@hubspot/app-connect-sdk 1.0.0-alpha.2 → 1.0.0-alpha.21

package/dist/server/hono/hubspot-connect-routes/utils.js

@@ -1,3 +1,4 @@
+import { OAUTH_CALLBACK_PATH } from "../../shared/constants.js";
 import { serializeCookie } from "../utils/cookie-utils.js";
 //#region src/server/hono/hubspot-connect-routes/utils.ts
 function clearTempCookie(name) {
@@ -5,10 +6,56 @@ function clearTempCookie(name) {
 		name,
 		value: "",
 		path: "/",
-		sameSite: "Lax",
-		maxAge: 0
+		sameSite: "None",
+		maxAge: 0,
+		partitioned: true
 	});
 }
+/**
+* Parses the request `Origin` header into the canonical origin
+* string (`URL.origin`) or returns `null` when the header is
+* missing, malformed, or carries a scheme/host the SDK does not
+* accept.
+*
+* Accepted shapes:
+*
+* - `https://<host>` for production deployments.
+* - `http://localhost[:<port>]` and `http://127.0.0.1[:<port>]`
+*   for local development; browsers exempt these from the `Secure`
+*   cookie restriction.
+*
+* Rejects values with a path/query/hash component (the request
+* `Origin` header is by spec a bare origin, so anything else
+* indicates a malformed or hostile request).
+*/
+function parseAppOriginHeader(originHeader) {
+	if (!originHeader) return null;
+	let parsed;
+	try {
+		parsed = new URL(originHeader);
+	} catch {
+		return null;
+	}
+	if (parsed.pathname !== "/" && parsed.pathname !== "") return null;
+	if (parsed.search !== "" || parsed.hash !== "") return null;
+	if (parsed.protocol === "https:") return parsed.origin;
+	if (parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1")) return parsed.origin;
+	return null;
+}
+/**
+* OAuth `redirect_uri` for the cross-origin app shape: the OAuth
+* callback lands on the **frontend** origin (not the SDK's edge
+* function host), so all cookies set by `init-session` and read by
+* `auth/complete` live in the same `(frontend, edge)` CHIPS
+* partition.
+*
+* Used by `auth/init-session` (when building `authorization_url`)
+* and `auth/complete` (which must rebuild the same value to satisfy
+* the OAuth token endpoint's `redirect_uri` check).
+*/
+function buildFrontendOAuthRedirectUri(appOrigin) {
+	return `${appOrigin}${OAUTH_CALLBACK_PATH}`;
+}
 function isSafeReturnPath(rawPath) {
 	if (!rawPath.startsWith("/")) return false;
 	if (rawPath.includes("\0")) return false;
@@ -47,15 +94,15 @@ function buildHubSpotConnectRequestOrigin(options) {
 * origin.
 */
 function buildOAuthRedirectUriFromRequest(options) {
-	const trimmed = normalizeHubSpotConnectBasePath(options.basePath);
-	return `${buildHubSpotConnectRequestOrigin(options)}${trimmed}/auth/callback`;
+	const { appOrigin } = options;
+	return `${appOrigin}${OAUTH_CALLBACK_PATH}`;
 }
 /**
 * CIMD `client_id` URL: `{origin}{basePath}/client.json`.
 */
 function buildCimdClientIdUrlFromRequest(options) {
 	const trimmed = normalizeHubSpotConnectBasePath(options.basePath);
-	return `${buildHubSpotConnectRequestOrigin(options)}${trimmed}/client.json`;
+	return `${buildHubSpotConnectRequestOrigin(options)}${trimmed}/client.json?app_origin=${encodeURIComponent(options.appOrigin)}`;
 }
 /**
 * App JWKS URL published in CIMD: `{origin}{basePath}/jwks.json`.
@@ -68,6 +115,6 @@ function isPositiveFiniteNumber(value) {
 	return typeof value === "number" && Number.isFinite(value) && value > 0;
 }
 //#endregion
-export { buildCimdClientIdUrlFromRequest, buildHubSpotAppJwksUrlFromRequest, buildOAuthRedirectUriFromRequest, clearTempCookie, isPositiveFiniteNumber, isSafeReturnPath };
+export { buildCimdClientIdUrlFromRequest, buildFrontendOAuthRedirectUri, buildHubSpotAppJwksUrlFromRequest, buildOAuthRedirectUriFromRequest, clearTempCookie, isPositiveFiniteNumber, isSafeReturnPath, parseAppOriginHeader };
 
