@volter/twin-hubspot 0.1.36 → 1.0.0

package/dist/journeys/demand.json

@@ -0,0 +1,171 @@
+{
+  "measured": "Application calls and optional settings are recorded below at the cited commits.",
+  "applications": [
+    {
+      "name": "volter-ai/runhuman",
+      "backend": [],
+      "frontend": [],
+      "webhooks": [],
+      "ci": []
+    },
+    {
+      "name": "volter-ai/twin",
+      "backend": [],
+      "frontend": [],
+      "webhooks": [],
+      "ci": []
+    },
+    {
+      "name": "supercode",
+      "backend": [],
+      "frontend": [],
+      "webhooks": [],
+      "ci": []
+    },
+    {
+      "name": "ponder",
+      "backend": [],
+      "frontend": [],
+      "webhooks": [],
+      "ci": []
+    },
+    {
+      "name": "company-layer",
+      "backend": [],
+      "frontend": [],
+      "webhooks": [],
+      "ci": []
+    },
+    {
+      "name": "rallly",
+      "backend": [],
+      "frontend": [],
+      "webhooks": [],
+      "ci": []
+    },
+    {
+      "name": "AFFiNE",
+      "backend": [],
+      "frontend": [],
+      "webhooks": [],
+      "ci": []
+    },
+    {
+      "name": "editor",
+      "backend": [],
+      "frontend": [],
+      "webhooks": [],
+      "ci": []
+    },
+    {
+      "name": "browser-substrate",
+      "backend": [],
+      "frontend": [],
+      "webhooks": [],
+      "ci": []
+    },
+    {
+      "name": "tabnode",
+      "backend": [],
+      "frontend": [],
+      "webhooks": [],
+      "ci": []
+    },
+    {
+      "name": "twin-catalog",
+      "backend": [],
+      "frontend": [],
+      "webhooks": [],
+      "ci": []
+    },
+    {
+      "name": "twenty",
+      "backend": [],
+      "frontend": [],
+      "webhooks": [],
+      "ci": []
+    },
+    {
+      "name": "inbox-zero",
+      "backend": [],
+      "frontend": [],
+      "webhooks": [],
+      "ci": []
+    },
+    {
+      "name": "LibreChat",
+      "backend": [],
+      "frontend": [],
+      "webhooks": [],
+      "ci": []
+    }
+  ],
+  "optional": [
+    {
+      "application": "dubinc/dub",
+      "what": "CRM OAuth integration and installed account operations",
+      "setting": "Install (2): the workspace HubSpot integration creates an installedIntegration; no installation exists by default (apps/web/app/(ee)/api/hubspot/callback/route.ts:94; apps/web/lib/integrations/hubspot/update-hubspot-settings.ts:39-46).",
+      "evidence": "apps/web/lib/integrations/hubspot/oauth.ts:102,103"
+    },
+    {
+      "client": "HubSpot OAuth installation and CRM booking synchronization",
+      "backend": [
+        {
+          "call": "CRM OAuth code and refresh token exchange",
+          "operation": "post-/oauth/v1/token_create",
+          "evidence": "packages/app-store/hubspot/api/callback.ts:36; packages/app-store/hubspot/lib/CrmService.ts:383"
+        },
+        {
+          "call": "Contact search by email",
