@hubspot/app-connect-sdk 1.0.0-alpha.2 → 1.0.0-alpha.3

package/dist/server/hono/hubspot-connect-routes/auth-complete.js

@@ -0,0 +1,154 @@
+import { base64urlDecode } from "../../shared/encoding/base64.js";
+import { HUBSPOT_ACCESS_TOKEN_COOKIE_NAME, HUBSPOT_APP_ORIGIN_COOKIE_NAME, HUBSPOT_REFRESH_COOKIE_PREFIX, TEMP_COOKIE_OAUTH_STATE, TEMP_COOKIE_PKCE_VERIFIER } from "../../constants.js";
+import { parseCookies } from "../../utils/cookie-utils.js";
+import { AUTH_COMPLETE_CODE_PARAM, AUTH_COMPLETE_STATE_PARAM } from "../../shared/constants.js";
+import { serializeCookie, setResponseCookie } from "../utils/cookie-utils.js";
+import { REFRESH_COOKIE_MAX_AGE_SEC } from "./constants.js";
+import { buildClientAssertion, buildClientAssertionFormParams, buildClientSecretFormParams, buildTokenEndpointDpopProof, requestOAuthToken } from "./oauth-client.js";
+import { buildCimdClientIdUrlFromRequest, buildFrontendOAuthRedirectUri, clearTempCookie, isPositiveFiniteNumber, isSafeReturnPath, parseAppOriginHeader } from "./utils.js";
+//#region src/server/hono/hubspot-connect-routes/auth-complete.ts
+/**
+* Cross-origin OAuth completion endpoint.
+*
+* Called from the React app on the frontend OAuth callback path
+* (`HUBSPOT_FRONTEND_CALLBACK_PATH`) once HubSpot has redirected the
+* browser back with `?code` + `?state`. The browser POSTs both
+* values here as a credentialed cross-site fetch — same partition as
+* `init-session`, so the temp PKCE/state cookies are visible — and
+* the SDK:
+*
+* 1. Validates `state` against the temp `__hs_oauth_state` cookie.
+* 2. Pulls the PKCE verifier from `__hs_pkce_verifier`.
+* 3. Rebuilds the same `redirect_uri` it sent to HubSpot during
+*    `init-session` (frontend origin + the fixed callback path);
+*    the OAuth token endpoint requires the two values to match.
+* 4. Exchanges `code` for an access + refresh token (with DPoP /
+*    CIMD client-assertion when enabled).
+* 5. Sets the durable session cookies (access token, refresh) with
+*    `SameSite=None; Secure; Partitioned` so they live in the
+*    `(frontend, edge)` partition where subsequent API fetches will
+*    read them.
+* 6. Clears the temp cookies.
+* 7. Returns `{ expires_at, return_path }` so the controller can
+*    update its session-storage expiry tracking and navigate back to
+*    the page the user started the connect flow from.
+*/
+async function handleAuthComplete(c, options) {
+	const { appKeys, refreshCookiePath, hubspotConnectEnv } = options;
+	const xForwardedProto = c.req.header("x-forwarded-proto") ?? void 0;
+	const xForwardedHost = c.req.header("x-forwarded-host") ?? void 0;
+	const requestHostHeader = c.req.header("host") ?? void 0;
+	const code = c.req.query(AUTH_COMPLETE_CODE_PARAM);
+	const state = c.req.query(AUTH_COMPLETE_STATE_PARAM);
+	if (!code || !state) return c.json({ error: "Missing code or state" }, 400);
+	if (hubspotConnectEnv.isAppPrivateKeyRequired && !appKeys) return c.json({ error: "Server misconfiguration: HUBSPOT_APP_PRIVATE_KEY is required when CIMD or DPoP is enabled" }, 500);
+	const cookies = parseCookies(c.req.header("Cookie"));
+	const expectedState = cookies[TEMP_COOKIE_OAUTH_STATE];
+	const codeVerifier = cookies[TEMP_COOKIE_PKCE_VERIFIER];
+	const appOriginCookie = cookies[HUBSPOT_APP_ORIGIN_COOKIE_NAME];
+	if (!expectedState || state !== decodeURIComponent(expectedState)) return c.json({ error: "State mismatch" }, 403);
+	if (!codeVerifier) return c.json({ error: "Missing PKCE verifier" }, 400);
+	const appOrigin = parseAppOriginHeader(appOriginCookie);
+	if (!appOrigin) return c.json({ error: "Missing app origin cookie" }, 400);
+	let statePayload;
+	try {
+		statePayload = JSON.parse(new TextDecoder().decode(base64urlDecode(decodeURIComponent(state))));
+	} catch {
+		return c.json({ error: "Malformed state value" }, 400);
+	}
+	const returnPath = statePayload.return_path;
+	if (!returnPath || !isSafeReturnPath(returnPath)) return c.json({ error: "Invalid return path in state" }, 400);
+	const sessionId = statePayload.sid;
+	if (!sessionId) return c.json({ error: "Missing app session cookie" }, 400);
+	const decodedCodeVerifier = decodeURIComponent(codeVerifier);
+	const clientId = hubspotConnectEnv.isCimdEnabled ? buildCimdClientIdUrlFromRequest({
+		requestUrl: c.req.url,
+		basePath: options.basePath,
+		xForwardedProto,
+		xForwardedHost,
+		requestHostHeader
+	}) : hubspotConnectEnv.hubspotClientId;
+	const redirectUri = buildFrontendOAuthRedirectUri(appOrigin);
+	const tokenEndpointUrl = new URL("/oauth/v1/token", hubspotConnectEnv.hubspotOAuthApiOrigin).href;
+	let dpopProof;
+	if (hubspotConnectEnv.isDpopEnabled) dpopProof = await buildTokenEndpointDpopProof({
+		appKeys,
+		tokenEndpointUrl,
+		sessionIdHash: sessionId
+	});
+	let formParams;
+	if (hubspotConnectEnv.isCimdEnabled) formParams = {
+		grant_type: "authorization_code",
+		code,
+		code_verifier: decodedCodeVerifier,
+		redirect_uri: redirectUri,
+		...buildClientAssertionFormParams({
+			clientId,
+			clientAssertion: await buildClientAssertion({
+				appKeys,
+				clientId,
+				audience: tokenEndpointUrl
+			})
+		})
+	};
+	else formParams = {
+		grant_type: "authorization_code",
+		code,
+		code_verifier: decodedCodeVerifier,
+		redirect_uri: redirectUri,
+		...buildClientSecretFormParams({
+			clientId,
+			clientSecret: hubspotConnectEnv.hubspotClientSecret
+		})
+	};
+	const tokenResult = await requestOAuthToken({
+		tokenEndpointUrl,
+		isDpopEnabled: hubspotConnectEnv.isDpopEnabled,
+		...dpopProof !== void 0 ? { dpopProof } : {},
+		formParams
+	});
+	if (!tokenResult.ok) return c.json({ error: `Token exchange failed: ${tokenResult.errorText}` }, 502);
+	const { access_token: accessToken, refresh_token: refreshToken, expires_in } = tokenResult.body;
+	if (!refreshToken) return c.json({ error: "Token response missing refresh_token" }, 502);
+	if (!isPositiveFiniteNumber(expires_in)) return c.json({ error: "Token response missing or invalid expires_in" }, 502);
+	const expiresAt = Date.now() + expires_in * 1e3;
+	const refreshCookieName = `${HUBSPOT_REFRESH_COOKIE_PREFIX}${sessionId}`;
+	setResponseCookie({
+		c,
+		value: serializeCookie({
+			name: HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,
+			value: accessToken,
+			path: "/",
+			sameSite: "None",
+			partitioned: true,
+			maxAge: expires_in
+		})
+	});
+	setResponseCookie({
+		c,
+		value: serializeCookie({
+			name: refreshCookieName,
+			value: refreshToken,
+			path: refreshCookiePath,
+			sameSite: "None",
+			partitioned: true,
+			maxAge: REFRESH_COOKIE_MAX_AGE_SEC
+		})
+	});
+	setResponseCookie({
+		c,
+		value: clearTempCookie(TEMP_COOKIE_PKCE_VERIFIER)
+	});
+	setResponseCookie({
+		c,
+		value: clearTempCookie(TEMP_COOKIE_OAUTH_STATE)
+	});
+	return c.json({
+		expires_at: expiresAt,
+		return_path: returnPath
+	});
+}
+//#endregion
+export { handleAuthComplete };
+
+//# sourceMappingURL=auth-complete.js.map

