@hubspot/app-connect-sdk 1.0.0-alpha.1

package/dist/server/hono/hubspot-connect-routes/auth-refresh.js

@@ -0,0 +1,101 @@
+import { sha256base64url } from "../../shared/encoding/sha256.js";
+import { HUBSPOT_ACCESS_TOKEN_COOKIE_NAME, HUBSPOT_APP_SID_COOKIE_NAME, HUBSPOT_REFRESH_COOKIE_PREFIX } from "../../constants.js";
+import { parseCookies } from "../../utils/cookie-utils.js";
+import { serializeCookie, setResponseCookie } from "../utils/cookie-utils.js";
+import { REFRESH_COOKIE_MAX_AGE_SEC } from "./constants.js";
+import { buildClientAssertion, buildClientAssertionFormParams, buildClientSecretFormParams, buildTokenEndpointDpopProof, requestOAuthToken } from "./oauth-client.js";
+import { buildCimdClientIdUrlFromRequest, isPositiveFiniteNumber } from "./utils.js";
+//#region src/server/hono/hubspot-connect-routes/auth-refresh.ts
+async function handleAuthRefresh(c, options) {
+	const { appKeys, refreshCookiePath, basePath, hubspotConnectEnv } = options;
+	const xForwardedProto = c.req.header("x-forwarded-proto") ?? void 0;
+	const xForwardedHost = c.req.header("x-forwarded-host") ?? void 0;
+	const requestHostHeader = c.req.header("host") ?? void 0;
+	const cookies = parseCookies(c.req.header("Cookie"));
+	const sessionId = cookies[HUBSPOT_APP_SID_COOKIE_NAME];
+	if (!sessionId) return c.json({ error: "Missing session cookie" }, 401);
+	if (hubspotConnectEnv.isAppPrivateKeyRequired && !appKeys) return c.json({ error: "Server misconfiguration: HUBSPOT_APP_PRIVATE_KEY is required when CIMD or DPoP is enabled" }, 500);
+	const sidHash = await sha256base64url(sessionId);
+	const refreshCookieName = `${HUBSPOT_REFRESH_COOKIE_PREFIX}${sidHash}`;
+	const refreshToken = cookies[refreshCookieName];
+	if (!refreshToken) return c.json({ error: "Missing refresh token" }, 401);
+	const clientId = hubspotConnectEnv.isCimdEnabled ? buildCimdClientIdUrlFromRequest({
+		requestUrl: c.req.url,
+		basePath,
+		xForwardedProto,
+		xForwardedHost,
+		requestHostHeader
+	}) : hubspotConnectEnv.hubspotClientId;
+	const tokenEndpointUrl = new URL("/oauth/v1/token", hubspotConnectEnv.hubspotOAuthApiOrigin).href;
+	let dpopProof;
+	if (hubspotConnectEnv.isDpopEnabled) dpopProof = await buildTokenEndpointDpopProof({
+		appKeys,
+		tokenEndpointUrl,
+		sessionIdHash: sidHash
+	});
+	let formParams;
+	if (hubspotConnectEnv.isCimdEnabled) formParams = {
+		grant_type: "refresh_token",
+		refresh_token: refreshToken,
+		...buildClientAssertionFormParams({
+			clientId,
+			clientAssertion: await buildClientAssertion({
+				appKeys,
+				clientId,
+				audience: tokenEndpointUrl
+			})
+		})
+	};
+	else formParams = {
+		grant_type: "refresh_token",
+		refresh_token: refreshToken,
+		...buildClientSecretFormParams({
+			clientId,
+			clientSecret: hubspotConnectEnv.hubspotClientSecret
+		})
+	};
+	const tokenResult = await requestOAuthToken({
+		tokenEndpointUrl,
+		isDpopEnabled: hubspotConnectEnv.isDpopEnabled,
+		...dpopProof !== void 0 ? { dpopProof } : {},
+		formParams
+	});
+	if (!tokenResult.ok) return c.json({ error: `Token refresh failed: ${tokenResult.errorText}` }, 502);
+	const { access_token: newAccessToken, refresh_token: newRefreshToken, expires_in } = tokenResult.body;
+	if (!newRefreshToken) return c.json({ error: "Token response missing refresh_token" }, 502);
+	if (!isPositiveFiniteNumber(expires_in)) return c.json({ error: "Token response missing or invalid expires_in" }, 502);
+	setResponseCookie({
+		c,
+		value: serializeCookie({
+			name: HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,
+			value: newAccessToken,
+			path: "/",
+			maxAge: expires_in
+		})
+	});
+	setResponseCookie({
+		c,
+		value: serializeCookie({
+			name: refreshCookieName,
+			value: newRefreshToken,
+			path: refreshCookiePath,
+			maxAge: REFRESH_COOKIE_MAX_AGE_SEC
+		})
+	});
+	Object.keys(cookies).forEach((cookieName) => {
+		if (cookieName.startsWith("hs_refresh_") && cookieName !== refreshCookieName) setResponseCookie({
+			c,
+			value: serializeCookie({
+				name: cookieName,
+				value: "",
+				path: refreshCookiePath,
+				maxAge: 0
+			})
+		});
+	});
+	return c.json({ expires_in });
+}
+//#endregion
+export { handleAuthRefresh };
+
+//# sourceMappingURL=auth-refresh.js.map

