@hubspot/app-connect-sdk 1.0.0-alpha.2 → 1.0.0-alpha.21

package/dist/server/api-client.js

@@ -3,99 +3,99 @@ import { createHubSpotClient } from "./api-client-core/client.js";
 import { createBinaryData, isBinaryData } from "./api-client-core/binary-data.js";
 import { op } from "./api-client-core/op.js";
 import { pagination } from "./api-client-core/pagination.js";
-import { accountAccountInfo } from "./api-client-core/apis/account/account-info.generated.js";
-import { accountAuditLogs } from "./api-client-core/apis/account/audit-logs.generated.js";
+import { account } from "./api-client-core/apis/account/account-info.generated.js";
+import { accountActivity } from "./api-client-core/apis/account/audit-logs.generated.js";
 import { authOauth } from "./api-client-core/apis/auth/oauth.generated.js";
-import { automationActions } from "./api-client-core/apis/automation/actions.generated.js";
+import { automationActionsCallbacks, automationActionsDefinitions, automationActionsFunctions, automationActionsRevisions } from "./api-client-core/apis/automation/actions.generated.js";
 import { automationSequences } from "./api-client-core/apis/automation/sequences.generated.js";
-import { businessUnits } from "./api-client-core/apis/business-units.generated.js";
-import { cmsAuthors } from "./api-client-core/apis/cms/authors.generated.js";
-import { cmsBlogSettings } from "./api-client-core/apis/cms/blog-settings.generated.js";
-import { cmsCmsContentAudit } from "./api-client-core/apis/cms/cms-content-audit.generated.js";
+import { businessunitsBusinessunitentries } from "./api-client-core/apis/business-units.generated.js";
+import { cmsAuthorsCmsBlogsAuthors, cmsBlogsAuthorsBatch } from "./api-client-core/apis/cms/authors.generated.js";
+import { cmsBlogsSettings, cmsBlogsSettingsMultilanguage } from "./api-client-core/apis/cms/blog-settings.generated.js";
+import { cmsAuditlogs } from "./api-client-core/apis/cms/cms-content-audit.generated.js";
 import { cmsDomains } from "./api-client-core/apis/cms/domains.generated.js";
-import { cmsHubdb } from "./api-client-core/apis/cms/hubdb.generated.js";
-import { cmsMediaBridge } from "./api-client-core/apis/cms/media-bridge.generated.js";
-import { cmsPages } from "./api-client-core/apis/cms/pages.generated.js";
-import { cmsPosts } from "./api-client-core/apis/cms/posts.generated.js";
-import { cmsSiteSearch } from "./api-client-core/apis/cms/site-search.generated.js";
-import { cmsSourceCode } from "./api-client-core/apis/cms/source-code.generated.js";
-import { cmsTags } from "./api-client-core/apis/cms/tags.generated.js";
-import { cmsUrlMappings } from "./api-client-core/apis/cms/url-mappings.generated.js";
-import { cmsUrlRedirects } from "./api-client-core/apis/cms/url-redirects.generated.js";
-import { communicationPreferencesSubscriptions } from "./api-client-core/apis/communication-preferences/subscriptions.generated.js";
-import { conversations } from "./api-client-core/apis/conversations.generated.js";
-import { conversationsCustomChannels } from "./api-client-core/apis/conversations/custom-channels.generated.js";
-import { conversationsVisitorIdentification } from "./api-client-core/apis/conversations/visitor-identification.generated.js";
-import { crmAppUninstalls } from "./api-client-core/apis/crm/app-uninstalls.generated.js";
-import { crmAppointments } from "./api-client-core/apis/crm/appointments.generated.js";
-import { crmAssociationsSchema } from "./api-client-core/apis/crm/associations-schema.generated.js";
-import { crmAssociations } from "./api-client-core/apis/crm/associations.generated.js";
-import { crmCallingExtensions } from "./api-client-core/apis/crm/calling-extensions.generated.js";
-import { crmCalls } from "./api-client-core/apis/crm/calls.generated.js";
-import { crmCarts } from "./api-client-core/apis/crm/carts.generated.js";
-import { crmCommercePayments } from "./api-client-core/apis/crm/commerce-payments.generated.js";
-import { crmCommerceSubscriptions } from "./api-client-core/apis/crm/commerce-subscriptions.generated.js";
-import { crmCommunications } from "./api-client-core/apis/crm/communications.generated.js";
-import { crmCompanies } from "./api-client-core/apis/crm/companies.generated.js";
-import { crmContacts } from "./api-client-core/apis/crm/contacts.generated.js";
-import { crmContracts } from "./api-client-core/apis/crm/contracts.generated.js";
-import { crmCourses } from "./api-client-core/apis/crm/courses.generated.js";
-import { crmCrmOwners } from "./api-client-core/apis/crm/crm-owners.generated.js";
-import { crmCustomObjects } from "./api-client-core/apis/crm/custom-objects.generated.js";
-import { crmDealSplits } from "./api-client-core/apis/crm/deal-splits.generated.js";
-import { crmDeals } from "./api-client-core/apis/crm/deals.generated.js";
-import { crmDiscounts } from "./api-client-core/apis/crm/discounts.generated.js";
-import { crmEmails } from "./api-client-core/apis/crm/emails.generated.js";
+import { cmsHubdbRows, cmsHubdbTables } from "./api-client-core/apis/cms/hubdb.generated.js";
+import { cmsMediabridge, cmsMediabridgeBatch } from "./api-client-core/apis/cms/media-bridge.generated.js";
+import { cmsPagesLandingPages, cmsPagesLandingPagesAbTest, cmsPagesLandingPagesBatch, cmsPagesLandingPagesDraft, cmsPagesLandingPagesFolders, cmsPagesLandingPagesMultiLanguage, cmsPagesLandingPagesRevisions, cmsPagesSitePages, cmsPagesSitePagesAbTest, cmsPagesSitePagesBatch, cmsPagesSitePagesDraft, cmsPagesSitePagesMultiLanguage, cmsPagesSitePagesRevisions } from "./api-client-core/apis/cms/pages.generated.js";
+import { cmsBlogsPosts, cmsBlogsPostsBatch, cmsBlogsPostsMultilanguage, cmsBlogsPostsRevisions, cmsPostsCmsBlogsAuthors } from "./api-client-core/apis/cms/posts.generated.js";
+import { cmsSitesearch } from "./api-client-core/apis/cms/site-search.generated.js";
+import { cmsSourcecode } from "./api-client-core/apis/cms/source-code.generated.js";
+import { cmsBlogsTags, cmsBlogsTagsBatch, cmsTagsCmsBlogsAuthors } from "./api-client-core/apis/cms/tags.generated.js";
+import { cmsUrlmappings } from "./api-client-core/apis/cms/url-mappings.generated.js";
+import { cmsUrlredirects } from "./api-client-core/apis/cms/url-redirects.generated.js";
+import { communicationpreferences, communicationpreferencesDefinitions, communicationpreferencesStatusesBatch } from "./api-client-core/apis/communication-preferences/subscriptions.generated.js";
+import { conversationsBasic, conversationsBatch } from "./api-client-core/apis/conversations.generated.js";
+import { conversationsCustomchannels, conversationsCustomchannelsChannelaccounts, conversationsCustomchannelsMessages } from "./api-client-core/apis/conversations/custom-channels.generated.js";
+import { conversationsVisitoridentification } from "./api-client-core/apis/conversations/visitor-identification.generated.js";
+import { crmAppuninstalls } from "./api-client-core/apis/crm/app-uninstalls.generated.js";
+import { crmAppointmentsAdvanced, crmAppointmentsCrmAssociations, crmAppointmentsCrmObjectsCustom, crmAppointmentsCrmObjectsCustomBatch, crmAppointmentsCrmObjectsGenericobjects } from "./api-client-core/apis/crm/appointments.generated.js";
+import { crmAssociationsschemaLabels, crmAssociationsschemaLimits } from "./api-client-core/apis/crm/associations-schema.generated.js";
+import { crmAssociationsBatch, crmAssociationsCrmAssociations, crmAssociationsCrmObjectsGenericobjects } from "./api-client-core/apis/crm/associations.generated.js";
+import { crmCallingExtensionsCrmExtensionsCalling } from "./api-client-core/apis/crm/calling-extensions.generated.js";
+import { crmCallsCrmAssociations, crmObjectsCalls, crmObjectsCallsBatch } from "./api-client-core/apis/crm/calls.generated.js";
