@hubspot/app-connect-sdk 1.0.0-alpha.4 → 1.0.0-alpha.5

package/dist/server/oauth.d.ts

@@ -1,128 +1,6 @@
-import { r as JwkSet } from "./types-5gfN91Fq.js";
-
-//#region src/server/utils/jwk-utils.d.ts
-interface GetJwkThumbprintOptions {
-  /** EC P-256 public JWK whose thumbprint to compute. */
-  publicKeyJwk: JsonWebKey;
-}
-/**
- * Computes the RFC 7638 JWK thumbprint of an EC P-256 public JWK.
- * Per §3.2 the canonical form contains only `crv`, `kty`, `x`, `y`,
- * sorted lexicographically — no whitespace, no other members. The
- * SHA-256 of this canonical UTF-8 JSON, base64url-encoded, is the
- * stable identifier (`jkt`) DPoP uses to bind tokens to public keys.
- */
-declare function getJwkThumbprint(options: GetJwkThumbprintOptions): Promise<string>;
-//#endregion
-//#region src/server/utils/dpop-utils.d.ts
-/**
- * Claims that go into a DPoP proof JWT (RFC 9449 §4.2). Extra
- * properties pass through to the encoder unchanged so callers can
- * include implementation-specific claims.
- */
-interface DpopClaims {
-  /** HTTP method of the protected request, uppercase. */
-  htm: string;
-  /** Target URI of the protected request, fully-qualified. */
-  htu: string;
-  /** Unique proof identifier (RFC 9449 §4.2, recommended UUID). */
-  jti: string;
-  /** Issuance time, Unix epoch seconds. */
-  iat: number;
-  /**
-   * Hash of the access token presented alongside this proof, if any
-   * (RFC 9449 §4.2). Required for resource-server DPoP.
-   */
-  ath?: string;
-  /**
-   * App session ID hash. Custom HubSpot extension that lets the auth
-   * server bind tokens to the browser session that minted them.
-   */
-  sid?: string;
-  [key: string]: unknown;
-}
-/**
- * Result of a successful {@link verifyDpopProof} call.
- */
-interface VerifiedDpopProof {
-  /** Public JWK extracted from the proof's header. */
-  publicKeyJwk: JsonWebKey;
-  /** RFC 7638 JWK thumbprint of `publicKeyJwk`. */
-  jkt: string;
-  /** Decoded claims from the proof's payload. */
-  claims: DpopClaims;
-}
-interface VerifyDpopProofOptions {
-  /** The compact-serialized DPoP proof. */
-  proof: string;
-  /** Expected HTTP method (RFC 9449 `htm` claim). */
-  htm: string;
-  /** Expected request URI (RFC 9449 `htu` claim). */
-  htu: string;
-  /** Expected access-token hash (RFC 9449 `ath` claim). */
-  ath?: string;
-  /** Expected app-session-ID hash (`sid` claim). */
-  sid?: string;
-}
-/**
- * Verifies a DPoP proof JWT and returns the embedded public JWK,
- * its thumbprint, and the decoded claims.
- *
- * Enforces RFC 9449's required checks:
- *
- * - `typ=dpop+jwt`, `alg=ES256`, and a JWK in the header.
- * - Signature is valid against the embedded JWK.
- * - `htm`, `htu`, and (when supplied) `ath`/`sid` match.
- * - `iat` is within ±5 minutes of "now".
- *
- * @throws {Error} If any of the above checks fail.
- */
-declare function verifyDpopProof(options: VerifyDpopProofOptions): Promise<VerifiedDpopProof>;
-//#endregion
-//#region src/server/utils/jwt-utils.d.ts
-interface VerifyJwtOptions {
-  /** Compact-serialized JWT to verify. */
-  token: string;
-  /** Public key in JWK form. Caller is responsible for trusting it. */
-  publicKeyJwk: JsonWebKey;
-}
-/**
- * Verifies signature and (if present) `exp` (RFC 7519 §4.1.4) on a
- * JWT and returns its payload.
- *
- * @throws {Error} When the signature fails or when `exp` has passed.
- */
-declare function verifyJwt(options: VerifyJwtOptions): Promise<Record<string, unknown>>;
-interface SignJwtOptions {
-  /** ES256 private key as a non-extractable WebCrypto key. */
-  privateKey: CryptoKey;
-  /**
-   * Custom claims merged onto an `iat` claim (and `exp` when
-   * `ttlSeconds` is supplied). Caller-provided keys override the
-   * standard ones.
-   */
-  payload: Record<string, unknown>;
-  /**
-   * Lifetime of the token in seconds. When set, the JWT's `exp` claim
-   * is computed as `iat + ttlSeconds`. When omitted, no `exp` is added
-   * (the caller is responsible for one if needed).
-   */
-  ttlSeconds?: number;
-}
-/**
- * Signs a JWT (RFC 7519) with `alg=ES256, typ=JWT` and returns the
- * compact serialization. Always sets `iat` to the current second; the
- * caller controls every other claim via `payload`.
- */
-declare function signJwt(options: SignJwtOptions): Promise<string>;
-//#endregion
-//#region src/shared/encoding/sha256.d.ts
-/**
- * Hashes a UTF-8 string with SHA-256 and encodes the digest as
- * base64url. Used to compute DPoP `ath`/`sid` claims, JWK thumbprints
- * (RFC 7638), and PKCE code challenges.
- */
-declare function sha256base64url(input: string): Promise<string>;
-//#endregion
-export { type JwkSet, getJwkThumbprint, sha256base64url, signJwt, verifyDpopProof, verifyJwt };
-//# sourceMappingURL=oauth.d.ts.map
+import { JwkSet } from "./types.js";
+import { getJwkThumbprint } from "./utils/jwk-utils.js";
+import { verifyDpopProof } from "./utils/dpop-utils.js";
+import { signJwt, verifyJwt } from "./utils/jwt-utils.js";
+import { sha256base64url } from "./shared/encoding/sha256.js";
+export { type JwkSet, getJwkThumbprint, sha256base64url, signJwt, verifyDpopProof, verifyJwt };

