@hubspot/app-connect-sdk 1.0.0-alpha.3 → 1.0.0-alpha.4

package/dist/server/hono/hubspot-connect-routes/utils.js

@@ -1,120 +0,0 @@
-import { HUBSPOT_FRONTEND_CALLBACK_PATH } from "../../shared/constants.js";
-import { serializeCookie } from "../utils/cookie-utils.js";
-//#region src/server/hono/hubspot-connect-routes/utils.ts
-function clearTempCookie(name) {
-	return serializeCookie({
-		name,
-		value: "",
-		path: "/",
-		sameSite: "None",
-		maxAge: 0,
-		partitioned: true
-	});
-}
-/**
-* Parses the request `Origin` header into the canonical origin
-* string (`URL.origin`) or returns `null` when the header is
-* missing, malformed, or carries a scheme/host the SDK does not
-* accept.
-*
-* Accepted shapes:
-*
-* - `https://<host>` for production deployments.
-* - `http://localhost[:<port>]` and `http://127.0.0.1[:<port>]`
-*   for local development; browsers exempt these from the `Secure`
-*   cookie restriction.
-*
-* Rejects values with a path/query/hash component (the request
-* `Origin` header is by spec a bare origin, so anything else
-* indicates a malformed or hostile request).
-*/
-function parseAppOriginHeader(originHeader) {
-	if (!originHeader) return null;
-	let parsed;
-	try {
-		parsed = new URL(originHeader);
-	} catch {
-		return null;
-	}
-	if (parsed.pathname !== "/" && parsed.pathname !== "") return null;
-	if (parsed.search !== "" || parsed.hash !== "") return null;
-	if (parsed.protocol === "https:") return parsed.origin;
-	if (parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1")) return parsed.origin;
-	return null;
-}
-/**
-* OAuth `redirect_uri` for the cross-origin app shape: the OAuth
-* callback lands on the **frontend** origin (not the SDK's edge
-* function host), so all cookies set by `init-session` and read by
-* `auth/complete` live in the same `(frontend, edge)` CHIPS
-* partition.
-*
-* Used by `auth/init-session` (when building `authorization_url`)
-* and `auth/complete` (which must rebuild the same value to satisfy
-* the OAuth token endpoint's `redirect_uri` check).
-*/
-function buildFrontendOAuthRedirectUri(appOrigin) {
-	return `${appOrigin}${HUBSPOT_FRONTEND_CALLBACK_PATH}`;
-}
-function isSafeReturnPath(rawPath) {
-	if (!rawPath.startsWith("/")) return false;
-	if (rawPath.includes("\0")) return false;
-	let decoded;
-	try {
-		decoded = decodeURIComponent(rawPath);
-	} catch {
-		return false;
-	}
-	if (!decoded.startsWith("/")) return false;
-	const second = decoded.charAt(1);
-	if (second === "/" || second === "\\") return false;
-	return true;
-}
-function normalizeHubSpotConnectBasePath(basePath) {
-	return basePath.endsWith("/") && basePath.length > 1 ? basePath.slice(0, -1) : basePath;
-}
-/**
-* Public origin for hubspot-connect URLs (`redirect_uri`, CIMD `client_id`,
-* `jwks_uri`). Matches the host/proto rules used for the OAuth callback.
-*/
-function buildHubSpotConnectRequestOrigin(options) {
-	const { requestUrl, xForwardedProto, xForwardedHost, requestHostHeader } = options;
-	const proto = xForwardedProto?.split(",")[0]?.trim();
-	if (proto && (proto === "http" || proto === "https")) {
-		const forwardedHost = xForwardedHost?.split(",")[0]?.trim();
-		const hostHeader = requestHostHeader?.split(",")[0]?.trim();
-		return `${proto}://${forwardedHost || hostHeader || new URL(requestUrl).host}`;
-	}
-	return new URL(requestUrl).origin;
-}
-/**
-* OAuth `redirect_uri` for the hubspot-connect callback. Uses
-* `X-Forwarded-Proto` with `X-Forwarded-Host`, then `Host`, then the request URL
-* host when the proto is forwarded (reverse proxy); otherwise the request URL
-* origin.
-*/
-function buildOAuthRedirectUriFromRequest(options) {
-	const trimmed = normalizeHubSpotConnectBasePath(options.basePath);
-	return `${buildHubSpotConnectRequestOrigin(options)}${trimmed}/auth/callback`;
-}
-/**
-* CIMD `client_id` URL: `{origin}{basePath}/client.json`.
-*/
-function buildCimdClientIdUrlFromRequest(options) {
-	const trimmed = normalizeHubSpotConnectBasePath(options.basePath);
-	return `${buildHubSpotConnectRequestOrigin(options)}${trimmed}/client.json`;
-}
-/**
-* App JWKS URL published in CIMD: `{origin}{basePath}/jwks.json`.
-*/
-function buildHubSpotAppJwksUrlFromRequest(options) {
-	const trimmed = normalizeHubSpotConnectBasePath(options.basePath);
-	return `${buildHubSpotConnectRequestOrigin(options)}${trimmed}/jwks.json`;
-}
-function isPositiveFiniteNumber(value) {
-	return typeof value === "number" && Number.isFinite(value) && value > 0;
-}
-//#endregion
-export { buildCimdClientIdUrlFromRequest, buildFrontendOAuthRedirectUri, buildHubSpotAppJwksUrlFromRequest, buildOAuthRedirectUriFromRequest, clearTempCookie, isPositiveFiniteNumber, isSafeReturnPath, parseAppOriginHeader };
-
-//# sourceMappingURL=utils.js.map

