@hubspot/app-connect-sdk 1.0.0-alpha.3 → 1.0.0-alpha.4

package/dist/server/sanitize-request.js

@@ -1,55 +0,0 @@
-import { isProtectedCookieName } from "./constants.js";
-import { parseCookies } from "./utils/cookie-utils.js";
-//#region src/server/sanitize-request.ts
-function serializeCookies(cookies) {
-	const parts = [];
-	for (const [name, value] of cookies) parts.push(`${name}=${value}`);
-	return parts.join("; ");
-}
-/**
-* Mutates `headers` in place: parses the `Cookie` header, drops every
-* protected cookie (see {@link isProtectedCookieName}), and rewrites
-* the header. Deletes the header entirely when nothing survives.
-*
-* Used by the SDK's auth middleware after it has read the access
-* token / session ID, so user route handlers never see — and
-* therefore cannot leak — those cookies, while CORS / auth
-* middleware that ran first still got the raw values.
-*/
-function stripProtectedCookies(headers) {
-	const cookies = parseCookies(headers.get("Cookie"));
-	const surviving = /* @__PURE__ */ new Map();
-	for (const [name, value] of Object.entries(cookies)) if (!isProtectedCookieName(name)) surviving.set(name, value);
-	if (surviving.size === 0) headers.delete("cookie");
-	else headers.set("cookie", serializeCookies(surviving));
-}
-/**
-* Returns a clone of `original` whose `Cookie` header has every
-* protected cookie removed (see {@link isProtectedCookieName}). When
-* no other cookies remain, the header is dropped entirely.
-*
-* Standalone helper retained for callers that want a new Request
-* (e.g. tests). Inside the SDK's per-request handler, the auth
-* middleware uses {@link stripProtectedCookies} directly on
-* `c.req.raw.headers` so the auth check itself can still read the
-* protected cookies before they are stripped.
-*/
-function sanitizeRequest(original) {
-	const headers = new Headers(original.headers);
-	stripProtectedCookies(headers);
-	const init = {
-		method: original.method,
-		headers,
-		redirect: original.redirect,
-		signal: original.signal
-	};
-	if (original.body !== null) {
-		init.body = original.body;
-		init.duplex = "half";
-	}
-	return new Request(original.url, init);
-}
-//#endregion
-export { sanitizeRequest };
-
-//# sourceMappingURL=sanitize-request.js.map

package/dist/server/sanitize-request.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sanitize-request.js","names":[],"sources":["../../src/server/sanitize-request.ts"],"sourcesContent":["import { isProtectedCookieName } from './constants.ts';\nimport { parseCookies } from './utils/cookie-utils.ts';\n\nfunction serializeCookies(cookies: Map<string, string>): string {\n  const parts: string[] = [];\n  for (const [name, value] of cookies) {\n    parts.push(`${name}=${value}`);\n  }\n  return parts.join('; ');\n}\n\n/**\n * Mutates `headers` in place: parses the `Cookie` header, drops every\n * protected cookie (see {@link isProtectedCookieName}), and rewrites\n * the header. Deletes the header entirely when nothing survives.\n *\n * Used by the SDK's auth middleware after it has read the access\n * token / session ID, so user route handlers never see — and\n * therefore cannot leak — those cookies, while CORS / auth\n * middleware that ran first still got the raw values.\n */\nexport function stripProtectedCookies(headers: Headers): void {\n  const cookies = parseCookies(headers.get('Cookie'));\n  const surviving = new Map<string, string>();\n  for (const [name, value] of Object.entries(cookies)) {\n    if (!isProtectedCookieName(name)) {\n      surviving.set(name, value);\n    }\n  }\n\n  if (surviving.size === 0) {\n    headers.delete('cookie');\n  } else {\n    headers.set('cookie', serializeCookies(surviving));\n  }\n}\n\n/**\n * Returns a clone of `original` whose `Cookie` header has every\n * protected cookie removed (see {@link isProtectedCookieName}). When\n * no other cookies remain, the header is dropped entirely.\n *\n * Standalone helper retained for callers that want a new Request\n * (e.g. tests). Inside the SDK's per-request handler, the auth\n * middleware uses {@link stripProtectedCookies} directly on\n * `c.req.raw.headers` so the auth check itself can still read the\n * protected cookies before they are stripped.\n */\nexport function sanitizeRequest(original: Request): Request {\n  const headers = new Headers(original.headers);\n  stripProtectedCookies(headers);\n\n  const init: RequestInit = {\n    method: original.method,\n    headers,\n    redirect: original.redirect,\n    signal: original.signal,\n  };\n\n  if (original.body !== null) {\n    init.body = original.body;\n    (init as RequestInit & { duplex: 'half' }).duplex = 'half';\n  }\n\n  return new Request(original.url, init);\n}\n"],"mappings":";;;AAGA,SAAS,iBAAiB,SAAsC;CAC9D,MAAM,QAAkB,EAAE;CAC1B,KAAK,MAAM,CAAC,MAAM,UAAU,SAC1B,MAAM,KAAK,GAAG,KAAK,GAAG,QAAQ;CAEhC,OAAO,MAAM,KAAK,KAAK;;;;;;;;;;;;AAazB,SAAgB,sBAAsB,SAAwB;CAC5D,MAAM,UAAU,aAAa,QAAQ,IAAI,SAAS,CAAC;CACnD,MAAM,4BAAY,IAAI,KAAqB;CAC3C,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,QAAQ,EACjD,IAAI,CAAC,sBAAsB,KAAK,EAC9B,UAAU,IAAI,MAAM,MAAM;CAI9B,IAAI,UAAU,SAAS,GACrB,QAAQ,OAAO,SAAS;MAExB,QAAQ,IAAI,UAAU,iBAAiB,UAAU,CAAC;;;;;;;;;;;;;AAetD,SAAgB,gBAAgB,UAA4B;CAC1D,MAAM,UAAU,IAAI,QAAQ,SAAS,QAAQ;CAC7C,sBAAsB,QAAQ;CAE9B,MAAM,OAAoB;EACxB,QAAQ,SAAS;EACjB;EACA,UAAU,SAAS;EACnB,QAAQ,SAAS;EAClB;CAED,IAAI,SAAS,SAAS,MAAM;EAC1B,KAAK,OAAO,SAAS;EACrB,KAA2C,SAAS;;CAGtD,OAAO,IAAI,QAAQ,SAAS,KAAK,KAAK"}

package/dist/server/secure-start-core.d.ts

@@ -1,23 +0,0 @@
-import { AppKeys } from "./types.js";
-
-//#region src/server/secure-start-core.d.ts
-/**
- * Context passed to a function-style entrypoint loaded by `runSecureStart`.
- * Contains imported `AppKeys` when CIMD or DPoP is enabled; otherwise
- * `null` (traditional OAuth with `client_secret` and Bearer API calls).
- */
-interface SecureStartContext {
-  appKeys: AppKeys | null;
-}
-interface SecureEntryPointExports {
-  start: (context: SecureStartContext) => Promise<void>;
-}
-/**
- * Loader returned to `runSecureStart` that produces the entrypoint
- * module. Always pass an `() => import('...')` arrow so the bundler
- * preserves dynamic-import semantics.
- */
-type SecureStartLoader = () => Promise<SecureEntryPointExports>;
-//#endregion
-export { SecureStartContext, SecureStartLoader };
-//# sourceMappingURL=secure-start-core.d.ts.map

