@confluentinc/mcp-confluent 1.2.1 → 1.3.0

package/dist/confluent/oauth/auth-context.d.ts

@@ -0,0 +1,94 @@
+import { type AuthErrors } from "../../confluent/oauth/errors.js";
+import type { Auth0Config, ConfluentTokenSet } from "../../confluent/oauth/types.js";
+/**
+ * Owns one user's Confluent OAuth lifecycle — token state plus the
+ * transformations that advance it. Internal state advances via atomic
+ * transform functions under {@link AuthContext.updateTokens} so each step is
+ * atomic and no caller mutates the token set directly.
+ */
+export declare class AuthContext {
+    private readonly auth0Config;
+    private internalTokens;
+    private cleared;
+    private refreshTimer;
+    private inflightRefresh;
+    private errors;
+    private failedRefreshAttempts;
+    private constructor();
+    /** Runs the auth code → CP → DP chain and wraps the result in a context. */
+    static newFromInitialLogin(auth0Config: Auth0Config, authCode: string, codeVerifier: string): Promise<AuthContext>;
+    /** Build a context from an already-acquired token set. */
+    static fromTokens(auth0Config: Auth0Config, tokens: ConfluentTokenSet): AuthContext;
+    /** Opaque access token — stable across refreshes. */
+    get accessToken(): string;
+    /**
+     * Current control-plane bearer token, or `undefined` if the context is
+     * cleared or the CP token has expired. Call this immediately before each
+     * API request — don't cache the returned string across awaits.
+     */
+    getControlPlaneToken(): string | undefined;
+    /**
+     * Current data-plane bearer token, or `undefined` if the context is
+     * cleared or the DP token has expired. Same usage guidance as
+     * {@link getControlPlaneToken}.
+     */
+    getDataPlaneToken(): string | undefined;
+    /**
+     * Readonly view of current auth-lifecycle errors. Consumers check this to decide
+     * whether to prompt re-auth (when a non-transient error has been flagged).
+     */
+    getErrors(): Readonly<AuthErrors>;
+    /** True when the refresh token is no longer usable (expired or cleared). */
+    refreshTokenExpired(now?: number): boolean;
+    /**
+     * Pure predicate: should the refresh loop call `refresh()` on this context
+     * right now? True when the refresh token is still live, no non-transient
+     * error has been recorded, and the CP token is within the refresh window.
+     */
+    shouldAttemptRefresh(now?: number): boolean;
+    /**
+     * Rotate the refresh token, then derive new CP and DP tokens. The rotated
+     * refresh token is persisted before the CP/DP leg so a phase-2 failure
+     * leaves the context with a valid (fresh) refresh token. The next scheduler
+     * tick still re-rotates (we don't cache the id_token across ticks), but the
+     * session isn't bricked by a partial failure.
+     *
+     * Single-flight: concurrent callers (e.g., the refresh loop + an explicit
+     * tool-triggered call) await the same in-flight promise. Refresh tokens are
+     * single-use, so overlapping calls would burn the same token.
+     */
+    refresh(): Promise<void>;
+    private doRefresh;
+    /**
+     * Records a refresh failure on the context. A failure is transient unless
+     * its message matches a known-permanent signal, or the consecutive failure
+     * counter hits {@link MAX_CONSECUTIVE_TRANSIENT_FAILURES}. A non-transient
+     * record flips `shouldAttemptRefresh` to `false` until the context is
+     * cleared / re-authenticated.
+     */
+    private recordRefreshError;
+    /**
+     * Mark this context as cleared — subsequent `refresh()` is a no-op, any
+     * running refresh loop is stopped, and the accessors (`getControlPlaneToken`,
+     * `getDataPlaneToken`) return `undefined`. Internal state is not exposed to
+     * consumers, so no field scrubbing is needed.
+     */
+    clear(): void;
+    /**
+     * Starts a background loop that refreshes the CP/DP token pair just before
+     * the CP token expires. The loop self-reschedules: each fire sets the next
+     * `setTimeout` at `controlPlaneExpiresAt - REFRESH_WINDOW_MS` from the
+     * post-refresh state, so the schedule tracks the actual token expiry.
+     */
+    startRefreshLoop(): void;
+    private scheduleNextRefresh;
+    /** Stops the background refresh loop. Safe to call even if not started. */
+    stopRefreshLoop(): void;
+    /**
+     * Applies a named transform to the token set. Each transform returns a
+     * whole new {@link ConfluentTokenSet}; callers never mutate the state
+     * directly.