package/dist/server/hono/hubspot-connect-routes/auth-refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-refresh.js","names":[],"sources":["../../../../src/server/hono/hubspot-connect-routes/auth-refresh.ts"],"sourcesContent":["import type { Context } from 'hono';\n\nimport {\n  HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,\n  HUBSPOT_APP_SID_COOKIE_NAME,\n  HUBSPOT_REFRESH_COOKIE_PREFIX,\n} from '../../constants.ts';\nimport { parseCookies } from '../../utils/cookie-utils.ts';\nimport { sha256base64url } from '../../utils/crypto-utils.ts';\nimport { serializeCookie, setResponseCookie } from '../utils/cookie-utils.ts';\nimport { REFRESH_COOKIE_MAX_AGE_SEC } from './constants.ts';\nimport {\n  buildClientAssertion,\n  buildClientAssertionFormParams,\n  buildClientSecretFormParams,\n  buildTokenEndpointDpopProof,\n  requestOAuthToken,\n} from './oauth-client.ts';\nimport type { HubSpotConnectOAuthRouteOptions } from './types.ts';\nimport {\n  buildCimdClientIdUrlFromRequest,\n  isPositiveFiniteNumber,\n} from './utils.ts';\n\nexport async function handleAuthRefresh(\n  c: Context,\n  options: HubSpotConnectOAuthRouteOptions\n) {\n  const { appKeys, refreshCookiePath, basePath, hubspotConnectEnv } = options;\n  const xForwardedProto = c.req.header('x-forwarded-proto') ?? undefined;\n  const xForwardedHost = c.req.header('x-forwarded-host') ?? undefined;\n  const requestHostHeader = c.req.header('host') ?? undefined;\n  const cookies = parseCookies(c.req.header('Cookie'));\n  const sessionId = cookies[HUBSPOT_APP_SID_COOKIE_NAME];\n  if (!sessionId) {\n    return c.json({ error: 'Missing session cookie' }, 401);\n  }\n\n  if (hubspotConnectEnv.isAppPrivateKeyRequired && !appKeys) {\n    return c.json(\n      {\n        error:\n          'Server misconfiguration: HUBSPOT_APP_PRIVATE_KEY is required when CIMD or DPoP is enabled',\n      },\n      500\n    );\n  }\n\n  const sidHash = await sha256base64url(sessionId);\n  const refreshCookieName = `${HUBSPOT_REFRESH_COOKIE_PREFIX}${sidHash}`;\n  const refreshToken = cookies[refreshCookieName];\n  if (!refreshToken) {\n    return c.json({ error: 'Missing refresh token' }, 401);\n  }\n\n  const clientId = hubspotConnectEnv.isCimdEnabled\n    ? buildCimdClientIdUrlFromRequest({\n        requestUrl: c.req.url,\n        basePath,\n        xForwardedProto,\n        xForwardedHost,\n        requestHostHeader,\n      })\n    : hubspotConnectEnv.hubspotClientId;\n\n  const tokenEndpointUrl = new URL(\n    '/oauth/v1/token',\n    hubspotConnectEnv.hubspotOAuthApiOrigin\n  ).href;\n\n  let dpopProof: string | undefined;\n  if (hubspotConnectEnv.isDpopEnabled) {\n    dpopProof = await buildTokenEndpointDpopProof({\n      appKeys: appKeys!,\n      tokenEndpointUrl,\n      sessionIdHash: sidHash,\n    });\n  }\n\n  let formParams: Record<string, string>;\n  if (hubspotConnectEnv.isCimdEnabled) {\n    const clientAssertion = await buildClientAssertion({\n      appKeys: appKeys!,\n      clientId,\n      audience: tokenEndpointUrl,\n    });\n    formParams = {\n      grant_type: 'refresh_token',\n      refresh_token: refreshToken,\n      ...buildClientAssertionFormParams({ clientId, clientAssertion }),\n    };\n  } else {\n    formParams = {\n      grant_type: 'refresh_token',\n      refresh_token: refreshToken,\n      ...buildClientSecretFormParams({\n        clientId,\n        clientSecret: hubspotConnectEnv.hubspotClientSecret,\n      }),\n    };\n  }\n\n  const tokenResult = await requestOAuthToken({\n    tokenEndpointUrl,\n    isDpopEnabled: hubspotConnectEnv.isDpopEnabled,\n    ...(dpopProof !== undefined ? { dpopProof } : {}),\n    formParams,\n  });\n  if (!tokenResult.ok) {\n    return c.json(\n      { error: `Token refresh failed: ${tokenResult.errorText}` },\n      502\n    );\n  }\n\n  const {\n    access_token: newAccessToken,\n    refresh_token: newRefreshToken,\n    expires_in,\n  } = tokenResult.body;\n\n  if (!newRefreshToken) {\n    return c.json({ error: 'Token response missing refresh_token' }, 502);\n  }\n  if (!isPositiveFiniteNumber(expires_in)) {\n    return c.json(\n      { error: 'Token response missing or invalid expires_in' },\n      502\n    );\n  }\n\n  setResponseCookie({\n    c,\n    value: serializeCookie({\n      name: HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,\n      value: newAccessToken,\n      path: '/',\n      maxAge: expires_in,\n    }),\n  });\n  setResponseCookie({\n    c,\n    value: serializeCookie({\n      name: refreshCookieName,\n      value: newRefreshToken,\n      path: refreshCookiePath,\n      maxAge: REFRESH_COOKIE_MAX_AGE_SEC,\n    }),\n  });\n\n  // Cookies prefixed with HUBSPOT_REFRESH_COOKIE_PREFIX that don't match the\n  // new refresh cookie name are stale and need to be cleared.\n  Object.keys(cookies).forEach((cookieName) => {\n    if (\n      cookieName.startsWith(HUBSPOT_REFRESH_COOKIE_PREFIX) &&\n      cookieName !== refreshCookieName\n    ) {\n      setResponseCookie({\n        c,\n        value: serializeCookie({\n          name: cookieName,\n          value: '',\n          path: refreshCookiePath,\n          maxAge: 0,\n        }),\n      });\n    }\n  });\n\n  return c.json({ expires_in });\n}\n"],"mappings":";;;;;;;;AAwBA,eAAsB,kBACpB,GACA,SACA;CACA,MAAM,EAAE,SAAS,mBAAmB,UAAU,sBAAsB;CACpE,MAAM,kBAAkB,EAAE,IAAI,OAAO,oBAAoB,IAAI,KAAA;CAC7D,MAAM,iBAAiB,EAAE,IAAI,OAAO,mBAAmB,IAAI,KAAA;CAC3D,MAAM,oBAAoB,EAAE,IAAI,OAAO,OAAO,IAAI,KAAA;CAClD,MAAM,UAAU,aAAa,EAAE,IAAI,OAAO,SAAS,CAAC;CACpD,MAAM,YAAY,QAAQ;CAC1B,IAAI,CAAC,WACH,OAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,IAAI;CAGzD,IAAI,kBAAkB,2BAA2B,CAAC,SAChD,OAAO,EAAE,KACP,EACE,OACE,6FACH,EACD,IACD;CAGH,MAAM,UAAU,MAAM,gBAAgB,UAAU;CAChD,MAAM,oBAAoB,GAAG,gCAAgC;CAC7D,MAAM,eAAe,QAAQ;CAC7B,IAAI,CAAC,cACH,OAAO,EAAE,KAAK,EAAE,OAAO,yBAAyB,EAAE,IAAI;CAGxD,MAAM,WAAW,kBAAkB,gBAC/B,gCAAgC;EAC9B,YAAY,EAAE,IAAI;EAClB;EACA;EACA;EACA;EACD,CAAC,GACF,kBAAkB;CAEtB,MAAM,mBAAmB,IAAI,IAC3B,mBACA,kBAAkB,sBACnB,CAAC;CAEF,IAAI;CACJ,IAAI,kBAAkB,eACpB,YAAY,MAAM,4BAA4B;EACnC;EACT;EACA,eAAe;EAChB,CAAC;CAGJ,IAAI;CACJ,IAAI,kBAAkB,eAMpB,aAAa;EACX,YAAY;EACZ,eAAe;EACf,GAAG,+BAA+B;GAAE;GAAU,iBAAA,MARlB,qBAAqB;IACxC;IACT;IACA,UAAU;IACX,CAAC;GAI+D,CAAC;EACjE;MAED,aAAa;EACX,YAAY;EACZ,eAAe;EACf,GAAG,4BAA4B;GAC7B;GACA,cAAc,kBAAkB;GACjC,CAAC;EACH;CAGH,MAAM,cAAc,MAAM,kBAAkB;EAC1C;EACA,eAAe,kBAAkB;EACjC,GAAI,cAAc,KAAA,IAAY,EAAE,WAAW,GAAG,EAAE;EAChD;EACD,CAAC;CACF,IAAI,CAAC,YAAY,IACf,OAAO,EAAE,KACP,EAAE,OAAO,yBAAyB,YAAY,aAAa,EAC3D,IACD;CAGH,MAAM,EACJ,cAAc,gBACd,eAAe,iBACf,eACE,YAAY;CAEhB,IAAI,CAAC,iBACH,OAAO,EAAE,KAAK,EAAE,OAAO,wCAAwC,EAAE,IAAI;CAEvE,IAAI,CAAC,uBAAuB,WAAW,EACrC,OAAO,EAAE,KACP,EAAE,OAAO,gDAAgD,EACzD,IACD;CAGH,kBAAkB;EAChB;EACA,OAAO,gBAAgB;GACrB,MAAM;GACN,OAAO;GACP,MAAM;GACN,QAAQ;GACT,CAAC;EACH,CAAC;CACF,kBAAkB;EAChB;EACA,OAAO,gBAAgB;GACrB,MAAM;GACN,OAAO;GACP,MAAM;GACN,QAAQ;GACT,CAAC;EACH,CAAC;CAIF,OAAO,KAAK,QAAQ,CAAC,SAAS,eAAe;EAC3C,IACE,WAAW,WAAA,cAAyC,IACpD,eAAe,mBAEf,kBAAkB;GAChB;GACA,OAAO,gBAAgB;IACrB,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;IACT,CAAC;GACH,CAAC;GAEJ;CAEF,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC"}

package/dist/server/hono/hubspot-connect-routes/cimd-client-metadata-types.d.ts

@@ -0,0 +1,16 @@
+//#region src/server/hono/hubspot-connect-routes/cimd-client-metadata-types.d.ts
+/**
+ * Caller-supplied scope configuration for the CIMD document served at
+ * `{basePath}/client.json`. `redirect_uri` and `jwks_uri` are derived at
+ * request time by the hubspot-connect routes.
+ */
+interface HubSpotConnectCimdClientMetadata {
+  scope: HubSpotConnectCimdClientScope;
+}
+interface HubSpotConnectCimdClientScope {
+  required: string[];
+  optional?: string[];
+}
+//#endregion
+export { HubSpotConnectCimdClientMetadata };
+//# sourceMappingURL=cimd-client-metadata-types.d.ts.map

package/dist/server/hono/hubspot-connect-routes/cimd-client-metadata-types.js

@@ -0,0 +1,13 @@
+//#region src/server/hono/hubspot-connect-routes/cimd-client-metadata-types.ts
+function assertHubSpotConnectCimdClientMetadata(value) {
+	const required = value.scope?.required;
+	if (!(Array.isArray(required) && required.length > 0 && required.every((s) => typeof s === "string" && s.length > 0))) throw new Error("HubSpotConnectCimdClientMetadata.scope.required must be a non-empty array of non-empty strings");
+	const optional = value.scope.optional;
+	if (optional === void 0) return;
+	if (!Array.isArray(optional)) throw new Error("HubSpotConnectCimdClientMetadata.scope.optional must be an array when set");
+	if (optional.length > 0 && !optional.every((s) => typeof s === "string" && s.length > 0)) throw new Error("HubSpotConnectCimdClientMetadata.scope.optional entries must be non-empty strings");
+}
+//#endregion
+export { assertHubSpotConnectCimdClientMetadata };
+
+//# sourceMappingURL=cimd-client-metadata-types.js.map

