@hubspot/app-connect-sdk 1.0.0-alpha.4 → 1.0.0-alpha.7

package/dist/server/utils/dpop-utils.js

@@ -0,0 +1,75 @@
+import { base64urlDecode } from "../shared/encoding/base64.js";
+import { getJwkThumbprint } from "./jwk-utils.js";
+import { decodeAndVerifyJwt, encodeAndSignJwt } from "./jwt-utils.js";
+//#region src/server/utils/dpop-utils.ts
+function ecPublicJwkForDpopHeader(jwk) {
+	if (jwk.kty !== "EC" || jwk.crv !== "P-256" || typeof jwk.x !== "string" || typeof jwk.y !== "string") throw new Error("Expected P-256 EC public JWK");
+	return {
+		kty: "EC",
+		crv: "P-256",
+		x: jwk.x,
+		y: jwk.y
+	};
+}
+/**
+* Mints a DPoP proof JWT (RFC 9449) signed with the app's private
+* key. The header is set to `typ=dpop+jwt`, `alg=ES256`, and embeds
+* the public JWK so the receiver can verify the signature without
+* out-of-band key distribution.
+*/
+async function signDpopProof(options) {
+	const { appKeys, claims } = options;
+	return encodeAndSignJwt({
+		header: {
+			alg: "ES256",
+			typ: "dpop+jwt",
+			jwk: ecPublicJwkForDpopHeader(appKeys.appPublicKeyJwk)
+		},
+		payload: claims,
+		privateKey: appKeys.appPrivateKey
+	});
+}
+/**
+* Verifies a DPoP proof JWT and returns the embedded public JWK,
+* its thumbprint, and the decoded claims.
+*
+* Enforces RFC 9449's required checks:
+*
+* - `typ=dpop+jwt`, `alg=ES256`, and a JWK in the header.
+* - Signature is valid against the embedded JWK.
+* - `htm`, `htu`, and (when supplied) `ath`/`sid` match.
+* - `iat` is within ±5 minutes of "now".
+*
+* @throws {Error} If any of the above checks fail.
+*/
+async function verifyDpopProof(options) {
+	const { proof, htm, htu, ath, sid } = options;
+	const parts = proof.split(".");
+	if (parts.length !== 3) throw new Error("Invalid DPoP proof format");
+	const encodedHeader = parts[0];
+	if (!encodedHeader) throw new Error("Missing DPoP header");
+	const header = JSON.parse(new TextDecoder().decode(base64urlDecode(encodedHeader)));
+	if (header.typ !== "dpop+jwt") throw new Error("Invalid DPoP typ header");
+	if (header.alg !== "ES256") throw new Error("Unsupported DPoP algorithm");
+	const publicKeyJwk = header.jwk;
+	if (!publicKeyJwk) throw new Error("Missing jwk in DPoP header");
+	const claims = await decodeAndVerifyJwt({
+		token: proof,
+		publicKeyJwk
+	});
+	if (claims.htm !== htm) throw new Error(`DPoP htm mismatch: expected ${htm}, got ${claims.htm}`);
+	if (claims.htu !== htu) throw new Error(`DPoP htu mismatch: expected ${htu}, got ${claims.htu}`);
+	if (ath !== void 0 && claims.ath !== ath) throw new Error("DPoP ath mismatch");
+	if (sid !== void 0 && claims.sid !== sid) throw new Error("DPoP sid mismatch");
+	const now = Math.floor(Date.now() / 1e3);
+	if (Math.abs(now - claims.iat) > 300) throw new Error("DPoP proof expired or too far in future");
+	return {
+		publicKeyJwk,
+		jkt: await getJwkThumbprint({ publicKeyJwk }),
+		claims
+	};
+}
+//#endregion
+export { signDpopProof, verifyDpopProof };
+
+//# sourceMappingURL=dpop-utils.js.map

