@volter/twin-hubspot 0.1.37 → 1.0.0

package/dist/src/screens/forms.js

@@ -1,126 +0,0 @@
-// HUBSPOT FORMS — an account's forms, built on its form builder and filled in on a website
-// (https://knowledge.hubspot.com/forms/create-forms; Dub's guide, https://dub.co/docs/integrations/hubspot, "Option 1: Using HubSpot
-// Forms": "In the HubSpot form builder, add a hidden field and map it to the **Dub Id** contact property").
-//
-// - app.hubspot.com/forms/:hubId: the account's forms, and **Create form** with its name (a form starts with Email,
-//   First name and Last name, contact fields).
-// - app.hubspot.com/forms/:hubId/editor/:formGuid/edit: the form's fields, and **Add hidden field** mapped to a contact
-//   property a form may use (a property with `formField`, as Dub makes its Dub Click ID: `formField: true`, "Allow the
-//   property to be used in a HubSpot form").
-// - POST https://api.hsforms.com/submissions/v3/integration/submit/:portalId/:formGuid: a visitor's submission, as HubSpot's
-//   Forms API takes it ("Submit data to a form (unauthenticated)",
-//   https://developers.hubspot.com/docs/api-reference/legacy/marketing/forms/v3-legacy/submit-data-unauthenticated):
-//   `fields`, each `{objectTypeId, name, value}`, and `context`; a field the form does not have is refused
-//   (`FIELD_NOT_IN_FORM_DEFINITION`), and an accepted submission answers `inlineMessage`. It makes or updates the
-//   contact with that email in the form's account (portal.ts: `FORM`), whose webhook events follow.
-//
-// Where the documentation stops and the twin decides: the builder's paths and layout; a new form's three fields and its
-// thank-you message ("Thanks for submitting the form."); the embed Dub's guide puts on a site (js.hsforms.net) submits
-// through a request HubSpot does not document, so a visitor's submission is the Forms API's documented one; a submission
-// without an email, or with one that is not an address, is refused as `INVALID_EMAIL`; a contact is found by its email
-// to be updated, as HubSpot deduplicates contacts by email.
-import { accountOf, hex, keep, stored } from "../accounts.js";
-import { handleHubspotTwinRequest } from "../hubspot-twin.js";
-import { inPortal } from "../portal.js";
-import { formOf, personFor, portalPage, redirect, who } from "./page.js";
-export const FORMS_HOST = 'api.hsforms.com';
-const DEFAULT_FIELDS = [
-    { name: 'email', label: 'Email', hidden: false },
-    { name: 'firstname', label: 'First name', hidden: false },
-    { name: 'lastname', label: 'Last name', hidden: false },
-];
-const formsOf = (hub, root) => stored('_form', root).filter((f) => f.hubId === hub && !f.archived);
-const uuid = (seed) => { const h = hex(seed); return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`; };
-/** app.hubspot.com/forms/…, or undefined for another path. */
-export async function formPages(request, root, at) {
-    const path = new URL(request.url).pathname.replace(/\/+$/, '');
-    const m = /^\/forms\/(\d+)(?:\/editor\/([0-9a-f-]+)\/edit)?$/.exec(path);
-    if (!m)
-        return undefined;
-    const hub = Number(m[1]);
-    const got = personFor(request, hub, root);
-    if (got instanceof Response)
-        return got;
-    const { person, account } = got;
-    const actor = String(person.email);
-    if (!m[2]) {
-        if (request.method === 'POST') {
-            const name = ((await formOf(request)).name ?? '').trim();
-            if (!name)
-                return listPage(hub, account, person, root, 'A form needs a name.', 422);
-            const guid = uuid(`hubspot-form:${hub}:${name}:${at}`);
-            await keep('_form', `form:${guid}`, { guid, hubId: hub, name, fields: DEFAULT_FIELDS, created_at: at, created_by: actor, archived: false }, root, at, actor);
-            return redirect(`/forms/${hub}/editor/${guid}/edit`);
-        }
-        return listPage(hub, account, person, root);
-    }
-    const form = formsOf(hub, root).find((f) => f.guid === m[2]);
-    if (!form)
-        return portalPage('Forms', { merchant: who(account, person), notice: 'This form does not exist.', sections: [] }, 404);
-    const properties = await inPortal({ hub, source: 'CRM_UI' }, () => handleHubspotTwinRequest({ method: 'GET', path: '/crm/v3/properties/contacts', root, occurredAt: at }));
-    const usable = (properties.body.results ?? []).filter((p) => p.formField === true && p.archived !== true);
-    let notice;
-    if (request.method === 'POST') {
-        const wanted = (await formOf(request)).property;
-        const property = usable.find((p) => p.name === wanted);