 //# sourceMappingURL=utils.js.map

package/dist/server/hono/hubspot-connect-routes/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","names":[],"sources":["../../../../src/server/hono/hubspot-connect-routes/utils.ts"],"sourcesContent":["import { serializeCookie } from '../utils/cookie-utils.ts';\n\nexport function clearTempCookie(name: string): string {\n  return serializeCookie({\n    name,\n    value: '',\n    path: '/',\n    sameSite: 'Lax',\n    maxAge: 0,\n  });\n}\n\nexport function isSafeReturnPath(rawPath: string): boolean {\n  if (!rawPath.startsWith('/')) return false;\n  if (rawPath.includes('\\0')) return false;\n  let decoded: string;\n  try {\n    decoded = decodeURIComponent(rawPath);\n  } catch {\n    return false;\n  }\n  if (!decoded.startsWith('/')) return false;\n  const second = decoded.charAt(1);\n  if (second === '/' || second === '\\\\') return false;\n  return true;\n}\n\nexport function getRequestHost(requestUrl: string): string {\n  return new URL(requestUrl).host;\n}\n\nexport interface GetRequestHostForHubspotConnectOptions {\n  requestUrl: string;\n  xForwardedHost?: string | undefined;\n  /** `Host` when `X-Forwarded-Host` is absent (some proxies only set `X-Forwarded-Proto`). */\n  requestHostHeader?: string | undefined;\n}\n\n/**\n * Host for CIMD `client_id` URLs when hubspot-connect sits behind a reverse\n * proxy (e.g. Vite → Deno): prefers `X-Forwarded-Host`, then `Host`, then the\n * request URL host.\n */\nexport function getRequestHostForHubspotConnect(\n  options: GetRequestHostForHubspotConnectOptions\n): string {\n  const rawForwarded = options.xForwardedHost?.split(',')[0]?.trim();\n  if (rawForwarded) {\n    try {\n      return new URL(`https://${rawForwarded}`).host;\n    } catch {\n      /* invalid forwarded host */\n    }\n  }\n  const rawHost = options.requestHostHeader?.split(',')[0]?.trim();\n  if (rawHost) {\n    try {\n      return new URL(`https://${rawHost}`).host;\n    } catch {\n      /* invalid host header */\n    }\n  }\n  return getRequestHost(options.requestUrl);\n}\n\nexport interface BuildOAuthRedirectUriFromRequestOptions {\n  requestUrl: string;\n  basePath: string;\n  xForwardedProto?: string | undefined;\n  xForwardedHost?: string | undefined;\n  /** `Host` when `X-Forwarded-Host` is absent but `X-Forwarded-Proto` is set. */\n  requestHostHeader?: string | undefined;\n}\n\nfunction normalizeHubSpotConnectBasePath(basePath: string): string {\n  return basePath.endsWith('/') && basePath.length > 1\n    ? basePath.slice(0, -1)\n    : basePath;\n}\n\n/**\n * Public origin for hubspot-connect URLs (`redirect_uri`, CIMD `client_id`,\n * `jwks_uri`). Matches the host/proto rules used for the OAuth callback.\n */\nexport function buildHubSpotConnectRequestOrigin(\n  options: BuildOAuthRedirectUriFromRequestOptions\n): string {\n  const { requestUrl, xForwardedProto, xForwardedHost, requestHostHeader } =\n    options;\n  const proto = xForwardedProto?.split(',')[0]?.trim();\n  if (proto && (proto === 'http' || proto === 'https')) {\n    const forwardedHost = xForwardedHost?.split(',')[0]?.trim();\n    const hostHeader = requestHostHeader?.split(',')[0]?.trim();\n    const hostPart = forwardedHost || hostHeader || new URL(requestUrl).host;\n    return `${proto}://${hostPart}`;\n  }\n  return new URL(requestUrl).origin;\n}\n\n/**\n * OAuth `redirect_uri` for the hubspot-connect callback. Uses\n * `X-Forwarded-Proto` with `X-Forwarded-Host`, then `Host`, then the request URL\n * host when the proto is forwarded (reverse proxy); otherwise the request URL\n * origin.\n */\nexport function buildOAuthRedirectUriFromRequest(\n  options: BuildOAuthRedirectUriFromRequestOptions\n): string {\n  const trimmed = normalizeHubSpotConnectBasePath(options.basePath);\n  const origin = buildHubSpotConnectRequestOrigin(options);\n  return `${origin}${trimmed}/auth/callback`;\n}\n\n/**\n * CIMD `client_id` URL: `{origin}{basePath}/client.json`.\n */\nexport function buildCimdClientIdUrlFromRequest(\n  options: BuildOAuthRedirectUriFromRequestOptions\n): string {\n  const trimmed = normalizeHubSpotConnectBasePath(options.basePath);\n  const origin = buildHubSpotConnectRequestOrigin(options);\n  return `${origin}${trimmed}/client.json`;\n}\n\n/**\n * App JWKS URL published in CIMD: `{origin}{basePath}/jwks.json`.\n */\nexport function buildHubSpotAppJwksUrlFromRequest(\n  options: BuildOAuthRedirectUriFromRequestOptions\n): string {\n  const trimmed = normalizeHubSpotConnectBasePath(options.basePath);\n  const origin = buildHubSpotConnectRequestOrigin(options);\n  return `${origin}${trimmed}/jwks.json`;\n}\n\nexport function isPositiveFiniteNumber(value: unknown): value is number {\n  return typeof value === 'number' && Number.isFinite(value) && value > 0;\n}\n"],"mappings":";;AAEA,SAAgB,gBAAgB,MAAsB;CACpD,OAAO,gBAAgB;EACrB;EACA,OAAO;EACP,MAAM;EACN,UAAU;EACV,QAAQ;EACT,CAAC;;AAGJ,SAAgB,iBAAiB,SAA0B;CACzD,IAAI,CAAC,QAAQ,WAAW,IAAI,EAAE,OAAO;CACrC,IAAI,QAAQ,SAAS,KAAK,EAAE,OAAO;CACnC,IAAI;CACJ,IAAI;EACF,UAAU,mBAAmB,QAAQ;SAC/B;EACN,OAAO;;CAET,IAAI,CAAC,QAAQ,WAAW,IAAI,EAAE,OAAO;CACrC,MAAM,SAAS,QAAQ,OAAO,EAAE;CAChC,IAAI,WAAW,OAAO,WAAW,MAAM,OAAO;CAC9C,OAAO;;AAkDT,SAAS,gCAAgC,UAA0B;CACjE,OAAO,SAAS,SAAS,IAAI,IAAI,SAAS,SAAS,IAC/C,SAAS,MAAM,GAAG,GAAG,GACrB;;;;;;AAON,SAAgB,iCACd,SACQ;CACR,MAAM,EAAE,YAAY,iBAAiB,gBAAgB,sBACnD;CACF,MAAM,QAAQ,iBAAiB,MAAM,IAAI,CAAC,IAAI,MAAM;CACpD,IAAI,UAAU,UAAU,UAAU,UAAU,UAAU;EACpD,MAAM,gBAAgB,gBAAgB,MAAM,IAAI,CAAC,IAAI,MAAM;EAC3D,MAAM,aAAa,mBAAmB,MAAM,IAAI,CAAC,IAAI,MAAM;EAE3D,OAAO,GAAG,MAAM,KADC,iBAAiB,cAAc,IAAI,IAAI,WAAW,CAAC;;CAGtE,OAAO,IAAI,IAAI,WAAW,CAAC;;;;;;;;AAS7B,SAAgB,iCACd,SACQ;CACR,MAAM,UAAU,gCAAgC,QAAQ,SAAS;CAEjE,OAAO,GADQ,iCAAiC,QAChC,GAAG,QAAQ;;;;;AAM7B,SAAgB,gCACd,SACQ;CACR,MAAM,UAAU,gCAAgC,QAAQ,SAAS;CAEjE,OAAO,GADQ,iCAAiC,QAChC,GAAG,QAAQ;;;;;AAM7B,SAAgB,kCACd,SACQ;CACR,MAAM,UAAU,gCAAgC,QAAQ,SAAS;CAEjE,OAAO,GADQ,iCAAiC,QAChC,GAAG,QAAQ;;AAG7B,SAAgB,uBAAuB,OAAiC;CACtE,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,MAAM,IAAI,QAAQ"}
+{"version":3,"file":"utils.js","names":[],"sources":["../../../../src/server/hono/hubspot-connect-routes/utils.ts"],"sourcesContent":["import { OAUTH_CALLBACK_PATH } from '../../../shared/constants.ts';\nimport { serializeCookie } from '../utils/cookie-utils.ts';\n\nexport function clearTempCookie(name: string): string {\n  return serializeCookie({\n    name,\n    value: '',\n    path: '/',\n    sameSite: 'None',\n    maxAge: 0,\n    partitioned: true,\n  });\n}\n\n/**\n * Parses the request `Origin` header into the canonical origin\n * string (`URL.origin`) or returns `null` when the header is\n * missing, malformed, or carries a scheme/host the SDK does not\n * accept.\n *\n * Accepted shapes:\n *\n * - `https://<host>` for production deployments.\n * - `http://localhost[:<port>]` and `http://127.0.0.1[:<port>]`\n *   for local development; browsers exempt these from the `Secure`\n *   cookie restriction.\n *\n * Rejects values with a path/query/hash component (the request\n * `Origin` header is by spec a bare origin, so anything else\n * indicates a malformed or hostile request).\n */\nexport function parseAppOriginHeader(\n  originHeader: string | undefined\n): string | null {\n  if (!originHeader) return null;\n  let parsed: URL;\n  try {\n    parsed = new URL(originHeader);\n  } catch {\n    return null;\n  }\n  if (parsed.pathname !== '/' && parsed.pathname !== '') return null;\n  if (parsed.search !== '' || parsed.hash !== '') return null;\n  if (parsed.protocol === 'https:') return parsed.origin;\n  if (\n    parsed.protocol === 'http:' &&\n    (parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1')\n  ) {\n    return parsed.origin;\n  }\n  return null;\n}\n\n/**\n * OAuth `redirect_uri` for the cross-origin app shape: the OAuth\n * callback lands on the **frontend** origin (not the SDK's edge\n * function host), so all cookies set by `init-session` and read by\n * `auth/complete` live in the same `(frontend, edge)` CHIPS\n * partition.\n *\n * Used by `auth/init-session` (when building `authorization_url`)\n * and `auth/complete` (which must rebuild the same value to satisfy\n * the OAuth token endpoint's `redirect_uri` check).\n */\nexport function buildFrontendOAuthRedirectUri(appOrigin: string): string {\n  return `${appOrigin}${OAUTH_CALLBACK_PATH}`;\n}\n\nexport function isSafeReturnPath(rawPath: string): boolean {\n  if (!rawPath.startsWith('/')) return false;\n  if (rawPath.includes('\\0')) return false;\n  let decoded: string;\n  try {\n    decoded = decodeURIComponent(rawPath);\n  } catch {\n    return false;\n  }\n  if (!decoded.startsWith('/')) return false;\n  const second = decoded.charAt(1);\n  if (second === '/' || second === '\\\\') return false;\n  return true;\n}\n\nexport function getRequestHost(requestUrl: string): string {\n  return new URL(requestUrl).host;\n}\n\nexport interface GetRequestHostForHubspotConnectOptions {\n  requestUrl: string;\n  xForwardedHost?: string | undefined;\n  /** `Host` when `X-Forwarded-Host` is absent (some proxies only set `X-Forwarded-Proto`). */\n  requestHostHeader?: string | undefined;\n}\n\n/**\n * Host for CIMD `client_id` URLs when hubspot-connect sits behind a reverse\n * proxy (e.g. Vite → Deno): prefers `X-Forwarded-Host`, then `Host`, then the\n * request URL host.\n */\nexport function getRequestHostForHubspotConnect(\n  options: GetRequestHostForHubspotConnectOptions\n): string {\n  const rawForwarded = options.xForwardedHost?.split(',')[0]?.trim();\n  if (rawForwarded) {\n    try {\n      return new URL(`https://${rawForwarded}`).host;\n    } catch {\n      /* invalid forwarded host */\n    }\n  }\n  const rawHost = options.requestHostHeader?.split(',')[0]?.trim();\n  if (rawHost) {\n    try {\n      return new URL(`https://${rawHost}`).host;\n    } catch {\n      /* invalid host header */\n    }\n  }\n  return getRequestHost(options.requestUrl);\n}\n\nexport interface BuildOAuthRedirectUriFromRequestOptions {\n  requestUrl: string;\n  basePath: string;\n  xForwardedProto?: string | undefined;\n  xForwardedHost?: string | undefined;\n  /** `Host` when `X-Forwarded-Host` is absent but `X-Forwarded-Proto` is set. */\n  requestHostHeader?: string | undefined;\n  appOrigin: string;\n}\n\nfunction normalizeHubSpotConnectBasePath(basePath: string): string {\n  return basePath.endsWith('/') && basePath.length > 1\n    ? basePath.slice(0, -1)\n    : basePath;\n}\n\n/**\n * Public origin for hubspot-connect URLs (`redirect_uri`, CIMD `client_id`,\n * `jwks_uri`). Matches the host/proto rules used for the OAuth callback.\n */\nexport function buildHubSpotConnectRequestOrigin(\n  options: BuildOAuthRedirectUriFromRequestOptions\n): string {\n  const { requestUrl, xForwardedProto, xForwardedHost, requestHostHeader } =\n    options;\n  const proto = xForwardedProto?.split(',')[0]?.trim();\n  if (proto && (proto === 'http' || proto === 'https')) {\n    const forwardedHost = xForwardedHost?.split(',')[0]?.trim();\n    const hostHeader = requestHostHeader?.split(',')[0]?.trim();\n    const hostPart = forwardedHost || hostHeader || new URL(requestUrl).host;\n    return `${proto}://${hostPart}`;\n  }\n  return new URL(requestUrl).origin;\n}\n\n/**\n * OAuth `redirect_uri` for the hubspot-connect callback. Uses\n * `X-Forwarded-Proto` with `X-Forwarded-Host`, then `Host`, then the request URL\n * host when the proto is forwarded (reverse proxy); otherwise the request URL\n * origin.\n */\nexport function buildOAuthRedirectUriFromRequest(\n  options: BuildOAuthRedirectUriFromRequestOptions\n): string {\n  const { appOrigin } = options;\n  return `${appOrigin}${OAUTH_CALLBACK_PATH}`;\n}\n\n/**\n * CIMD `client_id` URL: `{origin}{basePath}/client.json`.\n */\nexport function buildCimdClientIdUrlFromRequest(\n  options: BuildOAuthRedirectUriFromRequestOptions\n): string {\n  const trimmed = normalizeHubSpotConnectBasePath(options.basePath);\n  const origin = buildHubSpotConnectRequestOrigin(options);\n  return `${origin}${trimmed}/client.json?app_origin=${encodeURIComponent(options.appOrigin)}`;\n}\n\n/**\n * App JWKS URL published in CIMD: `{origin}{basePath}/jwks.json`.\n */\nexport function buildHubSpotAppJwksUrlFromRequest(\n  options: BuildOAuthRedirectUriFromRequestOptions\n): string {\n  const trimmed = normalizeHubSpotConnectBasePath(options.basePath);\n  const origin = buildHubSpotConnectRequestOrigin(options);\n  return `${origin}${trimmed}/jwks.json`;\n}\n\nexport function isPositiveFiniteNumber(value: unknown): value is number {\n  return typeof value === 'number' && Number.isFinite(value) && value > 0;\n}\n"],"mappings":";;;AAGA,SAAgB,gBAAgB,MAAsB;CACpD,OAAO,gBAAgB;EACrB;EACA,OAAO;EACP,MAAM;EACN,UAAU;EACV,QAAQ;EACR,aAAa;CACf,CAAC;AACH;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,qBACd,cACe;CACf,IAAI,CAAC,cAAc,OAAO;CAC1B,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,YAAY;CAC/B,QAAQ;EACN,OAAO;CACT;CACA,IAAI,OAAO,aAAa,OAAO,OAAO,aAAa,IAAI,OAAO;CAC9D,IAAI,OAAO,WAAW,MAAM,OAAO,SAAS,IAAI,OAAO;CACvD,IAAI,OAAO,aAAa,UAAU,OAAO,OAAO;CAChD,IACE,OAAO,aAAa,YACnB,OAAO,aAAa,eAAe,OAAO,aAAa,cAExD,OAAO,OAAO;CAEhB,OAAO;AACT;;;;;;;;;;;;AAaA,SAAgB,8BAA8B,WAA2B;CACvE,OAAO,GAAG,YAAY;AACxB;AAEA,SAAgB,iBAAiB,SAA0B;CACzD,IAAI,CAAC,QAAQ,WAAW,GAAG,GAAG,OAAO;CACrC,IAAI,QAAQ,SAAS,IAAI,GAAG,OAAO;CACnC,IAAI;CACJ,IAAI;EACF,UAAU,mBAAmB,OAAO;CACtC,QAAQ;EACN,OAAO;CACT;CACA,IAAI,CAAC,QAAQ,WAAW,GAAG,GAAG,OAAO;CACrC,MAAM,SAAS,QAAQ,OAAO,CAAC;CAC/B,IAAI,WAAW,OAAO,WAAW,MAAM,OAAO;CAC9C,OAAO;AACT;AAkDA,SAAS,gCAAgC,UAA0B;CACjE,OAAO,SAAS,SAAS,GAAG,KAAK,SAAS,SAAS,IAC/C,SAAS,MAAM,GAAG,EAAE,IACpB;AACN;;;;;AAMA,SAAgB,iCACd,SACQ;CACR,MAAM,EAAE,YAAY,iBAAiB,gBAAgB,sBACnD;CACF,MAAM,QAAQ,iBAAiB,MAAM,GAAG,EAAE,IAAI,KAAK;CACnD,IAAI,UAAU,UAAU,UAAU,UAAU,UAAU;EACpD,MAAM,gBAAgB,gBAAgB,MAAM,GAAG,EAAE,IAAI,KAAK;EAC1D,MAAM,aAAa,mBAAmB,MAAM,GAAG,EAAE,IAAI,KAAK;EAE1D,OAAO,GAAG,MAAM,KADC,iBAAiB,cAAc,IAAI,IAAI,UAAU,EAAE;CAEtE;CACA,OAAO,IAAI,IAAI,UAAU,EAAE;AAC7B;;;;;;;AAQA,SAAgB,iCACd,SACQ;CACR,MAAM,EAAE,cAAc;CACtB,OAAO,GAAG,YAAY;AACxB;;;;AAKA,SAAgB,gCACd,SACQ;CACR,MAAM,UAAU,gCAAgC,QAAQ,QAAQ;CAEhE,OAAO,GADQ,iCAAiC,OACjC,IAAI,QAAQ,0BAA0B,mBAAmB,QAAQ,SAAS;AAC3F;;;;AAKA,SAAgB,kCACd,SACQ;CACR,MAAM,UAAU,gCAAgC,QAAQ,QAAQ;CAEhE,OAAO,GADQ,iCAAiC,OACjC,IAAI,QAAQ;AAC7B;AAEA,SAAgB,uBAAuB,OAAiC;CACtE,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,KAAK,QAAQ;AACxE"}

