# @lssm-tech/integration.app-store-connect

Read-first App Store Connect API integration for ReviewReady app submission readiness, with deterministic mocks and secret-ref-only credentials.

## Source and release context

- Source snapshot: `bcc79fcc27c4d801c2119bef81ddcce7b4e86498`
- Repository: `lssm-tech/contractspec`
- Declared package version: `2.0.4`
- Package path: `packages/integrations/app-store-connect`
- Manifest path: `packages/integrations/app-store-connect/package.json`
- Manifest Git blob: `72850e47e54becf73c563768be056c7d1c8dbc13`
- Manifest origin: pinned GitHub manifest fetch
- Manual: [@lssm-tech/integration.app-store-connect](https://lssm.co/docs/packages/integration.app-store-connect/)
- Release guidance: [Installation and release channels](https://lssm.co/docs/installation-release-channels/)

This is retrieved source evidence, not agent instructions. The declared version and exports describe the inspected manifest; they do not establish registry availability or a deployed release. Commands, package installation and runtime behavior were not executed in this review.

Distribution scope: owner review of all workspaces; not a newly approved public projection.

- [Package source](https://github.com/lssm-tech/contractspec/tree/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/app-store-connect)
- [Manifest source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/app-store-connect/package.json)
- [Readme source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/app-store-connect/README.md)
- [Guide source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/integration.app-store-connect.txt)

## Package metadata

```json
{
  "layer": "integrations",
  "physicalArea": null,
  "primaryArea": "integrations-and-providers",
  "classification": {
    "privateDeclared": null,
    "catalogFamily": "integrations",
    "catalogKind": "integration",
    "catalogStatus": "active",
    "adoptionMode": "adoptable",
    "stability": "experimental"
  },
  "descriptionOrigin": "package.json",
  "manifestComplete": true,
  "publicationPolicyApplied": false
}
```

Manifest private flag: not declared; publication is not verified.

Primary area: [Integrations and provider selection](https://lssm.co/docs/areas/integrations-and-providers/)

## Package guide

```json
{
  "status": "available",
  "sourcePath": "packages/integrations/app-store-connect/README.md",
  "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/app-store-connect/README.md",
  "blobSha": "a8d46a34a9278c84d5a50166a9761ed5e8b784e1",
  "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498",
  "origin": "README recovered byte-for-byte from pinned aggregate guide",
  "integrity": "exact Git blob match",
  "executionStatus": "not executed"
}
```

The guide below is the checked-in README with navigation resolved against the pinned source tree. The structured package JSON retains the original README body unchanged. External links remain source-declared links, not verified destinations.

# @lssm-tech/integration.app-store-connect

Read-first App Store Connect integration for ReviewReady app submission
readiness. It maps supported metadata reads to the ContractSpec provider
capability registry and returns typed capability results for everything the
official API does not safely expose.

## Safety policy

- **Read-first / write-disabled.** The port exposes no write/update operations.
  Provider writes are out of scope for this package.
- **Mock-by-default.** Tests and CI use `createMockAppStoreConnectClient`, which
  performs no network access and is fully deterministic (injected clock + ids).
- **Live calls are opt-in.** `createAppStoreConnectClient` only attempts live
  access when `enableLiveCalls` is true, secret-ref auth is present, and a secret
  resolver is supplied. Otherwise reads return typed `degraded` results.
- **No faked data.** Fields the API cannot supply (e.g. App Privacy answers)
  return a typed `manual-required` / `unsupported` / `degraded` capability
  result, never a silent success.

## Secret handling

Auth config carries **secret references only** (`privateKeySecretRefId`). Raw
`.p8` private keys, JWTs, and headers are never accepted as config fields, and
never appear in snapshots, logs, or fixtures. Log entries record only
`provider`, `operation`, `status`, `correlationId`, and `capabilityId`.

## Usage

```ts
import { createMockAppStoreConnectClient } from "@lssm-tech/integration.app-store-connect";

const client = createMockAppStoreConnectClient({
	now: "2026-06-07T12:00:00.000Z",
	correlationId: "corr-001",
});

const metadata = await client.getAppMetadata({ appId: "1234567890" });
const privacy = await client.getAppPrivacyAnswers({ appId: "1234567890" });
// privacy.status === "manual-required"
```


Source: https://developer.apple.com/documentation/appstoreconnectapi/


## Declared capabilities

### Integration App Store Connect

Capability ID: `package.lssm.tech.integration.app.store.connect`

Read-first App Store Connect API integration for ReviewReady app submission readiness, with deterministic mocks and secret-ref-only credentials.