package/dist/server/secure-start-core.js

@@ -1,28 +0,0 @@
-import { importAppKeys } from "./import-app-keys.js";
-import { isHubspotAppPrivateKeyRequired } from "./utils/env-utils.js";
-//#region src/server/secure-start-core.ts
-const APP_PRIVATE_KEY_ENV = "HUBSPOT_APP_PRIVATE_KEY";
-/**
-* Loads `HUBSPOT_APP_PRIVATE_KEY` when CIMD or DPoP is enabled, deletes
-* it from the environment so later code cannot re-read it, imports the
-* entrypoint module via `loader`, and invokes `start` with `AppKeys` or
-* `null` when both features are off. On failure, logs the error and
-* exits with code 1.
-*/
-async function runSecureStart(loader, adapter) {
-	let appKeys = null;
-	if (isHubspotAppPrivateKeyRequired()) {
-		const envKey = adapter.readEnv(APP_PRIVATE_KEY_ENV)?.trim();
-		if (!envKey) throw new Error(`${APP_PRIVATE_KEY_ENV} is not set`);
-		appKeys = await importAppKeys(envKey);
-		adapter.deleteEnv(APP_PRIVATE_KEY_ENV);
-	}
-	return (await loader()).start({ appKeys }).catch((error) => {
-		console.error(error);
-		return adapter.exit(1);
-	});
-}
-//#endregion
-export { runSecureStart };
-
-//# sourceMappingURL=secure-start-core.js.map

package/dist/server/secure-start-core.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"secure-start-core.js","names":[],"sources":["../../src/server/secure-start-core.ts"],"sourcesContent":["import { importAppKeys } from './import-app-keys.ts';\nimport type { AppKeys } from './types.ts';\nimport { isHubspotAppPrivateKeyRequired } from './utils/env-utils.ts';\n\n/**\n * Context passed to a function-style entrypoint loaded by `runSecureStart`.\n * Contains imported `AppKeys` when CIMD or DPoP is enabled; otherwise\n * `null` (traditional OAuth with `client_secret` and Bearer API calls).\n */\nexport interface SecureStartContext {\n  appKeys: AppKeys | null;\n}\n\ninterface SecureEntryPointExports {\n  start: (context: SecureStartContext) => Promise<void>;\n}\n\n/**\n * Loader returned to `runSecureStart` that produces the entrypoint\n * module. Always pass an `() => import('...')` arrow so the bundler\n * preserves dynamic-import semantics.\n */\nexport type SecureStartLoader = () => Promise<SecureEntryPointExports>;\n\n/**\n * Platform adapters injected by the runtime-specific shim\n * (`node/start.ts` or `deno/start.ts`). Keeping the env/exit/delete\n * functions out of the core lets the shared logic stay platform-free.\n */\nexport interface SecureStartAdapter {\n  /** Reads the named env var, or returns `undefined` when unset. */\n  readEnv: (key: string) => string | undefined;\n  /** Removes the named env var so child processes cannot read it. */\n  deleteEnv: (key: string) => void;\n  /** Terminates the process with the given exit code. */\n  exit: (code: number) => never;\n}\n\nconst APP_PRIVATE_KEY_ENV = 'HUBSPOT_APP_PRIVATE_KEY';\n\n/**\n * Loads `HUBSPOT_APP_PRIVATE_KEY` when CIMD or DPoP is enabled, deletes\n * it from the environment so later code cannot re-read it, imports the\n * entrypoint module via `loader`, and invokes `start` with `AppKeys` or\n * `null` when both features are off. On failure, logs the error and\n * exits with code 1.\n */\nexport async function runSecureStart(\n  loader: SecureStartLoader,\n  adapter: SecureStartAdapter\n): Promise<void> {\n  let appKeys: AppKeys | null = null;\n  if (isHubspotAppPrivateKeyRequired()) {\n    const envKey = adapter.readEnv(APP_PRIVATE_KEY_ENV)?.trim();\n    if (!envKey) {\n      throw new Error(`${APP_PRIVATE_KEY_ENV} is not set`);\n    }\n    appKeys = await importAppKeys(envKey);\n    adapter.deleteEnv(APP_PRIVATE_KEY_ENV);\n  }\n\n  const exports = await loader();\n  return exports.start({ appKeys }).catch((error) => {\n    console.error(error);\n    return adapter.exit(1);\n  });\n}\n"],"mappings":";;;AAsCA,MAAM,sBAAsB;;;;;;;;AAS5B,eAAsB,eACpB,QACA,SACe;CACf,IAAI,UAA0B;CAC9B,IAAI,gCAAgC,EAAE;EACpC,MAAM,SAAS,QAAQ,QAAQ,oBAAoB,EAAE,MAAM;EAC3D,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,GAAG,oBAAoB,aAAa;EAEtD,UAAU,MAAM,cAAc,OAAO;EACrC,QAAQ,UAAU,oBAAoB;;CAIxC,QAAO,MADe,QAAQ,EACf,MAAM,EAAE,SAAS,CAAC,CAAC,OAAO,UAAU;EACjD,QAAQ,MAAM,MAAM;EACpB,OAAO,QAAQ,KAAK,EAAE;GACtB"}

package/dist/server/shared/constants.js

@@ -1,30 +0,0 @@
-//#region src/shared/constants.ts
-/**
-* Path the browser visits after HubSpot's authorize endpoint
-* redirects back to the app. Mounted on the **frontend** origin (not
-* the SDK's edge function host) so all OAuth-related cookies live in
-* the `(frontend, edge)` CHIPS partition.
-*
-* The SDK's `auth/init-session` builds the OAuth `redirect_uri` as
-* `${requestOrigin}${HUBSPOT_FRONTEND_CALLBACK_PATH}`. The browser
-* controller, on `start()`, recognizes this path on `window.location`
-* and forwards `?code` + `?state` to the SDK's `auth/complete`
-* endpoint via a credentialed cross-site fetch. The host app must
-* register `${app_origin}${HUBSPOT_FRONTEND_CALLBACK_PATH}` as a
-* redirect URI in its HubSpot app settings.
-*/
-const HUBSPOT_FRONTEND_CALLBACK_PATH = "/__hubspot_oauth_callback";
-/**
-* Query parameter on the `auth/complete` POST request carrying the
-* authorization `code` HubSpot returned to the frontend callback.
-*/
-const AUTH_COMPLETE_CODE_PARAM = "code";
-/**
-* Query parameter on the `auth/complete` POST request carrying the
-* OAuth `state` HubSpot echoed back to the frontend callback.
-*/
-const AUTH_COMPLETE_STATE_PARAM = "state";
-//#endregion
-export { AUTH_COMPLETE_CODE_PARAM, AUTH_COMPLETE_STATE_PARAM, HUBSPOT_FRONTEND_CALLBACK_PATH };
-
-//# sourceMappingURL=constants.js.map