package/dist/server/hono/hubspot-connect-routes/whoami.js

@@ -0,0 +1,51 @@
+import { createHubSpotClient } from "../../api-client-core/client.js";
+import { account } from "../../api-client-core/apis/account/account-info.generated.js";
+import { authOauth } from "../../api-client-core/apis/auth/oauth.generated.js";
+import { settingsUsers } from "../../api-client-core/apis/settings/user-provisioning.generated.js";
+import { getHubSpotApiOrigin } from "../../utils/env-utils.js";
+import { fetchTransportPlugin } from "../../api-client-core/plugins/fetch-transport.js";
+//#region src/server/hono/hubspot-connect-routes/whoami.ts
+async function fetchWhoami(accessToken, hubspotConnectEnv) {
+	const apiClient = createHubSpotClient({ plugins: [fetchTransportPlugin({
+		getEndpoint: getHubSpotApiOrigin,
+		getAccessToken: () => accessToken
+	})] });
+	const introspectInput = hubspotConnectEnv.isCimdEnabled ? { token: accessToken } : {
+		client_id: hubspotConnectEnv.hubspotClientId,
+		client_secret: hubspotConnectEnv.hubspotClientSecret,
+		token: accessToken
+	};
+	const [introspectResult, hubResult] = await Promise.allSettled([apiClient.send(authOauth.introspectToken(introspectInput)), apiClient.send(account.get())]);
+	const whoami = {
+		hub: {},
+		user: {}
+	};
+	if (hubResult.status === "fulfilled") {
+		const portal = hubResult.value;
+		whoami.hub.id = portal.portalId;
+		whoami.hub.uiDomain = portal.uiDomain;
+	}
+	if (introspectResult.status === "fulfilled" && introspectResult.value.token_use === "access_token") {
+		whoami.hub.domain = introspectResult.value.hub_domain;
+		const userId = String(introspectResult.value.user_id);
+		const userResult = await apiClient.send(settingsUsers.get({
+			userId,
+			idProperty: "USER_ID"
+		})).then((u) => ({
+			ok: true,
+			value: u
+		}), () => ({ ok: false }));
+		if (userResult.ok) {
+			const u = userResult.value;
+			whoami.user.id = u.id;
+			whoami.user.email = u.email;
+			whoami.user.firstName = u.firstName;
+			whoami.user.lastName = u.lastName;
+		}
+	}
+	return whoami;
+}
+//#endregion
+export { fetchWhoami };
+
+//# sourceMappingURL=whoami.js.map

package/dist/server/hono/hubspot-connect-routes/whoami.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"whoami.js","names":[],"sources":["../../../../src/server/hono/hubspot-connect-routes/whoami.ts"],"sourcesContent":["import type { AuthCompleteWhoami } from '../../../shared/wire-types.ts';\nimport {\n  account,\n  authOauth,\n  createHubSpotClient,\n  settingsUsers,\n} from '../../api-client-core/index.ts';\nimport { fetchTransportPlugin } from '../../api-client-core/plugins/fetch-transport.ts';\nimport { getHubSpotApiOrigin } from '../../utils/env-utils.ts';\nimport type { HubSpotConnectRoutesEnv } from './load-hubspot-connect-routes-env.ts';\n\nexport async function fetchWhoami(\n  accessToken: string,\n  hubspotConnectEnv: HubSpotConnectRoutesEnv\n): Promise<AuthCompleteWhoami> {\n  const apiClient = createHubSpotClient({\n    plugins: [\n      fetchTransportPlugin({\n        getEndpoint: getHubSpotApiOrigin,\n        getAccessToken: () => accessToken,\n      }),\n    ],\n  });\n\n  const introspectInput = hubspotConnectEnv.isCimdEnabled\n    ? { token: accessToken }\n    : {\n        client_id: hubspotConnectEnv.hubspotClientId,\n        client_secret: hubspotConnectEnv.hubspotClientSecret,\n        token: accessToken,\n      };\n\n  // Introspect and account.get are independent — run in parallel.\n  // settingsUsers.get requires user_id from introspect, so it runs after.\n  const [introspectResult, hubResult] = await Promise.allSettled([\n    apiClient.send(authOauth.introspectToken(introspectInput)),\n    apiClient.send(account.get()),\n  ]);\n\n  const whoami: AuthCompleteWhoami = {\n    hub: {},\n    user: {},\n  };\n\n  if (hubResult.status === 'fulfilled') {\n    const portal = hubResult.value;\n    whoami.hub.id = portal.portalId;\n    whoami.hub.uiDomain = portal.uiDomain;\n  }\n\n  if (\n    introspectResult.status === 'fulfilled' &&\n    introspectResult.value.token_use === 'access_token'\n  ) {\n    whoami.hub.domain = introspectResult.value.hub_domain;\n\n    const userId = String(introspectResult.value.user_id);\n    const userResult = await apiClient\n      .send(settingsUsers.get({ userId, idProperty: 'USER_ID' }))\n      .then(\n        (u) => ({ ok: true as const, value: u }),\n        () => ({ ok: false as const })\n      );\n    if (userResult.ok) {\n      const u = userResult.value;\n      whoami.user.id = u.id;\n      whoami.user.email = u.email;\n      whoami.user.firstName = u.firstName;\n      whoami.user.lastName = u.lastName;\n    }\n  }\n\n  return whoami;\n}\n"],"mappings":";;;;;;;AAWA,eAAsB,YACpB,aACA,mBAC6B;CAC7B,MAAM,YAAY,oBAAoB,EACpC,SAAS,CACP,qBAAqB;EACnB,aAAa;EACb,sBAAsB;CACxB,CAAC,CACH,EACF,CAAC;CAED,MAAM,kBAAkB,kBAAkB,gBACtC,EAAE,OAAO,YAAY,IACrB;EACE,WAAW,kBAAkB;EAC7B,eAAe,kBAAkB;EACjC,OAAO;CACT;CAIJ,MAAM,CAAC,kBAAkB,aAAa,MAAM,QAAQ,WAAW,CAC7D,UAAU,KAAK,UAAU,gBAAgB,eAAe,CAAC,GACzD,UAAU,KAAK,QAAQ,IAAI,CAAC,CAC9B,CAAC;CAED,MAAM,SAA6B;EACjC,KAAK,CAAC;EACN,MAAM,CAAC;CACT;CAEA,IAAI,UAAU,WAAW,aAAa;EACpC,MAAM,SAAS,UAAU;EACzB,OAAO,IAAI,KAAK,OAAO;EACvB,OAAO,IAAI,WAAW,OAAO;CAC/B;CAEA,IACE,iBAAiB,WAAW,eAC5B,iBAAiB,MAAM,cAAc,gBACrC;EACA,OAAO,IAAI,SAAS,iBAAiB,MAAM;EAE3C,MAAM,SAAS,OAAO,iBAAiB,MAAM,OAAO;EACpD,MAAM,aAAa,MAAM,UACtB,KAAK,cAAc,IAAI;GAAE;GAAQ,YAAY;EAAU,CAAC,CAAC,EACzD,MACE,OAAO;GAAE,IAAI;GAAe,OAAO;EAAE,WAC/B,EAAE,IAAI,MAAe,EAC9B;EACF,IAAI,WAAW,IAAI;GACjB,MAAM,IAAI,WAAW;GACrB,OAAO,KAAK,KAAK,EAAE;GACnB,OAAO,KAAK,QAAQ,EAAE;GACtB,OAAO,KAAK,YAAY,EAAE;GAC1B,OAAO,KAAK,WAAW,EAAE;EAC3B;CACF;CAEA,OAAO;AACT"}

package/dist/server/hono/types.d.ts

@@ -1,24 +1,23 @@
 import { HubSpotClient } from "../api-client-core/types.js";
-import { HubSpotProxy } from "../types.js";
 
 //#region src/server/hono/types.d.ts
-interface AppConnectHonoBindings {
+interface AppConnectRequestContext {
   /**
-   * Authenticated proxy that issues DPoP-bound calls to HubSpot's
-   * API on behalf of the browser session that made the inbound
-   * request. `authenticated: false` when the session cookies are
-   * absent or invalid.
+   * HubSpot API client.
    */
-  hubSpotProxy: HubSpotProxy;
+  client: HubSpotClient;
   /**
-   * Authenticated HubSpot API client.
+   * Whether the browser session is authenticated.
    */
-  hubSpotClient: HubSpotClient;
+  authenticated: boolean;
+}
+interface AppConnectHonoBindings {
+  hubSpot: AppConnectRequestContext;
 }
 /**
  * Hono environment shape used by handlers running inside a hubspot-
  * connect request handler. Exposes the per-request
- * {@link HubSpotProxy} as `c.env.hubSpotProxy`.
+ * {@link AppConnectRequestContext} as `c.env.hubSpot`.
  */
 interface AppConnectHonoEnv {
   Bindings: AppConnectHonoBindings;

package/dist/server/hono/utils/cookie-utils.js

@@ -14,13 +14,14 @@ function setResponseCookie(options) {
 * cookies share the same policy.
 */
 function serializeCookie(options) {
-	const { name, value, path, sameSite = "Strict", maxAge, secure = true, httpOnly = true } = options;
+	const { name, value, path, sameSite = "Strict", maxAge, secure = true, httpOnly = true, partitioned = false } = options;
 	const parts = [`${name}=${value}`];
 	if (httpOnly) parts.push("HttpOnly");
 	if (secure) parts.push("Secure");
 	parts.push(`SameSite=${sameSite}`);
 	parts.push(`Path=${path}`);
 	parts.push(`Max-Age=${maxAge}`);
+	if (partitioned) parts.push("Partitioned");
 	return parts.join("; ");
 }
 //#endregion