package/dist/server/hono/hubspot-connect-routes/cimd-client-metadata-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd-client-metadata-types.js","names":[],"sources":["../../../../src/server/hono/hubspot-connect-routes/cimd-client-metadata-types.ts"],"sourcesContent":["/**\n * Caller-supplied scope configuration for the CIMD document served at\n * `{basePath}/client.json`. `redirect_uri` and `jwks_uri` are derived at\n * request time by the hubspot-connect routes.\n */\nexport interface HubSpotConnectCimdClientMetadata {\n  scope: HubSpotConnectCimdClientScope;\n}\n\nexport interface HubSpotConnectCimdClientScope {\n  required: string[];\n  optional?: string[];\n}\n\n/**\n * JSON body returned by `GET {basePath}/client.json` (HubSpot CIMD).\n */\nexport interface HubSpotConnectCimdClientDocument {\n  redirect_uri: string;\n  jwks_uri: string;\n  scope: HubSpotConnectCimdClientScope;\n}\n\nexport function assertHubSpotConnectCimdClientMetadata(\n  value: HubSpotConnectCimdClientMetadata\n): void {\n  const required = value.scope?.required;\n  const requiredOk =\n    Array.isArray(required) &&\n    required.length > 0 &&\n    required.every((s) => typeof s === 'string' && s.length > 0);\n  if (!requiredOk) {\n    throw new Error(\n      'HubSpotConnectCimdClientMetadata.scope.required must be a non-empty array of non-empty strings'\n    );\n  }\n  const optional = value.scope.optional;\n  if (optional === undefined) {\n    return;\n  }\n  if (!Array.isArray(optional)) {\n    throw new Error(\n      'HubSpotConnectCimdClientMetadata.scope.optional must be an array when set'\n    );\n  }\n  if (\n    optional.length > 0 &&\n    !optional.every((s) => typeof s === 'string' && s.length > 0)\n  ) {\n    throw new Error(\n      'HubSpotConnectCimdClientMetadata.scope.optional entries must be non-empty strings'\n    );\n  }\n}\n"],"mappings":";AAuBA,SAAgB,uCACd,OACM;CACN,MAAM,WAAW,MAAM,OAAO;CAK9B,IAAI,EAHF,MAAM,QAAQ,SAAS,IACvB,SAAS,SAAS,KAClB,SAAS,OAAO,MAAM,OAAO,MAAM,YAAY,EAAE,SAAS,EAAE,GAE5D,MAAM,IAAI,MACR,iGACD;CAEH,MAAM,WAAW,MAAM,MAAM;CAC7B,IAAI,aAAa,KAAA,GACf;CAEF,IAAI,CAAC,MAAM,QAAQ,SAAS,EAC1B,MAAM,IAAI,MACR,4EACD;CAEH,IACE,SAAS,SAAS,KAClB,CAAC,SAAS,OAAO,MAAM,OAAO,MAAM,YAAY,EAAE,SAAS,EAAE,EAE7D,MAAM,IAAI,MACR,oFACD"}

package/dist/server/hono/hubspot-connect-routes/cimd-public-routes.js

@@ -0,0 +1,42 @@
+import { getJwkThumbprint } from "../../utils/jwk-utils.js";
+import { buildHubSpotAppJwksUrlFromRequest, buildOAuthRedirectUriFromRequest } from "./utils.js";
+//#region src/server/hono/hubspot-connect-routes/cimd-public-routes.ts
+async function handleCimdClientJson(c, options) {
+	const { cimdClientMetadata, basePath } = options;
+	if (!cimdClientMetadata) return c.text("CIMD client metadata is not configured", 500);
+	const xForwardedProto = c.req.header("x-forwarded-proto") ?? void 0;
+	const xForwardedHost = c.req.header("x-forwarded-host") ?? void 0;
+	const requestHostHeader = c.req.header("host") ?? void 0;
+	const forwarded = {
+		requestUrl: c.req.url,
+		basePath,
+		xForwardedProto,
+		xForwardedHost,
+		requestHostHeader
+	};
+	const body = {
+		redirect_uri: buildOAuthRedirectUriFromRequest(forwarded),
+		jwks_uri: buildHubSpotAppJwksUrlFromRequest(forwarded),
+		scope: cimdClientMetadata.scope
+	};
+	return c.text(JSON.stringify(body, null, 2), 200, { "Content-Type": "application/json; charset=utf-8" });
+}
+async function handleCimdAppJwks(c, options) {
+	const { appKeys, hubspotConnectEnv } = options;
+	if (!hubspotConnectEnv.isCimdEnabled) return c.text("Not found", 404);
+	if (!appKeys) return c.text("Missing app keys", 503);
+	const kid = await getJwkThumbprint({ publicKeyJwk: appKeys.appPublicKeyJwk });
+	const jwks = { keys: [{
+		...appKeys.appPublicKeyJwk,
+		kid,
+		use: "sig",
+		alg: "ES256",
+		key_ops: ["verify"],
+		ext: true
+	}] };
+	return c.json(jwks);
+}
+//#endregion
+export { handleCimdAppJwks, handleCimdClientJson };
+
+//# sourceMappingURL=cimd-public-routes.js.map

package/dist/server/hono/hubspot-connect-routes/cimd-public-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd-public-routes.js","names":[],"sources":["../../../../src/server/hono/hubspot-connect-routes/cimd-public-routes.ts"],"sourcesContent":["import type { Context } from 'hono';\n\nimport type { JwkSet } from '../../types.ts';\nimport { getJwkThumbprint } from '../../utils/jwk-utils.ts';\nimport type { HubSpotConnectCimdClientDocument } from './cimd-client-metadata-types.ts';\nimport type { HubSpotConnectOAuthRouteOptions } from './types.ts';\nimport {\n  buildHubSpotAppJwksUrlFromRequest,\n  buildOAuthRedirectUriFromRequest,\n  type BuildOAuthRedirectUriFromRequestOptions,\n} from './utils.ts';\n\nexport async function handleCimdClientJson(\n  c: Context,\n  options: HubSpotConnectOAuthRouteOptions\n): Promise<Response> {\n  const { cimdClientMetadata, basePath } = options;\n  if (!cimdClientMetadata) {\n    return c.text('CIMD client metadata is not configured', 500);\n  }\n\n  const xForwardedProto = c.req.header('x-forwarded-proto') ?? undefined;\n  const xForwardedHost = c.req.header('x-forwarded-host') ?? undefined;\n  const requestHostHeader = c.req.header('host') ?? undefined;\n\n  const forwarded: BuildOAuthRedirectUriFromRequestOptions = {\n    requestUrl: c.req.url,\n    basePath,\n    xForwardedProto,\n    xForwardedHost,\n    requestHostHeader,\n  };\n\n  const body: HubSpotConnectCimdClientDocument = {\n    redirect_uri: buildOAuthRedirectUriFromRequest(forwarded),\n    jwks_uri: buildHubSpotAppJwksUrlFromRequest(forwarded),\n    scope: cimdClientMetadata.scope,\n  };\n\n  return c.text(JSON.stringify(body, null, 2), 200, {\n    'Content-Type': 'application/json; charset=utf-8',\n  });\n}\n\nexport async function handleCimdAppJwks(\n  c: Context,\n  options: HubSpotConnectOAuthRouteOptions\n): Promise<Response> {\n  const { appKeys, hubspotConnectEnv } = options;\n  if (!hubspotConnectEnv.isCimdEnabled) {\n    return c.text('Not found', 404);\n  }\n  if (!appKeys) {\n    return c.text('Missing app keys', 503);\n  }\n\n  const kid = await getJwkThumbprint({\n    publicKeyJwk: appKeys.appPublicKeyJwk,\n  });\n\n  const jwk = {\n    ...appKeys.appPublicKeyJwk,\n    kid,\n    use: 'sig',\n    alg: 'ES256',\n    key_ops: ['verify'],\n    ext: true,\n  } as JsonWebKey;\n\n  const jwks: JwkSet = { keys: [jwk] };\n  return c.json(jwks);\n}\n"],"mappings":";;;AAYA,eAAsB,qBACpB,GACA,SACmB;CACnB,MAAM,EAAE,oBAAoB,aAAa;CACzC,IAAI,CAAC,oBACH,OAAO,EAAE,KAAK,0CAA0C,IAAI;CAG9D,MAAM,kBAAkB,EAAE,IAAI,OAAO,oBAAoB,IAAI,KAAA;CAC7D,MAAM,iBAAiB,EAAE,IAAI,OAAO,mBAAmB,IAAI,KAAA;CAC3D,MAAM,oBAAoB,EAAE,IAAI,OAAO,OAAO,IAAI,KAAA;CAElD,MAAM,YAAqD;EACzD,YAAY,EAAE,IAAI;EAClB;EACA;EACA;EACA;EACD;CAED,MAAM,OAAyC;EAC7C,cAAc,iCAAiC,UAAU;EACzD,UAAU,kCAAkC,UAAU;EACtD,OAAO,mBAAmB;EAC3B;CAED,OAAO,EAAE,KAAK,KAAK,UAAU,MAAM,MAAM,EAAE,EAAE,KAAK,EAChD,gBAAgB,mCACjB,CAAC;;AAGJ,eAAsB,kBACpB,GACA,SACmB;CACnB,MAAM,EAAE,SAAS,sBAAsB;CACvC,IAAI,CAAC,kBAAkB,eACrB,OAAO,EAAE,KAAK,aAAa,IAAI;CAEjC,IAAI,CAAC,SACH,OAAO,EAAE,KAAK,oBAAoB,IAAI;CAGxC,MAAM,MAAM,MAAM,iBAAiB,EACjC,cAAc,QAAQ,iBACvB,CAAC;CAWF,MAAM,OAAe,EAAE,MAAM,CAAC;EAR5B,GAAG,QAAQ;EACX;EACA,KAAK;EACL,KAAK;EACL,SAAS,CAAC,SAAS;EACnB,KAAK;EAG0B,CAAC,EAAE;CACpC,OAAO,EAAE,KAAK,KAAK"}

package/dist/server/hono/hubspot-connect-routes/constants.js

@@ -0,0 +1,8 @@
+//#region src/server/hono/hubspot-connect-routes/constants.ts
+const SESSION_MAX_AGE_SEC = 2592e3;
+const OAUTH_TEMP_MAX_AGE_SEC = 3600;
+const REFRESH_COOKIE_MAX_AGE_SEC = 2592e3;
+//#endregion
+export { OAUTH_TEMP_MAX_AGE_SEC, REFRESH_COOKIE_MAX_AGE_SEC, SESSION_MAX_AGE_SEC };
+
+//# sourceMappingURL=constants.js.map