package/dist/server/hono/hubspot-connect-routes/utils.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"utils.js","names":[],"sources":["../../../../src/server/hono/hubspot-connect-routes/utils.ts"],"sourcesContent":["import { HUBSPOT_FRONTEND_CALLBACK_PATH } from '../../../shared/constants.ts';\nimport { serializeCookie } from '../utils/cookie-utils.ts';\n\nexport function clearTempCookie(name: string): string {\n  return serializeCookie({\n    name,\n    value: '',\n    path: '/',\n    sameSite: 'None',\n    maxAge: 0,\n    partitioned: true,\n  });\n}\n\n/**\n * Parses the request `Origin` header into the canonical origin\n * string (`URL.origin`) or returns `null` when the header is\n * missing, malformed, or carries a scheme/host the SDK does not\n * accept.\n *\n * Accepted shapes:\n *\n * - `https://<host>` for production deployments.\n * - `http://localhost[:<port>]` and `http://127.0.0.1[:<port>]`\n *   for local development; browsers exempt these from the `Secure`\n *   cookie restriction.\n *\n * Rejects values with a path/query/hash component (the request\n * `Origin` header is by spec a bare origin, so anything else\n * indicates a malformed or hostile request).\n */\nexport function parseAppOriginHeader(\n  originHeader: string | undefined\n): string | null {\n  if (!originHeader) return null;\n  let parsed: URL;\n  try {\n    parsed = new URL(originHeader);\n  } catch {\n    return null;\n  }\n  if (parsed.pathname !== '/' && parsed.pathname !== '') return null;\n  if (parsed.search !== '' || parsed.hash !== '') return null;\n  if (parsed.protocol === 'https:') return parsed.origin;\n  if (\n    parsed.protocol === 'http:' &&\n    (parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1')\n  ) {\n    return parsed.origin;\n  }\n  return null;\n}\n\n/**\n * OAuth `redirect_uri` for the cross-origin app shape: the OAuth\n * callback lands on the **frontend** origin (not the SDK's edge\n * function host), so all cookies set by `init-session` and read by\n * `auth/complete` live in the same `(frontend, edge)` CHIPS\n * partition.\n *\n * Used by `auth/init-session` (when building `authorization_url`)\n * and `auth/complete` (which must rebuild the same value to satisfy\n * the OAuth token endpoint's `redirect_uri` check).\n */\nexport function buildFrontendOAuthRedirectUri(appOrigin: string): string {\n  return `${appOrigin}${HUBSPOT_FRONTEND_CALLBACK_PATH}`;\n}\n\nexport function isSafeReturnPath(rawPath: string): boolean {\n  if (!rawPath.startsWith('/')) return false;\n  if (rawPath.includes('\\0')) return false;\n  let decoded: string;\n  try {\n    decoded = decodeURIComponent(rawPath);\n  } catch {\n    return false;\n  }\n  if (!decoded.startsWith('/')) return false;\n  const second = decoded.charAt(1);\n  if (second === '/' || second === '\\\\') return false;\n  return true;\n}\n\nexport function getRequestHost(requestUrl: string): string {\n  return new URL(requestUrl).host;\n}\n\nexport interface GetRequestHostForHubspotConnectOptions {\n  requestUrl: string;\n  xForwardedHost?: string | undefined;\n  /** `Host` when `X-Forwarded-Host` is absent (some proxies only set `X-Forwarded-Proto`). */\n  requestHostHeader?: string | undefined;\n}\n\n/**\n * Host for CIMD `client_id` URLs when hubspot-connect sits behind a reverse\n * proxy (e.g. Vite → Deno): prefers `X-Forwarded-Host`, then `Host`, then the\n * request URL host.\n */\nexport function getRequestHostForHubspotConnect(\n  options: GetRequestHostForHubspotConnectOptions\n): string {\n  const rawForwarded = options.xForwardedHost?.split(',')[0]?.trim();\n  if (rawForwarded) {\n    try {\n      return new URL(`https://${rawForwarded}`).host;\n    } catch {\n      /* invalid forwarded host */\n    }\n  }\n  const rawHost = options.requestHostHeader?.split(',')[0]?.trim();\n  if (rawHost) {\n    try {\n      return new URL(`https://${rawHost}`).host;\n    } catch {\n      /* invalid host header */\n    }\n  }\n  return getRequestHost(options.requestUrl);\n}\n\nexport interface BuildOAuthRedirectUriFromRequestOptions {\n  requestUrl: string;\n  basePath: string;\n  xForwardedProto?: string | undefined;\n  xForwardedHost?: string | undefined;\n  /** `Host` when `X-Forwarded-Host` is absent but `X-Forwarded-Proto` is set. */\n  requestHostHeader?: string | undefined;\n}\n\nfunction normalizeHubSpotConnectBasePath(basePath: string): string {\n  return basePath.endsWith('/') && basePath.length > 1\n    ? basePath.slice(0, -1)\n    : basePath;\n}\n\n/**\n * Public origin for hubspot-connect URLs (`redirect_uri`, CIMD `client_id`,\n * `jwks_uri`). Matches the host/proto rules used for the OAuth callback.\n */\nexport function buildHubSpotConnectRequestOrigin(\n  options: BuildOAuthRedirectUriFromRequestOptions\n): string {\n  const { requestUrl, xForwardedProto, xForwardedHost, requestHostHeader } =\n    options;\n  const proto = xForwardedProto?.split(',')[0]?.trim();\n  if (proto && (proto === 'http' || proto === 'https')) {\n    const forwardedHost = xForwardedHost?.split(',')[0]?.trim();\n    const hostHeader = requestHostHeader?.split(',')[0]?.trim();\n    const hostPart = forwardedHost || hostHeader || new URL(requestUrl).host;\n    return `${proto}://${hostPart}`;\n  }\n  return new URL(requestUrl).origin;\n}\n\n/**\n * OAuth `redirect_uri` for the hubspot-connect callback. Uses\n * `X-Forwarded-Proto` with `X-Forwarded-Host`, then `Host`, then the request URL\n * host when the proto is forwarded (reverse proxy); otherwise the request URL\n * origin.\n */\nexport function buildOAuthRedirectUriFromRequest(\n  options: BuildOAuthRedirectUriFromRequestOptions\n): string {\n  const trimmed = normalizeHubSpotConnectBasePath(options.basePath);\n  const origin = buildHubSpotConnectRequestOrigin(options);\n  return `${origin}${trimmed}/auth/callback`;\n}\n\n/**\n * CIMD `client_id` URL: `{origin}{basePath}/client.json`.\n */\nexport function buildCimdClientIdUrlFromRequest(\n  options: BuildOAuthRedirectUriFromRequestOptions\n): string {\n  const trimmed = normalizeHubSpotConnectBasePath(options.basePath);\n  const origin = buildHubSpotConnectRequestOrigin(options);\n  return `${origin}${trimmed}/client.json`;\n}\n\n/**\n * App JWKS URL published in CIMD: `{origin}{basePath}/jwks.json`.\n */\nexport function buildHubSpotAppJwksUrlFromRequest(\n  options: BuildOAuthRedirectUriFromRequestOptions\n): string {\n  const trimmed = normalizeHubSpotConnectBasePath(options.basePath);\n  const origin = buildHubSpotConnectRequestOrigin(options);\n  return `${origin}${trimmed}/jwks.json`;\n}\n\nexport function isPositiveFiniteNumber(value: unknown): value is number {\n  return typeof value === 'number' && Number.isFinite(value) && value > 0;\n}\n"],"mappings":";;;AAGA,SAAgB,gBAAgB,MAAsB;CACpD,OAAO,gBAAgB;EACrB;EACA,OAAO;EACP,MAAM;EACN,UAAU;EACV,QAAQ;EACR,aAAa;EACd,CAAC;;;;;;;;;;;;;;;;;;;AAoBJ,SAAgB,qBACd,cACe;CACf,IAAI,CAAC,cAAc,OAAO;CAC1B,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,aAAa;SACxB;EACN,OAAO;;CAET,IAAI,OAAO,aAAa,OAAO,OAAO,aAAa,IAAI,OAAO;CAC9D,IAAI,OAAO,WAAW,MAAM,OAAO,SAAS,IAAI,OAAO;CACvD,IAAI,OAAO,aAAa,UAAU,OAAO,OAAO;CAChD,IACE,OAAO,aAAa,YACnB,OAAO,aAAa,eAAe,OAAO,aAAa,cAExD,OAAO,OAAO;CAEhB,OAAO;;;;;;;;;;;;;AAcT,SAAgB,8BAA8B,WAA2B;CACvE,OAAO,GAAG,YAAY;;AAGxB,SAAgB,iBAAiB,SAA0B;CACzD,IAAI,CAAC,QAAQ,WAAW,IAAI,EAAE,OAAO;CACrC,IAAI,QAAQ,SAAS,KAAK,EAAE,OAAO;CACnC,IAAI;CACJ,IAAI;EACF,UAAU,mBAAmB,QAAQ;SAC/B;EACN,OAAO;;CAET,IAAI,CAAC,QAAQ,WAAW,IAAI,EAAE,OAAO;CACrC,MAAM,SAAS,QAAQ,OAAO,EAAE;CAChC,IAAI,WAAW,OAAO,WAAW,MAAM,OAAO;CAC9C,OAAO;;AAkDT,SAAS,gCAAgC,UAA0B;CACjE,OAAO,SAAS,SAAS,IAAI,IAAI,SAAS,SAAS,IAC/C,SAAS,MAAM,GAAG,GAAG,GACrB;;;;;;AAON,SAAgB,iCACd,SACQ;CACR,MAAM,EAAE,YAAY,iBAAiB,gBAAgB,sBACnD;CACF,MAAM,QAAQ,iBAAiB,MAAM,IAAI,CAAC,IAAI,MAAM;CACpD,IAAI,UAAU,UAAU,UAAU,UAAU,UAAU;EACpD,MAAM,gBAAgB,gBAAgB,MAAM,IAAI,CAAC,IAAI,MAAM;EAC3D,MAAM,aAAa,mBAAmB,MAAM,IAAI,CAAC,IAAI,MAAM;EAE3D,OAAO,GAAG,MAAM,KADC,iBAAiB,cAAc,IAAI,IAAI,WAAW,CAAC;;CAGtE,OAAO,IAAI,IAAI,WAAW,CAAC;;;;;;;;AAS7B,SAAgB,iCACd,SACQ;CACR,MAAM,UAAU,gCAAgC,QAAQ,SAAS;CAEjE,OAAO,GADQ,iCAAiC,QAChC,GAAG,QAAQ;;;;;AAM7B,SAAgB,gCACd,SACQ;CACR,MAAM,UAAU,gCAAgC,QAAQ,SAAS;CAEjE,OAAO,GADQ,iCAAiC,QAChC,GAAG,QAAQ;;;;;AAM7B,SAAgB,kCACd,SACQ;CACR,MAAM,UAAU,gCAAgC,QAAQ,SAAS;CAEjE,OAAO,GADQ,iCAAiC,QAChC,GAAG,QAAQ;;AAG7B,SAAgB,uBAAuB,OAAiC;CACtE,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,MAAM,IAAI,QAAQ"}