package/dist/server/oauth.js

@@ -1,2 +1,5 @@
-import { a as verifyJwt, i as signJwt, o as getJwkThumbprint, r as verifyDpopProof, t as sha256base64url } from "./sha256-B7y8GBFB.js";
+import { getJwkThumbprint } from "./utils/jwk-utils.js";
+import { signJwt, verifyJwt } from "./utils/jwt-utils.js";
+import { verifyDpopProof } from "./utils/dpop-utils.js";
+import { sha256base64url } from "./shared/encoding/sha256.js";
 export { getJwkThumbprint, sha256base64url, signJwt, verifyDpopProof, verifyJwt };

package/dist/server/proxy.js

@@ -0,0 +1,68 @@
+import { signDpopProof } from "./utils/dpop-utils.js";
+import { sha256base64url } from "./shared/encoding/sha256.js";
+import { getHubSpotApiOrigin, isHubspotDpopEnabled } from "./utils/env-utils.js";
+import { noopLogger } from "./shared/logger.js";
+//#region src/server/proxy.ts
+const hubSpotApiOrigin = getHubSpotApiOrigin();
+const notAuthenticated = {
+	authenticated: false,
+	fetch: async () => {
+		return new Response(null, {
+			status: 401,
+			statusText: "Unauthorized",
+			headers: { "Content-Type": "application/json" }
+		});
+	}
+};
+const EMPTY_HEADERS = {};
+function createHubSpotProxy(options) {
+	const { userCredentials, appKeys, logger = noopLogger } = options;
+	if (isHubspotDpopEnabled() && appKeys === null) throw new Error("createHubSpotProxy: appKeys is required when HUBSPOT_DPOP_ENABLED is true");
+	const { accessToken, sessionId } = userCredentials;
+	if (!accessToken || !sessionId) {
+		logger.debug("createHubSpotProxy: returning unauthenticated proxy (missing cookies)");
+		return notAuthenticated;
+	}
+	async function proxyFetch(request) {
+		const { path, method = "GET", headers = EMPTY_HEADERS, body } = request;
+		const targetUrl = `${hubSpotApiOrigin}${path}`;
+		const useDpop = isHubspotDpopEnabled();
+		let authorizationHeaders;
+		if (useDpop) {
+			const ath = await sha256base64url(accessToken);
+			const sid = await sha256base64url(sessionId);
+			const dpopProof = await signDpopProof({
+				appKeys,
+				claims: {
+					htm: method,
+					htu: targetUrl,
+					jti: crypto.randomUUID(),
+					iat: Math.floor(Date.now() / 1e3),
+					ath,
+					sid
+				}
+			});
+			authorizationHeaders = {
+				Authorization: `DPoP ${accessToken}`,
+				DPoP: dpopProof
+			};
+		} else authorizationHeaders = { Authorization: `Bearer ${accessToken}` };
+		const requestInit = {
+			headers: {
+				...headers,
+				...authorizationHeaders
+			},
+			method
+		};
+		if (body != null) requestInit.body = body;
+		return fetch(targetUrl, requestInit);
+	}
+	return {
+		authenticated: true,
+		fetch: proxyFetch
+	};
+}
+//#endregion
+export { createHubSpotProxy };
+
+//# sourceMappingURL=proxy.js.map

