@hubspot/app-connect-sdk 1.0.0-alpha.4 → 1.0.0-alpha.7

package/dist/server/hono/index.js

@@ -0,0 +1,4 @@
+import "./hubspot-connect-routes/cimd-client-metadata-types.js";
+import "./hono-request-handler.js";
+import "./hubspot-connect-routes/hubspot-connect-routes.js";
+import "./hubspot-connect-routes/load-hubspot-connect-routes-env.js";

package/dist/server/hono/types.d.ts

@@ -0,0 +1,32 @@
+import { HubSpotClient } from "../api-client-core/types.js";
+import { HubSpotProxy } from "../types.js";
+
+//#region src/server/hono/types.d.ts
+interface AppConnectRequestContext {
+  /**
+   * HubSpot API proxy.
+   */
+  proxy: HubSpotProxy;
+  /**
+   * HubSpot API client.
+   */
+  client: HubSpotClient;
+  /**
+   * Whether the browser session is authenticated.
+   */
+  authenticated: boolean;
+}
+interface AppConnectHonoBindings {
+  hubSpot: AppConnectRequestContext;
+}
+/**
+ * Hono environment shape used by handlers running inside a hubspot-
+ * connect request handler. Exposes the per-request
+ * {@link AppConnectRequestContext} as `c.env.hubSpot`.
+ */
+interface AppConnectHonoEnv {
+  Bindings: AppConnectHonoBindings;
+}
+//#endregion
+export { AppConnectHonoEnv };
+//# sourceMappingURL=types.d.ts.map

package/dist/server/hono/utils/cookie-utils.js

@@ -0,0 +1,30 @@
+//#region src/server/hono/utils/cookie-utils.ts
+/**
+* Appends a `Set-Cookie` header to the response. Hono replaces single
+* headers by default, so this uses `{ append: true }` to emit multiple
+* cookies on the same response.
+*/
+function setResponseCookie(options) {
+	const { c, value } = options;
+	c.header("Set-Cookie", value, { append: true });
+}
+/**
+* Builds a `Set-Cookie` header value with HubSpot's default attributes
+* (HttpOnly, Secure, SameSite). Centralizes the serialization so all
+* cookies share the same policy.
+*/
+function serializeCookie(options) {
+	const { name, value, path, sameSite = "Strict", maxAge, secure = true, httpOnly = true, partitioned = false } = options;
+	const parts = [`${name}=${value}`];
+	if (httpOnly) parts.push("HttpOnly");
+	if (secure) parts.push("Secure");
+	parts.push(`SameSite=${sameSite}`);
+	parts.push(`Path=${path}`);
+	parts.push(`Max-Age=${maxAge}`);
+	if (partitioned) parts.push("Partitioned");
+	return parts.join("; ");
+}
+//#endregion
+export { serializeCookie, setResponseCookie };
+
+//# sourceMappingURL=cookie-utils.js.map

package/dist/server/hono/utils/cookie-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-utils.js","names":[],"sources":["../../../../src/server/hono/utils/cookie-utils.ts"],"sourcesContent":["import type { Context } from 'hono';\n\nexport interface SetResponseCookieOptions {\n  c: Context;\n  value: string;\n}\n\n/**\n * Appends a `Set-Cookie` header to the response. Hono replaces single\n * headers by default, so this uses `{ append: true }` to emit multiple\n * cookies on the same response.\n */\nexport function setResponseCookie(options: SetResponseCookieOptions): void {\n  const { c, value } = options;\n  c.header('Set-Cookie', value, { append: true });\n}\n\nexport interface SerializeCookieOptions {\n  name: string;\n  value: string;\n  /** `__Host-` prefix requires `Path=/` and is recommended for session cookies. */\n  path: string;\n  /**\n   * Defaults to `Strict`.\n   *\n   * - `Strict`: only sent on same-site requests. Default for self-hosted\n   *   same-origin deployments.\n   * - `Lax`: also sent on top-level cross-site GET navigations. Use for\n   *   short-lived OAuth temp cookies that need to survive a redirect.\n   * - `None`: sent on all cross-site requests; **requires `Secure=true`\n   *   and is typically combined with `Partitioned=true`** for the\n   *   cross-origin Lovable / Supabase deployment shape.\n   */\n  sameSite?: 'Strict' | 'Lax' | 'None';\n  /** Lifetime in seconds. `0` deletes the cookie. */\n  maxAge: number;\n  /** Defaults to `true`; only set `false` for tests or non-HTTPS dev hosts. */\n  secure?: boolean;\n  /** Defaults to `true`. */\n  httpOnly?: boolean;\n  /**\n   * When `true`, appends the `Partitioned` attribute (CHIPS — Cookies\n   * Having Independent Partitioned State). The browser then keys the\n   * cookie by `(top-level site, cookie host)` instead of by cookie\n   * host alone, which is required for the cross-origin SDK shape\n   * where the React app and the SDK's edge functions live on\n   * different sites and third-party cookies are blocked.\n   *\n   * Defaults to `false`. Browsers ignore `Partitioned` on cookies\n   * without `Secure=true` and reject it on cookies without\n   * `SameSite=None`.\n   */\n  partitioned?: boolean;\n}\n\n/**\n * Builds a `Set-Cookie` header value with HubSpot's default attributes\n * (HttpOnly, Secure, SameSite). Centralizes the serialization so all\n * cookies share the same policy.\n */\nexport function serializeCookie(options: SerializeCookieOptions): string {\n  const {\n    name,\n    value,\n    path,\n    sameSite = 'Strict',\n    maxAge,\n    secure = true,\n    httpOnly = true,\n    partitioned = false,\n  } = options;\n  const parts: string[] = [`${name}=${value}`];\n  if (httpOnly) parts.push('HttpOnly');\n  if (secure) parts.push('Secure');\n  parts.push(`SameSite=${sameSite}`);\n  parts.push(`Path=${path}`);\n  parts.push(`Max-Age=${maxAge}`);\n  if (partitioned) parts.push('Partitioned');\n  return parts.join('; ');\n}\n"],"mappings":";;;;;;AAYA,SAAgB,kBAAkB,SAAyC;CACzE,MAAM,EAAE,GAAG,UAAU;CACrB,EAAE,OAAO,cAAc,OAAO,EAAE,QAAQ,MAAM,CAAC;;;;;;;AA8CjD,SAAgB,gBAAgB,SAAyC;CACvE,MAAM,EACJ,MACA,OACA,MACA,WAAW,UACX,QACA,SAAS,MACT,WAAW,MACX,cAAc,UACZ;CACJ,MAAM,QAAkB,CAAC,GAAG,KAAK,GAAG,QAAQ;CAC5C,IAAI,UAAU,MAAM,KAAK,WAAW;CACpC,IAAI,QAAQ,MAAM,KAAK,SAAS;CAChC,MAAM,KAAK,YAAY,WAAW;CAClC,MAAM,KAAK,QAAQ,OAAO;CAC1B,MAAM,KAAK,WAAW,SAAS;CAC/B,IAAI,aAAa,MAAM,KAAK,cAAc;CAC1C,OAAO,MAAM,KAAK,KAAK"}