package/dist/server/shared/constants.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"constants.js","names":[],"sources":["../../../src/shared/constants.ts"],"sourcesContent":["/**\n * Constants whose values are part of the contract between the browser\n * controller and the server-side hubspot-connect routes. Both halves\n * import from this module so the wire format stays in sync.\n */\n\n/**\n * Query parameter on the OAuth return URL that carries the new access\n * token's expiry (Unix epoch milliseconds). The browser controller\n * sets this in the URL after a successful `auth/complete` call and\n * then strips it during `initAppConnect` via `history.replaceState`.\n */\nexport const EXPIRES_AT_URL_PARAM = '__hs_expires_at';\n\n/**\n * Path the browser visits after HubSpot's authorize endpoint\n * redirects back to the app. Mounted on the **frontend** origin (not\n * the SDK's edge function host) so all OAuth-related cookies live in\n * the `(frontend, edge)` CHIPS partition.\n *\n * The SDK's `auth/init-session` builds the OAuth `redirect_uri` as\n * `${requestOrigin}${HUBSPOT_FRONTEND_CALLBACK_PATH}`. The browser\n * controller, on `start()`, recognizes this path on `window.location`\n * and forwards `?code` + `?state` to the SDK's `auth/complete`\n * endpoint via a credentialed cross-site fetch. The host app must\n * register `${app_origin}${HUBSPOT_FRONTEND_CALLBACK_PATH}` as a\n * redirect URI in its HubSpot app settings.\n */\nexport const HUBSPOT_FRONTEND_CALLBACK_PATH = '/__hubspot_oauth_callback';\n\n/**\n * Query parameter on the `auth/complete` POST request carrying the\n * authorization `code` HubSpot returned to the frontend callback.\n */\nexport const AUTH_COMPLETE_CODE_PARAM = 'code';\n\n/**\n * Query parameter on the `auth/complete` POST request carrying the\n * OAuth `state` HubSpot echoed back to the frontend callback.\n */\nexport const AUTH_COMPLETE_STATE_PARAM = 'state';\n"],"mappings":";;;;;;;;;;;;;;;AA4BA,MAAa,iCAAiC;;;;;AAM9C,MAAa,2BAA2B;;;;;AAMxC,MAAa,4BAA4B"}

package/dist/server/shared/encoding/base64.js

@@ -1,45 +0,0 @@
-//#region src/shared/encoding/base64.ts
-/**
-* Base64url encoding and decoding helpers shared by the browser and
-* server halves of `@hubspot/app-connect-sdk`.
-*
-* Base64url (RFC 4648 §5) replaces `+`/`/` with `-`/`_` and drops `=`
-* padding. JWT, DPoP, and JWK thumbprints all use this variant.
-*/
-/**
-* Encodes a binary buffer as a base64url string (RFC 4648 §5).
-*/
-function base64url(input) {
-	const bytes = input instanceof Uint8Array ? input : new Uint8Array(input);
-	let binary = "";
-	for (const byte of bytes) binary += String.fromCharCode(byte);
-	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-}
-/**
-* Decodes a base64url string into a `Uint8Array`. Tolerates missing
-* padding by re-adding it before delegating to `atob`.
-*/
-function base64urlDecode(encoded) {
-	const padLen = (4 - encoded.length % 4) % 4;
-	const padded = encoded.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat(padLen);
-	const binary = atob(padded);
-	const out = new Uint8Array(new ArrayBuffer(binary.length));
-	for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i) ?? 0;
-	return out;
-}
-/**
-* Decodes a *standard* base64 string (with `+`/`/` and required `=`
-* padding) into an `ArrayBuffer`. Used for PKCS8-encoded private keys
-* stored in environment variables.
-*/
-function base64StandardToArrayBuffer(b64) {
-	const bin = atob(b64);
-	const buf = new ArrayBuffer(bin.length);
-	const view = new Uint8Array(buf);
-	for (let i = 0; i < bin.length; i++) view[i] = bin.charCodeAt(i) ?? 0;
-	return buf;
-}
-//#endregion
-export { base64StandardToArrayBuffer, base64url, base64urlDecode };
-
-//# sourceMappingURL=base64.js.map

package/dist/server/shared/encoding/base64.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"base64.js","names":[],"sources":["../../../../src/shared/encoding/base64.ts"],"sourcesContent":["/**\n * Base64url encoding and decoding helpers shared by the browser and\n * server halves of `@hubspot/app-connect-sdk`.\n *\n * Base64url (RFC 4648 §5) replaces `+`/`/` with `-`/`_` and drops `=`\n * padding. JWT, DPoP, and JWK thumbprints all use this variant.\n */\n\n/**\n * Encodes a binary buffer as a base64url string (RFC 4648 §5).\n */\nexport function base64url(input: ArrayBuffer | Uint8Array): string {\n  const bytes = input instanceof Uint8Array ? input : new Uint8Array(input);\n  let binary = '';\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n}\n\n/**\n * Decodes a base64url string into a `Uint8Array`. Tolerates missing\n * padding by re-adding it before delegating to `atob`.\n */\nexport function base64urlDecode(encoded: string): Uint8Array<ArrayBuffer> {\n  const padLen = (4 - (encoded.length % 4)) % 4;\n  const padded =\n    encoded.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat(padLen);\n  const binary = atob(padded);\n  const out = new Uint8Array(new ArrayBuffer(binary.length));\n  for (let i = 0; i < binary.length; i++) {\n    out[i] = binary.charCodeAt(i) ?? 0;\n  }\n  return out;\n}\n\n/**\n * Decodes a *standard* base64 string (with `+`/`/` and required `=`\n * padding) into an `ArrayBuffer`. Used for PKCS8-encoded private keys\n * stored in environment variables.\n */\nexport function base64StandardToArrayBuffer(b64: string): ArrayBuffer {\n  const bin = atob(b64);\n  const buf = new ArrayBuffer(bin.length);\n  const view = new Uint8Array(buf);\n  for (let i = 0; i < bin.length; i++) {\n    view[i] = bin.charCodeAt(i) ?? 0;\n  }\n  return buf;\n}\n"],"mappings":";;;;;;;;;;;AAWA,SAAgB,UAAU,OAAyC;CACjE,MAAM,QAAQ,iBAAiB,aAAa,QAAQ,IAAI,WAAW,MAAM;CACzE,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OACjB,UAAU,OAAO,aAAa,KAAK;CAErC,OAAO,KAAK,OAAO,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,MAAM,GAAG;;;;;;AAO/E,SAAgB,gBAAgB,SAA0C;CACxE,MAAM,UAAU,IAAK,QAAQ,SAAS,KAAM;CAC5C,MAAM,SACJ,QAAQ,QAAQ,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI,GAAG,IAAI,OAAO,OAAO;CACpE,MAAM,SAAS,KAAK,OAAO;CAC3B,MAAM,MAAM,IAAI,WAAW,IAAI,YAAY,OAAO,OAAO,CAAC;CAC1D,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KACjC,IAAI,KAAK,OAAO,WAAW,EAAE,IAAI;CAEnC,OAAO;;;;;;;AAQT,SAAgB,4BAA4B,KAA0B;CACpE,MAAM,MAAM,KAAK,IAAI;CACrB,MAAM,MAAM,IAAI,YAAY,IAAI,OAAO;CACvC,MAAM,OAAO,IAAI,WAAW,IAAI;CAChC,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAC9B,KAAK,KAAK,IAAI,WAAW,EAAE,IAAI;CAEjC,OAAO"}

