@portablecore/integrations 0.3.0 → 0.4.0

package/dist/apple.d.ts

@@ -0,0 +1,76 @@
+/**
+ * @portablecore/integrations — Apple Developer
+ *
+ * App Store Connect API authentication (JWT generation) and
+ * credential resolution for Apple Developer integrations.
+ *
+ * Apple's API authentication requires:
+ *   1. A .p8 private key (ECDSA P-256)
+ *   2. A Key ID (from App Store Connect)
+ *   3. An Issuer ID (from App Store Connect)
+ *
+ * These are combined into a short-lived JWT (max 20 min) signed with ES256.
+ *
+ * Reference: https://developer.apple.com/documentation/appstoreconnectapi/generating_tokens_for_api_requests
+ */
+import type { AnySupabaseClient, ProviderScope, ProviderConfigResult } from "./types.js";
+/**
+ * Configuration stored in the integration's credentials/settings for
+ * Apple Developer provider.
+ */
+export interface AppleDeveloperConfig {
+    /** The Key ID from App Store Connect → Users and Access → Keys */
+    key_id: string;
+    /** The Issuer ID (UUID) from App Store Connect */
+    issuer_id: string;
+    /** The Apple Developer Team ID */
+    team_id: string;
+    /** The .p8 private key contents (PEM format) */
+    p8_key: string;
+    /** Comma-separated bundle IDs this key can access */
+    bundle_ids?: string;
+}
+/**
+ * A generated JWT for App Store Connect API authentication.
+ */
+export interface AppStoreConnectToken {
+    /** The signed JWT string */
+    token: string;
+    /** When the token expires (Unix timestamp in seconds) */
+    expiresAt: number;
+    /** The Key ID used to generate this token */
+    keyId: string;
+    /** The Issuer ID */
+    issuerId: string;
+}
+/**
+ * Generates a JWT for the App Store Connect API.
+ *
+ * The token is valid for 20 minutes (the maximum allowed by Apple).
+ * Callers should cache and reuse tokens until they expire.
+ *
+ * @param config - The Apple Developer credentials (key_id, issuer_id, p8_key)
+ * @param audience - The JWT audience. Defaults to "appstoreconnect-v1".
+ * @returns The signed JWT and expiry metadata
+ */
+export declare function generateAppStoreConnectJWT(config: Pick<AppleDeveloperConfig, "key_id" | "issuer_id" | "p8_key">, audience?: string): AppStoreConnectToken;
+/**
+ * Resolves Apple Developer credentials from the database using the standard
+ * integration config resolution chain.
+ *
+ * @param supabase - A Supabase client with service role access
+ * @param scope - Optional scope for credential resolution
+ * @returns The resolved Apple Developer config, or null if not configured
+ */
+export declare function getAppleDeveloperConfig(supabase: AnySupabaseClient, scope?: ProviderScope): Promise<ProviderConfigResult<AppleDeveloperConfig> | null>;
+/**
+ * Convenience: resolve Apple Developer credentials and generate a fresh JWT.
+ *
+ * @param supabase - A Supabase client with service role access
+ * @param scope - Optional scope for credential resolution
+ * @returns The JWT and config source, or null if not configured
+ */
+export declare function getAppStoreConnectToken(supabase: AnySupabaseClient, scope?: ProviderScope): Promise<(AppStoreConnectToken & {
+    source: string;
+}) | null>;
+//# sourceMappingURL=apple.d.ts.map

package/dist/apple.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple.d.ts","sourceRoot":"","sources":["../src/apple.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAOxF;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAA;IACd,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAA;IACjB,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAA;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAA;IACd,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAA;IACjB,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAA;IACb,oBAAoB;IACpB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAMD;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,GAAG,WAAW,GAAG,QAAQ,CAAC,EACrE,QAAQ,SAAuB,GAC9B,oBAAoB,CA2CtB;AAMD;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,iBAAiB,EAC3B,KAAK,CAAC,EAAE,aAAa,GACpB,OAAO,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAAC,CAE5D;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,iBAAiB,EAC3B,KAAK,CAAC,EAAE,aAAa,GACpB,OAAO,CAAC,CAAC,oBAAoB,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,CAAC,CAU7D"}

