@hubspot/app-connect-sdk 1.0.0-alpha.2 → 1.0.0-alpha.4

package/dist/server/lovable.js

@@ -1,4 +1,1459 @@
-import { secureStart } from "./deno/start.js";
-import { startHubSpotConnectFunction } from "./lovable/hubspot-connect/index.js";
-import { createAppFunctionStart } from "./lovable/create-app-function-start.js";
+import { n as isBinaryData, r as createHubSpotClient } from "./binary-data-BOalJzKu.js";
+import { c as base64url, i as signJwt, l as base64urlDecode, n as signDpopProof, o as getJwkThumbprint, s as base64StandardToArrayBuffer, t as sha256base64url } from "./sha256-B7y8GBFB.js";
+import { Hono } from "hono";
+//#region src/server/import-app-keys.ts
+/**
+* Imports a base64-encoded PKCS8 ES256 private key into the
+* `AppKeys` shape used throughout the SDK.
+*
+* The function imports the key twice: once as **extractable** to
+* derive the public JWK (via `crypto.subtle.exportKey`), and once
+* as **non-extractable** so the long-lived `appPrivateKey` can never
+* be exfiltrated.
+*
+* @throws {Error} When `envKey` is empty/undefined or when the key
+*   isn't an EC P-256 keypair.
+*/
+async function importAppKeys(envKey) {
+	const b64 = envKey?.trim() ?? "";
+	if (!b64) throw new Error("HUBSPOT_APP_PRIVATE_KEY is not set");
+	const pkcs8 = base64StandardToArrayBuffer(b64);
+	const tempPrivateKey = await crypto.subtle.importKey("pkcs8", pkcs8, {
+		name: "ECDSA",
+		namedCurve: "P-256"
+	}, true, ["sign"]);
+	const privateJwk = await crypto.subtle.exportKey("jwk", tempPrivateKey);
+	if (privateJwk.kty !== "EC" || privateJwk.crv !== "P-256" || typeof privateJwk.x !== "string" || typeof privateJwk.y !== "string") throw new Error("Expected P-256 EC private key JWK with x and y");
+	const appPublicKeyJwk = {
+		kty: "EC",
+		crv: "P-256",
+		x: privateJwk.x,
+		y: privateJwk.y
+	};
+	return {
+		appPrivateKey: await crypto.subtle.importKey("pkcs8", pkcs8, {
+			name: "ECDSA",
+			namedCurve: "P-256"
+		}, false, ["sign"]),
+		appPublicKeyJwk
+	};
+}
+//#endregion
+//#region src/server/utils/env-utils.ts
+/**
+* Reads an environment variable in a way that works under both Node
+* (`process.env`) and Deno (`Deno.env.get`). Returns `undefined` when
+* the variable is unset or when neither runtime is available.
+*/
+function getEnv(key) {
+	const g = globalThis;
+	const proc = g.process;
+	if (proc?.env) return proc.env[key];
+	const deno = g.Deno;
+	if (deno !== void 0) return deno.env.get(key);
+}
+/**
+* Reads an environment variable and throws when it is missing or empty.
+* Use for values the SDK cannot fall back on (e.g. upstream service
+* URLs).
+*
+* @throws {Error} When the environment variable is unset or an empty
+*   string.
+*/
+function requireEnv(key) {
+	const value = getEnv(key);
+	if (!value) throw new Error(`Missing required environment variable: ${key}`);
+	return value;
+}
+/**
+* Whether outbound HubSpot OAuth and API calls should attach DPoP on
+* the wire. Disabled only when `HUBSPOT_DPOP_ENABLED` is exactly the
+* string `"false"` (unset or any other value keeps DPoP enabled).
+*/
+function isHubspotDpopEnabled() {
+	return getEnv("HUBSPOT_DPOP_ENABLED") !== "false";
+}
+/**
+* Whether the SDK should use CIMD-style OAuth (client ID URL + JWT client
+* assertion). Disabled only when `HUBSPOT_CIMD_ENABLED` is exactly the
+* string `"false"` (unset or any other value keeps CIMD enabled).
+*/
+function isHubspotCimdEnabled() {
+	return getEnv("HUBSPOT_CIMD_ENABLED") !== "false";
+}
+/**
+* Whether `HUBSPOT_APP_PRIVATE_KEY` must be set for `secureStart`. False
+* when both CIMD and DPoP are disabled — the SDK then uses
+* `client_secret` for OAuth and Bearer tokens only for API calls.
+*/
+function isHubspotAppPrivateKeyRequired() {
+	return isHubspotCimdEnabled() || isHubspotDpopEnabled();
+}
+//#endregion
+//#region src/server/secure-start-core.ts
+const APP_PRIVATE_KEY_ENV = "HUBSPOT_APP_PRIVATE_KEY";
+/**
+* Loads `HUBSPOT_APP_PRIVATE_KEY` when CIMD or DPoP is enabled, deletes
+* it from the environment so later code cannot re-read it, imports the
+* entrypoint module via `loader`, and invokes `start` with `AppKeys` or
+* `null` when both features are off. On failure, logs the error and
+* exits with code 1.
+*/
+async function runSecureStart(loader, adapter) {
+	let appKeys = null;
+	if (isHubspotAppPrivateKeyRequired()) {
+		const envKey = adapter.readEnv(APP_PRIVATE_KEY_ENV)?.trim();
+		if (!envKey) throw new Error(`${APP_PRIVATE_KEY_ENV} is not set`);
+		appKeys = await importAppKeys(envKey);
+		adapter.deleteEnv(APP_PRIVATE_KEY_ENV);
+	}
+	return (await loader()).start({ appKeys }).catch((error) => {
+		console.error(error);
+		return adapter.exit(1);
+	});
+}
+//#endregion
+//#region src/server/deno/start.ts
+const denoSecureStartAdapter = {
+	readEnv: (key) => Deno.env.get(key),
+	deleteEnv: (key) => {
+		Deno.env.delete(key);
+	},
+	exit: (code) => Deno.exit(code)
+};
+/**
+* Deno entrypoint helper. Reads `HUBSPOT_APP_PRIVATE_KEY` from `Deno.env`
+* when CIMD or DPoP is enabled, imports the supplied loader, and invokes
+* `start` with `AppKeys` or `null`.
+*/
+function secureStart(loader) {
+	return runSecureStart(loader, denoSecureStartAdapter);
+}
+//#endregion
+//#region src/server/hono/hubspot-connect-routes/cimd-client-metadata-types.ts
+function assertHubSpotConnectCimdClientMetadata(value) {
+	const required = value.scope?.required;
+	if (!(Array.isArray(required) && required.length > 0 && required.every((s) => typeof s === "string" && s.length > 0))) throw new Error("HubSpotConnectCimdClientMetadata.scope.required must be a non-empty array of non-empty strings");
+	const optional = value.scope.optional;
+	if (optional === void 0) return;
+	if (!Array.isArray(optional)) throw new Error("HubSpotConnectCimdClientMetadata.scope.optional must be an array when set");
+	if (optional.length > 0 && !optional.every((s) => typeof s === "string" && s.length > 0)) throw new Error("HubSpotConnectCimdClientMetadata.scope.optional entries must be non-empty strings");
+}
+//#endregion
+//#region src/shared/logger.ts
+/**
+* Logger that swallows every message. Convenient for tests and for
+* the SDK's server-side handlers when no logger is provided by the
+* host application.
+*/
+const noopLogger = {
+	debug: () => {},
+	info: () => {},
+	warn: () => {},
+	error: () => {}
+};
+//#endregion
+//#region src/server/api-client-core/plugins/fetch-transport.ts
+const BASE_URL = "https://api.hubapi.com";
+function appendRecordToUrlSearchParams(params, record) {
+	for (const [key, value] of Object.entries(record)) {
+		if (value == null) continue;
+		if (Array.isArray(value)) for (const item of value) params.append(key, String(item));
+		else params.append(key, String(value));
+	}
+}
+/**
+* Transport plugin that executes HTTP requests using the Fetch API.