+          "operation": "post-/crm/v3/objects/contacts/search_doSearch",
+          "evidence": "packages/app-store/hubspot/lib/CrmService.ts:524-525"
+        },
+        {
+          "call": "Create CRM meeting",
+          "operation": "post-/crm/v3/objects/meetings_create",
+          "evidence": "packages/app-store/hubspot/lib/CrmService.ts:314"
+        },
+        {
+          "call": "Update/cancel CRM meeting",
+          "operation": "patch-/crm/v3/objects/meetings/{meetingId}_update",
+          "evidence": "packages/app-store/hubspot/lib/CrmService.ts:350,360"
+        },
+        {
+          "call": "Archive meeting on organizer change",
+          "operation": "delete-/crm/v3/objects/meetings/{meetingId}_archive",
+          "evidence": "packages/app-store/hubspot/lib/CrmService.ts:364"
+        },
+        {
+          "call": "Create contacts",
+          "operation": "post-/crm/v3/objects/contacts_create",
+          "evidence": "packages/app-store/hubspot/lib/CrmService.ts:579"
+        },
+        {
+          "call": "Read meeting properties",
+          "operation": "get-/crm/v3/properties/{objectType}_getAll",
+          "evidence": "packages/app-store/hubspot/lib/CrmService.ts:95"
+        },
+        {
+          "call": "Associate meeting and contacts",
+          "operation": "post-/crm/v3/associations/{fromObjectType}/{toObjectType}/batch/create_create",
+          "evidence": "packages/app-store/hubspot/lib/CrmService.ts:325"
+        },
+        {
+          "call": "Read owners",
+          "operation": "get-/crm/v3/owners_/crm/v3/owners; get-/crm/v3/owners/{ownerId}_getById",
+          "evidence": "packages/app-store/hubspot/lib/CrmService.ts:611,665"
+        },
+        {
+          "call": "Read and update contact owner",
+          "operation": "get-/crm/v3/objects/contacts/{contactId}_getById; patch-/crm/v3/objects/contacts/{contactId}_update",
+          "evidence": "packages/app-store/hubspot/lib/CrmService.ts:630,639"
+        }
+      ],
+      "commit": "54343aa685ae",
+      "evidence": "packages/app-store/utils.ts:51; packages/app-store/_components/AppCard.tsx:94,116; packages/app-store/hubspot/api/callback.ts:50",
+      "application": "calcom/cal.diy",
+      "what": "HubSpot OAuth installation and CRM booking synchronization",
+      "setting": "Install (2): install the non-global HubSpot App Store app. HUBSPOT_CLIENT_ID makes its catalog metadata available, not user-installed (packages/app-store/hubspot/_metadata.ts:6). getApps omits non-global apps without a user credential (packages/app-store/utils.ts:47-56); AppCard offers installation (packages/app-store/_components/AppCard.tsx:94,116), and HubSpot's OAuth callback creates that credential (packages/app-store/hubspot/api/callback.ts:50). Calendar onboarding does not add CRM apps (apps/web/modules/onboarding/personal/calendar/personal-calendar-view.tsx:28-34)."
+    }
+  ]
+}