package/dist/server/hono/hubspot-connect-routes/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","names":[],"sources":["../../../../src/server/hono/hubspot-connect-routes/constants.ts"],"sourcesContent":["export const SESSION_MAX_AGE_SEC = 2592000;\nexport const OAUTH_TEMP_MAX_AGE_SEC = 3600;\nexport const REFRESH_COOKIE_MAX_AGE_SEC = 2592000;\n"],"mappings":";AAAA,MAAa,sBAAsB;AACnC,MAAa,yBAAyB;AACtC,MAAa,6BAA6B"}

package/dist/server/hono/hubspot-connect-routes/fetch-hubspot-client-metadata.js

@@ -0,0 +1,43 @@
+//#region src/server/hono/hubspot-connect-routes/fetch-hubspot-client-metadata.ts
+/**
+* Builds `scope` and `optional_scope` query values for HubSpot
+* `/oauth/authorize` from in-memory client metadata (same shape as
+* `HubSpotConnectCimdClientMetadata` / `startHubSpotConnectFunction({ client })`).
+*/
+function deriveHubSpotAuthorizeScopesFromClientMetadata(metadata) {
+	const required = metadata.scope?.required;
+	if (!(Array.isArray(required) && required.length > 0 && required.every((s) => typeof s === "string" && s.length > 0))) return {
+		ok: false,
+		status: 500,
+		message: "Invalid or empty scope.required in client metadata"
+	};
+	const scope = required.join(" ");
+	const optionalRaw = metadata.scope.optional;
+	if (optionalRaw == null) return {
+		ok: true,
+		scope
+	};
+	if (!Array.isArray(optionalRaw)) return {
+		ok: false,
+		status: 500,
+		message: "Invalid scope.optional in client metadata"
+	};
+	if (optionalRaw.length === 0) return {
+		ok: true,
+		scope
+	};
+	if (!optionalRaw.every((s) => typeof s === "string" && s.length > 0)) return {
+		ok: false,
+		status: 500,
+		message: "Invalid scope.optional in client metadata"
+	};
+	return {
+		ok: true,
+		scope,
+		optionalScope: optionalRaw.join(" ")
+	};
+}
+//#endregion
+export { deriveHubSpotAuthorizeScopesFromClientMetadata };
+
+//# sourceMappingURL=fetch-hubspot-client-metadata.js.map

package/dist/server/hono/hubspot-connect-routes/fetch-hubspot-client-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-hubspot-client-metadata.js","names":[],"sources":["../../../../src/server/hono/hubspot-connect-routes/fetch-hubspot-client-metadata.ts"],"sourcesContent":["import type { HubSpotConnectCimdClientMetadata } from './cimd-client-metadata-types.ts';\n\nexport interface DeriveHubSpotAuthorizeScopesFromClientMetadataSuccess {\n  ok: true;\n  scope: string;\n  optionalScope?: string;\n}\n\nexport interface DeriveHubSpotAuthorizeScopesFromClientMetadataFailure {\n  ok: false;\n  status: number;\n  message: string;\n}\n\nexport type DeriveHubSpotAuthorizeScopesFromClientMetadataResult =\n  | DeriveHubSpotAuthorizeScopesFromClientMetadataSuccess\n  | DeriveHubSpotAuthorizeScopesFromClientMetadataFailure;\n\n/**\n * Builds `scope` and `optional_scope` query values for HubSpot\n * `/oauth/authorize` from in-memory client metadata (same shape as\n * `HubSpotConnectCimdClientMetadata` / `startHubSpotConnectFunction({ client })`).\n */\nexport function deriveHubSpotAuthorizeScopesFromClientMetadata(\n  metadata: HubSpotConnectCimdClientMetadata\n): DeriveHubSpotAuthorizeScopesFromClientMetadataResult {\n  const required = metadata.scope?.required;\n  const requiredOk =\n    Array.isArray(required) &&\n    required.length > 0 &&\n    required.every((s) => typeof s === 'string' && s.length > 0);\n\n  if (!requiredOk) {\n    return {\n      ok: false,\n      status: 500,\n      message: 'Invalid or empty scope.required in client metadata',\n    };\n  }\n\n  const scope = required.join(' ');\n\n  const optionalRaw = metadata.scope.optional;\n  if (optionalRaw == null) {\n    return { ok: true, scope };\n  }\n\n  if (!Array.isArray(optionalRaw)) {\n    return {\n      ok: false,\n      status: 500,\n      message: 'Invalid scope.optional in client metadata',\n    };\n  }\n\n  if (optionalRaw.length === 0) {\n    return { ok: true, scope };\n  }\n\n  if (!optionalRaw.every((s) => typeof s === 'string' && s.length > 0)) {\n    return {\n      ok: false,\n      status: 500,\n      message: 'Invalid scope.optional in client metadata',\n    };\n  }\n\n  return {\n    ok: true,\n    scope,\n    optionalScope: optionalRaw.join(' '),\n  };\n}\n"],"mappings":";;;;;;AAuBA,SAAgB,+CACd,UACsD;CACtD,MAAM,WAAW,SAAS,OAAO;CAMjC,IAAI,EAJF,MAAM,QAAQ,SAAS,IACvB,SAAS,SAAS,KAClB,SAAS,OAAO,MAAM,OAAO,MAAM,YAAY,EAAE,SAAS,EAAE,GAG5D,OAAO;EACL,IAAI;EACJ,QAAQ;EACR,SAAS;EACV;CAGH,MAAM,QAAQ,SAAS,KAAK,IAAI;CAEhC,MAAM,cAAc,SAAS,MAAM;CACnC,IAAI,eAAe,MACjB,OAAO;EAAE,IAAI;EAAM;EAAO;CAG5B,IAAI,CAAC,MAAM,QAAQ,YAAY,EAC7B,OAAO;EACL,IAAI;EACJ,QAAQ;EACR,SAAS;EACV;CAGH,IAAI,YAAY,WAAW,GACzB,OAAO;EAAE,IAAI;EAAM;EAAO;CAG5B,IAAI,CAAC,YAAY,OAAO,MAAM,OAAO,MAAM,YAAY,EAAE,SAAS,EAAE,EAClE,OAAO;EACL,IAAI;EACJ,QAAQ;EACR,SAAS;EACV;CAGH,OAAO;EACL,IAAI;EACJ;EACA,eAAe,YAAY,KAAK,IAAI;EACrC"}

package/dist/server/hono/hubspot-connect-routes/hubspot-connect-routes.js

@@ -0,0 +1,35 @@
+import { assertHubSpotConnectCimdClientMetadata } from "./cimd-client-metadata-types.js";
+import { noopLogger } from "../../shared/logger.js";
+import { handleAuthCallback } from "./auth-callback.js";
+import { handleAuthInitSession } from "./auth-init-session.js";
+import { handleAuthLogout } from "./auth-logout.js";
+import { handleAuthRefresh } from "./auth-refresh.js";
+import { handleCimdAppJwks, handleCimdClientJson } from "./cimd-public-routes.js";
+//#region src/server/hono/hubspot-connect-routes/hubspot-connect-routes.ts
+/**
+* Mounts hubspot-connect routes: OAuth (`/auth/...`); `GET /client.json`
+* from `cimdClientMetadata`; `GET /jwks.json` when CIMD is enabled.
+*/
+function registerHubSpotConnectRoutes(options) {
+	const { app, appKeys, basePath, hubspotConnectEnv, cimdClientMetadata, logger = noopLogger } = options;
+	if (!cimdClientMetadata) throw new Error("registerHubSpotConnectRoutes: cimdClientMetadata is required");
+	assertHubSpotConnectCimdClientMetadata(cimdClientMetadata);
+	const oauthRouteOptions = {
+		appKeys,
+		refreshCookiePath: `${basePath}/auth`,
+		logger,
+		basePath,
+		hubspotConnectEnv,
+		cimdClientMetadata
+	};
+	app.get("/client.json", (c) => handleCimdClientJson(c, oauthRouteOptions));
+	if (hubspotConnectEnv.isCimdEnabled) app.get("/jwks.json", (c) => handleCimdAppJwks(c, oauthRouteOptions));
+	app.get("/auth/init-session", (c) => handleAuthInitSession(c, oauthRouteOptions));
+	app.get("/auth/callback", (c) => handleAuthCallback(c, oauthRouteOptions));
+	app.post("/auth/refresh", (c) => handleAuthRefresh(c, oauthRouteOptions));
+	app.post("/auth/logout", (c) => handleAuthLogout(c, oauthRouteOptions));
+}
+//#endregion
+export { registerHubSpotConnectRoutes };
+
+//# sourceMappingURL=hubspot-connect-routes.js.map