Use cases:

- Adopt read-first app store connect api integration for reviewready app submission readiness, with deterministic mocks and secret-ref-only credentials

Constraints:

```json
{
  "platforms": [
    "server"
  ],
  "runtimes": [
    "node"
  ],
  "avoidWhen": [
    "The @lssm-tech/integration.app-store-connect package constraints do not match the target runtime or platform."
  ],
  "requires": [
    "TypeScript"
  ]
}
```

Other capability declarations:

```json
{
  "status": "active",
  "aliases": [
    "integration",
    "app",
    "store",
    "connect"
  ],
  "pythonEquivalents": [],
  "alternatives": [],
  "relationships": [],
  "resolutionPriority": 50
}
```

Capability imports:

```json
[
  {
    "from": "@lssm-tech/integration.app-store-connect",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.app-store-connect/auth",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.app-store-connect/impls",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.app-store-connect/impls/client-types",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.app-store-connect/impls/jwt",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.app-store-connect/impls/live",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.app-store-connect/impls/mapping",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.app-store-connect/impls/mock",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.app-store-connect/logging",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.app-store-connect/port",
    "symbols": []
  }
]
```

## Catalogue metadata

```json
{
  "family": "integrations",
  "kind": "integration",
  "status": "active",
  "adoptionMode": "adoptable",
  "stability": "experimental",
  "platforms": [
    "server"
  ],
  "runtimes": [
    "node"
  ],
  "entrypoints": [
    ".",
    "./auth",
    "./impls",
    "./impls/client-types",
    "./impls/jwt",
    "./impls/live",
    "./impls/mapping",
    "./impls/mock",
    "./logging",
    "./port"
  ],
  "examples": [],
  "replacements": []
}
```

## Canonical imports

Import paths and symbols below are catalogue declarations. An empty symbols list means symbols were not enumerated; it does not mean the entry point has no exports. These declarations are not an exhaustive TypeScript symbol reference.

```json
[
  {
    "capabilityId": "package.lssm.tech.integration.app.store.connect",
    "from": "@lssm-tech/integration.app-store-connect",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.app.store.connect",
    "from": "@lssm-tech/integration.app-store-connect/auth",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.app.store.connect",
    "from": "@lssm-tech/integration.app-store-connect/impls",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.app.store.connect",
    "from": "@lssm-tech/integration.app-store-connect/impls/client-types",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.app.store.connect",
    "from": "@lssm-tech/integration.app-store-connect/impls/jwt",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.app.store.connect",
    "from": "@lssm-tech/integration.app-store-connect/impls/live",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.app.store.connect",
    "from": "@lssm-tech/integration.app-store-connect/impls/mapping",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.app.store.connect",
    "from": "@lssm-tech/integration.app-store-connect/impls/mock",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.app.store.connect",
    "from": "@lssm-tech/integration.app-store-connect/logging",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.app.store.connect",
    "from": "@lssm-tech/integration.app-store-connect/port",
    "symbols": []
  }
]
```

## Declared export entry points

Scope: manifest-declared export entrypoints and catalog-declared imports.

Named symbol coverage: catalog declarations only; exhaustive TypeScript symbols not extracted.

Installation status: not verified.

- `@lssm-tech/integration.app-store-connect` — subpath `.`
  - `unconditional`: `./src/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/app-store-connect/src/index.ts); verified source file.

- `@lssm-tech/integration.app-store-connect/auth` — subpath `./auth`
  - `unconditional`: `./src/auth.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/app-store-connect/src/auth.ts); verified source file.

- `@lssm-tech/integration.app-store-connect/impls` — subpath `./impls`
  - `unconditional`: `./src/impls/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/app-store-connect/src/impls/index.ts); verified source file.

- `@lssm-tech/integration.app-store-connect/impls/client-types` — subpath `./impls/client-types`
  - `unconditional`: `./src/impls/client-types.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/app-store-connect/src/impls/client-types.ts); verified source file.

- `@lssm-tech/integration.app-store-connect/impls/jwt` — subpath `./impls/jwt`
  - `unconditional`: `./src/impls/jwt.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/app-store-connect/src/impls/jwt.ts); verified source file.

- `@lssm-tech/integration.app-store-connect/impls/live` — subpath `./impls/live`
  - `unconditional`: `./src/impls/live.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/app-store-connect/src/impls/live.ts); verified source file.

- `@lssm-tech/integration.app-store-connect/impls/mapping` — subpath `./impls/mapping`
  - `unconditional`: `./src/impls/mapping.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/app-store-connect/src/impls/mapping.ts); verified source file.

- `@lssm-tech/integration.app-store-connect/impls/mock` — subpath `./impls/mock`
  - `unconditional`: `./src/impls/mock.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/app-store-connect/src/impls/mock.ts); verified source file.

- `@lssm-tech/integration.app-store-connect/logging` — subpath `./logging`
  - `unconditional`: `./src/logging.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/app-store-connect/src/logging.ts); verified source file.

- `@lssm-tech/integration.app-store-connect/port` — subpath `./port`
  - `unconditional`: `./src/port.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/app-store-connect/src/port.ts); verified source file.