package/dist/server/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","names":[],"sources":["../../src/server/proxy.ts"],"sourcesContent":["import { noopLogger, type Logger } from '../shared/logger.ts';\nimport {\n  type AppKeys,\n  type HubSpotProxy,\n  type HubSpotProxyRequest,\n  type UserCredentials,\n} from './types.ts';\nimport { sha256base64url } from './utils/crypto-utils.ts';\nimport { signDpopProof } from './utils/dpop-utils.ts';\nimport { getHubSpotApiOrigin, isHubspotDpopEnabled } from './utils/env-utils.ts';\n\nconst hubSpotApiOrigin = getHubSpotApiOrigin();\n\n/**\n * Options accepted by {@link createHubSpotProxy}.\n */\nexport interface CreateHubSpotProxyOptions {\n  /**\n   * User session context from the incoming browser request.\n   */\n  userCredentials: UserCredentials;\n\n  /**\n   * Imported app keys from `secureStart`, or `null` when CIMD and DPoP\n   * are both disabled.\n   */\n  appKeys: AppKeys | null;\n  /** Optional logger. Defaults to a no-op logger. */\n  logger?: Logger;\n}\n\nconst notAuthenticated: HubSpotProxy = {\n  authenticated: false,\n  fetch: async (): Promise<Response> => {\n    return new Response(null, {\n      status: 401,\n      statusText: 'Unauthorized',\n      headers: {\n        'Content-Type': 'application/json',\n      },\n    });\n  },\n};\n\nconst EMPTY_HEADERS = {};\n\nexport function createHubSpotProxy(\n  options: CreateHubSpotProxyOptions\n): HubSpotProxy {\n  const { userCredentials, appKeys, logger = noopLogger } = options;\n\n  if (isHubspotDpopEnabled() && appKeys === null) {\n    throw new Error(\n      'createHubSpotProxy: appKeys is required when HUBSPOT_DPOP_ENABLED is true'\n    );\n  }\n\n  const { accessToken, sessionId } = userCredentials;\n\n  if (!accessToken || !sessionId) {\n    logger.debug(\n      'createHubSpotProxy: returning unauthenticated proxy (missing cookies)'\n    );\n    return notAuthenticated;\n  }\n\n  async function proxyFetch(request: HubSpotProxyRequest): Promise<Response> {\n    const { path, method = 'GET', headers = EMPTY_HEADERS, body } = request;\n\n    const targetUrl = `${hubSpotApiOrigin}${path}`;\n    const useDpop = isHubspotDpopEnabled();\n\n    let authorizationHeaders: Record<string, string>;\n    if (useDpop) {\n      const ath = await sha256base64url(accessToken!);\n      const sid = await sha256base64url(sessionId!);\n      const dpopProof = await signDpopProof({\n        appKeys: appKeys!,\n        claims: {\n          htm: method,\n          htu: targetUrl,\n          jti: crypto.randomUUID(),\n          iat: Math.floor(Date.now() / 1000),\n          ath,\n          sid,\n        },\n      });\n      authorizationHeaders = {\n        Authorization: `DPoP ${accessToken}`,\n        DPoP: dpopProof,\n      };\n    } else {\n      authorizationHeaders = {\n        Authorization: `Bearer ${accessToken}`,\n      };\n    }\n\n    const finalHeaders = { ...headers, ...authorizationHeaders };\n\n    const requestInit: RequestInit = {\n      headers: finalHeaders,\n      method,\n    };\n\n    if (body != null) {\n      requestInit.body = body;\n    }\n\n    return fetch(targetUrl, requestInit);\n  }\n\n  return {\n    authenticated: true,\n    fetch: proxyFetch,\n  };\n}\n"],"mappings":";;;;;AAWA,MAAM,mBAAmB,qBAAqB;AAoB9C,MAAM,mBAAiC;CACrC,eAAe;CACf,OAAO,YAA+B;EACpC,OAAO,IAAI,SAAS,MAAM;GACxB,QAAQ;GACR,YAAY;GACZ,SAAS,EACP,gBAAgB,oBACjB;GACF,CAAC;;CAEL;AAED,MAAM,gBAAgB,EAAE;AAExB,SAAgB,mBACd,SACc;CACd,MAAM,EAAE,iBAAiB,SAAS,SAAS,eAAe;CAE1D,IAAI,sBAAsB,IAAI,YAAY,MACxC,MAAM,IAAI,MACR,4EACD;CAGH,MAAM,EAAE,aAAa,cAAc;CAEnC,IAAI,CAAC,eAAe,CAAC,WAAW;EAC9B,OAAO,MACL,wEACD;EACD,OAAO;;CAGT,eAAe,WAAW,SAAiD;EACzE,MAAM,EAAE,MAAM,SAAS,OAAO,UAAU,eAAe,SAAS;EAEhE,MAAM,YAAY,GAAG,mBAAmB;EACxC,MAAM,UAAU,sBAAsB;EAEtC,IAAI;EACJ,IAAI,SAAS;GACX,MAAM,MAAM,MAAM,gBAAgB,YAAa;GAC/C,MAAM,MAAM,MAAM,gBAAgB,UAAW;GAC7C,MAAM,YAAY,MAAM,cAAc;IAC3B;IACT,QAAQ;KACN,KAAK;KACL,KAAK;KACL,KAAK,OAAO,YAAY;KACxB,KAAK,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;KAClC;KACA;KACD;IACF,CAAC;GACF,uBAAuB;IACrB,eAAe,QAAQ;IACvB,MAAM;IACP;SAED,uBAAuB,EACrB,eAAe,UAAU,eAC1B;EAKH,MAAM,cAA2B;GAC/B,SAAS;IAHY,GAAG;IAAS,GAAG;IAGf;GACrB;GACD;EAED,IAAI,QAAQ,MACV,YAAY,OAAO;EAGrB,OAAO,MAAM,WAAW,YAAY;;CAGtC,OAAO;EACL,eAAe;EACf,OAAO;EACR"}

package/dist/server/sanitize-request.js

@@ -0,0 +1,55 @@
+import { isProtectedCookieName } from "./constants.js";
+import { parseCookies } from "./utils/cookie-utils.js";
+//#region src/server/sanitize-request.ts
+function serializeCookies(cookies) {
+	const parts = [];
+	for (const [name, value] of cookies) parts.push(`${name}=${value}`);
+	return parts.join("; ");
+}
+/**
+* Mutates `headers` in place: parses the `Cookie` header, drops every
+* protected cookie (see {@link isProtectedCookieName}), and rewrites
+* the header. Deletes the header entirely when nothing survives.
+*
+* Used by the SDK's auth middleware after it has read the access
+* token / session ID, so user route handlers never see — and
+* therefore cannot leak — those cookies, while CORS / auth
+* middleware that ran first still got the raw values.
+*/
+function stripProtectedCookies(headers) {
+	const cookies = parseCookies(headers.get("Cookie"));
+	const surviving = /* @__PURE__ */ new Map();
+	for (const [name, value] of Object.entries(cookies)) if (!isProtectedCookieName(name)) surviving.set(name, value);
+	if (surviving.size === 0) headers.delete("cookie");
+	else headers.set("cookie", serializeCookies(surviving));
+}
+/**
+* Returns a clone of `original` whose `Cookie` header has every
+* protected cookie removed (see {@link isProtectedCookieName}). When
+* no other cookies remain, the header is dropped entirely.
+*
+* Standalone helper retained for callers that want a new Request
+* (e.g. tests). Inside the SDK's per-request handler, the auth
+* middleware uses {@link stripProtectedCookies} directly on
+* `c.req.raw.headers` so the auth check itself can still read the
+* protected cookies before they are stripped.
+*/
+function sanitizeRequest(original) {
+	const headers = new Headers(original.headers);
+	stripProtectedCookies(headers);
+	const init = {
+		method: original.method,
+		headers,
+		redirect: original.redirect,
+		signal: original.signal
+	};
+	if (original.body !== null) {
+		init.body = original.body;
+		init.duplex = "half";
+	}
+	return new Request(original.url, init);
+}
+//#endregion
+export { sanitizeRequest };
+
+//# sourceMappingURL=sanitize-request.js.map