+import { crmCartsCrmAssociations, crmObjectsCarts, crmObjectsCartsBatch } from "./api-client-core/apis/crm/carts.generated.js";
+import { crmCommercePaymentsCrmAssociations, crmObjectsCommercepayments, crmObjectsCommercepaymentsBatch } from "./api-client-core/apis/crm/commerce-payments.generated.js";
+import { crmCommerceSubscriptionsCrmAssociations, crmObjectsSubscriptions, crmObjectsSubscriptionsBatch } from "./api-client-core/apis/crm/commerce-subscriptions.generated.js";
+import { crmCommunicationsCrmAssociations, crmObjectsCommunications, crmObjectsCommunicationsBatch } from "./api-client-core/apis/crm/communications.generated.js";
+import { crmCompaniesCrmAssociations, crmObjectsCompanies, crmObjectsCompaniesBatch } from "./api-client-core/apis/crm/companies.generated.js";
+import { crmContactsCrmAssociations, crmObjectsContacts, crmObjectsContactsBatch } from "./api-client-core/apis/crm/contacts.generated.js";
+import { crmContractsBasic, crmContractsBatch, crmContractsCrmAssociations, crmContractsSearch, crmObjectsContracts, crmObjectsContractsBatch } from "./api-client-core/apis/crm/contracts.generated.js";
+import { crmCoursesCrmAssociations, crmObjectsCourses, crmObjectsCoursesBatch } from "./api-client-core/apis/crm/courses.generated.js";
+import { crmOwners } from "./api-client-core/apis/crm/crm-owners.generated.js";
+import { crmCustomObjectsCrmAssociations, crmCustomObjectsCrmObjectsCustom, crmCustomObjectsCrmObjectsCustomBatch, crmCustomObjectsCrmObjectsGenericobjects } from "./api-client-core/apis/crm/custom-objects.generated.js";
+import { crmDealsplitsBatch } from "./api-client-core/apis/crm/deal-splits.generated.js";
+import { crmDealsCrmAssociations, crmObjectsDeals, crmObjectsDealsBatch } from "./api-client-core/apis/crm/deals.generated.js";
+import { crmDiscountsCrmAssociations, crmObjectsDiscounts, crmObjectsDiscountsBatch } from "./api-client-core/apis/crm/discounts.generated.js";
+import { crmEmailsCrmAssociations, crmObjectsEmails, crmObjectsEmailsBatch } from "./api-client-core/apis/crm/emails.generated.js";
 import { crmExports } from "./api-client-core/apis/crm/exports.generated.js";
-import { crmFeedbackSubmissions } from "./api-client-core/apis/crm/feedback-submissions.generated.js";
-import { crmFees } from "./api-client-core/apis/crm/fees.generated.js";
-import { crmGoalTargets } from "./api-client-core/apis/crm/goal-targets.generated.js";
+import { crmFeedbackSubmissionsCrmAssociations, crmObjectsFeedbacksubmissions, crmObjectsFeedbacksubmissionsBatch } from "./api-client-core/apis/crm/feedback-submissions.generated.js";
+import { crmFeesCrmAssociations, crmObjectsFees, crmObjectsFeesBatch } from "./api-client-core/apis/crm/fees.generated.js";
+import { crmGoalTargetsCrmAssociations, crmObjectsGoaltargets, crmObjectsGoaltargetsBatch } from "./api-client-core/apis/crm/goal-targets.generated.js";
 import { crmImports } from "./api-client-core/apis/crm/imports.generated.js";
-import { crmInvoices } from "./api-client-core/apis/crm/invoices.generated.js";
-import { crmLeads } from "./api-client-core/apis/crm/leads.generated.js";
-import { crmLimitsTracking } from "./api-client-core/apis/crm/limits-tracking.generated.js";
-import { crmLineItems } from "./api-client-core/apis/crm/line-items.generated.js";
-import { crmListings } from "./api-client-core/apis/crm/listings.generated.js";
+import { crmInvoicesCrmAssociations, crmObjectsInvoices, crmObjectsInvoicesBatch } from "./api-client-core/apis/crm/invoices.generated.js";
+import { crmLeadsCrmAssociations, crmObjectsLeads, crmObjectsLeadsBatch } from "./api-client-core/apis/crm/leads.generated.js";
+import { crmLimits } from "./api-client-core/apis/crm/limits-tracking.generated.js";
+import { crmLineItemsCrmAssociations, crmObjectsLineitems, crmObjectsLineitemsBatch } from "./api-client-core/apis/crm/line-items.generated.js";
+import { crmListingsCrmAssociations, crmObjectsListings, crmObjectsListingsBatch } from "./api-client-core/apis/crm/listings.generated.js";
 import { crmLists } from "./api-client-core/apis/crm/lists.generated.js";
-import { crmMeetings } from "./api-client-core/apis/crm/meetings.generated.js";
-import { crmNotes } from "./api-client-core/apis/crm/notes.generated.js";
-import { crmObjectLibrary } from "./api-client-core/apis/crm/object-library.generated.js";
-import { crmObjects } from "./api-client-core/apis/crm/objects.generated.js";
-import { crmOrders } from "./api-client-core/apis/crm/orders.generated.js";
-import { crmPartnerClients } from "./api-client-core/apis/crm/partner-clients.generated.js";
-import { crmPartnerServices } from "./api-client-core/apis/crm/partner-services.generated.js";
+import { crmMeetingsCrmAssociations, crmObjectsMeetings, crmObjectsMeetingsBatch } from "./api-client-core/apis/crm/meetings.generated.js";
+import { crmNotesCrmAssociations, crmObjectsNotes, crmObjectsNotesBatch } from "./api-client-core/apis/crm/notes.generated.js";
+import { crmObjectlibraryEnablement } from "./api-client-core/apis/crm/object-library.generated.js";
+import { crmObjectsCrmObjectsCustomBatch, crmObjectsCrmObjectsGenericobjects } from "./api-client-core/apis/crm/objects.generated.js";
+import { crmObjectsOrders, crmObjectsOrdersBatch, crmOrdersCrmAssociations } from "./api-client-core/apis/crm/orders.generated.js";
+import { crmObjectsPartnerclients, crmObjectsPartnerclientsBatch, crmPartnerClientsCrmAssociations } from "./api-client-core/apis/crm/partner-clients.generated.js";
+import { crmObjectsPartnerservices, crmObjectsPartnerservicesBatch, crmPartnerServicesCrmAssociations } from "./api-client-core/apis/crm/partner-services.generated.js";
 import { crmPipelines } from "./api-client-core/apis/crm/pipelines.generated.js";
-import { crmPostalMail } from "./api-client-core/apis/crm/postal-mail.generated.js";
-import { crmProducts } from "./api-client-core/apis/crm/products.generated.js";
-import { crmProjects } from "./api-client-core/apis/crm/projects.generated.js";
-import { crmProperties } from "./api-client-core/apis/crm/properties.generated.js";
-import { crmPropertyValidations } from "./api-client-core/apis/crm/property-validations.generated.js";
-import { crmPublicAppCrmCards } from "./api-client-core/apis/crm/public-app-crm-cards.generated.js";
-import { crmPublicAppFeatureFlags } from "./api-client-core/apis/crm/public-app-feature-flags.generated.js";
-import { crmQuotes } from "./api-client-core/apis/crm/quotes.generated.js";
-import { crmSchemas } from "./api-client-core/apis/crm/schemas.generated.js";
-import { crmServices } from "./api-client-core/apis/crm/services.generated.js";
-import { crmTasks } from "./api-client-core/apis/crm/tasks.generated.js";
-import { crmTaxes } from "./api-client-core/apis/crm/taxes.generated.js";
-import { crmTickets } from "./api-client-core/apis/crm/tickets.generated.js";
-import { crmTimeline } from "./api-client-core/apis/crm/timeline.generated.js";
-import { crmTranscriptions } from "./api-client-core/apis/crm/transcriptions.generated.js";
-import { crmUsers } from "./api-client-core/apis/crm/users.generated.js";
-import { crmVideoConferencingExtension } from "./api-client-core/apis/crm/video-conferencing-extension.generated.js";
-import { events } from "./api-client-core/apis/events.generated.js";
-import { eventsManageEventDefinitions } from "./api-client-core/apis/events/manage-event-definitions.generated.js";
-import { eventsSendEventCompletions } from "./api-client-core/apis/events/send-event-completions.generated.js";
-import { files } from "./api-client-core/apis/files.generated.js";
-import { marketingCampaignsPublicApi } from "./api-client-core/apis/marketing/campaigns-public-api.generated.js";