package/dist/server/hono/index.js

@@ -1,4 +0,0 @@
-import "./hubspot-connect-routes/cimd-client-metadata-types.js";
-import "./hono-request-handler.js";
-import "./hubspot-connect-routes/hubspot-connect-routes.js";
-import "./hubspot-connect-routes/load-hubspot-connect-routes-env.js";

package/dist/server/hono/types.d.ts

@@ -1,32 +0,0 @@
-import { HubSpotClient } from "../api-client-core/types.js";
-import { HubSpotProxy } from "../types.js";
-
-//#region src/server/hono/types.d.ts
-interface AppConnectRequestContext {
-  /**
-   * HubSpot API proxy.
-   */
-  proxy: HubSpotProxy;
-  /**
-   * HubSpot API client.
-   */
-  client: HubSpotClient;
-  /**
-   * Whether the browser session is authenticated.
-   */
-  authenticated: boolean;
-}
-interface AppConnectHonoBindings {
-  hubSpot: AppConnectRequestContext;
-}
-/**
- * Hono environment shape used by handlers running inside a hubspot-
- * connect request handler. Exposes the per-request
- * {@link AppConnectRequestContext} as `c.env.hubSpot`.
- */
-interface AppConnectHonoEnv {
-  Bindings: AppConnectHonoBindings;
-}
-//#endregion
-export { AppConnectHonoEnv };
-//# sourceMappingURL=types.d.ts.map

package/dist/server/hono/utils/cookie-utils.js

@@ -1,30 +0,0 @@
-//#region src/server/hono/utils/cookie-utils.ts
-/**
-* Appends a `Set-Cookie` header to the response. Hono replaces single
-* headers by default, so this uses `{ append: true }` to emit multiple
-* cookies on the same response.
-*/
-function setResponseCookie(options) {
-	const { c, value } = options;
-	c.header("Set-Cookie", value, { append: true });
-}
-/**
-* Builds a `Set-Cookie` header value with HubSpot's default attributes
-* (HttpOnly, Secure, SameSite). Centralizes the serialization so all
-* cookies share the same policy.
-*/
-function serializeCookie(options) {
-	const { name, value, path, sameSite = "Strict", maxAge, secure = true, httpOnly = true, partitioned = false } = options;
-	const parts = [`${name}=${value}`];
-	if (httpOnly) parts.push("HttpOnly");
-	if (secure) parts.push("Secure");
-	parts.push(`SameSite=${sameSite}`);
-	parts.push(`Path=${path}`);
-	parts.push(`Max-Age=${maxAge}`);
-	if (partitioned) parts.push("Partitioned");
-	return parts.join("; ");
-}
-//#endregion
-export { serializeCookie, setResponseCookie };
-
-//# sourceMappingURL=cookie-utils.js.map

package/dist/server/hono/utils/cookie-utils.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cookie-utils.js","names":[],"sources":["../../../../src/server/hono/utils/cookie-utils.ts"],"sourcesContent":["import type { Context } from 'hono';\n\nexport interface SetResponseCookieOptions {\n  c: Context;\n  value: string;\n}\n\n/**\n * Appends a `Set-Cookie` header to the response. Hono replaces single\n * headers by default, so this uses `{ append: true }` to emit multiple\n * cookies on the same response.\n */\nexport function setResponseCookie(options: SetResponseCookieOptions): void {\n  const { c, value } = options;\n  c.header('Set-Cookie', value, { append: true });\n}\n\nexport interface SerializeCookieOptions {\n  name: string;\n  value: string;\n  /** `__Host-` prefix requires `Path=/` and is recommended for session cookies. */\n  path: string;\n  /**\n   * Defaults to `Strict`.\n   *\n   * - `Strict`: only sent on same-site requests. Default for self-hosted\n   *   same-origin deployments.\n   * - `Lax`: also sent on top-level cross-site GET navigations. Use for\n   *   short-lived OAuth temp cookies that need to survive a redirect.\n   * - `None`: sent on all cross-site requests; **requires `Secure=true`\n   *   and is typically combined with `Partitioned=true`** for the\n   *   cross-origin Lovable / Supabase deployment shape.\n   */\n  sameSite?: 'Strict' | 'Lax' | 'None';\n  /** Lifetime in seconds. `0` deletes the cookie. */\n  maxAge: number;\n  /** Defaults to `true`; only set `false` for tests or non-HTTPS dev hosts. */\n  secure?: boolean;\n  /** Defaults to `true`. */\n  httpOnly?: boolean;\n  /**\n   * When `true`, appends the `Partitioned` attribute (CHIPS — Cookies\n   * Having Independent Partitioned State). The browser then keys the\n   * cookie by `(top-level site, cookie host)` instead of by cookie\n   * host alone, which is required for the cross-origin SDK shape\n   * where the React app and the SDK's edge functions live on\n   * different sites and third-party cookies are blocked.\n   *\n   * Defaults to `false`. Browsers ignore `Partitioned` on cookies\n   * without `Secure=true` and reject it on cookies without\n   * `SameSite=None`.\n   */\n  partitioned?: boolean;\n}\n\n/**\n * Builds a `Set-Cookie` header value with HubSpot's default attributes\n * (HttpOnly, Secure, SameSite). Centralizes the serialization so all\n * cookies share the same policy.\n */\nexport function serializeCookie(options: SerializeCookieOptions): string {\n  const {\n    name,\n    value,\n    path,\n    sameSite = 'Strict',\n    maxAge,\n    secure = true,\n    httpOnly = true,\n    partitioned = false,\n  } = options;\n  const parts: string[] = [`${name}=${value}`];\n  if (httpOnly) parts.push('HttpOnly');\n  if (secure) parts.push('Secure');\n  parts.push(`SameSite=${sameSite}`);\n  parts.push(`Path=${path}`);\n  parts.push(`Max-Age=${maxAge}`);\n  if (partitioned) parts.push('Partitioned');\n  return parts.join('; ');\n}\n"],"mappings":";;;;;;AAYA,SAAgB,kBAAkB,SAAyC;CACzE,MAAM,EAAE,GAAG,UAAU;CACrB,EAAE,OAAO,cAAc,OAAO,EAAE,QAAQ,MAAM,CAAC;;;;;;;AA8CjD,SAAgB,gBAAgB,SAAyC;CACvE,MAAM,EACJ,MACA,OACA,MACA,WAAW,UACX,QACA,SAAS,MACT,WAAW,MACX,cAAc,UACZ;CACJ,MAAM,QAAkB,CAAC,GAAG,KAAK,GAAG,QAAQ;CAC5C,IAAI,UAAU,MAAM,KAAK,WAAW;CACpC,IAAI,QAAQ,MAAM,KAAK,SAAS;CAChC,MAAM,KAAK,YAAY,WAAW;CAClC,MAAM,KAAK,QAAQ,OAAO;CAC1B,MAAM,KAAK,WAAW,SAAS;CAC/B,IAAI,aAAa,MAAM,KAAK,cAAc;CAC1C,OAAO,MAAM,KAAK,KAAK"}