package/dist/server/sanitize-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize-request.js","names":[],"sources":["../../src/server/sanitize-request.ts"],"sourcesContent":["import { isProtectedCookieName } from './constants.ts';\nimport { parseCookies } from './utils/cookie-utils.ts';\n\nfunction serializeCookies(cookies: Map<string, string>): string {\n  const parts: string[] = [];\n  for (const [name, value] of cookies) {\n    parts.push(`${name}=${value}`);\n  }\n  return parts.join('; ');\n}\n\n/**\n * Mutates `headers` in place: parses the `Cookie` header, drops every\n * protected cookie (see {@link isProtectedCookieName}), and rewrites\n * the header. Deletes the header entirely when nothing survives.\n *\n * Used by the SDK's auth middleware after it has read the access\n * token / session ID, so user route handlers never see — and\n * therefore cannot leak — those cookies, while CORS / auth\n * middleware that ran first still got the raw values.\n */\nexport function stripProtectedCookies(headers: Headers): void {\n  const cookies = parseCookies(headers.get('Cookie'));\n  const surviving = new Map<string, string>();\n  for (const [name, value] of Object.entries(cookies)) {\n    if (!isProtectedCookieName(name)) {\n      surviving.set(name, value);\n    }\n  }\n\n  if (surviving.size === 0) {\n    headers.delete('cookie');\n  } else {\n    headers.set('cookie', serializeCookies(surviving));\n  }\n}\n\n/**\n * Returns a clone of `original` whose `Cookie` header has every\n * protected cookie removed (see {@link isProtectedCookieName}). When\n * no other cookies remain, the header is dropped entirely.\n *\n * Standalone helper retained for callers that want a new Request\n * (e.g. tests). Inside the SDK's per-request handler, the auth\n * middleware uses {@link stripProtectedCookies} directly on\n * `c.req.raw.headers` so the auth check itself can still read the\n * protected cookies before they are stripped.\n */\nexport function sanitizeRequest(original: Request): Request {\n  const headers = new Headers(original.headers);\n  stripProtectedCookies(headers);\n\n  const init: RequestInit = {\n    method: original.method,\n    headers,\n    redirect: original.redirect,\n    signal: original.signal,\n  };\n\n  if (original.body !== null) {\n    init.body = original.body;\n    (init as RequestInit & { duplex: 'half' }).duplex = 'half';\n  }\n\n  return new Request(original.url, init);\n}\n"],"mappings":";;;AAGA,SAAS,iBAAiB,SAAsC;CAC9D,MAAM,QAAkB,EAAE;CAC1B,KAAK,MAAM,CAAC,MAAM,UAAU,SAC1B,MAAM,KAAK,GAAG,KAAK,GAAG,QAAQ;CAEhC,OAAO,MAAM,KAAK,KAAK;;;;;;;;;;;;AAazB,SAAgB,sBAAsB,SAAwB;CAC5D,MAAM,UAAU,aAAa,QAAQ,IAAI,SAAS,CAAC;CACnD,MAAM,4BAAY,IAAI,KAAqB;CAC3C,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,QAAQ,EACjD,IAAI,CAAC,sBAAsB,KAAK,EAC9B,UAAU,IAAI,MAAM,MAAM;CAI9B,IAAI,UAAU,SAAS,GACrB,QAAQ,OAAO,SAAS;MAExB,QAAQ,IAAI,UAAU,iBAAiB,UAAU,CAAC;;;;;;;;;;;;;AAetD,SAAgB,gBAAgB,UAA4B;CAC1D,MAAM,UAAU,IAAI,QAAQ,SAAS,QAAQ;CAC7C,sBAAsB,QAAQ;CAE9B,MAAM,OAAoB;EACxB,QAAQ,SAAS;EACjB;EACA,UAAU,SAAS;EACnB,QAAQ,SAAS;EAClB;CAED,IAAI,SAAS,SAAS,MAAM;EAC1B,KAAK,OAAO,SAAS;EACrB,KAA2C,SAAS;;CAGtD,OAAO,IAAI,QAAQ,SAAS,KAAK,KAAK"}

package/dist/server/secure-start-core.d.ts

@@ -0,0 +1,23 @@
+import { AppKeys } from "./types.js";
+
+//#region src/server/secure-start-core.d.ts
+/**
+ * Context passed to a function-style entrypoint loaded by `runSecureStart`.
+ * Contains imported `AppKeys` when CIMD or DPoP is enabled; otherwise
+ * `null` (traditional OAuth with `client_secret` and Bearer API calls).
+ */
+interface SecureStartContext {
+  appKeys: AppKeys | null;
+}
+interface SecureEntryPointExports {
+  start: (context: SecureStartContext) => Promise<void>;
+}
+/**
+ * Loader returned to `runSecureStart` that produces the entrypoint
+ * module. Always pass an `() => import('...')` arrow so the bundler
+ * preserves dynamic-import semantics.
+ */
+type SecureStartLoader = () => Promise<SecureEntryPointExports>;
+//#endregion
+export { SecureStartContext, SecureStartLoader };
+//# sourceMappingURL=secure-start-core.d.ts.map

package/dist/server/secure-start-core.js

@@ -0,0 +1,27 @@
+import { importAppKeys } from "./import-app-keys.js";
+import { HUBSPOT_APP_PRIVATE_KEY_ENV, isHubspotAppPrivateKeyRequired } from "./utils/env-utils.js";
+//#region src/server/secure-start-core.ts
+/**
+* Loads `HUBSPOT_APP_PRIVATE_KEY` when CIMD or DPoP is enabled, deletes
+* it from the environment so later code cannot re-read it, imports the
+* entrypoint module via `loader`, and invokes `start` with `AppKeys` or
+* `null` when both features are off. On failure, logs the error and
+* exits with code 1.
+*/
+async function runSecureStart(loader, adapter) {
+	let appKeys = null;
+	if (isHubspotAppPrivateKeyRequired()) {
+		const envKey = adapter.readEnv(HUBSPOT_APP_PRIVATE_KEY_ENV)?.trim();
+		if (!envKey) throw new Error(`${HUBSPOT_APP_PRIVATE_KEY_ENV} is not set`);
+		appKeys = await importAppKeys(envKey);
+		adapter.deleteEnv(HUBSPOT_APP_PRIVATE_KEY_ENV);
+	}
+	return (await loader()).start({ appKeys }).catch((error) => {
+		console.error(error);
+		return adapter.exit(1);
+	});
+}
+//#endregion
+export { runSecureStart };
+
+//# sourceMappingURL=secure-start-core.js.map