-import { marketingMarketingEmails } from "./api-client-core/apis/marketing/marketing-emails.generated.js";
-import { marketingMarketingEvents } from "./api-client-core/apis/marketing/marketing-events.generated.js";
-import { marketingSingleSend } from "./api-client-core/apis/marketing/single-send.generated.js";
-import { marketingTransactionalSingleSend } from "./api-client-core/apis/marketing/transactional-single-send.generated.js";
-import { metaOrigins } from "./api-client-core/apis/meta/origins.generated.js";
-import { schedulerMeetings } from "./api-client-core/apis/scheduler/meetings.generated.js";
-import { settingsMulticurrency } from "./api-client-core/apis/settings/multicurrency.generated.js";
-import { settingsTaxRates } from "./api-client-core/apis/settings/tax-rates.generated.js";
-import { settingsUserProvisioning } from "./api-client-core/apis/settings/user-provisioning.generated.js";
-import { webhooksJournal } from "./api-client-core/apis/webhooks-journal.generated.js";
-import { webhooks } from "./api-client-core/apis/webhooks.generated.js";
-export { HubSpotApiError, accountAccountInfo, accountAuditLogs, authOauth, automationActions, automationSequences, businessUnits, cmsAuthors, cmsBlogSettings, cmsCmsContentAudit, cmsDomains, cmsHubdb, cmsMediaBridge, cmsPages, cmsPosts, cmsSiteSearch, cmsSourceCode, cmsTags, cmsUrlMappings, cmsUrlRedirects, communicationPreferencesSubscriptions, conversations, conversationsCustomChannels, conversationsVisitorIdentification, createBinaryData, createHubSpotClient, crmAppUninstalls, crmAppointments, crmAssociations, crmAssociationsSchema, crmCallingExtensions, crmCalls, crmCarts, crmCommercePayments, crmCommerceSubscriptions, crmCommunications, crmCompanies, crmContacts, crmContracts, crmCourses, crmCrmOwners, crmCustomObjects, crmDealSplits, crmDeals, crmDiscounts, crmEmails, crmExports, crmFeedbackSubmissions, crmFees, crmGoalTargets, crmImports, crmInvoices, crmLeads, crmLimitsTracking, crmLineItems, crmListings, crmLists, crmMeetings, crmNotes, crmObjectLibrary, crmObjects, crmOrders, crmPartnerClients, crmPartnerServices, crmPipelines, crmPostalMail, crmProducts, crmProjects, crmProperties, crmPropertyValidations, crmPublicAppCrmCards, crmPublicAppFeatureFlags, crmQuotes, crmSchemas, crmServices, crmTasks, crmTaxes, crmTickets, crmTimeline, crmTranscriptions, crmUsers, crmVideoConferencingExtension, events, eventsManageEventDefinitions, eventsSendEventCompletions, files, isBinaryData, marketingCampaignsPublicApi, marketingMarketingEmails, marketingMarketingEvents, marketingSingleSend, marketingTransactionalSingleSend, metaOrigins, op, pagination, schedulerMeetings, settingsMulticurrency, settingsTaxRates, settingsUserProvisioning, webhooks, webhooksJournal };
+import { crmObjectsPostalmail, crmObjectsPostalmailBatch, crmPostalMailCrmAssociations } from "./api-client-core/apis/crm/postal-mail.generated.js";
+import { crmObjectsProducts, crmObjectsProductsBatch, crmProductsCrmAssociations } from "./api-client-core/apis/crm/products.generated.js";
+import { crmObjectsProjects, crmObjectsProjectsBatch, crmProjectsCrmAssociations } from "./api-client-core/apis/crm/projects.generated.js";
+import { crmProperties, crmPropertiesBatch, crmPropertiesGroups } from "./api-client-core/apis/crm/properties.generated.js";
+import { crmPropertiesvalidations } from "./api-client-core/apis/crm/property-validations.generated.js";
+import { crmExtensionsCardsdev } from "./api-client-core/apis/crm/public-app-crm-cards.generated.js";
+import { crmFeatureflags, crmFeatureflagsBatch } from "./api-client-core/apis/crm/public-app-feature-flags.generated.js";
+import { crmObjectsQuotes, crmObjectsQuotesBatch, crmQuotesCrmAssociations } from "./api-client-core/apis/crm/quotes.generated.js";
+import { crmObjectschemas, crmObjectschemasBatch } from "./api-client-core/apis/crm/schemas.generated.js";
+import { crmObjectsServices, crmObjectsServicesBatch, crmServicesCrmAssociations } from "./api-client-core/apis/crm/services.generated.js";
+import { crmObjectsTasks, crmObjectsTasksBatch, crmTasksCrmAssociations } from "./api-client-core/apis/crm/tasks.generated.js";
+import { crmObjectsTaxes, crmObjectsTaxesBatch, crmTaxesCrmAssociations } from "./api-client-core/apis/crm/taxes.generated.js";
+import { crmObjectsTickets, crmObjectsTicketsBatch, crmTicketsCrmAssociations } from "./api-client-core/apis/crm/tickets.generated.js";
+import { crmTimeline, crmTimelineBatch } from "./api-client-core/apis/crm/timeline.generated.js";
+import { crmExtensionsCallingTranscripts, crmTranscriptionsCrmExtensionsCalling } from "./api-client-core/apis/crm/transcriptions.generated.js";
+import { crmObjectsUsers, crmObjectsUsersBatch, crmUsersCrmAssociations } from "./api-client-core/apis/crm/users.generated.js";
+import { crmExtensionsVideoconferencing } from "./api-client-core/apis/crm/video-conferencing-extension.generated.js";
+import { eventsOccurrences } from "./api-client-core/apis/events.generated.js";
+import { eventsManageEventDefinitionsEventsDefinitions } from "./api-client-core/apis/events/manage-event-definitions.generated.js";
+import { eventsSend, eventsSendEventCompletionsEventsDefinitions } from "./api-client-core/apis/events/send-event-completions.generated.js";
+import { filesFileassets, filesFolders } from "./api-client-core/apis/files.generated.js";
+import { marketingCampaigns, marketingCampaignsAssets, marketingCampaignsBatch, marketingCampaignsBudget, marketingCampaignsMetrics, marketingCampaignsSpend } from "./api-client-core/apis/marketing/campaigns-public-api.generated.js";
+import { marketingEmails } from "./api-client-core/apis/marketing/marketing-emails.generated.js";
+import { marketingMarketingevents, marketingMarketingeventsAttendance, marketingMarketingeventsEvents, marketingMarketingeventsListassociations, marketingMarketingeventsParticipations, marketingMarketingeventsSettings, marketingMarketingeventsSubscriberstate } from "./api-client-core/apis/marketing/marketing-events.generated.js";
+import { marketingSinglesend } from "./api-client-core/apis/marketing/single-send.generated.js";
+import { marketingTransactionalSingleemail, marketingTransactionalSmtptokens } from "./api-client-core/apis/marketing/transactional-single-send.generated.js";
+import { metaOriginsIpranges } from "./api-client-core/apis/meta/origins.generated.js";
+import { schedulerMeetingsAdvanced, schedulerMeetingsBasic } from "./api-client-core/apis/scheduler/meetings.generated.js";
+import { settingsCurrencies, settingsCurrenciesCentralfxrates, settingsCurrenciesExchangerates, settingsCurrenciesExchangeratesBatch } from "./api-client-core/apis/settings/multicurrency.generated.js";
+import { settingsTaxrates } from "./api-client-core/apis/settings/tax-rates.generated.js";
+import { settingsUsers } from "./api-client-core/apis/settings/user-provisioning.generated.js";
+import { webhooksJournalWebhooks } from "./api-client-core/apis/webhooks-journal.generated.js";
+import { webhooksWebhooks } from "./api-client-core/apis/webhooks.generated.js";