+     */
+    private updateTokens;
+}
+//# sourceMappingURL=auth-context.d.ts.map

package/dist/confluent/oauth/auth-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-context.d.ts","sourceRoot":"","sources":["../../../src/confluent/oauth/auth-context.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,UAAU,EAEhB,MAAM,gCAAgC,CAAC;AAcxC,OAAO,KAAK,EACV,WAAW,EAEX,iBAAiB,EAGlB,MAAM,+BAA+B,CAAC;AAkBvC;;;;;GAKG;AACH,qBAAa,WAAW;IASpB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAR9B,OAAO,CAAC,cAAc,CAAoB;IAC1C,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,YAAY,CAA8C;IAClE,OAAO,CAAC,eAAe,CAA8B;IACrD,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,qBAAqB,CAAK;IAElC,OAAO;IAOP,4EAA4E;WAC/D,mBAAmB,CAC9B,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,WAAW,CAAC;IAqBvB,0DAA0D;IAC1D,MAAM,CAAC,UAAU,CACf,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,iBAAiB,GACxB,WAAW;IAId,qDAAqD;IACrD,IAAI,WAAW,IAAI,MAAM,CAExB;IAED;;;;OAIG;IACH,oBAAoB,IAAI,MAAM,GAAG,SAAS;IAO1C;;;;OAIG;IACH,iBAAiB,IAAI,MAAM,GAAG,SAAS;IAMvC;;;OAGG;IACH,SAAS,IAAI,QAAQ,CAAC,UAAU,CAAC;IAIjC,4EAA4E;IAC5E,mBAAmB,CAAC,GAAG,GAAE,MAAmB,GAAG,OAAO;IAQtD;;;;OAIG;IACH,oBAAoB,CAAC,GAAG,GAAE,MAAmB,GAAG,OAAO;IASvD;;;;;;;;;;OAUG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YAYhB,SAAS;IAiFvB;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAuB1B;;;;;OAKG;IACH,KAAK,IAAI,IAAI;IAKb;;;;;OAKG;IACH,gBAAgB,IAAI,IAAI;IAexB,OAAO,CAAC,mBAAmB;IAqD3B,2EAA2E;IAC3E,eAAe,IAAI,IAAI;IAQvB;;;;OAIG;IACH,OAAO,CAAC,YAAY;CAMrB"}

package/dist/confluent/oauth/auth-context.js

@@ -0,0 +1,323 @@
+import { generateOpaqueToken } from "../../confluent/oauth/crypto-utils.js";
+import { hasNonTransientError, } from "../../confluent/oauth/errors.js";
+import { exchangeControlPlaneForDataPlaneToken, exchangeIdTokenForControlPlaneToken, exchangeRefreshTokenForAuth0Tokens, executeFullTokenChain, } from "../../confluent/oauth/token-chain.js";
+import { CONTROL_PLANE_REFRESH_WINDOW_MS, CONTROL_PLANE_TOKEN_LIFETIME_MS, DATA_PLANE_TOKEN_LIFETIME_MS, MAX_CONSECUTIVE_TRANSIENT_FAILURES, REFRESH_TOKEN_IDLE_LIFETIME_MS, } from "../../confluent/oauth/token-lifetimes.js";
+import { logger } from "../../logger.js";
+/** Substrings that mark a refresh error as permanently non-recoverable. */
+const NON_TRANSIENT_ERROR_SIGNALS = [
+    "Unknown or invalid refresh token.",
+    '"error":"invalid_grant"',
+    '"error":"invalid_client"',
+    '"error":"unauthorized_client"',
+];
+function isKnownNonTransient(error) {
+    if (!(error instanceof Error))
+        return false;
+    return NON_TRANSIENT_ERROR_SIGNALS.some((signal) => error.message.includes(signal));
+}
+/**
+ * Owns one user's Confluent OAuth lifecycle — token state plus the
+ * transformations that advance it. Internal state advances via atomic
+ * transform functions under {@link AuthContext.updateTokens} so each step is
+ * atomic and no caller mutates the token set directly.