package/dist/server/hono/utils/cookie-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"cookie-utils.js","names":[],"sources":["../../../../src/server/hono/utils/cookie-utils.ts"],"sourcesContent":["import type { Context } from 'hono';\n\nexport interface SetResponseCookieOptions {\n  c: Context;\n  value: string;\n}\n\n/**\n * Appends a `Set-Cookie` header to the response. Hono replaces single\n * headers by default, so this uses `{ append: true }` to emit multiple\n * cookies on the same response.\n */\nexport function setResponseCookie(options: SetResponseCookieOptions): void {\n  const { c, value } = options;\n  c.header('Set-Cookie', value, { append: true });\n}\n\nexport interface SerializeCookieOptions {\n  name: string;\n  value: string;\n  /** `__Host-` prefix requires `Path=/` and is recommended for session cookies. */\n  path: string;\n  /** Defaults to `Strict`. Use `Lax` for short-lived OAuth temp cookies. */\n  sameSite?: 'Strict' | 'Lax';\n  /** Lifetime in seconds. `0` deletes the cookie. */\n  maxAge: number;\n  /** Defaults to `true`; only set `false` for tests or non-HTTPS dev hosts. */\n  secure?: boolean;\n  /** Defaults to `true`. */\n  httpOnly?: boolean;\n}\n\n/**\n * Builds a `Set-Cookie` header value with HubSpot's default attributes\n * (HttpOnly, Secure, SameSite). Centralizes the serialization so all\n * cookies share the same policy.\n */\nexport function serializeCookie(options: SerializeCookieOptions): string {\n  const {\n    name,\n    value,\n    path,\n    sameSite = 'Strict',\n    maxAge,\n    secure = true,\n    httpOnly = true,\n  } = options;\n  const parts: string[] = [`${name}=${value}`];\n  if (httpOnly) parts.push('HttpOnly');\n  if (secure) parts.push('Secure');\n  parts.push(`SameSite=${sameSite}`);\n  parts.push(`Path=${path}`);\n  parts.push(`Max-Age=${maxAge}`);\n  return parts.join('; ');\n}\n"],"mappings":";;;;;;AAYA,SAAgB,kBAAkB,SAAyC;CACzE,MAAM,EAAE,GAAG,UAAU;CACrB,EAAE,OAAO,cAAc,OAAO,EAAE,QAAQ,MAAM,CAAC;;;;;;;AAuBjD,SAAgB,gBAAgB,SAAyC;CACvE,MAAM,EACJ,MACA,OACA,MACA,WAAW,UACX,QACA,SAAS,MACT,WAAW,SACT;CACJ,MAAM,QAAkB,CAAC,GAAG,KAAK,GAAG,QAAQ;CAC5C,IAAI,UAAU,MAAM,KAAK,WAAW;CACpC,IAAI,QAAQ,MAAM,KAAK,SAAS;CAChC,MAAM,KAAK,YAAY,WAAW;CAClC,MAAM,KAAK,QAAQ,OAAO;CAC1B,MAAM,KAAK,WAAW,SAAS;CAC/B,OAAO,MAAM,KAAK,KAAK"}
+{"version":3,"file":"cookie-utils.js","names":[],"sources":["../../../../src/server/hono/utils/cookie-utils.ts"],"sourcesContent":["import type { Context } from 'hono';\n\nexport interface SetResponseCookieOptions {\n  c: Context;\n  value: string;\n}\n\n/**\n * Appends a `Set-Cookie` header to the response. Hono replaces single\n * headers by default, so this uses `{ append: true }` to emit multiple\n * cookies on the same response.\n */\nexport function setResponseCookie(options: SetResponseCookieOptions): void {\n  const { c, value } = options;\n  c.header('Set-Cookie', value, { append: true });\n}\n\nexport interface SerializeCookieOptions {\n  name: string;\n  value: string;\n  /** `__Host-` prefix requires `Path=/` and is recommended for session cookies. */\n  path: string;\n  /**\n   * Defaults to `Strict`.\n   *\n   * - `Strict`: only sent on same-site requests. Default for self-hosted\n   *   same-origin deployments.\n   * - `Lax`: also sent on top-level cross-site GET navigations. Use for\n   *   short-lived OAuth temp cookies that need to survive a redirect.\n   * - `None`: sent on all cross-site requests; **requires `Secure=true`\n   *   and is typically combined with `Partitioned=true`** for the\n   *   cross-origin Lovable / Supabase deployment shape.\n   */\n  sameSite?: 'Strict' | 'Lax' | 'None';\n  /** Lifetime in seconds. `0` deletes the cookie. */\n  maxAge: number;\n  /** Defaults to `true`; only set `false` for tests or non-HTTPS dev hosts. */\n  secure?: boolean;\n  /** Defaults to `true`. */\n  httpOnly?: boolean;\n  /**\n   * When `true`, appends the `Partitioned` attribute (CHIPS — Cookies\n   * Having Independent Partitioned State). The browser then keys the\n   * cookie by `(top-level site, cookie host)` instead of by cookie\n   * host alone, which is required for the cross-origin SDK shape\n   * where the React app and the SDK's edge functions live on\n   * different sites and third-party cookies are blocked.\n   *\n   * Defaults to `false`. Browsers ignore `Partitioned` on cookies\n   * without `Secure=true` and reject it on cookies without\n   * `SameSite=None`.\n   */\n  partitioned?: boolean;\n}\n\n/**\n * Builds a `Set-Cookie` header value with HubSpot's default attributes\n * (HttpOnly, Secure, SameSite). Centralizes the serialization so all\n * cookies share the same policy.\n */\nexport function serializeCookie(options: SerializeCookieOptions): string {\n  const {\n    name,\n    value,\n    path,\n    sameSite = 'Strict',\n    maxAge,\n    secure = true,\n    httpOnly = true,\n    partitioned = false,\n  } = options;\n  const parts: string[] = [`${name}=${value}`];\n  if (httpOnly) parts.push('HttpOnly');\n  if (secure) parts.push('Secure');\n  parts.push(`SameSite=${sameSite}`);\n  parts.push(`Path=${path}`);\n  parts.push(`Max-Age=${maxAge}`);\n  if (partitioned) parts.push('Partitioned');\n  return parts.join('; ');\n}\n"],"mappings":";;;;;;AAYA,SAAgB,kBAAkB,SAAyC;CACzE,MAAM,EAAE,GAAG,UAAU;CACrB,EAAE,OAAO,cAAc,OAAO,EAAE,QAAQ,KAAK,CAAC;AAChD;;;;;;AA6CA,SAAgB,gBAAgB,SAAyC;CACvE,MAAM,EACJ,MACA,OACA,MACA,WAAW,UACX,QACA,SAAS,MACT,WAAW,MACX,cAAc,UACZ;CACJ,MAAM,QAAkB,CAAC,GAAG,KAAK,GAAG,OAAO;CAC3C,IAAI,UAAU,MAAM,KAAK,UAAU;CACnC,IAAI,QAAQ,MAAM,KAAK,QAAQ;CAC/B,MAAM,KAAK,YAAY,UAAU;CACjC,MAAM,KAAK,QAAQ,MAAM;CACzB,MAAM,KAAK,WAAW,QAAQ;CAC9B,IAAI,aAAa,MAAM,KAAK,aAAa;CACzC,OAAO,MAAM,KAAK,IAAI;AACxB"}

package/dist/server/hono/utils/cors-middleware.js

@@ -0,0 +1,85 @@
+import { HUBSPOT_APP_ORIGIN_COOKIE_NAME } from "../../constants.js";
+import { parseCookies } from "../../utils/cookie-utils.js";
+//#region src/server/hono/utils/cors-middleware.ts
+/**
+* Comma-separated list of request headers the SDK accepts on
+* cross-site fetches. Mirrors the Supabase Edge Functions defaults
+* the Lovable AI agent emits today, plus `content-type` for the
+* `auth/complete` POST body and `accept` so JSON content negotiation
+* works.
+*/
+const ALLOWED_HEADERS = [
+	"authorization",
+	"x-client-info",
+	"apikey",
+	"content-type",
+	"accept",
+	"x-supabase-client-platform",
+	"x-supabase-client-platform-version",
+	"x-supabase-client-runtime",
+	"x-supabase-client-runtime-version"
+].join(", ");
+const ALLOWED_METHODS = "GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS";
+const PREFLIGHT_MAX_AGE_SECONDS = "600";
+/**
+* Reads the persisted app-origin cookie from the request, falling
+* back to the literal `Origin` request header. The cookie is the
+* authoritative pin once `auth/init-session` has run; on the very
+* first init-session call (no cookie yet) we just echo whatever
+* `Origin` the caller sent — the actual access decision is enforced
+* by cookie-based authentication on every other route, not by CORS.
+*/
+function resolveAllowedOrigin(c) {
+	const pinned = parseCookies(c.req.header("Cookie"))[HUBSPOT_APP_ORIGIN_COOKIE_NAME];
+	if (pinned) return pinned;
+	return c.req.header("Origin") ?? null;
+}
+function setSharedCorsHeaders(c, allowOrigin) {
+	c.res.headers.set("Access-Control-Allow-Origin", allowOrigin);
+	c.res.headers.set("Access-Control-Allow-Credentials", "true");
+	c.res.headers.set("Vary", "Origin, Cookie");
+}
+/**
+* Hono middleware that emits credentialed CORS response headers for
+* the cross-origin Lovable / Supabase deployment shape.
+*
+* - On `OPTIONS` preflight: short-circuits with a 204 carrying
+*   `Access-Control-Allow-*` headers. The browser will then send the
+*   real request with cookies attached.
+* - On every other method: echoes the pinned `__Host-hs_app_origin`
+*   cookie value (or, before init-session has run, the request
+*   `Origin` header) as `Access-Control-Allow-Origin`, with
+*   `Access-Control-Allow-Credentials: true`. The wildcard `*` is
+*   forbidden by browsers when credentials are included, so the
+*   middleware always echoes a concrete origin.
+*
+* Skips header emission entirely when the request has no `Origin`
+* (server-to-server calls, curl, etc.) so non-browser callers are
+* left untouched.
+*/
+function corsMiddleware() {
+	return async (c, next) => {
+		const allowOrigin = resolveAllowedOrigin(c);
+		if (c.req.method === "OPTIONS") {
+			const headers = new Headers();
+			if (allowOrigin) {
+				headers.set("Access-Control-Allow-Origin", allowOrigin);
+				headers.set("Access-Control-Allow-Credentials", "true");
+				headers.set("Vary", "Origin, Cookie");
+			}
+			headers.set("Access-Control-Allow-Methods", ALLOWED_METHODS);
+			headers.set("Access-Control-Allow-Headers", ALLOWED_HEADERS);
+			headers.set("Access-Control-Max-Age", PREFLIGHT_MAX_AGE_SECONDS);
+			return new Response(null, {
+				status: 204,
+				headers
+			});
+		}
+		await next();
+		if (allowOrigin) setSharedCorsHeaders(c, allowOrigin);
+	};
+}
+//#endregion
+export { corsMiddleware };
+
+//# sourceMappingURL=cors-middleware.js.map