package/dist/server/hono/utils/cors-middleware.js

@@ -0,0 +1,85 @@
+import { HUBSPOT_APP_ORIGIN_COOKIE_NAME } from "../../constants.js";
+import { parseCookies } from "../../utils/cookie-utils.js";
+//#region src/server/hono/utils/cors-middleware.ts
+/**
+* Comma-separated list of request headers the SDK accepts on
+* cross-site fetches. Mirrors the Supabase Edge Functions defaults
+* the Lovable AI agent emits today, plus `content-type` for the
+* `auth/complete` POST body and `accept` so JSON content negotiation
+* works.
+*/
+const ALLOWED_HEADERS = [
+	"authorization",
+	"x-client-info",
+	"apikey",
+	"content-type",
+	"accept",
+	"x-supabase-client-platform",
+	"x-supabase-client-platform-version",
+	"x-supabase-client-runtime",
+	"x-supabase-client-runtime-version"
+].join(", ");
+const ALLOWED_METHODS = "GET, POST, OPTIONS";
+const PREFLIGHT_MAX_AGE_SECONDS = "600";
+/**
+* Reads the persisted app-origin cookie from the request, falling
+* back to the literal `Origin` request header. The cookie is the
+* authoritative pin once `auth/init-session` has run; on the very
+* first init-session call (no cookie yet) we just echo whatever
+* `Origin` the caller sent — the actual access decision is enforced
+* by cookie-based authentication on every other route, not by CORS.
+*/
+function resolveAllowedOrigin(c) {
+	const pinned = parseCookies(c.req.header("Cookie"))[HUBSPOT_APP_ORIGIN_COOKIE_NAME];
+	if (pinned) return pinned;
+	return c.req.header("Origin") ?? null;
+}
+function setSharedCorsHeaders(c, allowOrigin) {
+	c.res.headers.set("Access-Control-Allow-Origin", allowOrigin);
+	c.res.headers.set("Access-Control-Allow-Credentials", "true");
+	c.res.headers.set("Vary", "Origin, Cookie");
+}
+/**
+* Hono middleware that emits credentialed CORS response headers for
+* the cross-origin Lovable / Supabase deployment shape.
+*
+* - On `OPTIONS` preflight: short-circuits with a 204 carrying
+*   `Access-Control-Allow-*` headers. The browser will then send the
+*   real request with cookies attached.
+* - On every other method: echoes the pinned `__Host-hs_app_origin`
+*   cookie value (or, before init-session has run, the request
+*   `Origin` header) as `Access-Control-Allow-Origin`, with
+*   `Access-Control-Allow-Credentials: true`. The wildcard `*` is
+*   forbidden by browsers when credentials are included, so the
+*   middleware always echoes a concrete origin.
+*
+* Skips header emission entirely when the request has no `Origin`
+* (server-to-server calls, curl, etc.) so non-browser callers are
+* left untouched.
+*/
+function corsMiddleware() {
+	return async (c, next) => {
+		const allowOrigin = resolveAllowedOrigin(c);
+		if (c.req.method === "OPTIONS") {
+			const headers = new Headers();
+			if (allowOrigin) {
+				headers.set("Access-Control-Allow-Origin", allowOrigin);
+				headers.set("Access-Control-Allow-Credentials", "true");
+				headers.set("Vary", "Origin, Cookie");
+			}
+			headers.set("Access-Control-Allow-Methods", ALLOWED_METHODS);
+			headers.set("Access-Control-Allow-Headers", ALLOWED_HEADERS);
+			headers.set("Access-Control-Max-Age", PREFLIGHT_MAX_AGE_SECONDS);
+			return new Response(null, {
+				status: 204,
+				headers
+			});
+		}
+		await next();
+		if (allowOrigin) setSharedCorsHeaders(c, allowOrigin);
+	};
+}
+//#endregion
+export { corsMiddleware };
+
+//# sourceMappingURL=cors-middleware.js.map