package/dist/server/secure-start-core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-start-core.js","names":[],"sources":["../../src/server/secure-start-core.ts"],"sourcesContent":["import { importAppKeys } from './import-app-keys.ts';\nimport type { AppKeys } from './types.ts';\nimport {\n  HUBSPOT_APP_PRIVATE_KEY_ENV,\n  isHubspotAppPrivateKeyRequired,\n} from './utils/env-utils.ts';\n\n/**\n * Context passed to a function-style entrypoint loaded by `runSecureStart`.\n * Contains imported `AppKeys` when CIMD or DPoP is enabled; otherwise\n * `null` (traditional OAuth with `client_secret` and Bearer API calls).\n */\nexport interface SecureStartContext {\n  appKeys: AppKeys | null;\n}\n\ninterface SecureEntryPointExports {\n  start: (context: SecureStartContext) => Promise<void>;\n}\n\n/**\n * Loader returned to `runSecureStart` that produces the entrypoint\n * module. Always pass an `() => import('...')` arrow so the bundler\n * preserves dynamic-import semantics.\n */\nexport type SecureStartLoader = () => Promise<SecureEntryPointExports>;\n\n/**\n * Platform adapters injected by the runtime-specific shim\n * (`node/start.ts` or `deno/start.ts`). Keeping the env/exit/delete\n * functions out of the core lets the shared logic stay platform-free.\n */\nexport interface SecureStartAdapter {\n  /** Reads the named env var, or returns `undefined` when unset. */\n  readEnv: (key: string) => string | undefined;\n  /** Removes the named env var so child processes cannot read it. */\n  deleteEnv: (key: string) => void;\n  /** Terminates the process with the given exit code. */\n  exit: (code: number) => never;\n}\n\n/**\n * Loads `HUBSPOT_APP_PRIVATE_KEY` when CIMD or DPoP is enabled, deletes\n * it from the environment so later code cannot re-read it, imports the\n * entrypoint module via `loader`, and invokes `start` with `AppKeys` or\n * `null` when both features are off. On failure, logs the error and\n * exits with code 1.\n */\nexport async function runSecureStart(\n  loader: SecureStartLoader,\n  adapter: SecureStartAdapter\n): Promise<void> {\n  let appKeys: AppKeys | null = null;\n  if (isHubspotAppPrivateKeyRequired()) {\n    const envKey = adapter.readEnv(HUBSPOT_APP_PRIVATE_KEY_ENV)?.trim();\n    if (!envKey) {\n      throw new Error(`${HUBSPOT_APP_PRIVATE_KEY_ENV} is not set`);\n    }\n    appKeys = await importAppKeys(envKey);\n    adapter.deleteEnv(HUBSPOT_APP_PRIVATE_KEY_ENV);\n  }\n\n  const exports = await loader();\n  return exports.start({ appKeys }).catch((error) => {\n    console.error(error);\n    return adapter.exit(1);\n  });\n}\n"],"mappings":";;;;;;;;;;AAgDA,eAAsB,eACpB,QACA,SACe;CACf,IAAI,UAA0B;CAC9B,IAAI,gCAAgC,EAAE;EACpC,MAAM,SAAS,QAAQ,QAAQ,4BAA4B,EAAE,MAAM;EACnE,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,GAAG,4BAA4B,aAAa;EAE9D,UAAU,MAAM,cAAc,OAAO;EACrC,QAAQ,UAAU,4BAA4B;;CAIhD,QAAO,MADe,QAAQ,EACf,MAAM,EAAE,SAAS,CAAC,CAAC,OAAO,UAAU;EACjD,QAAQ,MAAM,MAAM;EACpB,OAAO,QAAQ,KAAK,EAAE;GACtB"}

package/dist/server/shared/constants.js

@@ -0,0 +1,30 @@
+//#region src/shared/constants.ts
+/**
+* Path the browser visits after HubSpot's authorize endpoint
+* redirects back to the app. Mounted on the **frontend** origin (not
+* the SDK's edge function host) so all OAuth-related cookies live in
+* the `(frontend, edge)` CHIPS partition.
+*
+* The SDK's `auth/init-session` builds the OAuth `redirect_uri` as
+* `${requestOrigin}${HUBSPOT_FRONTEND_CALLBACK_PATH}`. The browser
+* controller, on `start()`, recognizes this path on `window.location`
+* and forwards `?code` + `?state` to the SDK's `auth/complete`
+* endpoint via a credentialed cross-site fetch. The host app must
+* register `${app_origin}${HUBSPOT_FRONTEND_CALLBACK_PATH}` as a
+* redirect URI in its HubSpot app settings.
+*/
+const HUBSPOT_FRONTEND_CALLBACK_PATH = "/__hubspot_oauth_callback";
+/**
+* Query parameter on the `auth/complete` POST request carrying the
+* authorization `code` HubSpot returned to the frontend callback.
+*/
+const AUTH_COMPLETE_CODE_PARAM = "code";
+/**
+* Query parameter on the `auth/complete` POST request carrying the
+* OAuth `state` HubSpot echoed back to the frontend callback.
+*/
+const AUTH_COMPLETE_STATE_PARAM = "state";
+//#endregion
+export { AUTH_COMPLETE_CODE_PARAM, AUTH_COMPLETE_STATE_PARAM, HUBSPOT_FRONTEND_CALLBACK_PATH };
+
+//# sourceMappingURL=constants.js.map