+*
+* This is the terminal middleware in the chain — it builds the actual HTTP
+* request from the operation descriptor and returns a normalized response.
+* It handles path-parameter interpolation, query-string serialization,
+* Bearer-token auth, and content-type negotiation (JSON, form-urlencoded, multipart).
+*/
+function fetchTransportPlugin(options) {
+	return { activate(api) {
+		api.addMiddleware(async (ctx) => {
+			const { operation } = ctx;
+			let url = `${BASE_URL}${operation.path}`;
+			if (operation.pathParams) for (const [key, value] of Object.entries(operation.pathParams)) url = url.replace(`{${key}}`, encodeURIComponent(String(value)));
+			if (operation.queryParams) {
+				const params = new URLSearchParams();
+				appendRecordToUrlSearchParams(params, operation.queryParams);
+				const qs = params.toString();
+				if (qs) url += `?${qs}`;
+			}
+			const headers = {
+				...operation.headers ?? {},
+				Authorization: `Bearer ${options.getAccessToken()}`
+			};
+			const init = {
+				method: operation.method.toUpperCase(),
+				headers
+			};
+			if (operation.contentType === "multipart/form-data" && operation.body) {
+				const formData = new FormData();
+				for (const [key, value] of Object.entries(operation.body)) {
+					if (value == null) continue;
+					if (isBinaryData(value)) formData.append(key, value.source);
+					else formData.append(key, String(value));
+				}
+				init.body = formData;
+			} else if (operation.contentType === "application/x-www-form-urlencoded") {
+				headers["Content-Type"] = "application/x-www-form-urlencoded";
+				if (operation.body) {
+					const params = new URLSearchParams();
+					appendRecordToUrlSearchParams(params, operation.body);
+					const encoded = params.toString();
+					if (encoded) init.body = encoded;
+				}
+			} else {
+				headers["Content-Type"] = "application/json";
+				if (operation.body) init.body = JSON.stringify(operation.body);
+			}
+			const response = await fetch(url, init);
+			const responseHeaders = Object.create(null);
+			response.headers.forEach((value, key) => {
+				responseHeaders[key] = value;
+			});
+			return {
+				status: response.status,
+				statusText: response.statusText,
+				headers: responseHeaders,
+				bodyJson: response.status === 204 ? void 0 : await response.json()
+			};
+		});
+	} };
+}
+//#endregion
+//#region src/server/constants.ts
+/**
+* Cookie name carrying the DPoP-bound access token. Uses the
+* `__Host-` prefix so the browser only accepts it from a `Secure`
+* response with `Path=/` — a defense-in-depth against subdomain
+* cookie injection.
+*/
+const HUBSPOT_ACCESS_TOKEN_COOKIE_NAME = "__Host-hs_access_token";
+/**
+* Cookie carrying the opaque app-session ID. Hashed before being put
+* on the wire as a DPoP `sid` claim.
+*/
+const HUBSPOT_APP_SID_COOKIE_NAME = "__Host-hs_app_sid";
+/**
+* Cookie pinning the browser-facing app origin (e.g.
+* `https://app.example.com`) for the lifetime of an app session.
+* Set by `auth/init-session` from the request's `Origin` header and
+* read by:
+*
+* - The CORS middleware to emit a credentialed
+*   `Access-Control-Allow-Origin` value (`*` is forbidden when
+*   `Access-Control-Allow-Credentials: true`).
+* - `auth/complete` to rebuild the OAuth `redirect_uri` it sent to
+*   HubSpot during `init-session` (the token endpoint validates that
+*   the two values match).
+*
+* `__Host-` prefixed (Path=/, Secure, no Domain), so the same
+* function host can serve both `hubspot-connect` and `api` routes
+* and read the cookie from either.
+*/
+const HUBSPOT_APP_ORIGIN_COOKIE_NAME = "__Host-hs_app_origin";
+/**
+* Prefix used for refresh-token cookies. Each session gets its own
+* cookie name (`hs_refresh_<sidHash>`) so multiple devices/tabs can
+* coexist without overwriting each other's refresh tokens.
+*/
+const HUBSPOT_REFRESH_COOKIE_PREFIX = "hs_refresh_";
+const PROTECTED_COOKIE_NAMES = new Set([
+	HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,
+	HUBSPOT_APP_SID_COOKIE_NAME,
+	HUBSPOT_APP_ORIGIN_COOKIE_NAME
+]);
+/**
+* Returns `true` for cookies the SDK manages internally
+* (access token, session ID, any refresh-token cookie). The
+* `sanitizeRequest` helper uses this to strip these cookies from the
+* request before user code sees it, ensuring user route handlers
+* cannot accidentally leak them in logs or proxy them upstream.
+*/
+function isProtectedCookieName(cookieName) {
+	return PROTECTED_COOKIE_NAMES.has(cookieName) || cookieName.startsWith("hs_refresh_");
+}
+/**
+* Cookie carrying the PKCE code verifier between `init-session` and
+* `auth/complete`. Set with `SameSite=None; Secure; Partitioned` so the
+* frontend's credentialed cross-site `POST /auth/complete` (made from
+* the OAuth callback page on the app origin to the SDK's edge function
+* origin) carries it through. `Lax` would silently drop it on that
+* fetch, breaking every successful HubSpot redirect.
+*/
+const TEMP_COOKIE_PKCE_VERIFIER = "__hs_pkce_verifier";
+/**
+* Cookie carrying the OAuth `state` value between `init-session` and
+* `auth/complete`. Compared against the `state` query parameter as the
+* primary CSRF defense. Same `SameSite=None; Secure; Partitioned`
+* attributes as `TEMP_COOKIE_PKCE_VERIFIER` for the same cross-site
+* `POST /auth/complete` reason.
+*/
+const TEMP_COOKIE_OAUTH_STATE = "__hs_oauth_state";
+//#endregion
+//#region src/server/proxy.ts
+const HUBSPOT_API_ORIGIN = requireEnv("HUBSPOT_API_ORIGIN");
+const notAuthenticated = {
+	authenticated: false,
+	fetch: async () => {
+		return new Response(null, {
+			status: 401,
+			statusText: "Unauthorized",
+			headers: { "Content-Type": "application/json" }
+		});
+	}
+};
+const EMPTY_HEADERS = {};
+function createHubSpotProxy(options) {
+	const { userCredentials, appKeys, logger = noopLogger } = options;
+	if (isHubspotDpopEnabled() && appKeys === null) throw new Error("createHubSpotProxy: appKeys is required when HUBSPOT_DPOP_ENABLED is not false");
+	const { accessToken, sessionId } = userCredentials;
+	if (!accessToken || !sessionId) {
+		logger.debug("createHubSpotProxy: returning unauthenticated proxy (missing cookies)");
+		return notAuthenticated;
+	}
+	async function proxyFetch(request) {
+		const { path, method = "GET", headers = EMPTY_HEADERS, body } = request;
+		const targetUrl = `${HUBSPOT_API_ORIGIN}${path}`;
+		const useDpop = isHubspotDpopEnabled();
+		let authorizationHeaders;
+		if (useDpop) {
+			const ath = await sha256base64url(accessToken);
+			const sid = await sha256base64url(sessionId);
+			const dpopProof = await signDpopProof({
+				appKeys,
+				claims: {
+					htm: method,
+					htu: targetUrl,
+					jti: crypto.randomUUID(),
+					iat: Math.floor(Date.now() / 1e3),
+					ath,
+					sid
+				}
+			});
+			authorizationHeaders = {
+				Authorization: `DPoP ${accessToken}`,
+				DPoP: dpopProof
+			};
+		} else authorizationHeaders = { Authorization: `Bearer ${accessToken}` };
+		const requestInit = {
+			headers: {
+				...headers,
+				...authorizationHeaders
+			},
+			method
+		};
+		if (body != null) requestInit.body = body;
+		return fetch(targetUrl, requestInit);
+	}
+	return {
+		authenticated: true,
+		fetch: proxyFetch
+	};
+}
+//#endregion
+//#region src/server/utils/cookie-utils.ts
+/**
+* Parses an HTTP `Cookie` request header into a `name -> value` map.
