@ggaiteam/appstore-connect-mcp 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 appstore-connect-mcp contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,353 @@
+# App Store Connect MCP
+
+A [Model Context Protocol](https://modelcontextprotocol.io/) server that exposes the entire **Apple App Store Connect API** (1,200+ operations) as MCP tools. Query apps, manage builds, handle submissions, read analytics, manage users, and more — all from your AI assistant.
+
+[![npm version](https://img.shields.io/npm/v/@ggaiteam/appstore-connect-mcp.svg)](https://www.npmjs.com/package/@ggaiteam/appstore-connect-mcp)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![Node.js](https://img.shields.io/badge/node-%3E%3D18-brightgreen)](https://nodejs.org/)
+
+## Features
+
+- **Complete API coverage** — all 1,216 operations from the App Store Connect API v4.4
+- **Tool search** — `search_apis` meta-tool to find the right operation among 1,200+
+- **Two transports** — `stdio` for local use (Claude Desktop, Cursor), `HTTP` for remote deployment
+- **JWT authentication** — automatic ES256 token generation and caching
+- **Docker ready** — multi-stage Dockerfile with health checks
+- **Auto-publish** — GitHub Actions workflow for npm publishing on release
+
+## Quick Start
+
+### 1. Get API Credentials
+
+1. Go to [App Store Connect → Users and Access → Keys](https://appstoreconnect.apple.com/access/api)
+2. Click **Generate API Key** (or use an existing one)
+3. Note down:
+   - **Issuer ID** — shown at the top of the Keys page
+   - **Key ID** — shown in the key list
+   - **Private Key (.p8 file)** — download it (only available once)
+
+> The key needs at least **App Manager** or **Admin** role for full functionality.
+
+### 2. Install
+
+#### Option A: npm (recommended)
+
+```bash
+npm install -g @ggaiteam/appstore-connect-mcp
+```
+
+#### Option B: One-line installer
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/topcheer/appstore-connect-mcp/main/scripts/install.sh | bash
+```
+
+#### Option C: Docker
+
+```bash
+docker pull ghcr.io/topcheer/appstore-connect-mcp:latest
+```
+
+### 3. Configure Your MCP Client
+
+#### Claude Desktop
+
+Edit `~/Library/Application Support/Claude/claude_desktop_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "appstore-connect": {
+      "command": "appstore-connect-mcp",
+      "env": {
+        "APP_STORE_CONNECT_ISSUER_ID": "your-issuer-id",
+        "APP_STORE_CONNECT_KEY_ID": "your-key-id",
+        "APP_STORE_CONNECT_P8_FILE": "/path/to/AuthKey_XXXXXXXXXX.p8"
+      }
+    }
+  }
+}
+```
+
+#### Cursor
+
+Add to your Cursor MCP settings:
+
+```json
+{
+  "mcpServers": {
+    "appstore-connect": {
+      "command": "npx",
+      "args": ["@ggaiteam/appstore-connect-mcp"],
+      "env": {
+        "APP_STORE_CONNECT_ISSUER_ID": "your-issuer-id",
+        "APP_STORE_CONNECT_KEY_ID": "your-key-id",
+        "APP_STORE_CONNECT_P8_FILE": "/path/to/AuthKey_XXXXXXXXXX.p8"
+      }
+    }
+  }
+}
+```
+
+> **Alternatively**, inline the private key instead of a file path:
+> ```json
+> "APP_STORE_CONNECT_PRIVATE_KEY": "-----BEGIN PRIVATE KEY-----\nMIGTAg...\n-----END PRIVATE KEY-----"
+> ```
+
+Restart your client. You should now have access to all App Store Connect API tools.
+
+## Usage Examples
+
+Once connected, ask your AI assistant:
+
+> "List all my apps on App Store Connect"
+
+> "Show me the latest build for bundle ID com.example.myapp"
+
+> "Get all pending app review submissions"
+
+> "Search for subscription-related API operations"
+
+The AI uses the `search_apis` meta-tool to discover available operations, then calls them.