package/dist/server/hono/hubspot-connect-routes/hubspot-connect-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hubspot-connect-routes.js","names":[],"sources":["../../../../src/server/hono/hubspot-connect-routes/hubspot-connect-routes.ts"],"sourcesContent":["import type { Hono } from 'hono';\n\nimport { noopLogger, type Logger } from '../../../shared/logger.ts';\nimport type { AppKeys } from '../../types.ts';\nimport { handleAuthCallback } from './auth-callback.ts';\nimport { handleAuthInitSession } from './auth-init-session.ts';\nimport { handleAuthLogout } from './auth-logout.ts';\nimport { handleAuthRefresh } from './auth-refresh.ts';\nimport { assertHubSpotConnectCimdClientMetadata } from './cimd-client-metadata-types.ts';\nimport type { HubSpotConnectCimdClientMetadata } from './cimd-client-metadata-types.ts';\nimport {\n  handleCimdAppJwks,\n  handleCimdClientJson,\n} from './cimd-public-routes.ts';\nimport type { HubSpotConnectRoutesEnv } from './load-hubspot-connect-routes-env.ts';\n\n/**\n * Options accepted by {@link registerHubSpotConnectRoutes}.\n */\nexport interface RegisterHubSpotConnectRoutesOptions {\n  /** The Hono app to mount the OAuth routes on. */\n  app: Hono;\n  /**\n   * Imported app keys from `secureStart`, or `null` when CIMD and DPoP\n   * are both disabled.\n   */\n  appKeys: AppKeys | null;\n  /**\n   * Path the routes are mounted under (no trailing slash). Used to\n   * scope refresh-token cookies via `Path=${basePath}/auth`.\n   */\n  basePath: string;\n  /**\n   * OAuth and client-mode settings, typically from\n   * {@link loadHubSpotConnectRoutesEnv}.\n   */\n  hubspotConnectEnv: HubSpotConnectRoutesEnv;\n  /**\n   * Scope configuration for `GET /client.json` and for authorize URL\n   * scopes when CIMD is off. Always required.\n   */\n  cimdClientMetadata: HubSpotConnectCimdClientMetadata;\n  /**\n   * Optional logger. When omitted the SDK uses a no-op logger so\n   * server-side state never leaks into the host application's\n   * console.\n   */\n  logger?: Logger;\n}\n\n/**\n * Mounts hubspot-connect routes: OAuth (`/auth/...`); `GET /client.json`\n * from `cimdClientMetadata`; `GET /jwks.json` when CIMD is enabled.\n */\nexport function registerHubSpotConnectRoutes(\n  options: RegisterHubSpotConnectRoutesOptions\n): void {\n  const {\n    app,\n    appKeys,\n    basePath,\n    hubspotConnectEnv,\n    cimdClientMetadata,\n    logger = noopLogger,\n  } = options;\n\n  if (!cimdClientMetadata) {\n    throw new Error(\n      'registerHubSpotConnectRoutes: cimdClientMetadata is required'\n    );\n  }\n  assertHubSpotConnectCimdClientMetadata(cimdClientMetadata);\n\n  const refreshCookiePath = `${basePath}/auth`;\n  const oauthRouteOptions = {\n    appKeys,\n    refreshCookiePath,\n    logger,\n    basePath,\n    hubspotConnectEnv,\n    cimdClientMetadata,\n  };\n\n  app.get('/client.json', (c) => handleCimdClientJson(c, oauthRouteOptions));\n  if (hubspotConnectEnv.isCimdEnabled) {\n    app.get('/jwks.json', (c) => handleCimdAppJwks(c, oauthRouteOptions));\n  }\n\n  app.get('/auth/init-session', (c) =>\n    handleAuthInitSession(c, oauthRouteOptions)\n  );\n  app.get('/auth/callback', (c) => handleAuthCallback(c, oauthRouteOptions));\n  app.post('/auth/refresh', (c) => handleAuthRefresh(c, oauthRouteOptions));\n  app.post('/auth/logout', (c) => handleAuthLogout(c, oauthRouteOptions));\n}\n"],"mappings":";;;;;;;;;;;;AAsDA,SAAgB,6BACd,SACM;CACN,MAAM,EACJ,KACA,SACA,UACA,mBACA,oBACA,SAAS,eACP;CAEJ,IAAI,CAAC,oBACH,MAAM,IAAI,MACR,+DACD;CAEH,uCAAuC,mBAAmB;CAG1D,MAAM,oBAAoB;EACxB;EACA,mBAAA,GAH2B,SAAS;EAIpC;EACA;EACA;EACA;EACD;CAED,IAAI,IAAI,iBAAiB,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;CAC1E,IAAI,kBAAkB,eACpB,IAAI,IAAI,eAAe,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;CAGvE,IAAI,IAAI,uBAAuB,MAC7B,sBAAsB,GAAG,kBAAkB,CAC5C;CACD,IAAI,IAAI,mBAAmB,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;CAC1E,IAAI,KAAK,kBAAkB,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;CACzE,IAAI,KAAK,iBAAiB,MAAM,iBAAiB,GAAG,kBAAkB,CAAC"}

package/dist/server/hono/hubspot-connect-routes/load-hubspot-connect-routes-env.js

@@ -0,0 +1,34 @@
+import { isHubspotCimdEnabled, isHubspotDpopEnabled, requireEnv } from "../../utils/env-utils.js";
+//#region src/server/hono/hubspot-connect-routes/load-hubspot-connect-routes-env.ts
+/**
+* Reads hubspot-connect environment variables from `process.env` or
+* `Deno.env` and returns a typed object for
+* {@link registerHubSpotConnectRoutes}.
+*/
+function loadHubSpotConnectRoutesEnv() {
+	const hubspotAuthorizationEndpoint = requireEnv("HUBSPOT_AUTHORIZATION_ENDPOINT");
+	const hubspotOAuthApiOrigin = new URL(requireEnv("HUBSPOT_OAUTH_API_ORIGIN")).origin;
+	const isCimdEnabled = isHubspotCimdEnabled();
+	const isDpopEnabled = isHubspotDpopEnabled();
+	const isAppPrivateKeyRequired = isCimdEnabled || isDpopEnabled;
+	if (isCimdEnabled) return {
+		hubspotAuthorizationEndpoint,
+		hubspotOAuthApiOrigin,
+		isCimdEnabled: true,
+		isDpopEnabled,
+		isAppPrivateKeyRequired
+	};
+	return {
+		hubspotAuthorizationEndpoint,
+		hubspotOAuthApiOrigin,
+		isCimdEnabled: false,
+		isDpopEnabled,
+		isAppPrivateKeyRequired,
+		hubspotClientId: requireEnv("HUBSPOT_CLIENT_ID"),
+		hubspotClientSecret: requireEnv("HUBSPOT_CLIENT_SECRET")
+	};
+}
+//#endregion
+export { loadHubSpotConnectRoutesEnv };
+
+//# sourceMappingURL=load-hubspot-connect-routes-env.js.map

package/dist/server/hono/hubspot-connect-routes/load-hubspot-connect-routes-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-hubspot-connect-routes-env.js","names":[],"sources":["../../../../src/server/hono/hubspot-connect-routes/load-hubspot-connect-routes-env.ts"],"sourcesContent":["import {\n  isHubspotCimdEnabled,\n  isHubspotDpopEnabled,\n  requireEnv,\n} from '../../utils/env-utils.ts';\n\n/**\n * HubSpot OAuth and client-mode settings read once for hubspot-connect\n * routes. Built by {@link loadHubSpotConnectRoutesEnv}.\n */\nexport type HubSpotConnectRoutesEnv =\n  | HubSpotConnectRoutesEnvCimd\n  | HubSpotConnectRoutesEnvClientSecret;\n\nexport interface HubSpotConnectRoutesEnvCimd {\n  hubspotAuthorizationEndpoint: string;\n  hubspotOAuthApiOrigin: string;\n  isCimdEnabled: true;\n  isDpopEnabled: boolean;\n  isAppPrivateKeyRequired: boolean;\n}\n\nexport interface HubSpotConnectRoutesEnvClientSecret {\n  hubspotAuthorizationEndpoint: string;\n  hubspotOAuthApiOrigin: string;\n  isCimdEnabled: false;\n  isDpopEnabled: boolean;\n  isAppPrivateKeyRequired: boolean;\n  hubspotClientId: string;\n  hubspotClientSecret: string;\n}\n\n/**\n * Reads hubspot-connect environment variables from `process.env` or\n * `Deno.env` and returns a typed object for\n * {@link registerHubSpotConnectRoutes}.\n */\nexport function loadHubSpotConnectRoutesEnv(): HubSpotConnectRoutesEnv {\n  const hubspotAuthorizationEndpoint = requireEnv(\n    'HUBSPOT_AUTHORIZATION_ENDPOINT'\n  );\n  const hubspotOAuthApiOrigin = new URL(requireEnv('HUBSPOT_OAUTH_API_ORIGIN'))\n    .origin;\n  const isCimdEnabled = isHubspotCimdEnabled();\n  const isDpopEnabled = isHubspotDpopEnabled();\n  const isAppPrivateKeyRequired = isCimdEnabled || isDpopEnabled;\n\n  if (isCimdEnabled) {\n    return {\n      hubspotAuthorizationEndpoint,\n      hubspotOAuthApiOrigin,\n      isCimdEnabled: true,\n      isDpopEnabled,\n      isAppPrivateKeyRequired,\n    };\n  }\n\n  return {\n    hubspotAuthorizationEndpoint,\n    hubspotOAuthApiOrigin,\n    isCimdEnabled: false,\n    isDpopEnabled,\n    isAppPrivateKeyRequired,\n    hubspotClientId: requireEnv('HUBSPOT_CLIENT_ID'),\n    hubspotClientSecret: requireEnv('HUBSPOT_CLIENT_SECRET'),\n  };\n}\n"],"mappings":";;;;;;;AAqCA,SAAgB,8BAAuD;CACrE,MAAM,+BAA+B,WACnC,iCACD;CACD,MAAM,wBAAwB,IAAI,IAAI,WAAW,2BAA2B,CAAC,CAC1E;CACH,MAAM,gBAAgB,sBAAsB;CAC5C,MAAM,gBAAgB,sBAAsB;CAC5C,MAAM,0BAA0B,iBAAiB;CAEjD,IAAI,eACF,OAAO;EACL;EACA;EACA,eAAe;EACf;EACA;EACD;CAGH,OAAO;EACL;EACA;EACA,eAAe;EACf;EACA;EACA,iBAAiB,WAAW,oBAAoB;EAChD,qBAAqB,WAAW,wBAAwB;EACzD"}