package/dist/server/shared/encoding/sha256.d.ts

@@ -1,10 +0,0 @@
-//#region src/shared/encoding/sha256.d.ts
-/**
- * Hashes a UTF-8 string with SHA-256 and encodes the digest as
- * base64url. Used to compute DPoP `ath`/`sid` claims, JWK thumbprints
- * (RFC 7638), and PKCE code challenges.
- */
-declare function sha256base64url(input: string): Promise<string>;
-//#endregion
-export { sha256base64url };
-//# sourceMappingURL=sha256.d.ts.map

package/dist/server/shared/encoding/sha256.js

@@ -1,15 +0,0 @@
-import { base64url } from "./base64.js";
-//#region src/shared/encoding/sha256.ts
-/**
-* Hashes a UTF-8 string with SHA-256 and encodes the digest as
-* base64url. Used to compute DPoP `ath`/`sid` claims, JWK thumbprints
-* (RFC 7638), and PKCE code challenges.
-*/
-async function sha256base64url(input) {
-	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
-	return base64url(new Uint8Array(digest));
-}
-//#endregion
-export { sha256base64url };
-
-//# sourceMappingURL=sha256.js.map

package/dist/server/shared/encoding/sha256.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sha256.js","names":[],"sources":["../../../../src/shared/encoding/sha256.ts"],"sourcesContent":["import { base64url } from './base64.ts';\n\n/**\n * Hashes a UTF-8 string with SHA-256 and encodes the digest as\n * base64url. Used to compute DPoP `ath`/`sid` claims, JWK thumbprints\n * (RFC 7638), and PKCE code challenges.\n */\nexport async function sha256base64url(input: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\n    'SHA-256',\n    new TextEncoder().encode(input)\n  );\n  return base64url(new Uint8Array(digest));\n}\n"],"mappings":";;;;;;;AAOA,eAAsB,gBAAgB,OAAgC;CACpE,MAAM,SAAS,MAAM,OAAO,OAAO,OACjC,WACA,IAAI,aAAa,CAAC,OAAO,MAAM,CAChC;CACD,OAAO,UAAU,IAAI,WAAW,OAAO,CAAC"}

package/dist/server/shared/logger.d.ts

@@ -1,15 +0,0 @@
-//#region src/shared/logger.d.ts
-/**
- * Pluggable logger contract used by the SDK on both the browser and
- * server. Consumers can pass `console`-like loggers, structured
- * loggers (pino / winston / etc.) or no-op stubs in tests.
- */
-interface Logger {
-  debug: (message: string, ...args: unknown[]) => void;
-  info: (message: string, ...args: unknown[]) => void;
-  warn: (message: string, ...args: unknown[]) => void;
-  error: (message: string, ...args: unknown[]) => void;
-}
-//#endregion
-export { Logger };
-//# sourceMappingURL=logger.d.ts.map

package/dist/server/shared/logger.js

@@ -1,16 +0,0 @@
-//#region src/shared/logger.ts
-/**
-* Logger that swallows every message. Convenient for tests and for
-* the SDK's server-side handlers when no logger is provided by the
-* host application.
-*/
-const noopLogger = {
-	debug: () => {},
-	info: () => {},
-	warn: () => {},
-	error: () => {}
-};
-//#endregion
-export { noopLogger };
-
-//# sourceMappingURL=logger.js.map

package/dist/server/shared/logger.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"logger.js","names":[],"sources":["../../../src/shared/logger.ts"],"sourcesContent":["/**\n * Pluggable logger contract used by the SDK on both the browser and\n * server. Consumers can pass `console`-like loggers, structured\n * loggers (pino / winston / etc.) or no-op stubs in tests.\n */\nexport interface Logger {\n  debug: (message: string, ...args: unknown[]) => void;\n  info: (message: string, ...args: unknown[]) => void;\n  warn: (message: string, ...args: unknown[]) => void;\n  error: (message: string, ...args: unknown[]) => void;\n}\n\nfunction formatPrefix(name: string): string {\n  return `[${name}]`;\n}\n\n/**\n * Creates a console-backed logger that prefixes every line with the\n * supplied `name`. Used as the default when no custom logger is\n * provided.\n */\nexport function createLogger(name: string): Logger {\n  const prefix = formatPrefix(name);\n  return {\n    debug: (message, ...args) => {\n      console.debug(prefix, message, ...args);\n    },\n    info: (message, ...args) => {\n      console.info(prefix, message, ...args);\n    },\n    warn: (message, ...args) => {\n      console.warn(prefix, message, ...args);\n    },\n    error: (message, ...args) => {\n      console.error(prefix, message, ...args);\n    },\n  };\n}\n\n/**\n * Logger that swallows every message. Convenient for tests and for\n * the SDK's server-side handlers when no logger is provided by the\n * host application.\n */\nexport const noopLogger: Logger = {\n  debug: () => {},\n  info: () => {},\n  warn: () => {},\n  error: () => {},\n};\n"],"mappings":";;;;;;AA4CA,MAAa,aAAqB;CAChC,aAAa;CACb,YAAY;CACZ,YAAY;CACZ,aAAa;CACd"}

package/dist/server/utils/cookie-utils.js

@@ -1,21 +0,0 @@
-//#region src/server/utils/cookie-utils.ts
-/**
-* Parses an HTTP `Cookie` request header into a `name -> value` map.
-* Tolerates leading/trailing whitespace, missing `=` (treats the
-* cookie value as empty), and duplicate names (last write wins).
-*
-* Returns an empty object when `cookieHeader` is `null`/`undefined`
-* /empty so callers don't have to null-check the input.
-*/
-function parseCookies(cookieHeader) {
-	if (!cookieHeader) return {};
-	return Object.fromEntries(cookieHeader.split(";").map((pair) => {
-		const eqIdx = pair.indexOf("=");
-		if (eqIdx === -1) return [pair.trim(), ""];
-		return [pair.slice(0, eqIdx).trim(), pair.slice(eqIdx + 1).trim()];
-	}).filter(([name]) => name.length > 0));
-}
-//#endregion
-export { parseCookies };
-
-//# sourceMappingURL=cookie-utils.js.map