+
+### Meta-Tools
+
+| Tool | Description |
+|------|-------------|
+| `search_apis` | Search API operations by keyword, category, or HTTP method |
+| `list_categories` | List all 192 API resource categories |
+| `get_tool_details` | Get full parameter details for a specific operation |
+
+### Example Tool Calls
+
+The AI can call tools like:
+- `apps_getCollection` — list all apps
+- `builds_getCollection` — list builds with filters
+- `appStoreVersions_getCollection` — get app versions
+- `betaTesters_getCollection` — list beta testers
+- `salesReports_getCollection` — download sales reports
+- `userInvitations_createInstance` — invite a new team member
+
+## Remote Deployment (HTTP Mode)
+
+### Docker Compose
+
+```bash
+# 1. Create .env file
+cp .env.example .env
+# Edit .env with your credentials
+
+# 2. Start
+docker compose up -d
+```
+
+The server is available at `http://localhost:3000/mcp`.
+
+### Docker (manual)
+
+```bash
+docker run -d \
+  --name appstore-connect-mcp \
+  -p 3000:3000 \
+  -e APP_STORE_CONNECT_ISSUER_ID=your-issuer-id \
+  -e APP_STORE_CONNECT_KEY_ID=your-key-id \
+  -e APP_STORE_CONNECT_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----" \
+  ghcr.io/topcheer/appstore-connect-mcp:latest
+```
+
+### Health Check
+
+```bash
+curl http://localhost:3000/health
+# {"status":"ok","server":"appstore-connect-mcp","version":"1.0.0"}
+```
+
+### Connect Remote MCP to Claude Desktop
+
+```json
+{
+  "mcpServers": {
+    "appstore-connect": {
+      "url": "http://your-server:3000/mcp"
+    }
+  }
+}
+```
+
+## CLI Usage
+
+```bash
+# Stdio mode (default — for local MCP clients)
+appstore-connect-mcp
+
+# HTTP mode (for remote deployment)
+appstore-connect-mcp --transport http --port 3000 --host 0.0.0.0
+
+# With verbose logging
+appstore-connect-mcp --verbose
+```
+
+### CLI Flags
+
+| Flag | Default | Description |
+|------|---------|-------------|
+| `--transport` | `stdio` | Transport mode: `stdio` or `http` |
+| `--port` | `3000` | HTTP port (HTTP mode only) |
+| `--host` | `0.0.0.0` | HTTP bind host |
+| `--issuer-id` | env | App Store Connect issuer ID |
+| `--key-id` | env | API key ID |
+| `--p8-file` | env | Path to .p8 private key file |
+| `--verbose` | off | Enable verbose logging |
+
+### Environment Variables
+
+| Variable | Description |
+|----------|-------------|
+| `APP_STORE_CONNECT_ISSUER_ID` | Issuer ID from App Store Connect |
+| `APP_STORE_CONNECT_KEY_ID` | Key ID |
+| `APP_STORE_CONNECT_PRIVATE_KEY` | PEM private key content (inline) |
+| `APP_STORE_CONNECT_P8_FILE` | Path to .p8 file (alternative to above) |
+| `MCP_TRANSPORT` | `stdio` or `http` |
+| `MCP_PORT` | HTTP port |
+| `MCP_HOST` | HTTP host |
+| `MCP_VERBOSE` | `1` to enable verbose logging |
+
+## Architecture
+
+```
+┌──────────────────┐     ┌──────────────────┐
+│  MCP Client      │     │  MCP Server      │
+│  (Claude, etc.)  │◄───►│                  │
+└──────────────────┘     │  ┌────────────┐  │     ┌─────────────────┐
+                         │  │ Tool       │  │     │ App Store       │
+   stdio or HTTP/SSE     │  │ Registry   │──┼────►│ Connect API     │
+                         │  │ (1,216     │  │     │ api.appstore    │
+                         │  │  tools)    │  │     │ connect.apple   │
+                         │  └────────────┘  │     │ .com            │
+                         │       │          │     └─────────────────┘
+                         │  ┌────▼─────┐    │            ▲
+                         │  │ JWT Auth │    │            │
+                         │  │ (ES256)  │────┼────────────┘
+                         │  └──────────┘    │
+                         └──────────────────┘
+```
+
+- **Tool data** is generated from Apple's OpenAPI spec (`scripts/generate-tools.py`)