+* Tolerates leading/trailing whitespace, missing `=` (treats the
+* cookie value as empty), and duplicate names (last write wins).
+*
+* Returns an empty object when `cookieHeader` is `null`/`undefined`
+* /empty so callers don't have to null-check the input.
+*/
+function parseCookies(cookieHeader) {
+	if (!cookieHeader) return {};
+	return Object.fromEntries(cookieHeader.split(";").map((pair) => {
+		const eqIdx = pair.indexOf("=");
+		if (eqIdx === -1) return [pair.trim(), ""];
+		return [pair.slice(0, eqIdx).trim(), pair.slice(eqIdx + 1).trim()];
+	}).filter(([name]) => name.length > 0));
+}
+//#endregion
+//#region src/server/sanitize-request.ts
+function serializeCookies(cookies) {
+	const parts = [];
+	for (const [name, value] of cookies) parts.push(`${name}=${value}`);
+	return parts.join("; ");
+}
+/**
+* Mutates `headers` in place: parses the `Cookie` header, drops every
+* protected cookie (see {@link isProtectedCookieName}), and rewrites
+* the header. Deletes the header entirely when nothing survives.
+*
+* Used by the SDK's auth middleware after it has read the access
+* token / session ID, so user route handlers never see — and
+* therefore cannot leak — those cookies, while CORS / auth
+* middleware that ran first still got the raw values.
+*/
+function stripProtectedCookies(headers) {
+	const cookies = parseCookies(headers.get("Cookie"));
+	const surviving = /* @__PURE__ */ new Map();
+	for (const [name, value] of Object.entries(cookies)) if (!isProtectedCookieName(name)) surviving.set(name, value);
+	if (surviving.size === 0) headers.delete("cookie");
+	else headers.set("cookie", serializeCookies(surviving));
+}
+/**
+* Returns a clone of `original` whose `Cookie` header has every
+* protected cookie removed (see {@link isProtectedCookieName}). When
+* no other cookies remain, the header is dropped entirely.
+*
+* Standalone helper retained for callers that want a new Request
+* (e.g. tests). Inside the SDK's per-request handler, the auth
+* middleware uses {@link stripProtectedCookies} directly on
+* `c.req.raw.headers` so the auth check itself can still read the
+* protected cookies before they are stripped.
+*/
+function sanitizeRequest(original) {
+	const headers = new Headers(original.headers);
+	stripProtectedCookies(headers);
+	const init = {
+		method: original.method,
+		headers,
+		redirect: original.redirect,
+		signal: original.signal
+	};
+	if (original.body !== null) {
+		init.body = original.body;
+		init.duplex = "half";
+	}
+	return new Request(original.url, init);
+}
+//#endregion
+//#region src/server/hono/utils/cors-middleware.ts
+/**
+* Comma-separated list of request headers the SDK accepts on
+* cross-site fetches. Mirrors the Supabase Edge Functions defaults
+* the Lovable AI agent emits today, plus `content-type` for the
+* `auth/complete` POST body and `accept` so JSON content negotiation
+* works.
+*/
+const ALLOWED_HEADERS = [
+	"authorization",
+	"x-client-info",
+	"apikey",
+	"content-type",
+	"accept",
+	"x-supabase-client-platform",
+	"x-supabase-client-platform-version",
+	"x-supabase-client-runtime",
+	"x-supabase-client-runtime-version"
+].join(", ");
+const ALLOWED_METHODS = "GET, POST, OPTIONS";
+const PREFLIGHT_MAX_AGE_SECONDS = "600";
+/**
+* Reads the persisted app-origin cookie from the request, falling
+* back to the literal `Origin` request header. The cookie is the
+* authoritative pin once `auth/init-session` has run; on the very
+* first init-session call (no cookie yet) we just echo whatever
+* `Origin` the caller sent — the actual access decision is enforced
+* by cookie-based authentication on every other route, not by CORS.
+*/
+function resolveAllowedOrigin(c) {
+	const pinned = parseCookies(c.req.header("Cookie"))[HUBSPOT_APP_ORIGIN_COOKIE_NAME];
+	if (pinned) return pinned;
+	return c.req.header("Origin") ?? null;
+}
+function setSharedCorsHeaders(c, allowOrigin) {
+	c.res.headers.set("Access-Control-Allow-Origin", allowOrigin);
+	c.res.headers.set("Access-Control-Allow-Credentials", "true");
+	c.res.headers.set("Vary", "Origin, Cookie");
+}
+/**
+* Hono middleware that emits credentialed CORS response headers for
+* the cross-origin Lovable / Supabase deployment shape.
+*
+* - On `OPTIONS` preflight: short-circuits with a 204 carrying
+*   `Access-Control-Allow-*` headers. The browser will then send the
+*   real request with cookies attached.
+* - On every other method: echoes the pinned `__Host-hs_app_origin`
+*   cookie value (or, before init-session has run, the request
+*   `Origin` header) as `Access-Control-Allow-Origin`, with
+*   `Access-Control-Allow-Credentials: true`. The wildcard `*` is
+*   forbidden by browsers when credentials are included, so the
+*   middleware always echoes a concrete origin.
+*
+* Skips header emission entirely when the request has no `Origin`
+* (server-to-server calls, curl, etc.) so non-browser callers are
+* left untouched.
+*/
+function corsMiddleware() {
+	return async (c, next) => {
+		const allowOrigin = resolveAllowedOrigin(c);
+		if (c.req.method === "OPTIONS") {
+			const headers = new Headers();
+			if (allowOrigin) {
+				headers.set("Access-Control-Allow-Origin", allowOrigin);
+				headers.set("Access-Control-Allow-Credentials", "true");
+				headers.set("Vary", "Origin, Cookie");
+			}
+			headers.set("Access-Control-Allow-Methods", ALLOWED_METHODS);
+			headers.set("Access-Control-Allow-Headers", ALLOWED_HEADERS);
+			headers.set("Access-Control-Max-Age", PREFLIGHT_MAX_AGE_SECONDS);
+			return new Response(null, {
+				status: 204,
+				headers
+			});
+		}
+		await next();
+		if (allowOrigin) setSharedCorsHeaders(c, allowOrigin);
+	};
+}
+//#endregion
+//#region src/server/hono/hono-request-handler.ts
+/**
+* Wraps a Hono app so its `fetch` handler additionally:
+*
+* - Strips SDK-managed cookies (access token, refresh, sid) from the
+*   request before the app sees them, via `sanitizeRequest`.
+* - Exposes a `hubSpotProxy` on the Hono context so route handlers
+*   can issue authenticated calls to HubSpot's API on behalf of the
+*   browser session.
+*/
+function createAppConnectRequestHandler(options) {
+	const { registerRoutes, appKeys, logger = noopLogger } = options;
+	const app = new Hono();
+	app.use("*", corsMiddleware());
+	app.use("*", async (c, next) => {
+		const { authenticated } = c.env.hubSpot;
+		if (!authenticated) return c.json({ error: "Unauthorized" }, 401);
+		await next();
+	});
+	registerRoutes(app);
+	return (request) => {
+		const cookie = request.headers.get("Cookie");
+		if (!cookie) throw new Error("Missing auth cookies");
+		const cookies = parseCookies(cookie);
+		const accessToken = cookies[HUBSPOT_ACCESS_TOKEN_COOKIE_NAME];
+		const proxy = createHubSpotProxy({
+			userCredentials: {
+				accessToken,
+				sessionId: cookies[HUBSPOT_APP_SID_COOKIE_NAME]
+			},
+			appKeys,
+			logger
+		});
+		const client = createHubSpotClient({ plugins: [fetchTransportPlugin({ getAccessToken: () => {
+			if (!accessToken) throw new Error("Missing access token");
+			return accessToken;
+		} })] });
+		const sanitizedRequest = sanitizeRequest(request);
+		const honoBindings = { hubSpot: {
+			proxy,
+			client,
+			authenticated: proxy.authenticated
+		} };
+		return app.fetch(sanitizedRequest, honoBindings);
+	};
+}
+//#endregion
+//#region src/shared/constants.ts
+/**
+* Path the browser visits after HubSpot's authorize endpoint
+* redirects back to the app. Mounted on the **frontend** origin (not
+* the SDK's edge function host) so all OAuth-related cookies live in
+* the `(frontend, edge)` CHIPS partition.