package/dist/apple.js

@@ -0,0 +1,181 @@
+"use strict";
+/**
+ * @portablecore/integrations — Apple Developer
+ *
+ * App Store Connect API authentication (JWT generation) and
+ * credential resolution for Apple Developer integrations.
+ *
+ * Apple's API authentication requires:
+ *   1. A .p8 private key (ECDSA P-256)
+ *   2. A Key ID (from App Store Connect)
+ *   3. An Issuer ID (from App Store Connect)
+ *
+ * These are combined into a short-lived JWT (max 20 min) signed with ES256.
+ *
+ * Reference: https://developer.apple.com/documentation/appstoreconnectapi/generating_tokens_for_api_requests
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateAppStoreConnectJWT = generateAppStoreConnectJWT;
+exports.getAppleDeveloperConfig = getAppleDeveloperConfig;
+exports.getAppStoreConnectToken = getAppStoreConnectToken;
+const crypto_1 = require("crypto");
+const config_js_1 = require("./config.js");
+// ---------------------------------------------------------------------------
+// JWT Generation
+// ---------------------------------------------------------------------------
+/**
+ * Generates a JWT for the App Store Connect API.
+ *
+ * The token is valid for 20 minutes (the maximum allowed by Apple).
+ * Callers should cache and reuse tokens until they expire.
+ *
+ * @param config - The Apple Developer credentials (key_id, issuer_id, p8_key)
+ * @param audience - The JWT audience. Defaults to "appstoreconnect-v1".
+ * @returns The signed JWT and expiry metadata
+ */
+function generateAppStoreConnectJWT(config, audience = "appstoreconnect-v1") {
+    const now = Math.floor(Date.now() / 1000);
+    const expiresAt = now + 20 * 60; // 20 minutes
+    // JWT Header
+    const header = {
+        alg: "ES256",
+        kid: config.key_id,
+        typ: "JWT",
+    };
+    // JWT Payload
+    const payload = {
+        iss: config.issuer_id,
+        iat: now,
+        exp: expiresAt,
+        aud: audience,
+    };
+    // Encode header and payload
+    const encodedHeader = base64UrlEncode(JSON.stringify(header));
+    const encodedPayload = base64UrlEncode(JSON.stringify(payload));
+    const signingInput = `${encodedHeader}.${encodedPayload}`;
+    // Sign with ES256 (ECDSA P-256 + SHA-256)
+    const signer = (0, crypto_1.createSign)("SHA256");
+    signer.update(signingInput);
+    signer.end();
+    // The p8 key should be in PEM format
+    const privateKey = normalizeP8Key(config.p8_key);
+    const derSignature = signer.sign(privateKey);
+    // Convert DER-encoded signature to raw IEEE P1363 format (r || s, 64 bytes)
+    const rawSignature = derToRaw(derSignature);
+    const encodedSignature = base64UrlEncode(rawSignature);
+    return {
+        token: `${signingInput}.${encodedSignature}`,
+        expiresAt,
+        keyId: config.key_id,
+        issuerId: config.issuer_id,
+    };
+}
+// ---------------------------------------------------------------------------
+// Credential Resolution
+// ---------------------------------------------------------------------------
+/**
+ * Resolves Apple Developer credentials from the database using the standard
+ * integration config resolution chain.
+ *
+ * @param supabase - A Supabase client with service role access
+ * @param scope - Optional scope for credential resolution
+ * @returns The resolved Apple Developer config, or null if not configured
+ */
+async function getAppleDeveloperConfig(supabase, scope) {
+    return (0, config_js_1.getProviderConfig)(supabase, "apple-developer", scope);
+}
+/**
+ * Convenience: resolve Apple Developer credentials and generate a fresh JWT.
+ *
+ * @param supabase - A Supabase client with service role access
+ * @param scope - Optional scope for credential resolution
+ * @returns The JWT and config source, or null if not configured
+ */
+async function getAppStoreConnectToken(supabase, scope) {
+    const result = await getAppleDeveloperConfig(supabase, scope);
+    if (!result)
+        return null;
+    // The config might be in different places depending on how it was stored
+    const config = resolveAppleConfig(result);
+    if (!config)
+        return null;
+    const jwt = generateAppStoreConnectJWT(config);
+    return { ...jwt, source: result.source };
+}
+// ---------------------------------------------------------------------------
+// Internal Helpers
+// ---------------------------------------------------------------------------
+/**
+ * Resolve Apple config from the various places it could be stored
+ * in the integration record (config, credentials, settings, or access_token).
+ */
+function resolveAppleConfig(result) {
+    // Try the typed config first
+    if (result.config?.key_id && result.config?.issuer_id && result.config?.p8_key) {
+        return result.config;
+    }
+    // Try credentials JSONB
+    const creds = result.credentials;
+    if (creds?.key_id && creds?.issuer_id && creds?.p8_key) {
+        return creds;
+    }
+    // Try settings JSONB
+    const settings = result.settings;
+    if (settings?.key_id && settings?.issuer_id && settings?.p8_key) {
+        return settings;
+    }
+    return null;
+}
+/**
+ * Ensure the P8 key has proper PEM formatting.
+ */
+function normalizeP8Key(key) {
+    const trimmed = key.trim();
+    if (trimmed.startsWith("-----BEGIN PRIVATE KEY-----")) {
+        return trimmed;
+    }
+    // If someone pasted just the base64 content without headers
+    return `-----BEGIN PRIVATE KEY-----\n${trimmed}\n-----END PRIVATE KEY-----`;
+}
+/**
+ * Base64url encode (RFC 7515).
+ */
+function base64UrlEncode(input) {
+    const buf = typeof input === "string" ? Buffer.from(input, "utf8") : input;
+    return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+/**
+ * Convert a DER-encoded ECDSA signature to raw IEEE P1363 format (r || s).
+ *
+ * Node.js's crypto.sign returns DER format, but JWT ES256 expects r||s (64 bytes).
+ */
+function derToRaw(derSig) {
+    // DER format: 0x30 [total-length] 0x02 [r-length] [r] 0x02 [s-length] [s]
+    let offset = 2; // skip SEQUENCE header (0x30, length)
+    // Parse r
+    if (derSig[offset] !== 0x02)
+        throw new Error("Invalid DER signature: expected INTEGER tag for r");
+    offset++;
+    const rLen = derSig[offset];
+    offset++;
+    let r = derSig.subarray(offset, offset + rLen);
+    offset += rLen;
+    // Parse s
+    if (derSig[offset] !== 0x02)
+        throw new Error("Invalid DER signature: expected INTEGER tag for s");
+    offset++;
+    const sLen = derSig[offset];
+    offset++;
+    let s = derSig.subarray(offset, offset + sLen);
+    // Remove leading zero padding (DER uses signed integers)
+    if (r.length > 32 && r[0] === 0x00)
+        r = r.subarray(1);
+    if (s.length > 32 && s[0] === 0x00)
+        s = s.subarray(1);
+    // Pad to 32 bytes each
+    const raw = Buffer.alloc(64);
+    r.copy(raw, 32 - r.length);
+    s.copy(raw, 64 - s.length);
+    return raw;
+}
+//# sourceMappingURL=apple.js.map