package/dist/server/hono/hubspot-connect-routes/oauth-client.js

@@ -0,0 +1,104 @@
+import { signJwt } from "../../utils/jwt-utils.js";
+import { signDpopProof } from "../../utils/dpop-utils.js";
+//#region src/server/hono/hubspot-connect-routes/oauth-client.ts
+/**
+* Lifetime of the OAuth `client_assertion` JWT in seconds. Short by
+* design — RFC 7521 recommends short-lived assertions, and HubSpot's
+* authorization server rejects assertions older than ~5 minutes.
+*/
+const CLIENT_ASSERTION_TTL_SEC = 60;
+/**
+* The `client_assertion_type` value mandated by RFC 7523 §2.2 for
+* JWT-bearer client authentication.
+*/
+const JWT_BEARER_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+/**
+* Mints a short-lived ES256 JWT used as the `client_assertion`
+* parameter when calling HubSpot's token endpoint, per RFC 7523.
+*/
+async function buildClientAssertion(options) {
+	const { appKeys, clientId, audience } = options;
+	return signJwt({
+		privateKey: appKeys.appPrivateKey,
+		payload: {
+			iss: clientId,
+			sub: clientId,
+			aud: audience,
+			jti: crypto.randomUUID()
+		},
+		ttlSeconds: CLIENT_ASSERTION_TTL_SEC
+	});
+}
+/**
+* Signs a DPoP proof for a `POST` to HubSpot's token endpoint. RFC 9449
+* binds the resulting access token to the proving public key so that
+* later API calls must come from the same key holder.
+*/
+async function buildTokenEndpointDpopProof(options) {
+	const { appKeys, tokenEndpointUrl, sessionIdHash } = options;
+	return signDpopProof({
+		appKeys,
+		claims: {
+			htm: "POST",
+			htu: tokenEndpointUrl,
+			jti: crypto.randomUUID(),
+			iat: Math.floor(Date.now() / 1e3),
+			sid: sessionIdHash
+		}
+	});
+}
+/**
+* POSTs an `application/x-www-form-urlencoded` body to a HubSpot token
+* endpoint. Attaches a `DPoP` header when `isDpopEnabled` is true and
+* `dpopProof` is provided. Reads the response once — either
+* as JSON on success or as text on failure — so callers never have to
+* consume the body twice.
+*/
+async function requestOAuthToken(options) {
+	const { tokenEndpointUrl, formParams, dpopProof, isDpopEnabled } = options;
+	const headers = { "Content-Type": "application/x-www-form-urlencoded" };
+	if (isDpopEnabled) {
+		if (!dpopProof) throw new Error("DPoP proof is required when DPoP is enabled");
+		headers.DPoP = dpopProof;
+	}
+	const tokenResponse = await fetch(tokenEndpointUrl, {
+		method: "POST",
+		headers,
+		body: new URLSearchParams(formParams)
+	});
+	if (!tokenResponse.ok) {
+		const errorText = await tokenResponse.text();
+		return {
+			ok: false,
+			status: tokenResponse.status,
+			errorText
+		};
+	}
+	return {
+		ok: true,
+		body: await tokenResponse.json()
+	};
+}
+/**
+* Form parameters always present on the OAuth `client_assertion` flow.
+* Spread into the call site's `formParams`.
+*/
+function buildClientAssertionFormParams(input) {
+	const { clientId, clientAssertion } = input;
+	return {
+		client_id: clientId,
+		client_assertion_type: JWT_BEARER_ASSERTION_TYPE,
+		client_assertion: clientAssertion
+	};
+}
+function buildClientSecretFormParams(options) {
+	const { clientId, clientSecret } = options;
+	return {
+		client_id: clientId,
+		client_secret: clientSecret
+	};
+}
+//#endregion
+export { buildClientAssertion, buildClientAssertionFormParams, buildClientSecretFormParams, buildTokenEndpointDpopProof, requestOAuthToken };
+
+//# sourceMappingURL=oauth-client.js.map

package/dist/server/hono/hubspot-connect-routes/oauth-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client.js","names":[],"sources":["../../../../src/server/hono/hubspot-connect-routes/oauth-client.ts"],"sourcesContent":["import type { AppKeys } from '../../types.ts';\nimport { signDpopProof } from '../../utils/dpop-utils.ts';\nimport { signJwt } from '../../utils/jwt-utils.ts';\n\n/**\n * Lifetime of the OAuth `client_assertion` JWT in seconds. Short by\n * design — RFC 7521 recommends short-lived assertions, and HubSpot's\n * authorization server rejects assertions older than ~5 minutes.\n */\nconst CLIENT_ASSERTION_TTL_SEC = 60;\n\n/**\n * The `client_assertion_type` value mandated by RFC 7523 §2.2 for\n * JWT-bearer client authentication.\n */\nconst JWT_BEARER_ASSERTION_TYPE =\n  'urn:ietf:params:oauth:client-assertion-type:jwt-bearer';\n\n/**\n * Wire shape of a HubSpot OAuth token-endpoint success response.\n */\nexport interface OAuthTokenResponse {\n  /** New DPoP-bound access token (sender-constrained). */\n  access_token: string;\n  /** New refresh token, opaque to the client. */\n  refresh_token: string;\n  /** Lifetime of `access_token` in seconds. */\n  expires_in: number;\n}\n\nexport interface BuildClientAssertionOptions {\n  appKeys: AppKeys;\n  /** Client ID URL — used as both `iss` and `sub`. */\n  clientId: string;\n  /** Token-endpoint URL — used as `aud`. */\n  audience: string;\n}\n\n/**\n * Mints a short-lived ES256 JWT used as the `client_assertion`\n * parameter when calling HubSpot's token endpoint, per RFC 7523.\n */\nexport async function buildClientAssertion(\n  options: BuildClientAssertionOptions\n): Promise<string> {\n  const { appKeys, clientId, audience } = options;\n  return signJwt({\n    privateKey: appKeys.appPrivateKey,\n    payload: {\n      iss: clientId,\n      sub: clientId,\n      aud: audience,\n      jti: crypto.randomUUID(),\n    },\n    ttlSeconds: CLIENT_ASSERTION_TTL_SEC,\n  });\n}\n\nexport interface BuildTokenEndpointDpopProofOptions {\n  appKeys: AppKeys;\n  /** Token-endpoint URL — used as the DPoP `htu` claim. */\n  tokenEndpointUrl: string;\n  /** Hash of the app session ID — used as the DPoP `sid` claim. */\n  sessionIdHash: string;\n}\n\n/**\n * Signs a DPoP proof for a `POST` to HubSpot's token endpoint. RFC 9449\n * binds the resulting access token to the proving public key so that\n * later API calls must come from the same key holder.\n */\nexport async function buildTokenEndpointDpopProof(\n  options: BuildTokenEndpointDpopProofOptions\n): Promise<string> {\n  const { appKeys, tokenEndpointUrl, sessionIdHash } = options;\n  return signDpopProof({\n    appKeys,\n    claims: {\n      htm: 'POST',\n      htu: tokenEndpointUrl,\n      jti: crypto.randomUUID(),\n      iat: Math.floor(Date.now() / 1000),\n      sid: sessionIdHash,\n    },\n  });\n}\n\nexport interface RequestOAuthTokenOptions {\n  tokenEndpointUrl: string;\n  /** Body parameters; serialized to `application/x-www-form-urlencoded`. */\n  formParams: Record<string, string>;\n  /**\n   * When true, a `DPoP` header is required and `dpopProof` must be set.\n   */\n  isDpopEnabled: boolean;\n  /**\n   * DPoP proof for this request; required when `isDpopEnabled` is true.\n   */\n  dpopProof?: string;\n}\n\nexport interface RequestOAuthTokenSuccess {\n  ok: true;\n  body: OAuthTokenResponse;\n}\n\nexport interface RequestOAuthTokenFailure {\n  ok: false;\n  /** HTTP status returned by the upstream endpoint. */\n  status: number;\n  /** Error body as text — used to compose the SDK's error response. */\n  errorText: string;\n}\n\nexport type RequestOAuthTokenResult =\n  | RequestOAuthTokenSuccess\n  | RequestOAuthTokenFailure;\n\n/**\n * POSTs an `application/x-www-form-urlencoded` body to a HubSpot token\n * endpoint. Attaches a `DPoP` header when `isDpopEnabled` is true and\n * `dpopProof` is provided. Reads the response once — either\n * as JSON on success or as text on failure — so callers never have to\n * consume the body twice.\n */\nexport async function requestOAuthToken(\n  options: RequestOAuthTokenOptions\n): Promise<RequestOAuthTokenResult> {\n  const { tokenEndpointUrl, formParams, dpopProof, isDpopEnabled } = options;\n  const headers: Record<string, string> = {\n    'Content-Type': 'application/x-www-form-urlencoded',\n  };\n  if (isDpopEnabled) {\n    if (!dpopProof) {\n      throw new Error('DPoP proof is required when DPoP is enabled');\n    }\n    headers.DPoP = dpopProof;\n  }\n  const tokenResponse = await fetch(tokenEndpointUrl, {\n    method: 'POST',\n    headers,\n    body: new URLSearchParams(formParams),\n  });\n  if (!tokenResponse.ok) {\n    const errorText = await tokenResponse.text();\n    return { ok: false, status: tokenResponse.status, errorText };\n  }\n  const body = (await tokenResponse.json()) as OAuthTokenResponse;\n  return { ok: true, body };\n}\n\n/**\n * Form parameters always present on the OAuth `client_assertion` flow.\n * Spread into the call site's `formParams`.\n */\nexport function buildClientAssertionFormParams(input: {\n  clientId: string;\n  clientAssertion: string;\n}): Record<string, string> {\n  const { clientId, clientAssertion } = input;\n  return {\n    client_id: clientId,\n    client_assertion_type: JWT_BEARER_ASSERTION_TYPE,\n    client_assertion: clientAssertion,\n  };\n}\n\nexport interface BuildClientSecretFormParamsOptions {\n  clientId: string;\n  clientSecret: string;\n}\n\nexport function buildClientSecretFormParams(\n  options: BuildClientSecretFormParamsOptions\n): Record<string, string> {\n  const { clientId, clientSecret } = options;\n  return {\n    client_id: clientId,\n    client_secret: clientSecret,\n  };\n}\n"],"mappings":";;;;;;;;AASA,MAAM,2BAA2B;;;;;AAMjC,MAAM,4BACJ;;;;;AA0BF,eAAsB,qBACpB,SACiB;CACjB,MAAM,EAAE,SAAS,UAAU,aAAa;CACxC,OAAO,QAAQ;EACb,YAAY,QAAQ;EACpB,SAAS;GACP,KAAK;GACL,KAAK;GACL,KAAK;GACL,KAAK,OAAO,YAAY;GACzB;EACD,YAAY;EACb,CAAC;;;;;;;AAgBJ,eAAsB,4BACpB,SACiB;CACjB,MAAM,EAAE,SAAS,kBAAkB,kBAAkB;CACrD,OAAO,cAAc;EACnB;EACA,QAAQ;GACN,KAAK;GACL,KAAK;GACL,KAAK,OAAO,YAAY;GACxB,KAAK,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;GAClC,KAAK;GACN;EACF,CAAC;;;;;;;;;AAyCJ,eAAsB,kBACpB,SACkC;CAClC,MAAM,EAAE,kBAAkB,YAAY,WAAW,kBAAkB;CACnE,MAAM,UAAkC,EACtC,gBAAgB,qCACjB;CACD,IAAI,eAAe;EACjB,IAAI,CAAC,WACH,MAAM,IAAI,MAAM,8CAA8C;EAEhE,QAAQ,OAAO;;CAEjB,MAAM,gBAAgB,MAAM,MAAM,kBAAkB;EAClD,QAAQ;EACR;EACA,MAAM,IAAI,gBAAgB,WAAW;EACtC,CAAC;CACF,IAAI,CAAC,cAAc,IAAI;EACrB,MAAM,YAAY,MAAM,cAAc,MAAM;EAC5C,OAAO;GAAE,IAAI;GAAO,QAAQ,cAAc;GAAQ;GAAW;;CAG/D,OAAO;EAAE,IAAI;EAAM,MAAA,MADC,cAAc,MAAM;EACf;;;;;;AAO3B,SAAgB,+BAA+B,OAGpB;CACzB,MAAM,EAAE,UAAU,oBAAoB;CACtC,OAAO;EACL,WAAW;EACX,uBAAuB;EACvB,kBAAkB;EACnB;;AAQH,SAAgB,4BACd,SACwB;CACxB,MAAM,EAAE,UAAU,iBAAiB;CACnC,OAAO;EACL,WAAW;EACX,eAAe;EAChB"}