+*
+* The SDK's `auth/init-session` builds the OAuth `redirect_uri` as
+* `${requestOrigin}${HUBSPOT_FRONTEND_CALLBACK_PATH}`. The browser
+* controller, on `start()`, recognizes this path on `window.location`
+* and forwards `?code` + `?state` to the SDK's `auth/complete`
+* endpoint via a credentialed cross-site fetch. The host app must
+* register `${app_origin}${HUBSPOT_FRONTEND_CALLBACK_PATH}` as a
+* redirect URI in its HubSpot app settings.
+*/
+const HUBSPOT_FRONTEND_CALLBACK_PATH = "/__hubspot_oauth_callback";
+/**
+* Query parameter on the `auth/complete` POST request carrying the
+* authorization `code` HubSpot returned to the frontend callback.
+*/
+const AUTH_COMPLETE_CODE_PARAM = "code";
+/**
+* Query parameter on the `auth/complete` POST request carrying the
+* OAuth `state` HubSpot echoed back to the frontend callback.
+*/
+const AUTH_COMPLETE_STATE_PARAM = "state";
+//#endregion
+//#region src/server/hono/utils/cookie-utils.ts
+/**
+* Appends a `Set-Cookie` header to the response. Hono replaces single
+* headers by default, so this uses `{ append: true }` to emit multiple
+* cookies on the same response.
+*/
+function setResponseCookie(options) {
+	const { c, value } = options;
+	c.header("Set-Cookie", value, { append: true });
+}
+/**
+* Builds a `Set-Cookie` header value with HubSpot's default attributes
+* (HttpOnly, Secure, SameSite). Centralizes the serialization so all
+* cookies share the same policy.
+*/
+function serializeCookie(options) {
+	const { name, value, path, sameSite = "Strict", maxAge, secure = true, httpOnly = true, partitioned = false } = options;
+	const parts = [`${name}=${value}`];
+	if (httpOnly) parts.push("HttpOnly");
+	if (secure) parts.push("Secure");
+	parts.push(`SameSite=${sameSite}`);
+	parts.push(`Path=${path}`);
+	parts.push(`Max-Age=${maxAge}`);
+	if (partitioned) parts.push("Partitioned");
+	return parts.join("; ");
+}
+//#endregion
+//#region src/server/hono/hubspot-connect-routes/constants.ts
+const SESSION_MAX_AGE_SEC = 2592e3;
+const OAUTH_TEMP_MAX_AGE_SEC = 3600;
+const REFRESH_COOKIE_MAX_AGE_SEC = 2592e3;
+//#endregion
+//#region src/server/hono/hubspot-connect-routes/oauth-client.ts
+/**
+* Lifetime of the OAuth `client_assertion` JWT in seconds. Short by
+* design — RFC 7521 recommends short-lived assertions, and HubSpot's
+* authorization server rejects assertions older than ~5 minutes.
+*/
+const CLIENT_ASSERTION_TTL_SEC = 60;
+/**
+* The `client_assertion_type` value mandated by RFC 7523 §2.2 for
+* JWT-bearer client authentication.
+*/
+const JWT_BEARER_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+/**
+* Mints a short-lived ES256 JWT used as the `client_assertion`
+* parameter when calling HubSpot's token endpoint, per RFC 7523.
+*/
+async function buildClientAssertion(options) {
+	const { appKeys, clientId, audience } = options;
+	return signJwt({
+		privateKey: appKeys.appPrivateKey,
+		payload: {
+			iss: clientId,
+			sub: clientId,
+			aud: audience,
+			jti: crypto.randomUUID()
+		},
+		ttlSeconds: CLIENT_ASSERTION_TTL_SEC
+	});
+}
+/**
+* Signs a DPoP proof for a `POST` to HubSpot's token endpoint. RFC 9449
+* binds the resulting access token to the proving public key so that
+* later API calls must come from the same key holder.
+*/
+async function buildTokenEndpointDpopProof(options) {
+	const { appKeys, tokenEndpointUrl, sessionIdHash } = options;
+	return signDpopProof({
+		appKeys,
+		claims: {
+			htm: "POST",
+			htu: tokenEndpointUrl,
+			jti: crypto.randomUUID(),
+			iat: Math.floor(Date.now() / 1e3),
+			sid: sessionIdHash
+		}
+	});
+}
+/**
+* POSTs an `application/x-www-form-urlencoded` body to a HubSpot token
+* endpoint. Attaches a `DPoP` header when `isDpopEnabled` is true and
+* `dpopProof` is provided. Reads the response once — either
+* as JSON on success or as text on failure — so callers never have to
+* consume the body twice.
+*/
+async function requestOAuthToken(options) {
+	const { tokenEndpointUrl, formParams, dpopProof, isDpopEnabled } = options;
+	const headers = { "Content-Type": "application/x-www-form-urlencoded" };
+	if (isDpopEnabled) {
+		if (!dpopProof) throw new Error("DPoP proof is required when DPoP is enabled");
+		headers.DPoP = dpopProof;
+	}
+	const tokenResponse = await fetch(tokenEndpointUrl, {
+		method: "POST",
+		headers,
+		body: new URLSearchParams(formParams)
+	});
+	if (!tokenResponse.ok) {
+		const errorText = await tokenResponse.text();
+		return {
+			ok: false,
+			status: tokenResponse.status,
+			errorText
+		};
+	}
+	return {
+		ok: true,
+		body: await tokenResponse.json()
+	};
+}
+/**
+* Form parameters always present on the OAuth `client_assertion` flow.
+* Spread into the call site's `formParams`.
+*/
+function buildClientAssertionFormParams(input) {
+	const { clientId, clientAssertion } = input;
+	return {
+		client_id: clientId,
+		client_assertion_type: JWT_BEARER_ASSERTION_TYPE,
+		client_assertion: clientAssertion
+	};
+}
+function buildClientSecretFormParams(options) {
+	const { clientId, clientSecret } = options;
+	return {
+		client_id: clientId,
+		client_secret: clientSecret
+	};
+}
+//#endregion
+//#region src/server/hono/hubspot-connect-routes/utils.ts
+function clearTempCookie(name) {
+	return serializeCookie({
+		name,
+		value: "",
+		path: "/",
+		sameSite: "None",
+		maxAge: 0,
+		partitioned: true
+	});
+}
+/**
+* Parses the request `Origin` header into the canonical origin
+* string (`URL.origin`) or returns `null` when the header is
+* missing, malformed, or carries a scheme/host the SDK does not
+* accept.
+*
+* Accepted shapes:
+*
+* - `https://<host>` for production deployments.
+* - `http://localhost[:<port>]` and `http://127.0.0.1[:<port>]`
+*   for local development; browsers exempt these from the `Secure`
+*   cookie restriction.
+*
+* Rejects values with a path/query/hash component (the request
+* `Origin` header is by spec a bare origin, so anything else
+* indicates a malformed or hostile request).
+*/
+function parseAppOriginHeader(originHeader) {
+	if (!originHeader) return null;
+	let parsed;
+	try {
+		parsed = new URL(originHeader);
+	} catch {
+		return null;
+	}
+	if (parsed.pathname !== "/" && parsed.pathname !== "") return null;
+	if (parsed.search !== "" || parsed.hash !== "") return null;
+	if (parsed.protocol === "https:") return parsed.origin;
+	if (parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1")) return parsed.origin;
+	return null;
+}
+/**
+* OAuth `redirect_uri` for the cross-origin app shape: the OAuth
+* callback lands on the **frontend** origin (not the SDK's edge
+* function host), so all cookies set by `init-session` and read by
+* `auth/complete` live in the same `(frontend, edge)` CHIPS
+* partition.