+ */
+export class AuthContext {
+    auth0Config;
+    internalTokens;
+    cleared = false;
+    refreshTimer = null;
+    inflightRefresh = null;
+    errors = {};
+    failedRefreshAttempts = 0;
+    constructor(auth0Config, tokens) {
+        this.auth0Config = auth0Config;
+        this.internalTokens = tokens;
+    }
+    /** Runs the auth code → CP → DP chain and wraps the result in a context. */
+    static async newFromInitialLogin(auth0Config, authCode, codeVerifier) {
+        const result = await executeFullTokenChain(auth0Config, authCode, codeVerifier);
+        // Explicit field copy: `TokenChainResult` carries identity fields
+        // (`resourceId`, `email`) that aren't part of `ConfluentTokenSet`; a
+        // spread would retain them on the long-lived context.
+        return new AuthContext(auth0Config, {
+            refreshToken: result.refreshToken,
+            refreshTokenAbsoluteExpiresAt: result.refreshTokenAbsoluteExpiresAt,
+            refreshTokenIdleExpiresAt: result.refreshTokenIdleExpiresAt,
+            controlPlaneToken: result.controlPlaneToken,
+            controlPlaneExpiresAt: result.controlPlaneExpiresAt,
+            dataPlaneToken: result.dataPlaneToken,
+            dataPlaneExpiresAt: result.dataPlaneExpiresAt,
+            accessToken: generateOpaqueToken(),
+        });
+    }
+    /** Build a context from an already-acquired token set. */
+    static fromTokens(auth0Config, tokens) {
+        return new AuthContext(auth0Config, tokens);
+    }
+    /** Opaque access token — stable across refreshes. */
+    get accessToken() {
+        return this.internalTokens.accessToken;
+    }
+    /**
+     * Current control-plane bearer token, or `undefined` if the context is
+     * cleared or the CP token has expired. Call this immediately before each
+     * API request — don't cache the returned string across awaits.
+     */
+    getControlPlaneToken() {
+        if (this.cleared)
+            return undefined;
+        if (this.internalTokens.controlPlaneExpiresAt <= Date.now())
+            return undefined;
+        return this.internalTokens.controlPlaneToken;
+    }
+    /**
+     * Current data-plane bearer token, or `undefined` if the context is
+     * cleared or the DP token has expired. Same usage guidance as
+     * {@link getControlPlaneToken}.
+     */
+    getDataPlaneToken() {
+        if (this.cleared)
+            return undefined;
+        if (this.internalTokens.dataPlaneExpiresAt <= Date.now())
+            return undefined;
+        return this.internalTokens.dataPlaneToken;
+    }
+    /**
+     * Readonly view of current auth-lifecycle errors. Consumers check this to decide
+     * whether to prompt re-auth (when a non-transient error has been flagged).
+     */
+    getErrors() {
+        return this.errors;
+    }
+    /** True when the refresh token is no longer usable (expired or cleared). */
+    refreshTokenExpired(now = Date.now()) {
+        if (this.cleared)
+            return true;
+        return (now >= this.internalTokens.refreshTokenAbsoluteExpiresAt ||
+            now >= this.internalTokens.refreshTokenIdleExpiresAt);
+    }
+    /**
+     * Pure predicate: should the refresh loop call `refresh()` on this context
+     * right now? True when the refresh token is still live, no non-transient
+     * error has been recorded, and the CP token is within the refresh window.
+     */
+    shouldAttemptRefresh(now = Date.now()) {
+        if (this.refreshTokenExpired(now))
+            return false;
+        if (hasNonTransientError(this.errors))
+            return false;
+        return (this.internalTokens.controlPlaneExpiresAt - now <=
+            CONTROL_PLANE_REFRESH_WINDOW_MS);
+    }
+    /**
+     * Rotate the refresh token, then derive new CP and DP tokens. The rotated
+     * refresh token is persisted before the CP/DP leg so a phase-2 failure
+     * leaves the context with a valid (fresh) refresh token. The next scheduler
+     * tick still re-rotates (we don't cache the id_token across ticks), but the
+     * session isn't bricked by a partial failure.
+     *
+     * Single-flight: concurrent callers (e.g., the refresh loop + an explicit
+     * tool-triggered call) await the same in-flight promise. Refresh tokens are
+     * single-use, so overlapping calls would burn the same token.
+     */
+    async refresh() {
+        if (this.cleared)
+            return;
+        if (this.refreshTokenExpired())
+            return;
+        if (this.inflightRefresh)
+            return this.inflightRefresh;
+        this.inflightRefresh = this.doRefresh();
+        try {
+            await this.inflightRefresh;
+        }
+        finally {
+            this.inflightRefresh = null;
+        }
+    }
+    async doRefresh() {
+        // Capture rotationTime BEFORE the auth0 exchange so the new CP/DP
+        // expiries we stamp are conservative - we refresh slightly sooner
+        // than strictly necessary instead of slightly later.
