@hubspot/app-connect-sdk 1.0.0-alpha.1

package/dist/server/hono/utils/cookie-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-utils.js","names":[],"sources":["../../../../src/server/hono/utils/cookie-utils.ts"],"sourcesContent":["import type { Context } from 'hono';\n\nexport interface SetResponseCookieOptions {\n  c: Context;\n  value: string;\n}\n\n/**\n * Appends a `Set-Cookie` header to the response. Hono replaces single\n * headers by default, so this uses `{ append: true }` to emit multiple\n * cookies on the same response.\n */\nexport function setResponseCookie(options: SetResponseCookieOptions): void {\n  const { c, value } = options;\n  c.header('Set-Cookie', value, { append: true });\n}\n\nexport interface SerializeCookieOptions {\n  name: string;\n  value: string;\n  /** `__Host-` prefix requires `Path=/` and is recommended for session cookies. */\n  path: string;\n  /** Defaults to `Strict`. Use `Lax` for short-lived OAuth temp cookies. */\n  sameSite?: 'Strict' | 'Lax';\n  /** Lifetime in seconds. `0` deletes the cookie. */\n  maxAge: number;\n  /** Defaults to `true`; only set `false` for tests or non-HTTPS dev hosts. */\n  secure?: boolean;\n  /** Defaults to `true`. */\n  httpOnly?: boolean;\n}\n\n/**\n * Builds a `Set-Cookie` header value with HubSpot's default attributes\n * (HttpOnly, Secure, SameSite). Centralizes the serialization so all\n * cookies share the same policy.\n */\nexport function serializeCookie(options: SerializeCookieOptions): string {\n  const {\n    name,\n    value,\n    path,\n    sameSite = 'Strict',\n    maxAge,\n    secure = true,\n    httpOnly = true,\n  } = options;\n  const parts: string[] = [`${name}=${value}`];\n  if (httpOnly) parts.push('HttpOnly');\n  if (secure) parts.push('Secure');\n  parts.push(`SameSite=${sameSite}`);\n  parts.push(`Path=${path}`);\n  parts.push(`Max-Age=${maxAge}`);\n  return parts.join('; ');\n}\n"],"mappings":";;;;;;AAYA,SAAgB,kBAAkB,SAAyC;CACzE,MAAM,EAAE,GAAG,UAAU;CACrB,EAAE,OAAO,cAAc,OAAO,EAAE,QAAQ,MAAM,CAAC;;;;;;;AAuBjD,SAAgB,gBAAgB,SAAyC;CACvE,MAAM,EACJ,MACA,OACA,MACA,WAAW,UACX,QACA,SAAS,MACT,WAAW,SACT;CACJ,MAAM,QAAkB,CAAC,GAAG,KAAK,GAAG,QAAQ;CAC5C,IAAI,UAAU,MAAM,KAAK,WAAW;CACpC,IAAI,QAAQ,MAAM,KAAK,SAAS;CAChC,MAAM,KAAK,YAAY,WAAW;CAClC,MAAM,KAAK,QAAQ,OAAO;CAC1B,MAAM,KAAK,WAAW,SAAS;CAC/B,OAAO,MAAM,KAAK,KAAK"}

package/dist/server/import-app-keys.js

@@ -0,0 +1,42 @@
+import { base64StandardToArrayBuffer } from "./shared/encoding/base64.js";
+//#region src/server/import-app-keys.ts
+/**
+* Imports a base64-encoded PKCS8 ES256 private key into the
+* `AppKeys` shape used throughout the SDK.
+*
+* The function imports the key twice: once as **extractable** to
+* derive the public JWK (via `crypto.subtle.exportKey`), and once
+* as **non-extractable** so the long-lived `appPrivateKey` can never
+* be exfiltrated.
+*
+* @throws {Error} When `envKey` is empty/undefined or when the key
+*   isn't an EC P-256 keypair.
+*/
+async function importAppKeys(envKey) {
+	const b64 = envKey?.trim() ?? "";
+	if (!b64) throw new Error("HUBSPOT_APP_PRIVATE_KEY is not set");
+	const pkcs8 = base64StandardToArrayBuffer(b64);
+	const tempPrivateKey = await crypto.subtle.importKey("pkcs8", pkcs8, {
+		name: "ECDSA",
+		namedCurve: "P-256"
+	}, true, ["sign"]);
+	const privateJwk = await crypto.subtle.exportKey("jwk", tempPrivateKey);
+	if (privateJwk.kty !== "EC" || privateJwk.crv !== "P-256" || typeof privateJwk.x !== "string" || typeof privateJwk.y !== "string") throw new Error("Expected P-256 EC private key JWK with x and y");
+	const appPublicKeyJwk = {
+		kty: "EC",
+		crv: "P-256",
+		x: privateJwk.x,
+		y: privateJwk.y
+	};
+	return {
+		appPrivateKey: await crypto.subtle.importKey("pkcs8", pkcs8, {
+			name: "ECDSA",
+			namedCurve: "P-256"
+		}, false, ["sign"]),
+		appPublicKeyJwk
+	};
+}
+//#endregion
+export { importAppKeys };
+
+//# sourceMappingURL=import-app-keys.js.map

package/dist/server/import-app-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-app-keys.js","names":[],"sources":["../../src/server/import-app-keys.ts"],"sourcesContent":["import type { AppKeys } from './types.ts';\nimport { base64StandardToArrayBuffer } from './utils/base64-utils.ts';\n\n/**\n * Imports a base64-encoded PKCS8 ES256 private key into the\n * `AppKeys` shape used throughout the SDK.\n *\n * The function imports the key twice: once as **extractable** to\n * derive the public JWK (via `crypto.subtle.exportKey`), and once\n * as **non-extractable** so the long-lived `appPrivateKey` can never\n * be exfiltrated.\n *\n * @throws {Error} When `envKey` is empty/undefined or when the key\n *   isn't an EC P-256 keypair.\n */\nexport async function importAppKeys(\n  envKey: string | undefined\n): Promise<AppKeys> {\n  const b64 = envKey?.trim() ?? '';\n  if (!b64) {\n    throw new Error('HUBSPOT_APP_PRIVATE_KEY is not set');\n  }\n\n  const pkcs8 = base64StandardToArrayBuffer(b64);\n  const tempPrivateKey = await crypto.subtle.importKey(\n    'pkcs8',\n    pkcs8,\n    { name: 'ECDSA', namedCurve: 'P-256' },\n    true,\n    ['sign']\n  );\n  const privateJwk = await crypto.subtle.exportKey('jwk', tempPrivateKey);\n  if (\n    privateJwk.kty !== 'EC' ||\n    privateJwk.crv !== 'P-256' ||\n    typeof privateJwk.x !== 'string' ||\n    typeof privateJwk.y !== 'string'\n  ) {\n    throw new Error('Expected P-256 EC private key JWK with x and y');\n  }\n  const appPublicKeyJwk: JsonWebKey = {\n    kty: 'EC',\n    crv: 'P-256',\n    x: privateJwk.x,\n    y: privateJwk.y,\n  };\n  const appPrivateKey = await crypto.subtle.importKey(\n    'pkcs8',\n    pkcs8,\n    { name: 'ECDSA', namedCurve: 'P-256' },\n    false,\n    ['sign']\n  );\n  return { appPrivateKey, appPublicKeyJwk };\n}\n"],"mappings":";;;;;;;;;;;;;;AAeA,eAAsB,cACpB,QACkB;CAClB,MAAM,MAAM,QAAQ,MAAM,IAAI;CAC9B,IAAI,CAAC,KACH,MAAM,IAAI,MAAM,qCAAqC;CAGvD,MAAM,QAAQ,4BAA4B,IAAI;CAC9C,MAAM,iBAAiB,MAAM,OAAO,OAAO,UACzC,SACA,OACA;EAAE,MAAM;EAAS,YAAY;EAAS,EACtC,MACA,CAAC,OAAO,CACT;CACD,MAAM,aAAa,MAAM,OAAO,OAAO,UAAU,OAAO,eAAe;CACvE,IACE,WAAW,QAAQ,QACnB,WAAW,QAAQ,WACnB,OAAO,WAAW,MAAM,YACxB,OAAO,WAAW,MAAM,UAExB,MAAM,IAAI,MAAM,iDAAiD;CAEnE,MAAM,kBAA8B;EAClC,KAAK;EACL,KAAK;EACL,GAAG,WAAW;EACd,GAAG,WAAW;EACf;CAQD,OAAO;EAAE,eAAA,MAPmB,OAAO,OAAO,UACxC,SACA,OACA;GAAE,MAAM;GAAS,YAAY;GAAS,EACtC,OACA,CAAC,OAAO,CACT;EACuB;EAAiB"}