+*
+* Used by `auth/init-session` (when building `authorization_url`)
+* and `auth/complete` (which must rebuild the same value to satisfy
+* the OAuth token endpoint's `redirect_uri` check).
+*/
+function buildFrontendOAuthRedirectUri(appOrigin) {
+	return `${appOrigin}${HUBSPOT_FRONTEND_CALLBACK_PATH}`;
+}
+function isSafeReturnPath(rawPath) {
+	if (!rawPath.startsWith("/")) return false;
+	if (rawPath.includes("\0")) return false;
+	let decoded;
+	try {
+		decoded = decodeURIComponent(rawPath);
+	} catch {
+		return false;
+	}
+	if (!decoded.startsWith("/")) return false;
+	const second = decoded.charAt(1);
+	if (second === "/" || second === "\\") return false;
+	return true;
+}
+function normalizeHubSpotConnectBasePath(basePath) {
+	return basePath.endsWith("/") && basePath.length > 1 ? basePath.slice(0, -1) : basePath;
+}
+/**
+* Public origin for hubspot-connect URLs (`redirect_uri`, CIMD `client_id`,
+* `jwks_uri`). Matches the host/proto rules used for the OAuth callback.
+*/
+function buildHubSpotConnectRequestOrigin(options) {
+	const { requestUrl, xForwardedProto, xForwardedHost, requestHostHeader } = options;
+	const proto = xForwardedProto?.split(",")[0]?.trim();
+	if (proto && (proto === "http" || proto === "https")) {
+		const forwardedHost = xForwardedHost?.split(",")[0]?.trim();
+		const hostHeader = requestHostHeader?.split(",")[0]?.trim();
+		return `${proto}://${forwardedHost || hostHeader || new URL(requestUrl).host}`;
+	}
+	return new URL(requestUrl).origin;
+}
+/**
+* OAuth `redirect_uri` for the hubspot-connect callback. Uses
+* `X-Forwarded-Proto` with `X-Forwarded-Host`, then `Host`, then the request URL
+* host when the proto is forwarded (reverse proxy); otherwise the request URL
+* origin.
+*/
+function buildOAuthRedirectUriFromRequest(options) {
+	const trimmed = normalizeHubSpotConnectBasePath(options.basePath);
+	return `${buildHubSpotConnectRequestOrigin(options)}${trimmed}/auth/callback`;
+}
+/**
+* CIMD `client_id` URL: `{origin}{basePath}/client.json`.
+*/
+function buildCimdClientIdUrlFromRequest(options) {
+	const trimmed = normalizeHubSpotConnectBasePath(options.basePath);
+	return `${buildHubSpotConnectRequestOrigin(options)}${trimmed}/client.json`;
+}
+/**
+* App JWKS URL published in CIMD: `{origin}{basePath}/jwks.json`.
+*/
+function buildHubSpotAppJwksUrlFromRequest(options) {
+	const trimmed = normalizeHubSpotConnectBasePath(options.basePath);
+	return `${buildHubSpotConnectRequestOrigin(options)}${trimmed}/jwks.json`;
+}
+function isPositiveFiniteNumber(value) {
+	return typeof value === "number" && Number.isFinite(value) && value > 0;
+}
+//#endregion
+//#region src/server/hono/hubspot-connect-routes/auth-complete.ts
+/**
+* Cross-origin OAuth completion endpoint.
+*
+* Called from the React app on the frontend OAuth callback path
+* (`HUBSPOT_FRONTEND_CALLBACK_PATH`) once HubSpot has redirected the
+* browser back with `?code` + `?state`. The browser POSTs both
+* values here as a credentialed cross-site fetch — same partition as
+* `init-session`, so the temp PKCE/state cookies are visible — and
+* the SDK:
+*
+* 1. Validates `state` against the temp `__hs_oauth_state` cookie.
+* 2. Pulls the PKCE verifier from `__hs_pkce_verifier`.
+* 3. Rebuilds the same `redirect_uri` it sent to HubSpot during
+*    `init-session` (frontend origin + the fixed callback path);
+*    the OAuth token endpoint requires the two values to match.
+* 4. Exchanges `code` for an access + refresh token (with DPoP /
+*    CIMD client-assertion when enabled).
+* 5. Sets the durable session cookies (access token, refresh) with
+*    `SameSite=None; Secure; Partitioned` so they live in the
+*    `(frontend, edge)` partition where subsequent API fetches will
+*    read them.
+* 6. Clears the temp cookies.
+* 7. Returns `{ expires_at, return_path }` so the controller can
+*    update its session-storage expiry tracking and navigate back to
+*    the page the user started the connect flow from.
+*/
+async function handleAuthComplete(c, options) {
+	const { appKeys, refreshCookiePath, hubspotConnectEnv } = options;
+	const xForwardedProto = c.req.header("x-forwarded-proto") ?? void 0;
+	const xForwardedHost = c.req.header("x-forwarded-host") ?? void 0;
+	const requestHostHeader = c.req.header("host") ?? void 0;
+	const code = c.req.query(AUTH_COMPLETE_CODE_PARAM);
+	const state = c.req.query(AUTH_COMPLETE_STATE_PARAM);
+	if (!code || !state) return c.json({ error: "Missing code or state" }, 400);
+	if (hubspotConnectEnv.isAppPrivateKeyRequired && !appKeys) return c.json({ error: "Server misconfiguration: HUBSPOT_APP_PRIVATE_KEY is required when CIMD or DPoP is enabled" }, 500);
+	const cookies = parseCookies(c.req.header("Cookie"));
+	const expectedState = cookies[TEMP_COOKIE_OAUTH_STATE];
+	const codeVerifier = cookies[TEMP_COOKIE_PKCE_VERIFIER];
+	const appOriginCookie = cookies[HUBSPOT_APP_ORIGIN_COOKIE_NAME];
+	if (!expectedState || state !== decodeURIComponent(expectedState)) return c.json({ error: "State mismatch" }, 403);
+	if (!codeVerifier) return c.json({ error: "Missing PKCE verifier" }, 400);
+	const appOrigin = parseAppOriginHeader(appOriginCookie);
+	if (!appOrigin) return c.json({ error: "Missing app origin cookie" }, 400);
+	let statePayload;
+	try {
+		statePayload = JSON.parse(new TextDecoder().decode(base64urlDecode(decodeURIComponent(state))));
+	} catch {
+		return c.json({ error: "Malformed state value" }, 400);
+	}
+	const returnPath = statePayload.return_path;
+	if (!returnPath || !isSafeReturnPath(returnPath)) return c.json({ error: "Invalid return path in state" }, 400);
+	const sessionId = statePayload.sid;
+	if (!sessionId) return c.json({ error: "Missing app session cookie" }, 400);
+	const decodedCodeVerifier = decodeURIComponent(codeVerifier);
+	const clientId = hubspotConnectEnv.isCimdEnabled ? buildCimdClientIdUrlFromRequest({
+		requestUrl: c.req.url,
+		basePath: options.basePath,
+		xForwardedProto,
+		xForwardedHost,
+		requestHostHeader
+	}) : hubspotConnectEnv.hubspotClientId;
+	const redirectUri = buildFrontendOAuthRedirectUri(appOrigin);
+	const tokenEndpointUrl = new URL("/oauth/v1/token", hubspotConnectEnv.hubspotOAuthApiOrigin).href;
+	let dpopProof;
+	if (hubspotConnectEnv.isDpopEnabled) dpopProof = await buildTokenEndpointDpopProof({
+		appKeys,
+		tokenEndpointUrl,
+		sessionIdHash: sessionId
+	});
+	let formParams;
+	if (hubspotConnectEnv.isCimdEnabled) formParams = {
+		grant_type: "authorization_code",
+		code,
+		code_verifier: decodedCodeVerifier,
+		redirect_uri: redirectUri,
+		...buildClientAssertionFormParams({
+			clientId,
+			clientAssertion: await buildClientAssertion({
+				appKeys,
+				clientId,
+				audience: tokenEndpointUrl
+			})
+		})
+	};
+	else formParams = {
+		grant_type: "authorization_code",
+		code,
+		code_verifier: decodedCodeVerifier,
+		redirect_uri: redirectUri,
+		...buildClientSecretFormParams({
+			clientId,
+			clientSecret: hubspotConnectEnv.hubspotClientSecret
+		})
+	};
+	const tokenResult = await requestOAuthToken({
+		tokenEndpointUrl,
+		isDpopEnabled: hubspotConnectEnv.isDpopEnabled,
+		...dpopProof !== void 0 ? { dpopProof } : {},
