@radhya/mach 2.6.4 → 2.6.6

package/README.md

@@ -314,12 +314,14 @@ mach deeplink setup
 mach deeplink verify
 ```
 
-When run from the project root, Mach reads `framework`, `scheme`, `ios.bundleIdentifier`, `android.package`, and production submit metadata from `mach.config.json`. In most projects the only value you need to provide is the public web URL:
+When run from the project root, Mach reads `framework`, `scheme`, `ios.bundleIdentifier`, `android.package`, and production submit metadata from `mach.config.json`. If the linked project has Mach Web Hosting, setup offers its stable Production address first (`project.getmach.dev`), followed by active Production customer domains, then a manual URL. It deliberately excludes Staging and immutable preview addresses. In most projects, simply run:
 
 ```bash
-mach deeplink setup --base-url https://app.example.com
+mach deeplink setup
 ```
 
+Pass `--base-url` to use a different host. A selected host is compiled into the mobile app, so changing from the Mach address to a customer domain later requires rerunning setup and shipping a new native build.
+
 Command flags always override values read from `mach.config.json`; config values are used as defaults.
 
 For CI or explicit overrides:
@@ -341,7 +343,7 @@ mach deeplink setup \
   --output public
 ```
 
-`setup` writes compact `deepLinks` settings into `mach.config.json`, generates Apple AASA and Android `assetlinks.json` files, wires an Expo config plugin for Expo projects, and safely patches Flutter's Android manifest plus iOS entitlements/URL scheme. Re-running it is idempotent. The interactive flow can also enable iOS Web Credentials for HTTPS OAuth callbacks and Android Login Credentials for website password and passkey sharing; both remain disabled by default. For Expo apps, Mach prefers `@radhya/mach/expo-plugin`; interactive setup offers to install `@radhya/mach` locally, and `--yes` or `--install-plugin` installs it automatically. Use `--no-install-plugin` to skip package installation; if the package is missing, Mach generates a local `./plugins/withMachDeepLinks` fallback. See [Deep Links](docs/deep-links.md).
+`setup` writes compact `deepLinks` settings into `mach.config.json`, generates Apple AASA and Android `assetlinks.json` files, wires an Expo config plugin for Expo projects, and safely patches Flutter's Android manifest plus iOS entitlements/URL scheme. `mach web deploy` includes those generated association files in every web release, even when setup wrote them to a separate `public` or `deep-links` directory. When the project is linked and has a Mach-managed Android keystore, setup reads its public SHA-256 signing fingerprint automatically; the temporary keystore file is removed immediately. It then offers an optional Google Play App Signing SHA-256 field, defaulting to No. The field accepts comma-separated fingerprints and `assetlinks.json` supports more than one, so debug, direct-distribution, and Google Play builds can coexist. Developers can also add the Google Play value later with a repeatable `--android-fingerprint` flag or `deepLinks.android.sha256CertFingerprints`; it must remain the Play certificate rather than the upload-key certificate. Re-running setup is idempotent. The interactive flow can also enable iOS Web Credentials for HTTPS OAuth callbacks and Android Login Credentials for website password and passkey sharing; both remain disabled by default. For Expo apps, Mach prefers `@radhya/mach/expo-plugin`; interactive setup offers to install `@radhya/mach` locally, and `--yes` or `--install-plugin` installs it automatically. Use `--no-install-plugin` to skip package installation; if the package is missing, Mach generates a local `./plugins/withMachDeepLinks` fallback. See [Deep Links](docs/deep-links.md).
 
 ## Local Device Agent