+- **Runtime** loads `tools.json` and registers all tools dynamically
+- **JWT tokens** are cached and auto-refreshed (20-minute TTL)
+- **Responses** are truncated at 50KB to fit LLM context windows
+
+### Regenerating Tools
+
+When Apple updates their API:
+
+```bash
+# Download the latest OpenAPI spec
+# https://developer.apple.com/app-store-connect/
+
+# Generate updated tools.json
+python3 scripts/generate-tools.py openapi.oas.json src/tools.json
+
+# Rebuild
+npm run build
+```
+
+## Development
+
+```bash
+# Clone
+git clone https://github.com/topcheer/appstore-connect-mcp.git
+cd appstore-connect-mcp
+
+# Install
+npm install
+
+# Generate tools from OpenAPI spec
+npm run generate
+
+# Build
+npm run build
+
+# Run locally
+APP_STORE_CONNECT_ISSUER_ID=... \
+APP_STORE_CONNECT_KEY_ID=... \
+APP_STORE_CONNECT_P8_FILE=... \
+npm start
+```
+
+### Project Structure
+
+```
+├── scripts/
+│   ├── generate-tools.py     # OpenAPI → tools.json generator
+│   └── install.sh            # One-line installer
+├── src/
+│   ├── index.ts              # Entry point + CLI
+│   ├── server.ts             # MCP server (tool registry + dispatch)
+│   ├── transport.ts          # stdio + HTTP transports
+│   ├── auth.ts               # JWT (ES256) token generation
+│   ├── client.ts             # App Store Connect API client
+│   ├── tools.ts              # Tool schema builder + executor
+│   ├── types.ts              # TypeScript type definitions
+│   └── tools.json            # Generated tool definitions (1,216 ops)
+├── Dockerfile                # Multi-stage Docker build
+├── docker-compose.yml        # Remote deployment config
+├── .github/workflows/
+│   ├── ci.yml                # Lint + build + test
+│   ├── npm-publish.yml       # Auto-publish to npm on release
+│   └── docker.yml            # Build + push Docker image
+└── package.json
+```
+
+## npm Publishing
+
+Publishing is automated via GitHub Actions:
+
+1. **Create a release** on GitHub (tag format: `v1.0.0`)
+2. The `npm-publish.yml` workflow automatically:
+   - Builds the package
+   - Publishes to npm
+   - With [provenance](https://docs.npmjs.com/generating-provenance-statements)
+
+### First-time Setup
+
+1. Create an npm access token: https://www.npmjs.com/settings/~/tokens
+2. Add it as a repository secret: `NPM_TOKEN`
+3. Create a GitHub release — done!
+
+### Manual Publishing
+
+```bash
+npm version patch  # or minor/major
+npm run build
+npm publish
+```
+
+## API Coverage
+
+This server covers **all 1,216 operations** across the App Store Connect API:
+
+| Method | Count |
+|--------|-------|
+| GET    | 768   |
+| POST   | 168   |
+| PATCH  | 153   |
+| DELETE | 127   |
+
+Including: Apps, Builds, App Store Versions, Beta Testing, Subscriptions, In-App Purchases, User Management, Sales Reports, Analytics, App Clips, Game Center, and more (192 categories total).
+
+## Security
+
+- Private keys are read from environment variables or files — never logged
+- JWT tokens are short-lived (20 minutes max) and cached in memory only
+- No data is stored or persisted between requests
+- For remote deployment, use HTTPS/TLS termination at your reverse proxy
+
+## License
+
+MIT — see [LICENSE](LICENSE)
+
+## Acknowledgments
+
+- [Apple App Store Connect API](https://developer.apple.com/app-store-connect/) — API and OpenAPI specification
+- [Model Context Protocol](https://modelcontextprotocol.io/) — Protocol specification

package/dist/auth.d.ts

@@ -0,0 +1,26 @@
+/**
+ * auth.ts — JWT token generation for App Store Connect API.
+ *
+ * Apple's App Store Connect API authenticates using JWT signed with
+ * ES256 (ECDSA P-256 + SHA-256). The private key comes from a .p8 file
+ * downloaded from App Store Connect → Users and Access → Keys.