+        const rotationTime = Date.now();
+        let auth0Response;
+        try {
+            auth0Response = await exchangeRefreshTokenForAuth0Tokens(this.auth0Config, this.internalTokens.refreshToken);
+        }
+        catch (error) {
+            this.recordRefreshError(error);
+            return;
+        }
+        // clear() may have fired while the rotation was in flight — the refresh
+        // token Auth0 just gave us is already stale by intent, and there's no
+        // point issuing further API calls that would be discarded.
+        if (this.cleared)
+            return;
+        this.updateTokens((prev) => ({
+            ...prev,
+            refreshToken: auth0Response.refresh_token,
+            // Idle expiry can't extend past the absolute lifetime — Auth0's
+            // absolute expiry is a hard ceiling that overrides idle bumps.
+            refreshTokenIdleExpiresAt: Math.min(rotationTime + REFRESH_TOKEN_IDLE_LIFETIME_MS, prev.refreshTokenAbsoluteExpiresAt),
+        }));
+        try {
+            // Phase 2 is safe to retry and both the CP and DP exchanges accept bearer
+            // tokens without marking them consumed. A retry after a transient 5xx just
+            // creates a fresh CP/DP session; any orphaned session from a lost-in-transit first
+            // response expires naturally within its short TTL.
+            let cpResponse;
+            try {
+                cpResponse = await exchangeIdTokenForControlPlaneToken(this.auth0Config.apiUrl, auth0Response.id_token);
+            }
+            catch (error) {
+                if (isKnownNonTransient(error))
+                    throw error;
+                cpResponse = await exchangeIdTokenForControlPlaneToken(this.auth0Config.apiUrl, auth0Response.id_token);
+            }
+            if (this.cleared)
+                return;
+            let dpResponse;
+            try {
+                dpResponse = await exchangeControlPlaneForDataPlaneToken(this.auth0Config.apiUrl, cpResponse.token);
+            }
+            catch (error) {
+                if (isKnownNonTransient(error))
+                    throw error;
+                dpResponse = await exchangeControlPlaneForDataPlaneToken(this.auth0Config.apiUrl, cpResponse.token);
+            }
+            if (this.cleared)
+                return;
+            this.updateTokens((prev) => ({
+                ...prev,
+                controlPlaneToken: cpResponse.token,
+                controlPlaneExpiresAt: rotationTime + CONTROL_PLANE_TOKEN_LIFETIME_MS,
+                dataPlaneToken: dpResponse.token,
+                dataPlaneExpiresAt: rotationTime + DATA_PLANE_TOKEN_LIFETIME_MS,
+            }));
+            // Full success — clear any prior transient error state.
+            this.errors = { ...this.errors, tokenRefresh: undefined };
+            this.failedRefreshAttempts = 0;
+            logger.info("Token set refreshed successfully");
+        }
+        catch (error) {
+            this.recordRefreshError(error);
+        }
+    }
+    /**
+     * Records a refresh failure on the context. A failure is transient unless
+     * its message matches a known-permanent signal, or the consecutive failure
+     * counter hits {@link MAX_CONSECUTIVE_TRANSIENT_FAILURES}. A non-transient
+     * record flips `shouldAttemptRefresh` to `false` until the context is
+     * cleared / re-authenticated.
+     */
+    recordRefreshError(error) {
+        this.failedRefreshAttempts += 1;
+        const isTransient = this.failedRefreshAttempts < MAX_CONSECUTIVE_TRANSIENT_FAILURES &&
+            !isKnownNonTransient(error);
+        const message = error instanceof Error ? error.message : String(error);
+        this.errors = {
+            ...this.errors,
+            tokenRefresh: { message, isTransient },
+        };
+        if (isTransient) {
+            logger.warn({ error, attempts: this.failedRefreshAttempts }, "Transient refresh error; will retry next tick");
+        }
+        else {
+            logger.error({ error, attempts: this.failedRefreshAttempts }, "Non-transient refresh error; scheduler will skip until re-auth");
+        }
+    }
+    /**
+     * Mark this context as cleared — subsequent `refresh()` is a no-op, any
+     * running refresh loop is stopped, and the accessors (`getControlPlaneToken`,
+     * `getDataPlaneToken`) return `undefined`. Internal state is not exposed to
+     * consumers, so no field scrubbing is needed.