package/dist/server/hono/hubspot-connect-routes/auth-complete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-complete.js","names":[],"sources":["../../../../src/server/hono/hubspot-connect-routes/auth-complete.ts"],"sourcesContent":["import type { Context } from 'hono';\n\nimport {\n  AUTH_COMPLETE_CODE_PARAM,\n  AUTH_COMPLETE_STATE_PARAM,\n} from '../../../shared/constants.ts';\nimport {\n  HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,\n  HUBSPOT_APP_ORIGIN_COOKIE_NAME,\n  HUBSPOT_REFRESH_COOKIE_PREFIX,\n  TEMP_COOKIE_OAUTH_STATE,\n  TEMP_COOKIE_PKCE_VERIFIER,\n} from '../../constants.ts';\nimport { base64urlDecode } from '../../utils/base64-utils.ts';\nimport { parseCookies } from '../../utils/cookie-utils.ts';\nimport { serializeCookie, setResponseCookie } from '../utils/cookie-utils.ts';\nimport { REFRESH_COOKIE_MAX_AGE_SEC } from './constants.ts';\nimport {\n  buildClientAssertion,\n  buildClientAssertionFormParams,\n  buildClientSecretFormParams,\n  buildTokenEndpointDpopProof,\n  requestOAuthToken,\n} from './oauth-client.ts';\nimport type { HubSpotConnectOAuthRouteOptions } from './types.ts';\nimport {\n  buildCimdClientIdUrlFromRequest,\n  buildFrontendOAuthRedirectUri,\n  clearTempCookie,\n  isPositiveFiniteNumber,\n  isSafeReturnPath,\n  parseAppOriginHeader,\n} from './utils.ts';\n\ninterface OAuthStatePayload {\n  return_path?: string;\n  sid?: string;\n}\n\n/**\n * Cross-origin OAuth completion endpoint.\n *\n * Called from the React app on the frontend OAuth callback path\n * (`HUBSPOT_FRONTEND_CALLBACK_PATH`) once HubSpot has redirected the\n * browser back with `?code` + `?state`. The browser POSTs both\n * values here as a credentialed cross-site fetch — same partition as\n * `init-session`, so the temp PKCE/state cookies are visible — and\n * the SDK:\n *\n * 1. Validates `state` against the temp `__hs_oauth_state` cookie.\n * 2. Pulls the PKCE verifier from `__hs_pkce_verifier`.\n * 3. Rebuilds the same `redirect_uri` it sent to HubSpot during\n *    `init-session` (frontend origin + the fixed callback path);\n *    the OAuth token endpoint requires the two values to match.\n * 4. Exchanges `code` for an access + refresh token (with DPoP /\n *    CIMD client-assertion when enabled).\n * 5. Sets the durable session cookies (access token, refresh) with\n *    `SameSite=None; Secure; Partitioned` so they live in the\n *    `(frontend, edge)` partition where subsequent API fetches will\n *    read them.\n * 6. Clears the temp cookies.\n * 7. Returns `{ expires_at, return_path }` so the controller can\n *    update its session-storage expiry tracking and navigate back to\n *    the page the user started the connect flow from.\n */\nexport async function handleAuthComplete(\n  c: Context,\n  options: HubSpotConnectOAuthRouteOptions\n) {\n  const { appKeys, refreshCookiePath, hubspotConnectEnv } = options;\n  const xForwardedProto = c.req.header('x-forwarded-proto') ?? undefined;\n  const xForwardedHost = c.req.header('x-forwarded-host') ?? undefined;\n  const requestHostHeader = c.req.header('host') ?? undefined;\n  const code = c.req.query(AUTH_COMPLETE_CODE_PARAM);\n  const state = c.req.query(AUTH_COMPLETE_STATE_PARAM);\n\n  if (!code || !state) {\n    return c.json({ error: 'Missing code or state' }, 400);\n  }\n\n  if (hubspotConnectEnv.isAppPrivateKeyRequired && !appKeys) {\n    return c.json(\n      {\n        error:\n          'Server misconfiguration: HUBSPOT_APP_PRIVATE_KEY is required when CIMD or DPoP is enabled',\n      },\n      500\n    );\n  }\n\n  const cookies = parseCookies(c.req.header('Cookie'));\n  const expectedState = cookies[TEMP_COOKIE_OAUTH_STATE];\n  const codeVerifier = cookies[TEMP_COOKIE_PKCE_VERIFIER];\n  const appOriginCookie = cookies[HUBSPOT_APP_ORIGIN_COOKIE_NAME];\n\n  if (!expectedState || state !== decodeURIComponent(expectedState)) {\n    return c.json({ error: 'State mismatch' }, 403);\n  }\n  if (!codeVerifier) {\n    return c.json({ error: 'Missing PKCE verifier' }, 400);\n  }\n  // The redirect_uri the OAuth token endpoint validates must equal\n  // the one we sent during init-session. We rebuild it from the\n  // pinned origin cookie so that value is anchored server-side, not\n  // taken from the (caller-controlled) request `Origin` on this call.\n  const appOrigin = parseAppOriginHeader(appOriginCookie);\n  if (!appOrigin) {\n    return c.json({ error: 'Missing app origin cookie' }, 400);\n  }\n\n  let statePayload: OAuthStatePayload;\n  try {\n    statePayload = JSON.parse(\n      new TextDecoder().decode(base64urlDecode(decodeURIComponent(state)))\n    ) as OAuthStatePayload;\n  } catch {\n    return c.json({ error: 'Malformed state value' }, 400);\n  }\n  const returnPath = statePayload.return_path;\n  if (!returnPath || !isSafeReturnPath(returnPath)) {\n    return c.json({ error: 'Invalid return path in state' }, 400);\n  }\n\n  const sessionId = statePayload.sid;\n  if (!sessionId) {\n    return c.json({ error: 'Missing app session cookie' }, 400);\n  }\n\n  const decodedCodeVerifier = decodeURIComponent(codeVerifier);\n\n  const clientId = hubspotConnectEnv.isCimdEnabled\n    ? buildCimdClientIdUrlFromRequest({\n        requestUrl: c.req.url,\n        basePath: options.basePath,\n        xForwardedProto,\n        xForwardedHost,\n        requestHostHeader,\n      })\n    : hubspotConnectEnv.hubspotClientId;\n\n  const redirectUri = buildFrontendOAuthRedirectUri(appOrigin);\n\n  const tokenEndpointUrl = new URL(\n    '/oauth/v1/token',\n    hubspotConnectEnv.hubspotOAuthApiOrigin\n  ).href;\n\n  let dpopProof: string | undefined;\n  if (hubspotConnectEnv.isDpopEnabled) {\n    dpopProof = await buildTokenEndpointDpopProof({\n      appKeys: appKeys!,\n      tokenEndpointUrl,\n      sessionIdHash: sessionId,\n    });\n  }\n\n  let formParams: Record<string, string>;\n  if (hubspotConnectEnv.isCimdEnabled) {\n    const clientAssertion = await buildClientAssertion({\n      appKeys: appKeys!,\n      clientId,\n      audience: tokenEndpointUrl,\n    });\n    formParams = {\n      grant_type: 'authorization_code',\n      code,\n      code_verifier: decodedCodeVerifier,\n      redirect_uri: redirectUri,\n      ...buildClientAssertionFormParams({ clientId, clientAssertion }),\n    };\n  } else {\n    formParams = {\n      grant_type: 'authorization_code',\n      code,\n      code_verifier: decodedCodeVerifier,\n      redirect_uri: redirectUri,\n      ...buildClientSecretFormParams({\n        clientId,\n        clientSecret: hubspotConnectEnv.hubspotClientSecret,\n      }),\n    };\n  }\n\n  const tokenResult = await requestOAuthToken({\n    tokenEndpointUrl,\n    isDpopEnabled: hubspotConnectEnv.isDpopEnabled,\n    ...(dpopProof !== undefined ? { dpopProof } : {}),\n    formParams,\n  });\n  if (!tokenResult.ok) {\n    return c.json(\n      { error: `Token exchange failed: ${tokenResult.errorText}` },\n      502\n    );\n  }\n\n  const {\n    access_token: accessToken,\n    refresh_token: refreshToken,\n    expires_in,\n  } = tokenResult.body;\n  if (!refreshToken) {\n    return c.json({ error: 'Token response missing refresh_token' }, 502);\n  }\n  if (!isPositiveFiniteNumber(expires_in)) {\n    return c.json(\n      { error: 'Token response missing or invalid expires_in' },\n      502\n    );\n  }\n\n  const expiresAt = Date.now() + expires_in * 1000;\n  const refreshCookieName = `${HUBSPOT_REFRESH_COOKIE_PREFIX}${sessionId}`;\n\n  setResponseCookie({\n    c,\n    value: serializeCookie({\n      name: HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,\n      value: accessToken,\n      path: '/',\n      sameSite: 'None',\n      partitioned: true,\n      maxAge: expires_in,\n    }),\n  });\n  setResponseCookie({\n    c,\n    value: serializeCookie({\n      name: refreshCookieName,\n      value: refreshToken,\n      path: refreshCookiePath,\n      sameSite: 'None',\n      partitioned: true,\n      maxAge: REFRESH_COOKIE_MAX_AGE_SEC,\n    }),\n  });\n  setResponseCookie({ c, value: clearTempCookie(TEMP_COOKIE_PKCE_VERIFIER) });\n  setResponseCookie({ c, value: clearTempCookie(TEMP_COOKIE_OAUTH_STATE) });\n\n  return c.json({ expires_at: expiresAt, return_path: returnPath });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiEA,eAAsB,mBACpB,GACA,SACA;CACA,MAAM,EAAE,SAAS,mBAAmB,sBAAsB;CAC1D,MAAM,kBAAkB,EAAE,IAAI,OAAO,oBAAoB,IAAI,KAAA;CAC7D,MAAM,iBAAiB,EAAE,IAAI,OAAO,mBAAmB,IAAI,KAAA;CAC3D,MAAM,oBAAoB,EAAE,IAAI,OAAO,OAAO,IAAI,KAAA;CAClD,MAAM,OAAO,EAAE,IAAI,MAAM,yBAAyB;CAClD,MAAM,QAAQ,EAAE,IAAI,MAAM,0BAA0B;CAEpD,IAAI,CAAC,QAAQ,CAAC,OACZ,OAAO,EAAE,KAAK,EAAE,OAAO,yBAAyB,EAAE,IAAI;CAGxD,IAAI,kBAAkB,2BAA2B,CAAC,SAChD,OAAO,EAAE,KACP,EACE,OACE,6FACH,EACD,IACD;CAGH,MAAM,UAAU,aAAa,EAAE,IAAI,OAAO,SAAS,CAAC;CACpD,MAAM,gBAAgB,QAAQ;CAC9B,MAAM,eAAe,QAAQ;CAC7B,MAAM,kBAAkB,QAAQ;CAEhC,IAAI,CAAC,iBAAiB,UAAU,mBAAmB,cAAc,EAC/D,OAAO,EAAE,KAAK,EAAE,OAAO,kBAAkB,EAAE,IAAI;CAEjD,IAAI,CAAC,cACH,OAAO,EAAE,KAAK,EAAE,OAAO,yBAAyB,EAAE,IAAI;CAMxD,MAAM,YAAY,qBAAqB,gBAAgB;CACvD,IAAI,CAAC,WACH,OAAO,EAAE,KAAK,EAAE,OAAO,6BAA6B,EAAE,IAAI;CAG5D,IAAI;CACJ,IAAI;EACF,eAAe,KAAK,MAClB,IAAI,aAAa,CAAC,OAAO,gBAAgB,mBAAmB,MAAM,CAAC,CAAC,CACrE;SACK;EACN,OAAO,EAAE,KAAK,EAAE,OAAO,yBAAyB,EAAE,IAAI;;CAExD,MAAM,aAAa,aAAa;CAChC,IAAI,CAAC,cAAc,CAAC,iBAAiB,WAAW,EAC9C,OAAO,EAAE,KAAK,EAAE,OAAO,gCAAgC,EAAE,IAAI;CAG/D,MAAM,YAAY,aAAa;CAC/B,IAAI,CAAC,WACH,OAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,EAAE,IAAI;CAG7D,MAAM,sBAAsB,mBAAmB,aAAa;CAE5D,MAAM,WAAW,kBAAkB,gBAC/B,gCAAgC;EAC9B,YAAY,EAAE,IAAI;EAClB,UAAU,QAAQ;EAClB;EACA;EACA;EACD,CAAC,GACF,kBAAkB;CAEtB,MAAM,cAAc,8BAA8B,UAAU;CAE5D,MAAM,mBAAmB,IAAI,IAC3B,mBACA,kBAAkB,sBACnB,CAAC;CAEF,IAAI;CACJ,IAAI,kBAAkB,eACpB,YAAY,MAAM,4BAA4B;EACnC;EACT;EACA,eAAe;EAChB,CAAC;CAGJ,IAAI;CACJ,IAAI,kBAAkB,eAMpB,aAAa;EACX,YAAY;EACZ;EACA,eAAe;EACf,cAAc;EACd,GAAG,+BAA+B;GAAE;GAAU,iBAAA,MAVlB,qBAAqB;IACxC;IACT;IACA,UAAU;IACX,CAAC;GAM+D,CAAC;EACjE;MAED,aAAa;EACX,YAAY;EACZ;EACA,eAAe;EACf,cAAc;EACd,GAAG,4BAA4B;GAC7B;GACA,cAAc,kBAAkB;GACjC,CAAC;EACH;CAGH,MAAM,cAAc,MAAM,kBAAkB;EAC1C;EACA,eAAe,kBAAkB;EACjC,GAAI,cAAc,KAAA,IAAY,EAAE,WAAW,GAAG,EAAE;EAChD;EACD,CAAC;CACF,IAAI,CAAC,YAAY,IACf,OAAO,EAAE,KACP,EAAE,OAAO,0BAA0B,YAAY,aAAa,EAC5D,IACD;CAGH,MAAM,EACJ,cAAc,aACd,eAAe,cACf,eACE,YAAY;CAChB,IAAI,CAAC,cACH,OAAO,EAAE,KAAK,EAAE,OAAO,wCAAwC,EAAE,IAAI;CAEvE,IAAI,CAAC,uBAAuB,WAAW,EACrC,OAAO,EAAE,KACP,EAAE,OAAO,gDAAgD,EACzD,IACD;CAGH,MAAM,YAAY,KAAK,KAAK,GAAG,aAAa;CAC5C,MAAM,oBAAoB,GAAG,gCAAgC;CAE7D,kBAAkB;EAChB;EACA,OAAO,gBAAgB;GACrB,MAAM;GACN,OAAO;GACP,MAAM;GACN,UAAU;GACV,aAAa;GACb,QAAQ;GACT,CAAC;EACH,CAAC;CACF,kBAAkB;EAChB;EACA,OAAO,gBAAgB;GACrB,MAAM;GACN,OAAO;GACP,MAAM;GACN,UAAU;GACV,aAAa;GACb,QAAQ;GACT,CAAC;EACH,CAAC;CACF,kBAAkB;EAAE;EAAG,OAAO,gBAAgB,0BAA0B;EAAE,CAAC;CAC3E,kBAAkB;EAAE;EAAG,OAAO,gBAAgB,wBAAwB;EAAE,CAAC;CAEzE,OAAO,EAAE,KAAK;EAAE,YAAY;EAAW,aAAa;EAAY,CAAC"}

package/dist/server/hono/hubspot-connect-routes/auth-init-session.js

@@ -1,9 +1,9 @@
 import { base64url } from "../../shared/encoding/base64.js";
 import { sha256base64url } from "../../shared/encoding/sha256.js";
-import { HUBSPOT_APP_SID_COOKIE_NAME, TEMP_COOKIE_OAUTH_STATE, TEMP_COOKIE_PKCE_VERIFIER } from "../../constants.js";
+import { HUBSPOT_APP_ORIGIN_COOKIE_NAME, HUBSPOT_APP_SID_COOKIE_NAME, TEMP_COOKIE_OAUTH_STATE, TEMP_COOKIE_PKCE_VERIFIER } from "../../constants.js";
 import { serializeCookie, setResponseCookie } from "../utils/cookie-utils.js";
 import { OAUTH_TEMP_MAX_AGE_SEC, SESSION_MAX_AGE_SEC } from "./constants.js";
-import { buildCimdClientIdUrlFromRequest, buildOAuthRedirectUriFromRequest, isSafeReturnPath } from "./utils.js";
+import { buildCimdClientIdUrlFromRequest, buildFrontendOAuthRedirectUri, isSafeReturnPath, parseAppOriginHeader } from "./utils.js";
 import { deriveHubSpotAuthorizeScopesFromClientMetadata } from "./fetch-hubspot-client-metadata.js";
 //#region src/server/hono/hubspot-connect-routes/auth-init-session.ts
 async function handleAuthInitSession(c, options) {
@@ -13,6 +13,8 @@ async function handleAuthInitSession(c, options) {
 	const requestHostHeader = c.req.header("host") ?? void 0;
 	const returnPath = new URL(c.req.url).searchParams.get("return_path") ?? "/";
 	if (!isSafeReturnPath(returnPath)) return c.text("Invalid return_path", 400);
+	const appOrigin = parseAppOriginHeader(c.req.header("Origin"));
+	if (!appOrigin) return c.text("Missing or invalid Origin header; init-session must be called from a browser", 400);
 	const sessionIdBytes = new Uint8Array(32);
 	crypto.getRandomValues(sessionIdBytes);
 	const sessionId = base64url(sessionIdBytes);
@@ -32,13 +34,7 @@ async function handleAuthInitSession(c, options) {
 		xForwardedHost,
 		requestHostHeader
 	}) : hubspotConnectEnv.hubspotClientId;
-	const redirectUri = buildOAuthRedirectUriFromRequest({
-		requestUrl: c.req.url,
-		basePath: options.basePath,
-		xForwardedProto,
-		xForwardedHost,
-		requestHostHeader
-	});
+	const redirectUri = buildFrontendOAuthRedirectUri(appOrigin);
 	const authorizeUrl = new URL(hubspotConnectEnv.hubspotAuthorizationEndpoint);
 	authorizeUrl.searchParams.set("response_type", "code");
 	authorizeUrl.searchParams.set("client_id", clientId);
@@ -53,12 +49,25 @@ async function handleAuthInitSession(c, options) {
 		authorizeUrl.searchParams.set("scope", scopesResult.scope);
 		if (scopesResult.optionalScope !== void 0) authorizeUrl.searchParams.set("optional_scope", scopesResult.optionalScope);
 	}
+	setResponseCookie({
+		c,
+		value: serializeCookie({
+			name: HUBSPOT_APP_ORIGIN_COOKIE_NAME,
+			value: appOrigin,
+			path: "/",
+			sameSite: "None",
+			partitioned: true,
+			maxAge: SESSION_MAX_AGE_SEC
+		})
+	});
 	setResponseCookie({
 		c,
 		value: serializeCookie({
 			name: HUBSPOT_APP_SID_COOKIE_NAME,
 			value: sessionId,
 			path: "/",
+			sameSite: "None",
+			partitioned: true,
 			maxAge: SESSION_MAX_AGE_SEC
 		})
 	});
@@ -68,7 +77,8 @@ async function handleAuthInitSession(c, options) {
 			name: TEMP_COOKIE_PKCE_VERIFIER,
 			value: encodeURIComponent(codeVerifier),
 			path: "/",
-			sameSite: "Lax",
+			sameSite: "None",
+			partitioned: true,
 			maxAge: OAUTH_TEMP_MAX_AGE_SEC
 		})
 	});
@@ -78,7 +88,8 @@ async function handleAuthInitSession(c, options) {
 			name: TEMP_COOKIE_OAUTH_STATE,
 			value: encodeURIComponent(stateValue),
 			path: "/",
-			sameSite: "Lax",
+			sameSite: "None",
+			partitioned: true,
 			maxAge: OAUTH_TEMP_MAX_AGE_SEC
 		})
 	});