-        const fields = form.fields;
-        if (!property)
-            notice = 'Choose a contact property that can be used in forms.';
-        else if (fields.some((f) => f.name === property.name))
-            notice = `${String(property.label)} is already on this form.`;
-        else {
-            await keep('_form', `form:${String(form.guid)}`, { ...form, fields: [...fields, { name: property.name, label: property.label, hidden: true }], updated_at: at }, root, at, actor);
-            return redirect(`/forms/${hub}/editor/${String(form.guid)}/edit`);
-        }
-    }
-    return portalPage(String(form.name), { merchant: who(account, person), back: { href: `/forms/${hub}`, label: 'Forms' }, ...(notice ? { notice } : {}),
-        sections: [{ heading: 'Fields', items: form.fields.map((f) => ({ title: String(f.label), detail: String(f.name), ...(f.hidden ? { badge: 'Hidden' } : {}) })) },
-            { heading: 'Embed', items: [{ title: 'Form ID', detail: String(form.guid) }, { title: 'Portal ID', detail: String(hub) }] }],
-        forms: [{ heading: 'Add hidden field', action: `/forms/${hub}/editor/${String(form.guid)}/edit`, submit: { label: 'Add' },
-                fields: [{ id: 'property', label: 'Contact property', options: usable.map((p) => ({ value: String(p.name), label: String(p.label) })) }] }] });
-}
-function listPage(hub, account, person, root, notice, status = 200) {
-    return portalPage('Forms', { merchant: who(account, person), ...(notice ? { notice } : {}),
-        sections: [{ heading: 'Forms', empty: 'No forms yet.', items: formsOf(hub, root).map((f) => ({ title: String(f.name), detail: String(f.guid), actions: [{ label: 'Edit', action: `/forms/${hub}/editor/${String(f.guid)}/edit`, method: 'get' }] })) }],
-        forms: [{ heading: 'Create form', action: `/forms/${hub}`, submit: { label: 'Create form' }, fields: [{ id: 'name', label: 'Form name' }] }] }, status);
-}
-const submitError = (errorType, message) => Response.json({ status: 'error', message: 'The request is not valid', errors: [{ message, errorType }] }, { status: 400 });
-/** api.hsforms.com's submission, or undefined for another request. */
-export async function formSubmission(request, root, at) {
-    const m = /^\/submissions\/v3\/integration\/submit\/(\d+)\/([0-9a-f-]+)$/.exec(new URL(request.url).pathname.replace(/\/+$/, ''));
-    if (!m || request.method !== 'POST')
-        return undefined;
-    const hub = Number(m[1]);
-    const form = accountOf(hub, root)?.closed_at ? undefined : formsOf(hub, root).find((f) => f.guid === m[2]);
-    if (!form)
-        return Response.json({ status: 'error', message: 'Form not found', category: 'OBJECT_NOT_FOUND' }, { status: 404 });
-    let body = {};
-    try {
-        body = JSON.parse(await request.text());
-    }
-    catch {
-        return submitError('INVALID_METADATA', 'The request body is not valid JSON.');
-    }
-    const fields = Array.isArray(body.fields) ? body.fields : [];
-    const names = new Set(form.fields.map((f) => String(f.name)));
-    const properties = {};
-    for (const f of fields) {
-        if (!names.has(String(f.name)))
-            return submitError('FIELD_NOT_IN_FORM_DEFINITION', `${String(f.name)} is not a field of this form.`);
-        properties[String(f.name)] = String(f.value ?? '');
-    }
-    const email = (properties.email ?? '').trim().toLowerCase();
-    if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email))
-        return submitError('INVALID_EMAIL', 'Email address is invalid.');
-    properties.email = email;
-    await inPortal({ hub, source: 'FORM', sourceId: String(form.guid) }, async () => {
-        const found = await handleHubspotTwinRequest({ method: 'POST', path: '/crm/v3/objects/contacts/search', body: JSON.stringify({ filterGroups: [{ filters: [{ propertyName: 'email', operator: 'EQ', value: email }] }], limit: 1 }), root, occurredAt: at });
-        const id = ((found.body.results ?? [])[0])?.id;
-        await handleHubspotTwinRequest(id === undefined
-            ? { method: 'POST', path: '/crm/v3/objects/contacts', body: JSON.stringify({ properties }), root, occurredAt: at }
-            : { method: 'PATCH', path: `/crm/v3/objects/contacts/${String(id)}`, body: JSON.stringify({ properties }), root, occurredAt: at });
-    });
-    const n = stored('_form_submission', root).length + 1;
-    await keep('_form_submission', `submission:${n}`, { n, formGuid: form.guid, hubId: hub, fields, context: body.context ?? null, submitted_at: at }, root, at, email);
-    return Response.json({ inlineMessage: 'Thanks for submitting the form.' });
-}