package/dist/apple.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple.js","sourceRoot":"","sources":["../src/apple.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AAuDH,gEA8CC;AAcD,0DAKC;AASD,0DAaC;AA5ID,mCAAmC;AAEnC,2CAA+C;AAqC/C,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,SAAgB,0BAA0B,CACxC,MAAqE,EACrE,QAAQ,GAAG,oBAAoB;IAE/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,MAAM,SAAS,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,CAAA,CAAC,aAAa;IAE7C,aAAa;IACb,MAAM,MAAM,GAAG;QACb,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,MAAM,CAAC,MAAM;QAClB,GAAG,EAAE,KAAK;KACX,CAAA;IAED,cAAc;IACd,MAAM,OAAO,GAAG;QACd,GAAG,EAAE,MAAM,CAAC,SAAS;QACrB,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,SAAS;QACd,GAAG,EAAE,QAAQ;KACd,CAAA;IAED,4BAA4B;IAC5B,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;IAC/D,MAAM,YAAY,GAAG,GAAG,aAAa,IAAI,cAAc,EAAE,CAAA;IAEzD,0CAA0C;IAC1C,MAAM,MAAM,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAA;IACnC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IAC3B,MAAM,CAAC,GAAG,EAAE,CAAA;IAEZ,qCAAqC;IACrC,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAChD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAE5C,4EAA4E;IAC5E,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAA;IAC3C,MAAM,gBAAgB,GAAG,eAAe,CAAC,YAAY,CAAC,CAAA;IAEtD,OAAO;QACL,KAAK,EAAE,GAAG,YAAY,IAAI,gBAAgB,EAAE;QAC5C,SAAS;QACT,KAAK,EAAE,MAAM,CAAC,MAAM;QACpB,QAAQ,EAAE,MAAM,CAAC,SAAS;KAC3B,CAAA;AACH,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;GAOG;AACI,KAAK,UAAU,uBAAuB,CAC3C,QAA2B,EAC3B,KAAqB;IAErB,OAAO,IAAA,6BAAiB,EAAuB,QAAQ,EAAE,iBAAiB,EAAE,KAAK,CAAC,CAAA;AACpF,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,uBAAuB,CAC3C,QAA2B,EAC3B,KAAqB;IAErB,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAC7D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAExB,yEAAyE;IACzE,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAExB,MAAM,GAAG,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAA;IAC9C,OAAO,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAA;AAC1C,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,kBAAkB,CACzB,MAAkD;IAElD,6BAA6B;IAC7B,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAC/E,OAAO,MAAM,CAAC,MAAM,CAAA;IACtB,CAAC;IAED,wBAAwB;IACxB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAwD,CAAA;IAC7E,IAAI,KAAK,EAAE,MAAM,IAAI,KAAK,EAAE,SAAS,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;QACvD,OAAO,KAAsE,CAAA;IAC/E,CAAC;IAED,qBAAqB;IACrB,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAqD,CAAA;IAC7E,IAAI,QAAQ,EAAE,MAAM,IAAI,QAAQ,EAAE,SAAS,IAAI,QAAQ,EAAE,MAAM,EAAE,CAAC;QAChE,OAAO,QAAyE,CAAA;IAClF,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IAC1B,IAAI,OAAO,CAAC,UAAU,CAAC,6BAA6B,CAAC,EAAE,CAAC;QACtD,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,4DAA4D;IAC5D,OAAO,gCAAgC,OAAO,6BAA6B,CAAA;AAC7E,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,KAAsB;IAC7C,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAC1E,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAC1F,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,MAAc;IAC9B,0EAA0E;IAC1E,IAAI,MAAM,GAAG,CAAC,CAAA,CAAC,sCAAsC;IAErD,UAAU;IACV,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACjG,MAAM,EAAE,CAAA;IACR,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAE,CAAA;IAC5B,MAAM,EAAE,CAAA;IACR,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAA;IAC9C,MAAM,IAAI,IAAI,CAAA;IAEd,UAAU;IACV,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACjG,MAAM,EAAE,CAAA;IACR,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAE,CAAA;IAC5B,MAAM,EAAE,CAAA;IACR,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAA;IAE9C,yDAAyD;IACzD,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;IACrD,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;IAErD,uBAAuB;IACvB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC5B,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAA;IAC1B,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAA;IAE1B,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/config.d.ts