package/dist/server/lovable/create-app-function-start.d.ts

@@ -0,0 +1,26 @@
+import { SecureStartContext } from "../secure-start-core.js";
+import { Logger } from "../shared/logger.js";
+import { AppConnectHonoEnv } from "../hono/types.js";
+import { Hono } from "hono";
+
+//#region src/server/lovable/create-app-function-start.d.ts
+type RegisterAppFunctionRoutesFunction = (app: Hono<AppConnectHonoEnv>) => void;
+interface CreateAppFunctionStartOptions {
+  /** Base path the user's routes are mounted under (e.g. `/functions/v1/api`). */
+  basePath: string;
+  /** Attach app routes to the SDK-owned Hono instance. */
+  registerRoutes: RegisterAppFunctionRoutesFunction;
+  /** Optional logger forwarded to `createAppConnectRequestHandler`. */
+  logger?: Logger;
+}
+type AppFunctionStart = (context: SecureStartContext) => Promise<void>;
+/**
+ * Builds a Deno-style `start({ appKeys })` entry point that boots a
+ * Hono app under `basePath`, wires the SDK's per-request HubSpot
+ * proxy via `createAppConnectRequestHandler`, and serves it with
+ * `Deno.serve` on `PORT`.
+ */
+declare function createAppFunctionStart(options: CreateAppFunctionStartOptions): AppFunctionStart;
+//#endregion
+export { AppFunctionStart, CreateAppFunctionStartOptions, RegisterAppFunctionRoutesFunction, createAppFunctionStart };
+//# sourceMappingURL=create-app-function-start.d.ts.map

package/dist/server/lovable/create-app-function-start.js

@@ -0,0 +1,28 @@
+import { createAppConnectRequestHandler } from "../hono/hono-request-handler.js";
+//#region src/server/lovable/create-app-function-start.ts
+const PORT = Deno.env.get("PORT");
+const serveOptions = typeof PORT === "string" ? { port: parseInt(PORT, 10) } : {};
+/**
+* Builds a Deno-style `start({ appKeys })` entry point that boots a
+* Hono app under `basePath`, wires the SDK's per-request HubSpot
+* proxy via `createAppConnectRequestHandler`, and serves it with
+* `Deno.serve` on `PORT`.
+*/
+function createAppFunctionStart(options) {
+	const { basePath, registerRoutes, logger } = options;
+	return ({ appKeys }) => {
+		Deno.serve(serveOptions, createAppConnectRequestHandler({
+			appKeys,
+			...logger !== void 0 ? { logger } : {},
+			registerRoutes: (app) => {
+				registerRoutes(app.basePath(basePath));
+			}
+		}));
+		console.log(`[app-function ${basePath}] Listening on http://localhost:${PORT}`);
+		return Promise.resolve();
+	};
+}
+//#endregion
+export { createAppFunctionStart };
+
+//# sourceMappingURL=create-app-function-start.js.map

package/dist/server/lovable/create-app-function-start.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-app-function-start.js","names":[],"sources":["../../../src/server/lovable/create-app-function-start.ts"],"sourcesContent":["import type { Hono } from 'hono';\n\nimport type { Logger } from '../../shared/logger.ts';\nimport { createAppConnectRequestHandler } from '../hono/hono-request-handler.ts';\nimport type { AppConnectHonoEnv } from '../hono/types.ts';\nimport type { SecureStartContext } from '../secure-start-core.ts';\n\nconst PORT = Deno.env.get('PORT');\nconst serveOptions =\n  typeof PORT === 'string' ? { port: parseInt(PORT, 10) } : {};\n\nexport type RegisterAppFunctionRoutesFunction = (\n  app: Hono<AppConnectHonoEnv>\n) => void;\n\nexport interface CreateAppFunctionStartOptions {\n  /** Base path the user's routes are mounted under (e.g. `/functions/v1/api`). */\n  basePath: string;\n  /** Attach app routes to the SDK-owned Hono instance. */\n  registerRoutes: RegisterAppFunctionRoutesFunction;\n  /** Optional logger forwarded to `createAppConnectRequestHandler`. */\n  logger?: Logger;\n}\n\nexport type AppFunctionStart = (context: SecureStartContext) => Promise<void>;\n\n/**\n * Builds a Deno-style `start({ appKeys })` entry point that boots a\n * Hono app under `basePath`, wires the SDK's per-request HubSpot\n * proxy via `createAppConnectRequestHandler`, and serves it with\n * `Deno.serve` on `PORT`.\n */\nexport function createAppFunctionStart(\n  options: CreateAppFunctionStartOptions\n): AppFunctionStart {\n  const { basePath, registerRoutes, logger } = options;\n\n  return ({ appKeys }) => {\n    Deno.serve(\n      serveOptions,\n      createAppConnectRequestHandler({\n        appKeys,\n        ...(logger !== undefined ? { logger } : {}),\n        registerRoutes: (app) => {\n          registerRoutes(app.basePath(basePath));\n        },\n      })\n    );\n\n    console.log(\n      `[app-function ${basePath}] Listening on http://localhost:${PORT}`\n    );\n    return Promise.resolve();\n  };\n}\n"],"mappings":";;AAOA,MAAM,OAAO,KAAK,IAAI,IAAI,OAAO;AACjC,MAAM,eACJ,OAAO,SAAS,WAAW,EAAE,MAAM,SAAS,MAAM,GAAG,EAAE,GAAG,EAAE;;;;;;;AAuB9D,SAAgB,uBACd,SACkB;CAClB,MAAM,EAAE,UAAU,gBAAgB,WAAW;CAE7C,QAAQ,EAAE,cAAc;EACtB,KAAK,MACH,cACA,+BAA+B;GAC7B;GACA,GAAI,WAAW,KAAA,IAAY,EAAE,QAAQ,GAAG,EAAE;GAC1C,iBAAiB,QAAQ;IACvB,eAAe,IAAI,SAAS,SAAS,CAAC;;GAEzC,CAAC,CACH;EAED,QAAQ,IACN,iBAAiB,SAAS,kCAAkC,OAC7D;EACD,OAAO,QAAQ,SAAS"}