package/dist/server/utils/cookie-utils.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cookie-utils.js","names":[],"sources":["../../../src/server/utils/cookie-utils.ts"],"sourcesContent":["/**\n * Parses an HTTP `Cookie` request header into a `name -> value` map.\n * Tolerates leading/trailing whitespace, missing `=` (treats the\n * cookie value as empty), and duplicate names (last write wins).\n *\n * Returns an empty object when `cookieHeader` is `null`/`undefined`\n * /empty so callers don't have to null-check the input.\n */\nexport function parseCookies(\n  cookieHeader: string | null | undefined\n): Record<string, string> {\n  if (!cookieHeader) return {};\n  return Object.fromEntries(\n    cookieHeader\n      .split(';')\n      .map((pair) => {\n        const eqIdx = pair.indexOf('=');\n        if (eqIdx === -1) return [pair.trim(), ''] as [string, string];\n        return [pair.slice(0, eqIdx).trim(), pair.slice(eqIdx + 1).trim()] as [\n          string,\n          string,\n        ];\n      })\n      .filter(([name]) => name.length > 0)\n  );\n}\n"],"mappings":";;;;;;;;;AAQA,SAAgB,aACd,cACwB;CACxB,IAAI,CAAC,cAAc,OAAO,EAAE;CAC5B,OAAO,OAAO,YACZ,aACG,MAAM,IAAI,CACV,KAAK,SAAS;EACb,MAAM,QAAQ,KAAK,QAAQ,IAAI;EAC/B,IAAI,UAAU,IAAI,OAAO,CAAC,KAAK,MAAM,EAAE,GAAG;EAC1C,OAAO,CAAC,KAAK,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,MAAM,QAAQ,EAAE,CAAC,MAAM,CAAC;GAIlE,CACD,QAAQ,CAAC,UAAU,KAAK,SAAS,EAAE,CACvC"}

package/dist/server/utils/dpop-utils.d.ts

@@ -1,67 +0,0 @@
-//#region src/server/utils/dpop-utils.d.ts
-/**
- * Claims that go into a DPoP proof JWT (RFC 9449 §4.2). Extra
- * properties pass through to the encoder unchanged so callers can
- * include implementation-specific claims.
- */
-interface DpopClaims {
-  /** HTTP method of the protected request, uppercase. */
-  htm: string;
-  /** Target URI of the protected request, fully-qualified. */
-  htu: string;
-  /** Unique proof identifier (RFC 9449 §4.2, recommended UUID). */
-  jti: string;
-  /** Issuance time, Unix epoch seconds. */
-  iat: number;
-  /**
-   * Hash of the access token presented alongside this proof, if any
-   * (RFC 9449 §4.2). Required for resource-server DPoP.
-   */
-  ath?: string;
-  /**
-   * App session ID hash. Custom HubSpot extension that lets the auth
-   * server bind tokens to the browser session that minted them.
-   */
-  sid?: string;
-  [key: string]: unknown;
-}
-/**
- * Result of a successful {@link verifyDpopProof} call.
- */
-interface VerifiedDpopProof {
-  /** Public JWK extracted from the proof's header. */
-  publicKeyJwk: JsonWebKey;
-  /** RFC 7638 JWK thumbprint of `publicKeyJwk`. */
-  jkt: string;
-  /** Decoded claims from the proof's payload. */
-  claims: DpopClaims;
-}
-interface VerifyDpopProofOptions {
-  /** The compact-serialized DPoP proof. */
-  proof: string;
-  /** Expected HTTP method (RFC 9449 `htm` claim). */
-  htm: string;
-  /** Expected request URI (RFC 9449 `htu` claim). */
-  htu: string;
-  /** Expected access-token hash (RFC 9449 `ath` claim). */
-  ath?: string;
-  /** Expected app-session-ID hash (`sid` claim). */
-  sid?: string;
-}
-/**
- * Verifies a DPoP proof JWT and returns the embedded public JWK,
- * its thumbprint, and the decoded claims.
- *
- * Enforces RFC 9449's required checks:
- *
- * - `typ=dpop+jwt`, `alg=ES256`, and a JWK in the header.
- * - Signature is valid against the embedded JWK.
- * - `htm`, `htu`, and (when supplied) `ath`/`sid` match.
- * - `iat` is within ±5 minutes of "now".
- *
- * @throws {Error} If any of the above checks fail.
- */
-declare function verifyDpopProof(options: VerifyDpopProofOptions): Promise<VerifiedDpopProof>;
-//#endregion
-export { verifyDpopProof };
-//# sourceMappingURL=dpop-utils.d.ts.map

package/dist/server/utils/dpop-utils.js

@@ -1,75 +0,0 @@
-import { base64urlDecode } from "../shared/encoding/base64.js";
-import { getJwkThumbprint } from "./jwk-utils.js";
-import { decodeAndVerifyJwt, encodeAndSignJwt } from "./jwt-utils.js";
-//#region src/server/utils/dpop-utils.ts
-function ecPublicJwkForDpopHeader(jwk) {
-	if (jwk.kty !== "EC" || jwk.crv !== "P-256" || typeof jwk.x !== "string" || typeof jwk.y !== "string") throw new Error("Expected P-256 EC public JWK");
-	return {
-		kty: "EC",
-		crv: "P-256",
-		x: jwk.x,
-		y: jwk.y
-	};
-}
-/**
-* Mints a DPoP proof JWT (RFC 9449) signed with the app's private
-* key. The header is set to `typ=dpop+jwt`, `alg=ES256`, and embeds
-* the public JWK so the receiver can verify the signature without
-* out-of-band key distribution.
-*/
-async function signDpopProof(options) {
-	const { appKeys, claims } = options;
-	return encodeAndSignJwt({
-		header: {
-			alg: "ES256",
-			typ: "dpop+jwt",
-			jwk: ecPublicJwkForDpopHeader(appKeys.appPublicKeyJwk)
-		},
-		payload: claims,
-		privateKey: appKeys.appPrivateKey
-	});
-}
-/**
-* Verifies a DPoP proof JWT and returns the embedded public JWK,
-* its thumbprint, and the decoded claims.
-*
-* Enforces RFC 9449's required checks:
-*
-* - `typ=dpop+jwt`, `alg=ES256`, and a JWK in the header.
-* - Signature is valid against the embedded JWK.
-* - `htm`, `htu`, and (when supplied) `ath`/`sid` match.
-* - `iat` is within ±5 minutes of "now".
-*
-* @throws {Error} If any of the above checks fail.
-*/
-async function verifyDpopProof(options) {
-	const { proof, htm, htu, ath, sid } = options;
-	const parts = proof.split(".");
-	if (parts.length !== 3) throw new Error("Invalid DPoP proof format");
-	const encodedHeader = parts[0];
-	if (!encodedHeader) throw new Error("Missing DPoP header");
-	const header = JSON.parse(new TextDecoder().decode(base64urlDecode(encodedHeader)));
-	if (header.typ !== "dpop+jwt") throw new Error("Invalid DPoP typ header");
-	if (header.alg !== "ES256") throw new Error("Unsupported DPoP algorithm");
-	const publicKeyJwk = header.jwk;
-	if (!publicKeyJwk) throw new Error("Missing jwk in DPoP header");
-	const claims = await decodeAndVerifyJwt({
-		token: proof,
-		publicKeyJwk
-	});
-	if (claims.htm !== htm) throw new Error(`DPoP htm mismatch: expected ${htm}, got ${claims.htm}`);
-	if (claims.htu !== htu) throw new Error(`DPoP htu mismatch: expected ${htu}, got ${claims.htu}`);
-	if (ath !== void 0 && claims.ath !== ath) throw new Error("DPoP ath mismatch");
-	if (sid !== void 0 && claims.sid !== sid) throw new Error("DPoP sid mismatch");
-	const now = Math.floor(Date.now() / 1e3);
-	if (Math.abs(now - claims.iat) > 300) throw new Error("DPoP proof expired or too far in future");
-	return {
-		publicKeyJwk,
-		jkt: await getJwkThumbprint({ publicKeyJwk }),
-		claims
-	};
-}
-//#endregion
-export { signDpopProof, verifyDpopProof };
-
-//# sourceMappingURL=dpop-utils.js.map