package/dist/server/hono/utils/cors-middleware.js

@@ -1,85 +0,0 @@
-import { HUBSPOT_APP_ORIGIN_COOKIE_NAME } from "../../constants.js";
-import { parseCookies } from "../../utils/cookie-utils.js";
-//#region src/server/hono/utils/cors-middleware.ts
-/**
-* Comma-separated list of request headers the SDK accepts on
-* cross-site fetches. Mirrors the Supabase Edge Functions defaults
-* the Lovable AI agent emits today, plus `content-type` for the
-* `auth/complete` POST body and `accept` so JSON content negotiation
-* works.
-*/
-const ALLOWED_HEADERS = [
-	"authorization",
-	"x-client-info",
-	"apikey",
-	"content-type",
-	"accept",
-	"x-supabase-client-platform",
-	"x-supabase-client-platform-version",
-	"x-supabase-client-runtime",
-	"x-supabase-client-runtime-version"
-].join(", ");
-const ALLOWED_METHODS = "GET, POST, OPTIONS";
-const PREFLIGHT_MAX_AGE_SECONDS = "600";
-/**
-* Reads the persisted app-origin cookie from the request, falling
-* back to the literal `Origin` request header. The cookie is the
-* authoritative pin once `auth/init-session` has run; on the very
-* first init-session call (no cookie yet) we just echo whatever
-* `Origin` the caller sent — the actual access decision is enforced
-* by cookie-based authentication on every other route, not by CORS.
-*/
-function resolveAllowedOrigin(c) {
-	const pinned = parseCookies(c.req.header("Cookie"))[HUBSPOT_APP_ORIGIN_COOKIE_NAME];
-	if (pinned) return pinned;
-	return c.req.header("Origin") ?? null;
-}
-function setSharedCorsHeaders(c, allowOrigin) {
-	c.res.headers.set("Access-Control-Allow-Origin", allowOrigin);
-	c.res.headers.set("Access-Control-Allow-Credentials", "true");
-	c.res.headers.set("Vary", "Origin, Cookie");
-}
-/**
-* Hono middleware that emits credentialed CORS response headers for
-* the cross-origin Lovable / Supabase deployment shape.
-*
-* - On `OPTIONS` preflight: short-circuits with a 204 carrying
-*   `Access-Control-Allow-*` headers. The browser will then send the
-*   real request with cookies attached.
-* - On every other method: echoes the pinned `__Host-hs_app_origin`
-*   cookie value (or, before init-session has run, the request
-*   `Origin` header) as `Access-Control-Allow-Origin`, with
-*   `Access-Control-Allow-Credentials: true`. The wildcard `*` is
-*   forbidden by browsers when credentials are included, so the
-*   middleware always echoes a concrete origin.
-*
-* Skips header emission entirely when the request has no `Origin`
-* (server-to-server calls, curl, etc.) so non-browser callers are
-* left untouched.
-*/
-function corsMiddleware() {
-	return async (c, next) => {
-		const allowOrigin = resolveAllowedOrigin(c);
-		if (c.req.method === "OPTIONS") {
-			const headers = new Headers();
-			if (allowOrigin) {
-				headers.set("Access-Control-Allow-Origin", allowOrigin);
-				headers.set("Access-Control-Allow-Credentials", "true");
-				headers.set("Vary", "Origin, Cookie");
-			}
-			headers.set("Access-Control-Allow-Methods", ALLOWED_METHODS);
-			headers.set("Access-Control-Allow-Headers", ALLOWED_HEADERS);
-			headers.set("Access-Control-Max-Age", PREFLIGHT_MAX_AGE_SECONDS);
-			return new Response(null, {
-				status: 204,
-				headers
-			});
-		}
-		await next();
-		if (allowOrigin) setSharedCorsHeaders(c, allowOrigin);
-	};
-}
-//#endregion
-export { corsMiddleware };
-
-//# sourceMappingURL=cors-middleware.js.map

package/dist/server/hono/utils/cors-middleware.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cors-middleware.js","names":[],"sources":["../../../../src/server/hono/utils/cors-middleware.ts"],"sourcesContent":["import type { Context, MiddlewareHandler } from 'hono';\n\nimport { HUBSPOT_APP_ORIGIN_COOKIE_NAME } from '../../constants.ts';\nimport { parseCookies } from '../../utils/cookie-utils.ts';\n\n/**\n * Comma-separated list of request headers the SDK accepts on\n * cross-site fetches. Mirrors the Supabase Edge Functions defaults\n * the Lovable AI agent emits today, plus `content-type` for the\n * `auth/complete` POST body and `accept` so JSON content negotiation\n * works.\n */\nconst ALLOWED_HEADERS = [\n  'authorization',\n  'x-client-info',\n  'apikey',\n  'content-type',\n  'accept',\n  'x-supabase-client-platform',\n  'x-supabase-client-platform-version',\n  'x-supabase-client-runtime',\n  'x-supabase-client-runtime-version',\n].join(', ');\n\nconst ALLOWED_METHODS = 'GET, POST, OPTIONS';\n\nconst PREFLIGHT_MAX_AGE_SECONDS = '600';\n\n/**\n * Reads the persisted app-origin cookie from the request, falling\n * back to the literal `Origin` request header. The cookie is the\n * authoritative pin once `auth/init-session` has run; on the very\n * first init-session call (no cookie yet) we just echo whatever\n * `Origin` the caller sent — the actual access decision is enforced\n * by cookie-based authentication on every other route, not by CORS.\n */\nfunction resolveAllowedOrigin(c: Context): string | null {\n  const cookies = parseCookies(c.req.header('Cookie'));\n  const pinned = cookies[HUBSPOT_APP_ORIGIN_COOKIE_NAME];\n  if (pinned) return pinned;\n  return c.req.header('Origin') ?? null;\n}\n\nfunction setSharedCorsHeaders(c: Context, allowOrigin: string): void {\n  c.res.headers.set('Access-Control-Allow-Origin', allowOrigin);\n  c.res.headers.set('Access-Control-Allow-Credentials', 'true');\n  // `Origin` so caches differentiate per-caller responses; `Cookie`\n  // because the allowed origin is derived from the persisted\n  // `__Host-hs_app_origin` cookie.\n  c.res.headers.set('Vary', 'Origin, Cookie');\n}\n\n/**\n * Hono middleware that emits credentialed CORS response headers for\n * the cross-origin Lovable / Supabase deployment shape.\n *\n * - On `OPTIONS` preflight: short-circuits with a 204 carrying\n *   `Access-Control-Allow-*` headers. The browser will then send the\n *   real request with cookies attached.\n * - On every other method: echoes the pinned `__Host-hs_app_origin`\n *   cookie value (or, before init-session has run, the request\n *   `Origin` header) as `Access-Control-Allow-Origin`, with\n *   `Access-Control-Allow-Credentials: true`. The wildcard `*` is\n *   forbidden by browsers when credentials are included, so the\n *   middleware always echoes a concrete origin.\n *\n * Skips header emission entirely when the request has no `Origin`\n * (server-to-server calls, curl, etc.) so non-browser callers are\n * left untouched.\n */\nexport function corsMiddleware(): MiddlewareHandler {\n  return async (c, next) => {\n    const allowOrigin = resolveAllowedOrigin(c);\n\n    if (c.req.method === 'OPTIONS') {\n      const headers = new Headers();\n      if (allowOrigin) {\n        headers.set('Access-Control-Allow-Origin', allowOrigin);\n        headers.set('Access-Control-Allow-Credentials', 'true');\n        headers.set('Vary', 'Origin, Cookie');\n      }\n      headers.set('Access-Control-Allow-Methods', ALLOWED_METHODS);\n      headers.set('Access-Control-Allow-Headers', ALLOWED_HEADERS);\n      headers.set('Access-Control-Max-Age', PREFLIGHT_MAX_AGE_SECONDS);\n      return new Response(null, { status: 204, headers });\n    }\n\n    await next();\n\n    if (allowOrigin) {\n      setSharedCorsHeaders(c, allowOrigin);\n    }\n    return;\n  };\n}\n"],"mappings":";;;;;;;;;;AAYA,MAAM,kBAAkB;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC,KAAK,KAAK;AAEZ,MAAM,kBAAkB;AAExB,MAAM,4BAA4B;;;;;;;;;AAUlC,SAAS,qBAAqB,GAA2B;CAEvD,MAAM,SADU,aAAa,EAAE,IAAI,OAAO,SAAS,CAC7B,CAAC;CACvB,IAAI,QAAQ,OAAO;CACnB,OAAO,EAAE,IAAI,OAAO,SAAS,IAAI;;AAGnC,SAAS,qBAAqB,GAAY,aAA2B;CACnE,EAAE,IAAI,QAAQ,IAAI,+BAA+B,YAAY;CAC7D,EAAE,IAAI,QAAQ,IAAI,oCAAoC,OAAO;CAI7D,EAAE,IAAI,QAAQ,IAAI,QAAQ,iBAAiB;;;;;;;;;;;;;;;;;;;;AAqB7C,SAAgB,iBAAoC;CAClD,OAAO,OAAO,GAAG,SAAS;EACxB,MAAM,cAAc,qBAAqB,EAAE;EAE3C,IAAI,EAAE,IAAI,WAAW,WAAW;GAC9B,MAAM,UAAU,IAAI,SAAS;GAC7B,IAAI,aAAa;IACf,QAAQ,IAAI,+BAA+B,YAAY;IACvD,QAAQ,IAAI,oCAAoC,OAAO;IACvD,QAAQ,IAAI,QAAQ,iBAAiB;;GAEvC,QAAQ,IAAI,gCAAgC,gBAAgB;GAC5D,QAAQ,IAAI,gCAAgC,gBAAgB;GAC5D,QAAQ,IAAI,0BAA0B,0BAA0B;GAChE,OAAO,IAAI,SAAS,MAAM;IAAE,QAAQ;IAAK;IAAS,CAAC;;EAGrD,MAAM,MAAM;EAEZ,IAAI,aACF,qBAAqB,GAAG,YAAY"}