+     */
+    clear() {
+        this.cleared = true;
+        this.stopRefreshLoop();
+    }
+    /**
+     * Starts a background loop that refreshes the CP/DP token pair just before
+     * the CP token expires. The loop self-reschedules: each fire sets the next
+     * `setTimeout` at `controlPlaneExpiresAt - REFRESH_WINDOW_MS` from the
+     * post-refresh state, so the schedule tracks the actual token expiry.
+     */
+    startRefreshLoop() {
+        if (this.cleared) {
+            // A cleared context is terminal. Scheduling a timer here would create
+            // a callback that can never do useful work — guard against the leak.
+            logger.warn("Refresh loop not started: context is cleared");
+            return;
+        }
+        if (this.refreshTimer) {
+            logger.warn("Refresh loop already running, skipping");
+            return;
+        }
+        this.scheduleNextRefresh();
+        logger.info("Token refresh loop started");
+    }
+    scheduleNextRefresh() {
+        if (this.cleared)
+            return;
+        if (this.refreshTokenExpired()) {
+            logger.info("Refresh token expired; clearing context");
+            this.clear();
+            return;
+        }
+        // After a non-transient refresh error (e.g., refresh-token revoked, or
+        // `MAX_CONSECUTIVE_TRANSIENT_FAILURES` exceeded), don't reschedule. The
+        // loop terminates; the user must re-authenticate to recover. Without
+        // this guard the loop would hammer auth0 every 1s indefinitely on a
+        // permanent failure.
+        if (hasNonTransientError(this.errors)) {
+            logger.info("Non-transient refresh error recorded; refresh loop stopping until re-auth");
+            return;
+        }
+        // Target: fire `REFRESH_WINDOW_MS` before CP expiry. Floor at 1s so a
+        // failed refresh (which doesn't advance `controlPlaneExpiresAt`)
+        // produces a tight retry. The failure counter caps at
+        // `MAX_CONSECUTIVE_TRANSIENT_FAILURES`, after which the next call to
+        // `recordRefreshError` flips the error to non-transient and the guard
+        // above stops the loop on the very next reschedule.
+        const now = Date.now();
+        const targetDelay = Math.max(this.internalTokens.controlPlaneExpiresAt -
+            now -
+            CONTROL_PLANE_REFRESH_WINDOW_MS, 1_000);
+        logger.info({
+            delayMs: targetDelay,
+            cpExpiresAt: new Date(this.internalTokens.controlPlaneExpiresAt).toISOString(),
+            firesAt: new Date(now + targetDelay).toISOString(),
+        }, "Next token refresh scheduled");
+        this.refreshTimer = setTimeout(async () => {
+            this.refreshTimer = null;
+            if (this.cleared)
+                return;
+            try {
+                await this.refresh();
+            }
+            catch (error) {
+                logger.error({ error }, "Token refresh loop error");
+            }
+            this.scheduleNextRefresh();
+        }, targetDelay);
+    }
+    /** Stops the background refresh loop. Safe to call even if not started. */
+    stopRefreshLoop() {
+        if (this.refreshTimer) {
+            clearTimeout(this.refreshTimer);
+            this.refreshTimer = null;
+            logger.info("Token refresh loop stopped");
+        }
+    }
+    /**
+     * Applies a named transform to the token set. Each transform returns a
+     * whole new {@link ConfluentTokenSet}; callers never mutate the state
+     * directly.