package/dist/journeys/score.json

@@ -0,0 +1,82 @@
+{
+  "vendor": "hubspot",
+  "life": {
+    "steps": 0,
+    "verdict": "unjudged",
+    "judge": null,
+    "authors": []
+  },
+  "failures": [],
+  "flags": [],
+  "coverage": {
+    "vendor": "hubspot",
+    "missing": 0,
+    "stale": [],
+    "code": {
+      "lines": 49,
+      "run": 47,
+      "recorded": 2,
+      "missing": 0
+    },
+    "state": {
+      "declared": 0,
+      "reached": 0,
+      "recorded": 0,
+      "missing": [],
+      "undeclared": []
+    },
+    "files": [
+      {
+        "file": "semantics/index.ts",
+        "lines": {
+          "found": 2,
+          "hit": 2
+        },
+        "missing": []
+      },
+      {
+        "file": "manifest.ts",
+        "lines": {
+          "found": 26,
+          "hit": 26
+        },
+        "missing": []
+      },
+      {
+        "file": "index.ts",
+        "lines": {
+          "found": 7,
+          "hit": 7
+        },
+        "missing": []
+      },
+      {
+        "file": "server.ts",
+        "lines": {
+          "found": 4,
+          "hit": 2
+        },
+        "missing": []
+      },
+      {
+        "file": "fetch.ts",
+        "lines": {
+          "found": 10,
+          "hit": 10
+        },
+        "missing": []
+      }
+    ]
+  },
+  "examples": {
+    "done": false,
+    "replayed": true,
+    "verdict": "unjudged",
+    "failures": [],
+    "line": "examples: 0 published, 0 of patch-removed operations, 0 of operations the twin does not serve, 0 replayed, 0 recorded; 0 failing   done: no"
+  },
+  "breadth": {
+    "operations": 103,
+    "gap": 103
+  }
+}