package/dist/server/utils/dpop-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dpop-utils.js","names":[],"sources":["../../../src/server/utils/dpop-utils.ts"],"sourcesContent":["import { type AppKeys } from '../types.ts';\nimport { base64urlDecode } from './base64-utils.ts';\nimport { getJwkThumbprint } from './jwk-utils.ts';\nimport { decodeAndVerifyJwt, encodeAndSignJwt } from './jwt-utils.ts';\n\n/**\n * Claims that go into a DPoP proof JWT (RFC 9449 §4.2). Extra\n * properties pass through to the encoder unchanged so callers can\n * include implementation-specific claims.\n */\nexport interface DpopClaims {\n  /** HTTP method of the protected request, uppercase. */\n  htm: string;\n  /** Target URI of the protected request, fully-qualified. */\n  htu: string;\n  /** Unique proof identifier (RFC 9449 §4.2, recommended UUID). */\n  jti: string;\n  /** Issuance time, Unix epoch seconds. */\n  iat: number;\n  /**\n   * Hash of the access token presented alongside this proof, if any\n   * (RFC 9449 §4.2). Required for resource-server DPoP.\n   */\n  ath?: string;\n  /**\n   * App session ID hash. Custom HubSpot extension that lets the auth\n   * server bind tokens to the browser session that minted them.\n   */\n  sid?: string;\n  [key: string]: unknown;\n}\n\nfunction ecPublicJwkForDpopHeader(jwk: JsonWebKey): JsonWebKey {\n  if (\n    jwk.kty !== 'EC' ||\n    jwk.crv !== 'P-256' ||\n    typeof jwk.x !== 'string' ||\n    typeof jwk.y !== 'string'\n  ) {\n    throw new Error('Expected P-256 EC public JWK');\n  }\n  return {\n    kty: 'EC',\n    crv: 'P-256',\n    x: jwk.x,\n    y: jwk.y,\n  };\n}\n\nexport interface SignDpopProofOptions {\n  /** App key material produced by `secureStart`. */\n  appKeys: AppKeys;\n  /** Claims to include in the DPoP proof. */\n  claims: DpopClaims;\n}\n\n/**\n * Mints a DPoP proof JWT (RFC 9449) signed with the app's private\n * key. The header is set to `typ=dpop+jwt`, `alg=ES256`, and embeds\n * the public JWK so the receiver can verify the signature without\n * out-of-band key distribution.\n */\nexport async function signDpopProof(\n  options: SignDpopProofOptions\n): Promise<string> {\n  const { appKeys, claims } = options;\n  const publicJwk = ecPublicJwkForDpopHeader(appKeys.appPublicKeyJwk);\n  return encodeAndSignJwt({\n    header: { alg: 'ES256', typ: 'dpop+jwt', jwk: publicJwk },\n    payload: claims,\n    privateKey: appKeys.appPrivateKey,\n  });\n}\n\n/**\n * Result of a successful {@link verifyDpopProof} call.\n */\nexport interface VerifiedDpopProof {\n  /** Public JWK extracted from the proof's header. */\n  publicKeyJwk: JsonWebKey;\n  /** RFC 7638 JWK thumbprint of `publicKeyJwk`. */\n  jkt: string;\n  /** Decoded claims from the proof's payload. */\n  claims: DpopClaims;\n}\n\nexport interface VerifyDpopProofOptions {\n  /** The compact-serialized DPoP proof. */\n  proof: string;\n  /** Expected HTTP method (RFC 9449 `htm` claim). */\n  htm: string;\n  /** Expected request URI (RFC 9449 `htu` claim). */\n  htu: string;\n  /** Expected access-token hash (RFC 9449 `ath` claim). */\n  ath?: string;\n  /** Expected app-session-ID hash (`sid` claim). */\n  sid?: string;\n}\n\ninterface DpopProofHeader {\n  typ?: string;\n  alg?: string;\n  jwk?: JsonWebKey;\n}\n\n/**\n * Verifies a DPoP proof JWT and returns the embedded public JWK,\n * its thumbprint, and the decoded claims.\n *\n * Enforces RFC 9449's required checks:\n *\n * - `typ=dpop+jwt`, `alg=ES256`, and a JWK in the header.\n * - Signature is valid against the embedded JWK.\n * - `htm`, `htu`, and (when supplied) `ath`/`sid` match.\n * - `iat` is within ±5 minutes of \"now\".\n *\n * @throws {Error} If any of the above checks fail.\n */\nexport async function verifyDpopProof(\n  options: VerifyDpopProofOptions\n): Promise<VerifiedDpopProof> {\n  const { proof, htm, htu, ath, sid } = options;\n  const parts = proof.split('.');\n  if (parts.length !== 3) throw new Error('Invalid DPoP proof format');\n\n  const encodedHeader = parts[0];\n  if (!encodedHeader) throw new Error('Missing DPoP header');\n\n  const header = JSON.parse(\n    new TextDecoder().decode(base64urlDecode(encodedHeader))\n  ) as DpopProofHeader;\n\n  if (header.typ !== 'dpop+jwt') throw new Error('Invalid DPoP typ header');\n  if (header.alg !== 'ES256') throw new Error('Unsupported DPoP algorithm');\n  const publicKeyJwk = header.jwk;\n  if (!publicKeyJwk) throw new Error('Missing jwk in DPoP header');\n\n  const payload = await decodeAndVerifyJwt({ token: proof, publicKeyJwk });\n  const claims = payload as unknown as DpopClaims;\n\n  if (claims.htm !== htm) {\n    throw new Error(`DPoP htm mismatch: expected ${htm}, got ${claims.htm}`);\n  }\n  if (claims.htu !== htu) {\n    throw new Error(`DPoP htu mismatch: expected ${htu}, got ${claims.htu}`);\n  }\n  if (ath !== undefined && claims.ath !== ath) {\n    throw new Error('DPoP ath mismatch');\n  }\n  if (sid !== undefined && claims.sid !== sid) {\n    throw new Error('DPoP sid mismatch');\n  }\n\n  const now = Math.floor(Date.now() / 1000);\n  if (Math.abs(now - claims.iat) > 300) {\n    throw new Error('DPoP proof expired or too far in future');\n  }\n\n  const jkt = await getJwkThumbprint({ publicKeyJwk });\n  return { publicKeyJwk, jkt, claims };\n}\n"],"mappings":";;;;AAgCA,SAAS,yBAAyB,KAA6B;CAC7D,IACE,IAAI,QAAQ,QACZ,IAAI,QAAQ,WACZ,OAAO,IAAI,MAAM,YACjB,OAAO,IAAI,MAAM,UAEjB,MAAM,IAAI,MAAM,+BAA+B;CAEjD,OAAO;EACL,KAAK;EACL,KAAK;EACL,GAAG,IAAI;EACP,GAAG,IAAI;EACR;;;;;;;;AAgBH,eAAsB,cACpB,SACiB;CACjB,MAAM,EAAE,SAAS,WAAW;CAE5B,OAAO,iBAAiB;EACtB,QAAQ;GAAE,KAAK;GAAS,KAAK;GAAY,KAFzB,yBAAyB,QAAQ,gBAEM;GAAE;EACzD,SAAS;EACT,YAAY,QAAQ;EACrB,CAAC;;;;;;;;;;;;;;;AA+CJ,eAAsB,gBACpB,SAC4B;CAC5B,MAAM,EAAE,OAAO,KAAK,KAAK,KAAK,QAAQ;CACtC,MAAM,QAAQ,MAAM,MAAM,IAAI;CAC9B,IAAI,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,4BAA4B;CAEpE,MAAM,gBAAgB,MAAM;CAC5B,IAAI,CAAC,eAAe,MAAM,IAAI,MAAM,sBAAsB;CAE1D,MAAM,SAAS,KAAK,MAClB,IAAI,aAAa,CAAC,OAAO,gBAAgB,cAAc,CAAC,CACzD;CAED,IAAI,OAAO,QAAQ,YAAY,MAAM,IAAI,MAAM,0BAA0B;CACzE,IAAI,OAAO,QAAQ,SAAS,MAAM,IAAI,MAAM,6BAA6B;CACzE,MAAM,eAAe,OAAO;CAC5B,IAAI,CAAC,cAAc,MAAM,IAAI,MAAM,6BAA6B;CAGhE,MAAM,SAAS,MADO,mBAAmB;EAAE,OAAO;EAAO;EAAc,CAAC;CAGxE,IAAI,OAAO,QAAQ,KACjB,MAAM,IAAI,MAAM,+BAA+B,IAAI,QAAQ,OAAO,MAAM;CAE1E,IAAI,OAAO,QAAQ,KACjB,MAAM,IAAI,MAAM,+BAA+B,IAAI,QAAQ,OAAO,MAAM;CAE1E,IAAI,QAAQ,KAAA,KAAa,OAAO,QAAQ,KACtC,MAAM,IAAI,MAAM,oBAAoB;CAEtC,IAAI,QAAQ,KAAA,KAAa,OAAO,QAAQ,KACtC,MAAM,IAAI,MAAM,oBAAoB;CAGtC,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;CACzC,IAAI,KAAK,IAAI,MAAM,OAAO,IAAI,GAAG,KAC/B,MAAM,IAAI,MAAM,0CAA0C;CAI5D,OAAO;EAAE;EAAc,KAAA,MADL,iBAAiB,EAAE,cAAc,CAAC;EACxB;EAAQ"}