package/dist/server/lovable/hubspot-connect/index.d.ts

@@ -0,0 +1,15 @@
+import { HubSpotConnectCimdClientMetadata } from "../../hono/hubspot-connect-routes/cimd-client-metadata-types.js";
+
+//#region src/server/lovable/hubspot-connect/index.d.ts
+interface StartHubSpotConnectFunctionOptions {
+  client: HubSpotConnectCimdClientMetadata;
+}
+/**
+ * Lovable-style entry point for the hubspot-connect Deno function.
+ * Loads `HUBSPOT_APP_PRIVATE_KEY` via `secureStart`, then serves OAuth
+ * and CIMD routes under `/functions/v1/hubspot-connect`.
+ */
+declare function startHubSpotConnectFunction(options: StartHubSpotConnectFunctionOptions): Promise<void>;
+//#endregion
+export { StartHubSpotConnectFunctionOptions, startHubSpotConnectFunction };
+//# sourceMappingURL=index.d.ts.map

package/dist/server/lovable/hubspot-connect/index.js

@@ -0,0 +1,20 @@
+import { secureStart } from "../../deno/start.js";
+import { assertHubSpotConnectCimdClientMetadata } from "../../hono/hubspot-connect-routes/cimd-client-metadata-types.js";
+import { runHubSpotConnectLovableServer } from "./run-hubspot-connect-lovable-server.js";
+//#region src/server/lovable/hubspot-connect/index.ts
+/**
+* Lovable-style entry point for the hubspot-connect Deno function.
+* Loads `HUBSPOT_APP_PRIVATE_KEY` via `secureStart`, then serves OAuth
+* and CIMD routes under `/functions/v1/hubspot-connect`.
+*/
+async function startHubSpotConnectFunction(options) {
+	assertHubSpotConnectCimdClientMetadata(options.client);
+	await secureStart(async () => ({ start: (context) => runHubSpotConnectLovableServer({
+		...context,
+		cimdClientMetadata: options.client
+	}) }));
+}
+//#endregion
+export { startHubSpotConnectFunction };
+
+//# sourceMappingURL=index.js.map

package/dist/server/lovable/hubspot-connect/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../../../src/server/lovable/hubspot-connect/index.ts"],"sourcesContent":["import { secureStart } from '../../deno/start.ts';\nimport { assertHubSpotConnectCimdClientMetadata } from '../../hono/hubspot-connect-routes/cimd-client-metadata-types.ts';\nimport type { HubSpotConnectCimdClientMetadata } from '../../hono/hubspot-connect-routes/cimd-client-metadata-types.ts';\nimport { runHubSpotConnectLovableServer } from './run-hubspot-connect-lovable-server.ts';\n\nexport type { HubSpotConnectCimdClientMetadata } from '../../hono/hubspot-connect-routes/cimd-client-metadata-types.ts';\n\nexport interface StartHubSpotConnectFunctionOptions {\n  client: HubSpotConnectCimdClientMetadata;\n}\n\n/**\n * Lovable-style entry point for the hubspot-connect Deno function.\n * Loads `HUBSPOT_APP_PRIVATE_KEY` via `secureStart`, then serves OAuth\n * and CIMD routes under `/functions/v1/hubspot-connect`.\n */\nexport async function startHubSpotConnectFunction(\n  options: StartHubSpotConnectFunctionOptions\n): Promise<void> {\n  assertHubSpotConnectCimdClientMetadata(options.client);\n  await secureStart(async () => ({\n    start: (context) =>\n      runHubSpotConnectLovableServer({\n        ...context,\n        cimdClientMetadata: options.client,\n      }),\n  }));\n}\n"],"mappings":";;;;;;;;;AAgBA,eAAsB,4BACpB,SACe;CACf,uCAAuC,QAAQ,OAAO;CACtD,MAAM,YAAY,aAAa,EAC7B,QAAQ,YACN,+BAA+B;EAC7B,GAAG;EACH,oBAAoB,QAAQ;EAC7B,CAAC,EACL,EAAE"}

package/dist/server/lovable/hubspot-connect/run-hubspot-connect-lovable-server.js

@@ -0,0 +1,29 @@
+import { registerHubSpotConnectRoutes } from "../../hono/hubspot-connect-routes/hubspot-connect-routes.js";
+import { loadHubSpotConnectRoutesEnv } from "../../hono/hubspot-connect-routes/load-hubspot-connect-routes-env.js";
+import "../../hono/index.js";
+import { Hono } from "hono";
+//#region src/server/lovable/hubspot-connect/run-hubspot-connect-lovable-server.ts
+const PORT = Deno.env.get("PORT");
+const serveOptions = typeof PORT === "string" ? { port: parseInt(PORT, 10) } : {};
+const HUBSPOT_CONNECT_BASE_PATH = "/functions/v1/hubspot-connect";
+function runHubSpotConnectLovableServer(options) {
+	const { appKeys, cimdClientMetadata } = options;
+	const hubspotConnectEnv = loadHubSpotConnectRoutesEnv();
+	const result = Deno.serve(serveOptions, (request) => {
+		const app = new Hono();
+		registerHubSpotConnectRoutes({
+			app: app.basePath(HUBSPOT_CONNECT_BASE_PATH),
+			appKeys,
+			basePath: HUBSPOT_CONNECT_BASE_PATH,
+			hubspotConnectEnv,
+			cimdClientMetadata
+		});
+		return app.fetch(request);
+	});
+	console.log(`[hubspot-connect] Listening on ${result.addr.port}`);
+	return Promise.resolve();
+}
+//#endregion
+export { runHubSpotConnectLovableServer };
+
+//# sourceMappingURL=run-hubspot-connect-lovable-server.js.map

package/dist/server/lovable/hubspot-connect/run-hubspot-connect-lovable-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-hubspot-connect-lovable-server.js","names":[],"sources":["../../../../src/server/lovable/hubspot-connect/run-hubspot-connect-lovable-server.ts"],"sourcesContent":["import { Hono } from 'hono';\n\nimport type { SecureStartContext } from '../../deno/start.ts';\nimport type { HubSpotConnectCimdClientMetadata } from '../../hono/hubspot-connect-routes/cimd-client-metadata-types.ts';\nimport {\n  loadHubSpotConnectRoutesEnv,\n  registerHubSpotConnectRoutes,\n} from '../../hono/index.ts';\n\nconst PORT = Deno.env.get('PORT');\nconst serveOptions =\n  typeof PORT === 'string' ? { port: parseInt(PORT, 10) } : {};\nconst HUBSPOT_CONNECT_BASE_PATH = '/functions/v1/hubspot-connect';\n\nexport interface RunHubSpotConnectLovableServerOptions extends SecureStartContext {\n  cimdClientMetadata: HubSpotConnectCimdClientMetadata;\n}\n\nexport function runHubSpotConnectLovableServer(\n  options: RunHubSpotConnectLovableServerOptions\n): Promise<void> {\n  const { appKeys, cimdClientMetadata } = options;\n  const hubspotConnectEnv = loadHubSpotConnectRoutesEnv();\n  const result = Deno.serve(serveOptions, (request) => {\n    const app = new Hono();\n\n    registerHubSpotConnectRoutes({\n      app: app.basePath(HUBSPOT_CONNECT_BASE_PATH),\n      appKeys,\n      basePath: HUBSPOT_CONNECT_BASE_PATH,\n      hubspotConnectEnv,\n      cimdClientMetadata,\n    });\n\n    return app.fetch(request);\n  });\n\n  console.log(`[hubspot-connect] Listening on ${result.addr.port}`);\n  return Promise.resolve();\n}\n"],"mappings":";;;;;AASA,MAAM,OAAO,KAAK,IAAI,IAAI,OAAO;AACjC,MAAM,eACJ,OAAO,SAAS,WAAW,EAAE,MAAM,SAAS,MAAM,GAAG,EAAE,GAAG,EAAE;AAC9D,MAAM,4BAA4B;AAMlC,SAAgB,+BACd,SACe;CACf,MAAM,EAAE,SAAS,uBAAuB;CACxC,MAAM,oBAAoB,6BAA6B;CACvD,MAAM,SAAS,KAAK,MAAM,eAAe,YAAY;EACnD,MAAM,MAAM,IAAI,MAAM;EAEtB,6BAA6B;GAC3B,KAAK,IAAI,SAAS,0BAA0B;GAC5C;GACA,UAAU;GACV;GACA;GACD,CAAC;EAEF,OAAO,IAAI,MAAM,QAAQ;GACzB;CAEF,QAAQ,IAAI,kCAAkC,OAAO,KAAK,OAAO;CACjE,OAAO,QAAQ,SAAS"}