package/dist/server/hono/hubspot-connect-routes/auth-init-session.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-init-session.js","names":[],"sources":["../../../../src/server/hono/hubspot-connect-routes/auth-init-session.ts"],"sourcesContent":["import type { Context } from 'hono';\n\nimport {\n  HUBSPOT_APP_SID_COOKIE_NAME,\n  TEMP_COOKIE_OAUTH_STATE,\n  TEMP_COOKIE_PKCE_VERIFIER,\n} from '../../constants.ts';\nimport { base64url } from '../../utils/base64-utils.ts';\nimport { sha256base64url } from '../../utils/crypto-utils.ts';\nimport { serializeCookie, setResponseCookie } from '../utils/cookie-utils.ts';\nimport { OAUTH_TEMP_MAX_AGE_SEC, SESSION_MAX_AGE_SEC } from './constants.ts';\nimport { deriveHubSpotAuthorizeScopesFromClientMetadata } from './fetch-hubspot-client-metadata.ts';\nimport type { HubSpotConnectOAuthRouteOptions } from './types.ts';\nimport {\n  buildCimdClientIdUrlFromRequest,\n  buildOAuthRedirectUriFromRequest,\n  isSafeReturnPath,\n} from './utils.ts';\n\nexport async function handleAuthInitSession(\n  c: Context,\n  options: HubSpotConnectOAuthRouteOptions\n) {\n  const { hubspotConnectEnv, cimdClientMetadata } = options;\n  const xForwardedProto = c.req.header('x-forwarded-proto') ?? undefined;\n  const xForwardedHost = c.req.header('x-forwarded-host') ?? undefined;\n  const requestHostHeader = c.req.header('host') ?? undefined;\n  const url = new URL(c.req.url);\n  const returnPath = url.searchParams.get('return_path') ?? '/';\n  if (!isSafeReturnPath(returnPath)) {\n    return c.text('Invalid return_path', 400);\n  }\n\n  const sessionIdBytes = new Uint8Array(32);\n  crypto.getRandomValues(sessionIdBytes);\n  const sessionId = base64url(sessionIdBytes);\n  const sessionIdHash = await sha256base64url(sessionId);\n\n  const codeVerifierBytes = new Uint8Array(32);\n  crypto.getRandomValues(codeVerifierBytes);\n  const codeVerifier = base64url(codeVerifierBytes);\n  const codeChallenge = await sha256base64url(codeVerifier);\n\n  const stateValue = base64url(\n    new TextEncoder().encode(\n      JSON.stringify({\n        return_path: returnPath,\n        sid: sessionIdHash,\n      })\n    )\n  );\n\n  const clientId = hubspotConnectEnv.isCimdEnabled\n    ? buildCimdClientIdUrlFromRequest({\n        requestUrl: c.req.url,\n        basePath: options.basePath,\n        xForwardedProto,\n        xForwardedHost,\n        requestHostHeader,\n      })\n    : hubspotConnectEnv.hubspotClientId;\n\n  const redirectUri = buildOAuthRedirectUriFromRequest({\n    requestUrl: c.req.url,\n    basePath: options.basePath,\n    xForwardedProto,\n    xForwardedHost,\n    requestHostHeader,\n  });\n\n  const authorizeUrl = new URL(hubspotConnectEnv.hubspotAuthorizationEndpoint);\n  authorizeUrl.searchParams.set('response_type', 'code');\n  authorizeUrl.searchParams.set('client_id', clientId);\n  authorizeUrl.searchParams.set('redirect_uri', redirectUri);\n  authorizeUrl.searchParams.set('code_challenge', codeChallenge);\n  authorizeUrl.searchParams.set('code_challenge_method', 'S256');\n  authorizeUrl.searchParams.set('state', stateValue);\n  authorizeUrl.searchParams.set('sid', sessionIdHash);\n\n  if (!hubspotConnectEnv.isCimdEnabled) {\n    const scopesResult =\n      deriveHubSpotAuthorizeScopesFromClientMetadata(cimdClientMetadata);\n    if (!scopesResult.ok) {\n      return c.text(scopesResult.message, scopesResult.status as 500 | 502);\n    }\n    authorizeUrl.searchParams.set('scope', scopesResult.scope);\n    if (scopesResult.optionalScope !== undefined) {\n      authorizeUrl.searchParams.set(\n        'optional_scope',\n        scopesResult.optionalScope\n      );\n    }\n  }\n\n  setResponseCookie({\n    c,\n    value: serializeCookie({\n      name: HUBSPOT_APP_SID_COOKIE_NAME,\n      value: sessionId,\n      path: '/',\n      maxAge: SESSION_MAX_AGE_SEC,\n    }),\n  });\n  setResponseCookie({\n    c,\n    value: serializeCookie({\n      name: TEMP_COOKIE_PKCE_VERIFIER,\n      value: encodeURIComponent(codeVerifier),\n      path: '/',\n      sameSite: 'Lax',\n      maxAge: OAUTH_TEMP_MAX_AGE_SEC,\n    }),\n  });\n  setResponseCookie({\n    c,\n    value: serializeCookie({\n      name: TEMP_COOKIE_OAUTH_STATE,\n      value: encodeURIComponent(stateValue),\n      path: '/',\n      sameSite: 'Lax',\n      maxAge: OAUTH_TEMP_MAX_AGE_SEC,\n    }),\n  });\n\n  return c.json({ authorization_url: authorizeUrl.toString() });\n}\n"],"mappings":";;;;;;;;AAmBA,eAAsB,sBACpB,GACA,SACA;CACA,MAAM,EAAE,mBAAmB,uBAAuB;CAClD,MAAM,kBAAkB,EAAE,IAAI,OAAO,oBAAoB,IAAI,KAAA;CAC7D,MAAM,iBAAiB,EAAE,IAAI,OAAO,mBAAmB,IAAI,KAAA;CAC3D,MAAM,oBAAoB,EAAE,IAAI,OAAO,OAAO,IAAI,KAAA;CAElD,MAAM,aAAa,IADH,IAAI,EAAE,IAAI,IACJ,CAAC,aAAa,IAAI,cAAc,IAAI;CAC1D,IAAI,CAAC,iBAAiB,WAAW,EAC/B,OAAO,EAAE,KAAK,uBAAuB,IAAI;CAG3C,MAAM,iBAAiB,IAAI,WAAW,GAAG;CACzC,OAAO,gBAAgB,eAAe;CACtC,MAAM,YAAY,UAAU,eAAe;CAC3C,MAAM,gBAAgB,MAAM,gBAAgB,UAAU;CAEtD,MAAM,oBAAoB,IAAI,WAAW,GAAG;CAC5C,OAAO,gBAAgB,kBAAkB;CACzC,MAAM,eAAe,UAAU,kBAAkB;CACjD,MAAM,gBAAgB,MAAM,gBAAgB,aAAa;CAEzD,MAAM,aAAa,UACjB,IAAI,aAAa,CAAC,OAChB,KAAK,UAAU;EACb,aAAa;EACb,KAAK;EACN,CAAC,CACH,CACF;CAED,MAAM,WAAW,kBAAkB,gBAC/B,gCAAgC;EAC9B,YAAY,EAAE,IAAI;EAClB,UAAU,QAAQ;EAClB;EACA;EACA;EACD,CAAC,GACF,kBAAkB;CAEtB,MAAM,cAAc,iCAAiC;EACnD,YAAY,EAAE,IAAI;EAClB,UAAU,QAAQ;EAClB;EACA;EACA;EACD,CAAC;CAEF,MAAM,eAAe,IAAI,IAAI,kBAAkB,6BAA6B;CAC5E,aAAa,aAAa,IAAI,iBAAiB,OAAO;CACtD,aAAa,aAAa,IAAI,aAAa,SAAS;CACpD,aAAa,aAAa,IAAI,gBAAgB,YAAY;CAC1D,aAAa,aAAa,IAAI,kBAAkB,cAAc;CAC9D,aAAa,aAAa,IAAI,yBAAyB,OAAO;CAC9D,aAAa,aAAa,IAAI,SAAS,WAAW;CAClD,aAAa,aAAa,IAAI,OAAO,cAAc;CAEnD,IAAI,CAAC,kBAAkB,eAAe;EACpC,MAAM,eACJ,+CAA+C,mBAAmB;EACpE,IAAI,CAAC,aAAa,IAChB,OAAO,EAAE,KAAK,aAAa,SAAS,aAAa,OAAoB;EAEvE,aAAa,aAAa,IAAI,SAAS,aAAa,MAAM;EAC1D,IAAI,aAAa,kBAAkB,KAAA,GACjC,aAAa,aAAa,IACxB,kBACA,aAAa,cACd;;CAIL,kBAAkB;EAChB;EACA,OAAO,gBAAgB;GACrB,MAAM;GACN,OAAO;GACP,MAAM;GACN,QAAQ;GACT,CAAC;EACH,CAAC;CACF,kBAAkB;EAChB;EACA,OAAO,gBAAgB;GACrB,MAAM;GACN,OAAO,mBAAmB,aAAa;GACvC,MAAM;GACN,UAAU;GACV,QAAQ;GACT,CAAC;EACH,CAAC;CACF,kBAAkB;EAChB;EACA,OAAO,gBAAgB;GACrB,MAAM;GACN,OAAO,mBAAmB,WAAW;GACrC,MAAM;GACN,UAAU;GACV,QAAQ;GACT,CAAC;EACH,CAAC;CAEF,OAAO,EAAE,KAAK,EAAE,mBAAmB,aAAa,UAAU,EAAE,CAAC"}
+{"version":3,"file":"auth-init-session.js","names":[],"sources":["../../../../src/server/hono/hubspot-connect-routes/auth-init-session.ts"],"sourcesContent":["import type { Context } from 'hono';\n\nimport {\n  HUBSPOT_APP_ORIGIN_COOKIE_NAME,\n  HUBSPOT_APP_SID_COOKIE_NAME,\n  TEMP_COOKIE_OAUTH_STATE,\n  TEMP_COOKIE_PKCE_VERIFIER,\n} from '../../constants.ts';\nimport { base64url } from '../../utils/base64-utils.ts';\nimport { sha256base64url } from '../../utils/crypto-utils.ts';\nimport { serializeCookie, setResponseCookie } from '../utils/cookie-utils.ts';\nimport { OAUTH_TEMP_MAX_AGE_SEC, SESSION_MAX_AGE_SEC } from './constants.ts';\nimport { deriveHubSpotAuthorizeScopesFromClientMetadata } from './fetch-hubspot-client-metadata.ts';\nimport type { HubSpotConnectOAuthRouteOptions } from './types.ts';\nimport {\n  buildCimdClientIdUrlFromRequest,\n  buildFrontendOAuthRedirectUri,\n  isSafeReturnPath,\n  parseAppOriginHeader,\n} from './utils.ts';\n\nexport async function handleAuthInitSession(\n  c: Context,\n  options: HubSpotConnectOAuthRouteOptions\n) {\n  const { hubspotConnectEnv, cimdClientMetadata } = options;\n  const xForwardedProto = c.req.header('x-forwarded-proto') ?? undefined;\n  const xForwardedHost = c.req.header('x-forwarded-host') ?? undefined;\n  const requestHostHeader = c.req.header('host') ?? undefined;\n  const url = new URL(c.req.url);\n  const returnPath = url.searchParams.get('return_path') ?? '/';\n  if (!isSafeReturnPath(returnPath)) {\n    return c.text('Invalid return_path', 400);\n  }\n\n  // The app origin pins the OAuth `redirect_uri` (which lands on the\n  // frontend, not on this edge function) and, via the persisted\n  // `__Host-hs_app_origin` cookie, drives credentialed\n  // `Access-Control-Allow-Origin` on every subsequent SDK response.\n  const appOrigin = parseAppOriginHeader(c.req.header('Origin'));\n  if (!appOrigin) {\n    return c.text(\n      'Missing or invalid Origin header; init-session must be called from a browser',\n      400\n    );\n  }\n\n  const sessionIdBytes = new Uint8Array(32);\n  crypto.getRandomValues(sessionIdBytes);\n  const sessionId = base64url(sessionIdBytes);\n  const sessionIdHash = await sha256base64url(sessionId);\n\n  const codeVerifierBytes = new Uint8Array(32);\n  crypto.getRandomValues(codeVerifierBytes);\n  const codeVerifier = base64url(codeVerifierBytes);\n  const codeChallenge = await sha256base64url(codeVerifier);\n\n  const stateValue = base64url(\n    new TextEncoder().encode(\n      JSON.stringify({\n        return_path: returnPath,\n        sid: sessionIdHash,\n      })\n    )\n  );\n\n  const clientId = hubspotConnectEnv.isCimdEnabled\n    ? buildCimdClientIdUrlFromRequest({\n        requestUrl: c.req.url,\n        basePath: options.basePath,\n        xForwardedProto,\n        xForwardedHost,\n        requestHostHeader,\n      })\n    : hubspotConnectEnv.hubspotClientId;\n\n  const redirectUri = buildFrontendOAuthRedirectUri(appOrigin);\n\n  const authorizeUrl = new URL(hubspotConnectEnv.hubspotAuthorizationEndpoint);\n  authorizeUrl.searchParams.set('response_type', 'code');\n  authorizeUrl.searchParams.set('client_id', clientId);\n  authorizeUrl.searchParams.set('redirect_uri', redirectUri);\n  authorizeUrl.searchParams.set('code_challenge', codeChallenge);\n  authorizeUrl.searchParams.set('code_challenge_method', 'S256');\n  authorizeUrl.searchParams.set('state', stateValue);\n  authorizeUrl.searchParams.set('sid', sessionIdHash);\n\n  if (!hubspotConnectEnv.isCimdEnabled) {\n    const scopesResult =\n      deriveHubSpotAuthorizeScopesFromClientMetadata(cimdClientMetadata);\n    if (!scopesResult.ok) {\n      return c.text(scopesResult.message, scopesResult.status as 500 | 502);\n    }\n    authorizeUrl.searchParams.set('scope', scopesResult.scope);\n    if (scopesResult.optionalScope !== undefined) {\n      authorizeUrl.searchParams.set(\n        'optional_scope',\n        scopesResult.optionalScope\n      );\n    }\n  }\n\n  setResponseCookie({\n    c,\n    value: serializeCookie({\n      name: HUBSPOT_APP_ORIGIN_COOKIE_NAME,\n      value: appOrigin,\n      path: '/',\n      sameSite: 'None',\n      partitioned: true,\n      maxAge: SESSION_MAX_AGE_SEC,\n    }),\n  });\n  setResponseCookie({\n    c,\n    value: serializeCookie({\n      name: HUBSPOT_APP_SID_COOKIE_NAME,\n      value: sessionId,\n      path: '/',\n      sameSite: 'None',\n      partitioned: true,\n      maxAge: SESSION_MAX_AGE_SEC,\n    }),\n  });\n  setResponseCookie({\n    c,\n    value: serializeCookie({\n      name: TEMP_COOKIE_PKCE_VERIFIER,\n      value: encodeURIComponent(codeVerifier),\n      path: '/',\n      sameSite: 'None',\n      partitioned: true,\n      maxAge: OAUTH_TEMP_MAX_AGE_SEC,\n    }),\n  });\n  setResponseCookie({\n    c,\n    value: serializeCookie({\n      name: TEMP_COOKIE_OAUTH_STATE,\n      value: encodeURIComponent(stateValue),\n      path: '/',\n      sameSite: 'None',\n      partitioned: true,\n      maxAge: OAUTH_TEMP_MAX_AGE_SEC,\n    }),\n  });\n\n  return c.json({ authorization_url: authorizeUrl.toString() });\n}\n"],"mappings":";;;;;;;;AAqBA,eAAsB,sBACpB,GACA,SACA;CACA,MAAM,EAAE,mBAAmB,uBAAuB;CAClD,MAAM,kBAAkB,EAAE,IAAI,OAAO,oBAAoB,IAAI,KAAA;CAC7D,MAAM,iBAAiB,EAAE,IAAI,OAAO,mBAAmB,IAAI,KAAA;CAC3D,MAAM,oBAAoB,EAAE,IAAI,OAAO,OAAO,IAAI,KAAA;CAElD,MAAM,aAAa,IADH,IAAI,EAAE,IAAI,IACJ,CAAC,aAAa,IAAI,cAAc,IAAI;CAC1D,IAAI,CAAC,iBAAiB,WAAW,EAC/B,OAAO,EAAE,KAAK,uBAAuB,IAAI;CAO3C,MAAM,YAAY,qBAAqB,EAAE,IAAI,OAAO,SAAS,CAAC;CAC9D,IAAI,CAAC,WACH,OAAO,EAAE,KACP,gFACA,IACD;CAGH,MAAM,iBAAiB,IAAI,WAAW,GAAG;CACzC,OAAO,gBAAgB,eAAe;CACtC,MAAM,YAAY,UAAU,eAAe;CAC3C,MAAM,gBAAgB,MAAM,gBAAgB,UAAU;CAEtD,MAAM,oBAAoB,IAAI,WAAW,GAAG;CAC5C,OAAO,gBAAgB,kBAAkB;CACzC,MAAM,eAAe,UAAU,kBAAkB;CACjD,MAAM,gBAAgB,MAAM,gBAAgB,aAAa;CAEzD,MAAM,aAAa,UACjB,IAAI,aAAa,CAAC,OAChB,KAAK,UAAU;EACb,aAAa;EACb,KAAK;EACN,CAAC,CACH,CACF;CAED,MAAM,WAAW,kBAAkB,gBAC/B,gCAAgC;EAC9B,YAAY,EAAE,IAAI;EAClB,UAAU,QAAQ;EAClB;EACA;EACA;EACD,CAAC,GACF,kBAAkB;CAEtB,MAAM,cAAc,8BAA8B,UAAU;CAE5D,MAAM,eAAe,IAAI,IAAI,kBAAkB,6BAA6B;CAC5E,aAAa,aAAa,IAAI,iBAAiB,OAAO;CACtD,aAAa,aAAa,IAAI,aAAa,SAAS;CACpD,aAAa,aAAa,IAAI,gBAAgB,YAAY;CAC1D,aAAa,aAAa,IAAI,kBAAkB,cAAc;CAC9D,aAAa,aAAa,IAAI,yBAAyB,OAAO;CAC9D,aAAa,aAAa,IAAI,SAAS,WAAW;CAClD,aAAa,aAAa,IAAI,OAAO,cAAc;CAEnD,IAAI,CAAC,kBAAkB,eAAe;EACpC,MAAM,eACJ,+CAA+C,mBAAmB;EACpE,IAAI,CAAC,aAAa,IAChB,OAAO,EAAE,KAAK,aAAa,SAAS,aAAa,OAAoB;EAEvE,aAAa,aAAa,IAAI,SAAS,aAAa,MAAM;EAC1D,IAAI,aAAa,kBAAkB,KAAA,GACjC,aAAa,aAAa,IACxB,kBACA,aAAa,cACd;;CAIL,kBAAkB;EAChB;EACA,OAAO,gBAAgB;GACrB,MAAM;GACN,OAAO;GACP,MAAM;GACN,UAAU;GACV,aAAa;GACb,QAAQ;GACT,CAAC;EACH,CAAC;CACF,kBAAkB;EAChB;EACA,OAAO,gBAAgB;GACrB,MAAM;GACN,OAAO;GACP,MAAM;GACN,UAAU;GACV,aAAa;GACb,QAAQ;GACT,CAAC;EACH,CAAC;CACF,kBAAkB;EAChB;EACA,OAAO,gBAAgB;GACrB,MAAM;GACN,OAAO,mBAAmB,aAAa;GACvC,MAAM;GACN,UAAU;GACV,aAAa;GACb,QAAQ;GACT,CAAC;EACH,CAAC;CACF,kBAAkB;EAChB;EACA,OAAO,gBAAgB;GACrB,MAAM;GACN,OAAO,mBAAmB,WAAW;GACrC,MAAM;GACN,UAAU;GACV,aAAa;GACb,QAAQ;GACT,CAAC;EACH,CAAC;CAEF,OAAO,EAAE,KAAK,EAAE,mBAAmB,aAAa,UAAU,EAAE,CAAC"}