package/dist/server/hono/utils/cors-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors-middleware.js","names":[],"sources":["../../../../src/server/hono/utils/cors-middleware.ts"],"sourcesContent":["import type { Context, MiddlewareHandler } from 'hono';\n\nimport { HUBSPOT_APP_ORIGIN_COOKIE_NAME } from '../../constants.ts';\nimport { parseCookies } from '../../utils/cookie-utils.ts';\n\n/**\n * Comma-separated list of request headers the SDK accepts on\n * cross-site fetches. Mirrors the Supabase Edge Functions defaults\n * the Lovable AI agent emits today, plus `content-type` for the\n * `auth/complete` POST body and `accept` so JSON content negotiation\n * works.\n */\nconst ALLOWED_HEADERS = [\n  'authorization',\n  'x-client-info',\n  'apikey',\n  'content-type',\n  'accept',\n  'x-supabase-client-platform',\n  'x-supabase-client-platform-version',\n  'x-supabase-client-runtime',\n  'x-supabase-client-runtime-version',\n].join(', ');\n\nconst ALLOWED_METHODS = 'GET, POST, OPTIONS';\n\nconst PREFLIGHT_MAX_AGE_SECONDS = '600';\n\n/**\n * Reads the persisted app-origin cookie from the request, falling\n * back to the literal `Origin` request header. The cookie is the\n * authoritative pin once `auth/init-session` has run; on the very\n * first init-session call (no cookie yet) we just echo whatever\n * `Origin` the caller sent — the actual access decision is enforced\n * by cookie-based authentication on every other route, not by CORS.\n */\nfunction resolveAllowedOrigin(c: Context): string | null {\n  const cookies = parseCookies(c.req.header('Cookie'));\n  const pinned = cookies[HUBSPOT_APP_ORIGIN_COOKIE_NAME];\n  if (pinned) return pinned;\n  return c.req.header('Origin') ?? null;\n}\n\nfunction setSharedCorsHeaders(c: Context, allowOrigin: string): void {\n  c.res.headers.set('Access-Control-Allow-Origin', allowOrigin);\n  c.res.headers.set('Access-Control-Allow-Credentials', 'true');\n  // `Origin` so caches differentiate per-caller responses; `Cookie`\n  // because the allowed origin is derived from the persisted\n  // `__Host-hs_app_origin` cookie.\n  c.res.headers.set('Vary', 'Origin, Cookie');\n}\n\n/**\n * Hono middleware that emits credentialed CORS response headers for\n * the cross-origin Lovable / Supabase deployment shape.\n *\n * - On `OPTIONS` preflight: short-circuits with a 204 carrying\n *   `Access-Control-Allow-*` headers. The browser will then send the\n *   real request with cookies attached.\n * - On every other method: echoes the pinned `__Host-hs_app_origin`\n *   cookie value (or, before init-session has run, the request\n *   `Origin` header) as `Access-Control-Allow-Origin`, with\n *   `Access-Control-Allow-Credentials: true`. The wildcard `*` is\n *   forbidden by browsers when credentials are included, so the\n *   middleware always echoes a concrete origin.\n *\n * Skips header emission entirely when the request has no `Origin`\n * (server-to-server calls, curl, etc.) so non-browser callers are\n * left untouched.\n */\nexport function corsMiddleware(): MiddlewareHandler {\n  return async (c, next) => {\n    const allowOrigin = resolveAllowedOrigin(c);\n\n    if (c.req.method === 'OPTIONS') {\n      const headers = new Headers();\n      if (allowOrigin) {\n        headers.set('Access-Control-Allow-Origin', allowOrigin);\n        headers.set('Access-Control-Allow-Credentials', 'true');\n        headers.set('Vary', 'Origin, Cookie');\n      }\n      headers.set('Access-Control-Allow-Methods', ALLOWED_METHODS);\n      headers.set('Access-Control-Allow-Headers', ALLOWED_HEADERS);\n      headers.set('Access-Control-Max-Age', PREFLIGHT_MAX_AGE_SECONDS);\n      return new Response(null, { status: 204, headers });\n    }\n\n    await next();\n\n    if (allowOrigin) {\n      setSharedCorsHeaders(c, allowOrigin);\n    }\n    return;\n  };\n}\n"],"mappings":";;;;;;;;;;AAYA,MAAM,kBAAkB;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC,KAAK,KAAK;AAEZ,MAAM,kBAAkB;AAExB,MAAM,4BAA4B;;;;;;;;;AAUlC,SAAS,qBAAqB,GAA2B;CAEvD,MAAM,SADU,aAAa,EAAE,IAAI,OAAO,SAAS,CAC7B,CAAC;CACvB,IAAI,QAAQ,OAAO;CACnB,OAAO,EAAE,IAAI,OAAO,SAAS,IAAI;;AAGnC,SAAS,qBAAqB,GAAY,aAA2B;CACnE,EAAE,IAAI,QAAQ,IAAI,+BAA+B,YAAY;CAC7D,EAAE,IAAI,QAAQ,IAAI,oCAAoC,OAAO;CAI7D,EAAE,IAAI,QAAQ,IAAI,QAAQ,iBAAiB;;;;;;;;;;;;;;;;;;;;AAqB7C,SAAgB,iBAAoC;CAClD,OAAO,OAAO,GAAG,SAAS;EACxB,MAAM,cAAc,qBAAqB,EAAE;EAE3C,IAAI,EAAE,IAAI,WAAW,WAAW;GAC9B,MAAM,UAAU,IAAI,SAAS;GAC7B,IAAI,aAAa;IACf,QAAQ,IAAI,+BAA+B,YAAY;IACvD,QAAQ,IAAI,oCAAoC,OAAO;IACvD,QAAQ,IAAI,QAAQ,iBAAiB;;GAEvC,QAAQ,IAAI,gCAAgC,gBAAgB;GAC5D,QAAQ,IAAI,gCAAgC,gBAAgB;GAC5D,QAAQ,IAAI,0BAA0B,0BAA0B;GAChE,OAAO,IAAI,SAAS,MAAM;IAAE,QAAQ;IAAK;IAAS,CAAC;;EAGrD,MAAM,MAAM;EAEZ,IAAI,aACF,qBAAqB,GAAG,YAAY"}