+ */
+import type { ASCCredentials } from "./types.js";
+/**
+ * Generate (or return cached) a signed JWT for the App Store Connect API.
+ *
+ * @param creds  The issuer ID, key ID, and PEM private key
+ * @param force  Force a fresh token even if the cache is still valid
+ */
+export declare function getToken(creds: ASCCredentials, force?: boolean): string;
+/**
+ * Parse a .p8 file content into a PEM string suitable for jwt.sign().
+ * Handles both raw PEM and the Apple AuthKey format.
+ */
+export declare function parsePrivateKey(raw: string): string;
+/**
+ * Validate that credentials look reasonable.
+ * Throws a descriptive Error if something is missing.
+ */
+export declare function validateCredentials(creds: ASCCredentials): void;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AASjD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,UAAQ,GAAG,MAAM,CAsBrE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgBnD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAgB/D"}

package/dist/auth.js

@@ -0,0 +1,72 @@
+/**
+ * auth.ts — JWT token generation for App Store Connect API.
+ *
+ * Apple's App Store Connect API authenticates using JWT signed with
+ * ES256 (ECDSA P-256 + SHA-256). The private key comes from a .p8 file
+ * downloaded from App Store Connect → Users and Access → Keys.
+ */
+import jwt from "jsonwebtoken";
+const AUDIENCE = "appstoreconnect-v1";
+const TOKEN_TTL_SECONDS = 20 * 60; // 20 minutes (Apple allows max 20)
+/** Cached token to avoid re-signing on every request. */
+let cachedToken = null;
+let cachedExpiry = 0;
+/**
+ * Generate (or return cached) a signed JWT for the App Store Connect API.
+ *
+ * @param creds  The issuer ID, key ID, and PEM private key
+ * @param force  Force a fresh token even if the cache is still valid
+ */
+export function getToken(creds, force = false) {
+    const now = Math.floor(Date.now() / 1000);
+    // Return cached token if it has >60s of life left
+    if (!force && cachedToken && now < cachedExpiry - 60) {
+        return cachedToken;
+    }
+    const payload = {
+        iss: creds.issuerId,
+        iat: now,
+        exp: now + TOKEN_TTL_SECONDS,
+        aud: AUDIENCE,
+    };
+    cachedToken = jwt.sign(payload, creds.privateKey, {
+        algorithm: "ES256",
+        keyid: creds.keyId,
+    });
+    cachedExpiry = now + TOKEN_TTL_SECONDS;
+    return cachedToken;
+}
+/**
+ * Parse a .p8 file content into a PEM string suitable for jwt.sign().
+ * Handles both raw PEM and the Apple AuthKey format.
+ */
+export function parsePrivateKey(raw) {
+    const trimmed = raw.trim();
+    // Already in PEM format
+    if (trimmed.includes("-----BEGIN PRIVATE KEY-----")) {
+        return trimmed;
+    }
+    // Apple .p8 files are usually already PEM, but handle edge cases
+    // where the header might be missing
+    if (trimmed.includes("-----BEGIN")) {
+        return trimmed;
+    }
+    // Try wrapping raw base64 content in PEM headers
+    return `-----BEGIN PRIVATE KEY-----\n${trimmed}\n-----END PRIVATE KEY-----`;
+}
+/**
+ * Validate that credentials look reasonable.
+ * Throws a descriptive Error if something is missing.