+export { HubSpotApiError, account, accountActivity, authOauth, automationActionsCallbacks, automationActionsDefinitions, automationActionsFunctions, automationActionsRevisions, automationSequences, businessunitsBusinessunitentries, cmsAuditlogs, cmsAuthorsCmsBlogsAuthors, cmsBlogsAuthorsBatch, cmsBlogsPosts, cmsBlogsPostsBatch, cmsBlogsPostsMultilanguage, cmsBlogsPostsRevisions, cmsBlogsSettings, cmsBlogsSettingsMultilanguage, cmsBlogsTags, cmsBlogsTagsBatch, cmsDomains, cmsHubdbRows, cmsHubdbTables, cmsMediabridge, cmsMediabridgeBatch, cmsPagesLandingPages, cmsPagesLandingPagesAbTest, cmsPagesLandingPagesBatch, cmsPagesLandingPagesDraft, cmsPagesLandingPagesFolders, cmsPagesLandingPagesMultiLanguage, cmsPagesLandingPagesRevisions, cmsPagesSitePages, cmsPagesSitePagesAbTest, cmsPagesSitePagesBatch, cmsPagesSitePagesDraft, cmsPagesSitePagesMultiLanguage, cmsPagesSitePagesRevisions, cmsPostsCmsBlogsAuthors, cmsSitesearch, cmsSourcecode, cmsTagsCmsBlogsAuthors, cmsUrlmappings, cmsUrlredirects, communicationpreferences, communicationpreferencesDefinitions, communicationpreferencesStatusesBatch, conversationsBasic, conversationsBatch, conversationsCustomchannels, conversationsCustomchannelsChannelaccounts, conversationsCustomchannelsMessages, conversationsVisitoridentification, createBinaryData, createHubSpotClient, crmAppointmentsAdvanced, crmAppointmentsCrmAssociations, crmAppointmentsCrmObjectsCustom, crmAppointmentsCrmObjectsCustomBatch, crmAppointmentsCrmObjectsGenericobjects, crmAppuninstalls, crmAssociationsBatch, crmAssociationsCrmAssociations, crmAssociationsCrmObjectsGenericobjects, crmAssociationsschemaLabels, crmAssociationsschemaLimits, crmCallingExtensionsCrmExtensionsCalling, crmCallsCrmAssociations, crmCartsCrmAssociations, crmCommercePaymentsCrmAssociations, crmCommerceSubscriptionsCrmAssociations, crmCommunicationsCrmAssociations, crmCompaniesCrmAssociations, crmContactsCrmAssociations, crmContractsBasic, crmContractsBatch, crmContractsCrmAssociations, crmContractsSearch, crmCoursesCrmAssociations, crmCustomObjectsCrmAssociations, crmCustomObjectsCrmObjectsCustom, crmCustomObjectsCrmObjectsCustomBatch, crmCustomObjectsCrmObjectsGenericobjects, crmDealsCrmAssociations, crmDealsplitsBatch, crmDiscountsCrmAssociations, crmEmailsCrmAssociations, crmExports, crmExtensionsCallingTranscripts, crmExtensionsCardsdev, crmExtensionsVideoconferencing, crmFeatureflags, crmFeatureflagsBatch, crmFeedbackSubmissionsCrmAssociations, crmFeesCrmAssociations, crmGoalTargetsCrmAssociations, crmImports, crmInvoicesCrmAssociations, crmLeadsCrmAssociations, crmLimits, crmLineItemsCrmAssociations, crmListingsCrmAssociations, crmLists, crmMeetingsCrmAssociations, crmNotesCrmAssociations, crmObjectlibraryEnablement, crmObjectsCalls, crmObjectsCallsBatch, crmObjectsCarts, crmObjectsCartsBatch, crmObjectsCommercepayments, crmObjectsCommercepaymentsBatch, crmObjectsCommunications, crmObjectsCommunicationsBatch, crmObjectsCompanies, crmObjectsCompaniesBatch, crmObjectsContacts, crmObjectsContactsBatch, crmObjectsContracts, crmObjectsContractsBatch, crmObjectsCourses, crmObjectsCoursesBatch, crmObjectsCrmObjectsCustomBatch, crmObjectsCrmObjectsGenericobjects, crmObjectsDeals, crmObjectsDealsBatch, crmObjectsDiscounts, crmObjectsDiscountsBatch, crmObjectsEmails, crmObjectsEmailsBatch, crmObjectsFeedbacksubmissions, crmObjectsFeedbacksubmissionsBatch, crmObjectsFees, crmObjectsFeesBatch, crmObjectsGoaltargets, crmObjectsGoaltargetsBatch, crmObjectsInvoices, crmObjectsInvoicesBatch, crmObjectsLeads, crmObjectsLeadsBatch, crmObjectsLineitems, crmObjectsLineitemsBatch, crmObjectsListings, crmObjectsListingsBatch, crmObjectsMeetings, crmObjectsMeetingsBatch, crmObjectsNotes, crmObjectsNotesBatch, crmObjectsOrders, crmObjectsOrdersBatch, crmObjectsPartnerclients, crmObjectsPartnerclientsBatch, crmObjectsPartnerservices, crmObjectsPartnerservicesBatch, crmObjectsPostalmail, crmObjectsPostalmailBatch, crmObjectsProducts, crmObjectsProductsBatch, crmObjectsProjects, crmObjectsProjectsBatch, crmObjectsQuotes, crmObjectsQuotesBatch, crmObjectsServices, crmObjectsServicesBatch, crmObjectsSubscriptions, crmObjectsSubscriptionsBatch, crmObjectsTasks, crmObjectsTasksBatch, crmObjectsTaxes, crmObjectsTaxesBatch, crmObjectsTickets, crmObjectsTicketsBatch, crmObjectsUsers, crmObjectsUsersBatch, crmObjectschemas, crmObjectschemasBatch, crmOrdersCrmAssociations, crmOwners, crmPartnerClientsCrmAssociations, crmPartnerServicesCrmAssociations, crmPipelines, crmPostalMailCrmAssociations, crmProductsCrmAssociations, crmProjectsCrmAssociations, crmProperties, crmPropertiesBatch, crmPropertiesGroups, crmPropertiesvalidations, crmQuotesCrmAssociations, crmServicesCrmAssociations, crmTasksCrmAssociations, crmTaxesCrmAssociations, crmTicketsCrmAssociations, crmTimeline, crmTimelineBatch, crmTranscriptionsCrmExtensionsCalling, crmUsersCrmAssociations, eventsManageEventDefinitionsEventsDefinitions, eventsOccurrences, eventsSend, eventsSendEventCompletionsEventsDefinitions, filesFileassets, filesFolders, isBinaryData, marketingCampaigns, marketingCampaignsAssets, marketingCampaignsBatch, marketingCampaignsBudget, marketingCampaignsMetrics, marketingCampaignsSpend, marketingEmails, marketingMarketingevents, marketingMarketingeventsAttendance, marketingMarketingeventsEvents, marketingMarketingeventsListassociations, marketingMarketingeventsParticipations, marketingMarketingeventsSettings, marketingMarketingeventsSubscriberstate, marketingSinglesend, marketingTransactionalSingleemail, marketingTransactionalSmtptokens, metaOriginsIpranges, op, pagination, schedulerMeetingsAdvanced, schedulerMeetingsBasic, settingsCurrencies, settingsCurrenciesCentralfxrates, settingsCurrenciesExchangerates, settingsCurrenciesExchangeratesBatch, settingsTaxrates, settingsUsers, webhooksJournalWebhooks, webhooksWebhooks };

package/dist/server/constants.js

@@ -12,12 +12,34 @@ const HUBSPOT_ACCESS_TOKEN_COOKIE_NAME = "__Host-hs_access_token";
 */
 const HUBSPOT_APP_SID_COOKIE_NAME = "__Host-hs_app_sid";
 /**
+* Cookie pinning the browser-facing app origin (e.g.
+* `https://app.example.com`) for the lifetime of an app session.
+* Set by `auth/init-session` from the request's `Origin` header and
+* read by:
+*
+* - The CORS middleware to emit a credentialed
+*   `Access-Control-Allow-Origin` value (`*` is forbidden when
+*   `Access-Control-Allow-Credentials: true`).
+* - `auth/complete` to rebuild the OAuth `redirect_uri` it sent to
+*   HubSpot during `init-session` (the token endpoint validates that
+*   the two values match).
+*
+* `__Host-` prefixed (Path=/, Secure, no Domain), so the same
+* function host can serve both `hubspot-connect` and `api` routes
+* and read the cookie from either.
+*/
+const HUBSPOT_APP_ORIGIN_COOKIE_NAME = "__Host-hs_app_origin";
+/**
 * Prefix used for refresh-token cookies. Each session gets its own
 * cookie name (`hs_refresh_<sidHash>`) so multiple devices/tabs can
 * coexist without overwriting each other's refresh tokens.
 */
 const HUBSPOT_REFRESH_COOKIE_PREFIX = "hs_refresh_";
-const PROTECTED_COOKIE_NAMES = new Set([HUBSPOT_ACCESS_TOKEN_COOKIE_NAME, HUBSPOT_APP_SID_COOKIE_NAME]);
+const PROTECTED_COOKIE_NAMES = new Set([
+	HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,
+	HUBSPOT_APP_SID_COOKIE_NAME,
+	HUBSPOT_APP_ORIGIN_COOKIE_NAME
+]);
 /**
 * Returns `true` for cookies the SDK manages internally
 * (access token, session ID, any refresh-token cookie). The
@@ -30,17 +52,22 @@ function isProtectedCookieName(cookieName) {
 }
 /**
 * Cookie carrying the PKCE code verifier between `init-session` and
-* `callback`. `Lax` SameSite so it accompanies the redirect back from
-* HubSpot.
+* `auth/complete`. Set with `SameSite=None; Secure; Partitioned` so the
+* frontend's credentialed cross-site `POST /auth/complete` (made from
+* the OAuth callback page on the app origin to the SDK's edge function
+* origin) carries it through. `Lax` would silently drop it on that
+* fetch, breaking every successful HubSpot redirect.
 */
 const TEMP_COOKIE_PKCE_VERIFIER = "__hs_pkce_verifier";
 /**
 * Cookie carrying the OAuth `state` value between `init-session` and
-* `callback`. Compared against the `state` query parameter as the
-* primary CSRF defense.
+* `auth/complete`. Compared against the `state` query parameter as the
+* primary CSRF defense. Same `SameSite=None; Secure; Partitioned`
+* attributes as `TEMP_COOKIE_PKCE_VERIFIER` for the same cross-site
+* `POST /auth/complete` reason.