package/dist/server/import-app-keys.js

@@ -1,42 +0,0 @@
-import { base64StandardToArrayBuffer } from "./shared/encoding/base64.js";
-//#region src/server/import-app-keys.ts
-/**
-* Imports a base64-encoded PKCS8 ES256 private key into the
-* `AppKeys` shape used throughout the SDK.
-*
-* The function imports the key twice: once as **extractable** to
-* derive the public JWK (via `crypto.subtle.exportKey`), and once
-* as **non-extractable** so the long-lived `appPrivateKey` can never
-* be exfiltrated.
-*
-* @throws {Error} When `envKey` is empty/undefined or when the key
-*   isn't an EC P-256 keypair.
-*/
-async function importAppKeys(envKey) {
-	const b64 = envKey?.trim() ?? "";
-	if (!b64) throw new Error("HUBSPOT_APP_PRIVATE_KEY is not set");
-	const pkcs8 = base64StandardToArrayBuffer(b64);
-	const tempPrivateKey = await crypto.subtle.importKey("pkcs8", pkcs8, {
-		name: "ECDSA",
-		namedCurve: "P-256"
-	}, true, ["sign"]);
-	const privateJwk = await crypto.subtle.exportKey("jwk", tempPrivateKey);
-	if (privateJwk.kty !== "EC" || privateJwk.crv !== "P-256" || typeof privateJwk.x !== "string" || typeof privateJwk.y !== "string") throw new Error("Expected P-256 EC private key JWK with x and y");
-	const appPublicKeyJwk = {
-		kty: "EC",
-		crv: "P-256",
-		x: privateJwk.x,
-		y: privateJwk.y
-	};
-	return {
-		appPrivateKey: await crypto.subtle.importKey("pkcs8", pkcs8, {
-			name: "ECDSA",
-			namedCurve: "P-256"
-		}, false, ["sign"]),
-		appPublicKeyJwk
-	};
-}
-//#endregion
-export { importAppKeys };
-
-//# sourceMappingURL=import-app-keys.js.map

package/dist/server/import-app-keys.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"import-app-keys.js","names":[],"sources":["../../src/server/import-app-keys.ts"],"sourcesContent":["import type { AppKeys } from './types.ts';\nimport { base64StandardToArrayBuffer } from './utils/base64-utils.ts';\n\n/**\n * Imports a base64-encoded PKCS8 ES256 private key into the\n * `AppKeys` shape used throughout the SDK.\n *\n * The function imports the key twice: once as **extractable** to\n * derive the public JWK (via `crypto.subtle.exportKey`), and once\n * as **non-extractable** so the long-lived `appPrivateKey` can never\n * be exfiltrated.\n *\n * @throws {Error} When `envKey` is empty/undefined or when the key\n *   isn't an EC P-256 keypair.\n */\nexport async function importAppKeys(\n  envKey: string | undefined\n): Promise<AppKeys> {\n  const b64 = envKey?.trim() ?? '';\n  if (!b64) {\n    throw new Error('HUBSPOT_APP_PRIVATE_KEY is not set');\n  }\n\n  const pkcs8 = base64StandardToArrayBuffer(b64);\n  const tempPrivateKey = await crypto.subtle.importKey(\n    'pkcs8',\n    pkcs8,\n    { name: 'ECDSA', namedCurve: 'P-256' },\n    true,\n    ['sign']\n  );\n  const privateJwk = await crypto.subtle.exportKey('jwk', tempPrivateKey);\n  if (\n    privateJwk.kty !== 'EC' ||\n    privateJwk.crv !== 'P-256' ||\n    typeof privateJwk.x !== 'string' ||\n    typeof privateJwk.y !== 'string'\n  ) {\n    throw new Error('Expected P-256 EC private key JWK with x and y');\n  }\n  const appPublicKeyJwk: JsonWebKey = {\n    kty: 'EC',\n    crv: 'P-256',\n    x: privateJwk.x,\n    y: privateJwk.y,\n  };\n  const appPrivateKey = await crypto.subtle.importKey(\n    'pkcs8',\n    pkcs8,\n    { name: 'ECDSA', namedCurve: 'P-256' },\n    false,\n    ['sign']\n  );\n  return { appPrivateKey, appPublicKeyJwk };\n}\n"],"mappings":";;;;;;;;;;;;;;AAeA,eAAsB,cACpB,QACkB;CAClB,MAAM,MAAM,QAAQ,MAAM,IAAI;CAC9B,IAAI,CAAC,KACH,MAAM,IAAI,MAAM,qCAAqC;CAGvD,MAAM,QAAQ,4BAA4B,IAAI;CAC9C,MAAM,iBAAiB,MAAM,OAAO,OAAO,UACzC,SACA,OACA;EAAE,MAAM;EAAS,YAAY;EAAS,EACtC,MACA,CAAC,OAAO,CACT;CACD,MAAM,aAAa,MAAM,OAAO,OAAO,UAAU,OAAO,eAAe;CACvE,IACE,WAAW,QAAQ,QACnB,WAAW,QAAQ,WACnB,OAAO,WAAW,MAAM,YACxB,OAAO,WAAW,MAAM,UAExB,MAAM,IAAI,MAAM,iDAAiD;CAEnE,MAAM,kBAA8B;EAClC,KAAK;EACL,KAAK;EACL,GAAG,WAAW;EACd,GAAG,WAAW;EACf;CAQD,OAAO;EAAE,eAAA,MAPmB,OAAO,OAAO,UACxC,SACA,OACA;GAAE,MAAM;GAAS,YAAY;GAAS,EACtC,OACA,CAAC,OAAO,CACT;EACuB;EAAiB"}