package/dist/server/import-app-keys.js

@@ -0,0 +1,42 @@
+import { base64StandardToArrayBuffer } from "./shared/encoding/base64.js";
+//#region src/server/import-app-keys.ts
+/**
+* Imports a base64-encoded PKCS8 ES256 private key into the
+* `AppKeys` shape used throughout the SDK.
+*
+* The function imports the key twice: once as **extractable** to
+* derive the public JWK (via `crypto.subtle.exportKey`), and once
+* as **non-extractable** so the long-lived `appPrivateKey` can never
+* be exfiltrated.
+*
+* @throws {Error} When `envKey` is empty/undefined or when the key
+*   isn't an EC P-256 keypair.
+*/
+async function importAppKeys(envKey) {
+	const b64 = envKey?.trim() ?? "";
+	if (!b64) throw new Error("HUBSPOT_APP_PRIVATE_KEY is not set");
+	const pkcs8 = base64StandardToArrayBuffer(b64);
+	const tempPrivateKey = await crypto.subtle.importKey("pkcs8", pkcs8, {
+		name: "ECDSA",
+		namedCurve: "P-256"
+	}, true, ["sign"]);
+	const privateJwk = await crypto.subtle.exportKey("jwk", tempPrivateKey);
+	if (privateJwk.kty !== "EC" || privateJwk.crv !== "P-256" || typeof privateJwk.x !== "string" || typeof privateJwk.y !== "string") throw new Error("Expected P-256 EC private key JWK with x and y");
+	const appPublicKeyJwk = {
+		kty: "EC",
+		crv: "P-256",
+		x: privateJwk.x,
+		y: privateJwk.y
+	};
+	return {
+		appPrivateKey: await crypto.subtle.importKey("pkcs8", pkcs8, {
+			name: "ECDSA",
+			namedCurve: "P-256"
+		}, false, ["sign"]),
+		appPublicKeyJwk
+	};
+}
+//#endregion
+export { importAppKeys };
+
+//# sourceMappingURL=import-app-keys.js.map

package/dist/server/import-app-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-app-keys.js","names":[],"sources":["../../src/server/import-app-keys.ts"],"sourcesContent":["import type { AppKeys } from './types.ts';\nimport { base64StandardToArrayBuffer } from './utils/base64-utils.ts';\n\n/**\n * Imports a base64-encoded PKCS8 ES256 private key into the\n * `AppKeys` shape used throughout the SDK.\n *\n * The function imports the key twice: once as **extractable** to\n * derive the public JWK (via `crypto.subtle.exportKey`), and once\n * as **non-extractable** so the long-lived `appPrivateKey` can never\n * be exfiltrated.\n *\n * @throws {Error} When `envKey` is empty/undefined or when the key\n *   isn't an EC P-256 keypair.\n */\nexport async function importAppKeys(\n  envKey: string | undefined\n): Promise<AppKeys> {\n  const b64 = envKey?.trim() ?? '';\n  if (!b64) {\n    throw new Error('HUBSPOT_APP_PRIVATE_KEY is not set');\n  }\n\n  const pkcs8 = base64StandardToArrayBuffer(b64);\n  const tempPrivateKey = await crypto.subtle.importKey(\n    'pkcs8',\n    pkcs8,\n    { name: 'ECDSA', namedCurve: 'P-256' },\n    true,\n    ['sign']\n  );\n  const privateJwk = await crypto.subtle.exportKey('jwk', tempPrivateKey);\n  if (\n    privateJwk.kty !== 'EC' ||\n    privateJwk.crv !== 'P-256' ||\n    typeof privateJwk.x !== 'string' ||\n    typeof privateJwk.y !== 'string'\n  ) {\n    throw new Error('Expected P-256 EC private key JWK with x and y');\n  }\n  const appPublicKeyJwk: JsonWebKey = {\n    kty: 'EC',\n    crv: 'P-256',\n    x: privateJwk.x,\n    y: privateJwk.y,\n  };\n  const appPrivateKey = await crypto.subtle.importKey(\n    'pkcs8',\n    pkcs8,\n    { name: 'ECDSA', namedCurve: 'P-256' },\n    false,\n    ['sign']\n  );\n  return { appPrivateKey, appPublicKeyJwk };\n}\n"],"mappings":";;;;;;;;;;;;;;AAeA,eAAsB,cACpB,QACkB;CAClB,MAAM,MAAM,QAAQ,MAAM,IAAI;CAC9B,IAAI,CAAC,KACH,MAAM,IAAI,MAAM,qCAAqC;CAGvD,MAAM,QAAQ,4BAA4B,IAAI;CAC9C,MAAM,iBAAiB,MAAM,OAAO,OAAO,UACzC,SACA,OACA;EAAE,MAAM;EAAS,YAAY;EAAS,EACtC,MACA,CAAC,OAAO,CACT;CACD,MAAM,aAAa,MAAM,OAAO,OAAO,UAAU,OAAO,eAAe;CACvE,IACE,WAAW,QAAQ,QACnB,WAAW,QAAQ,WACnB,OAAO,WAAW,MAAM,YACxB,OAAO,WAAW,MAAM,UAExB,MAAM,IAAI,MAAM,iDAAiD;CAEnE,MAAM,kBAA8B;EAClC,KAAK;EACL,KAAK;EACL,GAAG,WAAW;EACd,GAAG,WAAW;EACf;CAQD,OAAO;EAAE,eAAA,MAPmB,OAAO,OAAO,UACxC,SACA,OACA;GAAE,MAAM;GAAS,YAAY;GAAS,EACtC,OACA,CAAC,OAAO,CACT;EACuB;EAAiB"}