package/dist/server/lovable.d.ts

@@ -0,0 +1,6 @@
+import { SecureStartContext, SecureStartLoader } from "./secure-start-core.js";
+import { secureStart } from "./deno/start.js";
+import { HubSpotConnectCimdClientMetadata } from "./hono/hubspot-connect-routes/cimd-client-metadata-types.js";
+import { StartHubSpotConnectFunctionOptions, startHubSpotConnectFunction } from "./lovable/hubspot-connect/index.js";
+import { AppFunctionStart, CreateAppFunctionStartOptions, RegisterAppFunctionRoutesFunction, createAppFunctionStart } from "./lovable/create-app-function-start.js";
+export { type AppFunctionStart, type CreateAppFunctionStartOptions, type HubSpotConnectCimdClientMetadata, type RegisterAppFunctionRoutesFunction, type SecureStartContext, type SecureStartLoader, type StartHubSpotConnectFunctionOptions, createAppFunctionStart, secureStart, startHubSpotConnectFunction };

package/dist/server/lovable.js

@@ -0,0 +1,4 @@
+import { secureStart } from "./deno/start.js";
+import { startHubSpotConnectFunction } from "./lovable/hubspot-connect/index.js";
+import { createAppFunctionStart } from "./lovable/create-app-function-start.js";
+export { createAppFunctionStart, secureStart, startHubSpotConnectFunction };

package/dist/server/oauth.d.ts

@@ -0,0 +1,6 @@
+import { JwkSet } from "./types.js";
+import { getJwkThumbprint } from "./utils/jwk-utils.js";
+import { verifyDpopProof } from "./utils/dpop-utils.js";
+import { signJwt, verifyJwt } from "./utils/jwt-utils.js";
+import { sha256base64url } from "./shared/encoding/sha256.js";
+export { type JwkSet, getJwkThumbprint, sha256base64url, signJwt, verifyDpopProof, verifyJwt };

package/dist/server/oauth.js

@@ -0,0 +1,5 @@
+import { getJwkThumbprint } from "./utils/jwk-utils.js";
+import { signJwt, verifyJwt } from "./utils/jwt-utils.js";
+import { verifyDpopProof } from "./utils/dpop-utils.js";
+import { sha256base64url } from "./shared/encoding/sha256.js";
+export { getJwkThumbprint, sha256base64url, signJwt, verifyDpopProof, verifyJwt };

package/dist/server/proxy.js

@@ -0,0 +1,68 @@
+import { signDpopProof } from "./utils/dpop-utils.js";
+import { sha256base64url } from "./shared/encoding/sha256.js";
+import { isHubspotDpopEnabled, requireEnv } from "./utils/env-utils.js";
+import { noopLogger } from "./shared/logger.js";
+//#region src/server/proxy.ts
+const HUBSPOT_API_ORIGIN = requireEnv("HUBSPOT_API_ORIGIN");
+const notAuthenticated = {
+	authenticated: false,
+	fetch: async () => {
+		return new Response(null, {
+			status: 401,
+			statusText: "Unauthorized",
+			headers: { "Content-Type": "application/json" }
+		});
+	}
+};
+const EMPTY_HEADERS = {};
+function createHubSpotProxy(options) {
+	const { userCredentials, appKeys, logger = noopLogger } = options;
+	if (isHubspotDpopEnabled() && appKeys === null) throw new Error("createHubSpotProxy: appKeys is required when HUBSPOT_DPOP_ENABLED is not false");
+	const { accessToken, sessionId } = userCredentials;
+	if (!accessToken || !sessionId) {
+		logger.debug("createHubSpotProxy: returning unauthenticated proxy (missing cookies)");
+		return notAuthenticated;
+	}
+	async function proxyFetch(request) {
+		const { path, method = "GET", headers = EMPTY_HEADERS, body } = request;
+		const targetUrl = `${HUBSPOT_API_ORIGIN}${path}`;
+		const useDpop = isHubspotDpopEnabled();
+		let authorizationHeaders;
+		if (useDpop) {
+			const ath = await sha256base64url(accessToken);
+			const sid = await sha256base64url(sessionId);
+			const dpopProof = await signDpopProof({
+				appKeys,
+				claims: {
+					htm: method,
+					htu: targetUrl,
+					jti: crypto.randomUUID(),
+					iat: Math.floor(Date.now() / 1e3),
+					ath,
+					sid
+				}
+			});
+			authorizationHeaders = {
+				Authorization: `DPoP ${accessToken}`,
+				DPoP: dpopProof
+			};
+		} else authorizationHeaders = { Authorization: `Bearer ${accessToken}` };
+		const requestInit = {
+			headers: {
+				...headers,
+				...authorizationHeaders
+			},
+			method
+		};
+		if (body != null) requestInit.body = body;
+		return fetch(targetUrl, requestInit);
+	}
+	return {
+		authenticated: true,
+		fetch: proxyFetch
+	};
+}
+//#endregion
+export { createHubSpotProxy };
+
+//# sourceMappingURL=proxy.js.map