+		formParams
+	});
+	if (!tokenResult.ok) return c.json({ error: `Token exchange failed: ${tokenResult.errorText}` }, 502);
+	const { access_token: accessToken, refresh_token: refreshToken, expires_in } = tokenResult.body;
+	if (!refreshToken) return c.json({ error: "Token response missing refresh_token" }, 502);
+	if (!isPositiveFiniteNumber(expires_in)) return c.json({ error: "Token response missing or invalid expires_in" }, 502);
+	const expiresAt = Date.now() + expires_in * 1e3;
+	const refreshCookieName = `${HUBSPOT_REFRESH_COOKIE_PREFIX}${sessionId}`;
+	setResponseCookie({
+		c,
+		value: serializeCookie({
+			name: HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,
+			value: accessToken,
+			path: "/",
+			sameSite: "None",
+			partitioned: true,
+			maxAge: expires_in
+		})
+	});
+	setResponseCookie({
+		c,
+		value: serializeCookie({
+			name: refreshCookieName,
+			value: refreshToken,
+			path: refreshCookiePath,
+			sameSite: "None",
+			partitioned: true,
+			maxAge: REFRESH_COOKIE_MAX_AGE_SEC
+		})
+	});
+	setResponseCookie({
+		c,
+		value: clearTempCookie(TEMP_COOKIE_PKCE_VERIFIER)
+	});
+	setResponseCookie({
+		c,
+		value: clearTempCookie(TEMP_COOKIE_OAUTH_STATE)
+	});
+	return c.json({
+		expires_at: expiresAt,
+		return_path: returnPath
+	});
+}
+//#endregion
+//#region src/server/hono/hubspot-connect-routes/fetch-hubspot-client-metadata.ts
+/**
+* Builds `scope` and `optional_scope` query values for HubSpot
+* `/oauth/authorize` from in-memory client metadata (same shape as
+* `HubSpotConnectCimdClientMetadata` / `startHubSpotConnectFunction({ client })`).
+*/
+function deriveHubSpotAuthorizeScopesFromClientMetadata(metadata) {
+	const required = metadata.scope?.required;
+	if (!(Array.isArray(required) && required.length > 0 && required.every((s) => typeof s === "string" && s.length > 0))) return {
+		ok: false,
+		status: 500,
+		message: "Invalid or empty scope.required in client metadata"
+	};
+	const scope = required.join(" ");
+	const optionalRaw = metadata.scope.optional;
+	if (optionalRaw == null) return {
+		ok: true,
+		scope
+	};
+	if (!Array.isArray(optionalRaw)) return {
+		ok: false,
+		status: 500,
+		message: "Invalid scope.optional in client metadata"
+	};
+	if (optionalRaw.length === 0) return {
+		ok: true,
+		scope
+	};
+	if (!optionalRaw.every((s) => typeof s === "string" && s.length > 0)) return {
+		ok: false,
+		status: 500,
+		message: "Invalid scope.optional in client metadata"
+	};
+	return {
+		ok: true,
+		scope,
+		optionalScope: optionalRaw.join(" ")
+	};
+}
+//#endregion
+//#region src/server/hono/hubspot-connect-routes/auth-init-session.ts
+async function handleAuthInitSession(c, options) {
+	const { hubspotConnectEnv, cimdClientMetadata } = options;
+	const xForwardedProto = c.req.header("x-forwarded-proto") ?? void 0;
+	const xForwardedHost = c.req.header("x-forwarded-host") ?? void 0;
+	const requestHostHeader = c.req.header("host") ?? void 0;
+	const returnPath = new URL(c.req.url).searchParams.get("return_path") ?? "/";
+	if (!isSafeReturnPath(returnPath)) return c.text("Invalid return_path", 400);
+	const appOrigin = parseAppOriginHeader(c.req.header("Origin"));
+	if (!appOrigin) return c.text("Missing or invalid Origin header; init-session must be called from a browser", 400);
+	const sessionIdBytes = new Uint8Array(32);
+	crypto.getRandomValues(sessionIdBytes);
+	const sessionId = base64url(sessionIdBytes);
+	const sessionIdHash = await sha256base64url(sessionId);
+	const codeVerifierBytes = new Uint8Array(32);
+	crypto.getRandomValues(codeVerifierBytes);
+	const codeVerifier = base64url(codeVerifierBytes);
+	const codeChallenge = await sha256base64url(codeVerifier);
+	const stateValue = base64url(new TextEncoder().encode(JSON.stringify({
+		return_path: returnPath,
+		sid: sessionIdHash
+	})));
+	const clientId = hubspotConnectEnv.isCimdEnabled ? buildCimdClientIdUrlFromRequest({
+		requestUrl: c.req.url,
+		basePath: options.basePath,
+		xForwardedProto,
+		xForwardedHost,
+		requestHostHeader
+	}) : hubspotConnectEnv.hubspotClientId;
+	const redirectUri = buildFrontendOAuthRedirectUri(appOrigin);
+	const authorizeUrl = new URL(hubspotConnectEnv.hubspotAuthorizationEndpoint);
+	authorizeUrl.searchParams.set("response_type", "code");
+	authorizeUrl.searchParams.set("client_id", clientId);
+	authorizeUrl.searchParams.set("redirect_uri", redirectUri);
+	authorizeUrl.searchParams.set("code_challenge", codeChallenge);
+	authorizeUrl.searchParams.set("code_challenge_method", "S256");
+	authorizeUrl.searchParams.set("state", stateValue);
+	authorizeUrl.searchParams.set("sid", sessionIdHash);
+	if (!hubspotConnectEnv.isCimdEnabled) {
+		const scopesResult = deriveHubSpotAuthorizeScopesFromClientMetadata(cimdClientMetadata);
+		if (!scopesResult.ok) return c.text(scopesResult.message, scopesResult.status);
+		authorizeUrl.searchParams.set("scope", scopesResult.scope);
+		if (scopesResult.optionalScope !== void 0) authorizeUrl.searchParams.set("optional_scope", scopesResult.optionalScope);
+	}
+	setResponseCookie({
+		c,
+		value: serializeCookie({
+			name: HUBSPOT_APP_ORIGIN_COOKIE_NAME,
+			value: appOrigin,
+			path: "/",
+			sameSite: "None",
+			partitioned: true,
+			maxAge: SESSION_MAX_AGE_SEC
+		})
+	});
+	setResponseCookie({
+		c,
+		value: serializeCookie({
+			name: HUBSPOT_APP_SID_COOKIE_NAME,
+			value: sessionId,
+			path: "/",
+			sameSite: "None",
+			partitioned: true,
+			maxAge: SESSION_MAX_AGE_SEC
+		})
+	});
+	setResponseCookie({
+		c,
+		value: serializeCookie({
+			name: TEMP_COOKIE_PKCE_VERIFIER,
+			value: encodeURIComponent(codeVerifier),
+			path: "/",
+			sameSite: "None",
+			partitioned: true,
+			maxAge: OAUTH_TEMP_MAX_AGE_SEC
+		})
+	});
+	setResponseCookie({
+		c,
+		value: serializeCookie({
+			name: TEMP_COOKIE_OAUTH_STATE,
+			value: encodeURIComponent(stateValue),
+			path: "/",
+			sameSite: "None",
+			partitioned: true,
+			maxAge: OAUTH_TEMP_MAX_AGE_SEC
+		})
+	});
+	return c.json({ authorization_url: authorizeUrl.toString() });
+}
+//#endregion
+//#region src/server/hono/hubspot-connect-routes/auth-logout.ts
+async function revokeToken(options) {
+	const { revokeEndpointUrl, body, logger } = options;
+	try {
+		const response = await fetch(revokeEndpointUrl, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body
+		});
+		if (!response.ok) logger.warn(`HubSpot token revoke returned HTTP ${response.status} ${response.statusText}`);
+	} catch (error) {
+		logger.warn("HubSpot token revoke request failed", error);
+	}
+}
+async function handleAuthLogout(c, options) {
+	const { appKeys, refreshCookiePath, basePath, hubspotConnectEnv, logger } = options;
+	const xForwardedProto = c.req.header("x-forwarded-proto") ?? void 0;
+	const xForwardedHost = c.req.header("x-forwarded-host") ?? void 0;
+	const requestHostHeader = c.req.header("host") ?? void 0;
+	const cookies = parseCookies(c.req.header("Cookie"));
+	const accessToken = cookies[HUBSPOT_ACCESS_TOKEN_COOKIE_NAME];
+	const clientId = hubspotConnectEnv.isCimdEnabled ? buildCimdClientIdUrlFromRequest({
+		requestUrl: c.req.url,
+		basePath,
+		xForwardedProto,