package/dist/server/utils/env-utils.js

@@ -0,0 +1,107 @@
+//#region src/server/utils/env-utils.ts
+const HUBSPOT_API_ORIGIN_DEFAULT = "https://api.hubapi.com";
+const HUBSPOT_OAUTH_API_ORIGIN_DEFAULT = "https://api.hubapi.com";
+const HUBSPOT_AUTHORIZATION_ENDPOINT_DEFAULT = "https://app.hubspot.com/oauth/authorize";
+/** Environment variable name for the app private key loaded by `secureStart`. */
+const HUBSPOT_APP_PRIVATE_KEY_ENV = "HUBSPOT_APP_PRIVATE_KEY";
+/**
+* Reads an environment variable in a way that works under both Node
+* (`process.env`) and Deno (`Deno.env.get`). Returns `undefined` when
+* the variable is unset or when neither runtime is available.
+*/
+function getEnv(key) {
+	const g = globalThis;
+	const proc = g.process;
+	if (proc?.env) return proc.env[key];
+	const deno = g.Deno;
+	if (deno !== void 0) return deno.env.get(key);
+}
+/**
+* Reads an environment variable, returning `defaultValue` when it is
+* unset or an empty string.
+*/
+function getEnvWithDefault(key, defaultValue) {
+	const value = getEnv(key);
+	if (!value) return defaultValue;
+	return value;
+}
+/**
+* Reads an environment variable and throws when it is missing or empty.
+* Use for values the SDK cannot fall back on (e.g. upstream service
+* URLs).
+*
+* @throws {Error} When the environment variable is unset or an empty
+*   string.
+*/
+function requireEnv(key) {
+	const value = getEnv(key);
+	if (!value) throw new Error(`Missing required environment variable: ${key}`);
+	return value;
+}
+/**
+* HubSpot API origin used by {@link createHubSpotProxy}. Defaults to
+* `https://api.hubapi.com` when `HUBSPOT_API_ORIGIN` is unset.
+*/
+function getHubSpotApiOrigin() {
+	return getEnvWithDefault("HUBSPOT_API_ORIGIN", HUBSPOT_API_ORIGIN_DEFAULT);
+}
+/**
+* Full OAuth authorize URL for hubspot-connect routes. Defaults to
+* `https://app.hubspot.com/oauth/authorize` when
+* `HUBSPOT_AUTHORIZATION_ENDPOINT` is unset.
+*/
+function getHubSpotAuthorizationEndpoint() {
+	return getEnvWithDefault("HUBSPOT_AUTHORIZATION_ENDPOINT", HUBSPOT_AUTHORIZATION_ENDPOINT_DEFAULT);
+}
+/**
+* HubSpot OAuth API origin (token, revoke, JWKS). Normalized to a URL
+* origin. Defaults to `https://api.hubapi.com` when
+* `HUBSPOT_OAUTH_API_ORIGIN` is unset.
+*/
+function getHubSpotOAuthApiOrigin() {
+	return new URL(getEnvWithDefault("HUBSPOT_OAUTH_API_ORIGIN", HUBSPOT_OAUTH_API_ORIGIN_DEFAULT)).origin;
+}
+/**
+* Static OAuth client ID. Required when CIMD is disabled.
+*
+* @throws {Error} When `HUBSPOT_CLIENT_ID` is unset or empty.
+*/
+function requireHubSpotClientId() {
+	return requireEnv("HUBSPOT_CLIENT_ID");
+}
+/**
+* Static OAuth client secret. Required when CIMD is disabled.
+*
+* @throws {Error} When `HUBSPOT_CLIENT_SECRET` is unset or empty.
+*/
+function requireHubSpotClientSecret() {
+	return requireEnv("HUBSPOT_CLIENT_SECRET");
+}
+/**
+* Whether outbound HubSpot OAuth and API calls should attach DPoP on
+* the wire. Enabled only when `HUBSPOT_DPOP_ENABLED` is exactly the
+* string `"true"` (unset or any other value keeps DPoP disabled).
+*/
+function isHubspotDpopEnabled() {
+	return getEnv("HUBSPOT_DPOP_ENABLED") === "true";
+}
+/**
+* Whether the SDK should use CIMD-style OAuth (client ID URL + JWT client
+* assertion). Enabled only when `HUBSPOT_CIMD_ENABLED` is exactly the
+* string `"true"` (unset or any other value keeps CIMD disabled).
+*/
+function isHubspotCimdEnabled() {
+	return getEnv("HUBSPOT_CIMD_ENABLED") === "true";
+}
+/**
+* Whether `HUBSPOT_APP_PRIVATE_KEY` must be set for `secureStart`. False
+* when both CIMD and DPoP are disabled — the SDK then uses
+* `client_secret` for OAuth and Bearer tokens only for API calls.
+*/
+function isHubspotAppPrivateKeyRequired() {
+	return isHubspotCimdEnabled() || isHubspotDpopEnabled();
+}
+//#endregion
+export { HUBSPOT_APP_PRIVATE_KEY_ENV, getHubSpotApiOrigin, getHubSpotAuthorizationEndpoint, getHubSpotOAuthApiOrigin, isHubspotAppPrivateKeyRequired, isHubspotCimdEnabled, isHubspotDpopEnabled, requireHubSpotClientId, requireHubSpotClientSecret };
+
+//# sourceMappingURL=env-utils.js.map