package/dist/src/screens/page.d.ts

@@ -1,21 +0,0 @@
-import type { ReactElement } from 'react';
-import { type PortalProps } from '@volter/world-ui';
-import { type Row } from '../accounts.js';
-export declare const SKIN = "\nbody { background: #ffffff; color: #33475b; font-family: \"Lexend Deca\", Helvetica, Arial, sans-serif; }\n.sign-in-mark, .consent-vendor { background: #ff7a59; }\n.sign-in-box, .consent-box { background: #ffffff; border-color: #cbd6e2; }\n.sign-in-error { background: #fdedee; border-color: #f2545b; }\n.sign-in-submit, .consent-allow, .portal-primary { background: #ff7a59; border-color: #ff7a59; color: #ffffff; }\n.consent-badge { background: #f5f8fa; border: 1px solid #cbd6e2; color: #33475b; }\n.consent-link, .consent-actions { border-color: #cbd6e2; }\n.consent-who small, .consent-permission summary small, .consent-note { color: #516f90; }\n.consent-deny { background: #ffffff; border-color: #cbd6e2; color: #33475b; }\n.portal-side { background: #f5f8fa; border-right: 1px solid #cbd6e2; }\n.portal-section h2 { border-color: #cbd6e2; color: #516f90; }\n.portal-notice { background: #e5f5f8; border: 1px solid #7fd1de; word-break: break-all; }\n.portal-button { background: #ffffff; border-color: #cbd6e2; color: #33475b; }\n.portal-danger { color: #d94c53; }\n";
-export declare const CSS: {
-    signIn: string[];
-    consent: string[];
-    portal: string[];
-};
-/** A settings or record page: the account and person on the left, the page's sections and forms. */
-export declare function portalPage(title: string, props: PortalProps, status?: number): Response;
-export declare function page(title: string, css: string[], body: ReactElement, status?: number): Response;
-export declare function redirect(location: string): Response;
-export declare function formOf(request: Request): Promise<Record<string, string>>;
-/** The person a page needs, signed in to the account the page is of; a redirect to the sign-in, or a refusal, if not. */
-export declare function personFor(request: Request, hubId: number | undefined, root?: string): {
-    person: Row;
-    account: Row;
-} | Response;
-/** The left column every account page carries. */
-export declare const who: (account: Row, person: Row) => string;