package/dist/server/shared/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","names":[],"sources":["../../../src/shared/constants.ts"],"sourcesContent":["/**\n * Constants whose values are part of the contract between the browser\n * controller and the server-side hubspot-connect routes. Both halves\n * import from this module so the wire format stays in sync.\n */\n\n/**\n * Query parameter on the OAuth return URL that carries the new access\n * token's expiry (Unix epoch milliseconds). The browser controller\n * sets this in the URL after a successful `auth/complete` call and\n * then strips it during `initAppConnect` via `history.replaceState`.\n */\nexport const EXPIRES_AT_URL_PARAM = '__hs_expires_at';\n\n/**\n * Path the browser visits after HubSpot's authorize endpoint\n * redirects back to the app. Mounted on the **frontend** origin (not\n * the SDK's edge function host) so all OAuth-related cookies live in\n * the `(frontend, edge)` CHIPS partition.\n *\n * The SDK's `auth/init-session` builds the OAuth `redirect_uri` as\n * `${requestOrigin}${HUBSPOT_FRONTEND_CALLBACK_PATH}`. The browser\n * controller, on `start()`, recognizes this path on `window.location`\n * and forwards `?code` + `?state` to the SDK's `auth/complete`\n * endpoint via a credentialed cross-site fetch. The host app must\n * register `${app_origin}${HUBSPOT_FRONTEND_CALLBACK_PATH}` as a\n * redirect URI in its HubSpot app settings.\n */\nexport const HUBSPOT_FRONTEND_CALLBACK_PATH = '/__hubspot_oauth_callback';\n\n/**\n * Query parameter on the `auth/complete` POST request carrying the\n * authorization `code` HubSpot returned to the frontend callback.\n */\nexport const AUTH_COMPLETE_CODE_PARAM = 'code';\n\n/**\n * Query parameter on the `auth/complete` POST request carrying the\n * OAuth `state` HubSpot echoed back to the frontend callback.\n */\nexport const AUTH_COMPLETE_STATE_PARAM = 'state';\n"],"mappings":";;;;;;;;;;;;;;;AA4BA,MAAa,iCAAiC;;;;;AAM9C,MAAa,2BAA2B;;;;;AAMxC,MAAa,4BAA4B"}

package/dist/server/shared/encoding/base64.js

@@ -0,0 +1,45 @@
+//#region src/shared/encoding/base64.ts
+/**
+* Base64url encoding and decoding helpers shared by the browser and
+* server halves of `@hubspot/app-connect-sdk`.
+*
+* Base64url (RFC 4648 §5) replaces `+`/`/` with `-`/`_` and drops `=`
+* padding. JWT, DPoP, and JWK thumbprints all use this variant.
+*/
+/**
+* Encodes a binary buffer as a base64url string (RFC 4648 §5).
+*/
+function base64url(input) {
+	const bytes = input instanceof Uint8Array ? input : new Uint8Array(input);
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+/**
+* Decodes a base64url string into a `Uint8Array`. Tolerates missing
+* padding by re-adding it before delegating to `atob`.
+*/
+function base64urlDecode(encoded) {
+	const padLen = (4 - encoded.length % 4) % 4;
+	const padded = encoded.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat(padLen);
+	const binary = atob(padded);
+	const out = new Uint8Array(new ArrayBuffer(binary.length));
+	for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i) ?? 0;
+	return out;
+}
+/**
+* Decodes a *standard* base64 string (with `+`/`/` and required `=`
+* padding) into an `ArrayBuffer`. Used for PKCS8-encoded private keys
+* stored in environment variables.
+*/
+function base64StandardToArrayBuffer(b64) {
+	const bin = atob(b64);
+	const buf = new ArrayBuffer(bin.length);
+	const view = new Uint8Array(buf);
+	for (let i = 0; i < bin.length; i++) view[i] = bin.charCodeAt(i) ?? 0;
+	return buf;
+}
+//#endregion
+export { base64StandardToArrayBuffer, base64url, base64urlDecode };
+
+//# sourceMappingURL=base64.js.map

package/dist/server/shared/encoding/base64.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64.js","names":[],"sources":["../../../../src/shared/encoding/base64.ts"],"sourcesContent":["/**\n * Base64url encoding and decoding helpers shared by the browser and\n * server halves of `@hubspot/app-connect-sdk`.\n *\n * Base64url (RFC 4648 §5) replaces `+`/`/` with `-`/`_` and drops `=`\n * padding. JWT, DPoP, and JWK thumbprints all use this variant.\n */\n\n/**\n * Encodes a binary buffer as a base64url string (RFC 4648 §5).\n */\nexport function base64url(input: ArrayBuffer | Uint8Array): string {\n  const bytes = input instanceof Uint8Array ? input : new Uint8Array(input);\n  let binary = '';\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n}\n\n/**\n * Decodes a base64url string into a `Uint8Array`. Tolerates missing\n * padding by re-adding it before delegating to `atob`.\n */\nexport function base64urlDecode(encoded: string): Uint8Array<ArrayBuffer> {\n  const padLen = (4 - (encoded.length % 4)) % 4;\n  const padded =\n    encoded.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat(padLen);\n  const binary = atob(padded);\n  const out = new Uint8Array(new ArrayBuffer(binary.length));\n  for (let i = 0; i < binary.length; i++) {\n    out[i] = binary.charCodeAt(i) ?? 0;\n  }\n  return out;\n}\n\n/**\n * Decodes a *standard* base64 string (with `+`/`/` and required `=`\n * padding) into an `ArrayBuffer`. Used for PKCS8-encoded private keys\n * stored in environment variables.\n */\nexport function base64StandardToArrayBuffer(b64: string): ArrayBuffer {\n  const bin = atob(b64);\n  const buf = new ArrayBuffer(bin.length);\n  const view = new Uint8Array(buf);\n  for (let i = 0; i < bin.length; i++) {\n    view[i] = bin.charCodeAt(i) ?? 0;\n  }\n  return buf;\n}\n"],"mappings":";;;;;;;;;;;AAWA,SAAgB,UAAU,OAAyC;CACjE,MAAM,QAAQ,iBAAiB,aAAa,QAAQ,IAAI,WAAW,MAAM;CACzE,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OACjB,UAAU,OAAO,aAAa,KAAK;CAErC,OAAO,KAAK,OAAO,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,MAAM,GAAG;;;;;;AAO/E,SAAgB,gBAAgB,SAA0C;CACxE,MAAM,UAAU,IAAK,QAAQ,SAAS,KAAM;CAC5C,MAAM,SACJ,QAAQ,QAAQ,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI,GAAG,IAAI,OAAO,OAAO;CACpE,MAAM,SAAS,KAAK,OAAO;CAC3B,MAAM,MAAM,IAAI,WAAW,IAAI,YAAY,OAAO,OAAO,CAAC;CAC1D,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KACjC,IAAI,KAAK,OAAO,WAAW,EAAE,IAAI;CAEnC,OAAO;;;;;;;AAQT,SAAgB,4BAA4B,KAA0B;CACpE,MAAM,MAAM,KAAK,IAAI;CACrB,MAAM,MAAM,IAAI,YAAY,IAAI,OAAO;CACvC,MAAM,OAAO,IAAI,WAAW,IAAI;CAChC,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAC9B,KAAK,KAAK,IAAI,WAAW,EAAE,IAAI;CAEjC,OAAO"}