@@ -7,9 +7,10 @@
  * Resolution order:
  *   1. Account-level (BYOK) — if scope.accountId provided
  *   2. User-level (OAuth tokens) — if scope.userId provided
- *   3. Platform-specific — if scope.platformIdentityId provided
- *   4. Metaplatform fallback — auto-detected via platform_identity.is_metaplatform
- *   5. Any active platform integration — legacy catch-all
+ *   3. Studio-level (workspace) — if scope.studioId provided
+ *   4. Platform-specific — if scope.platformIdentityId provided
+ *   5. Metaplatform fallback — auto-detected via platform_identity.is_metaplatform
+ *   6. Any active platform integration — legacy catch-all
  *
  * This generalizes what Expert's `getProviderApiKey()` does for AI providers
  * and what `getTwilioConfig()` does for Twilio into a single function.

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EACV,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACd,MAAM,YAAY,CAAA;AAMnB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjE,QAAQ,EAAE,iBAAiB,EAC3B,YAAY,EAAE,MAAM,EACpB,KAAK,CAAC,EAAE,aAAa,GACpB,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAwBzC;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,iBAAiB,EAC3B,YAAY,EAAE,MAAM,EACpB,KAAK,CAAC,EAAE,aAAa,GACpB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAkC9E"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EACV,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACd,MAAM,YAAY,CAAA;AAMnB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjE,QAAQ,EAAE,iBAAiB,EAC3B,YAAY,EAAE,MAAM,EACpB,KAAK,CAAC,EAAE,aAAa,GACpB,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAwBzC;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,iBAAiB,EAC3B,YAAY,EAAE,MAAM,EACpB,KAAK,CAAC,EAAE,aAAa,GACpB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAkC9E"}

package/dist/config.js

@@ -8,9 +8,10 @@
  * Resolution order:
  *   1. Account-level (BYOK) — if scope.accountId provided
  *   2. User-level (OAuth tokens) — if scope.userId provided
- *   3. Platform-specific — if scope.platformIdentityId provided
- *   4. Metaplatform fallback — auto-detected via platform_identity.is_metaplatform
- *   5. Any active platform integration — legacy catch-all
+ *   3. Studio-level (workspace) — if scope.studioId provided
+ *   4. Platform-specific — if scope.platformIdentityId provided
+ *   5. Metaplatform fallback — auto-detected via platform_identity.is_metaplatform
+ *   6. Any active platform integration — legacy catch-all
  *
  * This generalizes what Expert's `getProviderApiKey()` does for AI providers
  * and what `getTwilioConfig()` does for Twilio into a single function.
@@ -128,7 +129,15 @@ function buildFallbackChain(scope) {
             filters: { user_id: scope.userId },
         });
     }
-    // 3. Platform-specific
+    // 3. Studio-level (Team workspaces)
+    if (scope?.studioId) {
+        steps.push({
+            source: "studio",
+            contextType: "studio",
+            filters: { studio_id: scope.studioId },
+        });
+    }
+    // 4. Platform-specific
     if (scope?.platformIdentityId) {
         steps.push({
             source: "platform",
@@ -136,13 +145,13 @@ function buildFallbackChain(scope) {
             filters: { platform_identity_id: scope.platformIdentityId },
         });
     }
-    // 4. Metaplatform fallback (resolved dynamically in queryIntegration)
+    // 5. Metaplatform fallback (resolved dynamically in queryIntegration)
     steps.push({
         source: "metaplatform",
         contextType: "platform",
         filters: { __metaplatform: "true" }, // sentinel — resolved at query time
     });
-    // 5. Any active platform integration (legacy catch-all)
+    // 6. Any active platform integration (legacy catch-all)
     steps.push({
         source: "platform",
         contextType: "platform",