package/dist/src/screens/page.js

@@ -1,49 +0,0 @@
-import { jsx as _jsx } from "react/jsx-runtime";
-import { CONSENT_CSS, flowPage, Portal, PORTAL_CSS, SIGN_IN_CSS } from '@volter/world-ui';
-import { accountOf, signedIn } from "../accounts.js";
-// HubSpot's skin: its slate ink, light grey panels and orange primary buttons
-export const SKIN = `
-body { background: #ffffff; color: #33475b; font-family: "Lexend Deca", Helvetica, Arial, sans-serif; }
-.sign-in-mark, .consent-vendor { background: #ff7a59; }
-.sign-in-box, .consent-box { background: #ffffff; border-color: #cbd6e2; }
-.sign-in-error { background: #fdedee; border-color: #f2545b; }
-.sign-in-submit, .consent-allow, .portal-primary { background: #ff7a59; border-color: #ff7a59; color: #ffffff; }
-.consent-badge { background: #f5f8fa; border: 1px solid #cbd6e2; color: #33475b; }
-.consent-link, .consent-actions { border-color: #cbd6e2; }
-.consent-who small, .consent-permission summary small, .consent-note { color: #516f90; }
-.consent-deny { background: #ffffff; border-color: #cbd6e2; color: #33475b; }
-.portal-side { background: #f5f8fa; border-right: 1px solid #cbd6e2; }
-.portal-section h2 { border-color: #cbd6e2; color: #516f90; }
-.portal-notice { background: #e5f5f8; border: 1px solid #7fd1de; word-break: break-all; }
-.portal-button { background: #ffffff; border-color: #cbd6e2; color: #33475b; }
-.portal-danger { color: #d94c53; }
-`;
-export const CSS = { signIn: [SIGN_IN_CSS, SKIN], consent: [CONSENT_CSS, SKIN], portal: [PORTAL_CSS, SKIN] };
-/** A settings or record page: the account and person on the left, the page's sections and forms. */
-export function portalPage(title, props, status = 200) {
-    return flowPage({ title: `${title} | HubSpot`, css: CSS.portal, status, body: _jsx(Portal, { ...props }) });
-}
-export function page(title, css, body, status = 200) {
-    return flowPage({ title: `${title} | HubSpot`, css, status, body });
-}
-export function redirect(location) {
-    return new Response(null, { status: 302, headers: { location } });
-}
-export async function formOf(request) {
-    return Object.fromEntries(new URLSearchParams(await request.text()));
-}
-/** The person a page needs, signed in to the account the page is of; a redirect to the sign-in, or a refusal, if not. */
-export function personFor(request, hubId, root) {
-    const person = signedIn(request, root);
-    const url = new URL(request.url);
-    if (!person)
-        return redirect(`/login?loginRedirectUrl=${encodeURIComponent(url.pathname + url.search)}`);
-    const account = accountOf(Number(person.hubId), root);
-    if (!account || (hubId !== undefined && Number(person.hubId) !== hubId))
-        return page('HubSpot', CSS.portal, _jsx("main", { className: "portal-main", children: _jsx("h1", { children: "You don't have access to this account." }) }), 403);
-    if (account.closed_at)
-        return page('HubSpot', CSS.portal, _jsx("main", { className: "portal-main", children: _jsx("h1", { children: "This account has been closed." }) }), 403);
-    return { person, account };
-}
-/** The left column every account page carries. */
-export const who = (account, person) => `${String(account.name)} · ${String(person.email)}`;

package/dist/src/screens/session.d.ts

@@ -1 +0,0 @@
-export declare function signIn(request: Request, root: string | undefined, at: string): Promise<Response>;

package/dist/src/screens/session.js

@@ -1,32 +0,0 @@
-import { jsx as _jsx } from "react/jsx-runtime";
-// HUBSPOT'S SIGN-IN — app.hubspot.com/login (docs/contributing/architecture.md, "Who is on a screen"): a person gives
-// the email and password the World gave them (accounts.ts's sign-up door), and the session cookie names them to every
-// page after; a page asked for by nobody signed in sends its visitor here with `loginRedirectUrl`, and the sign-in returns
-// them there. Built from @volter/world-ui's sign-in under HubSpot's skin.
-//
-// Where the documentation stops and the twin decides: the cookie is `hs_session`; a refused sign-in shows the form again
-// with "The email or password you entered is incorrect." (200); HubSpot's own sign-in also offers Google, Microsoft and
-// single sign-on, which the twin does not model.
-import { SignIn } from '@volter/world-ui';
-import { hex, keep, passwordHash, personOf, SESSION_COOKIE, stored } from "../accounts.js";
-import { CSS, formOf, page } from "./page.js";
-/** A return address on app.hubspot.com, never another site. */
-const back = (raw) => (raw && raw.startsWith('/') && !raw.startsWith('//') ? raw : '/');
-function signInPage(to, email, error) {
-    return page('Log in', CSS.signIn, (_jsx(SignIn, { heading: "Log in to HubSpot", action: "/login", fields: { loginRedirectUrl: to }, account: { name: 'email', label: 'Email address', ...(email ? { value: email } : {}) }, password: { name: 'password', label: 'Password' }, submit: "Log in", ...(error ? { error } : {}) })));
-}
-export async function signIn(request, root, at) {
-    if (request.method === 'GET')
-        return signInPage(back(new URL(request.url).searchParams.get('loginRedirectUrl')));
-    const f = await formOf(request);
-    const email = (f.email ?? '').trim().toLowerCase();
-    const to = back(f.loginRedirectUrl);
-    const person = personOf(email, root);
-    if (!person || person.hash !== passwordHash(email, f.password ?? ''))
-        return signInPage(to, email, 'The email or password you entered is incorrect.');
-    const token = hex(`hubspot-session:${email}:${at}:${stored('_web_session', root).length + 1}`).slice(0, 40);
-    await keep('_web_session', `session:${token}`, { token, email, created_at: at }, root, at, email);
-    const headers = new Headers({ location: to });
-    headers.append('set-cookie', `${SESSION_COOKIE}=${token}; Path=/; HttpOnly; Secure; SameSite=Lax`);
-    return new Response(null, { status: 302, headers });
-}