package/dist/server/shared/encoding/sha256.d.ts

@@ -0,0 +1,10 @@
+//#region src/shared/encoding/sha256.d.ts
+/**
+ * Hashes a UTF-8 string with SHA-256 and encodes the digest as
+ * base64url. Used to compute DPoP `ath`/`sid` claims, JWK thumbprints
+ * (RFC 7638), and PKCE code challenges.
+ */
+declare function sha256base64url(input: string): Promise<string>;
+//#endregion
+export { sha256base64url };
+//# sourceMappingURL=sha256.d.ts.map

package/dist/server/shared/encoding/sha256.js

@@ -0,0 +1,15 @@
+import { base64url } from "./base64.js";
+//#region src/shared/encoding/sha256.ts
+/**
+* Hashes a UTF-8 string with SHA-256 and encodes the digest as
+* base64url. Used to compute DPoP `ath`/`sid` claims, JWK thumbprints
+* (RFC 7638), and PKCE code challenges.
+*/
+async function sha256base64url(input) {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
+	return base64url(new Uint8Array(digest));
+}
+//#endregion
+export { sha256base64url };
+
+//# sourceMappingURL=sha256.js.map

package/dist/server/shared/encoding/sha256.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sha256.js","names":[],"sources":["../../../../src/shared/encoding/sha256.ts"],"sourcesContent":["import { base64url } from './base64.ts';\n\n/**\n * Hashes a UTF-8 string with SHA-256 and encodes the digest as\n * base64url. Used to compute DPoP `ath`/`sid` claims, JWK thumbprints\n * (RFC 7638), and PKCE code challenges.\n */\nexport async function sha256base64url(input: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\n    'SHA-256',\n    new TextEncoder().encode(input)\n  );\n  return base64url(new Uint8Array(digest));\n}\n"],"mappings":";;;;;;;AAOA,eAAsB,gBAAgB,OAAgC;CACpE,MAAM,SAAS,MAAM,OAAO,OAAO,OACjC,WACA,IAAI,aAAa,CAAC,OAAO,MAAM,CAChC;CACD,OAAO,UAAU,IAAI,WAAW,OAAO,CAAC"}

package/dist/server/shared/logger.d.ts

@@ -0,0 +1,15 @@
+//#region src/shared/logger.d.ts
+/**
+ * Pluggable logger contract used by the SDK on both the browser and
+ * server. Consumers can pass `console`-like loggers, structured
+ * loggers (pino / winston / etc.) or no-op stubs in tests.
+ */
+interface Logger {
+  debug: (message: string, ...args: unknown[]) => void;
+  info: (message: string, ...args: unknown[]) => void;
+  warn: (message: string, ...args: unknown[]) => void;
+  error: (message: string, ...args: unknown[]) => void;
+}
+//#endregion
+export { Logger };
+//# sourceMappingURL=logger.d.ts.map

package/dist/server/shared/logger.js

@@ -0,0 +1,16 @@
+//#region src/shared/logger.ts
+/**
+* Logger that swallows every message. Convenient for tests and for
+* the SDK's server-side handlers when no logger is provided by the
+* host application.
+*/
+const noopLogger = {
+	debug: () => {},
+	info: () => {},
+	warn: () => {},
+	error: () => {}
+};
+//#endregion
+export { noopLogger };
+
+//# sourceMappingURL=logger.js.map

package/dist/server/shared/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","names":[],"sources":["../../../src/shared/logger.ts"],"sourcesContent":["/**\n * Pluggable logger contract used by the SDK on both the browser and\n * server. Consumers can pass `console`-like loggers, structured\n * loggers (pino / winston / etc.) or no-op stubs in tests.\n */\nexport interface Logger {\n  debug: (message: string, ...args: unknown[]) => void;\n  info: (message: string, ...args: unknown[]) => void;\n  warn: (message: string, ...args: unknown[]) => void;\n  error: (message: string, ...args: unknown[]) => void;\n}\n\nfunction formatPrefix(name: string): string {\n  return `[${name}]`;\n}\n\n/**\n * Creates a console-backed logger that prefixes every line with the\n * supplied `name`. Used as the default when no custom logger is\n * provided.\n */\nexport function createLogger(name: string): Logger {\n  const prefix = formatPrefix(name);\n  return {\n    debug: (message, ...args) => {\n      console.debug(prefix, message, ...args);\n    },\n    info: (message, ...args) => {\n      console.info(prefix, message, ...args);\n    },\n    warn: (message, ...args) => {\n      console.warn(prefix, message, ...args);\n    },\n    error: (message, ...args) => {\n      console.error(prefix, message, ...args);\n    },\n  };\n}\n\n/**\n * Logger that swallows every message. Convenient for tests and for\n * the SDK's server-side handlers when no logger is provided by the\n * host application.\n */\nexport const noopLogger: Logger = {\n  debug: () => {},\n  info: () => {},\n  warn: () => {},\n  error: () => {},\n};\n"],"mappings":";;;;;;AA4CA,MAAa,aAAqB;CAChC,aAAa;CACb,YAAY;CACZ,YAAY;CACZ,aAAa;CACd"}

package/dist/server/{types-5gfN91Fq.d.ts → types.d.ts}

@@ -21,8 +21,8 @@ interface HubSpotProxyRequest {
   method?: string;
   /**
    * Extra request headers. The proxy adds `Authorization` itself
-   * (`DPoP` access token plus `DPoP` proof when `HUBSPOT_DPOP_ENABLED` is
-   * not `"false"` and `appKeys` is non-null; otherwise `Bearer` only).
+   * (`DPoP` access token plus `DPoP` proof when DPoP is enabled and
+   * `appKeys` is non-null; otherwise `Bearer` only).
    */
   headers?: Record<string, string>;
   /** Optional request body. Pass `null`/`undefined` for empty bodies. */
@@ -52,5 +52,5 @@ interface JwkSet {
   keys: JsonWebKey[];
 }
 //#endregion
-export { HubSpotProxy as n, JwkSet as r, AppKeys as t };
-//# sourceMappingURL=types-5gfN91Fq.d.ts.map
+export { AppKeys, HubSpotProxy, JwkSet };
+//# sourceMappingURL=types.d.ts.map