package/dist/server/hono/utils/cors-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors-middleware.js","names":[],"sources":["../../../../src/server/hono/utils/cors-middleware.ts"],"sourcesContent":["import type { Context, MiddlewareHandler } from 'hono';\n\nimport { HUBSPOT_APP_ORIGIN_COOKIE_NAME } from '../../constants.ts';\nimport { parseCookies } from '../../utils/cookie-utils.ts';\n\n/**\n * Comma-separated list of request headers the SDK accepts on\n * cross-site fetches. Mirrors the Supabase Edge Functions defaults\n * the Lovable AI agent emits today, plus `content-type` for the\n * `auth/complete` POST body and `accept` so JSON content negotiation\n * works.\n */\nconst ALLOWED_HEADERS = [\n  'authorization',\n  'x-client-info',\n  'apikey',\n  'content-type',\n  'accept',\n  'x-supabase-client-platform',\n  'x-supabase-client-platform-version',\n  'x-supabase-client-runtime',\n  'x-supabase-client-runtime-version',\n].join(', ');\n\nconst ALLOWED_METHODS = 'GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS';\n\nconst PREFLIGHT_MAX_AGE_SECONDS = '600';\n\n/**\n * Reads the persisted app-origin cookie from the request, falling\n * back to the literal `Origin` request header. The cookie is the\n * authoritative pin once `auth/init-session` has run; on the very\n * first init-session call (no cookie yet) we just echo whatever\n * `Origin` the caller sent — the actual access decision is enforced\n * by cookie-based authentication on every other route, not by CORS.\n */\nfunction resolveAllowedOrigin(c: Context): string | null {\n  const cookies = parseCookies(c.req.header('Cookie'));\n  const pinned = cookies[HUBSPOT_APP_ORIGIN_COOKIE_NAME];\n  if (pinned) return pinned;\n  return c.req.header('Origin') ?? null;\n}\n\nfunction setSharedCorsHeaders(c: Context, allowOrigin: string): void {\n  c.res.headers.set('Access-Control-Allow-Origin', allowOrigin);\n  c.res.headers.set('Access-Control-Allow-Credentials', 'true');\n  // `Origin` so caches differentiate per-caller responses; `Cookie`\n  // because the allowed origin is derived from the persisted\n  // `__Host-hs_app_origin` cookie.\n  c.res.headers.set('Vary', 'Origin, Cookie');\n}\n\n/**\n * Hono middleware that emits credentialed CORS response headers for\n * the cross-origin Lovable / Supabase deployment shape.\n *\n * - On `OPTIONS` preflight: short-circuits with a 204 carrying\n *   `Access-Control-Allow-*` headers. The browser will then send the\n *   real request with cookies attached.\n * - On every other method: echoes the pinned `__Host-hs_app_origin`\n *   cookie value (or, before init-session has run, the request\n *   `Origin` header) as `Access-Control-Allow-Origin`, with\n *   `Access-Control-Allow-Credentials: true`. The wildcard `*` is\n *   forbidden by browsers when credentials are included, so the\n *   middleware always echoes a concrete origin.\n *\n * Skips header emission entirely when the request has no `Origin`\n * (server-to-server calls, curl, etc.) so non-browser callers are\n * left untouched.\n */\nexport function corsMiddleware(): MiddlewareHandler {\n  return async (c, next) => {\n    const allowOrigin = resolveAllowedOrigin(c);\n\n    if (c.req.method === 'OPTIONS') {\n      const headers = new Headers();\n      if (allowOrigin) {\n        headers.set('Access-Control-Allow-Origin', allowOrigin);\n        headers.set('Access-Control-Allow-Credentials', 'true');\n        headers.set('Vary', 'Origin, Cookie');\n      }\n      headers.set('Access-Control-Allow-Methods', ALLOWED_METHODS);\n      headers.set('Access-Control-Allow-Headers', ALLOWED_HEADERS);\n      headers.set('Access-Control-Max-Age', PREFLIGHT_MAX_AGE_SECONDS);\n      return new Response(null, { status: 204, headers });\n    }\n\n    await next();\n\n    if (allowOrigin) {\n      setSharedCorsHeaders(c, allowOrigin);\n    }\n    return;\n  };\n}\n"],"mappings":";;;;;;;;;;AAYA,MAAM,kBAAkB;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,EAAE,KAAK,IAAI;AAEX,MAAM,kBAAkB;AAExB,MAAM,4BAA4B;;;;;;;;;AAUlC,SAAS,qBAAqB,GAA2B;CAEvD,MAAM,SADU,aAAa,EAAE,IAAI,OAAO,QAAQ,CAC7B,EAAE;CACvB,IAAI,QAAQ,OAAO;CACnB,OAAO,EAAE,IAAI,OAAO,QAAQ,KAAK;AACnC;AAEA,SAAS,qBAAqB,GAAY,aAA2B;CACnE,EAAE,IAAI,QAAQ,IAAI,+BAA+B,WAAW;CAC5D,EAAE,IAAI,QAAQ,IAAI,oCAAoC,MAAM;CAI5D,EAAE,IAAI,QAAQ,IAAI,QAAQ,gBAAgB;AAC5C;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,iBAAoC;CAClD,OAAO,OAAO,GAAG,SAAS;EACxB,MAAM,cAAc,qBAAqB,CAAC;EAE1C,IAAI,EAAE,IAAI,WAAW,WAAW;GAC9B,MAAM,UAAU,IAAI,QAAQ;GAC5B,IAAI,aAAa;IACf,QAAQ,IAAI,+BAA+B,WAAW;IACtD,QAAQ,IAAI,oCAAoC,MAAM;IACtD,QAAQ,IAAI,QAAQ,gBAAgB;GACtC;GACA,QAAQ,IAAI,gCAAgC,eAAe;GAC3D,QAAQ,IAAI,gCAAgC,eAAe;GAC3D,QAAQ,IAAI,0BAA0B,yBAAyB;GAC/D,OAAO,IAAI,SAAS,MAAM;IAAE,QAAQ;IAAK;GAAQ,CAAC;EACpD;EAEA,MAAM,KAAK;EAEX,IAAI,aACF,qBAAqB,GAAG,WAAW;CAGvC;AACF"}

package/dist/server/import-app-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"import-app-keys.js","names":[],"sources":["../../src/server/import-app-keys.ts"],"sourcesContent":["import type { AppKeys } from './types.ts';\nimport { base64StandardToArrayBuffer } from './utils/base64-utils.ts';\n\n/**\n * Imports a base64-encoded PKCS8 ES256 private key into the\n * `AppKeys` shape used throughout the SDK.\n *\n * The function imports the key twice: once as **extractable** to\n * derive the public JWK (via `crypto.subtle.exportKey`), and once\n * as **non-extractable** so the long-lived `appPrivateKey` can never\n * be exfiltrated.\n *\n * @throws {Error} When `envKey` is empty/undefined or when the key\n *   isn't an EC P-256 keypair.\n */\nexport async function importAppKeys(\n  envKey: string | undefined\n): Promise<AppKeys> {\n  const b64 = envKey?.trim() ?? '';\n  if (!b64) {\n    throw new Error('HUBSPOT_APP_PRIVATE_KEY is not set');\n  }\n\n  const pkcs8 = base64StandardToArrayBuffer(b64);\n  const tempPrivateKey = await crypto.subtle.importKey(\n    'pkcs8',\n    pkcs8,\n    { name: 'ECDSA', namedCurve: 'P-256' },\n    true,\n    ['sign']\n  );\n  const privateJwk = await crypto.subtle.exportKey('jwk', tempPrivateKey);\n  if (\n    privateJwk.kty !== 'EC' ||\n    privateJwk.crv !== 'P-256' ||\n    typeof privateJwk.x !== 'string' ||\n    typeof privateJwk.y !== 'string'\n  ) {\n    throw new Error('Expected P-256 EC private key JWK with x and y');\n  }\n  const appPublicKeyJwk: JsonWebKey = {\n    kty: 'EC',\n    crv: 'P-256',\n    x: privateJwk.x,\n    y: privateJwk.y,\n  };\n  const appPrivateKey = await crypto.subtle.importKey(\n    'pkcs8',\n    pkcs8,\n    { name: 'ECDSA', namedCurve: 'P-256' },\n    false,\n    ['sign']\n  );\n  return { appPrivateKey, appPublicKeyJwk };\n}\n"],"mappings":";;;;;;;;;;;;;;AAeA,eAAsB,cACpB,QACkB;CAClB,MAAM,MAAM,QAAQ,MAAM,IAAI;CAC9B,IAAI,CAAC,KACH,MAAM,IAAI,MAAM,qCAAqC;CAGvD,MAAM,QAAQ,4BAA4B,IAAI;CAC9C,MAAM,iBAAiB,MAAM,OAAO,OAAO,UACzC,SACA,OACA;EAAE,MAAM;EAAS,YAAY;EAAS,EACtC,MACA,CAAC,OAAO,CACT;CACD,MAAM,aAAa,MAAM,OAAO,OAAO,UAAU,OAAO,eAAe;CACvE,IACE,WAAW,QAAQ,QACnB,WAAW,QAAQ,WACnB,OAAO,WAAW,MAAM,YACxB,OAAO,WAAW,MAAM,UAExB,MAAM,IAAI,MAAM,iDAAiD;CAEnE,MAAM,kBAA8B;EAClC,KAAK;EACL,KAAK;EACL,GAAG,WAAW;EACd,GAAG,WAAW;EACf;CAQD,OAAO;EAAE,eAAA,MAPmB,OAAO,OAAO,UACxC,SACA,OACA;GAAE,MAAM;GAAS,YAAY;GAAS,EACtC,OACA,CAAC,OAAO,CACT;EACuB;EAAiB"}
+{"version":3,"file":"import-app-keys.js","names":[],"sources":["../../src/server/import-app-keys.ts"],"sourcesContent":["import type { AppKeys } from './types.ts';\nimport { base64StandardToArrayBuffer } from './utils/base64-utils.ts';\n\n/**\n * Imports a base64-encoded PKCS8 ES256 private key into the\n * `AppKeys` shape used throughout the SDK.\n *\n * The function imports the key twice: once as **extractable** to\n * derive the public JWK (via `crypto.subtle.exportKey`), and once\n * as **non-extractable** so the long-lived `appPrivateKey` can never\n * be exfiltrated.\n *\n * @throws {Error} When `envKey` is empty/undefined or when the key\n *   isn't an EC P-256 keypair.\n */\nexport async function importAppKeys(\n  envKey: string | undefined\n): Promise<AppKeys> {\n  const b64 = envKey?.trim() ?? '';\n  if (!b64) {\n    throw new Error('HUBSPOT_APP_PRIVATE_KEY is not set');\n  }\n\n  const pkcs8 = base64StandardToArrayBuffer(b64);\n  const tempPrivateKey = await crypto.subtle.importKey(\n    'pkcs8',\n    pkcs8,\n    { name: 'ECDSA', namedCurve: 'P-256' },\n    true,\n    ['sign']\n  );\n  const privateJwk = await crypto.subtle.exportKey('jwk', tempPrivateKey);\n  if (\n    privateJwk.kty !== 'EC' ||\n    privateJwk.crv !== 'P-256' ||\n    typeof privateJwk.x !== 'string' ||\n    typeof privateJwk.y !== 'string'\n  ) {\n    throw new Error('Expected P-256 EC private key JWK with x and y');\n  }\n  const appPublicKeyJwk: JsonWebKey = {\n    kty: 'EC',\n    crv: 'P-256',\n    x: privateJwk.x,\n    y: privateJwk.y,\n  };\n  const appPrivateKey = await crypto.subtle.importKey(\n    'pkcs8',\n    pkcs8,\n    { name: 'ECDSA', namedCurve: 'P-256' },\n    false,\n    ['sign']\n  );\n  return { appPrivateKey, appPublicKeyJwk };\n}\n"],"mappings":";;;;;;;;;;;;;;AAeA,eAAsB,cACpB,QACkB;CAClB,MAAM,MAAM,QAAQ,KAAK,KAAK;CAC9B,IAAI,CAAC,KACH,MAAM,IAAI,MAAM,oCAAoC;CAGtD,MAAM,QAAQ,4BAA4B,GAAG;CAC7C,MAAM,iBAAiB,MAAM,OAAO,OAAO,UACzC,SACA,OACA;EAAE,MAAM;EAAS,YAAY;CAAQ,GACrC,MACA,CAAC,MAAM,CACT;CACA,MAAM,aAAa,MAAM,OAAO,OAAO,UAAU,OAAO,cAAc;CACtE,IACE,WAAW,QAAQ,QACnB,WAAW,QAAQ,WACnB,OAAO,WAAW,MAAM,YACxB,OAAO,WAAW,MAAM,UAExB,MAAM,IAAI,MAAM,gDAAgD;CAElE,MAAM,kBAA8B;EAClC,KAAK;EACL,KAAK;EACL,GAAG,WAAW;EACd,GAAG,WAAW;CAChB;CAQA,OAAO;EAAE,eAAA,MAPmB,OAAO,OAAO,UACxC,SACA,OACA;GAAE,MAAM;GAAS,YAAY;EAAQ,GACrC,OACA,CAAC,MAAM,CACT;EACwB;CAAgB;AAC1C"}

package/dist/server/lovable/create-app-function-start.d.ts

@@ -17,7 +17,7 @@ type AppFunctionStart = (context: SecureStartContext) => Promise<void>;
 /**
  * Builds a Deno-style `start({ appKeys })` entry point that boots a
  * Hono app under `basePath`, wires the SDK's per-request HubSpot
- * proxy via `createAppConnectRequestHandler`, and serves it with
+ * client via `createAppConnectRequestHandler`, and serves it with
  * `Deno.serve` on `PORT`.
  */
 declare function createAppFunctionStart(options: CreateAppFunctionStartOptions): AppFunctionStart;

package/dist/server/lovable/create-app-function-start.js

@@ -5,21 +5,19 @@ const serveOptions = typeof PORT === "string" ? { port: parseInt(PORT, 10) } : {
 /**
 * Builds a Deno-style `start({ appKeys })` entry point that boots a
 * Hono app under `basePath`, wires the SDK's per-request HubSpot
-* proxy via `createAppConnectRequestHandler`, and serves it with
+* client via `createAppConnectRequestHandler`, and serves it with
 * `Deno.serve` on `PORT`.
 */
 function createAppFunctionStart(options) {
 	const { basePath, registerRoutes, logger } = options;
-	return ({ appKeys }) => {
-		Deno.serve(serveOptions, createAppConnectRequestHandler({
+	return async ({ appKeys }) => {
+		await Deno.serve(serveOptions, createAppConnectRequestHandler({
 			appKeys,
 			...logger !== void 0 ? { logger } : {},
 			registerRoutes: (app) => {
 				registerRoutes(app.basePath(basePath));
 			}
-		}));
-		console.log(`[app-function ${basePath}] Listening on http://localhost:${PORT}`);
-		return Promise.resolve();
+		})).finished;
 	};
 }
 //#endregion