package/dist/server/hono/hubspot-connect-routes/auth-logout.js

@@ -1,4 +1,4 @@
-import { HUBSPOT_ACCESS_TOKEN_COOKIE_NAME, HUBSPOT_APP_SID_COOKIE_NAME } from "../../constants.js";
+import { HUBSPOT_ACCESS_TOKEN_COOKIE_NAME, HUBSPOT_APP_ORIGIN_COOKIE_NAME, HUBSPOT_APP_SID_COOKIE_NAME } from "../../constants.js";
 import { parseCookies } from "../../utils/cookie-utils.js";
 import { serializeCookie, setResponseCookie } from "../utils/cookie-utils.js";
 import { buildClientAssertion } from "./oauth-client.js";
@@ -66,6 +66,8 @@ async function handleAuthLogout(c, options) {
 			name: HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,
 			value: "",
 			path: "/",
+			sameSite: "None",
+			partitioned: true,
 			maxAge: 0
 		})
 	});
@@ -75,6 +77,19 @@ async function handleAuthLogout(c, options) {
 			name: HUBSPOT_APP_SID_COOKIE_NAME,
 			value: "",
 			path: "/",
+			sameSite: "None",
+			partitioned: true,
+			maxAge: 0
+		})
+	});
+	setResponseCookie({
+		c,
+		value: serializeCookie({
+			name: HUBSPOT_APP_ORIGIN_COOKIE_NAME,
+			value: "",
+			path: "/",
+			sameSite: "None",
+			partitioned: true,
 			maxAge: 0
 		})
 	});
@@ -85,6 +100,8 @@ async function handleAuthLogout(c, options) {
 				name: cookieName,
 				value: "",
 				path: refreshCookiePath,
+				sameSite: "None",
+				partitioned: true,
 				maxAge: 0
 			})
 		});

package/dist/server/hono/hubspot-connect-routes/auth-logout.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-logout.js","names":[],"sources":["../../../../src/server/hono/hubspot-connect-routes/auth-logout.ts"],"sourcesContent":["import type { Context } from 'hono';\n\nimport type { Logger } from '../../../shared/logger.ts';\nimport {\n  HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,\n  HUBSPOT_APP_SID_COOKIE_NAME,\n  HUBSPOT_REFRESH_COOKIE_PREFIX,\n} from '../../constants.ts';\nimport { parseCookies } from '../../utils/cookie-utils.ts';\nimport { serializeCookie, setResponseCookie } from '../utils/cookie-utils.ts';\nimport { buildClientAssertion } from './oauth-client.ts';\nimport type { HubSpotConnectOAuthRouteOptions } from './types.ts';\nimport { buildCimdClientIdUrlFromRequest } from './utils.ts';\n\nasync function revokeToken(options: {\n  revokeEndpointUrl: string;\n  body: URLSearchParams;\n  logger: Logger;\n}): Promise<void> {\n  const { revokeEndpointUrl, body, logger } = options;\n  try {\n    const response = await fetch(revokeEndpointUrl, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body,\n    });\n    if (!response.ok) {\n      logger.warn(\n        `HubSpot token revoke returned HTTP ${response.status} ${response.statusText}`\n      );\n    }\n  } catch (error) {\n    logger.warn('HubSpot token revoke request failed', error);\n  }\n}\n\nexport async function handleAuthLogout(\n  c: Context,\n  options: HubSpotConnectOAuthRouteOptions\n) {\n  const { appKeys, refreshCookiePath, basePath, hubspotConnectEnv, logger } =\n    options;\n  const xForwardedProto = c.req.header('x-forwarded-proto') ?? undefined;\n  const xForwardedHost = c.req.header('x-forwarded-host') ?? undefined;\n  const requestHostHeader = c.req.header('host') ?? undefined;\n  const cookies = parseCookies(c.req.header('Cookie'));\n  const accessToken = cookies[HUBSPOT_ACCESS_TOKEN_COOKIE_NAME];\n\n  const clientId = hubspotConnectEnv.isCimdEnabled\n    ? buildCimdClientIdUrlFromRequest({\n        requestUrl: c.req.url,\n        basePath,\n        xForwardedProto,\n        xForwardedHost,\n        requestHostHeader,\n      })\n    : hubspotConnectEnv.hubspotClientId;\n\n  const revokeEndpointUrl = new URL(\n    '/oauth/v1/revoke',\n    hubspotConnectEnv.hubspotOAuthApiOrigin\n  ).href;\n\n  if (accessToken) {\n    if (hubspotConnectEnv.isCimdEnabled) {\n      if (!appKeys) {\n        return c.json(\n          {\n            error:\n              'Server misconfiguration: HUBSPOT_APP_PRIVATE_KEY is required when CIMD is enabled',\n          },\n          500\n        );\n      }\n      const clientAssertion = await buildClientAssertion({\n        appKeys,\n        clientId,\n        audience: revokeEndpointUrl,\n      });\n      await revokeToken({\n        revokeEndpointUrl,\n        body: new URLSearchParams({\n          token: accessToken,\n          token_type_hint: 'access_token',\n          client_id: clientId,\n          client_assertion_type:\n            'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',\n          client_assertion: clientAssertion,\n        }),\n        logger,\n      });\n    } else {\n      await revokeToken({\n        revokeEndpointUrl,\n        body: new URLSearchParams({\n          token: accessToken,\n          token_type_hint: 'access_token',\n          client_id: clientId,\n          client_secret: hubspotConnectEnv.hubspotClientSecret,\n        }),\n        logger,\n      });\n    }\n  }\n\n  setResponseCookie({\n    c,\n    value: serializeCookie({\n      name: HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,\n      value: '',\n      path: '/',\n      maxAge: 0,\n    }),\n  });\n  setResponseCookie({\n    c,\n    value: serializeCookie({\n      name: HUBSPOT_APP_SID_COOKIE_NAME,\n      value: '',\n      path: '/',\n      maxAge: 0,\n    }),\n  });\n\n  Object.keys(cookies).forEach((cookieName) => {\n    if (cookieName.startsWith(HUBSPOT_REFRESH_COOKIE_PREFIX)) {\n      setResponseCookie({\n        c,\n        value: serializeCookie({\n          name: cookieName,\n          value: '',\n          path: refreshCookiePath,\n          maxAge: 0,\n        }),\n      });\n    }\n  });\n\n  return c.json({ redirect_to: '/' });\n}\n"],"mappings":";;;;;;AAcA,eAAe,YAAY,SAIT;CAChB,MAAM,EAAE,mBAAmB,MAAM,WAAW;CAC5C,IAAI;EACF,MAAM,WAAW,MAAM,MAAM,mBAAmB;GAC9C,QAAQ;GACR,SAAS,EAAE,gBAAgB,qCAAqC;GAChE;GACD,CAAC;EACF,IAAI,CAAC,SAAS,IACZ,OAAO,KACL,sCAAsC,SAAS,OAAO,GAAG,SAAS,aACnE;UAEI,OAAO;EACd,OAAO,KAAK,uCAAuC,MAAM;;;AAI7D,eAAsB,iBACpB,GACA,SACA;CACA,MAAM,EAAE,SAAS,mBAAmB,UAAU,mBAAmB,WAC/D;CACF,MAAM,kBAAkB,EAAE,IAAI,OAAO,oBAAoB,IAAI,KAAA;CAC7D,MAAM,iBAAiB,EAAE,IAAI,OAAO,mBAAmB,IAAI,KAAA;CAC3D,MAAM,oBAAoB,EAAE,IAAI,OAAO,OAAO,IAAI,KAAA;CAClD,MAAM,UAAU,aAAa,EAAE,IAAI,OAAO,SAAS,CAAC;CACpD,MAAM,cAAc,QAAQ;CAE5B,MAAM,WAAW,kBAAkB,gBAC/B,gCAAgC;EAC9B,YAAY,EAAE,IAAI;EAClB;EACA;EACA;EACA;EACD,CAAC,GACF,kBAAkB;CAEtB,MAAM,oBAAoB,IAAI,IAC5B,oBACA,kBAAkB,sBACnB,CAAC;CAEF,IAAI,aACF,IAAI,kBAAkB,eAAe;EACnC,IAAI,CAAC,SACH,OAAO,EAAE,KACP,EACE,OACE,qFACH,EACD,IACD;EAEH,MAAM,kBAAkB,MAAM,qBAAqB;GACjD;GACA;GACA,UAAU;GACX,CAAC;EACF,MAAM,YAAY;GAChB;GACA,MAAM,IAAI,gBAAgB;IACxB,OAAO;IACP,iBAAiB;IACjB,WAAW;IACX,uBACE;IACF,kBAAkB;IACnB,CAAC;GACF;GACD,CAAC;QAEF,MAAM,YAAY;EAChB;EACA,MAAM,IAAI,gBAAgB;GACxB,OAAO;GACP,iBAAiB;GACjB,WAAW;GACX,eAAe,kBAAkB;GAClC,CAAC;EACF;EACD,CAAC;CAIN,kBAAkB;EAChB;EACA,OAAO,gBAAgB;GACrB,MAAM;GACN,OAAO;GACP,MAAM;GACN,QAAQ;GACT,CAAC;EACH,CAAC;CACF,kBAAkB;EAChB;EACA,OAAO,gBAAgB;GACrB,MAAM;GACN,OAAO;GACP,MAAM;GACN,QAAQ;GACT,CAAC;EACH,CAAC;CAEF,OAAO,KAAK,QAAQ,CAAC,SAAS,eAAe;EAC3C,IAAI,WAAW,WAAA,cAAyC,EACtD,kBAAkB;GAChB;GACA,OAAO,gBAAgB;IACrB,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;IACT,CAAC;GACH,CAAC;GAEJ;CAEF,OAAO,EAAE,KAAK,EAAE,aAAa,KAAK,CAAC"}
+{"version":3,"file":"auth-logout.js","names":[],"sources":["../../../../src/server/hono/hubspot-connect-routes/auth-logout.ts"],"sourcesContent":["import type { Context } from 'hono';\n\nimport type { Logger } from '../../../shared/logger.ts';\nimport {\n  HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,\n  HUBSPOT_APP_ORIGIN_COOKIE_NAME,\n  HUBSPOT_APP_SID_COOKIE_NAME,\n  HUBSPOT_REFRESH_COOKIE_PREFIX,\n} from '../../constants.ts';\nimport { parseCookies } from '../../utils/cookie-utils.ts';\nimport { serializeCookie, setResponseCookie } from '../utils/cookie-utils.ts';\nimport { buildClientAssertion } from './oauth-client.ts';\nimport type { HubSpotConnectOAuthRouteOptions } from './types.ts';\nimport { buildCimdClientIdUrlFromRequest } from './utils.ts';\n\nasync function revokeToken(options: {\n  revokeEndpointUrl: string;\n  body: URLSearchParams;\n  logger: Logger;\n}): Promise<void> {\n  const { revokeEndpointUrl, body, logger } = options;\n  try {\n    const response = await fetch(revokeEndpointUrl, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body,\n    });\n    if (!response.ok) {\n      logger.warn(\n        `HubSpot token revoke returned HTTP ${response.status} ${response.statusText}`\n      );\n    }\n  } catch (error) {\n    logger.warn('HubSpot token revoke request failed', error);\n  }\n}\n\nexport async function handleAuthLogout(\n  c: Context,\n  options: HubSpotConnectOAuthRouteOptions\n) {\n  const { appKeys, refreshCookiePath, basePath, hubspotConnectEnv, logger } =\n    options;\n  const xForwardedProto = c.req.header('x-forwarded-proto') ?? undefined;\n  const xForwardedHost = c.req.header('x-forwarded-host') ?? undefined;\n  const requestHostHeader = c.req.header('host') ?? undefined;\n  const cookies = parseCookies(c.req.header('Cookie'));\n  const accessToken = cookies[HUBSPOT_ACCESS_TOKEN_COOKIE_NAME];\n\n  const clientId = hubspotConnectEnv.isCimdEnabled\n    ? buildCimdClientIdUrlFromRequest({\n        requestUrl: c.req.url,\n        basePath,\n        xForwardedProto,\n        xForwardedHost,\n        requestHostHeader,\n      })\n    : hubspotConnectEnv.hubspotClientId;\n\n  const revokeEndpointUrl = new URL(\n    '/oauth/v1/revoke',\n    hubspotConnectEnv.hubspotOAuthApiOrigin\n  ).href;\n\n  if (accessToken) {\n    if (hubspotConnectEnv.isCimdEnabled) {\n      if (!appKeys) {\n        return c.json(\n          {\n            error:\n              'Server misconfiguration: HUBSPOT_APP_PRIVATE_KEY is required when CIMD is enabled',\n          },\n          500\n        );\n      }\n      const clientAssertion = await buildClientAssertion({\n        appKeys,\n        clientId,\n        audience: revokeEndpointUrl,\n      });\n      await revokeToken({\n        revokeEndpointUrl,\n        body: new URLSearchParams({\n          token: accessToken,\n          token_type_hint: 'access_token',\n          client_id: clientId,\n          client_assertion_type:\n            'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',\n          client_assertion: clientAssertion,\n        }),\n        logger,\n      });\n    } else {\n      await revokeToken({\n        revokeEndpointUrl,\n        body: new URLSearchParams({\n          token: accessToken,\n          token_type_hint: 'access_token',\n          client_id: clientId,\n          client_secret: hubspotConnectEnv.hubspotClientSecret,\n        }),\n        logger,\n      });\n    }\n  }\n\n  setResponseCookie({\n    c,\n    value: serializeCookie({\n      name: HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,\n      value: '',\n      path: '/',\n      sameSite: 'None',\n      partitioned: true,\n      maxAge: 0,\n    }),\n  });\n  setResponseCookie({\n    c,\n    value: serializeCookie({\n      name: HUBSPOT_APP_SID_COOKIE_NAME,\n      value: '',\n      path: '/',\n      sameSite: 'None',\n      partitioned: true,\n      maxAge: 0,\n    }),\n  });\n  setResponseCookie({\n    c,\n    value: serializeCookie({\n      name: HUBSPOT_APP_ORIGIN_COOKIE_NAME,\n      value: '',\n      path: '/',\n      sameSite: 'None',\n      partitioned: true,\n      maxAge: 0,\n    }),\n  });\n\n  Object.keys(cookies).forEach((cookieName) => {\n    if (cookieName.startsWith(HUBSPOT_REFRESH_COOKIE_PREFIX)) {\n      setResponseCookie({\n        c,\n        value: serializeCookie({\n          name: cookieName,\n          value: '',\n          path: refreshCookiePath,\n          sameSite: 'None',\n          partitioned: true,\n          maxAge: 0,\n        }),\n      });\n    }\n  });\n\n  return c.json({ redirect_to: '/' });\n}\n"],"mappings":";;;;;;AAeA,eAAe,YAAY,SAIT;CAChB,MAAM,EAAE,mBAAmB,MAAM,WAAW;CAC5C,IAAI;EACF,MAAM,WAAW,MAAM,MAAM,mBAAmB;GAC9C,QAAQ;GACR,SAAS,EAAE,gBAAgB,qCAAqC;GAChE;GACD,CAAC;EACF,IAAI,CAAC,SAAS,IACZ,OAAO,KACL,sCAAsC,SAAS,OAAO,GAAG,SAAS,aACnE;UAEI,OAAO;EACd,OAAO,KAAK,uCAAuC,MAAM;;;AAI7D,eAAsB,iBACpB,GACA,SACA;CACA,MAAM,EAAE,SAAS,mBAAmB,UAAU,mBAAmB,WAC/D;CACF,MAAM,kBAAkB,EAAE,IAAI,OAAO,oBAAoB,IAAI,KAAA;CAC7D,MAAM,iBAAiB,EAAE,IAAI,OAAO,mBAAmB,IAAI,KAAA;CAC3D,MAAM,oBAAoB,EAAE,IAAI,OAAO,OAAO,IAAI,KAAA;CAClD,MAAM,UAAU,aAAa,EAAE,IAAI,OAAO,SAAS,CAAC;CACpD,MAAM,cAAc,QAAQ;CAE5B,MAAM,WAAW,kBAAkB,gBAC/B,gCAAgC;EAC9B,YAAY,EAAE,IAAI;EAClB;EACA;EACA;EACA;EACD,CAAC,GACF,kBAAkB;CAEtB,MAAM,oBAAoB,IAAI,IAC5B,oBACA,kBAAkB,sBACnB,CAAC;CAEF,IAAI,aACF,IAAI,kBAAkB,eAAe;EACnC,IAAI,CAAC,SACH,OAAO,EAAE,KACP,EACE,OACE,qFACH,EACD,IACD;EAEH,MAAM,kBAAkB,MAAM,qBAAqB;GACjD;GACA;GACA,UAAU;GACX,CAAC;EACF,MAAM,YAAY;GAChB;GACA,MAAM,IAAI,gBAAgB;IACxB,OAAO;IACP,iBAAiB;IACjB,WAAW;IACX,uBACE;IACF,kBAAkB;IACnB,CAAC;GACF;GACD,CAAC;QAEF,MAAM,YAAY;EAChB;EACA,MAAM,IAAI,gBAAgB;GACxB,OAAO;GACP,iBAAiB;GACjB,WAAW;GACX,eAAe,kBAAkB;GAClC,CAAC;EACF;EACD,CAAC;CAIN,kBAAkB;EAChB;EACA,OAAO,gBAAgB;GACrB,MAAM;GACN,OAAO;GACP,MAAM;GACN,UAAU;GACV,aAAa;GACb,QAAQ;GACT,CAAC;EACH,CAAC;CACF,kBAAkB;EAChB;EACA,OAAO,gBAAgB;GACrB,MAAM;GACN,OAAO;GACP,MAAM;GACN,UAAU;GACV,aAAa;GACb,QAAQ;GACT,CAAC;EACH,CAAC;CACF,kBAAkB;EAChB;EACA,OAAO,gBAAgB;GACrB,MAAM;GACN,OAAO;GACP,MAAM;GACN,UAAU;GACV,aAAa;GACb,QAAQ;GACT,CAAC;EACH,CAAC;CAEF,OAAO,KAAK,QAAQ,CAAC,SAAS,eAAe;EAC3C,IAAI,WAAW,WAAA,cAAyC,EACtD,kBAAkB;GAChB;GACA,OAAO,gBAAgB;IACrB,MAAM;IACN,OAAO;IACP,MAAM;IACN,UAAU;IACV,aAAa;IACb,QAAQ;IACT,CAAC;GACH,CAAC;GAEJ;CAEF,OAAO,EAAE,KAAK,EAAE,aAAa,KAAK,CAAC"}