package/dist/server/utils/cookie-utils.js

@@ -0,0 +1,21 @@
+//#region src/server/utils/cookie-utils.ts
+/**
+* Parses an HTTP `Cookie` request header into a `name -> value` map.
+* Tolerates leading/trailing whitespace, missing `=` (treats the
+* cookie value as empty), and duplicate names (last write wins).
+*
+* Returns an empty object when `cookieHeader` is `null`/`undefined`
+* /empty so callers don't have to null-check the input.
+*/
+function parseCookies(cookieHeader) {
+	if (!cookieHeader) return {};
+	return Object.fromEntries(cookieHeader.split(";").map((pair) => {
+		const eqIdx = pair.indexOf("=");
+		if (eqIdx === -1) return [pair.trim(), ""];
+		return [pair.slice(0, eqIdx).trim(), pair.slice(eqIdx + 1).trim()];
+	}).filter(([name]) => name.length > 0));
+}
+//#endregion
+export { parseCookies };
+
+//# sourceMappingURL=cookie-utils.js.map

package/dist/server/utils/cookie-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-utils.js","names":[],"sources":["../../../src/server/utils/cookie-utils.ts"],"sourcesContent":["/**\n * Parses an HTTP `Cookie` request header into a `name -> value` map.\n * Tolerates leading/trailing whitespace, missing `=` (treats the\n * cookie value as empty), and duplicate names (last write wins).\n *\n * Returns an empty object when `cookieHeader` is `null`/`undefined`\n * /empty so callers don't have to null-check the input.\n */\nexport function parseCookies(\n  cookieHeader: string | null | undefined\n): Record<string, string> {\n  if (!cookieHeader) return {};\n  return Object.fromEntries(\n    cookieHeader\n      .split(';')\n      .map((pair) => {\n        const eqIdx = pair.indexOf('=');\n        if (eqIdx === -1) return [pair.trim(), ''] as [string, string];\n        return [pair.slice(0, eqIdx).trim(), pair.slice(eqIdx + 1).trim()] as [\n          string,\n          string,\n        ];\n      })\n      .filter(([name]) => name.length > 0)\n  );\n}\n"],"mappings":";;;;;;;;;AAQA,SAAgB,aACd,cACwB;CACxB,IAAI,CAAC,cAAc,OAAO,EAAE;CAC5B,OAAO,OAAO,YACZ,aACG,MAAM,IAAI,CACV,KAAK,SAAS;EACb,MAAM,QAAQ,KAAK,QAAQ,IAAI;EAC/B,IAAI,UAAU,IAAI,OAAO,CAAC,KAAK,MAAM,EAAE,GAAG;EAC1C,OAAO,CAAC,KAAK,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,MAAM,QAAQ,EAAE,CAAC,MAAM,CAAC;GAIlE,CACD,QAAQ,CAAC,UAAU,KAAK,SAAS,EAAE,CACvC"}

package/dist/server/utils/dpop-utils.d.ts

@@ -0,0 +1,67 @@
+//#region src/server/utils/dpop-utils.d.ts
+/**
+ * Claims that go into a DPoP proof JWT (RFC 9449 §4.2). Extra
+ * properties pass through to the encoder unchanged so callers can
+ * include implementation-specific claims.
+ */
+interface DpopClaims {
+  /** HTTP method of the protected request, uppercase. */
+  htm: string;
+  /** Target URI of the protected request, fully-qualified. */
+  htu: string;
+  /** Unique proof identifier (RFC 9449 §4.2, recommended UUID). */
+  jti: string;
+  /** Issuance time, Unix epoch seconds. */
+  iat: number;
+  /**
+   * Hash of the access token presented alongside this proof, if any
+   * (RFC 9449 §4.2). Required for resource-server DPoP.
+   */
+  ath?: string;
+  /**
+   * App session ID hash. Custom HubSpot extension that lets the auth
+   * server bind tokens to the browser session that minted them.
+   */
+  sid?: string;
+  [key: string]: unknown;
+}
+/**
+ * Result of a successful {@link verifyDpopProof} call.
+ */
+interface VerifiedDpopProof {
+  /** Public JWK extracted from the proof's header. */
+  publicKeyJwk: JsonWebKey;
+  /** RFC 7638 JWK thumbprint of `publicKeyJwk`. */
+  jkt: string;
+  /** Decoded claims from the proof's payload. */
+  claims: DpopClaims;
+}
+interface VerifyDpopProofOptions {
+  /** The compact-serialized DPoP proof. */
+  proof: string;
+  /** Expected HTTP method (RFC 9449 `htm` claim). */
+  htm: string;
+  /** Expected request URI (RFC 9449 `htu` claim). */
+  htu: string;
+  /** Expected access-token hash (RFC 9449 `ath` claim). */
+  ath?: string;
+  /** Expected app-session-ID hash (`sid` claim). */
+  sid?: string;
+}
+/**
+ * Verifies a DPoP proof JWT and returns the embedded public JWK,
+ * its thumbprint, and the decoded claims.
+ *
+ * Enforces RFC 9449's required checks:
+ *
+ * - `typ=dpop+jwt`, `alg=ES256`, and a JWK in the header.
+ * - Signature is valid against the embedded JWK.
+ * - `htm`, `htu`, and (when supplied) `ath`/`sid` match.
+ * - `iat` is within ±5 minutes of "now".
+ *
+ * @throws {Error} If any of the above checks fail.
+ */
+declare function verifyDpopProof(options: VerifyDpopProofOptions): Promise<VerifiedDpopProof>;
+//#endregion
+export { verifyDpopProof };
+//# sourceMappingURL=dpop-utils.d.ts.map