package/dist/src/semantics/crm.d.ts

@@ -1,8 +0,0 @@
-import type { DerivedHandler } from '@volter/world-core';
-/** The operations served by the pack's request handler, every CRM operation the twin serves. */
-export declare const CRM_HANDLED: readonly ["delete-/crm/v3/objects/0-3/{dealId}_archive", "delete-/crm/v3/objects/companies/{companyId}_archive", "delete-/crm/v3/objects/contacts/{contactId}_archive", "delete-/crm/v3/objects/tickets/{ticketId}_archive", "get-/crm/v3/objects/0-3_getPage", "get-/crm/v3/objects/0-3/{dealId}_getById", "get-/crm/v3/objects/companies_getPage", "get-/crm/v3/objects/companies/{companyId}_getById", "get-/crm/v3/objects/contacts_getPage", "get-/crm/v3/objects/contacts/{contactId}_getById", "get-/crm/v3/objects/tickets_getPage", "get-/crm/v3/objects/tickets/{ticketId}_getById", "patch-/crm/v3/objects/0-3/{dealId}_update", "patch-/crm/v3/objects/companies/{companyId}_update", "patch-/crm/v3/objects/contacts/{contactId}_update", "patch-/crm/v3/objects/tickets/{ticketId}_update", "post-/crm/v3/objects/0-3_create", "post-/crm/v3/objects/0-3/batch/archive_archive", "post-/crm/v3/objects/0-3/batch/create_create", "post-/crm/v3/objects/0-3/batch/read_read", "post-/crm/v3/objects/0-3/batch/update_update", "post-/crm/v3/objects/0-3/batch/upsert_upsert", "post-/crm/v3/objects/0-3/merge_merge", "post-/crm/v3/objects/0-3/search_doSearch", "post-/crm/v3/objects/companies_create", "post-/crm/v3/objects/companies/batch/archive_archive", "post-/crm/v3/objects/companies/batch/create_create", "post-/crm/v3/objects/companies/batch/read_read", "post-/crm/v3/objects/companies/batch/update_update", "post-/crm/v3/objects/companies/batch/upsert_upsert", "post-/crm/v3/objects/companies/merge_merge", "post-/crm/v3/objects/companies/search_doSearch", "post-/crm/v3/objects/contacts_create", "post-/crm/v3/objects/contacts/batch/archive_archive", "post-/crm/v3/objects/contacts/batch/create_create", "post-/crm/v3/objects/contacts/batch/read_read", "post-/crm/v3/objects/contacts/batch/update_update", "post-/crm/v3/objects/contacts/batch/upsert_upsert", "post-/crm/v3/objects/contacts/merge_merge", "post-/crm/v3/objects/contacts/search_doSearch", "post-/crm/v3/objects/tickets_create", "post-/crm/v3/objects/tickets/batch/archive_archive", "post-/crm/v3/objects/tickets/batch/create_create", "post-/crm/v3/objects/tickets/batch/read_read", "post-/crm/v3/objects/tickets/batch/update_update", "post-/crm/v3/objects/tickets/batch/upsert_upsert", "post-/crm/v3/objects/tickets/merge_merge", "post-/crm/v3/objects/tickets/search_doSearch", "get-/crm/v3/owners/{ownerId}_getById", "get-/crm/v3/owners_/crm/v3/owners", "delete-/crm/v3/pipelines/{objectType}/{pipelineId}_archive", "delete-/crm/v3/pipelines/{objectType}/{pipelineId}/stages/{stageId}_archive", "get-/crm/v3/pipelines/{objectType}_getAll", "get-/crm/v3/pipelines/{objectType}/{pipelineId}_getById", "get-/crm/v3/pipelines/{objectType}/{pipelineId}/stages_getAll", "get-/crm/v3/pipelines/{objectType}/{pipelineId}/stages/{stageId}_getById", "patch-/crm/v3/pipelines/{objectType}/{pipelineId}_update", "patch-/crm/v3/pipelines/{objectType}/{pipelineId}/stages/{stageId}_update", "post-/crm/v3/pipelines/{objectType}_create", "post-/crm/v3/pipelines/{objectType}/{pipelineId}/stages_create", "put-/crm/v3/pipelines/{objectType}/{pipelineId}_replace", "put-/crm/v3/pipelines/{objectType}/{pipelineId}/stages/{stageId}_replace", "delete-/crm/v3/properties/{objectType}/{propertyName}_archive", "delete-/crm/v3/properties/{objectType}/groups/{groupName}_archive", "get-/crm/v3/properties/{objectType}_getAll", "get-/crm/v3/properties/{objectType}/{propertyName}_getByName", "get-/crm/v3/properties/{objectType}/groups_getAll", "get-/crm/v3/properties/{objectType}/groups/{groupName}_getByName", "patch-/crm/v3/properties/{objectType}/{propertyName}_update", "patch-/crm/v3/properties/{objectType}/groups/{groupName}_update", "post-/crm/v3/properties/{objectType}_create", "post-/crm/v3/properties/{objectType}/batch/create_create", "post-/crm/v3/properties/{objectType}/groups_create", "post-/crm/v4/associations/{fromObjectType}/{toObjectType}/batch/archive_archive", "post-/crm/v4/associations/{fromObjectType}/{toObjectType}/batch/create_create", "post-/crm/v4/associations/{fromObjectType}/{toObjectType}/batch/read_getPage", "delete-/crm/v4/objects/{objectType}/{objectId}/associations/{toObjectType}/{toObjectId}_archive", "get-/crm/v4/objects/{objectType}/{objectId}/associations/{toObjectType}_getPage", "put-/crm/v4/objects/{fromObjectType}/{fromObjectId}/associations/default/{toObjectType}/{toObjectId}_createDefault", "put-/crm/v4/objects/{objectType}/{objectId}/associations/{toObjectType}/{toObjectId}_create"];
-/** The operations served by the OAuth install's token endpoints. */
-export declare const OAUTH_HANDLED: readonly ["get-/oauth/v1/access-tokens/{token}_get", "post-/oauth/v1/token_create"];
-/** A handler per operation above: the CRM ones answer through `answer` (the pack's request handler as a fetch), the
- *  OAuth ones through `oauth`. */
-export declare function hubspotHandlers(answer: (request: Request) => Promise<Response>, oauth: (request: Request) => Promise<Response>): Record<string, DerivedHandler>;