package/dist/server/utils/dpop-utils.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dpop-utils.js","names":[],"sources":["../../../src/server/utils/dpop-utils.ts"],"sourcesContent":["import { type AppKeys } from '../types.ts';\nimport { base64urlDecode } from './base64-utils.ts';\nimport { getJwkThumbprint } from './jwk-utils.ts';\nimport { decodeAndVerifyJwt, encodeAndSignJwt } from './jwt-utils.ts';\n\n/**\n * Claims that go into a DPoP proof JWT (RFC 9449 §4.2). Extra\n * properties pass through to the encoder unchanged so callers can\n * include implementation-specific claims.\n */\nexport interface DpopClaims {\n  /** HTTP method of the protected request, uppercase. */\n  htm: string;\n  /** Target URI of the protected request, fully-qualified. */\n  htu: string;\n  /** Unique proof identifier (RFC 9449 §4.2, recommended UUID). */\n  jti: string;\n  /** Issuance time, Unix epoch seconds. */\n  iat: number;\n  /**\n   * Hash of the access token presented alongside this proof, if any\n   * (RFC 9449 §4.2). Required for resource-server DPoP.\n   */\n  ath?: string;\n  /**\n   * App session ID hash. Custom HubSpot extension that lets the auth\n   * server bind tokens to the browser session that minted them.\n   */\n  sid?: string;\n  [key: string]: unknown;\n}\n\nfunction ecPublicJwkForDpopHeader(jwk: JsonWebKey): JsonWebKey {\n  if (\n    jwk.kty !== 'EC' ||\n    jwk.crv !== 'P-256' ||\n    typeof jwk.x !== 'string' ||\n    typeof jwk.y !== 'string'\n  ) {\n    throw new Error('Expected P-256 EC public JWK');\n  }\n  return {\n    kty: 'EC',\n    crv: 'P-256',\n    x: jwk.x,\n    y: jwk.y,\n  };\n}\n\nexport interface SignDpopProofOptions {\n  /** App key material produced by `secureStart`. */\n  appKeys: AppKeys;\n  /** Claims to include in the DPoP proof. */\n  claims: DpopClaims;\n}\n\n/**\n * Mints a DPoP proof JWT (RFC 9449) signed with the app's private\n * key. The header is set to `typ=dpop+jwt`, `alg=ES256`, and embeds\n * the public JWK so the receiver can verify the signature without\n * out-of-band key distribution.\n */\nexport async function signDpopProof(\n  options: SignDpopProofOptions\n): Promise<string> {\n  const { appKeys, claims } = options;\n  const publicJwk = ecPublicJwkForDpopHeader(appKeys.appPublicKeyJwk);\n  return encodeAndSignJwt({\n    header: { alg: 'ES256', typ: 'dpop+jwt', jwk: publicJwk },\n    payload: claims,\n    privateKey: appKeys.appPrivateKey,\n  });\n}\n\n/**\n * Result of a successful {@link verifyDpopProof} call.\n */\nexport interface VerifiedDpopProof {\n  /** Public JWK extracted from the proof's header. */\n  publicKeyJwk: JsonWebKey;\n  /** RFC 7638 JWK thumbprint of `publicKeyJwk`. */\n  jkt: string;\n  /** Decoded claims from the proof's payload. */\n  claims: DpopClaims;\n}\n\nexport interface VerifyDpopProofOptions {\n  /** The compact-serialized DPoP proof. */\n  proof: string;\n  /** Expected HTTP method (RFC 9449 `htm` claim). */\n  htm: string;\n  /** Expected request URI (RFC 9449 `htu` claim). */\n  htu: string;\n  /** Expected access-token hash (RFC 9449 `ath` claim). */\n  ath?: string;\n  /** Expected app-session-ID hash (`sid` claim). */\n  sid?: string;\n}\n\ninterface DpopProofHeader {\n  typ?: string;\n  alg?: string;\n  jwk?: JsonWebKey;\n}\n\n/**\n * Verifies a DPoP proof JWT and returns the embedded public JWK,\n * its thumbprint, and the decoded claims.\n *\n * Enforces RFC 9449's required checks:\n *\n * - `typ=dpop+jwt`, `alg=ES256`, and a JWK in the header.\n * - Signature is valid against the embedded JWK.\n * - `htm`, `htu`, and (when supplied) `ath`/`sid` match.\n * - `iat` is within ±5 minutes of \"now\".\n *\n * @throws {Error} If any of the above checks fail.\n */\nexport async function verifyDpopProof(\n  options: VerifyDpopProofOptions\n): Promise<VerifiedDpopProof> {\n  const { proof, htm, htu, ath, sid } = options;\n  const parts = proof.split('.');\n  if (parts.length !== 3) throw new Error('Invalid DPoP proof format');\n\n  const encodedHeader = parts[0];\n  if (!encodedHeader) throw new Error('Missing DPoP header');\n\n  const header = JSON.parse(\n    new TextDecoder().decode(base64urlDecode(encodedHeader))\n  ) as DpopProofHeader;\n\n  if (header.typ !== 'dpop+jwt') throw new Error('Invalid DPoP typ header');\n  if (header.alg !== 'ES256') throw new Error('Unsupported DPoP algorithm');\n  const publicKeyJwk = header.jwk;\n  if (!publicKeyJwk) throw new Error('Missing jwk in DPoP header');\n\n  const payload = await decodeAndVerifyJwt({ token: proof, publicKeyJwk });\n  const claims = payload as unknown as DpopClaims;\n\n  if (claims.htm !== htm) {\n    throw new Error(`DPoP htm mismatch: expected ${htm}, got ${claims.htm}`);\n  }\n  if (claims.htu !== htu) {\n    throw new Error(`DPoP htu mismatch: expected ${htu}, got ${claims.htu}`);\n  }\n  if (ath !== undefined && claims.ath !== ath) {\n    throw new Error('DPoP ath mismatch');\n  }\n  if (sid !== undefined && claims.sid !== sid) {\n    throw new Error('DPoP sid mismatch');\n  }\n\n  const now = Math.floor(Date.now() / 1000);\n  if (Math.abs(now - claims.iat) > 300) {\n    throw new Error('DPoP proof expired or too far in future');\n  }\n\n  const jkt = await getJwkThumbprint({ publicKeyJwk });\n  return { publicKeyJwk, jkt, claims };\n}\n"],"mappings":";;;;AAgCA,SAAS,yBAAyB,KAA6B;CAC7D,IACE,IAAI,QAAQ,QACZ,IAAI,QAAQ,WACZ,OAAO,IAAI,MAAM,YACjB,OAAO,IAAI,MAAM,UAEjB,MAAM,IAAI,MAAM,+BAA+B;CAEjD,OAAO;EACL,KAAK;EACL,KAAK;EACL,GAAG,IAAI;EACP,GAAG,IAAI;EACR;;;;;;;;AAgBH,eAAsB,cACpB,SACiB;CACjB,MAAM,EAAE,SAAS,WAAW;CAE5B,OAAO,iBAAiB;EACtB,QAAQ;GAAE,KAAK;GAAS,KAAK;GAAY,KAFzB,yBAAyB,QAAQ,gBAEM;GAAE;EACzD,SAAS;EACT,YAAY,QAAQ;EACrB,CAAC;;;;;;;;;;;;;;;AA+CJ,eAAsB,gBACpB,SAC4B;CAC5B,MAAM,EAAE,OAAO,KAAK,KAAK,KAAK,QAAQ;CACtC,MAAM,QAAQ,MAAM,MAAM,IAAI;CAC9B,IAAI,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,4BAA4B;CAEpE,MAAM,gBAAgB,MAAM;CAC5B,IAAI,CAAC,eAAe,MAAM,IAAI,MAAM,sBAAsB;CAE1D,MAAM,SAAS,KAAK,MAClB,IAAI,aAAa,CAAC,OAAO,gBAAgB,cAAc,CAAC,CACzD;CAED,IAAI,OAAO,QAAQ,YAAY,MAAM,IAAI,MAAM,0BAA0B;CACzE,IAAI,OAAO,QAAQ,SAAS,MAAM,IAAI,MAAM,6BAA6B;CACzE,MAAM,eAAe,OAAO;CAC5B,IAAI,CAAC,cAAc,MAAM,IAAI,MAAM,6BAA6B;CAGhE,MAAM,SAAS,MADO,mBAAmB;EAAE,OAAO;EAAO;EAAc,CAAC;CAGxE,IAAI,OAAO,QAAQ,KACjB,MAAM,IAAI,MAAM,+BAA+B,IAAI,QAAQ,OAAO,MAAM;CAE1E,IAAI,OAAO,QAAQ,KACjB,MAAM,IAAI,MAAM,+BAA+B,IAAI,QAAQ,OAAO,MAAM;CAE1E,IAAI,QAAQ,KAAA,KAAa,OAAO,QAAQ,KACtC,MAAM,IAAI,MAAM,oBAAoB;CAEtC,IAAI,QAAQ,KAAA,KAAa,OAAO,QAAQ,KACtC,MAAM,IAAI,MAAM,oBAAoB;CAGtC,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;CACzC,IAAI,KAAK,IAAI,MAAM,OAAO,IAAI,GAAG,KAC/B,MAAM,IAAI,MAAM,0CAA0C;CAI5D,OAAO;EAAE;EAAc,KAAA,MADL,iBAAiB,EAAE,cAAc,CAAC;EACxB;EAAQ"}