package/dist/server/hono/hubspot-connect-routes/utils.js

@@ -0,0 +1,73 @@
+import { serializeCookie } from "../utils/cookie-utils.js";
+//#region src/server/hono/hubspot-connect-routes/utils.ts
+function clearTempCookie(name) {
+	return serializeCookie({
+		name,
+		value: "",
+		path: "/",
+		sameSite: "Lax",
+		maxAge: 0
+	});
+}
+function isSafeReturnPath(rawPath) {
+	if (!rawPath.startsWith("/")) return false;
+	if (rawPath.includes("\0")) return false;
+	let decoded;
+	try {
+		decoded = decodeURIComponent(rawPath);
+	} catch {
+		return false;
+	}
+	if (!decoded.startsWith("/")) return false;
+	const second = decoded.charAt(1);
+	if (second === "/" || second === "\\") return false;
+	return true;
+}
+function normalizeHubSpotConnectBasePath(basePath) {
+	return basePath.endsWith("/") && basePath.length > 1 ? basePath.slice(0, -1) : basePath;
+}
+/**
+* Public origin for hubspot-connect URLs (`redirect_uri`, CIMD `client_id`,
+* `jwks_uri`). Matches the host/proto rules used for the OAuth callback.
+*/
+function buildHubSpotConnectRequestOrigin(options) {
+	const { requestUrl, xForwardedProto, xForwardedHost, requestHostHeader } = options;
+	const proto = xForwardedProto?.split(",")[0]?.trim();
+	if (proto && (proto === "http" || proto === "https")) {
+		const forwardedHost = xForwardedHost?.split(",")[0]?.trim();
+		const hostHeader = requestHostHeader?.split(",")[0]?.trim();
+		return `${proto}://${forwardedHost || hostHeader || new URL(requestUrl).host}`;
+	}
+	return new URL(requestUrl).origin;
+}
+/**
+* OAuth `redirect_uri` for the hubspot-connect callback. Uses
+* `X-Forwarded-Proto` with `X-Forwarded-Host`, then `Host`, then the request URL
+* host when the proto is forwarded (reverse proxy); otherwise the request URL
+* origin.
+*/
+function buildOAuthRedirectUriFromRequest(options) {
+	const trimmed = normalizeHubSpotConnectBasePath(options.basePath);
+	return `${buildHubSpotConnectRequestOrigin(options)}${trimmed}/auth/callback`;
+}
+/**
+* CIMD `client_id` URL: `{origin}{basePath}/client.json`.
+*/
+function buildCimdClientIdUrlFromRequest(options) {
+	const trimmed = normalizeHubSpotConnectBasePath(options.basePath);
+	return `${buildHubSpotConnectRequestOrigin(options)}${trimmed}/client.json`;
+}
+/**
+* App JWKS URL published in CIMD: `{origin}{basePath}/jwks.json`.
+*/
+function buildHubSpotAppJwksUrlFromRequest(options) {
+	const trimmed = normalizeHubSpotConnectBasePath(options.basePath);
+	return `${buildHubSpotConnectRequestOrigin(options)}${trimmed}/jwks.json`;
+}
+function isPositiveFiniteNumber(value) {
+	return typeof value === "number" && Number.isFinite(value) && value > 0;
+}
+//#endregion
+export { buildCimdClientIdUrlFromRequest, buildHubSpotAppJwksUrlFromRequest, buildOAuthRedirectUriFromRequest, clearTempCookie, isPositiveFiniteNumber, isSafeReturnPath };
+
+//# sourceMappingURL=utils.js.map