package/dist/src/semantics/crm.js

@@ -1,101 +0,0 @@
-/** The operations served by the pack's request handler, every CRM operation the twin serves. */
-export const CRM_HANDLED = [
-    // /crm/v3/objects
-    'delete-/crm/v3/objects/0-3/{dealId}_archive',
-    'delete-/crm/v3/objects/companies/{companyId}_archive',
-    'delete-/crm/v3/objects/contacts/{contactId}_archive',
-    'delete-/crm/v3/objects/tickets/{ticketId}_archive',
-    'get-/crm/v3/objects/0-3_getPage',
-    'get-/crm/v3/objects/0-3/{dealId}_getById',
-    'get-/crm/v3/objects/companies_getPage',
-    'get-/crm/v3/objects/companies/{companyId}_getById',
-    'get-/crm/v3/objects/contacts_getPage',
-    'get-/crm/v3/objects/contacts/{contactId}_getById',
-    'get-/crm/v3/objects/tickets_getPage',
-    'get-/crm/v3/objects/tickets/{ticketId}_getById',
-    'patch-/crm/v3/objects/0-3/{dealId}_update',
-    'patch-/crm/v3/objects/companies/{companyId}_update',
-    'patch-/crm/v3/objects/contacts/{contactId}_update',
-    'patch-/crm/v3/objects/tickets/{ticketId}_update',
-    'post-/crm/v3/objects/0-3_create',
-    'post-/crm/v3/objects/0-3/batch/archive_archive',
-    'post-/crm/v3/objects/0-3/batch/create_create',
-    'post-/crm/v3/objects/0-3/batch/read_read',
-    'post-/crm/v3/objects/0-3/batch/update_update',
-    'post-/crm/v3/objects/0-3/batch/upsert_upsert',
-    'post-/crm/v3/objects/0-3/merge_merge',
-    'post-/crm/v3/objects/0-3/search_doSearch',
-    'post-/crm/v3/objects/companies_create',
-    'post-/crm/v3/objects/companies/batch/archive_archive',
-    'post-/crm/v3/objects/companies/batch/create_create',
-    'post-/crm/v3/objects/companies/batch/read_read',
-    'post-/crm/v3/objects/companies/batch/update_update',
-    'post-/crm/v3/objects/companies/batch/upsert_upsert',
-    'post-/crm/v3/objects/companies/merge_merge',
-    'post-/crm/v3/objects/companies/search_doSearch',
-    'post-/crm/v3/objects/contacts_create',
-    'post-/crm/v3/objects/contacts/batch/archive_archive',
-    'post-/crm/v3/objects/contacts/batch/create_create',
-    'post-/crm/v3/objects/contacts/batch/read_read',
-    'post-/crm/v3/objects/contacts/batch/update_update',
-    'post-/crm/v3/objects/contacts/batch/upsert_upsert',
-    'post-/crm/v3/objects/contacts/merge_merge',
-    'post-/crm/v3/objects/contacts/search_doSearch',
-    'post-/crm/v3/objects/tickets_create',
-    'post-/crm/v3/objects/tickets/batch/archive_archive',
-    'post-/crm/v3/objects/tickets/batch/create_create',
-    'post-/crm/v3/objects/tickets/batch/read_read',
-    'post-/crm/v3/objects/tickets/batch/update_update',
-    'post-/crm/v3/objects/tickets/batch/upsert_upsert',
-    'post-/crm/v3/objects/tickets/merge_merge',
-    'post-/crm/v3/objects/tickets/search_doSearch',
-    // /crm/v3/owners
-    'get-/crm/v3/owners/{ownerId}_getById',
-    'get-/crm/v3/owners_/crm/v3/owners',
-    // /crm/v3/pipelines
-    'delete-/crm/v3/pipelines/{objectType}/{pipelineId}_archive',
-    'delete-/crm/v3/pipelines/{objectType}/{pipelineId}/stages/{stageId}_archive',
-    'get-/crm/v3/pipelines/{objectType}_getAll',
-    'get-/crm/v3/pipelines/{objectType}/{pipelineId}_getById',
-    'get-/crm/v3/pipelines/{objectType}/{pipelineId}/stages_getAll',
-    'get-/crm/v3/pipelines/{objectType}/{pipelineId}/stages/{stageId}_getById',
-    'patch-/crm/v3/pipelines/{objectType}/{pipelineId}_update',
-    'patch-/crm/v3/pipelines/{objectType}/{pipelineId}/stages/{stageId}_update',
-    'post-/crm/v3/pipelines/{objectType}_create',
-    'post-/crm/v3/pipelines/{objectType}/{pipelineId}/stages_create',
-    'put-/crm/v3/pipelines/{objectType}/{pipelineId}_replace',
-    'put-/crm/v3/pipelines/{objectType}/{pipelineId}/stages/{stageId}_replace',
-    // /crm/v3/properties
-    'delete-/crm/v3/properties/{objectType}/{propertyName}_archive',
-    'delete-/crm/v3/properties/{objectType}/groups/{groupName}_archive',
-    'get-/crm/v3/properties/{objectType}_getAll',
-    'get-/crm/v3/properties/{objectType}/{propertyName}_getByName',
-    'get-/crm/v3/properties/{objectType}/groups_getAll',
-    'get-/crm/v3/properties/{objectType}/groups/{groupName}_getByName',
-    'patch-/crm/v3/properties/{objectType}/{propertyName}_update',
-    'patch-/crm/v3/properties/{objectType}/groups/{groupName}_update',
-    'post-/crm/v3/properties/{objectType}_create',
-    'post-/crm/v3/properties/{objectType}/batch/create_create',
-    'post-/crm/v3/properties/{objectType}/groups_create',
-    // /crm/v4/associations
-    'post-/crm/v4/associations/{fromObjectType}/{toObjectType}/batch/archive_archive',
-    'post-/crm/v4/associations/{fromObjectType}/{toObjectType}/batch/create_create',
-    'post-/crm/v4/associations/{fromObjectType}/{toObjectType}/batch/read_getPage',
-    // /crm/v4/objects
-    'delete-/crm/v4/objects/{objectType}/{objectId}/associations/{toObjectType}/{toObjectId}_archive',
-    'get-/crm/v4/objects/{objectType}/{objectId}/associations/{toObjectType}_getPage',
-    'put-/crm/v4/objects/{fromObjectType}/{fromObjectId}/associations/default/{toObjectType}/{toObjectId}_createDefault',
-    'put-/crm/v4/objects/{objectType}/{objectId}/associations/{toObjectType}/{toObjectId}_create',
-];
-/** The operations served by the OAuth install's token endpoints. */
-export const OAUTH_HANDLED = [
-    'get-/oauth/v1/access-tokens/{token}_get',
-    'post-/oauth/v1/token_create',
-];
-/** A handler per operation above: the CRM ones answer through `answer` (the pack's request handler as a fetch), the
- *  OAuth ones through `oauth`. */
-export function hubspotHandlers(answer, oauth) {
-    const crm = ({ request }) => answer(request);
-    const token = ({ request }) => oauth(request);
-    return { ...Object.fromEntries(CRM_HANDLED.map((id) => [id, crm])), ...Object.fromEntries(OAUTH_HANDLED.map((id) => [id, token])) };
-}