package/dist/server/hono/hubspot-connect-routes/auth-refresh.js

@@ -70,6 +70,8 @@ async function handleAuthRefresh(c, options) {
 			name: HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,
 			value: newAccessToken,
 			path: "/",
+			sameSite: "None",
+			partitioned: true,
 			maxAge: expires_in
 		})
 	});
@@ -79,6 +81,8 @@ async function handleAuthRefresh(c, options) {
 			name: refreshCookieName,
 			value: newRefreshToken,
 			path: refreshCookiePath,
+			sameSite: "None",
+			partitioned: true,
 			maxAge: REFRESH_COOKIE_MAX_AGE_SEC
 		})
 	});
@@ -89,6 +93,8 @@ async function handleAuthRefresh(c, options) {
 				name: cookieName,
 				value: "",
 				path: refreshCookiePath,
+				sameSite: "None",
+				partitioned: true,
 				maxAge: 0
 			})
 		});

package/dist/server/hono/hubspot-connect-routes/auth-refresh.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-refresh.js","names":[],"sources":["../../../../src/server/hono/hubspot-connect-routes/auth-refresh.ts"],"sourcesContent":["import type { Context } from 'hono';\n\nimport {\n  HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,\n  HUBSPOT_APP_SID_COOKIE_NAME,\n  HUBSPOT_REFRESH_COOKIE_PREFIX,\n} from '../../constants.ts';\nimport { parseCookies } from '../../utils/cookie-utils.ts';\nimport { sha256base64url } from '../../utils/crypto-utils.ts';\nimport { serializeCookie, setResponseCookie } from '../utils/cookie-utils.ts';\nimport { REFRESH_COOKIE_MAX_AGE_SEC } from './constants.ts';\nimport {\n  buildClientAssertion,\n  buildClientAssertionFormParams,\n  buildClientSecretFormParams,\n  buildTokenEndpointDpopProof,\n  requestOAuthToken,\n} from './oauth-client.ts';\nimport type { HubSpotConnectOAuthRouteOptions } from './types.ts';\nimport {\n  buildCimdClientIdUrlFromRequest,\n  isPositiveFiniteNumber,\n} from './utils.ts';\n\nexport async function handleAuthRefresh(\n  c: Context,\n  options: HubSpotConnectOAuthRouteOptions\n) {\n  const { appKeys, refreshCookiePath, basePath, hubspotConnectEnv } = options;\n  const xForwardedProto = c.req.header('x-forwarded-proto') ?? undefined;\n  const xForwardedHost = c.req.header('x-forwarded-host') ?? undefined;\n  const requestHostHeader = c.req.header('host') ?? undefined;\n  const cookies = parseCookies(c.req.header('Cookie'));\n  const sessionId = cookies[HUBSPOT_APP_SID_COOKIE_NAME];\n  if (!sessionId) {\n    return c.json({ error: 'Missing session cookie' }, 401);\n  }\n\n  if (hubspotConnectEnv.isAppPrivateKeyRequired && !appKeys) {\n    return c.json(\n      {\n        error:\n          'Server misconfiguration: HUBSPOT_APP_PRIVATE_KEY is required when CIMD or DPoP is enabled',\n      },\n      500\n    );\n  }\n\n  const sidHash = await sha256base64url(sessionId);\n  const refreshCookieName = `${HUBSPOT_REFRESH_COOKIE_PREFIX}${sidHash}`;\n  const refreshToken = cookies[refreshCookieName];\n  if (!refreshToken) {\n    return c.json({ error: 'Missing refresh token' }, 401);\n  }\n\n  const clientId = hubspotConnectEnv.isCimdEnabled\n    ? buildCimdClientIdUrlFromRequest({\n        requestUrl: c.req.url,\n        basePath,\n        xForwardedProto,\n        xForwardedHost,\n        requestHostHeader,\n      })\n    : hubspotConnectEnv.hubspotClientId;\n\n  const tokenEndpointUrl = new URL(\n    '/oauth/v1/token',\n    hubspotConnectEnv.hubspotOAuthApiOrigin\n  ).href;\n\n  let dpopProof: string | undefined;\n  if (hubspotConnectEnv.isDpopEnabled) {\n    dpopProof = await buildTokenEndpointDpopProof({\n      appKeys: appKeys!,\n      tokenEndpointUrl,\n      sessionIdHash: sidHash,\n    });\n  }\n\n  let formParams: Record<string, string>;\n  if (hubspotConnectEnv.isCimdEnabled) {\n    const clientAssertion = await buildClientAssertion({\n      appKeys: appKeys!,\n      clientId,\n      audience: tokenEndpointUrl,\n    });\n    formParams = {\n      grant_type: 'refresh_token',\n      refresh_token: refreshToken,\n      ...buildClientAssertionFormParams({ clientId, clientAssertion }),\n    };\n  } else {\n    formParams = {\n      grant_type: 'refresh_token',\n      refresh_token: refreshToken,\n      ...buildClientSecretFormParams({\n        clientId,\n        clientSecret: hubspotConnectEnv.hubspotClientSecret,\n      }),\n    };\n  }\n\n  const tokenResult = await requestOAuthToken({\n    tokenEndpointUrl,\n    isDpopEnabled: hubspotConnectEnv.isDpopEnabled,\n    ...(dpopProof !== undefined ? { dpopProof } : {}),\n    formParams,\n  });\n  if (!tokenResult.ok) {\n    return c.json(\n      { error: `Token refresh failed: ${tokenResult.errorText}` },\n      502\n    );\n  }\n\n  const {\n    access_token: newAccessToken,\n    refresh_token: newRefreshToken,\n    expires_in,\n  } = tokenResult.body;\n\n  if (!newRefreshToken) {\n    return c.json({ error: 'Token response missing refresh_token' }, 502);\n  }\n  if (!isPositiveFiniteNumber(expires_in)) {\n    return c.json(\n      { error: 'Token response missing or invalid expires_in' },\n      502\n    );\n  }\n\n  setResponseCookie({\n    c,\n    value: serializeCookie({\n      name: HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,\n      value: newAccessToken,\n      path: '/',\n      maxAge: expires_in,\n    }),\n  });\n  setResponseCookie({\n    c,\n    value: serializeCookie({\n      name: refreshCookieName,\n      value: newRefreshToken,\n      path: refreshCookiePath,\n      maxAge: REFRESH_COOKIE_MAX_AGE_SEC,\n    }),\n  });\n\n  // Cookies prefixed with HUBSPOT_REFRESH_COOKIE_PREFIX that don't match the\n  // new refresh cookie name are stale and need to be cleared.\n  Object.keys(cookies).forEach((cookieName) => {\n    if (\n      cookieName.startsWith(HUBSPOT_REFRESH_COOKIE_PREFIX) &&\n      cookieName !== refreshCookieName\n    ) {\n      setResponseCookie({\n        c,\n        value: serializeCookie({\n          name: cookieName,\n          value: '',\n          path: refreshCookiePath,\n          maxAge: 0,\n        }),\n      });\n    }\n  });\n\n  return c.json({ expires_in });\n}\n"],"mappings":";;;;;;;;AAwBA,eAAsB,kBACpB,GACA,SACA;CACA,MAAM,EAAE,SAAS,mBAAmB,UAAU,sBAAsB;CACpE,MAAM,kBAAkB,EAAE,IAAI,OAAO,oBAAoB,IAAI,KAAA;CAC7D,MAAM,iBAAiB,EAAE,IAAI,OAAO,mBAAmB,IAAI,KAAA;CAC3D,MAAM,oBAAoB,EAAE,IAAI,OAAO,OAAO,IAAI,KAAA;CAClD,MAAM,UAAU,aAAa,EAAE,IAAI,OAAO,SAAS,CAAC;CACpD,MAAM,YAAY,QAAQ;CAC1B,IAAI,CAAC,WACH,OAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,IAAI;CAGzD,IAAI,kBAAkB,2BAA2B,CAAC,SAChD,OAAO,EAAE,KACP,EACE,OACE,6FACH,EACD,IACD;CAGH,MAAM,UAAU,MAAM,gBAAgB,UAAU;CAChD,MAAM,oBAAoB,GAAG,gCAAgC;CAC7D,MAAM,eAAe,QAAQ;CAC7B,IAAI,CAAC,cACH,OAAO,EAAE,KAAK,EAAE,OAAO,yBAAyB,EAAE,IAAI;CAGxD,MAAM,WAAW,kBAAkB,gBAC/B,gCAAgC;EAC9B,YAAY,EAAE,IAAI;EAClB;EACA;EACA;EACA;EACD,CAAC,GACF,kBAAkB;CAEtB,MAAM,mBAAmB,IAAI,IAC3B,mBACA,kBAAkB,sBACnB,CAAC;CAEF,IAAI;CACJ,IAAI,kBAAkB,eACpB,YAAY,MAAM,4BAA4B;EACnC;EACT;EACA,eAAe;EAChB,CAAC;CAGJ,IAAI;CACJ,IAAI,kBAAkB,eAMpB,aAAa;EACX,YAAY;EACZ,eAAe;EACf,GAAG,+BAA+B;GAAE;GAAU,iBAAA,MARlB,qBAAqB;IACxC;IACT;IACA,UAAU;IACX,CAAC;GAI+D,CAAC;EACjE;MAED,aAAa;EACX,YAAY;EACZ,eAAe;EACf,GAAG,4BAA4B;GAC7B;GACA,cAAc,kBAAkB;GACjC,CAAC;EACH;CAGH,MAAM,cAAc,MAAM,kBAAkB;EAC1C;EACA,eAAe,kBAAkB;EACjC,GAAI,cAAc,KAAA,IAAY,EAAE,WAAW,GAAG,EAAE;EAChD;EACD,CAAC;CACF,IAAI,CAAC,YAAY,IACf,OAAO,EAAE,KACP,EAAE,OAAO,yBAAyB,YAAY,aAAa,EAC3D,IACD;CAGH,MAAM,EACJ,cAAc,gBACd,eAAe,iBACf,eACE,YAAY;CAEhB,IAAI,CAAC,iBACH,OAAO,EAAE,KAAK,EAAE,OAAO,wCAAwC,EAAE,IAAI;CAEvE,IAAI,CAAC,uBAAuB,WAAW,EACrC,OAAO,EAAE,KACP,EAAE,OAAO,gDAAgD,EACzD,IACD;CAGH,kBAAkB;EAChB;EACA,OAAO,gBAAgB;GACrB,MAAM;GACN,OAAO;GACP,MAAM;GACN,QAAQ;GACT,CAAC;EACH,CAAC;CACF,kBAAkB;EAChB;EACA,OAAO,gBAAgB;GACrB,MAAM;GACN,OAAO;GACP,MAAM;GACN,QAAQ;GACT,CAAC;EACH,CAAC;CAIF,OAAO,KAAK,QAAQ,CAAC,SAAS,eAAe;EAC3C,IACE,WAAW,WAAA,cAAyC,IACpD,eAAe,mBAEf,kBAAkB;GAChB;GACA,OAAO,gBAAgB;IACrB,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;IACT,CAAC;GACH,CAAC;GAEJ;CAEF,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC"}