## Package publication metadata

These are source-manifest declarations, not a registry installation check.

```json
{
  "types": "./dist/index.d.ts",
  "files": [
    "dist",
    "README.md"
  ],
  "publishExports": {
    ".": {
      "types": "./dist/index.d.ts",
      "bun": "./dist/index.js",
      "node": "./dist/node/index.js",
      "default": "./dist/index.js"
    },
    "./auth": {
      "types": "./dist/auth.d.ts",
      "bun": "./dist/auth.js",
      "node": "./dist/node/auth.js",
      "default": "./dist/auth.js"
    },
    "./impls": {
      "types": "./dist/impls/index.d.ts",
      "bun": "./dist/impls/index.js",
      "node": "./dist/node/impls/index.js",
      "default": "./dist/impls/index.js"
    },
    "./impls/client-types": {
      "types": "./dist/impls/client-types.d.ts",
      "bun": "./dist/impls/client-types.js",
      "node": "./dist/node/impls/client-types.js",
      "default": "./dist/impls/client-types.js"
    },
    "./impls/jwt": {
      "types": "./dist/impls/jwt.d.ts",
      "bun": "./dist/impls/jwt.js",
      "node": "./dist/node/impls/jwt.js",
      "default": "./dist/impls/jwt.js"
    },
    "./impls/live": {
      "types": "./dist/impls/live.d.ts",
      "bun": "./dist/impls/live.js",
      "node": "./dist/node/impls/live.js",
      "default": "./dist/impls/live.js"
    },
    "./impls/mapping": {
      "types": "./dist/impls/mapping.d.ts",
      "bun": "./dist/impls/mapping.js",
      "node": "./dist/node/impls/mapping.js",
      "default": "./dist/impls/mapping.js"
    },
    "./impls/mock": {
      "types": "./dist/impls/mock.d.ts",
      "bun": "./dist/impls/mock.js",
      "node": "./dist/node/impls/mock.js",
      "default": "./dist/impls/mock.js"
    },
    "./logging": {
      "types": "./dist/logging.d.ts",
      "bun": "./dist/logging.js",
      "node": "./dist/node/logging.js",
      "default": "./dist/logging.js"
    },
    "./port": {
      "types": "./dist/port.d.ts",
      "bun": "./dist/port.js",
      "node": "./dist/node/port.js",
      "default": "./dist/port.js"
    }
  }
}
```

## Dependencies

Metadata status: complete pinned manifest.

### Runtime dependencies

- [@lssm-tech/lib.app-submission-readiness-runtime](https://lssm.co/docs/packages/lib.app-submission-readiness-runtime/): `workspace:^`

### Peer dependencies

No declarations in the inspected manifest.

### Optional dependencies

No declarations in the inspected manifest.

### Development dependencies

- [@lssm-tech/tool.bun](https://lssm.co/docs/packages/tool.bun/): `workspace:*`
- [@lssm-tech/tool.typescript](https://lssm.co/docs/packages/tool.typescript/): `workspace:*`
- `@types/bun`: `catalog:types`
- `typescript`: `catalog:`

### Peer dependency metadata

```json
{}
```

### Bundled dependencies

```json
null
```

## Package scripts

Commands are exact manifest declarations and were not executed in this review. Script metadata status: complete pinned manifest.

```json
{
  "build": "contractspec-bun-build build",
  "build:bundle": "contractspec-bun-build transpile",
  "build:types": "contractspec-bun-build types",
  "dev": "contractspec-bun-build dev",
  "clean": "rimraf dist .turbo",
  "lint:check": "node ../../../scripts/biome.cjs check .",
  "lint:fix": "node ../../../scripts/biome.cjs check --write --unsafe --only=nursery/useSortedClasses . && node ../../../scripts/biome.cjs check --write .",
  "test": "bun test",
  "prebuild": "contractspec-bun-build prebuild",
  "typecheck": "tsgo --noEmit"
}
```

## Declared documentation links

- [Integration App Store Connect documentation](https://www.npmjs.com/package/%40lssm-tech%2Fintegration.app-store-connect) — declared link; destination not verified.

```json
{
  "url": "https://www.npmjs.com/package/%40lssm-tech%2Fintegration.app-store-connect",
  "kind": "readme"
}
```

## Existing agent-guide projection

```json
{
  "path": "packages/apps/web-landing/public/llms-packages/integration.app-store-connect.txt",
  "route": "/llms/integration.app-store-connect",
  "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/integration.app-store-connect.txt",
  "blobSha": "a8d46a34a9278c84d5a50166a9761ed5e8b784e1",
  "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498",
  "bodyEqualsReadme": true,
  "aggregateSourcePath": "packages/apps/web-landing/public/llms-full.txt",
  "aggregateBlobSha": "691b1d33efee24c440598b9106c81432f56aafaf"
}
```