package/dist/src/webhooks.d.ts

@@ -1,12 +0,0 @@
-export type WriteEvent = {
-    objectType: string;
-    objectId: string;
-    kind: 'creation' | 'propertyChange';
-    propertyName?: string;
-    propertyValue?: string | null;
-};
-/** Announce a stored write to every app installed in the request's account that subscribes to it. */
-export declare function announceWrite(e: WriteEvent, root: string | undefined, at: string): Promise<void>;
-/** GET /_twin/deliveries?to=<url>: what an app's server received from HubSpot, oldest first — each request's headers,
- *  its body as sent, and the events in it. */
-export declare function deliveriesDoor(request: Request, root?: string): Response;

package/dist/src/webhooks.js

@@ -1,79 +0,0 @@
-// HUBSPOT'S WEBHOOK EVENTS — what HubSpot sends an installed app when a record changes in the account it is installed
-// in (docs/contributing/architecture.md, "Events and webhooks"). An app declares its subscriptions in its project's
-// webhooks component: a `targetUrl` and, in `crmObjects`, the `object.*` events it wants by `subscriptionType`,
-// `objectType` and, for a property change, `propertyName`
-// (https://developers.hubspot.com/docs/apps/developer-platform/add-features/configure-webhooks). Every write the request
-// handler stores (hubspot-twin.ts, whoever made it: an app's API call, a person on a record's page, a form's submission)
-// is announced here, and each live install in the account whose app subscribes to it is sent a POST to its target URL:
-// a JSON array of events, each with `objectId`, `eventId`, `subscriptionId`, `portalId`, `appId`, `occurredAt`,
-// `attemptNumber`, `changeSource`, `subscriptionType`, `objectTypeId`, `sourceId`, and for a property change
-// `propertyName` and `propertyValue` (the generic payload's fields,
-// https://developers.hubspot.com/docs/apps/legacy-apps/public-apps/create-generic-webhook-subscriptions).
-//
-// Signed as HubSpot's request-validation page says: `X-HubSpot-Signature-v3`, the base64 HMAC SHA-256 of the method,
-// the URI, the body and `X-HubSpot-Request-Timestamp` with the app's client secret, and "for backwards compatibility"
-// the older signature, `X-HubSpot-Signature` with `X-HubSpot-Signature-Version: v1`, the SHA-256 of "Client secret +
-// request body" (https://developers.hubspot.com/docs/apps/developer-platform/build-apps/authentication/request-validation).
-//
-// The app's server is outside HubSpot, so what it received is read at a door, `GET /_twin/deliveries?to=<target URL>`,
-// as slack's deliveries are; each delivery is also POSTed to the target URL where the World lets it out.
-//
-// Where the documentation stops and the twin decides: one event per request (HubSpot may batch up to a hundred); the
-// event's `eventId` counts the account's events; `subscriptionId` is the subscription's index in the app, from the app's
-// id; `changeSource` is `CRM_UI` for a person on a page, `FORM` for a form's submission, `INTEGRATION` for an app's API
-// call and `API` otherwise, and `sourceId` is `userId:<id>` or `<appId>`; the v1 signature is sent on every event, which
-// the page does not promise for a developer-platform app's `object.*` event.
-import { createHash, createHmac } from 'node:crypto';
-import { appDestination, appFetch } from '@volter/world-core/app-route';
-import { worldEgressRefusal } from '@volter/world-core/network-policy';
-import { appById, installsIn, keep, stored } from "./accounts.js";
-import { currentPortal } from "./portal.js";
-const OBJECT_TYPE_ID = { contacts: '0-1', companies: '0-2', deals: '0-3', tickets: '0-5' };
-const SUBSCRIPTION_OBJECT = { contacts: 'contact', companies: 'company', deals: 'deal', tickets: 'ticket' };
-/** Announce a stored write to every app installed in the request's account that subscribes to it. */
-export async function announceWrite(e, root, at) {
-    const { hub, source, sourceId } = currentPortal();
-    for (const install of installsIn(hub, root)) {
-        const app = appById(Number(install.appId), root);
-        const hooks = app?.webhooks;
-        if (!app || !hooks?.targetUrl)
-            continue;
-        const subscription = (hooks.subscriptions ?? []).find((s) => s.active !== false
-            && s.subscriptionType === `object.${e.kind}` && s.objectType === SUBSCRIPTION_OBJECT[e.objectType]
-            && (e.kind !== 'propertyChange' || s.propertyName === e.propertyName));
-        if (!subscription)
-            continue;
-        const eventId = stored('_webhook_delivery', root).filter((d) => d.portalId === hub).length + 1;
-        const event = {
-            objectId: Number(e.objectId), eventId, subscriptionId: Number(subscription.id), portalId: hub, appId: app.appId,
-            occurredAt: Date.parse(at), attemptNumber: 0, changeSource: source, subscriptionType: `object.${e.kind}`,
-            objectTypeId: OBJECT_TYPE_ID[e.objectType], ...(sourceId ? { sourceId } : {}),
-            ...(e.kind === 'propertyChange' ? { propertyName: e.propertyName, propertyValue: e.propertyValue ?? '' } : {}),
-        };
-        await deliver(String(hooks.targetUrl), String(app.client_secret), [event], hub, root, at);
-    }
-}
-async function deliver(to, secret, events, hub, root, at) {
-    const body = JSON.stringify(events);
-    const timestamp = String(Date.parse(at));
-    const headers = {
-        'content-type': 'application/json',
-        'x-hubspot-signature': createHash('sha256').update(secret + body).digest('hex'),
-        'x-hubspot-signature-version': 'v1',
-        'x-hubspot-signature-v3': createHmac('sha256', secret).update(`POST${to}${body}${timestamp}`).digest('base64'),
-        'x-hubspot-request-timestamp': timestamp,
-    };
-    const n = stored('_webhook_delivery', root).length + 1;
-    await keep('_webhook_delivery', `delivery:${n}`, { n, to, portalId: hub, body, headers, delivered_at: at }, root, at);
-    // the application's own hostnames reach it inside the World; elsewhere, the World's egress rule decides
-    if (appDestination(to) || worldEgressRefusal(to) === null)
-        await appFetch(to, { method: 'POST', headers, body }).then((r) => r.text()).catch(() => undefined);
-}
-/** GET /_twin/deliveries?to=<url>: what an app's server received from HubSpot, oldest first — each request's headers,
- *  its body as sent, and the events in it. */
-export function deliveriesDoor(request, root) {
-    const to = new URL(request.url).searchParams.get('to') ?? '';
-    const deliveries = stored('_webhook_delivery', root).filter((d) => d.to === to).sort((a, b) => Number(a.n) - Number(b.n))
-        .map((d) => ({ n: d.n, delivered_at: d.delivered_at, headers: d.headers, body: d.body, events: JSON.parse(String(d.body)) }));
-    return Response.json({ to, deliveries });
-}