package/dist/server/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","names":[],"sources":["../../src/server/proxy.ts"],"sourcesContent":["import { noopLogger, type Logger } from '../shared/logger.ts';\nimport {\n  type AppKeys,\n  type HubSpotProxy,\n  type HubSpotProxyRequest,\n  type UserCredentials,\n} from './types.ts';\nimport { sha256base64url } from './utils/crypto-utils.ts';\nimport { signDpopProof } from './utils/dpop-utils.ts';\nimport { isHubspotDpopEnabled, requireEnv } from './utils/env-utils.ts';\n\nconst HUBSPOT_API_ORIGIN = requireEnv('HUBSPOT_API_ORIGIN');\n\n/**\n * Options accepted by {@link createHubSpotProxy}.\n */\nexport interface CreateHubSpotProxyOptions {\n  /**\n   * User session context from the incoming browser request.\n   */\n  userCredentials: UserCredentials;\n\n  /**\n   * Imported app keys from `secureStart`, or `null` when CIMD and DPoP\n   * are both disabled.\n   */\n  appKeys: AppKeys | null;\n  /** Optional logger. Defaults to a no-op logger. */\n  logger?: Logger;\n}\n\nconst notAuthenticated: HubSpotProxy = {\n  authenticated: false,\n  fetch: async (): Promise<Response> => {\n    return new Response(null, {\n      status: 401,\n      statusText: 'Unauthorized',\n      headers: {\n        'Content-Type': 'application/json',\n      },\n    });\n  },\n};\n\nconst EMPTY_HEADERS = {};\n\nexport function createHubSpotProxy(\n  options: CreateHubSpotProxyOptions\n): HubSpotProxy {\n  const { userCredentials, appKeys, logger = noopLogger } = options;\n\n  if (isHubspotDpopEnabled() && appKeys === null) {\n    throw new Error(\n      'createHubSpotProxy: appKeys is required when HUBSPOT_DPOP_ENABLED is not false'\n    );\n  }\n\n  const { accessToken, sessionId } = userCredentials;\n\n  if (!accessToken || !sessionId) {\n    logger.debug(\n      'createHubSpotProxy: returning unauthenticated proxy (missing cookies)'\n    );\n    return notAuthenticated;\n  }\n\n  async function proxyFetch(request: HubSpotProxyRequest): Promise<Response> {\n    const { path, method = 'GET', headers = EMPTY_HEADERS, body } = request;\n\n    const targetUrl = `${HUBSPOT_API_ORIGIN}${path}`;\n    const useDpop = isHubspotDpopEnabled();\n\n    let authorizationHeaders: Record<string, string>;\n    if (useDpop) {\n      const ath = await sha256base64url(accessToken!);\n      const sid = await sha256base64url(sessionId!);\n      const dpopProof = await signDpopProof({\n        appKeys: appKeys!,\n        claims: {\n          htm: method,\n          htu: targetUrl,\n          jti: crypto.randomUUID(),\n          iat: Math.floor(Date.now() / 1000),\n          ath,\n          sid,\n        },\n      });\n      authorizationHeaders = {\n        Authorization: `DPoP ${accessToken}`,\n        DPoP: dpopProof,\n      };\n    } else {\n      authorizationHeaders = {\n        Authorization: `Bearer ${accessToken}`,\n      };\n    }\n\n    const finalHeaders = { ...headers, ...authorizationHeaders };\n\n    const requestInit: RequestInit = {\n      headers: finalHeaders,\n      method,\n    };\n\n    if (body != null) {\n      requestInit.body = body;\n    }\n\n    return fetch(targetUrl, requestInit);\n  }\n\n  return {\n    authenticated: true,\n    fetch: proxyFetch,\n  };\n}\n"],"mappings":";;;;;AAWA,MAAM,qBAAqB,WAAW,qBAAqB;AAoB3D,MAAM,mBAAiC;CACrC,eAAe;CACf,OAAO,YAA+B;EACpC,OAAO,IAAI,SAAS,MAAM;GACxB,QAAQ;GACR,YAAY;GACZ,SAAS,EACP,gBAAgB,oBACjB;GACF,CAAC;;CAEL;AAED,MAAM,gBAAgB,EAAE;AAExB,SAAgB,mBACd,SACc;CACd,MAAM,EAAE,iBAAiB,SAAS,SAAS,eAAe;CAE1D,IAAI,sBAAsB,IAAI,YAAY,MACxC,MAAM,IAAI,MACR,iFACD;CAGH,MAAM,EAAE,aAAa,cAAc;CAEnC,IAAI,CAAC,eAAe,CAAC,WAAW;EAC9B,OAAO,MACL,wEACD;EACD,OAAO;;CAGT,eAAe,WAAW,SAAiD;EACzE,MAAM,EAAE,MAAM,SAAS,OAAO,UAAU,eAAe,SAAS;EAEhE,MAAM,YAAY,GAAG,qBAAqB;EAC1C,MAAM,UAAU,sBAAsB;EAEtC,IAAI;EACJ,IAAI,SAAS;GACX,MAAM,MAAM,MAAM,gBAAgB,YAAa;GAC/C,MAAM,MAAM,MAAM,gBAAgB,UAAW;GAC7C,MAAM,YAAY,MAAM,cAAc;IAC3B;IACT,QAAQ;KACN,KAAK;KACL,KAAK;KACL,KAAK,OAAO,YAAY;KACxB,KAAK,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;KAClC;KACA;KACD;IACF,CAAC;GACF,uBAAuB;IACrB,eAAe,QAAQ;IACvB,MAAM;IACP;SAED,uBAAuB,EACrB,eAAe,UAAU,eAC1B;EAKH,MAAM,cAA2B;GAC/B,SAAS;IAHY,GAAG;IAAS,GAAG;IAGf;GACrB;GACD;EAED,IAAI,QAAQ,MACV,YAAY,OAAO;EAGrB,OAAO,MAAM,WAAW,YAAY;;CAGtC,OAAO;EACL,eAAe;EACf,OAAO;EACR"}

package/dist/server/sanitize-request.js

@@ -0,0 +1,41 @@
+import { isProtectedCookieName } from "./constants.js";
+import { parseCookies } from "./utils/cookie-utils.js";
+//#region src/server/sanitize-request.ts
+function serializeCookies(cookies) {
+	const parts = [];
+	for (const [name, value] of cookies) parts.push(`${name}=${value}`);
+	return parts.join("; ");
+}
+/**
+* Returns a clone of `original` whose `Cookie` header has every
+* protected cookie removed (see
+* {@link isProtectedCookieName}). When no other cookies
+* remain, the header is dropped entirely.
+*
+* Used by `createAppConnectRequestHandler` so the user's route
+* handlers never see — and therefore cannot leak — the access token,
+* session ID, or refresh-token cookies.
+*/
+function sanitizeRequest(original) {
+	const cookies = parseCookies(original.headers.get("Cookie"));
+	const surviving = /* @__PURE__ */ new Map();
+	for (const [name, value] of Object.entries(cookies)) if (!isProtectedCookieName(name)) surviving.set(name, value);
+	const headers = new Headers(original.headers);
+	if (surviving.size === 0) headers.delete("cookie");
+	else headers.set("cookie", serializeCookies(surviving));
+	const init = {
+		method: original.method,
+		headers,
+		redirect: original.redirect,
+		signal: original.signal
+	};
+	if (original.body !== null) {
+		init.body = original.body;
+		init.duplex = "half";
+	}
+	return new Request(original.url, init);
+}
+//#endregion
+export { sanitizeRequest };
+
+//# sourceMappingURL=sanitize-request.js.map