package/dist/server/lovable/create-app-function-start.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-app-function-start.js","names":[],"sources":["../../../src/server/lovable/create-app-function-start.ts"],"sourcesContent":["import type { Hono } from 'hono';\n\nimport type { Logger } from '../../shared/logger.ts';\nimport { createAppConnectRequestHandler } from '../hono/hono-request-handler.ts';\nimport type { AppConnectHonoEnv } from '../hono/types.ts';\nimport type { SecureStartContext } from '../secure-start-core.ts';\n\nconst PORT = Deno.env.get('PORT');\nconst serveOptions =\n  typeof PORT === 'string' ? { port: parseInt(PORT, 10) } : {};\n\nexport type RegisterAppFunctionRoutesFunction = (\n  app: Hono<AppConnectHonoEnv>\n) => void;\n\nexport interface CreateAppFunctionStartOptions {\n  /** Base path the user's routes are mounted under (e.g. `/functions/v1/api`). */\n  basePath: string;\n  /** Attach app routes to the SDK-owned Hono instance. */\n  registerRoutes: RegisterAppFunctionRoutesFunction;\n  /** Optional logger forwarded to `createAppConnectRequestHandler`. */\n  logger?: Logger;\n}\n\nexport type AppFunctionStart = (context: SecureStartContext) => Promise<void>;\n\n/**\n * Builds a Deno-style `start({ appKeys })` entry point that boots a\n * Hono app under `basePath`, wires the SDK's per-request HubSpot\n * proxy via `createAppConnectRequestHandler`, and serves it with\n * `Deno.serve` on `PORT`.\n */\nexport function createAppFunctionStart(\n  options: CreateAppFunctionStartOptions\n): AppFunctionStart {\n  const { basePath, registerRoutes, logger } = options;\n\n  return ({ appKeys }) => {\n    Deno.serve(\n      serveOptions,\n      createAppConnectRequestHandler({\n        appKeys,\n        ...(logger !== undefined ? { logger } : {}),\n        registerRoutes: (app) => {\n          registerRoutes(app.basePath(basePath));\n        },\n      })\n    );\n\n    console.log(\n      `[app-function ${basePath}] Listening on http://localhost:${PORT}`\n    );\n    return Promise.resolve();\n  };\n}\n"],"mappings":";;AAOA,MAAM,OAAO,KAAK,IAAI,IAAI,OAAO;AACjC,MAAM,eACJ,OAAO,SAAS,WAAW,EAAE,MAAM,SAAS,MAAM,GAAG,EAAE,GAAG,EAAE;;;;;;;AAuB9D,SAAgB,uBACd,SACkB;CAClB,MAAM,EAAE,UAAU,gBAAgB,WAAW;CAE7C,QAAQ,EAAE,cAAc;EACtB,KAAK,MACH,cACA,+BAA+B;GAC7B;GACA,GAAI,WAAW,KAAA,IAAY,EAAE,QAAQ,GAAG,EAAE;GAC1C,iBAAiB,QAAQ;IACvB,eAAe,IAAI,SAAS,SAAS,CAAC;;GAEzC,CAAC,CACH;EAED,QAAQ,IACN,iBAAiB,SAAS,kCAAkC,OAC7D;EACD,OAAO,QAAQ,SAAS"}
+{"version":3,"file":"create-app-function-start.js","names":[],"sources":["../../../src/server/lovable/create-app-function-start.ts"],"sourcesContent":["import type { Hono } from 'hono';\n\nimport type { Logger } from '../../shared/logger.ts';\nimport { createAppConnectRequestHandler } from '../hono/hono-request-handler.ts';\nimport type { AppConnectHonoEnv } from '../hono/types.ts';\nimport type { SecureStartContext } from '../secure-start-core.ts';\n\nconst PORT = Deno.env.get('PORT');\nconst serveOptions =\n  typeof PORT === 'string' ? { port: parseInt(PORT, 10) } : {};\n\nexport type RegisterAppFunctionRoutesFunction = (\n  app: Hono<AppConnectHonoEnv>\n) => void;\n\nexport interface CreateAppFunctionStartOptions {\n  /** Base path the user's routes are mounted under (e.g. `/functions/v1/api`). */\n  basePath: string;\n  /** Attach app routes to the SDK-owned Hono instance. */\n  registerRoutes: RegisterAppFunctionRoutesFunction;\n  /** Optional logger forwarded to `createAppConnectRequestHandler`. */\n  logger?: Logger;\n}\n\nexport type AppFunctionStart = (context: SecureStartContext) => Promise<void>;\n\n/**\n * Builds a Deno-style `start({ appKeys })` entry point that boots a\n * Hono app under `basePath`, wires the SDK's per-request HubSpot\n * client via `createAppConnectRequestHandler`, and serves it with\n * `Deno.serve` on `PORT`.\n */\nexport function createAppFunctionStart(\n  options: CreateAppFunctionStartOptions\n): AppFunctionStart {\n  const { basePath, registerRoutes, logger } = options;\n\n  return async ({ appKeys }) => {\n    const server = Deno.serve(\n      serveOptions,\n      createAppConnectRequestHandler({\n        appKeys,\n        ...(logger !== undefined ? { logger } : {}),\n        registerRoutes: (app) => {\n          registerRoutes(app.basePath(basePath));\n        },\n      })\n    );\n\n    await server.finished;\n  };\n}\n"],"mappings":";;AAOA,MAAM,OAAO,KAAK,IAAI,IAAI,MAAM;AAChC,MAAM,eACJ,OAAO,SAAS,WAAW,EAAE,MAAM,SAAS,MAAM,EAAE,EAAE,IAAI,CAAC;;;;;;;AAuB7D,SAAgB,uBACd,SACkB;CAClB,MAAM,EAAE,UAAU,gBAAgB,WAAW;CAE7C,OAAO,OAAO,EAAE,cAAc;EAY5B,MAXe,KAAK,MAClB,cACA,+BAA+B;GAC7B;GACA,GAAI,WAAW,KAAA,IAAY,EAAE,OAAO,IAAI,CAAC;GACzC,iBAAiB,QAAQ;IACvB,eAAe,IAAI,SAAS,QAAQ,CAAC;GACvC;EACF,CAAC,CAGQ,EAAE;CACf;AACF"}

package/dist/server/lovable/hubspot-connect/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../../src/server/lovable/hubspot-connect/index.ts"],"sourcesContent":["import { secureStart } from '../../deno/start.ts';\nimport { assertHubSpotConnectCimdClientMetadata } from '../../hono/hubspot-connect-routes/cimd-client-metadata-types.ts';\nimport type { HubSpotConnectCimdClientMetadata } from '../../hono/hubspot-connect-routes/cimd-client-metadata-types.ts';\nimport { runHubSpotConnectLovableServer } from './run-hubspot-connect-lovable-server.ts';\n\nexport type { HubSpotConnectCimdClientMetadata } from '../../hono/hubspot-connect-routes/cimd-client-metadata-types.ts';\n\nexport interface StartHubSpotConnectFunctionOptions {\n  client: HubSpotConnectCimdClientMetadata;\n}\n\n/**\n * Lovable-style entry point for the hubspot-connect Deno function.\n * Loads `HUBSPOT_APP_PRIVATE_KEY` via `secureStart`, then serves OAuth\n * and CIMD routes under `/functions/v1/hubspot-connect`.\n */\nexport async function startHubSpotConnectFunction(\n  options: StartHubSpotConnectFunctionOptions\n): Promise<void> {\n  assertHubSpotConnectCimdClientMetadata(options.client);\n  await secureStart(async () => ({\n    start: (context) =>\n      runHubSpotConnectLovableServer({\n        ...context,\n        cimdClientMetadata: options.client,\n      }),\n  }));\n}\n"],"mappings":";;;;;;;;;AAgBA,eAAsB,4BACpB,SACe;CACf,uCAAuC,QAAQ,OAAO;CACtD,MAAM,YAAY,aAAa,EAC7B,QAAQ,YACN,+BAA+B;EAC7B,GAAG;EACH,oBAAoB,QAAQ;EAC7B,CAAC,EACL,EAAE"}
+{"version":3,"file":"index.js","names":[],"sources":["../../../../src/server/lovable/hubspot-connect/index.ts"],"sourcesContent":["import { secureStart } from '../../deno/start.ts';\nimport { assertHubSpotConnectCimdClientMetadata } from '../../hono/hubspot-connect-routes/cimd-client-metadata-types.ts';\nimport type { HubSpotConnectCimdClientMetadata } from '../../hono/hubspot-connect-routes/cimd-client-metadata-types.ts';\nimport { runHubSpotConnectLovableServer } from './run-hubspot-connect-lovable-server.ts';\n\nexport type { HubSpotConnectCimdClientMetadata } from '../../hono/hubspot-connect-routes/cimd-client-metadata-types.ts';\n\nexport interface StartHubSpotConnectFunctionOptions {\n  client: HubSpotConnectCimdClientMetadata;\n}\n\n/**\n * Lovable-style entry point for the hubspot-connect Deno function.\n * Loads `HUBSPOT_APP_PRIVATE_KEY` via `secureStart`, then serves OAuth\n * and CIMD routes under `/functions/v1/hubspot-connect`.\n */\nexport async function startHubSpotConnectFunction(\n  options: StartHubSpotConnectFunctionOptions\n): Promise<void> {\n  assertHubSpotConnectCimdClientMetadata(options.client);\n  await secureStart(async () => ({\n    start: (context) =>\n      runHubSpotConnectLovableServer({\n        ...context,\n        cimdClientMetadata: options.client,\n      }),\n  }));\n}\n"],"mappings":";;;;;;;;;AAgBA,eAAsB,4BACpB,SACe;CACf,uCAAuC,QAAQ,MAAM;CACrD,MAAM,YAAY,aAAa,EAC7B,QAAQ,YACN,+BAA+B;EAC7B,GAAG;EACH,oBAAoB,QAAQ;CAC9B,CAAC,EACL,EAAE;AACJ"}

package/dist/server/lovable/hubspot-connect/run-hubspot-connect-lovable-server.js