package/src/accounts.ts

@@ -1,127 +0,0 @@
-// HUBSPOT ACCOUNTS, THEIR USERS, AND WHAT THEY HOLD OUTSIDE THE CRM — the state HubSpot's pages and its OAuth install
-// keep, which no CRM operation reads or writes: an account (its Hub ID, name and subscription, closed or not), the
-// people who sign in to it (each a user, and so an owner of its records), their browser sessions, the apps an account
-// builds as developer projects (each with its client ID and secret, redirect URLs, scopes and webhook subscriptions),
-// and each app's installs in accounts (who installed it, when, which scopes, uninstalled or not). Kept in the kernel's
-// log under `_`-prefixed types that never reach the wire.
-//
-// Where HubSpot's documentation stops and the twin decides: an account the World makes has a Hub ID from 146000001 up,
-// a user id from 80000001 and an owner id from 90000001 (HubSpot documents their existence, not their ranges); every
-// user of an account the story names is its super admin or one of its users with the seats the story gives them, and
-// the twin keeps no finer permission than super admin or not.
-import { createHash } from 'node:crypto';
-import { applyTwinWrite, projectResources } from '@volter/world-core';
-
-const SERVICE = 'hubspot';
-export type Row = Record<string, unknown>;
-
-export const hex = (s: string): string => createHash('sha256').update(s).digest('hex');
-
-/** Every live stored subject of a bookkeeping type (these are not scoped to an account: each names its own). */
-export function stored(type: string, root?: string): Row[] {
-  return (projectResources(SERVICE, root) as unknown as Row[]).filter((r) => r.type === type && r.deleted !== true);
-}
-
-/** Write a bookkeeping subject. */
-export async function keep(type: string, id: string, fields: Row, root: string | undefined, at: string, actor = 'hubspot'): Promise<void> {
-  await applyTwinWrite(SERVICE, { operation: `hubspot.${type}`, subjectType: type, subjectId: id, fields, occurredAt: at, actor: { kind: 'human', id: actor } }, root);
-}
-
-// ── accounts and users ─────────────────────────────────────────────────────────────────────
-export const passwordHash = (email: string, password: string): string => hex(`hubspot-password:${email.toLowerCase()}:${password}`);
-
-export function accountOf(hubId: number, root?: string): Row | undefined {
-  return stored('_account', root).find((a) => a.hubId === hubId);
-}
-
-export function personOf(email: string, root?: string): Row | undefined {
-  return stored('_person', root).find((p) => p.email === email.toLowerCase());
-}
-
-export function usersOf(hubId: number, root?: string): Row[] {
-  return stored('_person', root).filter((p) => p.hubId === hubId).sort((a, b) => Number(a.userId) - Number(b.userId));
-}
-
-/** An account's owners, as GET /crm/v3/owners answers them (the spec's PublicOwner): one per user. */
-export function ownersOf(hubId: number, root?: string): Row[] {
-  return usersOf(hubId, root).map((p) => ({
-    id: String(p.ownerId), email: p.email, firstName: p.firstName, lastName: p.lastName, userId: p.userId,
-    userIdIncludingInactive: p.userId, type: 'PERSON', archived: false, teams: [],
-    createdAt: p.created_at, updatedAt: p.created_at,
-  }));
-}
-
-/** POST /_twin/users/:email/password {password, firstName, lastName, account?, subscription?, renewsOn?, hubId?} — stands in for two pages the
- *  twin does not build: HubSpot's sign-up (a new account, named `account`, whose first user is its super admin) and a
- *  user's acceptance of an invitation from an account's Users & Teams settings (`hubId`: the user joins that account).
- *  The World keeps the password's hash, never the password; 201 with the account's Hub ID and the user's ids. */
-export async function signUpDoor(email: string, request: Request, root: string | undefined, at: string): Promise<Response> {
-  let body: Row = {};
-  try { body = JSON.parse(await request.text()) as Row; } catch { /* refused below */ }
-  const password = typeof body.password === 'string' ? body.password : '';
-  const firstName = typeof body.firstName === 'string' ? body.firstName : '';
-  const lastName = typeof body.lastName === 'string' ? body.lastName : '';
-  const refuse = (message: string): Response => Response.json({ status: 'error', message, category: 'VALIDATION_ERROR' }, { status: 400 });
-  if (!/^[^@\s]+@[^@\s]+$/.test(email) || password.length < 8 || !firstName || !lastName) return refuse('an email, a password of at least 8 characters, a firstName and a lastName are required');
-  if (personOf(email, root)) return refuse(`${email} already has a HubSpot login`);
-  let hubId: number;
-  let superAdmin: boolean;
-  if (body.hubId !== undefined) {
-    hubId = Number(body.hubId);
-    const account = accountOf(hubId, root);
-    if (!account || account.closed_at) return refuse(`no open account ${String(body.hubId)}`);
-    superAdmin = body.superAdmin === true;
-  } else {
-    const name = typeof body.account === 'string' ? body.account.trim() : '';
-    if (!name) return refuse('an account name (a new account) or a hubId (an account to join) is required');
-    hubId = 146000000 + stored('_account', root).length + 1;
-    const subscription = typeof body.subscription === 'string' ? body.subscription : 'free';
-    // a paid subscription's commitment term ends on `renewsOn` (a date), when it renews unless its auto-renewal was cancelled
-    const renewsOn = typeof body.renewsOn === 'string' && /^\d{4}-\d{2}-\d{2}$/.test(body.renewsOn) ? body.renewsOn : null;
-    if (subscription !== 'free' && !renewsOn) return refuse('a paid subscription needs the date its commitment term ends (renewsOn)');
-    await keep('_account', `account:${hubId}`, { hubId, name, subscription, renews_on: renewsOn, auto_renew: subscription !== 'free', created_at: at, closed_at: null }, root, at, email);
-    superAdmin = true;
-  }
-  const n = stored('_person', root).length + 1;
-  const person = { email: email.toLowerCase(), hash: passwordHash(email, password), hubId, userId: 80000000 + n, ownerId: String(90000000 + n), firstName, lastName, superAdmin, created_at: at };
-  await keep('_person', `person:${email.toLowerCase()}`, person, root, at, email);
-  return Response.json({ hubId, userId: person.userId, ownerId: person.ownerId }, { status: 201 });
-}
-
-/** The subscription an account has at `at`: a paid one whose auto-renewal was cancelled ends on its renewal date, when
- *  "your account will be downgraded to HubSpot's free tools"
- *  (https://knowledge.hubspot.com/account/how-do-i-cancel-my-hubspot-account); one that renews carries on. */
-export function subscriptionAt(account: Row, at: string): string {
-  const paid = String(account.subscription ?? 'free');
-  if (paid === 'free' || account.auto_renew !== false || !account.renews_on) return paid;
-  return Date.parse(at) >= Date.parse(`${String(account.renews_on)}T00:00:00Z`) ? 'free' : paid;
-}
-
-// ── sessions ───────────────────────────────────────────────────────────────────────────────
-export const SESSION_COOKIE = 'hs_session';
-
-/** The person the request's session cookie names, or undefined. */
-export function signedIn(request: Request, root?: string): Row | undefined {
-  const cookie = request.headers.get('cookie') ?? '';
-  const token = new RegExp(`(?:^|;\\s*)${SESSION_COOKIE}=([^;]+)`).exec(cookie)?.[1];
-  const session = token ? stored('_web_session', root).find((s) => s.token === token) : undefined;
-  return session ? personOf(String(session.email), root) : undefined;
-}
-
-// ── apps and installs ──────────────────────────────────────────────────────────────────────
-export function appByClientId(clientId: string, root?: string): Row | undefined {
-  return stored('_app', root).find((a) => a.client_id === clientId && !a.deleted_at);
-}
-export function appById(appId: number, root?: string): Row | undefined {
-  return stored('_app', root).find((a) => a.appId === appId && !a.deleted_at);
-}
-export function appsOf(hubId: number, root?: string): Row[] {
-  return stored('_app', root).filter((a) => a.hubId === hubId && !a.deleted_at);
-}
-/** The live installs in an account. */
-export function installsIn(hubId: number, root?: string): Row[] {
-  return stored('_install', root).filter((i) => i.hubId === hubId && !i.uninstalled_at);
-}
-export function installOf(appId: number, hubId: number, root?: string): Row | undefined {
-  return installsIn(hubId, root).find((i) => i.appId === appId);
-}