package/dist/server/lovable/create-app-function-start.d.ts

@@ -0,0 +1,26 @@
+import { SecureStartContext } from "../secure-start-core.js";
+import { Logger } from "../shared/logger.js";
+import { AppConnectHonoEnv } from "../hono/types.js";
+import { Hono } from "hono";
+
+//#region src/server/lovable/create-app-function-start.d.ts
+type RegisterAppFunctionRoutesFunction = (app: Hono<AppConnectHonoEnv>) => void;
+interface CreateAppFunctionStartOptions {
+  /** Base path the user's routes are mounted under (e.g. `/functions/v1/api`). */
+  basePath: string;
+  /** Attach app routes to the SDK-owned Hono instance. */
+  registerRoutes: RegisterAppFunctionRoutesFunction;
+  /** Optional logger forwarded to `createAppConnectRequestHandler`. */
+  logger?: Logger;
+}
+type AppFunctionStart = (context: SecureStartContext) => Promise<void>;
+/**
+ * Builds a Deno-style `start({ appKeys })` entry point that boots a
+ * Hono app under `basePath`, wires the SDK's per-request HubSpot
+ * proxy via `createAppConnectRequestHandler`, and serves it with
+ * `Deno.serve` on `PORT`.
+ */
+declare function createAppFunctionStart(options: CreateAppFunctionStartOptions): AppFunctionStart;
+//#endregion
+export { AppFunctionStart, CreateAppFunctionStartOptions, RegisterAppFunctionRoutesFunction, createAppFunctionStart };
+//# sourceMappingURL=create-app-function-start.d.ts.map

package/dist/server/lovable/create-app-function-start.js

@@ -0,0 +1,28 @@
+import { createAppConnectRequestHandler } from "../hono/hono-request-handler.js";
+//#region src/server/lovable/create-app-function-start.ts
+const PORT = Deno.env.get("PORT");
+const serveOptions = typeof PORT === "string" ? { port: parseInt(PORT, 10) } : {};
+/**
+* Builds a Deno-style `start({ appKeys })` entry point that boots a
+* Hono app under `basePath`, wires the SDK's per-request HubSpot
+* proxy via `createAppConnectRequestHandler`, and serves it with
+* `Deno.serve` on `PORT`.
+*/
+function createAppFunctionStart(options) {
+	const { basePath, registerRoutes, logger } = options;
+	return ({ appKeys }) => {
+		Deno.serve(serveOptions, createAppConnectRequestHandler({
+			appKeys,
+			...logger !== void 0 ? { logger } : {},
+			registerRoutes: (app) => {
+				registerRoutes(app.basePath(basePath));
+			}
+		}));
+		console.log(`[app-function ${basePath}] Listening on http://localhost:${PORT}`);
+		return Promise.resolve();
+	};
+}
+//#endregion
+export { createAppFunctionStart };
+
+//# sourceMappingURL=create-app-function-start.js.map