@@ -4,24 +4,23 @@ import "../../hono/index.js";
 import { Hono } from "hono";
 //#region src/server/lovable/hubspot-connect/run-hubspot-connect-lovable-server.ts
 const PORT = Deno.env.get("PORT");
-const serveOptions = typeof PORT === "string" ? { port: parseInt(PORT, 10) } : {};
-const HUBSPOT_CONNECT_BASE_PATH = "/functions/v1/hubspot-connect";
-function runHubSpotConnectLovableServer(options) {
+const port = typeof PORT === "string" ? parseInt(PORT, 10) : void 0;
+const PUBLIC_HUBSPOT_CONNECT_BASE_PATH = "/functions/v1/hubspot-connect";
+async function runHubSpotConnectLovableServer(options) {
 	const { appKeys, cimdClientMetadata } = options;
 	const hubspotConnectEnv = loadHubSpotConnectRoutesEnv();
-	const result = Deno.serve(serveOptions, (request) => {
-		const app = new Hono();
-		registerHubSpotConnectRoutes({
-			app: app.basePath(HUBSPOT_CONNECT_BASE_PATH),
-			appKeys,
-			basePath: HUBSPOT_CONNECT_BASE_PATH,
-			hubspotConnectEnv,
-			cimdClientMetadata
-		});
-		return app.fetch(request);
+	const app = new Hono().basePath("/hubspot-connect");
+	registerHubSpotConnectRoutes({
+		app,
+		appKeys,
+		basePath: PUBLIC_HUBSPOT_CONNECT_BASE_PATH,
+		hubspotConnectEnv,
+		cimdClientMetadata
 	});
-	console.log(`[hubspot-connect] Listening on ${result.addr.port}`);
-	return Promise.resolve();
+	const serveHandler = (request) => {
+		return app.fetch(request);
+	};
+	await (port !== void 0 ? Deno.serve({ port }, serveHandler) : Deno.serve(serveHandler)).finished;
 }
 //#endregion
 export { runHubSpotConnectLovableServer };

package/dist/server/lovable/hubspot-connect/run-hubspot-connect-lovable-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"run-hubspot-connect-lovable-server.js","names":[],"sources":["../../../../src/server/lovable/hubspot-connect/run-hubspot-connect-lovable-server.ts"],"sourcesContent":["import { Hono } from 'hono';\n\nimport type { SecureStartContext } from '../../deno/start.ts';\nimport type { HubSpotConnectCimdClientMetadata } from '../../hono/hubspot-connect-routes/cimd-client-metadata-types.ts';\nimport {\n  loadHubSpotConnectRoutesEnv,\n  registerHubSpotConnectRoutes,\n} from '../../hono/index.ts';\n\nconst PORT = Deno.env.get('PORT');\nconst serveOptions =\n  typeof PORT === 'string' ? { port: parseInt(PORT, 10) } : {};\nconst HUBSPOT_CONNECT_BASE_PATH = '/functions/v1/hubspot-connect';\n\nexport interface RunHubSpotConnectLovableServerOptions extends SecureStartContext {\n  cimdClientMetadata: HubSpotConnectCimdClientMetadata;\n}\n\nexport function runHubSpotConnectLovableServer(\n  options: RunHubSpotConnectLovableServerOptions\n): Promise<void> {\n  const { appKeys, cimdClientMetadata } = options;\n  const hubspotConnectEnv = loadHubSpotConnectRoutesEnv();\n  const result = Deno.serve(serveOptions, (request) => {\n    const app = new Hono();\n\n    registerHubSpotConnectRoutes({\n      app: app.basePath(HUBSPOT_CONNECT_BASE_PATH),\n      appKeys,\n      basePath: HUBSPOT_CONNECT_BASE_PATH,\n      hubspotConnectEnv,\n      cimdClientMetadata,\n    });\n\n    return app.fetch(request);\n  });\n\n  console.log(`[hubspot-connect] Listening on ${result.addr.port}`);\n  return Promise.resolve();\n}\n"],"mappings":";;;;;AASA,MAAM,OAAO,KAAK,IAAI,IAAI,OAAO;AACjC,MAAM,eACJ,OAAO,SAAS,WAAW,EAAE,MAAM,SAAS,MAAM,GAAG,EAAE,GAAG,EAAE;AAC9D,MAAM,4BAA4B;AAMlC,SAAgB,+BACd,SACe;CACf,MAAM,EAAE,SAAS,uBAAuB;CACxC,MAAM,oBAAoB,6BAA6B;CACvD,MAAM,SAAS,KAAK,MAAM,eAAe,YAAY;EACnD,MAAM,MAAM,IAAI,MAAM;EAEtB,6BAA6B;GAC3B,KAAK,IAAI,SAAS,0BAA0B;GAC5C;GACA,UAAU;GACV;GACA;GACD,CAAC;EAEF,OAAO,IAAI,MAAM,QAAQ;GACzB;CAEF,QAAQ,IAAI,kCAAkC,OAAO,KAAK,OAAO;CACjE,OAAO,QAAQ,SAAS"}
+{"version":3,"file":"run-hubspot-connect-lovable-server.js","names":[],"sources":["../../../../src/server/lovable/hubspot-connect/run-hubspot-connect-lovable-server.ts"],"sourcesContent":["import { Hono } from 'hono';\n\nimport type { SecureStartContext } from '../../deno/start.ts';\nimport type { HubSpotConnectCimdClientMetadata } from '../../hono/hubspot-connect-routes/cimd-client-metadata-types.ts';\nimport {\n  loadHubSpotConnectRoutesEnv,\n  registerHubSpotConnectRoutes,\n} from '../../hono/index.ts';\n\nconst PORT = Deno.env.get('PORT');\nconst port = typeof PORT === 'string' ? parseInt(PORT!, 10) : undefined;\n\nconst PUBLIC_HUBSPOT_CONNECT_BASE_PATH = '/functions/v1/hubspot-connect';\n\nexport interface RunHubSpotConnectLovableServerOptions extends SecureStartContext {\n  cimdClientMetadata: HubSpotConnectCimdClientMetadata;\n}\n\nexport async function runHubSpotConnectLovableServer(\n  options: RunHubSpotConnectLovableServerOptions\n): Promise<void> {\n  const { appKeys, cimdClientMetadata } = options;\n  const hubspotConnectEnv = loadHubSpotConnectRoutesEnv();\n\n  const app = new Hono().basePath('/hubspot-connect');\n\n  registerHubSpotConnectRoutes({\n    app,\n    appKeys,\n    basePath: PUBLIC_HUBSPOT_CONNECT_BASE_PATH,\n    hubspotConnectEnv,\n    cimdClientMetadata,\n  });\n\n  const serveHandler = (request: Request): Response | Promise<Response> => {\n    return app.fetch(request);\n  };\n\n  const server =\n    port !== undefined\n      ? Deno.serve({ port }, serveHandler)\n      : Deno.serve(serveHandler);\n\n  await server.finished;\n}\n"],"mappings":";;;;;AASA,MAAM,OAAO,KAAK,IAAI,IAAI,MAAM;AAChC,MAAM,OAAO,OAAO,SAAS,WAAW,SAAS,MAAO,EAAE,IAAI,KAAA;AAE9D,MAAM,mCAAmC;AAMzC,eAAsB,+BACpB,SACe;CACf,MAAM,EAAE,SAAS,uBAAuB;CACxC,MAAM,oBAAoB,4BAA4B;CAEtD,MAAM,MAAM,IAAI,KAAK,EAAE,SAAS,kBAAkB;CAElD,6BAA6B;EAC3B;EACA;EACA,UAAU;EACV;EACA;CACF,CAAC;CAED,MAAM,gBAAgB,YAAmD;EACvE,OAAO,IAAI,MAAM,OAAO;CAC1B;CAOA,OAJE,SAAS,KAAA,IACL,KAAK,MAAM,EAAE,KAAK,GAAG,YAAY,IACjC,KAAK,MAAM,YAAY,GAEhB;AACf"}

package/dist/server/sanitize-request.js

@@ -7,22 +7,25 @@ function serializeCookies(cookies) {
 	return parts.join("; ");
 }
 /**
-* Returns a clone of `original` whose `Cookie` header has every
-* protected cookie removed (see
-* {@link isProtectedCookieName}). When no other cookies
-* remain, the header is dropped entirely.
-*
-* Used by `createAppConnectRequestHandler` so the user's route
-* handlers never see — and therefore cannot leak — the access token,
-* session ID, or refresh-token cookies.
+* Mutates `headers` in place: parses the `Cookie` header, drops every
+* protected cookie (see {@link isProtectedCookieName}), and rewrites
+* the header. Deletes the header entirely when nothing survives.
 */
-function sanitizeRequest(original) {
-	const cookies = parseCookies(original.headers.get("Cookie"));
+function stripProtectedCookies(headers) {
+	const cookies = parseCookies(headers.get("Cookie"));
 	const surviving = /* @__PURE__ */ new Map();
 	for (const [name, value] of Object.entries(cookies)) if (!isProtectedCookieName(name)) surviving.set(name, value);
-	const headers = new Headers(original.headers);
 	if (surviving.size === 0) headers.delete("cookie");
 	else headers.set("cookie", serializeCookies(surviving));
+}
+/**
+* Returns a clone of `original` whose `Cookie` header has every
+* protected cookie removed (see {@link isProtectedCookieName}). When
+* no other cookies remain, the header is dropped entirely.
+*/
+function sanitizeRequest(original) {
+	const headers = new Headers(original.headers);
+	stripProtectedCookies(headers);
 	const init = {
 		method: original.method,
 		headers,

package/dist/server/sanitize-request.js.map

@@ -1 +1 @@
-{"version":3,"file":"sanitize-request.js","names":[],"sources":["../../src/server/sanitize-request.ts"],"sourcesContent":["import { isProtectedCookieName } from './constants.ts';\nimport { parseCookies } from './utils/cookie-utils.ts';\n\nfunction serializeCookies(cookies: Map<string, string>): string {\n  const parts: string[] = [];\n  for (const [name, value] of cookies) {\n    parts.push(`${name}=${value}`);\n  }\n  return parts.join('; ');\n}\n\n/**\n * Returns a clone of `original` whose `Cookie` header has every\n * protected cookie removed (see\n * {@link isProtectedCookieName}). When no other cookies\n * remain, the header is dropped entirely.\n *\n * Used by `createAppConnectRequestHandler` so the user's route\n * handlers never see — and therefore cannot leak — the access token,\n * session ID, or refresh-token cookies.\n */\nexport function sanitizeRequest(original: Request): Request {\n  const cookies = parseCookies(original.headers.get('Cookie'));\n\n  const surviving = new Map<string, string>();\n  for (const [name, value] of Object.entries(cookies)) {\n    if (!isProtectedCookieName(name)) {\n      surviving.set(name, value);\n    }\n  }\n\n  const headers = new Headers(original.headers);\n  if (surviving.size === 0) {\n    headers.delete('cookie');\n  } else {\n    headers.set('cookie', serializeCookies(surviving));\n  }\n\n  const init: RequestInit = {\n    method: original.method,\n    headers,\n    redirect: original.redirect,\n    signal: original.signal,\n  };\n\n  if (original.body !== null) {\n    init.body = original.body;\n    (init as RequestInit & { duplex: 'half' }).duplex = 'half';\n  }\n\n  return new Request(original.url, init);\n}\n"],"mappings":";;;AAGA,SAAS,iBAAiB,SAAsC;CAC9D,MAAM,QAAkB,EAAE;CAC1B,KAAK,MAAM,CAAC,MAAM,UAAU,SAC1B,MAAM,KAAK,GAAG,KAAK,GAAG,QAAQ;CAEhC,OAAO,MAAM,KAAK,KAAK;;;;;;;;;;;;AAazB,SAAgB,gBAAgB,UAA4B;CAC1D,MAAM,UAAU,aAAa,SAAS,QAAQ,IAAI,SAAS,CAAC;CAE5D,MAAM,4BAAY,IAAI,KAAqB;CAC3C,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,QAAQ,EACjD,IAAI,CAAC,sBAAsB,KAAK,EAC9B,UAAU,IAAI,MAAM,MAAM;CAI9B,MAAM,UAAU,IAAI,QAAQ,SAAS,QAAQ;CAC7C,IAAI,UAAU,SAAS,GACrB,QAAQ,OAAO,SAAS;MAExB,QAAQ,IAAI,UAAU,iBAAiB,UAAU,CAAC;CAGpD,MAAM,OAAoB;EACxB,QAAQ,SAAS;EACjB;EACA,UAAU,SAAS;EACnB,QAAQ,SAAS;EAClB;CAED,IAAI,SAAS,SAAS,MAAM;EAC1B,KAAK,OAAO,SAAS;EACrB,KAA2C,SAAS;;CAGtD,OAAO,IAAI,QAAQ,SAAS,KAAK,KAAK"}
+{"version":3,"file":"sanitize-request.js","names":[],"sources":["../../src/server/sanitize-request.ts"],"sourcesContent":["import { isProtectedCookieName } from './constants.ts';\nimport { parseCookies } from './utils/cookie-utils.ts';\n\nfunction serializeCookies(cookies: Map<string, string>): string {\n  const parts: string[] = [];\n  for (const [name, value] of cookies) {\n    parts.push(`${name}=${value}`);\n  }\n  return parts.join('; ');\n}\n\n/**\n * Mutates `headers` in place: parses the `Cookie` header, drops every\n * protected cookie (see {@link isProtectedCookieName}), and rewrites\n * the header. Deletes the header entirely when nothing survives.\n */\nfunction stripProtectedCookies(headers: Headers): void {\n  const cookies = parseCookies(headers.get('Cookie'));\n  const surviving = new Map<string, string>();\n  for (const [name, value] of Object.entries(cookies)) {\n    if (!isProtectedCookieName(name)) {\n      surviving.set(name, value);\n    }\n  }\n\n  if (surviving.size === 0) {\n    headers.delete('cookie');\n  } else {\n    headers.set('cookie', serializeCookies(surviving));\n  }\n}\n\n/**\n * Returns a clone of `original` whose `Cookie` header has every\n * protected cookie removed (see {@link isProtectedCookieName}). When\n * no other cookies remain, the header is dropped entirely.\n */\nexport function sanitizeRequest(original: Request): Request {\n  const headers = new Headers(original.headers);\n  stripProtectedCookies(headers);\n\n  const init: RequestInit = {\n    method: original.method,\n    headers,\n    redirect: original.redirect,\n    signal: original.signal,\n  };\n\n  if (original.body !== null) {\n    init.body = original.body;\n    (init as RequestInit & { duplex: 'half' }).duplex = 'half';\n  }\n\n  return new Request(original.url, init);\n}\n"],"mappings":";;;AAGA,SAAS,iBAAiB,SAAsC;CAC9D,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,CAAC,MAAM,UAAU,SAC1B,MAAM,KAAK,GAAG,KAAK,GAAG,OAAO;CAE/B,OAAO,MAAM,KAAK,IAAI;AACxB;;;;;;AAOA,SAAS,sBAAsB,SAAwB;CACrD,MAAM,UAAU,aAAa,QAAQ,IAAI,QAAQ,CAAC;CAClD,MAAM,4BAAY,IAAI,IAAoB;CAC1C,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,OAAO,GAChD,IAAI,CAAC,sBAAsB,IAAI,GAC7B,UAAU,IAAI,MAAM,KAAK;CAI7B,IAAI,UAAU,SAAS,GACrB,QAAQ,OAAO,QAAQ;MAEvB,QAAQ,IAAI,UAAU,iBAAiB,SAAS,CAAC;AAErD;;;;;;AAOA,SAAgB,gBAAgB,UAA4B;CAC1D,MAAM,UAAU,IAAI,QAAQ,SAAS,OAAO;CAC5C,sBAAsB,OAAO;CAE7B,MAAM,OAAoB;EACxB,QAAQ,SAAS;EACjB;EACA,UAAU,SAAS;EACnB,QAAQ,SAAS;CACnB;CAEA,IAAI,SAAS,SAAS,MAAM;EAC1B,KAAK,OAAO,SAAS;EACrB,KAA2C,SAAS;CACtD;CAEA,OAAO,IAAI,QAAQ,SAAS,KAAK,IAAI;AACvC"}