+{"version":3,"file":"auth-refresh.js","names":[],"sources":["../../../../src/server/hono/hubspot-connect-routes/auth-refresh.ts"],"sourcesContent":["import type { Context } from 'hono';\n\nimport {\n  HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,\n  HUBSPOT_APP_SID_COOKIE_NAME,\n  HUBSPOT_REFRESH_COOKIE_PREFIX,\n} from '../../constants.ts';\nimport { parseCookies } from '../../utils/cookie-utils.ts';\nimport { sha256base64url } from '../../utils/crypto-utils.ts';\nimport { serializeCookie, setResponseCookie } from '../utils/cookie-utils.ts';\nimport { REFRESH_COOKIE_MAX_AGE_SEC } from './constants.ts';\nimport {\n  buildClientAssertion,\n  buildClientAssertionFormParams,\n  buildClientSecretFormParams,\n  buildTokenEndpointDpopProof,\n  requestOAuthToken,\n} from './oauth-client.ts';\nimport type { HubSpotConnectOAuthRouteOptions } from './types.ts';\nimport {\n  buildCimdClientIdUrlFromRequest,\n  isPositiveFiniteNumber,\n} from './utils.ts';\n\nexport async function handleAuthRefresh(\n  c: Context,\n  options: HubSpotConnectOAuthRouteOptions\n) {\n  const { appKeys, refreshCookiePath, basePath, hubspotConnectEnv } = options;\n  const xForwardedProto = c.req.header('x-forwarded-proto') ?? undefined;\n  const xForwardedHost = c.req.header('x-forwarded-host') ?? undefined;\n  const requestHostHeader = c.req.header('host') ?? undefined;\n  const cookies = parseCookies(c.req.header('Cookie'));\n  const sessionId = cookies[HUBSPOT_APP_SID_COOKIE_NAME];\n  if (!sessionId) {\n    return c.json({ error: 'Missing session cookie' }, 401);\n  }\n\n  if (hubspotConnectEnv.isAppPrivateKeyRequired && !appKeys) {\n    return c.json(\n      {\n        error:\n          'Server misconfiguration: HUBSPOT_APP_PRIVATE_KEY is required when CIMD or DPoP is enabled',\n      },\n      500\n    );\n  }\n\n  const sidHash = await sha256base64url(sessionId);\n  const refreshCookieName = `${HUBSPOT_REFRESH_COOKIE_PREFIX}${sidHash}`;\n  const refreshToken = cookies[refreshCookieName];\n  if (!refreshToken) {\n    return c.json({ error: 'Missing refresh token' }, 401);\n  }\n\n  const clientId = hubspotConnectEnv.isCimdEnabled\n    ? buildCimdClientIdUrlFromRequest({\n        requestUrl: c.req.url,\n        basePath,\n        xForwardedProto,\n        xForwardedHost,\n        requestHostHeader,\n      })\n    : hubspotConnectEnv.hubspotClientId;\n\n  const tokenEndpointUrl = new URL(\n    '/oauth/v1/token',\n    hubspotConnectEnv.hubspotOAuthApiOrigin\n  ).href;\n\n  let dpopProof: string | undefined;\n  if (hubspotConnectEnv.isDpopEnabled) {\n    dpopProof = await buildTokenEndpointDpopProof({\n      appKeys: appKeys!,\n      tokenEndpointUrl,\n      sessionIdHash: sidHash,\n    });\n  }\n\n  let formParams: Record<string, string>;\n  if (hubspotConnectEnv.isCimdEnabled) {\n    const clientAssertion = await buildClientAssertion({\n      appKeys: appKeys!,\n      clientId,\n      audience: tokenEndpointUrl,\n    });\n    formParams = {\n      grant_type: 'refresh_token',\n      refresh_token: refreshToken,\n      ...buildClientAssertionFormParams({ clientId, clientAssertion }),\n    };\n  } else {\n    formParams = {\n      grant_type: 'refresh_token',\n      refresh_token: refreshToken,\n      ...buildClientSecretFormParams({\n        clientId,\n        clientSecret: hubspotConnectEnv.hubspotClientSecret,\n      }),\n    };\n  }\n\n  const tokenResult = await requestOAuthToken({\n    tokenEndpointUrl,\n    isDpopEnabled: hubspotConnectEnv.isDpopEnabled,\n    ...(dpopProof !== undefined ? { dpopProof } : {}),\n    formParams,\n  });\n  if (!tokenResult.ok) {\n    return c.json(\n      { error: `Token refresh failed: ${tokenResult.errorText}` },\n      502\n    );\n  }\n\n  const {\n    access_token: newAccessToken,\n    refresh_token: newRefreshToken,\n    expires_in,\n  } = tokenResult.body;\n\n  if (!newRefreshToken) {\n    return c.json({ error: 'Token response missing refresh_token' }, 502);\n  }\n  if (!isPositiveFiniteNumber(expires_in)) {\n    return c.json(\n      { error: 'Token response missing or invalid expires_in' },\n      502\n    );\n  }\n\n  setResponseCookie({\n    c,\n    value: serializeCookie({\n      name: HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,\n      value: newAccessToken,\n      path: '/',\n      sameSite: 'None',\n      partitioned: true,\n      maxAge: expires_in,\n    }),\n  });\n  setResponseCookie({\n    c,\n    value: serializeCookie({\n      name: refreshCookieName,\n      value: newRefreshToken,\n      path: refreshCookiePath,\n      sameSite: 'None',\n      partitioned: true,\n      maxAge: REFRESH_COOKIE_MAX_AGE_SEC,\n    }),\n  });\n\n  // Cookies prefixed with HUBSPOT_REFRESH_COOKIE_PREFIX that don't match the\n  // new refresh cookie name are stale and need to be cleared.\n  Object.keys(cookies).forEach((cookieName) => {\n    if (\n      cookieName.startsWith(HUBSPOT_REFRESH_COOKIE_PREFIX) &&\n      cookieName !== refreshCookieName\n    ) {\n      setResponseCookie({\n        c,\n        value: serializeCookie({\n          name: cookieName,\n          value: '',\n          path: refreshCookiePath,\n          sameSite: 'None',\n          partitioned: true,\n          maxAge: 0,\n        }),\n      });\n    }\n  });\n\n  return c.json({ expires_in });\n}\n"],"mappings":";;;;;;;;AAwBA,eAAsB,kBACpB,GACA,SACA;CACA,MAAM,EAAE,SAAS,mBAAmB,UAAU,sBAAsB;CACpE,MAAM,kBAAkB,EAAE,IAAI,OAAO,oBAAoB,IAAI,KAAA;CAC7D,MAAM,iBAAiB,EAAE,IAAI,OAAO,mBAAmB,IAAI,KAAA;CAC3D,MAAM,oBAAoB,EAAE,IAAI,OAAO,OAAO,IAAI,KAAA;CAClD,MAAM,UAAU,aAAa,EAAE,IAAI,OAAO,SAAS,CAAC;CACpD,MAAM,YAAY,QAAQ;CAC1B,IAAI,CAAC,WACH,OAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,EAAE,IAAI;CAGzD,IAAI,kBAAkB,2BAA2B,CAAC,SAChD,OAAO,EAAE,KACP,EACE,OACE,6FACH,EACD,IACD;CAGH,MAAM,UAAU,MAAM,gBAAgB,UAAU;CAChD,MAAM,oBAAoB,GAAG,gCAAgC;CAC7D,MAAM,eAAe,QAAQ;CAC7B,IAAI,CAAC,cACH,OAAO,EAAE,KAAK,EAAE,OAAO,yBAAyB,EAAE,IAAI;CAGxD,MAAM,WAAW,kBAAkB,gBAC/B,gCAAgC;EAC9B,YAAY,EAAE,IAAI;EAClB;EACA;EACA;EACA;EACD,CAAC,GACF,kBAAkB;CAEtB,MAAM,mBAAmB,IAAI,IAC3B,mBACA,kBAAkB,sBACnB,CAAC;CAEF,IAAI;CACJ,IAAI,kBAAkB,eACpB,YAAY,MAAM,4BAA4B;EACnC;EACT;EACA,eAAe;EAChB,CAAC;CAGJ,IAAI;CACJ,IAAI,kBAAkB,eAMpB,aAAa;EACX,YAAY;EACZ,eAAe;EACf,GAAG,+BAA+B;GAAE;GAAU,iBAAA,MARlB,qBAAqB;IACxC;IACT;IACA,UAAU;IACX,CAAC;GAI+D,CAAC;EACjE;MAED,aAAa;EACX,YAAY;EACZ,eAAe;EACf,GAAG,4BAA4B;GAC7B;GACA,cAAc,kBAAkB;GACjC,CAAC;EACH;CAGH,MAAM,cAAc,MAAM,kBAAkB;EAC1C;EACA,eAAe,kBAAkB;EACjC,GAAI,cAAc,KAAA,IAAY,EAAE,WAAW,GAAG,EAAE;EAChD;EACD,CAAC;CACF,IAAI,CAAC,YAAY,IACf,OAAO,EAAE,KACP,EAAE,OAAO,yBAAyB,YAAY,aAAa,EAC3D,IACD;CAGH,MAAM,EACJ,cAAc,gBACd,eAAe,iBACf,eACE,YAAY;CAEhB,IAAI,CAAC,iBACH,OAAO,EAAE,KAAK,EAAE,OAAO,wCAAwC,EAAE,IAAI;CAEvE,IAAI,CAAC,uBAAuB,WAAW,EACrC,OAAO,EAAE,KACP,EAAE,OAAO,gDAAgD,EACzD,IACD;CAGH,kBAAkB;EAChB;EACA,OAAO,gBAAgB;GACrB,MAAM;GACN,OAAO;GACP,MAAM;GACN,UAAU;GACV,aAAa;GACb,QAAQ;GACT,CAAC;EACH,CAAC;CACF,kBAAkB;EAChB;EACA,OAAO,gBAAgB;GACrB,MAAM;GACN,OAAO;GACP,MAAM;GACN,UAAU;GACV,aAAa;GACb,QAAQ;GACT,CAAC;EACH,CAAC;CAIF,OAAO,KAAK,QAAQ,CAAC,SAAS,eAAe;EAC3C,IACE,WAAW,WAAA,cAAyC,IACpD,eAAe,mBAEf,kBAAkB;GAChB;GACA,OAAO,gBAAgB;IACrB,MAAM;IACN,OAAO;IACP,MAAM;IACN,UAAU;IACV,aAAa;IACb,QAAQ;IACT,CAAC;GACH,CAAC;GAEJ;CAEF,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC"}

package/dist/server/hono/hubspot-connect-routes/hubspot-connect-routes.js

@@ -1,6 +1,7 @@
 import { assertHubSpotConnectCimdClientMetadata } from "./cimd-client-metadata-types.js";
 import { noopLogger } from "../../shared/logger.js";
-import { handleAuthCallback } from "./auth-callback.js";
+import { corsMiddleware } from "../utils/cors-middleware.js";
+import { handleAuthComplete } from "./auth-complete.js";
 import { handleAuthInitSession } from "./auth-init-session.js";
 import { handleAuthLogout } from "./auth-logout.js";
 import { handleAuthRefresh } from "./auth-refresh.js";
@@ -22,10 +23,11 @@ function registerHubSpotConnectRoutes(options) {
 		hubspotConnectEnv,
 		cimdClientMetadata
 	};
+	app.use("*", corsMiddleware());
 	app.get("/client.json", (c) => handleCimdClientJson(c, oauthRouteOptions));
 	if (hubspotConnectEnv.isCimdEnabled) app.get("/jwks.json", (c) => handleCimdAppJwks(c, oauthRouteOptions));
 	app.get("/auth/init-session", (c) => handleAuthInitSession(c, oauthRouteOptions));
-	app.get("/auth/callback", (c) => handleAuthCallback(c, oauthRouteOptions));
+	app.post("/auth/complete", (c) => handleAuthComplete(c, oauthRouteOptions));
 	app.post("/auth/refresh", (c) => handleAuthRefresh(c, oauthRouteOptions));
 	app.post("/auth/logout", (c) => handleAuthLogout(c, oauthRouteOptions));
 }

