@lssm/integration.app-store-connect

Read-first App Store Connect integration for ReviewReady app submission readiness. It maps supported metadata reads to the ContractSpec provider capability registry and returns typed capability results for everything the official API does not safely expose.

Safety policy

• Read-first / write-disabled. The port exposes no write/update operations. Provider writes are out of scope for this package.
• Mock-by-default. Tests and CI use createMockAppStoreConnectClient, which performs no network access and is fully deterministic (injected clock + ids).
• Live calls are opt-in. createAppStoreConnectClient only attempts live access when enableLiveCalls is true, secret-ref auth is present, and a secret resolver is supplied. Otherwise reads return typed degraded results.
• No faked data. Fields the API cannot supply (e.g. App Privacy answers) return a typed manual-required / unsupported / degraded capability result, never a silent success.

Secret handling

Auth config carries secret references only (privateKeySecretRefId). Raw .p8 private keys, JWTs, and headers are never accepted as config fields, and never appear in snapshots, logs, or fixtures. Log entries record only provider, operation, status, correlationId, and capabilityId.

Usage

import { createMockAppStoreConnectClient } from "@lssm/integration.app-store-connect";

const client = createMockAppStoreConnectClient({
	now: "2026-06-07T12:00:00.000Z",
	correlationId: "corr-001",
});

const metadata = await client.getAppMetadata({ appId: "1234567890" });
const privacy = await client.getAppPrivacyAnswers({ appId: "1234567890" });
// privacy.status === "manual-required"

Source: https://developer.apple.com/documentation/appstoreconnectapi/