package/dist/server/lovable/create-app-function-start.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-app-function-start.js","names":[],"sources":["../../../src/server/lovable/create-app-function-start.ts"],"sourcesContent":["import type { Hono } from 'hono';\n\nimport type { Logger } from '../../shared/logger.ts';\nimport { createAppConnectRequestHandler } from '../hono/hono-request-handler.ts';\nimport type { AppConnectHonoEnv } from '../hono/types.ts';\nimport type { SecureStartContext } from '../secure-start-core.ts';\n\nconst PORT = Deno.env.get('PORT');\nconst serveOptions =\n  typeof PORT === 'string' ? { port: parseInt(PORT, 10) } : {};\n\nexport type RegisterAppFunctionRoutesFunction = (\n  app: Hono<AppConnectHonoEnv>\n) => void;\n\nexport interface CreateAppFunctionStartOptions {\n  /** Base path the user's routes are mounted under (e.g. `/functions/v1/api`). */\n  basePath: string;\n  /** Attach app routes to the SDK-owned Hono instance. */\n  registerRoutes: RegisterAppFunctionRoutesFunction;\n  /** Optional logger forwarded to `createAppConnectRequestHandler`. */\n  logger?: Logger;\n}\n\nexport type AppFunctionStart = (context: SecureStartContext) => Promise<void>;\n\n/**\n * Builds a Deno-style `start({ appKeys })` entry point that boots a\n * Hono app under `basePath`, wires the SDK's per-request HubSpot\n * proxy via `createAppConnectRequestHandler`, and serves it with\n * `Deno.serve` on `PORT`.\n */\nexport function createAppFunctionStart(\n  options: CreateAppFunctionStartOptions\n): AppFunctionStart {\n  const { basePath, registerRoutes, logger } = options;\n\n  return ({ appKeys }) => {\n    Deno.serve(\n      serveOptions,\n      createAppConnectRequestHandler({\n        appKeys,\n        ...(logger !== undefined ? { logger } : {}),\n        registerRoutes: (app) => {\n          registerRoutes(app.basePath(basePath));\n        },\n      })\n    );\n\n    console.log(\n      `[app-function ${basePath}] Listening on http://localhost:${PORT}`\n    );\n    return Promise.resolve();\n  };\n}\n"],"mappings":";;AAOA,MAAM,OAAO,KAAK,IAAI,IAAI,OAAO;AACjC,MAAM,eACJ,OAAO,SAAS,WAAW,EAAE,MAAM,SAAS,MAAM,GAAG,EAAE,GAAG,EAAE;;;;;;;AAuB9D,SAAgB,uBACd,SACkB;CAClB,MAAM,EAAE,UAAU,gBAAgB,WAAW;CAE7C,QAAQ,EAAE,cAAc;EACtB,KAAK,MACH,cACA,+BAA+B;GAC7B;GACA,GAAI,WAAW,KAAA,IAAY,EAAE,QAAQ,GAAG,EAAE;GAC1C,iBAAiB,QAAQ;IACvB,eAAe,IAAI,SAAS,SAAS,CAAC;;GAEzC,CAAC,CACH;EAED,QAAQ,IACN,iBAAiB,SAAS,kCAAkC,OAC7D;EACD,OAAO,QAAQ,SAAS"}

package/dist/server/lovable/hubspot-connect/index.d.ts

@@ -0,0 +1,15 @@
+import { HubSpotConnectCimdClientMetadata } from "../../hono/hubspot-connect-routes/cimd-client-metadata-types.js";
+
+//#region src/server/lovable/hubspot-connect/index.d.ts
+interface StartHubSpotConnectFunctionOptions {
+  client: HubSpotConnectCimdClientMetadata;
+}
+/**
+ * Lovable-style entry point for the hubspot-connect Deno function.
+ * Loads `HUBSPOT_APP_PRIVATE_KEY` via `secureStart`, then serves OAuth
+ * and CIMD routes under `/functions/v1/hubspot-connect`.
+ */
+declare function startHubSpotConnectFunction(options: StartHubSpotConnectFunctionOptions): Promise<void>;
+//#endregion
+export { StartHubSpotConnectFunctionOptions, startHubSpotConnectFunction };
+//# sourceMappingURL=index.d.ts.map

package/dist/server/lovable/hubspot-connect/index.js

@@ -0,0 +1,20 @@
+import { secureStart } from "../../deno/start.js";
+import { assertHubSpotConnectCimdClientMetadata } from "../../hono/hubspot-connect-routes/cimd-client-metadata-types.js";
+import { runHubSpotConnectLovableServer } from "./run-hubspot-connect-lovable-server.js";
+//#region src/server/lovable/hubspot-connect/index.ts
+/**
+* Lovable-style entry point for the hubspot-connect Deno function.
+* Loads `HUBSPOT_APP_PRIVATE_KEY` via `secureStart`, then serves OAuth
+* and CIMD routes under `/functions/v1/hubspot-connect`.
+*/
+async function startHubSpotConnectFunction(options) {
+	assertHubSpotConnectCimdClientMetadata(options.client);
+	await secureStart(async () => ({ start: (context) => runHubSpotConnectLovableServer({
+		...context,
+		cimdClientMetadata: options.client
+	}) }));
+}
+//#endregion
+export { startHubSpotConnectFunction };
+
+//# sourceMappingURL=index.js.map

package/dist/server/lovable/hubspot-connect/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../../../src/server/lovable/hubspot-connect/index.ts"],"sourcesContent":["import { secureStart } from '../../deno/start.ts';\nimport { assertHubSpotConnectCimdClientMetadata } from '../../hono/hubspot-connect-routes/cimd-client-metadata-types.ts';\nimport type { HubSpotConnectCimdClientMetadata } from '../../hono/hubspot-connect-routes/cimd-client-metadata-types.ts';\nimport { runHubSpotConnectLovableServer } from './run-hubspot-connect-lovable-server.ts';\n\nexport type { HubSpotConnectCimdClientMetadata } from '../../hono/hubspot-connect-routes/cimd-client-metadata-types.ts';\n\nexport interface StartHubSpotConnectFunctionOptions {\n  client: HubSpotConnectCimdClientMetadata;\n}\n\n/**\n * Lovable-style entry point for the hubspot-connect Deno function.\n * Loads `HUBSPOT_APP_PRIVATE_KEY` via `secureStart`, then serves OAuth\n * and CIMD routes under `/functions/v1/hubspot-connect`.\n */\nexport async function startHubSpotConnectFunction(\n  options: StartHubSpotConnectFunctionOptions\n): Promise<void> {\n  assertHubSpotConnectCimdClientMetadata(options.client);\n  await secureStart(async () => ({\n    start: (context) =>\n      runHubSpotConnectLovableServer({\n        ...context,\n        cimdClientMetadata: options.client,\n      }),\n  }));\n}\n"],"mappings":";;;;;;;;;AAgBA,eAAsB,4BACpB,SACe;CACf,uCAAuC,QAAQ,OAAO;CACtD,MAAM,YAAY,aAAa,EAC7B,QAAQ,YACN,+BAA+B;EAC7B,GAAG;EACH,oBAAoB,QAAQ;EAC7B,CAAC,EACL,EAAE"}

package/dist/server/lovable/hubspot-connect/run-hubspot-connect-lovable-server.js