package/dist/server/hono/hubspot-connect-routes/hubspot-connect-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"hubspot-connect-routes.js","names":[],"sources":["../../../../src/server/hono/hubspot-connect-routes/hubspot-connect-routes.ts"],"sourcesContent":["import type { Hono } from 'hono';\n\nimport { noopLogger, type Logger } from '../../../shared/logger.ts';\nimport type { AppKeys } from '../../types.ts';\nimport { handleAuthCallback } from './auth-callback.ts';\nimport { handleAuthInitSession } from './auth-init-session.ts';\nimport { handleAuthLogout } from './auth-logout.ts';\nimport { handleAuthRefresh } from './auth-refresh.ts';\nimport { assertHubSpotConnectCimdClientMetadata } from './cimd-client-metadata-types.ts';\nimport type { HubSpotConnectCimdClientMetadata } from './cimd-client-metadata-types.ts';\nimport {\n  handleCimdAppJwks,\n  handleCimdClientJson,\n} from './cimd-public-routes.ts';\nimport type { HubSpotConnectRoutesEnv } from './load-hubspot-connect-routes-env.ts';\n\n/**\n * Options accepted by {@link registerHubSpotConnectRoutes}.\n */\nexport interface RegisterHubSpotConnectRoutesOptions {\n  /** The Hono app to mount the OAuth routes on. */\n  app: Hono;\n  /**\n   * Imported app keys from `secureStart`, or `null` when CIMD and DPoP\n   * are both disabled.\n   */\n  appKeys: AppKeys | null;\n  /**\n   * Path the routes are mounted under (no trailing slash). Used to\n   * scope refresh-token cookies via `Path=${basePath}/auth`.\n   */\n  basePath: string;\n  /**\n   * OAuth and client-mode settings, typically from\n   * {@link loadHubSpotConnectRoutesEnv}.\n   */\n  hubspotConnectEnv: HubSpotConnectRoutesEnv;\n  /**\n   * Scope configuration for `GET /client.json` and for authorize URL\n   * scopes when CIMD is off. Always required.\n   */\n  cimdClientMetadata: HubSpotConnectCimdClientMetadata;\n  /**\n   * Optional logger. When omitted the SDK uses a no-op logger so\n   * server-side state never leaks into the host application's\n   * console.\n   */\n  logger?: Logger;\n}\n\n/**\n * Mounts hubspot-connect routes: OAuth (`/auth/...`); `GET /client.json`\n * from `cimdClientMetadata`; `GET /jwks.json` when CIMD is enabled.\n */\nexport function registerHubSpotConnectRoutes(\n  options: RegisterHubSpotConnectRoutesOptions\n): void {\n  const {\n    app,\n    appKeys,\n    basePath,\n    hubspotConnectEnv,\n    cimdClientMetadata,\n    logger = noopLogger,\n  } = options;\n\n  if (!cimdClientMetadata) {\n    throw new Error(\n      'registerHubSpotConnectRoutes: cimdClientMetadata is required'\n    );\n  }\n  assertHubSpotConnectCimdClientMetadata(cimdClientMetadata);\n\n  const refreshCookiePath = `${basePath}/auth`;\n  const oauthRouteOptions = {\n    appKeys,\n    refreshCookiePath,\n    logger,\n    basePath,\n    hubspotConnectEnv,\n    cimdClientMetadata,\n  };\n\n  app.get('/client.json', (c) => handleCimdClientJson(c, oauthRouteOptions));\n  if (hubspotConnectEnv.isCimdEnabled) {\n    app.get('/jwks.json', (c) => handleCimdAppJwks(c, oauthRouteOptions));\n  }\n\n  app.get('/auth/init-session', (c) =>\n    handleAuthInitSession(c, oauthRouteOptions)\n  );\n  app.get('/auth/callback', (c) => handleAuthCallback(c, oauthRouteOptions));\n  app.post('/auth/refresh', (c) => handleAuthRefresh(c, oauthRouteOptions));\n  app.post('/auth/logout', (c) => handleAuthLogout(c, oauthRouteOptions));\n}\n"],"mappings":";;;;;;;;;;;;AAsDA,SAAgB,6BACd,SACM;CACN,MAAM,EACJ,KACA,SACA,UACA,mBACA,oBACA,SAAS,eACP;CAEJ,IAAI,CAAC,oBACH,MAAM,IAAI,MACR,+DACD;CAEH,uCAAuC,mBAAmB;CAG1D,MAAM,oBAAoB;EACxB;EACA,mBAAA,GAH2B,SAAS;EAIpC;EACA;EACA;EACA;EACD;CAED,IAAI,IAAI,iBAAiB,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;CAC1E,IAAI,kBAAkB,eACpB,IAAI,IAAI,eAAe,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;CAGvE,IAAI,IAAI,uBAAuB,MAC7B,sBAAsB,GAAG,kBAAkB,CAC5C;CACD,IAAI,IAAI,mBAAmB,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;CAC1E,IAAI,KAAK,kBAAkB,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;CACzE,IAAI,KAAK,iBAAiB,MAAM,iBAAiB,GAAG,kBAAkB,CAAC"}
+{"version":3,"file":"hubspot-connect-routes.js","names":[],"sources":["../../../../src/server/hono/hubspot-connect-routes/hubspot-connect-routes.ts"],"sourcesContent":["import type { Hono } from 'hono';\n\nimport { noopLogger, type Logger } from '../../../shared/logger.ts';\nimport type { AppKeys } from '../../types.ts';\nimport { corsMiddleware } from '../utils/cors-middleware.ts';\nimport { handleAuthComplete } from './auth-complete.ts';\nimport { handleAuthInitSession } from './auth-init-session.ts';\nimport { handleAuthLogout } from './auth-logout.ts';\nimport { handleAuthRefresh } from './auth-refresh.ts';\nimport { assertHubSpotConnectCimdClientMetadata } from './cimd-client-metadata-types.ts';\nimport type { HubSpotConnectCimdClientMetadata } from './cimd-client-metadata-types.ts';\nimport {\n  handleCimdAppJwks,\n  handleCimdClientJson,\n} from './cimd-public-routes.ts';\nimport type { HubSpotConnectRoutesEnv } from './load-hubspot-connect-routes-env.ts';\n\n/**\n * Options accepted by {@link registerHubSpotConnectRoutes}.\n */\nexport interface RegisterHubSpotConnectRoutesOptions {\n  /** The Hono app to mount the OAuth routes on. */\n  app: Hono;\n  /**\n   * Imported app keys from `secureStart`, or `null` when CIMD and DPoP\n   * are both disabled.\n   */\n  appKeys: AppKeys | null;\n  /**\n   * Path the routes are mounted under (no trailing slash). Used to\n   * scope refresh-token cookies via `Path=${basePath}/auth`.\n   */\n  basePath: string;\n  /**\n   * OAuth and client-mode settings, typically from\n   * {@link loadHubSpotConnectRoutesEnv}.\n   */\n  hubspotConnectEnv: HubSpotConnectRoutesEnv;\n  /**\n   * Scope configuration for `GET /client.json` and for authorize URL\n   * scopes when CIMD is off. Always required.\n   */\n  cimdClientMetadata: HubSpotConnectCimdClientMetadata;\n  /**\n   * Optional logger. When omitted the SDK uses a no-op logger so\n   * server-side state never leaks into the host application's\n   * console.\n   */\n  logger?: Logger;\n}\n\n/**\n * Mounts hubspot-connect routes: OAuth (`/auth/...`); `GET /client.json`\n * from `cimdClientMetadata`; `GET /jwks.json` when CIMD is enabled.\n */\nexport function registerHubSpotConnectRoutes(\n  options: RegisterHubSpotConnectRoutesOptions\n): void {\n  const {\n    app,\n    appKeys,\n    basePath,\n    hubspotConnectEnv,\n    cimdClientMetadata,\n    logger = noopLogger,\n  } = options;\n\n  if (!cimdClientMetadata) {\n    throw new Error(\n      'registerHubSpotConnectRoutes: cimdClientMetadata is required'\n    );\n  }\n  assertHubSpotConnectCimdClientMetadata(cimdClientMetadata);\n\n  const refreshCookiePath = `${basePath}/auth`;\n  const oauthRouteOptions = {\n    appKeys,\n    refreshCookiePath,\n    logger,\n    basePath,\n    hubspotConnectEnv,\n    cimdClientMetadata,\n  };\n\n  // Credentialed CORS for the cross-origin Lovable / Supabase shape.\n  // Echoes the request `Origin` (or the pinned `__Host-hs_app_origin`\n  // cookie value once init-session has run) and short-circuits OPTIONS\n  // preflights with a 204 before any route handler runs.\n  app.use('*', corsMiddleware());\n\n  app.get('/client.json', (c) => handleCimdClientJson(c, oauthRouteOptions));\n  if (hubspotConnectEnv.isCimdEnabled) {\n    app.get('/jwks.json', (c) => handleCimdAppJwks(c, oauthRouteOptions));\n  }\n\n  app.get('/auth/init-session', (c) =>\n    handleAuthInitSession(c, oauthRouteOptions)\n  );\n  app.post('/auth/complete', (c) => handleAuthComplete(c, oauthRouteOptions));\n  app.post('/auth/refresh', (c) => handleAuthRefresh(c, oauthRouteOptions));\n  app.post('/auth/logout', (c) => handleAuthLogout(c, oauthRouteOptions));\n}\n"],"mappings":";;;;;;;;;;;;;AAuDA,SAAgB,6BACd,SACM;CACN,MAAM,EACJ,KACA,SACA,UACA,mBACA,oBACA,SAAS,eACP;CAEJ,IAAI,CAAC,oBACH,MAAM,IAAI,MACR,+DACD;CAEH,uCAAuC,mBAAmB;CAG1D,MAAM,oBAAoB;EACxB;EACA,mBAAA,GAH2B,SAAS;EAIpC;EACA;EACA;EACA;EACD;CAMD,IAAI,IAAI,KAAK,gBAAgB,CAAC;CAE9B,IAAI,IAAI,iBAAiB,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;CAC1E,IAAI,kBAAkB,eACpB,IAAI,IAAI,eAAe,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;CAGvE,IAAI,IAAI,uBAAuB,MAC7B,sBAAsB,GAAG,kBAAkB,CAC5C;CACD,IAAI,KAAK,mBAAmB,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;CAC3E,IAAI,KAAK,kBAAkB,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;CACzE,IAAI,KAAK,iBAAiB,MAAM,iBAAiB,GAAG,kBAAkB,CAAC"}

package/dist/server/hono/hubspot-connect-routes/utils.js

@@ -1,3 +1,4 @@
+import { HUBSPOT_FRONTEND_CALLBACK_PATH } from "../../shared/constants.js";
 import { serializeCookie } from "../utils/cookie-utils.js";
 //#region src/server/hono/hubspot-connect-routes/utils.ts
 function clearTempCookie(name) {
@@ -5,10 +6,56 @@ function clearTempCookie(name) {
 		name,
 		value: "",
 		path: "/",
-		sameSite: "Lax",
-		maxAge: 0
+		sameSite: "None",
+		maxAge: 0,
+		partitioned: true
 	});
 }
+/**
+* Parses the request `Origin` header into the canonical origin
+* string (`URL.origin`) or returns `null` when the header is
+* missing, malformed, or carries a scheme/host the SDK does not
+* accept.
+*
+* Accepted shapes:
+*
+* - `https://<host>` for production deployments.
+* - `http://localhost[:<port>]` and `http://127.0.0.1[:<port>]`
+*   for local development; browsers exempt these from the `Secure`
+*   cookie restriction.
+*
+* Rejects values with a path/query/hash component (the request
+* `Origin` header is by spec a bare origin, so anything else
+* indicates a malformed or hostile request).
+*/
+function parseAppOriginHeader(originHeader) {
+	if (!originHeader) return null;
+	let parsed;
+	try {
+		parsed = new URL(originHeader);
+	} catch {
+		return null;
+	}
+	if (parsed.pathname !== "/" && parsed.pathname !== "") return null;
+	if (parsed.search !== "" || parsed.hash !== "") return null;
+	if (parsed.protocol === "https:") return parsed.origin;
+	if (parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1")) return parsed.origin;
+	return null;
+}
+/**
+* OAuth `redirect_uri` for the cross-origin app shape: the OAuth
+* callback lands on the **frontend** origin (not the SDK's edge
+* function host), so all cookies set by `init-session` and read by
+* `auth/complete` live in the same `(frontend, edge)` CHIPS
+* partition.
+*
+* Used by `auth/init-session` (when building `authorization_url`)
+* and `auth/complete` (which must rebuild the same value to satisfy
+* the OAuth token endpoint's `redirect_uri` check).
+*/
+function buildFrontendOAuthRedirectUri(appOrigin) {
+	return `${appOrigin}${HUBSPOT_FRONTEND_CALLBACK_PATH}`;
+}
 function isSafeReturnPath(rawPath) {
 	if (!rawPath.startsWith("/")) return false;
 	if (rawPath.includes("\0")) return false;
@@ -68,6 +115,6 @@ function isPositiveFiniteNumber(value) {
 	return typeof value === "number" && Number.isFinite(value) && value > 0;
 }
 //#endregion
-export { buildCimdClientIdUrlFromRequest, buildHubSpotAppJwksUrlFromRequest, buildOAuthRedirectUriFromRequest, clearTempCookie, isPositiveFiniteNumber, isSafeReturnPath };
+export { buildCimdClientIdUrlFromRequest, buildFrontendOAuthRedirectUri, buildHubSpotAppJwksUrlFromRequest, buildOAuthRedirectUriFromRequest, clearTempCookie, isPositiveFiniteNumber, isSafeReturnPath, parseAppOriginHeader };
 