package/dist/server/hono/hubspot-connect-routes/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","names":[],"sources":["../../../../src/server/hono/hubspot-connect-routes/utils.ts"],"sourcesContent":["import { serializeCookie } from '../utils/cookie-utils.ts';\n\nexport function clearTempCookie(name: string): string {\n  return serializeCookie({\n    name,\n    value: '',\n    path: '/',\n    sameSite: 'Lax',\n    maxAge: 0,\n  });\n}\n\nexport function isSafeReturnPath(rawPath: string): boolean {\n  if (!rawPath.startsWith('/')) return false;\n  if (rawPath.includes('\\0')) return false;\n  let decoded: string;\n  try {\n    decoded = decodeURIComponent(rawPath);\n  } catch {\n    return false;\n  }\n  if (!decoded.startsWith('/')) return false;\n  const second = decoded.charAt(1);\n  if (second === '/' || second === '\\\\') return false;\n  return true;\n}\n\nexport function getRequestHost(requestUrl: string): string {\n  return new URL(requestUrl).host;\n}\n\nexport interface GetRequestHostForHubspotConnectOptions {\n  requestUrl: string;\n  xForwardedHost?: string | undefined;\n  /** `Host` when `X-Forwarded-Host` is absent (some proxies only set `X-Forwarded-Proto`). */\n  requestHostHeader?: string | undefined;\n}\n\n/**\n * Host for CIMD `client_id` URLs when hubspot-connect sits behind a reverse\n * proxy (e.g. Vite → Deno): prefers `X-Forwarded-Host`, then `Host`, then the\n * request URL host.\n */\nexport function getRequestHostForHubspotConnect(\n  options: GetRequestHostForHubspotConnectOptions\n): string {\n  const rawForwarded = options.xForwardedHost?.split(',')[0]?.trim();\n  if (rawForwarded) {\n    try {\n      return new URL(`https://${rawForwarded}`).host;\n    } catch {\n      /* invalid forwarded host */\n    }\n  }\n  const rawHost = options.requestHostHeader?.split(',')[0]?.trim();\n  if (rawHost) {\n    try {\n      return new URL(`https://${rawHost}`).host;\n    } catch {\n      /* invalid host header */\n    }\n  }\n  return getRequestHost(options.requestUrl);\n}\n\nexport interface BuildOAuthRedirectUriFromRequestOptions {\n  requestUrl: string;\n  basePath: string;\n  xForwardedProto?: string | undefined;\n  xForwardedHost?: string | undefined;\n  /** `Host` when `X-Forwarded-Host` is absent but `X-Forwarded-Proto` is set. */\n  requestHostHeader?: string | undefined;\n}\n\nfunction normalizeHubSpotConnectBasePath(basePath: string): string {\n  return basePath.endsWith('/') && basePath.length > 1\n    ? basePath.slice(0, -1)\n    : basePath;\n}\n\n/**\n * Public origin for hubspot-connect URLs (`redirect_uri`, CIMD `client_id`,\n * `jwks_uri`). Matches the host/proto rules used for the OAuth callback.\n */\nexport function buildHubSpotConnectRequestOrigin(\n  options: BuildOAuthRedirectUriFromRequestOptions\n): string {\n  const { requestUrl, xForwardedProto, xForwardedHost, requestHostHeader } =\n    options;\n  const proto = xForwardedProto?.split(',')[0]?.trim();\n  if (proto && (proto === 'http' || proto === 'https')) {\n    const forwardedHost = xForwardedHost?.split(',')[0]?.trim();\n    const hostHeader = requestHostHeader?.split(',')[0]?.trim();\n    const hostPart = forwardedHost || hostHeader || new URL(requestUrl).host;\n    return `${proto}://${hostPart}`;\n  }\n  return new URL(requestUrl).origin;\n}\n\n/**\n * OAuth `redirect_uri` for the hubspot-connect callback. Uses\n * `X-Forwarded-Proto` with `X-Forwarded-Host`, then `Host`, then the request URL\n * host when the proto is forwarded (reverse proxy); otherwise the request URL\n * origin.\n */\nexport function buildOAuthRedirectUriFromRequest(\n  options: BuildOAuthRedirectUriFromRequestOptions\n): string {\n  const trimmed = normalizeHubSpotConnectBasePath(options.basePath);\n  const origin = buildHubSpotConnectRequestOrigin(options);\n  return `${origin}${trimmed}/auth/callback`;\n}\n\n/**\n * CIMD `client_id` URL: `{origin}{basePath}/client.json`.\n */\nexport function buildCimdClientIdUrlFromRequest(\n  options: BuildOAuthRedirectUriFromRequestOptions\n): string {\n  const trimmed = normalizeHubSpotConnectBasePath(options.basePath);\n  const origin = buildHubSpotConnectRequestOrigin(options);\n  return `${origin}${trimmed}/client.json`;\n}\n\n/**\n * App JWKS URL published in CIMD: `{origin}{basePath}/jwks.json`.\n */\nexport function buildHubSpotAppJwksUrlFromRequest(\n  options: BuildOAuthRedirectUriFromRequestOptions\n): string {\n  const trimmed = normalizeHubSpotConnectBasePath(options.basePath);\n  const origin = buildHubSpotConnectRequestOrigin(options);\n  return `${origin}${trimmed}/jwks.json`;\n}\n\nexport function isPositiveFiniteNumber(value: unknown): value is number {\n  return typeof value === 'number' && Number.isFinite(value) && value > 0;\n}\n"],"mappings":";;AAEA,SAAgB,gBAAgB,MAAsB;CACpD,OAAO,gBAAgB;EACrB;EACA,OAAO;EACP,MAAM;EACN,UAAU;EACV,QAAQ;EACT,CAAC;;AAGJ,SAAgB,iBAAiB,SAA0B;CACzD,IAAI,CAAC,QAAQ,WAAW,IAAI,EAAE,OAAO;CACrC,IAAI,QAAQ,SAAS,KAAK,EAAE,OAAO;CACnC,IAAI;CACJ,IAAI;EACF,UAAU,mBAAmB,QAAQ;SAC/B;EACN,OAAO;;CAET,IAAI,CAAC,QAAQ,WAAW,IAAI,EAAE,OAAO;CACrC,MAAM,SAAS,QAAQ,OAAO,EAAE;CAChC,IAAI,WAAW,OAAO,WAAW,MAAM,OAAO;CAC9C,OAAO;;AAkDT,SAAS,gCAAgC,UAA0B;CACjE,OAAO,SAAS,SAAS,IAAI,IAAI,SAAS,SAAS,IAC/C,SAAS,MAAM,GAAG,GAAG,GACrB;;;;;;AAON,SAAgB,iCACd,SACQ;CACR,MAAM,EAAE,YAAY,iBAAiB,gBAAgB,sBACnD;CACF,MAAM,QAAQ,iBAAiB,MAAM,IAAI,CAAC,IAAI,MAAM;CACpD,IAAI,UAAU,UAAU,UAAU,UAAU,UAAU;EACpD,MAAM,gBAAgB,gBAAgB,MAAM,IAAI,CAAC,IAAI,MAAM;EAC3D,MAAM,aAAa,mBAAmB,MAAM,IAAI,CAAC,IAAI,MAAM;EAE3D,OAAO,GAAG,MAAM,KADC,iBAAiB,cAAc,IAAI,IAAI,WAAW,CAAC;;CAGtE,OAAO,IAAI,IAAI,WAAW,CAAC;;;;;;;;AAS7B,SAAgB,iCACd,SACQ;CACR,MAAM,UAAU,gCAAgC,QAAQ,SAAS;CAEjE,OAAO,GADQ,iCAAiC,QAChC,GAAG,QAAQ;;;;;AAM7B,SAAgB,gCACd,SACQ;CACR,MAAM,UAAU,gCAAgC,QAAQ,SAAS;CAEjE,OAAO,GADQ,iCAAiC,QAChC,GAAG,QAAQ;;;;;AAM7B,SAAgB,kCACd,SACQ;CACR,MAAM,UAAU,gCAAgC,QAAQ,SAAS;CAEjE,OAAO,GADQ,iCAAiC,QAChC,GAAG,QAAQ;;AAG7B,SAAgB,uBAAuB,OAAiC;CACtE,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,MAAM,IAAI,QAAQ"}

package/dist/server/hono/index.js

@@ -0,0 +1,4 @@
+import "./hubspot-connect-routes/cimd-client-metadata-types.js";
+import "./hono-request-handler.js";
+import "./hubspot-connect-routes/hubspot-connect-routes.js";
+import "./hubspot-connect-routes/load-hubspot-connect-routes-env.js";

package/dist/server/hono/types.d.ts

@@ -0,0 +1,28 @@
+import { HubSpotClient } from "../api-client-core/types.js";
+import { HubSpotProxy } from "../types.js";
+
+//#region src/server/hono/types.d.ts
+interface AppConnectHonoBindings {
+  /**
+   * Authenticated proxy that issues DPoP-bound calls to HubSpot's
+   * API on behalf of the browser session that made the inbound
+   * request. `authenticated: false` when the session cookies are
+   * absent or invalid.
+   */
+  hubSpotProxy: HubSpotProxy;
+  /**
+   * Authenticated HubSpot API client.
+   */
+  hubSpotClient: HubSpotClient;
+}
+/**
+ * Hono environment shape used by handlers running inside a hubspot-
+ * connect request handler. Exposes the per-request
+ * {@link HubSpotProxy} as `c.env.hubSpotProxy`.
+ */
+interface AppConnectHonoEnv {
+  Bindings: AppConnectHonoBindings;
+}
+//#endregion
+export { AppConnectHonoEnv };
+//# sourceMappingURL=types.d.ts.map

package/dist/server/hono/utils/cookie-utils.js

@@ -0,0 +1,29 @@
+//#region src/server/hono/utils/cookie-utils.ts
+/**
+* Appends a `Set-Cookie` header to the response. Hono replaces single
+* headers by default, so this uses `{ append: true }` to emit multiple
+* cookies on the same response.
+*/
+function setResponseCookie(options) {
+	const { c, value } = options;
+	c.header("Set-Cookie", value, { append: true });
+}
+/**
+* Builds a `Set-Cookie` header value with HubSpot's default attributes
+* (HttpOnly, Secure, SameSite). Centralizes the serialization so all
+* cookies share the same policy.
+*/
+function serializeCookie(options) {
+	const { name, value, path, sameSite = "Strict", maxAge, secure = true, httpOnly = true } = options;
+	const parts = [`${name}=${value}`];
+	if (httpOnly) parts.push("HttpOnly");
+	if (secure) parts.push("Secure");
+	parts.push(`SameSite=${sameSite}`);
+	parts.push(`Path=${path}`);
+	parts.push(`Max-Age=${maxAge}`);
+	return parts.join("; ");
+}
+//#endregion
+export { serializeCookie, setResponseCookie };
+
+//# sourceMappingURL=cookie-utils.js.map