package/dist/server/utils/env-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-utils.js","names":[],"sources":["../../../src/server/utils/env-utils.ts"],"sourcesContent":["interface GlobalWithOptionalEnv {\n  process?: { env?: Record<string, string | undefined> };\n  Deno?: { env: { get(name: string): string | undefined } };\n}\n\nconst HUBSPOT_API_ORIGIN_DEFAULT = 'https://api.hubapi.com';\n\nconst HUBSPOT_OAUTH_API_ORIGIN_DEFAULT = 'https://api.hubapi.com';\n\nconst HUBSPOT_AUTHORIZATION_ENDPOINT_DEFAULT =\n  'https://app.hubspot.com/oauth/authorize';\n\n/** Environment variable name for the app private key loaded by `secureStart`. */\nexport const HUBSPOT_APP_PRIVATE_KEY_ENV = 'HUBSPOT_APP_PRIVATE_KEY';\n\n/**\n * Reads an environment variable in a way that works under both Node\n * (`process.env`) and Deno (`Deno.env.get`). Returns `undefined` when\n * the variable is unset or when neither runtime is available.\n */\nexport function getEnv(key: string): string | undefined {\n  const g = globalThis as GlobalWithOptionalEnv;\n  const proc = g.process;\n  if (proc?.env) {\n    return proc.env[key];\n  }\n  const deno = g.Deno;\n  if (deno !== undefined) {\n    return deno.env.get(key);\n  }\n  return undefined;\n}\n\n/**\n * Reads an environment variable, returning `defaultValue` when it is\n * unset or an empty string.\n */\nexport function getEnvWithDefault(key: string, defaultValue: string): string {\n  const value = getEnv(key);\n  if (!value) {\n    return defaultValue;\n  }\n  return value;\n}\n\n/**\n * Reads an environment variable and throws when it is missing or empty.\n * Use for values the SDK cannot fall back on (e.g. upstream service\n * URLs).\n *\n * @throws {Error} When the environment variable is unset or an empty\n *   string.\n */\nexport function requireEnv(key: string): string {\n  const value = getEnv(key);\n  if (!value) {\n    throw new Error(`Missing required environment variable: ${key}`);\n  }\n  return value;\n}\n\n/**\n * HubSpot API origin used by {@link createHubSpotProxy}. Defaults to\n * `https://api.hubapi.com` when `HUBSPOT_API_ORIGIN` is unset.\n */\nexport function getHubSpotApiOrigin(): string {\n  return getEnvWithDefault('HUBSPOT_API_ORIGIN', HUBSPOT_API_ORIGIN_DEFAULT);\n}\n\n/**\n * Full OAuth authorize URL for hubspot-connect routes. Defaults to\n * `https://app.hubspot.com/oauth/authorize` when\n * `HUBSPOT_AUTHORIZATION_ENDPOINT` is unset.\n */\nexport function getHubSpotAuthorizationEndpoint(): string {\n  return getEnvWithDefault(\n    'HUBSPOT_AUTHORIZATION_ENDPOINT',\n    HUBSPOT_AUTHORIZATION_ENDPOINT_DEFAULT\n  );\n}\n\n/**\n * HubSpot OAuth API origin (token, revoke, JWKS). Normalized to a URL\n * origin. Defaults to `https://api.hubapi.com` when\n * `HUBSPOT_OAUTH_API_ORIGIN` is unset.\n */\nexport function getHubSpotOAuthApiOrigin(): string {\n  return new URL(\n    getEnvWithDefault(\n      'HUBSPOT_OAUTH_API_ORIGIN',\n      HUBSPOT_OAUTH_API_ORIGIN_DEFAULT\n    )\n  ).origin;\n}\n\n/**\n * Static OAuth client ID. Required when CIMD is disabled.\n *\n * @throws {Error} When `HUBSPOT_CLIENT_ID` is unset or empty.\n */\nexport function requireHubSpotClientId(): string {\n  return requireEnv('HUBSPOT_CLIENT_ID');\n}\n\n/**\n * Static OAuth client secret. Required when CIMD is disabled.\n *\n * @throws {Error} When `HUBSPOT_CLIENT_SECRET` is unset or empty.\n */\nexport function requireHubSpotClientSecret(): string {\n  return requireEnv('HUBSPOT_CLIENT_SECRET');\n}\n\n/**\n * Whether outbound HubSpot OAuth and API calls should attach DPoP on\n * the wire. Enabled only when `HUBSPOT_DPOP_ENABLED` is exactly the\n * string `\"true\"` (unset or any other value keeps DPoP disabled).\n */\nexport function isHubspotDpopEnabled(): boolean {\n  return getEnv('HUBSPOT_DPOP_ENABLED') === 'true';\n}\n\n/**\n * Whether the SDK should use CIMD-style OAuth (client ID URL + JWT client\n * assertion). Enabled only when `HUBSPOT_CIMD_ENABLED` is exactly the\n * string `\"true\"` (unset or any other value keeps CIMD disabled).\n */\nexport function isHubspotCimdEnabled(): boolean {\n  return getEnv('HUBSPOT_CIMD_ENABLED') === 'true';\n}\n\n/**\n * Whether `HUBSPOT_APP_PRIVATE_KEY` must be set for `secureStart`. False\n * when both CIMD and DPoP are disabled — the SDK then uses\n * `client_secret` for OAuth and Bearer tokens only for API calls.\n */\nexport function isHubspotAppPrivateKeyRequired(): boolean {\n  return isHubspotCimdEnabled() || isHubspotDpopEnabled();\n}\n"],"mappings":";AAKA,MAAM,6BAA6B;AAEnC,MAAM,mCAAmC;AAEzC,MAAM,yCACJ;;AAGF,MAAa,8BAA8B;;;;;;AAO3C,SAAgB,OAAO,KAAiC;CACtD,MAAM,IAAI;CACV,MAAM,OAAO,EAAE;CACf,IAAI,MAAM,KACR,OAAO,KAAK,IAAI;CAElB,MAAM,OAAO,EAAE;CACf,IAAI,SAAS,KAAA,GACX,OAAO,KAAK,IAAI,IAAI,IAAI;;;;;;AAS5B,SAAgB,kBAAkB,KAAa,cAA8B;CAC3E,MAAM,QAAQ,OAAO,IAAI;CACzB,IAAI,CAAC,OACH,OAAO;CAET,OAAO;;;;;;;;;;AAWT,SAAgB,WAAW,KAAqB;CAC9C,MAAM,QAAQ,OAAO,IAAI;CACzB,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,0CAA0C,MAAM;CAElE,OAAO;;;;;;AAOT,SAAgB,sBAA8B;CAC5C,OAAO,kBAAkB,sBAAsB,2BAA2B;;;;;;;AAQ5E,SAAgB,kCAA0C;CACxD,OAAO,kBACL,kCACA,uCACD;;;;;;;AAQH,SAAgB,2BAAmC;CACjD,OAAO,IAAI,IACT,kBACE,4BACA,iCACD,CACF,CAAC;;;;;;;AAQJ,SAAgB,yBAAiC;CAC/C,OAAO,WAAW,oBAAoB;;;;;;;AAQxC,SAAgB,6BAAqC;CACnD,OAAO,WAAW,wBAAwB;;;;;;;AAQ5C,SAAgB,uBAAgC;CAC9C,OAAO,OAAO,uBAAuB,KAAK;;;;;;;AAQ5C,SAAgB,uBAAgC;CAC9C,OAAO,OAAO,uBAAuB,KAAK;;;;;;;AAQ5C,SAAgB,iCAA0C;CACxD,OAAO,sBAAsB,IAAI,sBAAsB"}

package/dist/server/utils/jwk-utils.d.ts

@@ -0,0 +1,16 @@
+//#region src/server/utils/jwk-utils.d.ts
+interface GetJwkThumbprintOptions {
+  /** EC P-256 public JWK whose thumbprint to compute. */
+  publicKeyJwk: JsonWebKey;
+}
+/**
+ * Computes the RFC 7638 JWK thumbprint of an EC P-256 public JWK.
+ * Per §3.2 the canonical form contains only `crv`, `kty`, `x`, `y`,
+ * sorted lexicographically — no whitespace, no other members. The
+ * SHA-256 of this canonical UTF-8 JSON, base64url-encoded, is the
+ * stable identifier (`jkt`) DPoP uses to bind tokens to public keys.
+ */
+declare function getJwkThumbprint(options: GetJwkThumbprintOptions): Promise<string>;
+//#endregion
+export { getJwkThumbprint };
+//# sourceMappingURL=jwk-utils.d.ts.map

package/dist/server/utils/jwk-utils.js

@@ -0,0 +1,24 @@
+import { base64url } from "../shared/encoding/base64.js";
+//#region src/server/utils/jwk-utils.ts
+/**
+* Computes the RFC 7638 JWK thumbprint of an EC P-256 public JWK.
+* Per §3.2 the canonical form contains only `crv`, `kty`, `x`, `y`,
+* sorted lexicographically — no whitespace, no other members. The
+* SHA-256 of this canonical UTF-8 JSON, base64url-encoded, is the
+* stable identifier (`jkt`) DPoP uses to bind tokens to public keys.
+*/
+async function getJwkThumbprint(options) {
+	const { publicKeyJwk } = options;
+	const canonical = JSON.stringify({
+		crv: publicKeyJwk.crv,
+		kty: publicKeyJwk.kty,
+		x: publicKeyJwk.x,
+		y: publicKeyJwk.y
+	});
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(canonical));
+	return base64url(new Uint8Array(digest));
+}
+//#endregion
+export { getJwkThumbprint };
+
+//# sourceMappingURL=jwk-utils.js.map