package/dist/journeys/unreachable.json

@@ -0,0 +1,12 @@
+{
+  "code": [
+    {
+      "file": "server.ts",
+      "declarations": [
+        "createHubspotTwinServer"
+      ],
+      "world": "host-process",
+      "why": "The journey walks call fetch in their in-memory Worlds; the host-process serve factory runs during final HTTP conformance."
+    }
+  ]
+}

package/dist/journeys/vendor-examples.json

@@ -0,0 +1,7 @@
+{
+  "vendor": "hubspot",
+  "host": "api.hubapi.com",
+  "author": "Codex",
+  "about": "No demanded application calls HubSpot; integrations are opt-in. Published examples remain unserved.",
+  "steps": []
+}

package/dist/spec/SOURCE.md

@@ -0,0 +1,40 @@
+# hubspot spec — provenance
+
+HubSpot publishes its API as one OpenAPI document per API and version, listed in its public spec catalog,
+https://api.hubspot.com/public/api/spec/v1/specs (each entry names its `openApi` URL). The vendored documents all
+name the one server `https://api.hubapi.com` and one OAuth scheme, so they are one API published as several documents
+(docs/contributing/architecture.md, "Other wires"): each is vendored as published and read as their union
+(`scripts/spec-documents.ts`).
+
+- **Files:** `openapi/<name>.json.gz`, gzip (`gzip -9 -n`) of each document's bytes as the catalog URL answered them.
+- **Fetched:** 2026-09-27, from the catalog's `openApi` URL for each entry and version below. The catalog lists newer
+  dated versions of each (`2026-03`, `2026-09`, some `2025-09`); the pack vendors the numbered stable versions the
+  twin's paths speak (`/crm/v3/...`, `/crm/v4/...`, `/oauth/v1/...`) and Dub calls.
+
+| File | Catalog entry | Version | `openApi` URL | Operations | SHA-256 of the document |
+|---|---|---|---|---|---|
+| `contacts` | CRM / Contacts | 3 | https://api.hubspot.com/public/api/spec/v2/specs/release/22150/version/3 | 13 | `a2150f2b1030da4b0df497f1888fe5027b70f1304da30dbb025d5a20761c7cb0` |
+| `companies` | CRM / Companies | 3 | https://api.hubspot.com/public/api/spec/v2/specs/release/22149/version/3 | 12 | `9dec0c5251136207dce6a65edce57ad8bd0fd7a8fb1c4571bda0fa98b79e588f` |
+| `deals` | CRM / Deals | 3 | https://api.hubspot.com/public/api/spec/v2/specs/release/25196/version/3 | 12 | `19e252b252ea9cdf9d2537829e615617e55bcc2a370500b7ff866de1b9b05bf4` |
+| `tickets` | CRM / Tickets | 3 | https://api.hubspot.com/public/api/spec/v2/specs/release/22189/version/3 | 12 | `7f0992e9458fe9e16d00d6b72bdced967cb5fa14c2b02ec74eab12a0fc3f65cf` |
+| `owners` | CRM / Crm Owners | 3 | https://api.hubspot.com/public/api/spec/v2/specs/release/22153/version/3 | 2 | `d7b511d6e964d6ae1fb8e83b1f6fa3184d4b4bfbac4ed7a57e275f36ada76e5d` |
+| `properties` | CRM / Properties | 3 | https://api.hubspot.com/public/api/spec/v2/specs/release/25174/version/3 | 13 | `1bc8ced2fac77840c7bf6f0e1ee17b259ad03c10b0557a5cdb5e9099a2bd0d80` |
+| `pipelines` | CRM / Pipelines | 3 | https://api.hubspot.com/public/api/spec/v2/specs/release/22177/version/3 | 14 | `80ba0da3a7e191167b861c57bed0a5c37e6e171d0a48a0004afc2da93609a700` |
+| `associations` | CRM / Associations | 4 | https://api.hubspot.com/public/api/spec/v2/specs/release/25199/version/4 | 10 | `44230be570fa6b32ae1cee5194de39bd9dd54209961fdd4c2934447d2f2af373` |
+| `meetings` | CRM / Meetings | 3 | https://api.hubspot.com/public/api/spec/v2/specs/release/22170/version/3 | 11 | `141d4da7ccc63bbce34a3b649f73c6d0a0f407eed6068ea33462796d070a2268` |
+| `oauth` | Auth / Oauth | 1 | https://api.hubspot.com/public/api/spec/v2/specs/release/22117/version/1 | 4 | `6ee55dc7a63b14a4947e5a9154c7da6585d96d5a6e654bfa336b9b0092ea2b23` |
+
+- **Version:** OpenAPI 3.0.1 each, 103 operations in their union.
+- **Operation ids:** HubSpot's own, from the documents.
+- **Deals' paths:** the document names `/crm/v3/objects/0-3`; the other object documents use names. No operation is served.
+- **Contradictions ruled** (`patches.json`, RFC 6902, applied to the documents before their union): the one scheme
+  `oauth2` lists different scopes in each document: each lists only the scopes its own operations name (the CRM object
+  documents no `crm.schemas.*`; Properties and Pipelines no `crm.objects.partner-clients.*` or `products.read`; Crm
+  Owners four; Oauth none), with the same authorization and token URLs. None refuses a scope another grants, so they
+  are partial lists of one scheme; the patches write their union (130 scopes) into every document. Evidence: the
+  spec's own words.
+- **Not in the documents:** `/oauth/authorize` is a consent page, not an API operation. No screen is served. OAuth v3 is not vendored.
+- **Read by:** twin-world's `scripts/derive-pack.ts`, writing `src/generated/`.
+- **Read by contributor:** Codex.
+
+No operation has a demanded caller. The optional integrations' evidence is in `journeys/demand.json`.