package/dist/server/lovable/create-app-function-start.d.ts

@@ -1,26 +0,0 @@
-import { SecureStartContext } from "../secure-start-core.js";
-import { Logger } from "../shared/logger.js";
-import { AppConnectHonoEnv } from "../hono/types.js";
-import { Hono } from "hono";
-
-//#region src/server/lovable/create-app-function-start.d.ts
-type RegisterAppFunctionRoutesFunction = (app: Hono<AppConnectHonoEnv>) => void;
-interface CreateAppFunctionStartOptions {
-  /** Base path the user's routes are mounted under (e.g. `/functions/v1/api`). */
-  basePath: string;
-  /** Attach app routes to the SDK-owned Hono instance. */
-  registerRoutes: RegisterAppFunctionRoutesFunction;
-  /** Optional logger forwarded to `createAppConnectRequestHandler`. */
-  logger?: Logger;
-}
-type AppFunctionStart = (context: SecureStartContext) => Promise<void>;
-/**
- * Builds a Deno-style `start({ appKeys })` entry point that boots a
- * Hono app under `basePath`, wires the SDK's per-request HubSpot
- * proxy via `createAppConnectRequestHandler`, and serves it with
- * `Deno.serve` on `PORT`.
- */
-declare function createAppFunctionStart(options: CreateAppFunctionStartOptions): AppFunctionStart;
-//#endregion
-export { AppFunctionStart, CreateAppFunctionStartOptions, RegisterAppFunctionRoutesFunction, createAppFunctionStart };
-//# sourceMappingURL=create-app-function-start.d.ts.map

package/dist/server/lovable/create-app-function-start.js

@@ -1,28 +0,0 @@
-import { createAppConnectRequestHandler } from "../hono/hono-request-handler.js";
-//#region src/server/lovable/create-app-function-start.ts
-const PORT = Deno.env.get("PORT");
-const serveOptions = typeof PORT === "string" ? { port: parseInt(PORT, 10) } : {};
-/**
-* Builds a Deno-style `start({ appKeys })` entry point that boots a
-* Hono app under `basePath`, wires the SDK's per-request HubSpot
-* proxy via `createAppConnectRequestHandler`, and serves it with
-* `Deno.serve` on `PORT`.
-*/
-function createAppFunctionStart(options) {
-	const { basePath, registerRoutes, logger } = options;
-	return ({ appKeys }) => {
-		Deno.serve(serveOptions, createAppConnectRequestHandler({
-			appKeys,
-			...logger !== void 0 ? { logger } : {},
-			registerRoutes: (app) => {
-				registerRoutes(app.basePath(basePath));
-			}
-		}));
-		console.log(`[app-function ${basePath}] Listening on http://localhost:${PORT}`);
-		return Promise.resolve();
-	};
-}
-//#endregion
-export { createAppFunctionStart };
-
-//# sourceMappingURL=create-app-function-start.js.map

package/dist/server/lovable/create-app-function-start.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"create-app-function-start.js","names":[],"sources":["../../../src/server/lovable/create-app-function-start.ts"],"sourcesContent":["import type { Hono } from 'hono';\n\nimport type { Logger } from '../../shared/logger.ts';\nimport { createAppConnectRequestHandler } from '../hono/hono-request-handler.ts';\nimport type { AppConnectHonoEnv } from '../hono/types.ts';\nimport type { SecureStartContext } from '../secure-start-core.ts';\n\nconst PORT = Deno.env.get('PORT');\nconst serveOptions =\n  typeof PORT === 'string' ? { port: parseInt(PORT, 10) } : {};\n\nexport type RegisterAppFunctionRoutesFunction = (\n  app: Hono<AppConnectHonoEnv>\n) => void;\n\nexport interface CreateAppFunctionStartOptions {\n  /** Base path the user's routes are mounted under (e.g. `/functions/v1/api`). */\n  basePath: string;\n  /** Attach app routes to the SDK-owned Hono instance. */\n  registerRoutes: RegisterAppFunctionRoutesFunction;\n  /** Optional logger forwarded to `createAppConnectRequestHandler`. */\n  logger?: Logger;\n}\n\nexport type AppFunctionStart = (context: SecureStartContext) => Promise<void>;\n\n/**\n * Builds a Deno-style `start({ appKeys })` entry point that boots a\n * Hono app under `basePath`, wires the SDK's per-request HubSpot\n * proxy via `createAppConnectRequestHandler`, and serves it with\n * `Deno.serve` on `PORT`.\n */\nexport function createAppFunctionStart(\n  options: CreateAppFunctionStartOptions\n): AppFunctionStart {\n  const { basePath, registerRoutes, logger } = options;\n\n  return ({ appKeys }) => {\n    Deno.serve(\n      serveOptions,\n      createAppConnectRequestHandler({\n        appKeys,\n        ...(logger !== undefined ? { logger } : {}),\n        registerRoutes: (app) => {\n          registerRoutes(app.basePath(basePath));\n        },\n      })\n    );\n\n    console.log(\n      `[app-function ${basePath}] Listening on http://localhost:${PORT}`\n    );\n    return Promise.resolve();\n  };\n}\n"],"mappings":";;AAOA,MAAM,OAAO,KAAK,IAAI,IAAI,OAAO;AACjC,MAAM,eACJ,OAAO,SAAS,WAAW,EAAE,MAAM,SAAS,MAAM,GAAG,EAAE,GAAG,EAAE;;;;;;;AAuB9D,SAAgB,uBACd,SACkB;CAClB,MAAM,EAAE,UAAU,gBAAgB,WAAW;CAE7C,QAAQ,EAAE,cAAc;EACtB,KAAK,MACH,cACA,+BAA+B;GAC7B;GACA,GAAI,WAAW,KAAA,IAAY,EAAE,QAAQ,GAAG,EAAE;GAC1C,iBAAiB,QAAQ;IACvB,eAAe,IAAI,SAAS,SAAS,CAAC;;GAEzC,CAAC,CACH;EAED,QAAQ,IACN,iBAAiB,SAAS,kCAAkC,OAC7D;EACD,OAAO,QAAQ,SAAS"}

package/dist/server/lovable/hubspot-connect/index.d.ts

@@ -1,15 +0,0 @@
-import { HubSpotConnectCimdClientMetadata } from "../../hono/hubspot-connect-routes/cimd-client-metadata-types.js";
-
-//#region src/server/lovable/hubspot-connect/index.d.ts
-interface StartHubSpotConnectFunctionOptions {
-  client: HubSpotConnectCimdClientMetadata;
-}
-/**
- * Lovable-style entry point for the hubspot-connect Deno function.
- * Loads `HUBSPOT_APP_PRIVATE_KEY` via `secureStart`, then serves OAuth
- * and CIMD routes under `/functions/v1/hubspot-connect`.
- */
-declare function startHubSpotConnectFunction(options: StartHubSpotConnectFunctionOptions): Promise<void>;
-//#endregion
-export { StartHubSpotConnectFunctionOptions, startHubSpotConnectFunction };
-//# sourceMappingURL=index.d.ts.map

package/dist/server/lovable/hubspot-connect/index.js

@@ -1,20 +0,0 @@
-import { secureStart } from "../../deno/start.js";
-import { assertHubSpotConnectCimdClientMetadata } from "../../hono/hubspot-connect-routes/cimd-client-metadata-types.js";
-import { runHubSpotConnectLovableServer } from "./run-hubspot-connect-lovable-server.js";
-//#region src/server/lovable/hubspot-connect/index.ts
-/**
-* Lovable-style entry point for the hubspot-connect Deno function.
-* Loads `HUBSPOT_APP_PRIVATE_KEY` via `secureStart`, then serves OAuth
-* and CIMD routes under `/functions/v1/hubspot-connect`.
-*/
-async function startHubSpotConnectFunction(options) {
-	assertHubSpotConnectCimdClientMetadata(options.client);
-	await secureStart(async () => ({ start: (context) => runHubSpotConnectLovableServer({
-		...context,
-		cimdClientMetadata: options.client
-	}) }));
-}
-//#endregion
-export { startHubSpotConnectFunction };
-
-//# sourceMappingURL=index.js.map