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;AAkCH,8CA4BC;AAiBD,8CAsCC;AAnHD,+CAA2C;AAQ3C,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;GAmBG;AACI,KAAK,UAAU,iBAAiB,CACrC,QAA2B,EAC3B,YAAoB,EACpB,KAAqB;IAErB,yBAAyB;IACzB,MAAM,QAAQ,GAAG,MAAM,IAAA,yBAAW,EAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;IAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,uCAAuC,YAAY,GAAG,CAAC,CAAA;QACpE,OAAO,IAAI,CAAA;IACb,CAAC;IAED,6BAA6B;IAC7B,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAEvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAI,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QACrE,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAA;QAC/C,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,OAAO,CAAC,IAAI,CACV,6CAA6C,YAAY,GAAG,EAC5D,KAAK,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAC3D,CAAA;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACI,KAAK,UAAU,iBAAiB,CACrC,QAA2B,EAC3B,YAAoB,EACpB,KAAqB;IAErB,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,CAAA;IACrE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAExB,oDAAoD;IACpD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,WAAW;YAC1B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAA;IACH,CAAC;IAED,qBAAqB;IACrB,MAAM,SAAS,GAAI,MAAM,CAAC,MAAkC,EAAE,OAAO,CAAA;IACrE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC/C,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAA;IACH,CAAC;IAED,0BAA0B;IAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,EAAE,OAAO,CAAA;IAC3C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC;QAC3C,OAAO;YACL,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAA;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAYD;;GAEG;AACH,SAAS,kBAAkB,CAAC,KAAqB;IAC/C,MAAM,KAAK,GAAmB,EAAE,CAAA;IAEhC,0BAA0B;IAC1B,IAAI,KAAK,EAAE,SAAS,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC;YACT,MAAM,EAAE,SAAS;YACjB,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE;SACzC,CAAC,CAAA;IACJ,CAAC;IAED,+BAA+B;IAC/B,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC;YACT,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,MAAM;YACnB,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE;SACnC,CAAC,CAAA;IACJ,CAAC;IAED,uBAAuB;IACvB,IAAI,KAAK,EAAE,kBAAkB,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC;YACT,MAAM,EAAE,UAAU;YAClB,WAAW,EAAE,UAAU;YACvB,OAAO,EAAE,EAAE,oBAAoB,EAAE,KAAK,CAAC,kBAAkB,EAAE;SAC5D,CAAC,CAAA;IACJ,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,IAAI,CAAC;QACT,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,UAAU;QACvB,OAAO,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,oCAAoC;KAC1E,CAAC,CAAA;IAEF,wDAAwD;IACxD,KAAK,CAAC,IAAI,CAAC;QACT,MAAM,EAAE,UAAU;QAClB,WAAW,EAAE,UAAU;QACvB,OAAO,EAAE,EAAE;KACZ,CAAC,CAAA;IAEF,OAAO,KAAK,CAAA;AACd,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;GAEG;AACH,KAAK,UAAU,gBAAgB,CAC7B,QAA2B,EAC3B,UAAkB,EAClB,IAAkB;IAElB,IAAI,CAAC;QACH,+BAA+B;QAC/B,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAChC,OAAO,MAAM,4BAA4B,CAAI,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QACjF,CAAC;QAED,yEAAyE;QACzE,uFAAuF;QACvF,yFAAyF;QACzF,6DAA6D;QAC7D,IAAI,KAAK,GAAG,QAAQ;aACjB,IAAI,CAAC,cAAc,CAAC;aACpB,MAAM,CAAC,GAAG,CAAC;aACX,EAAE,CAAC,aAAa,EAAE,UAAU,CAAC;aAC7B,EAAE,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC;aACpC,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;QAExB,sBAAsB;QACtB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACxD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC1C,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YAC9B,CAAC;QACH,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,CAAA;QAEjD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,+BAA+B,IAAI,CAAC,MAAM,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;YAC3E,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QAEtB,OAAO,iBAAiB,CAAI,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,oCAAoC,IAAI,CAAC,MAAM,IAAI,EAAE,GAAG,CAAC,CAAA;QACtE,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,4BAA4B,CACzC,QAA2B,EAC3B,UAAkB,EAClB,MAAoB;IAEpB,IAAI,CAAC;QACH,wBAAwB;QACxB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,QAAQ;aACpD,IAAI,CAAC,mBAAmB,CAAC;aACzB,MAAM,CAAC,IAAI,CAAC;aACZ,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC;aAC3B,WAAW,EAAE,CAAA;QAEhB,IAAI,SAAS,IAAI,CAAC,IAAI,EAAE,EAAE;YAAE,OAAO,IAAI,CAAA;QAEvC,yCAAyC;QACzC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ;aACnC,IAAI,CAAC,cAAc,CAAC;aACpB,MAAM,CAAC,GAAG,CAAC;aACX,EAAE,CAAC,aAAa,EAAE,UAAU,CAAC;aAC7B,EAAE,CAAC,cAAc,EAAE,UAAU,CAAC;aAC9B,EAAE,CAAC,sBAAsB,EAAE,IAAI,CAAC,EAAE,CAAC;aACnC,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC;aACrB,WAAW,EAAE,CAAA;QAEhB,IAAI,KAAK,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QAE/B,OAAO,iBAAiB,CAAI,IAAI,EAAE,MAAM,CAAC,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,SAAS,iBAAiB,CACxB,GAA4B,EAC5B,MAAoB;IAEpB,OAAO;QACL,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAM;QAC/B,MAAM;QACN,aAAa,EAAE,GAAG,CAAC,EAAY;QAC/B,WAAW,EAAE,GAAG,CAAC,YAAkC;QACnD,WAAW,EAAE,GAAG,CAAC,WAAkD;QACnE,QAAQ,EAAE,GAAG,CAAC,QAA+C;KAC9D,CAAA;AACH,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;AAkCH,8CA4BC;AAiBD,8CAsCC;AAnHD,+CAA2C;AAQ3C,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;GAmBG;AACI,KAAK,UAAU,iBAAiB,CACrC,QAA2B,EAC3B,YAAoB,EACpB,KAAqB;IAErB,yBAAyB;IACzB,MAAM,QAAQ,GAAG,MAAM,IAAA,yBAAW,EAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;IAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,uCAAuC,YAAY,GAAG,CAAC,CAAA;QACpE,OAAO,IAAI,CAAA;IACb,CAAC;IAED,6BAA6B;IAC7B,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAEvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAI,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QACrE,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAA;QAC/C,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,OAAO,CAAC,IAAI,CACV,6CAA6C,YAAY,GAAG,EAC5D,KAAK,