package/dist/spec/patches.json

@@ -0,0 +1,235 @@
+{
+  "patches": [
+    {
+      "op": "replace",
+      "path": "/documents/associations/components/securitySchemes/oauth2/flows/authorizationCode/scopes",
+      "value": {
+        "automation": "",
+        "cpq.quotes.read": "",
+        "cpq.quotes.write": "",
+        "crm.objects.appointments.read": "",
+        "crm.objects.appointments.sensitive.read.v2": "",
+        "crm.objects.appointments.sensitive.write.v2": "",
+        "crm.objects.appointments.write": "",
+        "crm.objects.calls.read": "",
+        "crm.objects.carts.read": "",
+        "crm.objects.carts.write": "",
+        "crm.objects.commercepayments.read": "",
+        "crm.objects.commercepayments.write": "",
+        "crm.objects.companies.highly_sensitive.read.v2": "",
+        "crm.objects.companies.highly_sensitive.write.v2": "",
+        "crm.objects.companies.read": "",
+        "crm.objects.companies.sensitive.read.v2": "",
+        "crm.objects.companies.sensitive.write.v2": "",
+        "crm.objects.companies.write": "",
+        "crm.objects.contacts.highly_sensitive.read.v2": "",
+        "crm.objects.contacts.highly_sensitive.write.v2": "",
+        "crm.objects.contacts.read": "",
+        "crm.objects.contacts.sensitive.read.v2": "",
+        "crm.objects.contacts.sensitive.write.v2": "",
+        "crm.objects.contacts.write": "",
+        "crm.objects.courses.read": "",
+        "crm.objects.courses.write": "",
+        "crm.objects.custom.highly_sensitive.read.v2": "",
+        "crm.objects.custom.highly_sensitive.write.v2": "",
+        "crm.objects.custom.read": "",
+        "crm.objects.custom.sensitive.read.v2": "",
+        "crm.objects.custom.sensitive.write.v2": "",
+        "crm.objects.custom.write": "",
+        "crm.objects.deals.highly_sensitive.read.v2": "",
+        "crm.objects.deals.highly_sensitive.write.v2": "",
+        "crm.objects.deals.read": "",
+        "crm.objects.deals.sensitive.read.v2": "",
+        "crm.objects.deals.sensitive.write.v2": "",
+        "crm.objects.deals.write": "",
+        "crm.objects.emails.read": "",
+        "crm.objects.feedback_submissions.read": "",
+        "crm.objects.goals.read": "",
+        "crm.objects.goals.write": "",
+        "crm.objects.invoices.read": "",
+        "crm.objects.invoices.write": "",
+        "crm.objects.leads.read": "",
+        "crm.objects.leads.write": "",
+        "crm.objects.line_items.read": "",
+        "crm.objects.line_items.write": "",
+        "crm.objects.listings.read": "",
+        "crm.objects.listings.write": "",
+        "crm.objects.marketing_events.read": "",
+        "crm.objects.marketing_events.write": "",
+        "crm.objects.meetings.read": "",
+        "crm.objects.notes.read": "",
+        "crm.objects.orders.read": "",
+        "crm.objects.orders.write": "",
+        "crm.objects.owners.read": "",
+        "crm.objects.partner-clients.read": "",
+        "crm.objects.partner-clients.write": "",
+        "crm.objects.partner-services.read": "",
+        "crm.objects.partner-services.write": "",
+        "crm.objects.products.read": "",
+        "crm.objects.products.write": "",
+        "crm.objects.projects.highly_sensitive.read": "",
+        "crm.objects.projects.highly_sensitive.write": "",
+        "crm.objects.projects.read": "",
+        "crm.objects.projects.sensitive.read": "",
+        "crm.objects.projects.sensitive.write": "",
+        "crm.objects.projects.write": "",
+        "crm.objects.quotes.read": "",
+        "crm.objects.quotes.write": "",
+        "crm.objects.services.read": "",
+        "crm.objects.services.write": "",
+        "crm.objects.subscriptions.read": "",
+        "crm.objects.subscriptions.write": "",
+        "crm.objects.tasks.read": "",
+        "crm.objects.tickets.highly_sensitive.read": "",
+        "crm.objects.tickets.highly_sensitive.write": "",
+        "crm.objects.tickets.sensitive.read": "",
+        "crm.objects.tickets.sensitive.write": "",
+        "crm.objects.users.read": "",
+        "crm.objects.users.write": "",
+        "crm.pipelines.approval.read": "",
+        "crm.pipelines.governance.write": "",
+        "crm.pipelines.orders.read": "",