package/dist/server/lovable/hubspot-connect/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../../src/server/lovable/hubspot-connect/index.ts"],"sourcesContent":["import { secureStart } from '../../deno/start.ts';\nimport { assertHubSpotConnectCimdClientMetadata } from '../../hono/hubspot-connect-routes/cimd-client-metadata-types.ts';\nimport type { HubSpotConnectCimdClientMetadata } from '../../hono/hubspot-connect-routes/cimd-client-metadata-types.ts';\nimport { runHubSpotConnectLovableServer } from './run-hubspot-connect-lovable-server.ts';\n\nexport type { HubSpotConnectCimdClientMetadata } from '../../hono/hubspot-connect-routes/cimd-client-metadata-types.ts';\n\nexport interface StartHubSpotConnectFunctionOptions {\n  client: HubSpotConnectCimdClientMetadata;\n}\n\n/**\n * Lovable-style entry point for the hubspot-connect Deno function.\n * Loads `HUBSPOT_APP_PRIVATE_KEY` via `secureStart`, then serves OAuth\n * and CIMD routes under `/functions/v1/hubspot-connect`.\n */\nexport async function startHubSpotConnectFunction(\n  options: StartHubSpotConnectFunctionOptions\n): Promise<void> {\n  assertHubSpotConnectCimdClientMetadata(options.client);\n  await secureStart(async () => ({\n    start: (context) =>\n      runHubSpotConnectLovableServer({\n        ...context,\n        cimdClientMetadata: options.client,\n      }),\n  }));\n}\n"],"mappings":";;;;;;;;;AAgBA,eAAsB,4BACpB,SACe;CACf,uCAAuC,QAAQ,OAAO;CACtD,MAAM,YAAY,aAAa,EAC7B,QAAQ,YACN,+BAA+B;EAC7B,GAAG;EACH,oBAAoB,QAAQ;EAC7B,CAAC,EACL,EAAE"}

package/dist/server/lovable/hubspot-connect/run-hubspot-connect-lovable-server.js

@@ -1,29 +0,0 @@
-import { registerHubSpotConnectRoutes } from "../../hono/hubspot-connect-routes/hubspot-connect-routes.js";
-import { loadHubSpotConnectRoutesEnv } from "../../hono/hubspot-connect-routes/load-hubspot-connect-routes-env.js";
-import "../../hono/index.js";
-import { Hono } from "hono";
-//#region src/server/lovable/hubspot-connect/run-hubspot-connect-lovable-server.ts
-const PORT = Deno.env.get("PORT");
-const serveOptions = typeof PORT === "string" ? { port: parseInt(PORT, 10) } : {};
-const HUBSPOT_CONNECT_BASE_PATH = "/functions/v1/hubspot-connect";
-function runHubSpotConnectLovableServer(options) {
-	const { appKeys, cimdClientMetadata } = options;
-	const hubspotConnectEnv = loadHubSpotConnectRoutesEnv();
-	const result = Deno.serve(serveOptions, (request) => {
-		const app = new Hono();
-		registerHubSpotConnectRoutes({
-			app: app.basePath(HUBSPOT_CONNECT_BASE_PATH),
-			appKeys,
-			basePath: HUBSPOT_CONNECT_BASE_PATH,
-			hubspotConnectEnv,
-			cimdClientMetadata
-		});
-		return app.fetch(request);
-	});
-	console.log(`[hubspot-connect] Listening on ${result.addr.port}`);
-	return Promise.resolve();
-}
-//#endregion
-export { runHubSpotConnectLovableServer };
-
-//# sourceMappingURL=run-hubspot-connect-lovable-server.js.map

package/dist/server/lovable/hubspot-connect/run-hubspot-connect-lovable-server.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"run-hubspot-connect-lovable-server.js","names":[],"sources":["../../../../src/server/lovable/hubspot-connect/run-hubspot-connect-lovable-server.ts"],"sourcesContent":["import { Hono } from 'hono';\n\nimport type { SecureStartContext } from '../../deno/start.ts';\nimport type { HubSpotConnectCimdClientMetadata } from '../../hono/hubspot-connect-routes/cimd-client-metadata-types.ts';\nimport {\n  loadHubSpotConnectRoutesEnv,\n  registerHubSpotConnectRoutes,\n} from '../../hono/index.ts';\n\nconst PORT = Deno.env.get('PORT');\nconst serveOptions =\n  typeof PORT === 'string' ? { port: parseInt(PORT, 10) } : {};\nconst HUBSPOT_CONNECT_BASE_PATH = '/functions/v1/hubspot-connect';\n\nexport interface RunHubSpotConnectLovableServerOptions extends SecureStartContext {\n  cimdClientMetadata: HubSpotConnectCimdClientMetadata;\n}\n\nexport function runHubSpotConnectLovableServer(\n  options: RunHubSpotConnectLovableServerOptions\n): Promise<void> {\n  const { appKeys, cimdClientMetadata } = options;\n  const hubspotConnectEnv = loadHubSpotConnectRoutesEnv();\n  const result = Deno.serve(serveOptions, (request) => {\n    const app = new Hono();\n\n    registerHubSpotConnectRoutes({\n      app: app.basePath(HUBSPOT_CONNECT_BASE_PATH),\n      appKeys,\n      basePath: HUBSPOT_CONNECT_BASE_PATH,\n      hubspotConnectEnv,\n      cimdClientMetadata,\n    });\n\n    return app.fetch(request);\n  });\n\n  console.log(`[hubspot-connect] Listening on ${result.addr.port}`);\n  return Promise.resolve();\n}\n"],"mappings":";;;;;AASA,MAAM,OAAO,KAAK,IAAI,IAAI,OAAO;AACjC,MAAM,eACJ,OAAO,SAAS,WAAW,EAAE,MAAM,SAAS,MAAM,GAAG,EAAE,GAAG,EAAE;AAC9D,MAAM,4BAA4B;AAMlC,SAAgB,+BACd,SACe;CACf,MAAM,EAAE,SAAS,uBAAuB;CACxC,MAAM,oBAAoB,6BAA6B;CACvD,MAAM,SAAS,KAAK,MAAM,eAAe,YAAY;EACnD,MAAM,MAAM,IAAI,MAAM;EAEtB,6BAA6B;GAC3B,KAAK,IAAI,SAAS,0BAA0B;GAC5C;GACA,UAAU;GACV;GACA;GACD,CAAC;EAEF,OAAO,IAAI,MAAM,QAAQ;GACzB;CAEF,QAAQ,IAAI,kCAAkC,OAAO,KAAK,OAAO;CACjE,OAAO,QAAQ,SAAS"}