package/dist/server/sanitize-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize-request.js","names":[],"sources":["../../src/server/sanitize-request.ts"],"sourcesContent":["import { isProtectedCookieName } from './constants.ts';\nimport { parseCookies } from './utils/cookie-utils.ts';\n\nfunction serializeCookies(cookies: Map<string, string>): string {\n  const parts: string[] = [];\n  for (const [name, value] of cookies) {\n    parts.push(`${name}=${value}`);\n  }\n  return parts.join('; ');\n}\n\n/**\n * Returns a clone of `original` whose `Cookie` header has every\n * protected cookie removed (see\n * {@link isProtectedCookieName}). When no other cookies\n * remain, the header is dropped entirely.\n *\n * Used by `createAppConnectRequestHandler` so the user's route\n * handlers never see — and therefore cannot leak — the access token,\n * session ID, or refresh-token cookies.\n */\nexport function sanitizeRequest(original: Request): Request {\n  const cookies = parseCookies(original.headers.get('Cookie'));\n\n  const surviving = new Map<string, string>();\n  for (const [name, value] of Object.entries(cookies)) {\n    if (!isProtectedCookieName(name)) {\n      surviving.set(name, value);\n    }\n  }\n\n  const headers = new Headers(original.headers);\n  if (surviving.size === 0) {\n    headers.delete('cookie');\n  } else {\n    headers.set('cookie', serializeCookies(surviving));\n  }\n\n  const init: RequestInit = {\n    method: original.method,\n    headers,\n    redirect: original.redirect,\n    signal: original.signal,\n  };\n\n  if (original.body !== null) {\n    init.body = original.body;\n    (init as RequestInit & { duplex: 'half' }).duplex = 'half';\n  }\n\n  return new Request(original.url, init);\n}\n"],"mappings":";;;AAGA,SAAS,iBAAiB,SAAsC;CAC9D,MAAM,QAAkB,EAAE;CAC1B,KAAK,MAAM,CAAC,MAAM,UAAU,SAC1B,MAAM,KAAK,GAAG,KAAK,GAAG,QAAQ;CAEhC,OAAO,MAAM,KAAK,KAAK;;;;;;;;;;;;AAazB,SAAgB,gBAAgB,UAA4B;CAC1D,MAAM,UAAU,aAAa,SAAS,QAAQ,IAAI,SAAS,CAAC;CAE5D,MAAM,4BAAY,IAAI,KAAqB;CAC3C,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,QAAQ,EACjD,IAAI,CAAC,sBAAsB,KAAK,EAC9B,UAAU,IAAI,MAAM,MAAM;CAI9B,MAAM,UAAU,IAAI,QAAQ,SAAS,QAAQ;CAC7C,IAAI,UAAU,SAAS,GACrB,QAAQ,OAAO,SAAS;MAExB,QAAQ,IAAI,UAAU,iBAAiB,UAAU,CAAC;CAGpD,MAAM,OAAoB;EACxB,QAAQ,SAAS;EACjB;EACA,UAAU,SAAS;EACnB,QAAQ,SAAS;EAClB;CAED,IAAI,SAAS,SAAS,MAAM;EAC1B,KAAK,OAAO,SAAS;EACrB,KAA2C,SAAS;;CAGtD,OAAO,IAAI,QAAQ,SAAS,KAAK,KAAK"}

package/dist/server/secure-start-core.d.ts

@@ -0,0 +1,23 @@
+import { AppKeys } from "./types.js";
+
+//#region src/server/secure-start-core.d.ts
+/**
+ * Context passed to a function-style entrypoint loaded by `runSecureStart`.
+ * Contains imported `AppKeys` when CIMD or DPoP is enabled; otherwise
+ * `null` (traditional OAuth with `client_secret` and Bearer API calls).
+ */
+interface SecureStartContext {
+  appKeys: AppKeys | null;
+}
+interface SecureEntryPointExports {
+  start: (context: SecureStartContext) => Promise<void>;
+}
+/**
+ * Loader returned to `runSecureStart` that produces the entrypoint
+ * module. Always pass an `() => import('...')` arrow so the bundler
+ * preserves dynamic-import semantics.
+ */
+type SecureStartLoader = () => Promise<SecureEntryPointExports>;
+//#endregion
+export { SecureStartContext, SecureStartLoader };
+//# sourceMappingURL=secure-start-core.d.ts.map

package/dist/server/secure-start-core.js

@@ -0,0 +1,28 @@
+import { importAppKeys } from "./import-app-keys.js";
+import { isHubspotAppPrivateKeyRequired } from "./utils/env-utils.js";
+//#region src/server/secure-start-core.ts
+const APP_PRIVATE_KEY_ENV = "HUBSPOT_APP_PRIVATE_KEY";
+/**
+* Loads `HUBSPOT_APP_PRIVATE_KEY` when CIMD or DPoP is enabled, deletes
+* it from the environment so later code cannot re-read it, imports the
+* entrypoint module via `loader`, and invokes `start` with `AppKeys` or
+* `null` when both features are off. On failure, logs the error and
+* exits with code 1.
+*/
+async function runSecureStart(loader, adapter) {
+	let appKeys = null;
+	if (isHubspotAppPrivateKeyRequired()) {
+		const envKey = adapter.readEnv(APP_PRIVATE_KEY_ENV)?.trim();
+		if (!envKey) throw new Error(`${APP_PRIVATE_KEY_ENV} is not set`);
+		appKeys = await importAppKeys(envKey);
+		adapter.deleteEnv(APP_PRIVATE_KEY_ENV);
+	}
+	return (await loader()).start({ appKeys }).catch((error) => {
+		console.error(error);
+		return adapter.exit(1);
+	});
+}
+//#endregion
+export { runSecureStart };
+
+//# sourceMappingURL=secure-start-core.js.map

package/dist/server/secure-start-core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-start-core.js","names":[],"sources":["../../src/server/secure-start-core.ts"],"sourcesContent":["import { importAppKeys } from './import-app-keys.ts';\nimport type { AppKeys } from './types.ts';\nimport { isHubspotAppPrivateKeyRequired } from './utils/env-utils.ts';\n\n/**\n * Context passed to a function-style entrypoint loaded by `runSecureStart`.\n * Contains imported `AppKeys` when CIMD or DPoP is enabled; otherwise\n * `null` (traditional OAuth with `client_secret` and Bearer API calls).\n */\nexport interface SecureStartContext {\n  appKeys: AppKeys | null;\n}\n\ninterface SecureEntryPointExports {\n  start: (context: SecureStartContext) => Promise<void>;\n}\n\n/**\n * Loader returned to `runSecureStart` that produces the entrypoint\n * module. Always pass an `() => import('...')` arrow so the bundler\n * preserves dynamic-import semantics.\n */\nexport type SecureStartLoader = () => Promise<SecureEntryPointExports>;\n\n/**\n * Platform adapters injected by the runtime-specific shim\n * (`node/start.ts` or `deno/start.ts`). Keeping the env/exit/delete\n * functions out of the core lets the shared logic stay platform-free.\n */\nexport interface SecureStartAdapter {\n  /** Reads the named env var, or returns `undefined` when unset. */\n  readEnv: (key: string) => string | undefined;\n  /** Removes the named env var so child processes cannot read it. */\n  deleteEnv: (key: string) => void;\n  /** Terminates the process with the given exit code. */\n  exit: (code: number) => never;\n}\n\nconst APP_PRIVATE_KEY_ENV = 'HUBSPOT_APP_PRIVATE_KEY';\n\n/**\n * Loads `HUBSPOT_APP_PRIVATE_KEY` when CIMD or DPoP is enabled, deletes\n * it from the environment so later code cannot re-read it, imports the\n * entrypoint module via `loader`, and invokes `start` with `AppKeys` or\n * `null` when both features are off. On failure, logs the error and\n * exits with code 1.\n */\nexport async function runSecureStart(\n  loader: SecureStartLoader,\n  adapter: SecureStartAdapter\n): Promise<void> {\n  let appKeys: AppKeys | null = null;\n  if (isHubspotAppPrivateKeyRequired()) {\n    const envKey = adapter.readEnv(APP_PRIVATE_KEY_ENV)?.trim();\n    if (!envKey) {\n      throw new Error(`${APP_PRIVATE_KEY_ENV} is not set`);\n    }\n    appKeys = await importAppKeys(envKey);\n    adapter.deleteEnv(APP_PRIVATE_KEY_ENV);\n  }\n\n  const exports = await loader();\n  return exports.start({ appKeys }).catch((error) => {\n    console.error(error);\n    return adapter.exit(1);\n  });\n}\n"],"mappings":";;;AAsCA,MAAM,sBAAsB;;;;;;;;AAS5B,eAAsB,eACpB,QACA,SACe;CACf,IAAI,UAA0B;CAC9B,IAAI,gCAAgC,EAAE;EACpC,MAAM,SAAS,QAAQ,QAAQ,oBAAoB,EAAE,MAAM;EAC3D,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,GAAG,oBAAoB,aAAa;EAEtD,UAAU,MAAM,cAAc,OAAO;EACrC,QAAQ,UAAU,oBAAoB;;CAIxC,QAAO,MADe,QAAQ,EACf,MAAM,EAAE,SAAS,CAAC,CAAC,OAAO,UAAU;EACjD,QAAQ,MAAM,MAAM;EACpB,OAAO,QAAQ,KAAK,EAAE;GACtB"}