+        "crm.pipelines.orders.write": "",
+        "crm.schemas.appointments.read": "",
+        "crm.schemas.appointments.write": "",
+        "crm.schemas.calls.read": "",
+        "crm.schemas.calls.write": "",
+        "crm.schemas.carts.read": "",
+        "crm.schemas.carts.write": "",
+        "crm.schemas.commercepayments.read": "",
+        "crm.schemas.commercepayments.write": "",
+        "crm.schemas.companies.read": "",
+        "crm.schemas.companies.write": "",
+        "crm.schemas.contacts.read": "",
+        "crm.schemas.contacts.write": "",
+        "crm.schemas.courses.read": "",
+        "crm.schemas.courses.write": "",
+        "crm.schemas.custom.read": "",
+        "crm.schemas.custom.write": "",
+        "crm.schemas.deals.read": "",
+        "crm.schemas.deals.write": "",
+        "crm.schemas.emails.read": "",
+        "crm.schemas.emails.write": "",
+        "crm.schemas.invoices.read": "",
+        "crm.schemas.invoices.write": "",
+        "crm.schemas.line_items.read": "",
+        "crm.schemas.listings.read": "",
+        "crm.schemas.listings.write": "",
+        "crm.schemas.meetings.read": "",
+        "crm.schemas.meetings.write": "",
+        "crm.schemas.notes.read": "",
+        "crm.schemas.notes.write": "",
+        "crm.schemas.orders.read": "",
+        "crm.schemas.orders.write": "",
+        "crm.schemas.projects.read": "",
+        "crm.schemas.quotes.read": "",
+        "crm.schemas.quotes.write": "",
+        "crm.schemas.services.read": "",
+        "crm.schemas.services.write": "",
+        "crm.schemas.subscriptions.read": "",
+        "crm.schemas.subscriptions.write": "",
+        "crm.schemas.tasks.read": "",
+        "crm.schemas.tasks.write": "",
+        "e-commerce": "",
+        "media_bridge.read": "",
+        "tickets.highly_sensitive.v2": "",
+        "tickets.sensitive.v2": ""
+      },
+      "why": "The nine documents describe one OAuth scheme (each names the same authorizationUrl, app.hubspot.com/oauth/authorize, and tokenUrl, api.hubapi.com/oauth/v1/token), and each lists only the scopes its own operations' security names: the CRM object documents omit the crm.schemas.* scopes, Properties and Pipelines omit crm.objects.partner-clients.*, crm.objects.partner-services.*, crm.objects.products.read and crm.objects.commercepayments.read, Crm Owners lists four, and Oauth none. No list refuses a scope another grants, so the lists are partial catalogues of one scheme, not a contradiction: the scheme's scopes are their union (130 scopes), written here on the first document and copied to the other eight below. Evidence: the spec's own words, the Crm Owners document naming crm.pipelines.governance.write, which only it lists.",
+      "source": {
+        "spec": "/documents/owners/components/securitySchemes/oauth2",
+        "quote": "crm.pipelines.governance.write"
+      }
+    },
+    {
+      "op": "copy",
+      "from": "/documents/associations/components/securitySchemes/oauth2/flows/authorizationCode/scopes",
+      "path": "/documents/companies/components/securitySchemes/oauth2/flows/authorizationCode/scopes",
+      "why": "One OAuth scheme across the nine documents (the first patch's reason): the companies document's partial list of scopes becomes the union, so the documents agree.",
+      "source": {
+        "spec": "/documents/companies/components/securitySchemes/oauth2/flows/authorizationCode",
+        "quote": "https://api.hubapi.com/oauth/v1/token"
+      }
+    },
+    {
+      "op": "copy",
+      "from": "/documents/associations/components/securitySchemes/oauth2/flows/authorizationCode/scopes",
+      "path": "/documents/contacts/components/securitySchemes/oauth2/flows/authorizationCode/scopes",
+      "why": "One OAuth scheme across the nine documents (the first patch's reason): the contacts document's partial list of scopes becomes the union, so the documents agree.",
+      "source": {
+        "spec": "/documents/contacts/components/securitySchemes/oauth2/flows/authorizationCode",
+        "quote": "https://api.hubapi.com/oauth/v1/token"
+      }
+    },
+    {
+      "op": "copy",
+      "from": "/documents/associations/components/securitySchemes/oauth2/flows/authorizationCode/scopes",