package/dist/server/utils/jwk-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwk-utils.js","names":[],"sources":["../../../src/server/utils/jwk-utils.ts"],"sourcesContent":["import { base64url } from './base64-utils.ts';\n\nexport interface GetJwkThumbprintOptions {\n  /** EC P-256 public JWK whose thumbprint to compute. */\n  publicKeyJwk: JsonWebKey;\n}\n\n/**\n * Computes the RFC 7638 JWK thumbprint of an EC P-256 public JWK.\n * Per §3.2 the canonical form contains only `crv`, `kty`, `x`, `y`,\n * sorted lexicographically — no whitespace, no other members. The\n * SHA-256 of this canonical UTF-8 JSON, base64url-encoded, is the\n * stable identifier (`jkt`) DPoP uses to bind tokens to public keys.\n */\nexport async function getJwkThumbprint(\n  options: GetJwkThumbprintOptions\n): Promise<string> {\n  const { publicKeyJwk } = options;\n  const canonical = JSON.stringify({\n    crv: publicKeyJwk.crv,\n    kty: publicKeyJwk.kty,\n    x: publicKeyJwk.x,\n    y: publicKeyJwk.y,\n  });\n  const digest = await crypto.subtle.digest(\n    'SHA-256',\n    new TextEncoder().encode(canonical)\n  );\n  return base64url(new Uint8Array(digest));\n}\n"],"mappings":";;;;;;;;;AAcA,eAAsB,iBACpB,SACiB;CACjB,MAAM,EAAE,iBAAiB;CACzB,MAAM,YAAY,KAAK,UAAU;EAC/B,KAAK,aAAa;EAClB,KAAK,aAAa;EAClB,GAAG,aAAa;EAChB,GAAG,aAAa;EACjB,CAAC;CACF,MAAM,SAAS,MAAM,OAAO,OAAO,OACjC,WACA,IAAI,aAAa,CAAC,OAAO,UAAU,CACpC;CACD,OAAO,UAAU,IAAI,WAAW,OAAO,CAAC"}

package/dist/server/utils/jwt-utils.d.ts

@@ -0,0 +1,39 @@
+//#region src/server/utils/jwt-utils.d.ts
+interface VerifyJwtOptions {
+  /** Compact-serialized JWT to verify. */
+  token: string;
+  /** Public key in JWK form. Caller is responsible for trusting it. */
+  publicKeyJwk: JsonWebKey;
+}
+/**
+ * Verifies signature and (if present) `exp` (RFC 7519 §4.1.4) on a
+ * JWT and returns its payload.
+ *
+ * @throws {Error} When the signature fails or when `exp` has passed.
+ */
+declare function verifyJwt(options: VerifyJwtOptions): Promise<Record<string, unknown>>;
+interface SignJwtOptions {
+  /** ES256 private key as a non-extractable WebCrypto key. */
+  privateKey: CryptoKey;
+  /**
+   * Custom claims merged onto an `iat` claim (and `exp` when
+   * `ttlSeconds` is supplied). Caller-provided keys override the
+   * standard ones.
+   */
+  payload: Record<string, unknown>;
+  /**
+   * Lifetime of the token in seconds. When set, the JWT's `exp` claim
+   * is computed as `iat + ttlSeconds`. When omitted, no `exp` is added
+   * (the caller is responsible for one if needed).
+   */
+  ttlSeconds?: number;
+}
+/**
+ * Signs a JWT (RFC 7519) with `alg=ES256, typ=JWT` and returns the
+ * compact serialization. Always sets `iat` to the current second; the
+ * caller controls every other claim via `payload`.
+ */
+declare function signJwt(options: SignJwtOptions): Promise<string>;
+//#endregion
+export { signJwt, verifyJwt };
+//# sourceMappingURL=jwt-utils.d.ts.map

package/dist/server/utils/jwt-utils.js

@@ -0,0 +1,87 @@
+import { base64url, base64urlDecode } from "../shared/encoding/base64.js";
+//#region src/server/utils/jwt-utils.ts
+/**
+* Low-level helper that encodes a JWS Compact Serialization JWT
+* (RFC 7519) and signs it with the supplied `privateKey` using
+* ES256 (P-256 + SHA-256). Returns the three-segment compact form.
+*/
+async function encodeAndSignJwt(options) {
+	const { header, payload, privateKey } = options;
+	const signingInput = `${base64url(new TextEncoder().encode(JSON.stringify(header)))}.${base64url(new TextEncoder().encode(JSON.stringify(payload)))}`;
+	const signatureBuffer = await crypto.subtle.sign({
+		name: "ECDSA",
+		hash: "SHA-256"
+	}, privateKey, new TextEncoder().encode(signingInput));
+	return `${signingInput}.${base64url(new Uint8Array(signatureBuffer))}`;
+}
+async function importPublicKey(jwk) {
+	return crypto.subtle.importKey("jwk", jwk, {
+		name: "ECDSA",
+		namedCurve: "P-256"
+	}, false, ["verify"]);
+}
+/**
+* Verifies the ES256 signature on `token` against `publicKeyJwk` and
+* returns the decoded payload. Does not check `exp` — use
+* {@link verifyJwt} when expiry enforcement is desired.
+*
+* @throws {Error} When the token isn't three segments, when the
+*   signature fails verification, or when the payload isn't valid
+*   JSON.
+*/
+async function decodeAndVerifyJwt(options) {
+	const { token, publicKeyJwk } = options;
+	const parts = token.split(".");
+	if (parts.length !== 3) throw new Error("Invalid JWT format");
+	const [encodedHeader, encodedPayload, encodedSignature] = parts;
+	const publicKey = await importPublicKey(publicKeyJwk);
+	if (!await crypto.subtle.verify({
+		name: "ECDSA",
+		hash: "SHA-256"
+	}, publicKey, base64urlDecode(encodedSignature), new TextEncoder().encode(`${encodedHeader}.${encodedPayload}`))) throw new Error("JWT signature verification failed");
+	return JSON.parse(new TextDecoder().decode(base64urlDecode(encodedPayload)));
+}
+/**
+* Verifies signature and (if present) `exp` (RFC 7519 §4.1.4) on a
+* JWT and returns its payload.
+*
+* @throws {Error} When the signature fails or when `exp` has passed.
+*/
+async function verifyJwt(options) {
+	const { token, publicKeyJwk } = options;
+	const payload = await decodeAndVerifyJwt({
+		token,
+		publicKeyJwk
+	});
+	const now = Math.floor(Date.now() / 1e3);
+	if (typeof payload["exp"] === "number" && payload["exp"] < now) throw new Error("JWT expired");
+	return payload;
+}
+/**
+* Signs a JWT (RFC 7519) with `alg=ES256, typ=JWT` and returns the
+* compact serialization. Always sets `iat` to the current second; the
+* caller controls every other claim via `payload`.
+*/
+async function signJwt(options) {
+	const { privateKey, payload, ttlSeconds } = options;
+	const now = Math.floor(Date.now() / 1e3);
+	return encodeAndSignJwt({
+		header: {
+			alg: "ES256",
+			typ: "JWT"
+		},
+		payload: ttlSeconds !== void 0 ? {
+			iat: now,
+			exp: now + ttlSeconds,
+			...payload
+		} : {
+			iat: now,
+			...payload
+		},
+		privateKey
+	});
+}
+//#endregion
+export { decodeAndVerifyJwt, encodeAndSignJwt, signJwt, verifyJwt };
+
+//# sourceMappingURL=jwt-utils.js.map