@@ -0,0 +1,27 @@
+import { registerHubSpotConnectRoutes } from "../../hono/hubspot-connect-routes/hubspot-connect-routes.js";
+import { loadHubSpotConnectRoutesEnv } from "../../hono/hubspot-connect-routes/load-hubspot-connect-routes-env.js";
+import "../../hono/index.js";
+import { Hono } from "hono";
+//#region src/server/lovable/hubspot-connect/run-hubspot-connect-lovable-server.ts
+const PORT = Deno.env.get("PORT");
+const serveOptions = typeof PORT === "string" ? { port: parseInt(PORT, 10) } : {};
+const HUBSPOT_CONNECT_BASE_PATH = "/functions/v1/hubspot-connect";
+function runHubSpotConnectLovableServer(options) {
+	const { appKeys, cimdClientMetadata } = options;
+	const hubspotConnectEnv = loadHubSpotConnectRoutesEnv();
+	return Deno.serve(serveOptions, (request) => {
+		const app = new Hono();
+		registerHubSpotConnectRoutes({
+			app: app.basePath(HUBSPOT_CONNECT_BASE_PATH),
+			appKeys,
+			basePath: HUBSPOT_CONNECT_BASE_PATH,
+			hubspotConnectEnv,
+			cimdClientMetadata
+		});
+		return app.fetch(request);
+	}).finished;
+}
+//#endregion
+export { runHubSpotConnectLovableServer };
+
+//# sourceMappingURL=run-hubspot-connect-lovable-server.js.map

package/dist/server/lovable/hubspot-connect/run-hubspot-connect-lovable-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-hubspot-connect-lovable-server.js","names":[],"sources":["../../../../src/server/lovable/hubspot-connect/run-hubspot-connect-lovable-server.ts"],"sourcesContent":["import { Hono } from 'hono';\n\nimport type { SecureStartContext } from '../../deno/start.ts';\nimport type { HubSpotConnectCimdClientMetadata } from '../../hono/hubspot-connect-routes/cimd-client-metadata-types.ts';\nimport {\n  loadHubSpotConnectRoutesEnv,\n  registerHubSpotConnectRoutes,\n} from '../../hono/index.ts';\n\nconst PORT = Deno.env.get('PORT');\nconst serveOptions =\n  typeof PORT === 'string' ? { port: parseInt(PORT, 10) } : {};\nconst HUBSPOT_CONNECT_BASE_PATH = '/functions/v1/hubspot-connect';\n\nexport interface RunHubSpotConnectLovableServerOptions extends SecureStartContext {\n  cimdClientMetadata: HubSpotConnectCimdClientMetadata;\n}\n\nexport function runHubSpotConnectLovableServer(\n  options: RunHubSpotConnectLovableServerOptions\n): Promise<void> {\n  const { appKeys, cimdClientMetadata } = options;\n  const hubspotConnectEnv = loadHubSpotConnectRoutesEnv();\n  const server = Deno.serve(serveOptions, (request) => {\n    const app = new Hono();\n\n    registerHubSpotConnectRoutes({\n      app: app.basePath(HUBSPOT_CONNECT_BASE_PATH),\n      appKeys,\n      basePath: HUBSPOT_CONNECT_BASE_PATH,\n      hubspotConnectEnv,\n      cimdClientMetadata,\n    });\n\n    return app.fetch(request);\n  });\n\n  return server.finished;\n}\n"],"mappings":";;;;;AASA,MAAM,OAAO,KAAK,IAAI,IAAI,OAAO;AACjC,MAAM,eACJ,OAAO,SAAS,WAAW,EAAE,MAAM,SAAS,MAAM,GAAG,EAAE,GAAG,EAAE;AAC9D,MAAM,4BAA4B;AAMlC,SAAgB,+BACd,SACe;CACf,MAAM,EAAE,SAAS,uBAAuB;CACxC,MAAM,oBAAoB,6BAA6B;CAevD,OAde,KAAK,MAAM,eAAe,YAAY;EACnD,MAAM,MAAM,IAAI,MAAM;EAEtB,6BAA6B;GAC3B,KAAK,IAAI,SAAS,0BAA0B;GAC5C;GACA,UAAU;GACV;GACA;GACD,CAAC;EAEF,OAAO,IAAI,MAAM,QAAQ;GAGd,CAAC"}