package/dist/server/utils/env-utils.js

@@ -1,54 +0,0 @@
-//#region src/server/utils/env-utils.ts
-/**
-* Reads an environment variable in a way that works under both Node
-* (`process.env`) and Deno (`Deno.env.get`). Returns `undefined` when
-* the variable is unset or when neither runtime is available.
-*/
-function getEnv(key) {
-	const g = globalThis;
-	const proc = g.process;
-	if (proc?.env) return proc.env[key];
-	const deno = g.Deno;
-	if (deno !== void 0) return deno.env.get(key);
-}
-/**
-* Reads an environment variable and throws when it is missing or empty.
-* Use for values the SDK cannot fall back on (e.g. upstream service
-* URLs).
-*
-* @throws {Error} When the environment variable is unset or an empty
-*   string.
-*/
-function requireEnv(key) {
-	const value = getEnv(key);
-	if (!value) throw new Error(`Missing required environment variable: ${key}`);
-	return value;
-}
-/**
-* Whether outbound HubSpot OAuth and API calls should attach DPoP on
-* the wire. Disabled only when `HUBSPOT_DPOP_ENABLED` is exactly the
-* string `"false"` (unset or any other value keeps DPoP enabled).
-*/
-function isHubspotDpopEnabled() {
-	return getEnv("HUBSPOT_DPOP_ENABLED") !== "false";
-}
-/**
-* Whether the SDK should use CIMD-style OAuth (client ID URL + JWT client
-* assertion). Disabled only when `HUBSPOT_CIMD_ENABLED` is exactly the
-* string `"false"` (unset or any other value keeps CIMD enabled).
-*/
-function isHubspotCimdEnabled() {
-	return getEnv("HUBSPOT_CIMD_ENABLED") !== "false";
-}
-/**
-* Whether `HUBSPOT_APP_PRIVATE_KEY` must be set for `secureStart`. False
-* when both CIMD and DPoP are disabled — the SDK then uses
-* `client_secret` for OAuth and Bearer tokens only for API calls.
-*/
-function isHubspotAppPrivateKeyRequired() {
-	return isHubspotCimdEnabled() || isHubspotDpopEnabled();
-}
-//#endregion
-export { isHubspotAppPrivateKeyRequired, isHubspotCimdEnabled, isHubspotDpopEnabled, requireEnv };
-
-//# sourceMappingURL=env-utils.js.map

package/dist/server/utils/env-utils.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"env-utils.js","names":[],"sources":["../../../src/server/utils/env-utils.ts"],"sourcesContent":["interface GlobalWithOptionalEnv {\n  process?: { env?: Record<string, string | undefined> };\n  Deno?: { env: { get(name: string): string | undefined } };\n}\n\n/**\n * Reads an environment variable in a way that works under both Node\n * (`process.env`) and Deno (`Deno.env.get`). Returns `undefined` when\n * the variable is unset or when neither runtime is available.\n */\nexport function getEnv(key: string): string | undefined {\n  const g = globalThis as GlobalWithOptionalEnv;\n  const proc = g.process;\n  if (proc?.env) {\n    return proc.env[key];\n  }\n  const deno = g.Deno;\n  if (deno !== undefined) {\n    return deno.env.get(key);\n  }\n  return undefined;\n}\n\n/**\n * Reads an environment variable and throws when it is missing or empty.\n * Use for values the SDK cannot fall back on (e.g. upstream service\n * URLs).\n *\n * @throws {Error} When the environment variable is unset or an empty\n *   string.\n */\nexport function requireEnv(key: string): string {\n  const value = getEnv(key);\n  if (!value) {\n    throw new Error(`Missing required environment variable: ${key}`);\n  }\n  return value;\n}\n\n/**\n * Whether outbound HubSpot OAuth and API calls should attach DPoP on\n * the wire. Disabled only when `HUBSPOT_DPOP_ENABLED` is exactly the\n * string `\"false\"` (unset or any other value keeps DPoP enabled).\n */\nexport function isHubspotDpopEnabled(): boolean {\n  return getEnv('HUBSPOT_DPOP_ENABLED') !== 'false';\n}\n\n/**\n * Whether the SDK should use CIMD-style OAuth (client ID URL + JWT client\n * assertion). Disabled only when `HUBSPOT_CIMD_ENABLED` is exactly the\n * string `\"false\"` (unset or any other value keeps CIMD enabled).\n */\nexport function isHubspotCimdEnabled(): boolean {\n  return getEnv('HUBSPOT_CIMD_ENABLED') !== 'false';\n}\n\n/**\n * Whether `HUBSPOT_APP_PRIVATE_KEY` must be set for `secureStart`. False\n * when both CIMD and DPoP are disabled — the SDK then uses\n * `client_secret` for OAuth and Bearer tokens only for API calls.\n */\nexport function isHubspotAppPrivateKeyRequired(): boolean {\n  return isHubspotCimdEnabled() || isHubspotDpopEnabled();\n}\n"],"mappings":";;;;;;AAUA,SAAgB,OAAO,KAAiC;CACtD,MAAM,IAAI;CACV,MAAM,OAAO,EAAE;CACf,IAAI,MAAM,KACR,OAAO,KAAK,IAAI;CAElB,MAAM,OAAO,EAAE;CACf,IAAI,SAAS,KAAA,GACX,OAAO,KAAK,IAAI,IAAI,IAAI;;;;;;;;;;AAa5B,SAAgB,WAAW,KAAqB;CAC9C,MAAM,QAAQ,OAAO,IAAI;CACzB,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,0CAA0C,MAAM;CAElE,OAAO;;;;;;;AAQT,SAAgB,uBAAgC;CAC9C,OAAO,OAAO,uBAAuB,KAAK;;;;;;;AAQ5C,SAAgB,uBAAgC;CAC9C,OAAO,OAAO,uBAAuB,KAAK;;;;;;;AAQ5C,SAAgB,iCAA0C;CACxD,OAAO,sBAAsB,IAAI,sBAAsB"}