 */
 const TEMP_COOKIE_OAUTH_STATE = "__hs_oauth_state";
 //#endregion
-export { HUBSPOT_ACCESS_TOKEN_COOKIE_NAME, HUBSPOT_APP_SID_COOKIE_NAME, HUBSPOT_REFRESH_COOKIE_PREFIX, TEMP_COOKIE_OAUTH_STATE, TEMP_COOKIE_PKCE_VERIFIER, isProtectedCookieName };
+export { HUBSPOT_ACCESS_TOKEN_COOKIE_NAME, HUBSPOT_APP_ORIGIN_COOKIE_NAME, HUBSPOT_APP_SID_COOKIE_NAME, HUBSPOT_REFRESH_COOKIE_PREFIX, TEMP_COOKIE_OAUTH_STATE, TEMP_COOKIE_PKCE_VERIFIER, isProtectedCookieName };
 
 //# sourceMappingURL=constants.js.map

package/dist/server/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","names":[],"sources":["../../src/server/constants.ts"],"sourcesContent":["/**\n * Cookie name carrying the DPoP-bound access token. Uses the\n * `__Host-` prefix so the browser only accepts it from a `Secure`\n * response with `Path=/` — a defense-in-depth against subdomain\n * cookie injection.\n */\nexport const HUBSPOT_ACCESS_TOKEN_COOKIE_NAME = '__Host-hs_access_token';\n\n/**\n * Cookie carrying the opaque app-session ID. Hashed before being put\n * on the wire as a DPoP `sid` claim.\n */\nexport const HUBSPOT_APP_SID_COOKIE_NAME = '__Host-hs_app_sid';\n\n/**\n * Prefix used for refresh-token cookies. Each session gets its own\n * cookie name (`hs_refresh_<sidHash>`) so multiple devices/tabs can\n * coexist without overwriting each other's refresh tokens.\n */\nexport const HUBSPOT_REFRESH_COOKIE_PREFIX = 'hs_refresh_';\n\nconst PROTECTED_COOKIE_NAMES = new Set([\n  HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,\n  HUBSPOT_APP_SID_COOKIE_NAME,\n]);\n\n/**\n * Returns `true` for cookies the SDK manages internally\n * (access token, session ID, any refresh-token cookie). The\n * `sanitizeRequest` helper uses this to strip these cookies from the\n * request before user code sees it, ensuring user route handlers\n * cannot accidentally leak them in logs or proxy them upstream.\n */\nexport function isProtectedCookieName(cookieName: string): boolean {\n  return (\n    PROTECTED_COOKIE_NAMES.has(cookieName) ||\n    cookieName.startsWith(HUBSPOT_REFRESH_COOKIE_PREFIX)\n  );\n}\n\n/**\n * Cookie carrying the PKCE code verifier between `init-session` and\n * `callback`. `Lax` SameSite so it accompanies the redirect back from\n * HubSpot.\n */\nexport const TEMP_COOKIE_PKCE_VERIFIER = '__hs_pkce_verifier';\n\n/**\n * Cookie carrying the OAuth `state` value between `init-session` and\n * `callback`. Compared against the `state` query parameter as the\n * primary CSRF defense.\n */\nexport const TEMP_COOKIE_OAUTH_STATE = '__hs_oauth_state';\n"],"mappings":";;;;;;;AAMA,MAAa,mCAAmC;;;;;AAMhD,MAAa,8BAA8B;;;;;;AAO3C,MAAa,gCAAgC;AAE7C,MAAM,yBAAyB,IAAI,IAAI,CACrC,kCACA,4BACD,CAAC;;;;;;;;AASF,SAAgB,sBAAsB,YAA6B;CACjE,OACE,uBAAuB,IAAI,WAAW,IACtC,WAAW,WAAA,cAAyC;;;;;;;AASxD,MAAa,4BAA4B;;;;;;AAOzC,MAAa,0BAA0B"}
+{"version":3,"file":"constants.js","names":[],"sources":["../../src/server/constants.ts"],"sourcesContent":["/**\n * Cookie name carrying the DPoP-bound access token. Uses the\n * `__Host-` prefix so the browser only accepts it from a `Secure`\n * response with `Path=/` — a defense-in-depth against subdomain\n * cookie injection.\n */\nexport const HUBSPOT_ACCESS_TOKEN_COOKIE_NAME = '__Host-hs_access_token';\n\n/**\n * Cookie carrying the opaque app-session ID. Hashed before being put\n * on the wire as a DPoP `sid` claim.\n */\nexport const HUBSPOT_APP_SID_COOKIE_NAME = '__Host-hs_app_sid';\n\n/**\n * Cookie pinning the browser-facing app origin (e.g.\n * `https://app.example.com`) for the lifetime of an app session.\n * Set by `auth/init-session` from the request's `Origin` header and\n * read by:\n *\n * - The CORS middleware to emit a credentialed\n *   `Access-Control-Allow-Origin` value (`*` is forbidden when\n *   `Access-Control-Allow-Credentials: true`).\n * - `auth/complete` to rebuild the OAuth `redirect_uri` it sent to\n *   HubSpot during `init-session` (the token endpoint validates that\n *   the two values match).\n *\n * `__Host-` prefixed (Path=/, Secure, no Domain), so the same\n * function host can serve both `hubspot-connect` and `api` routes\n * and read the cookie from either.\n */\nexport const HUBSPOT_APP_ORIGIN_COOKIE_NAME = '__Host-hs_app_origin';\n\n/**\n * Prefix used for refresh-token cookies. Each session gets its own\n * cookie name (`hs_refresh_<sidHash>`) so multiple devices/tabs can\n * coexist without overwriting each other's refresh tokens.\n */\nexport const HUBSPOT_REFRESH_COOKIE_PREFIX = 'hs_refresh_';\n\nconst PROTECTED_COOKIE_NAMES = new Set([\n  HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,\n  HUBSPOT_APP_SID_COOKIE_NAME,\n  HUBSPOT_APP_ORIGIN_COOKIE_NAME,\n]);\n\n/**\n * Returns `true` for cookies the SDK manages internally\n * (access token, session ID, any refresh-token cookie). The\n * `sanitizeRequest` helper uses this to strip these cookies from the\n * request before user code sees it, ensuring user route handlers\n * cannot accidentally leak them in logs or proxy them upstream.\n */\nexport function isProtectedCookieName(cookieName: string): boolean {\n  return (\n    PROTECTED_COOKIE_NAMES.has(cookieName) ||\n    cookieName.startsWith(HUBSPOT_REFRESH_COOKIE_PREFIX)\n  );\n}\n\n/**\n * Cookie carrying the PKCE code verifier between `init-session` and\n * `auth/complete`. Set with `SameSite=None; Secure; Partitioned` so the\n * frontend's credentialed cross-site `POST /auth/complete` (made from\n * the OAuth callback page on the app origin to the SDK's edge function\n * origin) carries it through. `Lax` would silently drop it on that\n * fetch, breaking every successful HubSpot redirect.\n */\nexport const TEMP_COOKIE_PKCE_VERIFIER = '__hs_pkce_verifier';\n\n/**\n * Cookie carrying the OAuth `state` value between `init-session` and\n * `auth/complete`. Compared against the `state` query parameter as the\n * primary CSRF defense. Same `SameSite=None; Secure; Partitioned`\n * attributes as `TEMP_COOKIE_PKCE_VERIFIER` for the same cross-site\n * `POST /auth/complete` reason.\n */\nexport const TEMP_COOKIE_OAUTH_STATE = '__hs_oauth_state';\n"],"mappings":";;;;;;;AAMA,MAAa,mCAAmC;;;;;AAMhD,MAAa,8BAA8B;;;;;;;;;;;;;;;;;;AAmB3C,MAAa,iCAAiC;;;;;;AAO9C,MAAa,gCAAgC;AAE7C,MAAM,yBAAyB,IAAI,IAAI;CACrC;CACA;CACA;AACF,CAAC;;;;;;;;AASD,SAAgB,sBAAsB,YAA6B;CACjE,OACE,uBAAuB,IAAI,UAAU,KACrC,WAAW,WAAA,aAAwC;AAEvD;;;;;;;;;AAUA,MAAa,4BAA4B;;;;;;;;AASzC,MAAa,0BAA0B"}

package/dist/server/deno/start.js.map

@@ -1 +1 @@
-{"version":3,"file":"start.js","names":[],"sources":["../../../src/server/deno/start.ts"],"sourcesContent":["import {\n  runSecureStart,\n  type SecureStartAdapter,\n  type SecureStartContext,\n  type SecureStartLoader,\n} from '../secure-start-core.ts';\n\nexport type { SecureStartContext, SecureStartLoader };\n\nconst denoSecureStartAdapter: SecureStartAdapter = {\n  readEnv: (key) => Deno.env.get(key),\n  deleteEnv: (key) => {\n    Deno.env.delete(key);\n  },\n  exit: (code) => Deno.exit(code),\n};\n\n/**\n * Deno entrypoint helper. Reads `HUBSPOT_APP_PRIVATE_KEY` from `Deno.env`\n * when CIMD or DPoP is enabled, imports the supplied loader, and invokes\n * `start` with `AppKeys` or `null`.\n */\nexport function secureStart(loader: SecureStartLoader): Promise<void> {\n  return runSecureStart(loader, denoSecureStartAdapter);\n}\n"],"mappings":";;AASA,MAAM,yBAA6C;CACjD,UAAU,QAAQ,KAAK,IAAI,IAAI,IAAI;CACnC,YAAY,QAAQ;EAClB,KAAK,IAAI,OAAO,IAAI;;CAEtB,OAAO,SAAS,KAAK,KAAK,KAAK;CAChC;;;;;;AAOD,SAAgB,YAAY,QAA0C;CACpE,OAAO,eAAe,QAAQ,uBAAuB"}