package/dist/server/shared/constants.js

@@ -0,0 +1,17 @@
+//#region src/shared/constants.ts
+/**
+* Constants whose values are part of the contract between the browser
+* controller and the server-side hubspot-connect routes. Both halves
+* import from this module so the wire format stays in sync.
+*/
+/**
+* Query parameter on the OAuth return URL that carries the new access
+* token's expiry (Unix epoch milliseconds). The server emits this on
+* the `auth/callback` redirect; the browser parses it during `initSdk`
+* and then strips it from the URL via `history.replaceState`.
+*/
+const EXPIRES_AT_URL_PARAM = "__hs_expires_at";
+//#endregion
+export { EXPIRES_AT_URL_PARAM };
+
+//# sourceMappingURL=constants.js.map

package/dist/server/shared/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","names":[],"sources":["../../../src/shared/constants.ts"],"sourcesContent":["/**\n * Constants whose values are part of the contract between the browser\n * controller and the server-side hubspot-connect routes. Both halves\n * import from this module so the wire format stays in sync.\n */\n\n/**\n * Query parameter on the OAuth return URL that carries the new access\n * token's expiry (Unix epoch milliseconds). The server emits this on\n * the `auth/callback` redirect; the browser parses it during `initSdk`\n * and then strips it from the URL via `history.replaceState`.\n */\nexport const EXPIRES_AT_URL_PARAM = '__hs_expires_at';\n"],"mappings":";;;;;;;;;;;;AAYA,MAAa,uBAAuB"}

package/dist/server/shared/encoding/base64.js

@@ -0,0 +1,45 @@
+//#region src/shared/encoding/base64.ts
+/**
+* Base64url encoding and decoding helpers shared by the browser and
+* server halves of `@hubspot/app-connect-sdk`.
+*
+* Base64url (RFC 4648 §5) replaces `+`/`/` with `-`/`_` and drops `=`
+* padding. JWT, DPoP, and JWK thumbprints all use this variant.
+*/
+/**
+* Encodes a binary buffer as a base64url string (RFC 4648 §5).
+*/
+function base64url(input) {
+	const bytes = input instanceof Uint8Array ? input : new Uint8Array(input);
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+/**
+* Decodes a base64url string into a `Uint8Array`. Tolerates missing
+* padding by re-adding it before delegating to `atob`.
+*/
+function base64urlDecode(encoded) {
+	const padLen = (4 - encoded.length % 4) % 4;
+	const padded = encoded.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat(padLen);
+	const binary = atob(padded);
+	const out = new Uint8Array(new ArrayBuffer(binary.length));
+	for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i) ?? 0;
+	return out;
+}
+/**
+* Decodes a *standard* base64 string (with `+`/`/` and required `=`
+* padding) into an `ArrayBuffer`. Used for PKCS8-encoded private keys
+* stored in environment variables.
+*/
+function base64StandardToArrayBuffer(b64) {
+	const bin = atob(b64);
+	const buf = new ArrayBuffer(bin.length);
+	const view = new Uint8Array(buf);
+	for (let i = 0; i < bin.length; i++) view[i] = bin.charCodeAt(i) ?? 0;
+	return buf;
+}
+//#endregion
+export { base64StandardToArrayBuffer, base64url, base64urlDecode };
+
+//# sourceMappingURL=base64.js.map

package/dist/server/shared/encoding/base64.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64.js","names":[],"sources":["../../../../src/shared/encoding/base64.ts"],"sourcesContent":["/**\n * Base64url encoding and decoding helpers shared by the browser and\n * server halves of `@hubspot/app-connect-sdk`.\n *\n * Base64url (RFC 4648 §5) replaces `+`/`/` with `-`/`_` and drops `=`\n * padding. JWT, DPoP, and JWK thumbprints all use this variant.\n */\n\n/**\n * Encodes a binary buffer as a base64url string (RFC 4648 §5).\n */\nexport function base64url(input: ArrayBuffer | Uint8Array): string {\n  const bytes = input instanceof Uint8Array ? input : new Uint8Array(input);\n  let binary = '';\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n}\n\n/**\n * Decodes a base64url string into a `Uint8Array`. Tolerates missing\n * padding by re-adding it before delegating to `atob`.\n */\nexport function base64urlDecode(encoded: string): Uint8Array<ArrayBuffer> {\n  const padLen = (4 - (encoded.length % 4)) % 4;\n  const padded =\n    encoded.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat(padLen);\n  const binary = atob(padded);\n  const out = new Uint8Array(new ArrayBuffer(binary.length));\n  for (let i = 0; i < binary.length; i++) {\n    out[i] = binary.charCodeAt(i) ?? 0;\n  }\n  return out;\n}\n\n/**\n * Decodes a *standard* base64 string (with `+`/`/` and required `=`\n * padding) into an `ArrayBuffer`. Used for PKCS8-encoded private keys\n * stored in environment variables.\n */\nexport function base64StandardToArrayBuffer(b64: string): ArrayBuffer {\n  const bin = atob(b64);\n  const buf = new ArrayBuffer(bin.length);\n  const view = new Uint8Array(buf);\n  for (let i = 0; i < bin.length; i++) {\n    view[i] = bin.charCodeAt(i) ?? 0;\n  }\n  return buf;\n}\n"],"mappings":";;;;;;;;;;;AAWA,SAAgB,UAAU,OAAyC;CACjE,MAAM,QAAQ,iBAAiB,aAAa,QAAQ,IAAI,WAAW,MAAM;CACzE,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OACjB,UAAU,OAAO,aAAa,KAAK;CAErC,OAAO,KAAK,OAAO,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,MAAM,GAAG;;;;;;AAO/E,SAAgB,gBAAgB,SAA0C;CACxE,MAAM,UAAU,IAAK,QAAQ,SAAS,KAAM;CAC5C,MAAM,SACJ,QAAQ,QAAQ,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI,GAAG,IAAI,OAAO,OAAO;CACpE,MAAM,SAAS,KAAK,OAAO;CAC3B,MAAM,MAAM,IAAI,WAAW,IAAI,YAAY,OAAO,OAAO,CAAC;CAC1D,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KACjC,IAAI,KAAK,OAAO,WAAW,EAAE,IAAI;CAEnC,OAAO;;;;;;;AAQT,SAAgB,4BAA4B,KAA0B;CACpE,MAAM,MAAM,KAAK,IAAI;CACrB,MAAM,MAAM,IAAI,YAAY,IAAI,OAAO;CACvC,MAAM,OAAO,IAAI,WAAW,IAAI;CAChC,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAC9B,KAAK,KAAK,IAAI,WAAW,EAAE,IAAI;CAEjC,OAAO"}