package/dist/server/utils/jwt-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-utils.js","names":[],"sources":["../../../src/server/utils/jwt-utils.ts"],"sourcesContent":["import { base64url, base64urlDecode } from './base64-utils.ts';\n\ninterface EncodeAndSignJwtOptions {\n  header: Record<string, unknown>;\n  payload: Record<string, unknown>;\n  privateKey: CryptoKey;\n}\n\n/**\n * Low-level helper that encodes a JWS Compact Serialization JWT\n * (RFC 7519) and signs it with the supplied `privateKey` using\n * ES256 (P-256 + SHA-256). Returns the three-segment compact form.\n */\nexport async function encodeAndSignJwt(\n  options: EncodeAndSignJwtOptions\n): Promise<string> {\n  const { header, payload, privateKey } = options;\n\n  const encodedHeader = base64url(\n    new TextEncoder().encode(JSON.stringify(header))\n  );\n  const encodedPayload = base64url(\n    new TextEncoder().encode(JSON.stringify(payload))\n  );\n  const signingInput = `${encodedHeader}.${encodedPayload}`;\n  const signatureBuffer = await crypto.subtle.sign(\n    { name: 'ECDSA', hash: 'SHA-256' },\n    privateKey,\n    new TextEncoder().encode(signingInput)\n  );\n  return `${signingInput}.${base64url(new Uint8Array(signatureBuffer))}`;\n}\n\nasync function importPublicKey(jwk: JsonWebKey): Promise<CryptoKey> {\n  return crypto.subtle.importKey(\n    'jwk',\n    jwk,\n    { name: 'ECDSA', namedCurve: 'P-256' },\n    false,\n    ['verify']\n  );\n}\n\ninterface DecodeAndVerifyJwtOptions {\n  token: string;\n  publicKeyJwk: JsonWebKey;\n}\n\n/**\n * Verifies the ES256 signature on `token` against `publicKeyJwk` and\n * returns the decoded payload. Does not check `exp` — use\n * {@link verifyJwt} when expiry enforcement is desired.\n *\n * @throws {Error} When the token isn't three segments, when the\n *   signature fails verification, or when the payload isn't valid\n *   JSON.\n */\nexport async function decodeAndVerifyJwt(\n  options: DecodeAndVerifyJwtOptions\n): Promise<Record<string, unknown>> {\n  const { token, publicKeyJwk } = options;\n  const parts = token.split('.');\n  if (parts.length !== 3) throw new Error('Invalid JWT format');\n  const [encodedHeader, encodedPayload, encodedSignature] = parts as [\n    string,\n    string,\n    string,\n  ];\n  const publicKey = await importPublicKey(publicKeyJwk);\n  const valid = await crypto.subtle.verify(\n    { name: 'ECDSA', hash: 'SHA-256' },\n    publicKey,\n    base64urlDecode(encodedSignature),\n    new TextEncoder().encode(`${encodedHeader}.${encodedPayload}`)\n  );\n  if (!valid) throw new Error('JWT signature verification failed');\n  return JSON.parse(\n    new TextDecoder().decode(base64urlDecode(encodedPayload))\n  ) as Record<string, unknown>;\n}\n\nexport interface VerifyJwtOptions {\n  /** Compact-serialized JWT to verify. */\n  token: string;\n  /** Public key in JWK form. Caller is responsible for trusting it. */\n  publicKeyJwk: JsonWebKey;\n}\n\n/**\n * Verifies signature and (if present) `exp` (RFC 7519 §4.1.4) on a\n * JWT and returns its payload.\n *\n * @throws {Error} When the signature fails or when `exp` has passed.\n */\nexport async function verifyJwt(\n  options: VerifyJwtOptions\n): Promise<Record<string, unknown>> {\n  const { token, publicKeyJwk } = options;\n  const payload = await decodeAndVerifyJwt({ token, publicKeyJwk });\n  const now = Math.floor(Date.now() / 1000);\n  if (typeof payload['exp'] === 'number' && payload['exp'] < now) {\n    throw new Error('JWT expired');\n  }\n  return payload;\n}\n\nexport interface SignJwtOptions {\n  /** ES256 private key as a non-extractable WebCrypto key. */\n  privateKey: CryptoKey;\n  /**\n   * Custom claims merged onto an `iat` claim (and `exp` when\n   * `ttlSeconds` is supplied). Caller-provided keys override the\n   * standard ones.\n   */\n  payload: Record<string, unknown>;\n  /**\n   * Lifetime of the token in seconds. When set, the JWT's `exp` claim\n   * is computed as `iat + ttlSeconds`. When omitted, no `exp` is added\n   * (the caller is responsible for one if needed).\n   */\n  ttlSeconds?: number;\n}\n\n/**\n * Signs a JWT (RFC 7519) with `alg=ES256, typ=JWT` and returns the\n * compact serialization. Always sets `iat` to the current second; the\n * caller controls every other claim via `payload`.\n */\nexport async function signJwt(options: SignJwtOptions): Promise<string> {\n  const { privateKey, payload, ttlSeconds } = options;\n  const now = Math.floor(Date.now() / 1000);\n  const payloadWithStandardClaims =\n    ttlSeconds !== undefined\n      ? { iat: now, exp: now + ttlSeconds, ...payload }\n      : { iat: now, ...payload };\n  return encodeAndSignJwt({\n    header: { alg: 'ES256', typ: 'JWT' },\n    payload: payloadWithStandardClaims,\n    privateKey,\n  });\n}\n"],"mappings":";;;;;;;AAaA,eAAsB,iBACpB,SACiB;CACjB,MAAM,EAAE,QAAQ,SAAS,eAAe;CAQxC,MAAM,eAAe,GANC,UACpB,IAAI,aAAa,CAAC,OAAO,KAAK,UAAU,OAAO,CAAC,CAKb,CAAC,GAHf,UACrB,IAAI,aAAa,CAAC,OAAO,KAAK,UAAU,QAAQ,CAAC,CAEI;CACvD,MAAM,kBAAkB,MAAM,OAAO,OAAO,KAC1C;EAAE,MAAM;EAAS,MAAM;EAAW,EAClC,YACA,IAAI,aAAa,CAAC,OAAO,aAAa,CACvC;CACD,OAAO,GAAG,aAAa,GAAG,UAAU,IAAI,WAAW,gBAAgB,CAAC;;AAGtE,eAAe,gBAAgB,KAAqC;CAClE,OAAO,OAAO,OAAO,UACnB,OACA,KACA;EAAE,MAAM;EAAS,YAAY;EAAS,EACtC,OACA,CAAC,SAAS,CACX;;;;;;;;;;;AAiBH,eAAsB,mBACpB,SACkC;CAClC,MAAM,EAAE,OAAO,iBAAiB;CAChC,MAAM,QAAQ,MAAM,MAAM,IAAI;CAC9B,IAAI,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,qBAAqB;CAC7D,MAAM,CAAC,eAAe,gBAAgB,oBAAoB;CAK1D,MAAM,YAAY,MAAM,gBAAgB,aAAa;CAOrD,IAAI,CAAC,MANe,OAAO,OAAO,OAChC;EAAE,MAAM;EAAS,MAAM;EAAW,EAClC,WACA,gBAAgB,iBAAiB,EACjC,IAAI,aAAa,CAAC,OAAO,GAAG,cAAc,GAAG,iBAAiB,CAC/D,EACW,MAAM,IAAI,MAAM,oCAAoC;CAChE,OAAO,KAAK,MACV,IAAI,aAAa,CAAC,OAAO,gBAAgB,eAAe,CAAC,CAC1D;;;;;;;;AAgBH,eAAsB,UACpB,SACkC;CAClC,MAAM,EAAE,OAAO,iBAAiB;CAChC,MAAM,UAAU,MAAM,mBAAmB;EAAE;EAAO;EAAc,CAAC;CACjE,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;CACzC,IAAI,OAAO,QAAQ,WAAW,YAAY,QAAQ,SAAS,KACzD,MAAM,IAAI,MAAM,cAAc;CAEhC,OAAO;;;;;;;AAyBT,eAAsB,QAAQ,SAA0C;CACtE,MAAM,EAAE,YAAY,SAAS,eAAe;CAC5C,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;CAKzC,OAAO,iBAAiB;EACtB,QAAQ;GAAE,KAAK;GAAS,KAAK;GAAO;EACpC,SALA,eAAe,KAAA,IACX;GAAE,KAAK;GAAK,KAAK,MAAM;GAAY,GAAG;GAAS,GAC/C;GAAE,KAAK;GAAK,GAAG;GAAS;EAI5B;EACD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hubspot/app-connect-sdk",
-  "version": "1.0.0-alpha.4",
+  "version": "1.0.0-alpha.7",
   "description": "HubSpot App Connect SDK (alpha release). Documentation and integration guidance forthcoming.",
   "type": "module",
   "exports": {
@@ -45,8 +45,8 @@
     "typescript": "6.0.3",
     "vitest": "4.0.18",
     "@private/eslint-config": "0.1.0",
-    "@private/tsconfig": "0.1.0",
-    "@private/prettier-config": "0.1.0"
+    "@private/prettier-config": "0.1.0",
+    "@private/tsconfig": "0.1.0"
   },
   "scripts": {
     "clean": "rm -rf dist build *.tsbuildinfo node_modules .turbo",