+{"version":3,"file":"start.js","names":[],"sources":["../../../src/server/deno/start.ts"],"sourcesContent":["import {\n  runSecureStart,\n  type SecureStartAdapter,\n  type SecureStartContext,\n  type SecureStartLoader,\n} from '../secure-start-core.ts';\n\nexport type { SecureStartContext, SecureStartLoader };\n\nconst denoSecureStartAdapter: SecureStartAdapter = {\n  readEnv: (key) => Deno.env.get(key),\n  deleteEnv: (key) => {\n    Deno.env.delete(key);\n  },\n  exit: (code) => Deno.exit(code),\n};\n\n/**\n * Deno entrypoint helper. Reads `HUBSPOT_APP_PRIVATE_KEY` from `Deno.env`\n * when CIMD or DPoP is enabled, imports the supplied loader, and invokes\n * `start` with `AppKeys` or `null`.\n */\nexport function secureStart(loader: SecureStartLoader): Promise<void> {\n  return runSecureStart(loader, denoSecureStartAdapter);\n}\n"],"mappings":";;AASA,MAAM,yBAA6C;CACjD,UAAU,QAAQ,KAAK,IAAI,IAAI,GAAG;CAClC,YAAY,QAAQ;EAClB,KAAK,IAAI,OAAO,GAAG;CACrB;CACA,OAAO,SAAS,KAAK,KAAK,IAAI;AAChC;;;;;;AAOA,SAAgB,YAAY,QAA0C;CACpE,OAAO,eAAe,QAAQ,sBAAsB;AACtD"}

package/dist/server/hono/hono-request-handler.js

@@ -1,10 +1,11 @@
 import { createHubSpotClient } from "../api-client-core/client.js";
-import { noopLogger } from "../shared/logger.js";
+import { getHubSpotApiOrigin, isHubspotDpopEnabled } from "../utils/env-utils.js";
 import { fetchTransportPlugin } from "../api-client-core/plugins/fetch-transport.js";
 import { HUBSPOT_ACCESS_TOKEN_COOKIE_NAME, HUBSPOT_APP_SID_COOKIE_NAME } from "../constants.js";
-import { createHubSpotProxy } from "../proxy.js";
 import { parseCookies } from "../utils/cookie-utils.js";
 import { sanitizeRequest } from "../sanitize-request.js";
+import { buildHubSpotDpopAuthHeaders } from "../utils/hubspot-dpop-auth-headers.js";
+import { corsMiddleware } from "./utils/cors-middleware.js";
 import { Hono } from "hono";
 //#region src/server/hono/hono-request-handler.ts
 /**
@@ -12,39 +13,47 @@ import { Hono } from "hono";
 *
 * - Strips SDK-managed cookies (access token, refresh, sid) from the
 *   request before the app sees them, via `sanitizeRequest`.
-* - Exposes a `hubSpotProxy` on the Hono context so route handlers
+* - Exposes a `hubSpot.client` on the Hono context so route handlers
 *   can issue authenticated calls to HubSpot's API on behalf of the
 *   browser session.
 */
 function createAppConnectRequestHandler(options) {
-	const { registerRoutes, appKeys, logger = noopLogger } = options;
+	const { registerRoutes, appKeys } = options;
+	if (isHubspotDpopEnabled() && appKeys === null) throw new Error("createAppConnectRequestHandler: appKeys is required when HUBSPOT_DPOP_ENABLED is true");
 	const app = new Hono();
+	app.use("*", corsMiddleware());
+	app.use("*", async (c, next) => {
+		const { authenticated } = c.env.hubSpot;
+		if (!authenticated) return c.json({ error: "Unauthorized" }, 401);
+		await next();
+	});
 	registerRoutes(app);
 	return (request) => {
 		const cookie = request.headers.get("Cookie");
-		if (!cookie) throw new Error("Missing auth cookies");
-		const cookies = parseCookies(cookie);
+		if (!cookie && request.method !== "OPTIONS") throw new Error("Missing auth cookies");
+		const cookies = parseCookies(cookie ?? "");
 		const accessToken = cookies[HUBSPOT_ACCESS_TOKEN_COOKIE_NAME];
 		const sessionId = cookies[HUBSPOT_APP_SID_COOKIE_NAME];
-		if (!accessToken || !sessionId) return new Response(null, {
-			status: 401,
-			statusText: "Unauthorized",
-			headers: { "Content-Type": "application/json" }
-		});
-		const hubSpotProxy = createHubSpotProxy({
-			userCredentials: {
-				accessToken,
-				sessionId
+		const client = createHubSpotClient({ plugins: [fetchTransportPlugin({
+			getEndpoint: () => {
+				return getHubSpotApiOrigin();
 			},
-			appKeys,
-			logger
-		});
-		const hubSpotClient = createHubSpotClient({ plugins: [fetchTransportPlugin({ getAccessToken: () => accessToken })] });
+			getAuthorizationHeaders: (ctx) => {
+				if (isHubspotDpopEnabled()) return buildHubSpotDpopAuthHeaders({
+					accessToken,
+					sessionId,
+					appKeys,
+					method: ctx.method,
+					targetUrl: ctx.targetUrl
+				});
+				return { Authorization: `Bearer ${accessToken}` };
+			}
+		})] });
 		const sanitizedRequest = sanitizeRequest(request);
-		const honoBindings = {
-			hubSpotProxy,
-			hubSpotClient
-		};
+		const honoBindings = { hubSpot: {
+			client,
+			authenticated: Boolean(accessToken && sessionId)
+		} };
 		return app.fetch(sanitizedRequest, honoBindings);
 	};
 }

package/dist/server/hono/hono-request-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"hono-request-handler.js","names":[],"sources":["../../../src/server/hono/hono-request-handler.ts"],"sourcesContent":["import { Hono } from 'hono';\n\nimport { noopLogger, type Logger } from '../../shared/logger.ts';\nimport { createHubSpotClient } from '../api-client-core/client.ts';\nimport { fetchTransportPlugin } from '../api-client-core/plugins/fetch-transport.ts';\nimport {\n  HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,\n  HUBSPOT_APP_SID_COOKIE_NAME,\n} from '../constants.ts';\nimport { createHubSpotProxy } from '../proxy.ts';\nimport { sanitizeRequest } from '../sanitize-request.ts';\nimport type { AppKeys, UserCredentials } from '../types.ts';\nimport { parseCookies } from '../utils/cookie-utils.ts';\nimport type { AppConnectHonoBindings, AppConnectHonoEnv } from './types.ts';\n\n/**\n * Web-standard fetch handler signature returned by\n * {@link createAppConnectRequestHandler}.\n */\nexport type AppConnectFetchHandler = (\n  request: Request\n) => Response | Promise<Response>;\n\n/**\n * Callback used to attach application routes to the SDK-owned Hono\n * app instance.\n */\nexport type RegisterAppConnectRoutesFunction = (\n  app: Hono<AppConnectHonoEnv>\n) => void;\n\n/**\n * Options accepted by {@link createAppConnectRequestHandler}.\n */\nexport interface CreateAppConnectRequestHandlerOptions {\n  /** Registers application routes on the SDK-owned Hono app. */\n  registerRoutes: RegisterAppConnectRoutesFunction;\n  /**\n   * Imported app keys from `secureStart`, or `null` when CIMD and DPoP\n   * are both disabled.\n   */\n  appKeys: AppKeys | null;\n  /**\n   * Optional logger. When omitted the SDK uses a no-op logger so\n   * server-side state never leaks into the host application's\n   * console.\n   */\n  logger?: Logger;\n}\n\n/**\n * Wraps a Hono app so its `fetch` handler additionally:\n *\n * - Strips SDK-managed cookies (access token, refresh, sid) from the\n *   request before the app sees them, via `sanitizeRequest`.\n * - Exposes a `hubSpotProxy` on the Hono context so route handlers\n *   can issue authenticated calls to HubSpot's API on behalf of the\n *   browser session.\n */\nexport function createAppConnectRequestHandler(\n  options: CreateAppConnectRequestHandlerOptions\n): AppConnectFetchHandler {\n  const { registerRoutes, appKeys, logger = noopLogger } = options;\n  const app = new Hono<AppConnectHonoEnv>();\n  registerRoutes(app);\n\n  return (request: Request) => {\n    const cookie = request.headers.get('Cookie');\n    if (!cookie) {\n      throw new Error('Missing auth cookies');\n    }\n    const cookies = parseCookies(cookie);\n    const accessToken = cookies[HUBSPOT_ACCESS_TOKEN_COOKIE_NAME];\n    const sessionId = cookies[HUBSPOT_APP_SID_COOKIE_NAME];\n    if (!accessToken || !sessionId) {\n      // Return 401 Unauthorized\n      return new Response(null, {\n        status: 401,\n        statusText: 'Unauthorized',\n        headers: {\n          'Content-Type': 'application/json',\n        },\n      });\n    }\n    const userCredentials: UserCredentials = { accessToken, sessionId };\n\n    const hubSpotProxy = createHubSpotProxy({\n      userCredentials,\n      appKeys,\n      logger,\n    });\n\n    const hubSpotClient = createHubSpotClient({\n      plugins: [fetchTransportPlugin({ getAccessToken: () => accessToken })],\n    });\n\n    const sanitizedRequest = sanitizeRequest(request);\n\n    const honoBindings: AppConnectHonoBindings = {\n      hubSpotProxy,\n      hubSpotClient,\n    };\n\n    return app.fetch(sanitizedRequest, honoBindings);\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AA2DA,SAAgB,+BACd,SACwB;CACxB,MAAM,EAAE,gBAAgB,SAAS,SAAS,eAAe;CACzD,MAAM,MAAM,IAAI,MAAyB;CACzC,eAAe,IAAI;CAEnB,QAAQ,YAAqB;EAC3B,MAAM,SAAS,QAAQ,QAAQ,IAAI,SAAS;EAC5C,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,uBAAuB;EAEzC,MAAM,UAAU,aAAa,OAAO;EACpC,MAAM,cAAc,QAAQ;EAC5B,MAAM,YAAY,QAAQ;EAC1B,IAAI,CAAC,eAAe,CAAC,WAEnB,OAAO,IAAI,SAAS,MAAM;GACxB,QAAQ;GACR,YAAY;GACZ,SAAS,EACP,gBAAgB,oBACjB;GACF,CAAC;EAIJ,MAAM,eAAe,mBAAmB;GACtC,iBAAA;IAHyC;IAAa;IAGvC;GACf;GACA;GACD,CAAC;EAEF,MAAM,gBAAgB,oBAAoB,EACxC,SAAS,CAAC,qBAAqB,EAAE,sBAAsB,aAAa,CAAC,CAAC,EACvE,CAAC;EAEF,MAAM,mBAAmB,gBAAgB,QAAQ;EAEjD,MAAM,eAAuC;GAC3C;GACA;GACD;EAED,OAAO,IAAI,MAAM,kBAAkB,aAAa"}
