProcessEnv;
+}): DeployDoctorResult;
+export declare function parseDeployTargets(value: string | undefined): readonly NativeDeployTarget[] | undefined;