package/dist/server/secure-start-core.js

@@ -1,7 +1,6 @@
 import { importAppKeys } from "./import-app-keys.js";
-import { isHubspotAppPrivateKeyRequired } from "./utils/env-utils.js";
+import { HUBSPOT_APP_PRIVATE_KEY_ENV, isHubspotAppPrivateKeyRequired } from "./utils/env-utils.js";
 //#region src/server/secure-start-core.ts
-const APP_PRIVATE_KEY_ENV = "HUBSPOT_APP_PRIVATE_KEY";
 /**
 * Loads `HUBSPOT_APP_PRIVATE_KEY` when CIMD or DPoP is enabled, deletes
 * it from the environment so later code cannot re-read it, imports the
@@ -12,10 +11,10 @@ const APP_PRIVATE_KEY_ENV = "HUBSPOT_APP_PRIVATE_KEY";
 async function runSecureStart(loader, adapter) {
 	let appKeys = null;
 	if (isHubspotAppPrivateKeyRequired()) {
-		const envKey = adapter.readEnv(APP_PRIVATE_KEY_ENV)?.trim();
-		if (!envKey) throw new Error(`${APP_PRIVATE_KEY_ENV} is not set`);
+		const envKey = adapter.readEnv(HUBSPOT_APP_PRIVATE_KEY_ENV)?.trim();
+		if (!envKey) throw new Error(`${HUBSPOT_APP_PRIVATE_KEY_ENV} is not set`);
 		appKeys = await importAppKeys(envKey);
-		adapter.deleteEnv(APP_PRIVATE_KEY_ENV);
+		adapter.deleteEnv(HUBSPOT_APP_PRIVATE_KEY_ENV);
 	}
 	return (await loader()).start({ appKeys }).catch((error) => {
 		console.error(error);

package/dist/server/secure-start-core.js.map

@@ -1 +1 @@
-{"version":3,"file":"secure-start-core.js","names":[],"sources":["../../src/server/secure-start-core.ts"],"sourcesContent":["import { importAppKeys } from './import-app-keys.ts';\nimport type { AppKeys } from './types.ts';\nimport { isHubspotAppPrivateKeyRequired } from './utils/env-utils.ts';\n\n/**\n * Context passed to a function-style entrypoint loaded by `runSecureStart`.\n * Contains imported `AppKeys` when CIMD or DPoP is enabled; otherwise\n * `null` (traditional OAuth with `client_secret` and Bearer API calls).\n */\nexport interface SecureStartContext {\n  appKeys: AppKeys | null;\n}\n\ninterface SecureEntryPointExports {\n  start: (context: SecureStartContext) => Promise<void>;\n}\n\n/**\n * Loader returned to `runSecureStart` that produces the entrypoint\n * module. Always pass an `() => import('...')` arrow so the bundler\n * preserves dynamic-import semantics.\n */\nexport type SecureStartLoader = () => Promise<SecureEntryPointExports>;\n\n/**\n * Platform adapters injected by the runtime-specific shim\n * (`node/start.ts` or `deno/start.ts`). Keeping the env/exit/delete\n * functions out of the core lets the shared logic stay platform-free.\n */\nexport interface SecureStartAdapter {\n  /** Reads the named env var, or returns `undefined` when unset. */\n  readEnv: (key: string) => string | undefined;\n  /** Removes the named env var so child processes cannot read it. */\n  deleteEnv: (key: string) => void;\n  /** Terminates the process with the given exit code. */\n  exit: (code: number) => never;\n}\n\nconst APP_PRIVATE_KEY_ENV = 'HUBSPOT_APP_PRIVATE_KEY';\n\n/**\n * Loads `HUBSPOT_APP_PRIVATE_KEY` when CIMD or DPoP is enabled, deletes\n * it from the environment so later code cannot re-read it, imports the\n * entrypoint module via `loader`, and invokes `start` with `AppKeys` or\n * `null` when both features are off. On failure, logs the error and\n * exits with code 1.\n */\nexport async function runSecureStart(\n  loader: SecureStartLoader,\n  adapter: SecureStartAdapter\n): Promise<void> {\n  let appKeys: AppKeys | null = null;\n  if (isHubspotAppPrivateKeyRequired()) {\n    const envKey = adapter.readEnv(APP_PRIVATE_KEY_ENV)?.trim();\n    if (!envKey) {\n      throw new Error(`${APP_PRIVATE_KEY_ENV} is not set`);\n    }\n    appKeys = await importAppKeys(envKey);\n    adapter.deleteEnv(APP_PRIVATE_KEY_ENV);\n  }\n\n  const exports = await loader();\n  return exports.start({ appKeys }).catch((error) => {\n    console.error(error);\n    return adapter.exit(1);\n  });\n}\n"],"mappings":";;;AAsCA,MAAM,sBAAsB;;;;;;;;AAS5B,eAAsB,eACpB,QACA,SACe;CACf,IAAI,UAA0B;CAC9B,IAAI,gCAAgC,EAAE;EACpC,MAAM,SAAS,QAAQ,QAAQ,oBAAoB,EAAE,MAAM;EAC3D,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,GAAG,oBAAoB,aAAa;EAEtD,UAAU,MAAM,cAAc,OAAO;EACrC,QAAQ,UAAU,oBAAoB;;CAIxC,QAAO,MADe,QAAQ,EACf,MAAM,EAAE,SAAS,CAAC,CAAC,OAAO,UAAU;EACjD,QAAQ,MAAM,MAAM;EACpB,OAAO,QAAQ,KAAK,EAAE;GACtB"}
+{"version":3,"file":"secure-start-core.js","names":[],"sources":["../../src/server/secure-start-core.ts"],"sourcesContent":["import { importAppKeys } from './import-app-keys.ts';\nimport type { AppKeys } from './types.ts';\nimport {\n  HUBSPOT_APP_PRIVATE_KEY_ENV,\n  isHubspotAppPrivateKeyRequired,\n} from './utils/env-utils.ts';\n\n/**\n * Context passed to a function-style entrypoint loaded by `runSecureStart`.\n * Contains imported `AppKeys` when CIMD or DPoP is enabled; otherwise\n * `null` (traditional OAuth with `client_secret` and Bearer API calls).\n */\nexport interface SecureStartContext {\n  appKeys: AppKeys | null;\n}\n\ninterface SecureEntryPointExports {\n  start: (context: SecureStartContext) => Promise<void>;\n}\n\n/**\n * Loader returned to `runSecureStart` that produces the entrypoint\n * module. Always pass an `() => import('...')` arrow so the bundler\n * preserves dynamic-import semantics.\n */\nexport type SecureStartLoader = () => Promise<SecureEntryPointExports>;\n\n/**\n * Platform adapters injected by the runtime-specific shim\n * (`node/start.ts` or `deno/start.ts`). Keeping the env/exit/delete\n * functions out of the core lets the shared logic stay platform-free.\n */\nexport interface SecureStartAdapter {\n  /** Reads the named env var, or returns `undefined` when unset. */\n  readEnv: (key: string) => string | undefined;\n  /** Removes the named env var so child processes cannot read it. */\n  deleteEnv: (key: string) => void;\n  /** Terminates the process with the given exit code. */\n  exit: (code: number) => never;\n}\n\n/**\n * Loads `HUBSPOT_APP_PRIVATE_KEY` when CIMD or DPoP is enabled, deletes\n * it from the environment so later code cannot re-read it, imports the\n * entrypoint module via `loader`, and invokes `start` with `AppKeys` or\n * `null` when both features are off. On failure, logs the error and\n * exits with code 1.\n */\nexport async function runSecureStart(\n  loader: SecureStartLoader,\n  adapter: SecureStartAdapter\n): Promise<void> {\n  let appKeys: AppKeys | null = null;\n  if (isHubspotAppPrivateKeyRequired()) {\n    const envKey = adapter.readEnv(HUBSPOT_APP_PRIVATE_KEY_ENV)?.trim();\n    if (!envKey) {\n      throw new Error(`${HUBSPOT_APP_PRIVATE_KEY_ENV} is not set`);\n    }\n    appKeys = await importAppKeys(envKey);\n    adapter.deleteEnv(HUBSPOT_APP_PRIVATE_KEY_ENV);\n  }\n\n  const exports = await loader();\n  return exports.start({ appKeys }).catch((error) => {\n    console.error(error);\n    return adapter.exit(1);\n  });\n}\n"],"mappings":";;;;;;;;;;AAgDA,eAAsB,eACpB,QACA,SACe;CACf,IAAI,UAA0B;CAC9B,IAAI,+BAA+B,GAAG;EACpC,MAAM,SAAS,QAAQ,QAAQ,2BAA2B,GAAG,KAAK;EAClE,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,GAAG,4BAA4B,YAAY;EAE7D,UAAU,MAAM,cAAc,MAAM;EACpC,QAAQ,UAAU,2BAA2B;CAC/C;CAGA,QAAO,MADe,OAAO,GACd,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,UAAU;EACjD,QAAQ,MAAM,KAAK;EACnB,OAAO,QAAQ,KAAK,CAAC;CACvB,CAAC;AACH"}