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAC3D,CAAA;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACI,KAAK,UAAU,iBAAiB,CACrC,QAA2B,EAC3B,YAAoB,EACpB,KAAqB;IAErB,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,CAAA;IACrE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAExB,oDAAoD;IACpD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,WAAW;YAC1B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAA;IACH,CAAC;IAED,qBAAqB;IACrB,MAAM,SAAS,GAAI,MAAM,CAAC,MAAkC,EAAE,OAAO,CAAA;IACrE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC/C,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAA;IACH,CAAC;IAED,0BAA0B;IAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,EAAE,OAAO,CAAA;IAC3C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC;QAC3C,OAAO;YACL,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAA;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAYD;;GAEG;AACH,SAAS,kBAAkB,CAAC,KAAqB;IAC/C,MAAM,KAAK,GAAmB,EAAE,CAAA;IAEhC,0BAA0B;IAC1B,IAAI,KAAK,EAAE,SAAS,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC;YACT,MAAM,EAAE,SAAS;YACjB,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE;SACzC,CAAC,CAAA;IACJ,CAAC;IAED,+BAA+B;IAC/B,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC;YACT,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,MAAM;YACnB,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE;SACnC,CAAC,CAAA;IACJ,CAAC;IAED,oCAAoC;IACpC,IAAI,KAAK,EAAE,QAAQ,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC;YACT,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,QAAQ;YACrB,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE;SACvC,CAAC,CAAA;IACJ,CAAC;IAED,uBAAuB;IACvB,IAAI,KAAK,EAAE,kBAAkB,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC;YACT,MAAM,EAAE,UAAU;YAClB,WAAW,EAAE,UAAU;YACvB,OAAO,EAAE,EAAE,oBAAoB,EAAE,KAAK,CAAC,kBAAkB,EAAE;SAC5D,CAAC,CAAA;IACJ,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,IAAI,CAAC;QACT,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,UAAU;QACvB,OAAO,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,oCAAoC;KAC1E,CAAC,CAAA;IAEF,wDAAwD;IACxD,KAAK,CAAC,IAAI,CAAC;QACT,MAAM,EAAE,UAAU;QAClB,WAAW,EAAE,UAAU;QACvB,OAAO,EAAE,EAAE;KACZ,CAAC,CAAA;IAEF,OAAO,KAAK,CAAA;AACd,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;GAEG;AACH,KAAK,UAAU,gBAAgB,CAC7B,QAA2B,EAC3B,UAAkB,EAClB,IAAkB;IAElB,IAAI,CAAC;QACH,+BAA+B;QAC/B,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAChC,OAAO,MAAM,4BAA4B,CAAI,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QACjF,CAAC;QAED,yEAAyE;QACzE,uFAAuF;QACvF,yFAAyF;QACzF,6DAA6D;QAC7D,IAAI,KAAK,GAAG,QAAQ;aACjB,IAAI,CAAC,cAAc,CAAC;aACpB,MAAM,CAAC,GAAG,CAAC;aACX,EAAE,CAAC,aAAa,EAAE,UAAU,CAAC;aAC7B,EAAE,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC;aACpC,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;QAExB,sBAAsB;QACtB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACxD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC1C,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YAC9B,CAAC;QACH,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,CAAA;QAEjD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,+BAA+B,IAAI,CAAC,MAAM,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;YAC3E,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QAEtB,OAAO,iBAAiB,CAAI,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,oCAAoC,IAAI,CAAC,MAAM,IAAI,EAAE,GAAG,CAAC,CAAA;QACtE,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,4BAA4B,CACzC,QAA2B,EAC3B,UAAkB,EAClB,MAAoB;IAEpB,IAAI,CAAC;QACH,wBAAwB;QACxB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,QAAQ;aACpD,IAAI,CAAC,mBAAmB,CAAC;aACzB,MAAM,CAAC,IAAI,CAAC;aACZ,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC;aAC3B,WAAW,EAAE,CAAA;QAEhB,IAAI,SAAS,IAAI,CAAC,IAAI,EAAE,EAAE;YAAE,OAAO,IAAI,CAAA;QAEvC,yCAAyC;QACzC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ;aACnC,IAAI,CAAC,cAAc,CAAC;aACpB,MAAM,CAAC,GAAG,CAAC;aACX,EAAE,CAAC,aAAa,EAAE,UAAU,CAAC;aAC7B,EAAE,CAAC,cAAc,EAAE,UAAU,CAAC;aAC9B,EAAE,CAAC,sBAAsB,EAAE,IAAI,CAAC,EAAE,CAAC;aACnC,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC;aACrB,WAAW,EAAE,CAAA;QAEhB,IAAI,KAAK,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QAE/B,OAAO,iBAAiB,CAAI,IAAI,EAAE,MAAM,CAAC,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,SAAS,iBAAiB,CACxB,GAA4B,EAC5B,MAAoB;IAEpB,OAAO;QACL,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAM;QAC/B,MAAM;QACN,aAAa,EAAE,GAAG,CAAC,EAAY;QAC/B,WAAW,EAAE,GAAG,CAAC,YAAkC;QACnD,WAAW,EAAE,GAAG,CAAC,WAAkD;QACnE,QAAQ,EAAE,GAAG,CAAC,QAA+C;KAC9D,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -23,4 +23,6 @@ export { getProvider, getProviders, listProviders } from "./provider.js";
 export { getProviderConfig, getProviderApiKey } from "./config.js";
 export { getSurfaceCapabilities } from "./capabilities.js";
 export type { CredentialAvailability } from "./capabilities.js";
+export { generateAppStoreConnectJWT, getAppleDeveloperConfig, getAppStoreConnectToken, } from "./apple.js";
+export type { AppleDeveloperConfig, AppStoreConnectToken, } from "./apple.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,YAAY,EACZ,iBAAiB,GAClB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAA;AAGxD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAGxE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAGlE,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAC1D,YAAY,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,YAAY,EACZ,iBAAiB,GAClB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAA;AAGxD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAGxE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAGlE,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAC1D,YAAY,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAG/D,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,YAAY,CAAA;AACnB,YAAY,EACV,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,YAAY,CAAA"}