package/src/browser/app-connect-controller/connect-start.ts

@@ -41,6 +41,5 @@ export async function startHubSpotConnection(
 
   await delay(ARTIFICIAL_CONNECT_REDIRECT_DELAY_MS);
 
-  console.log('authorizationUrl', authorizationUrl);
-  // window.location.href = authorizationUrl;
+  window.location.href = authorizationUrl;
 }

package/src/server/hono/hubspot-connect-routes/load-hubspot-connect-routes-env.test.ts

@@ -1,5 +1,9 @@
 import { afterEach, describe, expect, it, vi } from 'vitest';
 
+import {
+  getHubSpotAuthorizationEndpoint,
+  getHubSpotOAuthApiOrigin,
+} from '../../utils/env-utils.ts';
 import { loadHubSpotConnectRoutesEnv } from './load-hubspot-connect-routes-env.ts';
 
 const HUBSPOT_AUTHORIZATION_ENDPOINT_EXAMPLE =
@@ -19,29 +23,16 @@ describe('loadHubSpotConnectRoutesEnv', () => {
     vi.unstubAllEnvs();
   });
 
-  it('throws when HUBSPOT_AUTHORIZATION_ENDPOINT is missing', () => {
-    vi.stubEnv('HUBSPOT_OAUTH_API_ORIGIN', HUBSPOT_OAUTH_API_ORIGIN_EXAMPLE);
+  it('uses production URL defaults when OAuth endpoint vars are unset', () => {
     vi.stubEnv('HUBSPOT_CIMD_ENABLED', 'false');
     vi.stubEnv('HUBSPOT_DPOP_ENABLED', 'false');
-    vi.stubEnv('HUBSPOT_CLIENT_ID', 'cid');
-    vi.stubEnv('HUBSPOT_CLIENT_SECRET', 'sec');
-    expect(() => loadHubSpotConnectRoutesEnv()).toThrow(
-      'Missing required environment variable: HUBSPOT_AUTHORIZATION_ENDPOINT'
-    );
-  });
-
-  it('throws when HUBSPOT_OAUTH_API_ORIGIN is missing', () => {
-    vi.stubEnv(
-      'HUBSPOT_AUTHORIZATION_ENDPOINT',
-      HUBSPOT_AUTHORIZATION_ENDPOINT_EXAMPLE
-    );
-    vi.stubEnv('HUBSPOT_CIMD_ENABLED', 'false');
-    vi.stubEnv('HUBSPOT_DPOP_ENABLED', 'false');
-    vi.stubEnv('HUBSPOT_CLIENT_ID', 'cid');
-    vi.stubEnv('HUBSPOT_CLIENT_SECRET', 'sec');
-    expect(() => loadHubSpotConnectRoutesEnv()).toThrow(
-      'Missing required environment variable: HUBSPOT_OAUTH_API_ORIGIN'
+    vi.stubEnv('HUBSPOT_CLIENT_ID', 'my-id');
+    vi.stubEnv('HUBSPOT_CLIENT_SECRET', 'my-secret');
+    const env = loadHubSpotConnectRoutesEnv();
+    expect(env.hubspotAuthorizationEndpoint).toBe(
+      getHubSpotAuthorizationEndpoint()
     );
+    expect(env.hubspotOAuthApiOrigin).toBe(getHubSpotOAuthApiOrigin());
   });
 
   it('throws when CIMD is disabled and HUBSPOT_CLIENT_ID is missing', () => {
@@ -120,12 +111,14 @@ describe('loadHubSpotConnectRoutesEnv', () => {
     expect(loadHubSpotConnectRoutesEnv().isAppPrivateKeyRequired).toBe(true);
   });
 
-  it('sets isAppPrivateKeyRequired true when both are enabled by default', () => {
+  it('sets CIMD and DPoP disabled when both flags are unset', () => {
     stubHubSpotOAuthEndpoints();
+    vi.stubEnv('HUBSPOT_CLIENT_ID', 'id');
+    vi.stubEnv('HUBSPOT_CLIENT_SECRET', 'sec');
     const env = loadHubSpotConnectRoutesEnv();
-    expect(env.isCimdEnabled).toBe(true);
-    expect(env.isDpopEnabled).toBe(true);
-    expect(env.isAppPrivateKeyRequired).toBe(true);
+    expect(env.isCimdEnabled).toBe(false);
+    expect(env.isDpopEnabled).toBe(false);
+    expect(env.isAppPrivateKeyRequired).toBe(false);
   });
 
   it('normalizes HUBSPOT_OAUTH_API_ORIGIN to an origin URL', () => {

package/src/server/hono/hubspot-connect-routes/load-hubspot-connect-routes-env.ts