package/dist/server/shared/encoding/sha256.d.ts

@@ -0,0 +1,10 @@
+//#region src/shared/encoding/sha256.d.ts
+/**
+ * Hashes a UTF-8 string with SHA-256 and encodes the digest as
+ * base64url. Used to compute DPoP `ath`/`sid` claims, JWK thumbprints
+ * (RFC 7638), and PKCE code challenges.
+ */
+declare function sha256base64url(input: string): Promise<string>;
+//#endregion
+export { sha256base64url };
+//# sourceMappingURL=sha256.d.ts.map

package/dist/server/shared/encoding/sha256.js

@@ -0,0 +1,15 @@
+import { base64url } from "./base64.js";
+//#region src/shared/encoding/sha256.ts
+/**
+* Hashes a UTF-8 string with SHA-256 and encodes the digest as
+* base64url. Used to compute DPoP `ath`/`sid` claims, JWK thumbprints
+* (RFC 7638), and PKCE code challenges.
+*/
+async function sha256base64url(input) {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
+	return base64url(new Uint8Array(digest));
+}
+//#endregion
+export { sha256base64url };
+
+//# sourceMappingURL=sha256.js.map

package/dist/server/shared/encoding/sha256.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sha256.js","names":[],"sources":["../../../../src/shared/encoding/sha256.ts"],"sourcesContent":["import { base64url } from './base64.ts';\n\n/**\n * Hashes a UTF-8 string with SHA-256 and encodes the digest as\n * base64url. Used to compute DPoP `ath`/`sid` claims, JWK thumbprints\n * (RFC 7638), and PKCE code challenges.\n */\nexport async function sha256base64url(input: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\n    'SHA-256',\n    new TextEncoder().encode(input)\n  );\n  return base64url(new Uint8Array(digest));\n}\n"],"mappings":";;;;;;;AAOA,eAAsB,gBAAgB,OAAgC;CACpE,MAAM,SAAS,MAAM,OAAO,OAAO,OACjC,WACA,IAAI,aAAa,CAAC,OAAO,MAAM,CAChC;CACD,OAAO,UAAU,IAAI,WAAW,OAAO,CAAC"}

package/dist/server/shared/logger.d.ts

@@ -0,0 +1,15 @@
+//#region src/shared/logger.d.ts
+/**
+ * Pluggable logger contract used by the SDK on both the browser and
+ * server. Consumers can pass `console`-like loggers, structured
+ * loggers (pino / winston / etc.) or no-op stubs in tests.
+ */
+interface Logger {
+  debug: (message: string, ...args: unknown[]) => void;
+  info: (message: string, ...args: unknown[]) => void;
+  warn: (message: string, ...args: unknown[]) => void;
+  error: (message: string, ...args: unknown[]) => void;
+}
+//#endregion
+export { Logger };
+//# sourceMappingURL=logger.d.ts.map

package/dist/server/shared/logger.js

@@ -0,0 +1,16 @@
+//#region src/shared/logger.ts
+/**
+* Logger that swallows every message. Convenient for tests and for
+* the SDK's server-side handlers when no logger is provided by the
+* host application.
+*/
+const noopLogger = {
+	debug: () => {},
+	info: () => {},
+	warn: () => {},
+	error: () => {}
+};
+//#endregion
+export { noopLogger };
+
+//# sourceMappingURL=logger.js.map

package/dist/server/shared/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","names":[],"sources":["../../../src/shared/logger.ts"],"sourcesContent":["/**\n * Pluggable logger contract used by the SDK on both the browser and\n * server. Consumers can pass `console`-like loggers, structured\n * loggers (pino / winston / etc.) or no-op stubs in tests.\n */\nexport interface Logger {\n  debug: (message: string, ...args: unknown[]) => void;\n  info: (message: string, ...args: unknown[]) => void;\n  warn: (message: string, ...args: unknown[]) => void;\n  error: (message: string, ...args: unknown[]) => void;\n}\n\nfunction formatPrefix(name: string): string {\n  return `[${name}]`;\n}\n\n/**\n * Creates a console-backed logger that prefixes every line with the\n * supplied `name`. Used as the default when no custom logger is\n * provided.\n */\nexport function createLogger(name: string): Logger {\n  const prefix = formatPrefix(name);\n  return {\n    debug: (message, ...args) => {\n      console.debug(prefix, message, ...args);\n    },\n    info: (message, ...args) => {\n      console.info(prefix, message, ...args);\n    },\n    warn: (message, ...args) => {\n      console.warn(prefix, message, ...args);\n    },\n    error: (message, ...args) => {\n      console.error(prefix, message, ...args);\n    },\n  };\n}\n\n/**\n * Logger that swallows every message. Convenient for tests and for\n * the SDK's server-side handlers when no logger is provided by the\n * host application.\n */\nexport const noopLogger: Logger = {\n  debug: () => {},\n  info: () => {},\n  warn: () => {},\n  error: () => {},\n};\n"],"mappings":";;;;;;AA4CA,MAAa,aAAqB;CAChC,aAAa;CACb,YAAY;CACZ,YAAY;CACZ,aAAa;CACd"}

package/dist/server/types.d.ts

@@ -0,0 +1,56 @@
+//#region src/server/types.d.ts
+/**
+ * Imported app key material used to sign client assertions and DPoP
+ * proofs. Produced by `secureStart`/`importAppKeys`; never store this
+ * shape on disk.
+ */
+interface AppKeys {
+  /** ES256 private key as a non-extractable WebCrypto `CryptoKey`. */
+  appPrivateKey: CryptoKey;
+  /** Public key in JWK form. Used to derive the JWK thumbprint and `cnf`. */
+  appPublicKeyJwk: JsonWebKey;
+}
+/**
+ * Request shape accepted by `HubSpotProxy.fetch`. Only the `path`
+ * is required; everything else mirrors the equivalent fetch fields.
+ */
+interface HubSpotProxyRequest {
+  /** Path component of the upstream URL, including leading slash. */
+  path: string;
+  /** HTTP method. Defaults to `GET`. */
+  method?: string;
+  /**
+   * Extra request headers. The proxy adds `Authorization` itself
+   * (`DPoP` access token plus `DPoP` proof when `HUBSPOT_DPOP_ENABLED` is
+   * not `"false"` and `appKeys` is non-null; otherwise `Bearer` only).
+   */
+  headers?: Record<string, string>;
+  /** Optional request body. Pass `null`/`undefined` for empty bodies. */
+  body?: string | null | undefined;
+}
+/**
+ * Authenticated proxy returned by `createHubSpotProxy`. Use it
+ * inside Hono handlers (via `c.env.hubSpotProxy`) to call
+ * HubSpot's API on behalf of the browser session that issued the
+ * incoming request.
+ */
+interface HubSpotProxy {
+  /**
+   * `true` when the session cookies present on the inbound request
+   * yielded a usable access token. When `false`, every `fetch()` call
+   * returns a 401 without contacting the upstream.
+   */
+  authenticated: boolean;
+  /** Performs an authenticated upstream request. */
+  fetch: (request: HubSpotProxyRequest) => Promise<Response>;
+}
+/**
+ * RFC 7517 JWK Set. Returned by HubSpot's `/oauth/v1/jwks` endpoint
+ * and used to verify access tokens on the resource server.
+ */
+interface JwkSet {
+  keys: JsonWebKey[];
+}
+//#endregion
+export { AppKeys, HubSpotProxy, JwkSet };
+//# sourceMappingURL=types.d.ts.map