+ */
+export function validateCredentials(creds) {
+    if (!creds.issuerId) {
+        throw new Error("Missing APP_STORE_CONNECT_ISSUER_ID. Set it via env or CLI flag.");
+    }
+    if (!creds.keyId) {
+        throw new Error("Missing APP_STORE_CONNECT_KEY_ID. Set it via env or CLI flag.");
+    }
+    if (!creds.privateKey) {
+        throw new Error("Missing APP_STORE_CONNECT_PRIVATE_KEY. Provide the .p8 file path via APP_STORE_CONNECT_P8_FILE or the key content via the env var.");
+    }
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,GAAG,MAAM,cAAc,CAAC;AAG/B,MAAM,QAAQ,GAAG,oBAAoB,CAAC;AACtC,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,mCAAmC;AAEtE,yDAAyD;AACzD,IAAI,WAAW,GAAkB,IAAI,CAAC;AACtC,IAAI,YAAY,GAAG,CAAC,CAAC;AAErB;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAqB,EAAE,KAAK,GAAG,KAAK;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE1C,kDAAkD;IAClD,IAAI,CAAC,KAAK,IAAI,WAAW,IAAI,GAAG,GAAG,YAAY,GAAG,EAAE,EAAE,CAAC;QACrD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,OAAO,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,QAAQ;QACnB,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,iBAAiB;QAC5B,GAAG,EAAE,QAAQ;KACd,CAAC;IAEF,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE;QAChD,SAAS,EAAE,OAAO;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC;IACH,YAAY,GAAG,GAAG,GAAG,iBAAiB,CAAC;IAEvC,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAE3B,wBAAwB;IACxB,IAAI,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;QACpD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,iEAAiE;IACjE,oCAAoC;IACpC,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,iDAAiD;IACjD,OAAO,gCAAgC,OAAO,6BAA6B,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAqB;IACvD,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,oIAAoI,CACrI,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/client.d.ts

@@ -0,0 +1,31 @@
+/**
+ * client.ts — HTTP client for the App Store Connect REST API.
+ *
+ * Handles JWT authentication, request building, JSON:API conventions,
+ * error normalisation, and response formatting.
+ */
+import type { ASCCredentials } from "./types.js";
+export interface ApiRequestOptions {
+    method: string;
+    path: string;
+    pathParams?: Record<string, string>;
+    queryParams?: Record<string, string | string[]>;
+    body?: unknown;
+    credentials: ASCCredentials;
+}
+/**
+ * Execute a single App Store Connect API request.
+ *
+ * @returns the parsed JSON response body (or null for 204).
+ * @throws  Error with a descriptive message on failure.
+ */
+export declare function callApi(opts: ApiRequestOptions): Promise<unknown>;
+/** Structured error from the App Store Connect API. */
+export declare class ApiError extends Error {
+    status: number;
+    detail: unknown;
+    method: string;
+    url: string;
+    constructor(status: number, detail: unknown, method: string, url: string);
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAKjD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,cAAc,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,CAoEvE;AAED,uDAAuD;AACvD,qBAAa,QAAS,SAAQ,KAAK;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;gBAEA,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;CAYzE"}

package/dist/client.js

@@ -0,0 +1,97 @@
+/**
+ * client.ts — HTTP client for the App Store Connect REST API.
+ *
+ * Handles JWT authentication, request building, JSON:API conventions,
+ * error normalisation, and response formatting.
+ */
+import { getToken } from "./auth.js";
+const BASE_URL = "https://api.appstoreconnect.apple.com";
+/**
+ * Execute a single App Store Connect API request.
+ *
+ * @returns the parsed JSON response body (or null for 204).
+ * @throws  Error with a descriptive message on failure.