@@ -1,7 +1,10 @@
 import {
+  getHubSpotAuthorizationEndpoint,
+  getHubSpotOAuthApiOrigin,
   isHubspotCimdEnabled,
   isHubspotDpopEnabled,
-  requireEnv,
+  requireHubSpotClientId,
+  requireHubSpotClientSecret,
 } from '../../utils/env-utils.ts';
 
 /**
@@ -36,11 +39,8 @@ export interface HubSpotConnectRoutesEnvClientSecret {
  * {@link registerHubSpotConnectRoutes}.
  */
 export function loadHubSpotConnectRoutesEnv(): HubSpotConnectRoutesEnv {
-  const hubspotAuthorizationEndpoint = requireEnv(
-    'HUBSPOT_AUTHORIZATION_ENDPOINT'
-  );
-  const hubspotOAuthApiOrigin = new URL(requireEnv('HUBSPOT_OAUTH_API_ORIGIN'))
-    .origin;
+  const hubspotAuthorizationEndpoint = getHubSpotAuthorizationEndpoint();
+  const hubspotOAuthApiOrigin = getHubSpotOAuthApiOrigin();
   const isCimdEnabled = isHubspotCimdEnabled();
   const isDpopEnabled = isHubspotDpopEnabled();
   const isAppPrivateKeyRequired = isCimdEnabled || isDpopEnabled;
@@ -61,7 +61,7 @@ export function loadHubSpotConnectRoutesEnv(): HubSpotConnectRoutesEnv {
     isCimdEnabled: false,
     isDpopEnabled,
     isAppPrivateKeyRequired,
-    hubspotClientId: requireEnv('HUBSPOT_CLIENT_ID'),
-    hubspotClientSecret: requireEnv('HUBSPOT_CLIENT_SECRET'),
+    hubspotClientId: requireHubSpotClientId(),
+    hubspotClientSecret: requireHubSpotClientSecret(),
   };
 }

package/src/server/lovable/hubspot-connect/run-hubspot-connect-lovable-server.ts

@@ -21,7 +21,7 @@ export function runHubSpotConnectLovableServer(
 ): Promise<void> {
   const { appKeys, cimdClientMetadata } = options;
   const hubspotConnectEnv = loadHubSpotConnectRoutesEnv();
-  const result = Deno.serve(serveOptions, (request) => {
+  const server = Deno.serve(serveOptions, (request) => {
     const app = new Hono();
 
     registerHubSpotConnectRoutes({
@@ -35,6 +35,5 @@ export function runHubSpotConnectLovableServer(
     return app.fetch(request);
   });
 
-  console.log(`[hubspot-connect] Listening on ${result.addr.port}`);
-  return Promise.resolve();
+  return server.finished;
 }

package/src/server/proxy.test.ts

@@ -35,7 +35,7 @@ describe('createHubSpotProxy', () => {
         appKeys: null,
       })
     ).toThrow(
-      'createHubSpotProxy: appKeys is required when HUBSPOT_DPOP_ENABLED is not false'
+      'createHubSpotProxy: appKeys is required when HUBSPOT_DPOP_ENABLED is true'
     );
   });
 

package/src/server/proxy.ts

@@ -7,9 +7,12 @@ import {
 } from './types.ts';
 import { sha256base64url } from './utils/crypto-utils.ts';
 import { signDpopProof } from './utils/dpop-utils.ts';
-import { isHubspotDpopEnabled, requireEnv } from './utils/env-utils.ts';
+import {
+  getHubSpotApiOrigin,
+  isHubspotDpopEnabled,
+} from './utils/env-utils.ts';
 
-const HUBSPOT_API_ORIGIN = requireEnv('HUBSPOT_API_ORIGIN');
+const hubSpotApiOrigin = getHubSpotApiOrigin();
 
 /**
  * Options accepted by {@link createHubSpotProxy}.
@@ -51,7 +54,7 @@ export function createHubSpotProxy(
 
   if (isHubspotDpopEnabled() && appKeys === null) {
     throw new Error(
-      'createHubSpotProxy: appKeys is required when HUBSPOT_DPOP_ENABLED is not false'
+      'createHubSpotProxy: appKeys is required when HUBSPOT_DPOP_ENABLED is true'
     );
   }
 
@@ -67,7 +70,7 @@ export function createHubSpotProxy(
   async function proxyFetch(request: HubSpotProxyRequest): Promise<Response> {
     const { path, method = 'GET', headers = EMPTY_HEADERS, body } = request;
 
-    const targetUrl = `${HUBSPOT_API_ORIGIN}${path}`;
+    const targetUrl = `${hubSpotApiOrigin}${path}`;
     const useDpop = isHubspotDpopEnabled();
 
     let authorizationHeaders: Record<string, string>;

package/src/server/secure-start-core.ts

@@ -1,6 +1,9 @@
 import { importAppKeys } from './import-app-keys.ts';
 import type { AppKeys } from './types.ts';
-import { isHubspotAppPrivateKeyRequired } from './utils/env-utils.ts';
+import {
+  HUBSPOT_APP_PRIVATE_KEY_ENV,
+  isHubspotAppPrivateKeyRequired,
+} from './utils/env-utils.ts';
 
 /**
  * Context passed to a function-style entrypoint loaded by `runSecureStart`.
@@ -36,8 +39,6 @@ export interface SecureStartAdapter {
   exit: (code: number) => never;
 }
 
-const APP_PRIVATE_KEY_ENV = 'HUBSPOT_APP_PRIVATE_KEY';
-
 /**
  * Loads `HUBSPOT_APP_PRIVATE_KEY` when CIMD or DPoP is enabled, deletes
  * it from the environment so later code cannot re-read it, imports the
@@ -51,12 +52,12 @@ export async function runSecureStart(
 ): Promise<void> {
   let appKeys: AppKeys | null = null;
   if (isHubspotAppPrivateKeyRequired()) {
-    const envKey = adapter.readEnv(APP_PRIVATE_KEY_ENV)?.trim();
+    const envKey = adapter.readEnv(HUBSPOT_APP_PRIVATE_KEY_ENV)?.trim();
     if (!envKey) {
-      throw new Error(`${APP_PRIVATE_KEY_ENV} is not set`);
+      throw new Error(`${HUBSPOT_APP_PRIVATE_KEY_ENV} is not set`);
     }
     appKeys = await importAppKeys(envKey);
-    adapter.deleteEnv(APP_PRIVATE_KEY_ENV);
+    adapter.deleteEnv(HUBSPOT_APP_PRIVATE_KEY_ENV);
   }
 
   const exports = await loader();

package/src/server/types.ts

@@ -21,8 +21,8 @@ export interface HubSpotProxyRequest {
   method?: string;
   /**
    * Extra request headers. The proxy adds `Authorization` itself
-   * (`DPoP` access token plus `DPoP` proof when `HUBSPOT_DPOP_ENABLED` is
-   * not `"false"` and `appKeys` is non-null; otherwise `Bearer` only).
+   * (`DPoP` access token plus `DPoP` proof when DPoP is enabled and
+   * `appKeys` is non-null; otherwise `Bearer` only).
    */
   headers?: Record<string, string>;
   /** Optional request body. Pass `null`/`undefined` for empty bodies. */