package/dist/index.js

@@ -19,7 +19,7 @@
  * "The expert brings expertise. The surface provides integrations."
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getSurfaceCapabilities = exports.getProviderApiKey = exports.getProviderConfig = exports.listProviders = exports.getProviders = exports.getProvider = exports.DEFAULT_CAPABILITY_MAPPINGS = void 0;
+exports.getAppStoreConnectToken = exports.getAppleDeveloperConfig = exports.generateAppStoreConnectJWT = exports.getSurfaceCapabilities = exports.getProviderApiKey = exports.getProviderConfig = exports.listProviders = exports.getProviders = exports.getProvider = exports.DEFAULT_CAPABILITY_MAPPINGS = void 0;
 var types_js_1 = require("./types.js");
 Object.defineProperty(exports, "DEFAULT_CAPABILITY_MAPPINGS", { enumerable: true, get: function () { return types_js_1.DEFAULT_CAPABILITY_MAPPINGS; } });
 // Provider lookup
@@ -34,4 +34,9 @@ Object.defineProperty(exports, "getProviderApiKey", { enumerable: true, get: fun
 // PEP capability discovery
 var capabilities_js_1 = require("./capabilities.js");
 Object.defineProperty(exports, "getSurfaceCapabilities", { enumerable: true, get: function () { return capabilities_js_1.getSurfaceCapabilities; } });
+// Apple Developer (App Store Connect API)
+var apple_js_1 = require("./apple.js");
+Object.defineProperty(exports, "generateAppStoreConnectJWT", { enumerable: true, get: function () { return apple_js_1.generateAppStoreConnectJWT; } });
+Object.defineProperty(exports, "getAppleDeveloperConfig", { enumerable: true, get: function () { return apple_js_1.getAppleDeveloperConfig; } });
+Object.defineProperty(exports, "getAppStoreConnectToken", { enumerable: true, get: function () { return apple_js_1.getAppStoreConnectToken; } });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;AAaH,uCAAwD;AAA/C,uHAAA,2BAA2B,OAAA;AAEpC,kBAAkB;AAClB,6CAAwE;AAA/D,0GAAA,WAAW,OAAA;AAAE,2GAAA,YAAY,OAAA;AAAE,4GAAA,aAAa,OAAA;AAEjD,wBAAwB;AACxB,yCAAkE;AAAzD,8GAAA,iBAAiB,OAAA;AAAE,8GAAA,iBAAiB,OAAA;AAE7C,2BAA2B;AAC3B,qDAA0D;AAAjD,yHAAA,sBAAsB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;AAaH,uCAAwD;AAA/C,uHAAA,2BAA2B,OAAA;AAEpC,kBAAkB;AAClB,6CAAwE;AAA/D,0GAAA,WAAW,OAAA;AAAE,2GAAA,YAAY,OAAA;AAAE,4GAAA,aAAa,OAAA;AAEjD,wBAAwB;AACxB,yCAAkE;AAAzD,8GAAA,iBAAiB,OAAA;AAAE,8GAAA,iBAAiB,OAAA;AAE7C,2BAA2B;AAC3B,qDAA0D;AAAjD,yHAAA,sBAAsB,OAAA;AAG/B,0CAA0C;AAC1C,uCAImB;AAHjB,sHAAA,0BAA0B,OAAA;AAC1B,mHAAA,uBAAuB,OAAA;AACvB,mHAAA,uBAAuB,OAAA"}