package/dist/server/lovable.d.ts

@@ -1,117 +1,6 @@
-import { i as HubSpotClient } from "./types-DEOUH4wE.js";
-import { n as HubSpotProxy, t as AppKeys } from "./types-5gfN91Fq.js";
-import { Hono } from "hono";
-
-//#region src/server/secure-start-core.d.ts
-/**
- * Context passed to a function-style entrypoint loaded by `runSecureStart`.
- * Contains imported `AppKeys` when CIMD or DPoP is enabled; otherwise
- * `null` (traditional OAuth with `client_secret` and Bearer API calls).
- */
-interface SecureStartContext {
-  appKeys: AppKeys | null;
-}
-interface SecureEntryPointExports {
-  start: (context: SecureStartContext) => Promise<void>;
-}
-/**
- * Loader returned to `runSecureStart` that produces the entrypoint
- * module. Always pass an `() => import('...')` arrow so the bundler
- * preserves dynamic-import semantics.
- */
-type SecureStartLoader = () => Promise<SecureEntryPointExports>;
-//#endregion
-//#region src/server/deno/start.d.ts
-/**
- * Deno entrypoint helper. Reads `HUBSPOT_APP_PRIVATE_KEY` from `Deno.env`
- * when CIMD or DPoP is enabled, imports the supplied loader, and invokes
- * `start` with `AppKeys` or `null`.
- */
-declare function secureStart(loader: SecureStartLoader): Promise<void>;
-//#endregion
-//#region src/server/hono/hubspot-connect-routes/cimd-client-metadata-types.d.ts
-/**
- * Caller-supplied scope configuration for the CIMD document served at
- * `{basePath}/client.json`. `redirect_uri` and `jwks_uri` are derived at
- * request time by the hubspot-connect routes.
- */
-interface HubSpotConnectCimdClientMetadata {
-  scope: HubSpotConnectCimdClientScope;
-}
-interface HubSpotConnectCimdClientScope {
-  required: string[];
-  optional?: string[];
-}
-//#endregion
-//#region src/server/lovable/hubspot-connect/index.d.ts
-interface StartHubSpotConnectFunctionOptions {
-  client: HubSpotConnectCimdClientMetadata;
-}
-/**
- * Lovable-style entry point for the hubspot-connect Deno function.
- * Loads `HUBSPOT_APP_PRIVATE_KEY` via `secureStart`, then serves OAuth
- * and CIMD routes under `/functions/v1/hubspot-connect`.
- */
-declare function startHubSpotConnectFunction(options: StartHubSpotConnectFunctionOptions): Promise<void>;
-//#endregion
-//#region src/shared/logger.d.ts
-/**
- * Pluggable logger contract used by the SDK on both the browser and
- * server. Consumers can pass `console`-like loggers, structured
- * loggers (pino / winston / etc.) or no-op stubs in tests.
- */
-interface Logger {
-  debug: (message: string, ...args: unknown[]) => void;
-  info: (message: string, ...args: unknown[]) => void;
-  warn: (message: string, ...args: unknown[]) => void;
-  error: (message: string, ...args: unknown[]) => void;
-}
-//#endregion
-//#region src/server/hono/types.d.ts
-interface AppConnectRequestContext {
-  /**
-   * HubSpot API proxy.
-   */
-  proxy: HubSpotProxy;
-  /**
-   * HubSpot API client.
-   */
-  client: HubSpotClient;
-  /**
-   * Whether the browser session is authenticated.
-   */
-  authenticated: boolean;
-}
-interface AppConnectHonoBindings {
-  hubSpot: AppConnectRequestContext;
-}
-/**
- * Hono environment shape used by handlers running inside a hubspot-
- * connect request handler. Exposes the per-request
- * {@link AppConnectRequestContext} as `c.env.hubSpot`.
- */
-interface AppConnectHonoEnv {
-  Bindings: AppConnectHonoBindings;
-}
-//#endregion
-//#region src/server/lovable/create-app-function-start.d.ts
-type RegisterAppFunctionRoutesFunction = (app: Hono<AppConnectHonoEnv>) => void;
-interface CreateAppFunctionStartOptions {
-  /** Base path the user's routes are mounted under (e.g. `/functions/v1/api`). */
-  basePath: string;
-  /** Attach app routes to the SDK-owned Hono instance. */
-  registerRoutes: RegisterAppFunctionRoutesFunction;
-  /** Optional logger forwarded to `createAppConnectRequestHandler`. */
-  logger?: Logger;
-}
-type AppFunctionStart = (context: SecureStartContext) => Promise<void>;
-/**
- * Builds a Deno-style `start({ appKeys })` entry point that boots a
- * Hono app under `basePath`, wires the SDK's per-request HubSpot
- * proxy via `createAppConnectRequestHandler`, and serves it with
- * `Deno.serve` on `PORT`.
- */
-declare function createAppFunctionStart(options: CreateAppFunctionStartOptions): AppFunctionStart;
-//#endregion
-export { type AppFunctionStart, type CreateAppFunctionStartOptions, type HubSpotConnectCimdClientMetadata, type RegisterAppFunctionRoutesFunction, type SecureStartContext, type SecureStartLoader, type StartHubSpotConnectFunctionOptions, createAppFunctionStart, secureStart, startHubSpotConnectFunction };
-//# sourceMappingURL=lovable.d.ts.map
+import { SecureStartContext, SecureStartLoader } from "./secure-start-core.js";
+import { secureStart } from "./deno/start.js";
+import { HubSpotConnectCimdClientMetadata } from "./hono/hubspot-connect-routes/cimd-client-metadata-types.js";
+import { StartHubSpotConnectFunctionOptions, startHubSpotConnectFunction } from "./lovable/hubspot-connect/index.js";
+import { AppFunctionStart, CreateAppFunctionStartOptions, RegisterAppFunctionRoutesFunction, createAppFunctionStart } from "./lovable/create-app-function-start.js";
+export { type AppFunctionStart, type CreateAppFunctionStartOptions, type HubSpotConnectCimdClientMetadata, type RegisterAppFunctionRoutesFunction, type SecureStartContext, type SecureStartLoader, type StartHubSpotConnectFunctionOptions, createAppFunctionStart, secureStart, startHubSpotConnectFunction };