+{"version":3,"file":"hono-request-handler.js","names":[],"sources":["../../../src/server/hono/hono-request-handler.ts"],"sourcesContent":["import { Hono } from 'hono';\n\nimport { type Logger } from '../../shared/logger.ts';\nimport { createHubSpotClient } from '../api-client-core/client.ts';\nimport { fetchTransportPlugin } from '../api-client-core/plugins/fetch-transport.ts';\nimport {\n  HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,\n  HUBSPOT_APP_SID_COOKIE_NAME,\n} from '../constants.ts';\nimport { sanitizeRequest } from '../sanitize-request.ts';\nimport type { AppKeys } from '../types.ts';\nimport { parseCookies } from '../utils/cookie-utils.ts';\nimport {\n  getHubSpotApiOrigin,\n  isHubspotDpopEnabled,\n} from '../utils/env-utils.ts';\nimport { buildHubSpotDpopAuthHeaders } from '../utils/hubspot-dpop-auth-headers.ts';\nimport type { AppConnectHonoBindings, AppConnectHonoEnv } from './types.ts';\nimport { corsMiddleware } from './utils/cors-middleware.ts';\n\n/**\n * Web-standard fetch handler signature returned by\n * {@link createAppConnectRequestHandler}.\n */\nexport type AppConnectFetchHandler = (\n  request: Request\n) => Response | Promise<Response>;\n\n/**\n * Callback used to attach application routes to the SDK-owned Hono\n * app instance.\n */\nexport type RegisterAppConnectRoutesFunction = (\n  app: Hono<AppConnectHonoEnv>\n) => void;\n\n/**\n * Options accepted by {@link createAppConnectRequestHandler}.\n */\nexport interface CreateAppConnectRequestHandlerOptions {\n  /** Registers application routes on the SDK-owned Hono app. */\n  registerRoutes: RegisterAppConnectRoutesFunction;\n  /**\n   * Imported app keys from `secureStart`, or `null` when CIMD and DPoP\n   * are both disabled.\n   */\n  appKeys: AppKeys | null;\n  /**\n   * Optional logger. When omitted the SDK uses a no-op logger so\n   * server-side state never leaks into the host application's\n   * console.\n   */\n  logger?: Logger;\n}\n\n/**\n * Wraps a Hono app so its `fetch` handler additionally:\n *\n * - Strips SDK-managed cookies (access token, refresh, sid) from the\n *   request before the app sees them, via `sanitizeRequest`.\n * - Exposes a `hubSpot.client` on the Hono context so route handlers\n *   can issue authenticated calls to HubSpot's API on behalf of the\n *   browser session.\n */\nexport function createAppConnectRequestHandler(\n  options: CreateAppConnectRequestHandlerOptions\n): AppConnectFetchHandler {\n  const { registerRoutes, appKeys } = options;\n\n  if (isHubspotDpopEnabled() && appKeys === null) {\n    throw new Error(\n      'createAppConnectRequestHandler: appKeys is required when HUBSPOT_DPOP_ENABLED is true'\n    );\n  }\n\n  const app = new Hono<AppConnectHonoEnv>();\n  // Credentialed CORS first: preflights short-circuit with 204\n  // before the auth check runs, and 401 responses still carry\n  // `Access-Control-Allow-*` headers (the browser drops responses\n  // without them on credentialed cross-site fetches).\n  app.use('*', corsMiddleware());\n\n  // Auth gate: every non-OPTIONS request must arrive with the\n  // SDK-managed access-token + session-id cookies. The CORS\n  // middleware above short-circuits OPTIONS, so this only runs on\n  // real requests; missing cookies now surface as a normal 401 with\n  // CORS headers attached on the way back out (the previous\n  // implementation threw on a missing `Cookie` header before any\n  // middleware ran, which broke browser preflights).\n  app.use('*', async (c, next) => {\n    const { authenticated } = c.env.hubSpot;\n    if (!authenticated) {\n      return c.json({ error: 'Unauthorized' }, 401);\n    }\n\n    await next();\n    return;\n  });\n\n  registerRoutes(app);\n\n  return (request: Request) => {\n    const cookie = request.headers.get('Cookie');\n    if (!cookie && request.method !== 'OPTIONS') {\n      throw new Error('Missing auth cookies');\n    }\n    const cookies = parseCookies(cookie ?? '');\n    const accessToken = cookies[HUBSPOT_ACCESS_TOKEN_COOKIE_NAME];\n    const sessionId = cookies[HUBSPOT_APP_SID_COOKIE_NAME];\n\n    const client = createHubSpotClient({\n      plugins: [\n        fetchTransportPlugin({\n          getEndpoint: () => {\n            return getHubSpotApiOrigin();\n          },\n          getAuthorizationHeaders: (ctx) => {\n            if (isHubspotDpopEnabled()) {\n              return buildHubSpotDpopAuthHeaders({\n                accessToken: accessToken!,\n                sessionId: sessionId!,\n                appKeys: appKeys!,\n                method: ctx.method,\n                targetUrl: ctx.targetUrl,\n              });\n            }\n\n            return {\n              Authorization: `Bearer ${accessToken!}`,\n            };\n          },\n        }),\n      ],\n    });\n\n    const sanitizedRequest = sanitizeRequest(request);\n\n    const honoBindings: AppConnectHonoBindings = {\n      hubSpot: {\n        client,\n        authenticated: Boolean(accessToken && sessionId),\n      },\n    };\n\n    return app.fetch(sanitizedRequest, honoBindings);\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAgEA,SAAgB,+BACd,SACwB;CACxB,MAAM,EAAE,gBAAgB,YAAY;CAEpC,IAAI,qBAAqB,KAAK,YAAY,MACxC,MAAM,IAAI,MACR,uFACF;CAGF,MAAM,MAAM,IAAI,KAAwB;CAKxC,IAAI,IAAI,KAAK,eAAe,CAAC;CAS7B,IAAI,IAAI,KAAK,OAAO,GAAG,SAAS;EAC9B,MAAM,EAAE,kBAAkB,EAAE,IAAI;EAChC,IAAI,CAAC,eACH,OAAO,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;EAG9C,MAAM,KAAK;CAEb,CAAC;CAED,eAAe,GAAG;CAElB,QAAQ,YAAqB;EAC3B,MAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;EAC3C,IAAI,CAAC,UAAU,QAAQ,WAAW,WAChC,MAAM,IAAI,MAAM,sBAAsB;EAExC,MAAM,UAAU,aAAa,UAAU,EAAE;EACzC,MAAM,cAAc,QAAQ;EAC5B,MAAM,YAAY,QAAQ;EAE1B,MAAM,SAAS,oBAAoB,EACjC,SAAS,CACP,qBAAqB;GACnB,mBAAmB;IACjB,OAAO,oBAAoB;GAC7B;GACA,0BAA0B,QAAQ;IAChC,IAAI,qBAAqB,GACvB,OAAO,4BAA4B;KACpB;KACF;KACF;KACT,QAAQ,IAAI;KACZ,WAAW,IAAI;IACjB,CAAC;IAGH,OAAO,EACL,eAAe,UAAU,cAC3B;GACF;EACF,CAAC,CACH,EACF,CAAC;EAED,MAAM,mBAAmB,gBAAgB,OAAO;EAEhD,MAAM,eAAuC,EAC3C,SAAS;GACP;GACA,eAAe,QAAQ,eAAe,SAAS;EACjD,EACF;EAEA,OAAO,IAAI,MAAM,kBAAkB,YAAY;CACjD;AACF"}

package/dist/server/hono/hubspot-connect-routes/auth-complete.js

@@ -0,0 +1,158 @@
+import { base64urlDecode } from "../../shared/encoding/base64.js";
+import { HUBSPOT_ACCESS_TOKEN_COOKIE_NAME, HUBSPOT_APP_ORIGIN_COOKIE_NAME, HUBSPOT_REFRESH_COOKIE_PREFIX, TEMP_COOKIE_OAUTH_STATE, TEMP_COOKIE_PKCE_VERIFIER } from "../../constants.js";
+import { parseCookies } from "../../utils/cookie-utils.js";
+import { AUTH_COMPLETE_CODE_PARAM, AUTH_COMPLETE_STATE_PARAM } from "../../shared/constants.js";
+import { serializeCookie, setResponseCookie } from "../utils/cookie-utils.js";
+import { REFRESH_COOKIE_MAX_AGE_SEC } from "./constants.js";
+import { buildClientAssertion, buildClientAssertionFormParams, buildClientSecretFormParams, buildTokenEndpointDpopProof, requestOAuthToken } from "./oauth-client.js";
+import { buildCimdClientIdUrlFromRequest, buildFrontendOAuthRedirectUri, clearTempCookie, isPositiveFiniteNumber, isSafeReturnPath, parseAppOriginHeader } from "./utils.js";
+import { fetchWhoami } from "./whoami.js";
+//#region src/server/hono/hubspot-connect-routes/auth-complete.ts
+/**
+* Cross-origin OAuth completion endpoint.