package/dist/server/proxy.js

@@ -1,68 +0,0 @@
-import { signDpopProof } from "./utils/dpop-utils.js";
-import { sha256base64url } from "./shared/encoding/sha256.js";
-import { isHubspotDpopEnabled, requireEnv } from "./utils/env-utils.js";
-import { noopLogger } from "./shared/logger.js";
-//#region src/server/proxy.ts
-const HUBSPOT_API_ORIGIN = requireEnv("HUBSPOT_API_ORIGIN");
-const notAuthenticated = {
-	authenticated: false,
-	fetch: async () => {
-		return new Response(null, {
-			status: 401,
-			statusText: "Unauthorized",
-			headers: { "Content-Type": "application/json" }
-		});
-	}
-};
-const EMPTY_HEADERS = {};
-function createHubSpotProxy(options) {
-	const { userCredentials, appKeys, logger = noopLogger } = options;
-	if (isHubspotDpopEnabled() && appKeys === null) throw new Error("createHubSpotProxy: appKeys is required when HUBSPOT_DPOP_ENABLED is not false");
-	const { accessToken, sessionId } = userCredentials;
-	if (!accessToken || !sessionId) {
-		logger.debug("createHubSpotProxy: returning unauthenticated proxy (missing cookies)");
-		return notAuthenticated;
-	}
-	async function proxyFetch(request) {
-		const { path, method = "GET", headers = EMPTY_HEADERS, body } = request;
-		const targetUrl = `${HUBSPOT_API_ORIGIN}${path}`;
-		const useDpop = isHubspotDpopEnabled();
-		let authorizationHeaders;
-		if (useDpop) {
-			const ath = await sha256base64url(accessToken);
-			const sid = await sha256base64url(sessionId);
-			const dpopProof = await signDpopProof({
-				appKeys,
-				claims: {
-					htm: method,
-					htu: targetUrl,
-					jti: crypto.randomUUID(),
-					iat: Math.floor(Date.now() / 1e3),
-					ath,
-					sid
-				}
-			});
-			authorizationHeaders = {
-				Authorization: `DPoP ${accessToken}`,
-				DPoP: dpopProof
-			};
-		} else authorizationHeaders = { Authorization: `Bearer ${accessToken}` };
-		const requestInit = {
-			headers: {
-				...headers,
-				...authorizationHeaders
-			},
-			method
-		};
-		if (body != null) requestInit.body = body;
-		return fetch(targetUrl, requestInit);
-	}
-	return {
-		authenticated: true,
-		fetch: proxyFetch
-	};
-}
-//#endregion
-export { createHubSpotProxy };
-
-//# sourceMappingURL=proxy.js.map

package/dist/server/proxy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"proxy.js","names":[],"sources":["../../src/server/proxy.ts"],"sourcesContent":["import { noopLogger, type Logger } from '../shared/logger.ts';\nimport {\n  type AppKeys,\n  type HubSpotProxy,\n  type HubSpotProxyRequest,\n  type UserCredentials,\n} from './types.ts';\nimport { sha256base64url } from './utils/crypto-utils.ts';\nimport { signDpopProof } from './utils/dpop-utils.ts';\nimport { isHubspotDpopEnabled, requireEnv } from './utils/env-utils.ts';\n\nconst HUBSPOT_API_ORIGIN = requireEnv('HUBSPOT_API_ORIGIN');\n\n/**\n * Options accepted by {@link createHubSpotProxy}.\n */\nexport interface CreateHubSpotProxyOptions {\n  /**\n   * User session context from the incoming browser request.\n   */\n  userCredentials: UserCredentials;\n\n  /**\n   * Imported app keys from `secureStart`, or `null` when CIMD and DPoP\n   * are both disabled.\n   */\n  appKeys: AppKeys | null;\n  /** Optional logger. Defaults to a no-op logger. */\n  logger?: Logger;\n}\n\nconst notAuthenticated: HubSpotProxy = {\n  authenticated: false,\n  fetch: async (): Promise<Response> => {\n    return new Response(null, {\n      status: 401,\n      statusText: 'Unauthorized',\n      headers: {\n        'Content-Type': 'application/json',\n      },\n    });\n  },\n};\n\nconst EMPTY_HEADERS = {};\n\nexport function createHubSpotProxy(\n  options: CreateHubSpotProxyOptions\n): HubSpotProxy {\n  const { userCredentials, appKeys, logger = noopLogger } = options;\n\n  if (isHubspotDpopEnabled() && appKeys === null) {\n    throw new Error(\n      'createHubSpotProxy: appKeys is required when HUBSPOT_DPOP_ENABLED is not false'\n    );\n  }\n\n  const { accessToken, sessionId } = userCredentials;\n\n  if (!accessToken || !sessionId) {\n    logger.debug(\n      'createHubSpotProxy: returning unauthenticated proxy (missing cookies)'\n    );\n    return notAuthenticated;\n  }\n\n  async function proxyFetch(request: HubSpotProxyRequest): Promise<Response> {\n    const { path, method = 'GET', headers = EMPTY_HEADERS, body } = request;\n\n    const targetUrl = `${HUBSPOT_API_ORIGIN}${path}`;\n    const useDpop = isHubspotDpopEnabled();\n\n    let authorizationHeaders: Record<string, string>;\n    if (useDpop) {\n      const ath = await sha256base64url(accessToken!);\n      const sid = await sha256base64url(sessionId!);\n      const dpopProof = await signDpopProof({\n        appKeys: appKeys!,\n        claims: {\n          htm: method,\n          htu: targetUrl,\n          jti: crypto.randomUUID(),\n          iat: Math.floor(Date.now() / 1000),\n          ath,\n          sid,\n        },\n      });\n      authorizationHeaders = {\n        Authorization: `DPoP ${accessToken}`,\n        DPoP: dpopProof,\n      };\n    } else {\n      authorizationHeaders = {\n        Authorization: `Bearer ${accessToken}`,\n      };\n    }\n\n    const finalHeaders = { ...headers, ...authorizationHeaders };\n\n    const requestInit: RequestInit = {\n      headers: finalHeaders,\n      method,\n    };\n\n    if (body != null) {\n      requestInit.body = body;\n    }\n\n    return fetch(targetUrl, requestInit);\n  }\n\n  return {\n    authenticated: true,\n    fetch: proxyFetch,\n  };\n}\n"],"mappings":";;;;;AAWA,MAAM,qBAAqB,WAAW,qBAAqB;AAoB3D,MAAM,mBAAiC;CACrC,eAAe;CACf,OAAO,YAA+B;EACpC,OAAO,IAAI,SAAS,MAAM;GACxB,QAAQ;GACR,YAAY;GACZ,SAAS,EACP,gBAAgB,oBACjB;GACF,CAAC;;CAEL;AAED,MAAM,gBAAgB,EAAE;AAExB,SAAgB,mBACd,SACc;CACd,MAAM,EAAE,iBAAiB,SAAS,SAAS,eAAe;CAE1D,IAAI,sBAAsB,IAAI,YAAY,MACxC,MAAM,IAAI,MACR,iFACD;CAGH,MAAM,EAAE,aAAa,cAAc;CAEnC,IAAI,CAAC,eAAe,CAAC,WAAW;EAC9B,OAAO,MACL,wEACD;EACD,OAAO;;CAGT,eAAe,WAAW,SAAiD;EACzE,MAAM,EAAE,MAAM,SAAS,OAAO,UAAU,eAAe,SAAS;EAEhE,MAAM,YAAY,GAAG,qBAAqB;EAC1C,MAAM,UAAU,sBAAsB;EAEtC,IAAI;EACJ,IAAI,SAAS;GACX,MAAM,MAAM,MAAM,gBAAgB,YAAa;GAC/C,MAAM,MAAM,MAAM,gBAAgB,UAAW;GAC7C,MAAM,YAAY,MAAM,cAAc;IAC3B;IACT,QAAQ;KACN,KAAK;KACL,KAAK;KACL,KAAK,OAAO,YAAY;KACxB,KAAK,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;KAClC;KACA;KACD;IACF,CAAC;GACF,uBAAuB;IACrB,eAAe,QAAQ;IACvB,MAAM;IACP;SAED,uBAAuB,EACrB,eAAe,UAAU,eAC1B;EAKH,MAAM,cAA2B;GAC/B,SAAS;IAHY,GAAG;IAAS,GAAG;IAGf;GACrB;GACD;EAED,IAAI,QAAQ,MACV,YAAY,OAAO;EAGrB,OAAO,MAAM,WAAW,YAAY;;CAGtC,OAAO;EACL,eAAe;EACf,OAAO;EACR"}