+      "path": "/documents/deals/components/securitySchemes/oauth2/flows/authorizationCode/scopes",
+      "why": "One OAuth scheme across the nine documents (the first patch's reason): the deals document's partial list of scopes becomes the union, so the documents agree.",
+      "source": {
+        "spec": "/documents/deals/components/securitySchemes/oauth2/flows/authorizationCode",
+        "quote": "https://api.hubapi.com/oauth/v1/token"
+      }
+    },
+    {
+      "op": "copy",
+      "from": "/documents/associations/components/securitySchemes/oauth2/flows/authorizationCode/scopes",
+      "path": "/documents/oauth/components/securitySchemes/oauth2/flows/authorizationCode/scopes",
+      "why": "One OAuth scheme across the nine documents (the first patch's reason): the oauth document's partial list of scopes becomes the union, so the documents agree.",
+      "source": {
+        "spec": "/documents/oauth/components/securitySchemes/oauth2/flows/authorizationCode",
+        "quote": "https://api.hubapi.com/oauth/v1/token"
+      }
+    },
+    {
+      "op": "copy",
+      "from": "/documents/associations/components/securitySchemes/oauth2/flows/authorizationCode/scopes",
+      "path": "/documents/owners/components/securitySchemes/oauth2/flows/authorizationCode/scopes",
+      "why": "One OAuth scheme across the nine documents (the first patch's reason): the owners document's partial list of scopes becomes the union, so the documents agree.",
+      "source": {
+        "spec": "/documents/owners/components/securitySchemes/oauth2/flows/authorizationCode",
+        "quote": "https://api.hubapi.com/oauth/v1/token"
+      }
+    },
+    {
+      "op": "copy",
+      "from": "/documents/associations/components/securitySchemes/oauth2/flows/authorizationCode/scopes",
+      "path": "/documents/pipelines/components/securitySchemes/oauth2/flows/authorizationCode/scopes",
+      "why": "One OAuth scheme across the nine documents (the first patch's reason): the pipelines document's partial list of scopes becomes the union, so the documents agree.",
+      "source": {
+        "spec": "/documents/pipelines/components/securitySchemes/oauth2/flows/authorizationCode",
+        "quote": "https://api.hubapi.com/oauth/v1/token"
+      }
+    },
+    {
+      "op": "copy",
+      "from": "/documents/associations/components/securitySchemes/oauth2/flows/authorizationCode/scopes",
+      "path": "/documents/properties/components/securitySchemes/oauth2/flows/authorizationCode/scopes",
+      "why": "One OAuth scheme across the nine documents (the first patch's reason): the properties document's partial list of scopes becomes the union, so the documents agree.",
+      "source": {
+        "spec": "/documents/properties/components/securitySchemes/oauth2/flows/authorizationCode",
+        "quote": "https://api.hubapi.com/oauth/v1/token"
+      }
+    },
+    {
+      "op": "copy",
+      "from": "/documents/associations/components/securitySchemes/oauth2/flows/authorizationCode/scopes",
+      "path": "/documents/tickets/components/securitySchemes/oauth2/flows/authorizationCode/scopes",
+      "why": "One OAuth scheme across the nine documents (the first patch's reason): the tickets document's partial list of scopes becomes the union, so the documents agree.",
+      "source": {
+        "spec": "/documents/tickets/components/securitySchemes/oauth2/flows/authorizationCode",
+        "quote": "https://api.hubapi.com/oauth/v1/token"
+      }
+    },
+    {
+      "op": "copy",
+      "from": "/documents/associations/components/securitySchemes/oauth2/flows/authorizationCode/scopes",
+      "path": "/documents/meetings/components/securitySchemes/oauth2/flows/authorizationCode/scopes",
+      "why": "One OAuth scheme across the documents (the first patch's reason): the Meetings document, vendored after the others for cal.com's meetings, lists only its own operations' scopes (79, each in the union), so its partial list becomes the union and the documents agree.",
+      "source": {
+        "spec": "/documents/meetings/components/securitySchemes/oauth2/flows/authorizationCode",
+        "quote": "https://api.hubapi.com/oauth/v1/token"
+      }
+    }
+  ]
+}