+		xForwardedHost,
+		requestHostHeader
+	}) : hubspotConnectEnv.hubspotClientId;
+	const revokeEndpointUrl = new URL("/oauth/v1/revoke", hubspotConnectEnv.hubspotOAuthApiOrigin).href;
+	if (accessToken) if (hubspotConnectEnv.isCimdEnabled) {
+		if (!appKeys) return c.json({ error: "Server misconfiguration: HUBSPOT_APP_PRIVATE_KEY is required when CIMD is enabled" }, 500);
+		const clientAssertion = await buildClientAssertion({
+			appKeys,
+			clientId,
+			audience: revokeEndpointUrl
+		});
+		await revokeToken({
+			revokeEndpointUrl,
+			body: new URLSearchParams({
+				token: accessToken,
+				token_type_hint: "access_token",
+				client_id: clientId,
+				client_assertion_type: "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
+				client_assertion: clientAssertion
+			}),
+			logger
+		});
+	} else await revokeToken({
+		revokeEndpointUrl,
+		body: new URLSearchParams({
+			token: accessToken,
+			token_type_hint: "access_token",
+			client_id: clientId,
+			client_secret: hubspotConnectEnv.hubspotClientSecret
+		}),
+		logger
+	});
+	setResponseCookie({
+		c,
+		value: serializeCookie({
+			name: HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,
+			value: "",
+			path: "/",
+			sameSite: "None",
+			partitioned: true,
+			maxAge: 0
+		})
+	});
+	setResponseCookie({
+		c,
+		value: serializeCookie({
+			name: HUBSPOT_APP_SID_COOKIE_NAME,
+			value: "",
+			path: "/",
+			sameSite: "None",
+			partitioned: true,
+			maxAge: 0
+		})
+	});
+	setResponseCookie({
+		c,
+		value: serializeCookie({
+			name: HUBSPOT_APP_ORIGIN_COOKIE_NAME,
+			value: "",
+			path: "/",
+			sameSite: "None",
+			partitioned: true,
+			maxAge: 0
+		})
+	});
+	Object.keys(cookies).forEach((cookieName) => {
+		if (cookieName.startsWith("hs_refresh_")) setResponseCookie({
+			c,
+			value: serializeCookie({
+				name: cookieName,
+				value: "",
+				path: refreshCookiePath,
+				sameSite: "None",
+				partitioned: true,
+				maxAge: 0
+			})
+		});
+	});
+	return c.json({ redirect_to: "/" });
+}
+//#endregion
+//#region src/server/hono/hubspot-connect-routes/auth-refresh.ts
+async function handleAuthRefresh(c, options) {
+	const { appKeys, refreshCookiePath, basePath, hubspotConnectEnv } = options;
+	const xForwardedProto = c.req.header("x-forwarded-proto") ?? void 0;
+	const xForwardedHost = c.req.header("x-forwarded-host") ?? void 0;
+	const requestHostHeader = c.req.header("host") ?? void 0;
+	const cookies = parseCookies(c.req.header("Cookie"));
+	const sessionId = cookies[HUBSPOT_APP_SID_COOKIE_NAME];
+	if (!sessionId) return c.json({ error: "Missing session cookie" }, 401);
+	if (hubspotConnectEnv.isAppPrivateKeyRequired && !appKeys) return c.json({ error: "Server misconfiguration: HUBSPOT_APP_PRIVATE_KEY is required when CIMD or DPoP is enabled" }, 500);
+	const sidHash = await sha256base64url(sessionId);
+	const refreshCookieName = `${HUBSPOT_REFRESH_COOKIE_PREFIX}${sidHash}`;
+	const refreshToken = cookies[refreshCookieName];
+	if (!refreshToken) return c.json({ error: "Missing refresh token" }, 401);
+	const clientId = hubspotConnectEnv.isCimdEnabled ? buildCimdClientIdUrlFromRequest({
+		requestUrl: c.req.url,
+		basePath,
+		xForwardedProto,
+		xForwardedHost,
+		requestHostHeader
+	}) : hubspotConnectEnv.hubspotClientId;
+	const tokenEndpointUrl = new URL("/oauth/v1/token", hubspotConnectEnv.hubspotOAuthApiOrigin).href;
+	let dpopProof;
+	if (hubspotConnectEnv.isDpopEnabled) dpopProof = await buildTokenEndpointDpopProof({
+		appKeys,
+		tokenEndpointUrl,
+		sessionIdHash: sidHash
+	});
+	let formParams;
+	if (hubspotConnectEnv.isCimdEnabled) formParams = {
+		grant_type: "refresh_token",
+		refresh_token: refreshToken,
+		...buildClientAssertionFormParams({
+			clientId,
+			clientAssertion: await buildClientAssertion({
+				appKeys,
+				clientId,
+				audience: tokenEndpointUrl
+			})
+		})
+	};
+	else formParams = {
+		grant_type: "refresh_token",
+		refresh_token: refreshToken,
+		...buildClientSecretFormParams({
+			clientId,
+			clientSecret: hubspotConnectEnv.hubspotClientSecret
+		})
+	};
+	const tokenResult = await requestOAuthToken({
+		tokenEndpointUrl,
+		isDpopEnabled: hubspotConnectEnv.isDpopEnabled,
+		...dpopProof !== void 0 ? { dpopProof } : {},
+		formParams
+	});
+	if (!tokenResult.ok) return c.json({ error: `Token refresh failed: ${tokenResult.errorText}` }, 502);
+	const { access_token: newAccessToken, refresh_token: newRefreshToken, expires_in } = tokenResult.body;
+	if (!newRefreshToken) return c.json({ error: "Token response missing refresh_token" }, 502);
+	if (!isPositiveFiniteNumber(expires_in)) return c.json({ error: "Token response missing or invalid expires_in" }, 502);
+	setResponseCookie({
+		c,
+		value: serializeCookie({
+			name: HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,
+			value: newAccessToken,
+			path: "/",
+			sameSite: "None",
+			partitioned: true,
+			maxAge: expires_in
+		})
+	});
+	setResponseCookie({
+		c,
+		value: serializeCookie({
+			name: refreshCookieName,
+			value: newRefreshToken,
+			path: refreshCookiePath,
+			sameSite: "None",
+			partitioned: true,
+			maxAge: REFRESH_COOKIE_MAX_AGE_SEC
+		})
+	});
+	Object.keys(cookies).forEach((cookieName) => {
+		if (cookieName.startsWith("hs_refresh_") && cookieName !== refreshCookieName) setResponseCookie({
+			c,
+			value: serializeCookie({
+				name: cookieName,
+				value: "",
+				path: refreshCookiePath,
+				sameSite: "None",
+				partitioned: true,
+				maxAge: 0
+			})
+		});
+	});
+	return c.json({ expires_in });
+}
+//#endregion
+//#region src/server/hono/hubspot-connect-routes/cimd-public-routes.ts
+async function handleCimdClientJson(c, options) {
+	const { cimdClientMetadata, basePath } = options;
+	if (!cimdClientMetadata) return c.text("CIMD client metadata is not configured", 500);
+	const xForwardedProto = c.req.header("x-forwarded-proto") ?? void 0;
+	const xForwardedHost = c.req.header("x-forwarded-host") ?? void 0;
+	const requestHostHeader = c.req.header("host") ?? void 0;
+	const forwarded = {
+		requestUrl: c.req.url,
+		basePath,
+		xForwardedProto,
+		xForwardedHost,
+		requestHostHeader
+	};
+	const body = {
+		redirect_uri: buildOAuthRedirectUriFromRequest(forwarded),
+		jwks_uri: buildHubSpotAppJwksUrlFromRequest(forwarded),
+		scope: cimdClientMetadata.scope
+	};
+	return c.text(JSON.stringify(body, null, 2), 200, { "Content-Type": "application/json; charset=utf-8" });
+}
+async function handleCimdAppJwks(c, options) {
+	const { appKeys, hubspotConnectEnv } = options;
+	if (!hubspotConnectEnv.isCimdEnabled) return c.text("Not found", 404);
+	if (!appKeys) return c.text("Missing app keys", 503);
+	const kid = await getJwkThumbprint({ publicKeyJwk: appKeys.appPublicKeyJwk });
+	const jwks = { keys: [{
+		...appKeys.appPublicKeyJwk,
+		kid,
+		use: "sig",
+		alg: "ES256",
+		key_ops: ["verify"],
+		ext: true
+	}] };
+	return c.json(jwks);
+}
+//#endregion
+//#region src/server/hono/hubspot-connect-routes/hubspot-connect-routes.ts
+/**
+* Mounts hubspot-connect routes: OAuth (`/auth/...`); `GET /client.json`
+* from `cimdClientMetadata`; `GET /jwks.json` when CIMD is enabled.