package/dist/server/utils/jwk-utils.d.ts

@@ -1,16 +0,0 @@
-//#region src/server/utils/jwk-utils.d.ts
-interface GetJwkThumbprintOptions {
-  /** EC P-256 public JWK whose thumbprint to compute. */
-  publicKeyJwk: JsonWebKey;
-}
-/**
- * Computes the RFC 7638 JWK thumbprint of an EC P-256 public JWK.
- * Per §3.2 the canonical form contains only `crv`, `kty`, `x`, `y`,
- * sorted lexicographically — no whitespace, no other members. The
- * SHA-256 of this canonical UTF-8 JSON, base64url-encoded, is the
- * stable identifier (`jkt`) DPoP uses to bind tokens to public keys.
- */
-declare function getJwkThumbprint(options: GetJwkThumbprintOptions): Promise<string>;
-//#endregion
-export { getJwkThumbprint };
-//# sourceMappingURL=jwk-utils.d.ts.map

package/dist/server/utils/jwk-utils.js

@@ -1,24 +0,0 @@
-import { base64url } from "../shared/encoding/base64.js";
-//#region src/server/utils/jwk-utils.ts
-/**
-* Computes the RFC 7638 JWK thumbprint of an EC P-256 public JWK.
-* Per §3.2 the canonical form contains only `crv`, `kty`, `x`, `y`,
-* sorted lexicographically — no whitespace, no other members. The
-* SHA-256 of this canonical UTF-8 JSON, base64url-encoded, is the
-* stable identifier (`jkt`) DPoP uses to bind tokens to public keys.
-*/
-async function getJwkThumbprint(options) {
-	const { publicKeyJwk } = options;
-	const canonical = JSON.stringify({
-		crv: publicKeyJwk.crv,
-		kty: publicKeyJwk.kty,
-		x: publicKeyJwk.x,
-		y: publicKeyJwk.y
-	});
-	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(canonical));
-	return base64url(new Uint8Array(digest));
-}
-//#endregion
-export { getJwkThumbprint };
-
-//# sourceMappingURL=jwk-utils.js.map

package/dist/server/utils/jwk-utils.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwk-utils.js","names":[],"sources":["../../../src/server/utils/jwk-utils.ts"],"sourcesContent":["import { base64url } from './base64-utils.ts';\n\nexport interface GetJwkThumbprintOptions {\n  /** EC P-256 public JWK whose thumbprint to compute. */\n  publicKeyJwk: JsonWebKey;\n}\n\n/**\n * Computes the RFC 7638 JWK thumbprint of an EC P-256 public JWK.\n * Per §3.2 the canonical form contains only `crv`, `kty`, `x`, `y`,\n * sorted lexicographically — no whitespace, no other members. The\n * SHA-256 of this canonical UTF-8 JSON, base64url-encoded, is the\n * stable identifier (`jkt`) DPoP uses to bind tokens to public keys.\n */\nexport async function getJwkThumbprint(\n  options: GetJwkThumbprintOptions\n): Promise<string> {\n  const { publicKeyJwk } = options;\n  const canonical = JSON.stringify({\n    crv: publicKeyJwk.crv,\n    kty: publicKeyJwk.kty,\n    x: publicKeyJwk.x,\n    y: publicKeyJwk.y,\n  });\n  const digest = await crypto.subtle.digest(\n    'SHA-256',\n    new TextEncoder().encode(canonical)\n  );\n  return base64url(new Uint8Array(digest));\n}\n"],"mappings":";;;;;;;;;AAcA,eAAsB,iBACpB,SACiB;CACjB,MAAM,EAAE,iBAAiB;CACzB,MAAM,YAAY,KAAK,UAAU;EAC/B,KAAK,aAAa;EAClB,KAAK,aAAa;EAClB,GAAG,aAAa;EAChB,GAAG,aAAa;EACjB,CAAC;CACF,MAAM,SAAS,MAAM,OAAO,OAAO,OACjC,WACA,IAAI,aAAa,CAAC,OAAO,UAAU,CACpC;CACD,OAAO,UAAU,IAAI,WAAW,OAAO,CAAC"}

package/dist/server/utils/jwt-utils.d.ts

@@ -1,39 +0,0 @@
-//#region src/server/utils/jwt-utils.d.ts
-interface VerifyJwtOptions {
-  /** Compact-serialized JWT to verify. */
-  token: string;
-  /** Public key in JWK form. Caller is responsible for trusting it. */
-  publicKeyJwk: JsonWebKey;
-}
-/**
- * Verifies signature and (if present) `exp` (RFC 7519 §4.1.4) on a
- * JWT and returns its payload.
- *
- * @throws {Error} When the signature fails or when `exp` has passed.
- */
-declare function verifyJwt(options: VerifyJwtOptions): Promise<Record<string, unknown>>;
-interface SignJwtOptions {
-  /** ES256 private key as a non-extractable WebCrypto key. */
-  privateKey: CryptoKey;
-  /**
-   * Custom claims merged onto an `iat` claim (and `exp` when
-   * `ttlSeconds` is supplied). Caller-provided keys override the
-   * standard ones.
-   */
-  payload: Record<string, unknown>;
-  /**
-   * Lifetime of the token in seconds. When set, the JWT's `exp` claim
-   * is computed as `iat + ttlSeconds`. When omitted, no `exp` is added
-   * (the caller is responsible for one if needed).
-   */
-  ttlSeconds?: number;
-}
-/**
- * Signs a JWT (RFC 7519) with `alg=ES256, typ=JWT` and returns the
- * compact serialization. Always sets `iat` to the current second; the
- * caller controls every other claim via `payload`.
- */
-declare function signJwt(options: SignJwtOptions): Promise<string>;
-//#endregion
-export { signJwt, verifyJwt };
-//# sourceMappingURL=jwt-utils.d.ts.map