+ */
+export async function callApi(opts) {
+    // Build the URL with path parameters
+    let url = opts.path;
+    for (const [key, value] of Object.entries(opts.pathParams ?? {})) {
+        url = url.replace(`{${key}}`, encodeURIComponent(value));
+    }
+    // Append query parameters
+    const urlObj = new URL(url, BASE_URL);
+    if (opts.queryParams) {
+        for (const [key, value] of Object.entries(opts.queryParams)) {
+            if (value === undefined || value === null || value === "")
+                continue;
+            if (Array.isArray(value)) {
+                for (const v of value) {
+                    urlObj.searchParams.append(key, String(v));
+                }
+            }
+            else {
+                urlObj.searchParams.append(key, String(value));
+            }
+        }
+    }
+    // Get JWT token
+    const token = getToken(opts.credentials);
+    // Build fetch options
+    const fetchOpts = {
+        method: opts.method,
+        headers: {
+            Authorization: `Bearer ${token}`,
+            Accept: "application/json",
+        },
+    };
+    if (opts.body !== undefined && opts.method !== "GET" && opts.method !== "DELETE") {
+        fetchOpts.headers = {
+            ...fetchOpts.headers,
+            "Content-Type": "application/json",
+        };
+        fetchOpts.body = JSON.stringify(opts.body);
+    }
+    // Execute request
+    const response = await fetch(urlObj.toString(), fetchOpts);
+    // Parse response
+    const responseText = await response.text();
+    if (!response.ok) {
+        let errorDetail;
+        try {
+            errorDetail = JSON.parse(responseText);
+        }
+        catch {
+            errorDetail = responseText;
+        }
+        throw new ApiError(response.status, errorDetail, opts.method, url);
+    }
+    // 204 No Content or empty body
+    if (response.status === 204 || !responseText) {
+        return { status: response.status, message: "Success (no content)" };
+    }
+    try {
+        return JSON.parse(responseText);
+    }
+    catch {
+        return responseText;
+    }
+}
+/** Structured error from the App Store Connect API. */
+export class ApiError extends Error {
+    status;
+    detail;
+    method;
+    url;
+    constructor(status, detail, method, url) {
+        const message = typeof detail === "object" && detail !== null && "errors" in detail
+            ? JSON.stringify(detail.errors, null, 2)
+            : `HTTP ${status}: ${String(detail).slice(0, 200)}`;
+        super(message);
+        this.name = "AppStoreConnectApiError";
+        this.status = status;
+        this.detail = detail;
+        this.method = method;
+        this.url = url;
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,MAAM,QAAQ,GAAG,uCAAuC,CAAC;AAWzD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAuB;IACpD,qCAAqC;IACrC,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC;IACpB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;QACjE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,GAAG,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,0BAA0B;IAC1B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;gBAAE,SAAS;YACpE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;oBACtB,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IAED,gBAAgB;IAChB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAEzC,sBAAsB;IACtB,MAAM,SAAS,GAAgB;QAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,MAAM,EAAE,kBAAkB;SAC3B;KACF,CAAC;IAEF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACjF,SAAS,CAAC,OAAO,GAAG;YAClB,GAAG,SAAS,CAAC,OAAO;YACpB,cAAc,EAAE,kBAAkB;SACnC,CAAC;QACF,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,kBAAkB;IAClB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,CAAC,CAAC;IAE3D,iBAAiB;IACjB,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAE3C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,WAAoB,CAAC;QACzB,IAAI,CAAC;YACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,YAAY,CAAC;QAC7B,CAAC;QACD,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC;IAED,+BAA+B;IAC/B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAC7C,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IACtE,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,YAAY,CAAC;IACtB,CAAC;AACF,CAAC;AAED,uDAAuD;AACvD,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,MAAM,CAAS;IACf,MAAM,CAAU;IAChB,MAAM,CAAS;IACf,GAAG,CAAS;IAEZ,YAAY,MAAc,EAAE,MAAe,EAAE,MAAc,EAAE,GAAW;QACtE,MAAM,OAAO,GACX,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,QAAQ,IAAI,MAAM;YACjE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAE,MAAc,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,CAAC,CAAC,QAAQ,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+/**
+ * index.ts — Entry point for appstore-connect-mcp.
+ *
+ * Usage:
+ *   # Local (stdio) — for Claude Desktop, Cursor, etc.
+ *   appstore-connect-mcp
+ *   appstore-connect-mcp --transport stdio
+ *
+ *   # Remote (HTTP) — for server deployment
+ *   appstore-connect-mcp --transport http --port 3000 --host 0.0.0.0
+ *
+ * Environment variables:
+ *   APP_STORE_CONNECT_ISSUER_ID    Your App Store Connect issuer ID
+ *   APP_STORE_CONNECT_KEY_ID       Your API key ID
+ *   APP_STORE_CONNECT_PRIVATE_KEY  PEM private key content (alternative: path)
+ *   APP_STORE_CONNECT_P8_FILE      Path to your .p8 private key file
+ *   MCP_TRANSPORT                  'stdio' (default) or 'http'
+ *   MCP_PORT                       HTTP port (default: 3000)
+ *   MCP_HOST                       HTTP host (default: 0.0.0.0)
+ *   MCP_VERBOSE                    Set to '1' for verbose logging
+ */
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;GAoBG"}