+*/
+function registerHubSpotConnectRoutes(options) {
+	const { app, appKeys, basePath, hubspotConnectEnv, cimdClientMetadata, logger = noopLogger } = options;
+	if (!cimdClientMetadata) throw new Error("registerHubSpotConnectRoutes: cimdClientMetadata is required");
+	assertHubSpotConnectCimdClientMetadata(cimdClientMetadata);
+	const oauthRouteOptions = {
+		appKeys,
+		refreshCookiePath: `${basePath}/auth`,
+		logger,
+		basePath,
+		hubspotConnectEnv,
+		cimdClientMetadata
+	};
+	app.use("*", corsMiddleware());
+	app.get("/client.json", (c) => handleCimdClientJson(c, oauthRouteOptions));
+	if (hubspotConnectEnv.isCimdEnabled) app.get("/jwks.json", (c) => handleCimdAppJwks(c, oauthRouteOptions));
+	app.get("/auth/init-session", (c) => handleAuthInitSession(c, oauthRouteOptions));
+	app.post("/auth/complete", (c) => handleAuthComplete(c, oauthRouteOptions));
+	app.post("/auth/refresh", (c) => handleAuthRefresh(c, oauthRouteOptions));
+	app.post("/auth/logout", (c) => handleAuthLogout(c, oauthRouteOptions));
+}
+//#endregion
+//#region src/server/hono/hubspot-connect-routes/load-hubspot-connect-routes-env.ts
+/**
+* Reads hubspot-connect environment variables from `process.env` or
+* `Deno.env` and returns a typed object for
+* {@link registerHubSpotConnectRoutes}.
+*/
+function loadHubSpotConnectRoutesEnv() {
+	const hubspotAuthorizationEndpoint = requireEnv("HUBSPOT_AUTHORIZATION_ENDPOINT");
+	const hubspotOAuthApiOrigin = new URL(requireEnv("HUBSPOT_OAUTH_API_ORIGIN")).origin;
+	const isCimdEnabled = isHubspotCimdEnabled();
+	const isDpopEnabled = isHubspotDpopEnabled();
+	const isAppPrivateKeyRequired = isCimdEnabled || isDpopEnabled;
+	if (isCimdEnabled) return {
+		hubspotAuthorizationEndpoint,
+		hubspotOAuthApiOrigin,
+		isCimdEnabled: true,
+		isDpopEnabled,
+		isAppPrivateKeyRequired
+	};
+	return {
+		hubspotAuthorizationEndpoint,
+		hubspotOAuthApiOrigin,
+		isCimdEnabled: false,
+		isDpopEnabled,
+		isAppPrivateKeyRequired,
+		hubspotClientId: requireEnv("HUBSPOT_CLIENT_ID"),
+		hubspotClientSecret: requireEnv("HUBSPOT_CLIENT_SECRET")
+	};
+}
+//#endregion
+//#region src/server/lovable/hubspot-connect/run-hubspot-connect-lovable-server.ts
+const PORT$1 = Deno.env.get("PORT");
+const serveOptions$1 = typeof PORT$1 === "string" ? { port: parseInt(PORT$1, 10) } : {};
+const HUBSPOT_CONNECT_BASE_PATH = "/functions/v1/hubspot-connect";
+function runHubSpotConnectLovableServer(options) {
+	const { appKeys, cimdClientMetadata } = options;
+	const hubspotConnectEnv = loadHubSpotConnectRoutesEnv();
+	const result = Deno.serve(serveOptions$1, (request) => {
+		const app = new Hono();
+		registerHubSpotConnectRoutes({
+			app: app.basePath(HUBSPOT_CONNECT_BASE_PATH),
+			appKeys,
+			basePath: HUBSPOT_CONNECT_BASE_PATH,
+			hubspotConnectEnv,
+			cimdClientMetadata
+		});
+		return app.fetch(request);
+	});
+	console.log(`[hubspot-connect] Listening on ${result.addr.port}`);
+	return Promise.resolve();
+}
+//#endregion
+//#region src/server/lovable/hubspot-connect/index.ts
+/**
+* Lovable-style entry point for the hubspot-connect Deno function.
+* Loads `HUBSPOT_APP_PRIVATE_KEY` via `secureStart`, then serves OAuth
+* and CIMD routes under `/functions/v1/hubspot-connect`.
+*/
+async function startHubSpotConnectFunction(options) {
+	assertHubSpotConnectCimdClientMetadata(options.client);
+	await secureStart(async () => ({ start: (context) => runHubSpotConnectLovableServer({
+		...context,
+		cimdClientMetadata: options.client
+	}) }));
+}
+//#endregion
+//#region src/server/lovable/create-app-function-start.ts
+const PORT = Deno.env.get("PORT");
+const serveOptions = typeof PORT === "string" ? { port: parseInt(PORT, 10) } : {};
+/**
+* Builds a Deno-style `start({ appKeys })` entry point that boots a
+* Hono app under `basePath`, wires the SDK's per-request HubSpot
+* proxy via `createAppConnectRequestHandler`, and serves it with
+* `Deno.serve` on `PORT`.
+*/
+function createAppFunctionStart(options) {
+	const { basePath, registerRoutes, logger } = options;
+	return ({ appKeys }) => {
+		Deno.serve(serveOptions, createAppConnectRequestHandler({
+			appKeys,
+			...logger !== void 0 ? { logger } : {},
+			registerRoutes: (app) => {
+				registerRoutes(app.basePath(basePath));
+			}
+		}));
+		console.log(`[app-function ${basePath}] Listening on http://localhost:${PORT}`);
+		return Promise.resolve();
+	};
+}
+//#endregion
 export { createAppFunctionStart, secureStart, startHubSpotConnectFunction };
+
+//# sourceMappingURL=lovable.js.map