 //# sourceMappingURL=utils.js.map

package/dist/server/hono/hubspot-connect-routes/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","names":[],"sources":["../../../../src/server/hono/hubspot-connect-routes/utils.ts"],"sourcesContent":["import { serializeCookie } from '../utils/cookie-utils.ts';\n\nexport function clearTempCookie(name: string): string {\n  return serializeCookie({\n    name,\n    value: '',\n    path: '/',\n    sameSite: 'Lax',\n    maxAge: 0,\n  });\n}\n\nexport function isSafeReturnPath(rawPath: string): boolean {\n  if (!rawPath.startsWith('/')) return false;\n  if (rawPath.includes('\\0')) return false;\n  let decoded: string;\n  try {\n    decoded = decodeURIComponent(rawPath);\n  } catch {\n    return false;\n  }\n  if (!decoded.startsWith('/')) return false;\n  const second = decoded.charAt(1);\n  if (second === '/' || second === '\\\\') return false;\n  return true;\n}\n\nexport function getRequestHost(requestUrl: string): string {\n  return new URL(requestUrl).host;\n}\n\nexport interface GetRequestHostForHubspotConnectOptions {\n  requestUrl: string;\n  xForwardedHost?: string | undefined;\n  /** `Host` when `X-Forwarded-Host` is absent (some proxies only set `X-Forwarded-Proto`). */\n  requestHostHeader?: string | undefined;\n}\n\n/**\n * Host for CIMD `client_id` URLs when hubspot-connect sits behind a reverse\n * proxy (e.g. Vite → Deno): prefers `X-Forwarded-Host`, then `Host`, then the\n * request URL host.\n */\nexport function getRequestHostForHubspotConnect(\n  options: GetRequestHostForHubspotConnectOptions\n): string {\n  const rawForwarded = options.xForwardedHost?.split(',')[0]?.trim();\n  if (rawForwarded) {\n    try {\n      return new URL(`https://${rawForwarded}`).host;\n    } catch {\n      /* invalid forwarded host */\n    }\n  }\n  const rawHost = options.requestHostHeader?.split(',')[0]?.trim();\n  if (rawHost) {\n    try {\n      return new URL(`https://${rawHost}`).host;\n    } catch {\n      /* invalid host header */\n    }\n  }\n  return getRequestHost(options.requestUrl);\n}\n\nexport interface BuildOAuthRedirectUriFromRequestOptions {\n  requestUrl: string;\n  basePath: string;\n  xForwardedProto?: string | undefined;\n  xForwardedHost?: string | undefined;\n  /** `Host` when `X-Forwarded-Host` is absent but `X-Forwarded-Proto` is set. */\n  requestHostHeader?: string | undefined;\n}\n\nfunction normalizeHubSpotConnectBasePath(basePath: string): string {\n  return basePath.endsWith('/') && basePath.length > 1\n    ? basePath.slice(0, -1)\n    : basePath;\n}\n\n/**\n * Public origin for hubspot-connect URLs (`redirect_uri`, CIMD `client_id`,\n * `jwks_uri`). Matches the host/proto rules used for the OAuth callback.\n */\nexport function buildHubSpotConnectRequestOrigin(\n  options: BuildOAuthRedirectUriFromRequestOptions\n): string {\n  const { requestUrl, xForwardedProto, xForwardedHost, requestHostHeader } =\n    options;\n  const proto = xForwardedProto?.split(',')[0]?.trim();\n  if (proto && (proto === 'http' || proto === 'https')) {\n    const forwardedHost = xForwardedHost?.split(',')[0]?.trim();\n    const hostHeader = requestHostHeader?.split(',')[0]?.trim();\n    const hostPart = forwardedHost || hostHeader || new URL(requestUrl).host;\n    return `${proto}://${hostPart}`;\n  }\n  return new URL(requestUrl).origin;\n}\n\n/**\n * OAuth `redirect_uri` for the hubspot-connect callback. Uses\n * `X-Forwarded-Proto` with `X-Forwarded-Host`, then `Host`, then the request URL\n * host when the proto is forwarded (reverse proxy); otherwise the request URL\n * origin.\n */\nexport function buildOAuthRedirectUriFromRequest(\n  options: BuildOAuthRedirectUriFromRequestOptions\n): string {\n  const trimmed = normalizeHubSpotConnectBasePath(options.basePath);\n  const origin = buildHubSpotConnectRequestOrigin(options);\n  return `${origin}${trimmed}/auth/callback`;\n}\n\n/**\n * CIMD `client_id` URL: `{origin}{basePath}/client.json`.\n */\nexport function buildCimdClientIdUrlFromRequest(\n  options: BuildOAuthRedirectUriFromRequestOptions\n): string {\n  const trimmed = normalizeHubSpotConnectBasePath(options.basePath);\n  const origin = buildHubSpotConnectRequestOrigin(options);\n  return `${origin}${trimmed}/client.json`;\n}\n\n/**\n * App JWKS URL published in CIMD: `{origin}{basePath}/jwks.json`.\n */\nexport function buildHubSpotAppJwksUrlFromRequest(\n  options: BuildOAuthRedirectUriFromRequestOptions\n): string {\n  const trimmed = normalizeHubSpotConnectBasePath(options.basePath);\n  const origin = buildHubSpotConnectRequestOrigin(options);\n  return `${origin}${trimmed}/jwks.json`;\n}\n\nexport function isPositiveFiniteNumber(value: unknown): value is number {\n  return typeof value === 'number' && Number.isFinite(value) && value > 0;\n}\n"],"mappings":";;AAEA,SAAgB,gBAAgB,MAAsB;CACpD,OAAO,gBAAgB;EACrB;EACA,OAAO;EACP,MAAM;EACN,UAAU;EACV,QAAQ;EACT,CAAC;;AAGJ,SAAgB,iBAAiB,SAA0B;CACzD,IAAI,CAAC,QAAQ,WAAW,IAAI,EAAE,OAAO;CACrC,IAAI,QAAQ,SAAS,KAAK,EAAE,OAAO;CACnC,IAAI;CACJ,IAAI;EACF,UAAU,mBAAmB,QAAQ;SAC/B;EACN,OAAO;;CAET,IAAI,CAAC,QAAQ,WAAW,IAAI,EAAE,OAAO;CACrC,MAAM,SAAS,QAAQ,OAAO,EAAE;CAChC,IAAI,WAAW,OAAO,WAAW,MAAM,OAAO;CAC9C,OAAO;;AAkDT,SAAS,gCAAgC,UAA0B;CACjE,OAAO,SAAS,SAAS,IAAI,IAAI,SAAS,SAAS,IAC/C,SAAS,MAAM,GAAG,GAAG,GACrB;;;;;;AAON,SAAgB,iCACd,SACQ;CACR,MAAM,EAAE,YAAY,iBAAiB,gBAAgB,sBACnD;CACF,MAAM,QAAQ,iBAAiB,MAAM,IAAI,CAAC,IAAI,MAAM;CACpD,IAAI,UAAU,UAAU,UAAU,UAAU,UAAU;EACpD,MAAM,gBAAgB,gBAAgB,MAAM,IAAI,CAAC,IAAI,MAAM;EAC3D,MAAM,aAAa,mBAAmB,MAAM,IAAI,CAAC,IAAI,MAAM;EAE3D,OAAO,GAAG,MAAM,KADC,iBAAiB,cAAc,IAAI,IAAI,WAAW,CAAC;;CAGtE,OAAO,IAAI,IAAI,WAAW,CAAC;;;;;;;;AAS7B,SAAgB,iCACd,SACQ;CACR,MAAM,UAAU,gCAAgC,QAAQ,SAAS;CAEjE,OAAO,GADQ,iCAAiC,QAChC,GAAG,QAAQ;;;;;AAM7B,SAAgB,gCACd,SACQ;CACR,MAAM,UAAU,gCAAgC,QAAQ,SAAS;CAEjE,OAAO,GADQ,iCAAiC,QAChC,GAAG,QAAQ;;;;;AAM7B,SAAgB,kCACd,SACQ;CACR,MAAM,UAAU,gCAAgC,QAAQ,SAAS;CAEjE,OAAO,GADQ,iCAAiC,QAChC,GAAG,QAAQ;;AAG7B,SAAgB,uBAAuB,OAAiC;CACtE,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,MAAM,IAAI,QAAQ"}
+{"version":3,"file":"utils.js","names":[],"sources":["../../../../src/server/hono/hubspot-connect-routes/utils.ts"],"sourcesContent":["import { HUBSPOT_FRONTEND_CALLBACK_PATH } from '../../../shared/constants.ts';\nimport { serializeCookie } from '../utils/cookie-utils.ts';\n\nexport function clearTempCookie(name: string): string {\n  return serializeCookie({\n    name,\n    value: '',\n    path: '/',\n    sameSite: 'None',\n    maxAge: 0,\n    partitioned: true,\n  });\n}\n\n/**\n * Parses the request `Origin` header into the canonical origin\n * string (`URL.origin`) or returns `null` when the header is\n * missing, malformed, or carries a scheme/host the SDK does not\n * accept.\n *\n * Accepted shapes:\n *\n * - `https://<host>` for production deployments.\n * - `http://localhost[:<port>]` and `http://127.0.0.1[:<port>]`\n *   for local development; browsers exempt these from the `Secure`\n *   cookie restriction.\n *\n * Rejects values with a path/query/hash component (the request\n * `Origin` header is by spec a bare origin, so anything else\n * indicates a malformed or hostile request).\n */\nexport function parseAppOriginHeader(\n  originHeader: string | undefined\n): string | null {\n  if (!originHeader) return null;\n  let parsed: URL;\n  try {\n    parsed = new URL(originHeader);\n  } catch {\n    return null;\n  }\n  if (parsed.pathname !== '/' && parsed.pathname !== '') return null;\n  if (parsed.search !== '' || parsed.hash !== '') return null;\n  if (parsed.protocol === 'https:') return parsed.origin;\n  if (\n    parsed.protocol === 'http:' &&\n    (parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1')\n  ) {\n    return parsed.origin;\n  }\n  return null;\n}\n\n/**\n * OAuth `redirect_uri` for the cross-origin app shape: the OAuth\n * callback lands on the **frontend** origin (not the SDK's edge\n * function host), so all cookies set by `init-session` and read by\n * `auth/complete` live in the same `(frontend, edge)` CHIPS\n * partition.\n *\n * Used by `auth/init-session` (when building `authorization_url`)\n * and `auth/complete` (which must rebuild the same value to satisfy\n * the OAuth token endpoint's `redirect_uri` check).\n */\nexport function buildFrontendOAuthRedirectUri(appOrigin: string): string {\n  return `${appOrigin}${HUBSPOT_FRONTEND_CALLBACK_PATH}`;\n}\n\nexport function isSafeReturnPath(rawPath: string): boolean {\n  if (!rawPath.startsWith('/')) return false;\n  if (rawPath.includes('\\0')) return false;\n  let decoded: string;\n  try {\n    decoded = decodeURIComponent(rawPath);\n  } catch {\n    return false;\n  }\n  if (!decoded.startsWith('/')) return false;\n  const second = decoded.charAt(1);\n  if (second === '/' || second === '\\\\') return false;\n  return true;\n}\n\nexport function getRequestHost(requestUrl: string): string {\n  return new URL(requestUrl).host;\n}\n\nexport interface GetRequestHostForHubspotConnectOptions {\n  requestUrl: string;\n  xForwardedHost?: string | undefined;\n  /** `Host` when `X-Forwarded-Host` is absent (some proxies only set `X-Forwarded-Proto`). */\n  requestHostHeader?: string | undefined;\n}\n\n/**\n * Host for CIMD `client_id` URLs when hubspot-connect sits behind a reverse\n * proxy (e.g. Vite → Deno): prefers `X-Forwarded-Host`, then `Host`, then the\n * request URL host.\n */\nexport function getRequestHostForHubspotConnect(\n  options: GetRequestHostForHubspotConnectOptions\n): string {\n  const rawForwarded = options.xForwardedHost?.split(',')[0]?.trim();\n  if (rawForwarded) {\n    try {\n      return new URL(`https://${rawForwarded}`).host;\n    } catch {\n      /* invalid forwarded host */\n    }\n  }\n  const rawHost = options.requestHostHeader?.split(',')[0]?.trim();\n  if (rawHost) {\n    try {\n      return new URL(`https://${rawHost}`).host;\n    } catch {\n      /* invalid host header */\n    }\n  }\n  return getRequestHost(options.requestUrl);\n}\n\nexport interface BuildOAuthRedirectUriFromRequestOptions {\n  requestUrl: string;\n  basePath: string;\n  xForwardedProto?: string | undefined;\n  xForwardedHost?: string | undefined;\n  /** `Host` when `X-Forwarded-Host` is absent but `X-Forwarded-Proto` is set. */\n  requestHostHeader?: string | undefined;\n}\n\nfunction normalizeHubSpotConnectBasePath(basePath: string): string {\n  return basePath.endsWith('/') && basePath.length > 1\n    ? basePath.slice(0, -1)\n    : basePath;\n}\n\n/**\n * Public origin for hubspot-connect URLs (`redirect_uri`, CIMD `client_id`,\n * `jwks_uri`). Matches the host/proto rules used for the OAuth callback.\n */\nexport function buildHubSpotConnectRequestOrigin(\n  options: BuildOAuthRedirectUriFromRequestOptions\n): string {\n  const { requestUrl, xForwardedProto, xForwardedHost, requestHostHeader } =\n    options;\n  const proto = xForwardedProto?.split(',')[0]?.trim();\n  if (proto && (proto === 'http' || proto === 'https')) {\n    const forwardedHost = xForwardedHost?.split(',')[0]?.trim();\n    const hostHeader = requestHostHeader?.split(',')[0]?.trim();\n    const hostPart = forwardedHost || hostHeader || new URL(requestUrl).host;\n    return `${proto}://${hostPart}`;\n  }\n  return new URL(requestUrl).origin;\n}\n\n/**\n * OAuth `redirect_uri` for the hubspot-connect callback. Uses\n * `X-Forwarded-Proto` with `X-Forwarded-Host`, then `Host`, then the request URL\n * host when the proto is forwarded (reverse proxy); otherwise the request URL\n * origin.\n */\nexport function buildOAuthRedirectUriFromRequest(\n  options: BuildOAuthRedirectUriFromRequestOptions\n): string {\n  const trimmed = normalizeHubSpotConnectBasePath(options.basePath);\n  const origin = buildHubSpotConnectRequestOrigin(options);\n  return `${origin}${trimmed}/auth/callback`;\n}\n\n/**\n * CIMD `client_id` URL: `{origin}{basePath}/client.json`.\n */\nexport function buildCimdClientIdUrlFromRequest(\n  options: BuildOAuthRedirectUriFromRequestOptions\n): string {\n  const trimmed = normalizeHubSpotConnectBasePath(options.basePath);\n  const origin = buildHubSpotConnectRequestOrigin(options);\n  return `${origin}${trimmed}/client.json`;\n}\n\n/**\n * App JWKS URL published in CIMD: `{origin}{basePath}/jwks.json`.\n */\nexport function buildHubSpotAppJwksUrlFromRequest(\n  options: BuildOAuthRedirectUriFromRequestOptions\n): string {\n  const trimmed = normalizeHubSpotConnectBasePath(options.basePath);\n  const origin = buildHubSpotConnectRequestOrigin(options);\n  return `${origin}${trimmed}/jwks.json`;\n}\n\nexport function isPositiveFiniteNumber(value: unknown): value is number {\n  return typeof value === 'number' && Number.isFinite(value) && value > 0;\n}\n"],"mappings":";;;AAGA,SAAgB,gBAAgB,MAAsB;CACpD,OAAO,gBAAgB;EACrB;EACA,OAAO;EACP,MAAM;EACN,UAAU;EACV,QAAQ;EACR,aAAa;EACd,CAAC;;;;;;;;;;;;;;;;;;;AAoBJ,SAAgB,qBACd,cACe;CACf,IAAI,CAAC,cAAc,OAAO;CAC1B,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,aAAa;SACxB;EACN,OAAO;;CAET,IAAI,OAAO,aAAa,OAAO,OAAO,aAAa,IAAI,OAAO;CAC9D,IAAI,OAAO,WAAW,MAAM,OAAO,SAAS,IAAI,OAAO;CACvD,IAAI,OAAO,aAAa,UAAU,OAAO,OAAO;CAChD,IACE,OAAO,aAAa,YACnB,OAAO,aAAa,eAAe,OAAO,aAAa,cAExD,OAAO,OAAO;CAEhB,OAAO;;;;;;;;;;;;;AAcT,SAAgB,8BAA8B,WAA2B;CACvE,OAAO,GAAG,YAAY;;AAGxB,SAAgB,iBAAiB,SAA0B;CACzD,IAAI,CAAC,QAAQ,WAAW,IAAI,EAAE,OAAO;CACrC,IAAI,QAAQ,SAAS,KAAK,EAAE,OAAO;CACnC,IAAI;CACJ,IAAI;EACF,UAAU,mBAAmB,QAAQ;SAC/B;EACN,OAAO;;CAET,IAAI,CAAC,QAAQ,WAAW,IAAI,EAAE,OAAO;CACrC,MAAM,SAAS,QAAQ,OAAO,EAAE;CAChC,IAAI,WAAW,OAAO,WAAW,MAAM,OAAO;CAC9C,OAAO;;AAkDT,SAAS,gCAAgC,UAA0B;CACjE,OAAO,SAAS,SAAS,IAAI,IAAI,SAAS,SAAS,IAC/C,SAAS,MAAM,GAAG,GAAG,GACrB;;;;;;AAON,SAAgB,iCACd,SACQ;CACR,MAAM,EAAE,YAAY,iBAAiB,gBAAgB,sBACnD;CACF,MAAM,QAAQ,iBAAiB,MAAM,IAAI,CAAC,IAAI,MAAM;CACpD,IAAI,UAAU,UAAU,UAAU,UAAU,UAAU;EACpD,MAAM,gBAAgB,gBAAgB,MAAM,IAAI,CAAC,IAAI,MAAM;EAC3D,MAAM,aAAa,mBAAmB,MAAM,IAAI,CAAC,IAAI,MAAM;EAE3D,OAAO,GAAG,MAAM,KADC,iBAAiB,cAAc,IAAI,IAAI,WAAW,CAAC;;CAGtE,OAAO,IAAI,IAAI,WAAW,CAAC;;;;;;;;AAS7B,SAAgB,iCACd,SACQ;CACR,MAAM,UAAU,gCAAgC,QAAQ,SAAS;CAEjE,OAAO,GADQ,iCAAiC,QAChC,GAAG,QAAQ;;;;;AAM7B,SAAgB,gCACd,SACQ;CACR,MAAM,UAAU,gCAAgC,QAAQ,SAAS;CAEjE,OAAO,GADQ,iCAAiC,QAChC,GAAG,QAAQ;;;;;AAM7B,SAAgB,kCACd,SACQ;CACR,MAAM,UAAU,gCAAgC,QAAQ,SAAS;CAEjE,OAAO,GADQ,iCAAiC,QAChC,GAAG,QAAQ;;AAG7B,SAAgB,uBAAuB,OAAiC;CACtE,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,MAAM,IAAI,QAAQ"}

package/dist/server/hono/types.d.ts

@@ -2,23 +2,27 @@ import { HubSpotClient } from "../api-client-core/types.js";
 import { HubSpotProxy } from "../types.js";
 
 //#region src/server/hono/types.d.ts
-interface AppConnectHonoBindings {
+interface AppConnectRequestContext {
+  /**
+   * HubSpot API proxy.
+   */
+  proxy: HubSpotProxy;
   /**
-   * Authenticated proxy that issues DPoP-bound calls to HubSpot's
-   * API on behalf of the browser session that made the inbound
-   * request. `authenticated: false` when the session cookies are
-   * absent or invalid.
+   * HubSpot API client.
    */
-  hubSpotProxy: HubSpotProxy;
+  client: HubSpotClient;
   /**
-   * Authenticated HubSpot API client.
+   * Whether the browser session is authenticated.
    */
-  hubSpotClient: HubSpotClient;
+  authenticated: boolean;
+}
+interface AppConnectHonoBindings {
+  hubSpot: AppConnectRequestContext;
 }
 /**
  * Hono environment shape used by handlers running inside a hubspot-
  * connect request handler. Exposes the per-request
- * {@link HubSpotProxy} as `c.env.hubSpotProxy`.
+ * {@link AppConnectRequestContext} as `c.env.hubSpot`.
  */
 interface AppConnectHonoEnv {
   Bindings: AppConnectHonoBindings;