package/dist/types.d.ts

@@ -37,9 +37,10 @@ export type IntegrationRole = "think" | "work" | "infrastructure";
  * Determines which `integrations` rows are checked and in what order:
  *   1. Account-level (BYOK) — if `accountId` provided
  *   2. User-level (OAuth tokens) — if `userId` provided
- *   3. Platform-specific — if `platformIdentityId` provided
- *   4. Metaplatform fallback — auto-detected via `is_metaplatform`
- *   5. Any active platform integration — legacy catch-all
+ *   3. Studio-level (workspace) — if `studioId` provided
+ *   4. Platform-specific — if `platformIdentityId` provided
+ *   5. Metaplatform fallback — auto-detected via `is_metaplatform`
+ *   6. Any active platform integration — legacy catch-all
  */
 export interface ProviderScope {
     /** Check account-level integration first (BYOK API keys) */
@@ -48,6 +49,8 @@ export interface ProviderScope {
     userId?: string;
     /** Check a specific platform's integration */
     platformIdentityId?: string;
+    /** Check a specific studio's integration (Team workspaces) */
+    studioId?: string;
 }
 /**
  * The resolved configuration for an integration provider.
@@ -74,7 +77,7 @@ export interface ProviderConfigResult<T = Record<string, unknown>> {
     /** The settings JSONB column (non-secret configuration) */
     settings?: Record<string, unknown>;
 }
-export type ConfigSource = "account" | "user" | "platform" | "metaplatform";
+export type ConfigSource = "account" | "user" | "studio" | "platform" | "metaplatform";
 /**
  * Maps an integration provider category to a PEP credential type.
  *

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,MAAM,MAAM,iBAAiB,GAAG,GAAG,CAAA;AAMnC;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB,YAAY,CAAC,EAAE,OAAO,EAAE,CAAA;IACxB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB;;;;;;OAMG;IACH,eAAe,EAAE,eAAe,CAAA;CACjC;AAED,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,MAAM,GAAG,gBAAgB,CAAA;AAMjE;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,8CAA8C;IAC9C,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAMD;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC/D,0DAA0D;IAC1D,MAAM,EAAE,CAAC,CAAA;IACT,6CAA6C;IAC7C,MAAM,EAAE,YAAY,CAAA;IACpB,mCAAmC;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,0BAA0B;IAC1B,aAAa,EAAE,MAAM,CAAA;IACrB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACrC,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,MAAM,GAAG,UAAU,GAAG,cAAc,CAAA;AAM3E;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAA;IACpB,2CAA2C;IAC3C,cAAc,EAAE,MAAM,CAAA;IACtB,qDAAqD;IACrD,cAAc,EAAE,MAAM,CAAA;CACvB;AAED;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,EAAE,iBAAiB,EAS1D,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,MAAM,MAAM,iBAAiB,GAAG,GAAG,CAAA;AAMnC;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB,YAAY,CAAC,EAAE,OAAO,EAAE,CAAA;IACxB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB;;;;;;OAMG;IACH,eAAe,EAAE,eAAe,CAAA;CACjC;AAED,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,MAAM,GAAG,gBAAgB,CAAA;AAMjE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC5B,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,8CAA8C;IAC9C,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAMD;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC/D,0DAA0D;IAC1D,MAAM,EAAE,CAAC,CAAA;IACT,6CAA6C;IAC7C,MAAM,EAAE,YAAY,CAAA;IACpB,mCAAmC;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,0BAA0B;IAC1B,aAAa,EAAE,MAAM,CAAA;IACrB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACrC,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,cAAc,CAAA;AAMtF;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAA;IACpB,2CAA2C;IAC3C,cAAc,EAAE,MAAM,CAAA;IACtB,qDAAqD;IACrD,cAAc,EAAE,MAAM,CAAA;CACvB;AAED;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,EAAE,iBAAiB,EAS1D,CAAA"}

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AA8GH;;;;;GAKG;AACU,QAAA,2BAA2B,GAAwB;IAC9D,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE;IAClF,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE;IACxF,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE;IACvF,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE;IACzF,EAAE,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,WAAW,EAAE,cAAc,EAAE,wBAAwB,EAAE;IAC3G,EAAE,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,UAAU,EAAE,cAAc,EAAE,uBAAuB,EAAE;IACxG,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,kBAAkB,EAAE;IAC5F,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE;CACrF,CAAA"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAiHH;;;;;GAKG;AACU,QAAA,2BAA2B,GAAwB;IAC9D,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE;IAClF,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE;IACxF,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE;IACvF,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE;IACzF,EAAE,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,WAAW,EAAE,cAAc,EAAE,wBAAwB,EAAE;IAC3G,EAAE,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,UAAU,EAAE,cAAc,EAAE,uBAAuB,EAAE;IACxG,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,kBAAkB,EAAE;IAC5F,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE;CACrF,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@portablecore/integrations",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Shared integration provider registry and credential resolution for Portable platforms",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -20,11 +20,21 @@
     "./capabilities": {
       "types": "./dist/capabilities.d.ts",
       "default": "./dist/capabilities.js"
+    },
+    "./apple": {
+      "types": "./dist/apple.d.ts",
+      "default": "./dist/apple.js"
     }
   },
   "files": [
     "dist"
   ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "clean": "rm -rf dist",
+    "typecheck": "tsc --noEmit"
+  },
   "keywords": [
     "portable",
     "integrations",
@@ -40,11 +50,5 @@
   "devDependencies": {
     "@supabase/supabase-js": "^2.49.0",
     "typescript": "^5.3.0"
-  },
-  "scripts": {
-    "build": "tsc",
-    "dev": "tsc --watch",
-    "clean": "rm -rf dist",
-    "typecheck": "tsc --noEmit"
   }
-}
+}