+*
+* Called from the React app on the frontend OAuth callback path
+* (`HUBSPOT_FRONTEND_CALLBACK_PATH`) once HubSpot has redirected the
+* browser back with `?code` + `?state`. The browser POSTs both
+* values here as a credentialed cross-site fetch — same partition as
+* `init-session`, so the temp PKCE/state cookies are visible — and
+* the SDK:
+*
+* 1. Validates `state` against the temp `__hs_oauth_state` cookie.
+* 2. Pulls the PKCE verifier from `__hs_pkce_verifier`.
+* 3. Rebuilds the same `redirect_uri` it sent to HubSpot during
+*    `init-session` (frontend origin + the fixed callback path);
+*    the OAuth token endpoint requires the two values to match.
+* 4. Exchanges `code` for an access + refresh token (with DPoP /
+*    CIMD client-assertion when enabled).
+* 5. Sets the durable session cookies (access token, refresh) with
+*    `SameSite=None; Secure; Partitioned` so they live in the
+*    `(frontend, edge)` partition where subsequent API fetches will
+*    read them.
+* 6. Clears the temp cookies.
+* 7. Returns `{ expires_at, return_path }` so the controller can
+*    update its session-storage expiry tracking and navigate back to
+*    the page the user started the connect flow from.
+*/
+async function handleAuthComplete(c, options) {
+	const { appKeys, refreshCookiePath, hubspotConnectEnv } = options;
+	const xForwardedProto = c.req.header("x-forwarded-proto") ?? void 0;
+	const xForwardedHost = c.req.header("x-forwarded-host") ?? void 0;
+	const requestHostHeader = c.req.header("host") ?? void 0;
+	const code = c.req.query(AUTH_COMPLETE_CODE_PARAM);
+	const state = c.req.query(AUTH_COMPLETE_STATE_PARAM);
+	if (!code || !state) return c.json({ error: "Missing code or state" }, 400);
+	if (hubspotConnectEnv.isAppPrivateKeyRequired && !appKeys) return c.json({ error: "Server misconfiguration: HUBSPOT_APP_PRIVATE_KEY is required when CIMD or DPoP is enabled" }, 500);
+	const cookies = parseCookies(c.req.header("Cookie"));
+	const expectedState = cookies[TEMP_COOKIE_OAUTH_STATE];
+	const codeVerifier = cookies[TEMP_COOKIE_PKCE_VERIFIER];
+	const appOriginCookie = cookies[HUBSPOT_APP_ORIGIN_COOKIE_NAME];
+	if (!expectedState || state !== decodeURIComponent(expectedState)) return c.json({ error: "State mismatch" }, 403);
+	if (!codeVerifier) return c.json({ error: "Missing PKCE verifier" }, 400);
+	const appOrigin = parseAppOriginHeader(appOriginCookie);
+	if (!appOrigin) return c.json({ error: "Missing app origin cookie" }, 400);
+	let statePayload;
+	try {
+		statePayload = JSON.parse(new TextDecoder().decode(base64urlDecode(decodeURIComponent(state))));
+	} catch {
+		return c.json({ error: "Malformed state value" }, 400);
+	}
+	const returnPath = statePayload.return_path;
+	if (!returnPath || !isSafeReturnPath(returnPath)) return c.json({ error: "Invalid return path in state" }, 400);
+	const sessionId = statePayload.sid;
+	if (!sessionId) return c.json({ error: "Missing app session cookie" }, 400);
+	const decodedCodeVerifier = decodeURIComponent(codeVerifier);
+	const clientId = hubspotConnectEnv.isCimdEnabled ? buildCimdClientIdUrlFromRequest({
+		requestUrl: c.req.url,
+		basePath: options.basePath,
+		xForwardedProto,
+		xForwardedHost,
+		requestHostHeader,
+		appOrigin
+	}) : hubspotConnectEnv.hubspotClientId;
+	const redirectUri = buildFrontendOAuthRedirectUri(appOrigin);
+	const tokenEndpointUrl = new URL("/oauth/v1/token", hubspotConnectEnv.hubspotOAuthApiOrigin).href;
+	let dpopProof;
+	if (hubspotConnectEnv.isDpopEnabled) dpopProof = await buildTokenEndpointDpopProof({
+		appKeys,
+		tokenEndpointUrl,
+		sessionIdHash: sessionId
+	});
+	let formParams;
+	if (hubspotConnectEnv.isCimdEnabled) formParams = {
+		grant_type: "authorization_code",
+		code,
+		code_verifier: decodedCodeVerifier,
+		redirect_uri: redirectUri,
+		...buildClientAssertionFormParams({
+			clientId,
+			clientAssertion: await buildClientAssertion({
+				appKeys,
+				clientId,
+				audience: tokenEndpointUrl
+			})
+		})
+	};
+	else formParams = {
+		grant_type: "authorization_code",
+		code,
+		code_verifier: decodedCodeVerifier,
+		redirect_uri: redirectUri,
+		...buildClientSecretFormParams({
+			clientId,
+			clientSecret: hubspotConnectEnv.hubspotClientSecret
+		})
+	};
+	const tokenResult = await requestOAuthToken({
+		tokenEndpointUrl,
+		isDpopEnabled: hubspotConnectEnv.isDpopEnabled,
+		...dpopProof !== void 0 ? { dpopProof } : {},
+		formParams
+	});
+	if (!tokenResult.ok) return c.json({ error: `Token exchange failed: ${tokenResult.errorText}` }, 502);
+	const { access_token: accessToken, refresh_token: refreshToken, expires_in } = tokenResult.body;
+	if (!refreshToken) return c.json({ error: "Token response missing refresh_token" }, 502);
+	if (!isPositiveFiniteNumber(expires_in)) return c.json({ error: "Token response missing or invalid expires_in" }, 502);
+	const expiresAt = Date.now() + expires_in * 1e3;
+	const refreshCookieName = `${HUBSPOT_REFRESH_COOKIE_PREFIX}${sessionId}`;
+	setResponseCookie({
+		c,
+		value: serializeCookie({
+			name: HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,
+			value: accessToken,
+			path: "/",
+			sameSite: "None",
+			partitioned: true,
+			maxAge: expires_in
+		})
+	});
+	setResponseCookie({
+		c,
+		value: serializeCookie({
+			name: refreshCookieName,
+			value: refreshToken,
+			path: refreshCookiePath,
+			sameSite: "None",
+			partitioned: true,
+			maxAge: REFRESH_COOKIE_MAX_AGE_SEC
+		})
+	});
+	setResponseCookie({
+		c,
+		value: clearTempCookie(TEMP_COOKIE_PKCE_VERIFIER)
+	});
+	setResponseCookie({
+		c,
+		value: clearTempCookie(TEMP_COOKIE_OAUTH_STATE)
+	});
+	const whoami = await fetchWhoami(accessToken, hubspotConnectEnv);
+	return c.json({
+		expires_at: expiresAt,
+		return_path: returnPath,
+		whoami
+	});
+}
+//#endregion
+export { handleAuthComplete };
+
+//# sourceMappingURL=auth-complete.js.map