package/dist/spec/sources.json

@@ -0,0 +1,32 @@
+{
+  "https://developers.hubspot.com/docs/api-reference/error-handling": {
+    "status": 200,
+    "checked": "2026-10-03",
+    "quotes": {
+      "return a JSON formatted response with details about the error": true,
+      "Returned when the authentication provided is invalid.": true
+    }
+  },
+  "https://developers.hubspot.com/docs/api-reference/webhooks-webhooks-v3/guide": {
+    "status": 200,
+    "checked": "2026-10-03",
+    "quotes": {
+      "404 Not Found : requested resource not found": true,
+      "Authorization : Bearer YOUR_ACCESS_TOKEN": true
+    }
+  },
+  "https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines": {
+    "status": 200,
+    "checked": "2026-10-03",
+    "quotes": {
+      "110 requests every 10 seconds": true
+    }
+  },
+  "https://raw.githubusercontent.com/dubinc/dub/7e0101363b2ab30afc537c1893f159d1dcba513a/apps/web/lib/integrations/hubspot/oauth.ts": {
+    "status": 200,
+    "checked": "2026-10-03",
+    "quotes": {
+      "process.env.HUBSPOT_CLIENT_ID": true
+    }
+  }
+}

package/dist/src/cli.js

@@ -1,31 +1,19 @@
 #!/usr/bin/env node
-import { keepProcessAlive } from '@volter/world-core/lifecycle';
-// world-hubspot CLI: serve the HubSpot CRM API twin, the CRM mirror UI, or run conformance.
+// world-hubspot: serve the hubspot twin.
 import { hasFlag, optionValue } from '@volter/world-core/args';
-import { createHubspotTwinServer } from "./hubspot-server.js";
-import { createHubspotMirrorServer } from "./hubspot-mirror-ui.js";
+import { keepProcessAlive } from '@volter/world-core/lifecycle';
+import { createHubspotTwinServer } from "./server.js";
 const [cmd, ...rest] = process.argv.slice(2);
 const port = Number(optionValue(rest, '--port', '0')) || undefined;
 const root = optionValue(rest, '--root') || undefined;
-const readOnly = hasFlag(rest, '--read-only'); // a twin accepts writes unless started read-only
-if (cmd === 'serve') {
-    const s = await createHubspotTwinServer({ readOnly, ...(root ? { root } : {}), ...(port ? { port } : {}) });
-    process.stdout.write(`hubspot twin (CRM v3/v4)${readOnly ? ' [read-only]' : ''} at ${s.url}\n`);
+const readOnly = hasFlag(rest, '--read-only');
+// the World's managed Postgres, which the runtime binds a pack declaring managedDatabase to
+const database = optionValue(rest, '--database') || undefined;
+if (cmd === 'serve' || cmd === undefined) {
+    const s = await createHubspotTwinServer({ readOnly, ...(root ? { root } : {}), ...(port ? { port } : {}), ...(database ? { database } : {}) });
+    process.stdout.write(`hubspot twin${readOnly ? ' [read-only]' : ''} at http://127.0.0.1:${s.port}\n`);
     await keepProcessAlive();
 }
-else if (cmd === 'mirror') {
-    const s = await createHubspotMirrorServer({ ...(root ? { root } : {}), ...(port ? { port } : {}) });
-    process.stdout.write(`hubspot mirror UI (CRM) at ${s.url}\n`);
-    await keepProcessAlive();
-}
-else if (cmd === 'conformance') {
-    // dev-only; lazy so the bin runs without @volter/world-tooling in the runtime graph
-    const { checkHubspotConformance } = await import("./hubspot-conformance.js");
-    const report = await checkHubspotConformance({ ...(root ? { root } : {}) });
-    process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
-    if (!report.ok)
-        process.exitCode = 1;
-}
 else {
-    process.stdout.write('Usage: world-hubspot serve|mirror|conformance [--port N] [--root DIR] [--read-only]\n');
+    process.stdout.write('Usage: world-hubspot serve [--port N] [--root DIR] [--read-only] [--database URL]\n');
 }