+     */
+    updateTokens(transform) {
+        if (this.cleared)
+            return;
+        this.internalTokens = transform(this.internalTokens);
+    }
+}
+//# sourceMappingURL=auth-context.js.map

package/dist/confluent/oauth/auth-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-context.js","sourceRoot":"","sources":["../../../src/confluent/oauth/auth-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EAEL,oBAAoB,GACrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,qCAAqC,EACrC,mCAAmC,EACnC,kCAAkC,EAClC,qBAAqB,GACtB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,+BAA+B,EAC/B,+BAA+B,EAC/B,4BAA4B,EAC5B,kCAAkC,EAClC,8BAA8B,GAC/B,MAAM,yCAAyC,CAAC;AAQjD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC,2EAA2E;AAC3E,MAAM,2BAA2B,GAAG;IAClC,mCAAmC;IACnC,yBAAyB;IACzB,0BAA0B;IAC1B,+BAA+B;CACvB,CAAC;AAEX,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,2BAA2B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACjD,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,WAAW;IASH;IARX,cAAc,CAAoB;IAClC,OAAO,GAAG,KAAK,CAAC;IAChB,YAAY,GAAyC,IAAI,CAAC;IAC1D,eAAe,GAAyB,IAAI,CAAC;IAC7C,MAAM,GAAe,EAAE,CAAC;IACxB,qBAAqB,GAAG,CAAC,CAAC;IAElC,YACmB,WAAwB,EACzC,MAAyB;QADR,gBAAW,GAAX,WAAW,CAAa;QAGzC,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;IAC/B,CAAC;IAED,4EAA4E;IAC5E,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAC9B,WAAwB,EACxB,QAAgB,EAChB,YAAoB;QAEpB,MAAM,MAAM,GAAG,MAAM,qBAAqB,CACxC,WAAW,EACX,QAAQ,EACR,YAAY,CACb,CAAC;QACF,kEAAkE;QAClE,qEAAqE;QACrE,sDAAsD;QACtD,OAAO,IAAI,WAAW,CAAC,WAAW,EAAE;YAClC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,6BAA6B,EAAE,MAAM,CAAC,6BAA6B;YACnE,yBAAyB,EAAE,MAAM,CAAC,yBAAyB;YAC3D,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;YACnD,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,WAAW,EAAE,mBAAmB,EAAE;SACnC,CAAC,CAAC;IACL,CAAC;IAED,0DAA0D;IAC1D,MAAM,CAAC,UAAU,CACf,WAAwB,EACxB,MAAyB;QAEzB,OAAO,IAAI,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED,qDAAqD;IACrD,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACH,oBAAoB;QAClB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QACnC,IAAI,IAAI,CAAC,cAAc,CAAC,qBAAqB,IAAI,IAAI,CAAC,GAAG,EAAE;YACzD,OAAO,SAAS,CAAC;QACnB,OAAO,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC;IAC/C,CAAC;IAED;;;;OAIG;IACH,iBAAiB;QACf,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QACnC,IAAI,IAAI,CAAC,cAAc,CAAC,kBAAkB,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,SAAS,CAAC;QAC3E,OAAO,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,4EAA4E;IAC5E,mBAAmB,CAAC,MAAc,IAAI,CAAC,GAAG,EAAE;QAC1C,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC9B,OAAO,CACL,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,6BAA6B;YACxD,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,yBAAyB,CACrD,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,oBAAoB,CAAC,MAAc,IAAI,CAAC,GAAG,EAAE;QAC3C,IAAI,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChD,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QACpD,OAAO,CACL,IAAI,CAAC,cAAc,CAAC,qBAAqB,GAAG,GAAG;YAC/C,+BAA+B,CAChC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,IAAI,CAAC,mBAAmB,EAAE;YAAE,OAAO;QACvC,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC;QACtD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,eAAe,CAAC;QAC7B,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,kEAAkE;QAClE,kEAAkE;QAClE,qDAAqD;QACrD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,IAAI,aAAiC,CAAC;QACtC,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,kCAAkC,CACtD,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,cAAc,CAAC,YAAY,CACjC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,wEAAwE;QACxE,sEAAsE;QACtE,2DAA2D;QAC3D,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC3B,GAAG,IAAI;YACP,YAAY,EAAE,aAAa,CAAC,aAAa;YACzC,gEAAgE;YAChE,+DAA+D;YAC/D,yBAAyB,EAAE,IAAI,CAAC,GAAG,CACjC,YAAY,GAAG,8BAA8B,EAC7C,IAAI,CAAC,6BAA6B,CACnC;SACF,CAAC,CAAC,CAAC;QAEJ,IAAI,CAAC;YACH,0EAA0E;YAC1E,2EAA2E;YAC3E,mFAAmF;YACnF,mDAAmD;YACnD,IAAI,UAAqC,CAAC;YAC1C,IAAI,CAAC;gBACH,UAAU,GAAG,MAAM,mCAAmC,CACpD,IAAI,CAAC,WAAW,CAAC,MAAM,EACvB,aAAa,CAAC,QAAQ,CACvB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;gBAC5C,UAAU,GAAG,MAAM,mCAAmC,CACpD,IAAI,CAAC,WAAW,CAAC,MAAM,EACvB,aAAa,CAAC,QAAQ,CACvB,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO;YAEzB,IAAI,UAAkC,CAAC;YACvC,IAAI,CAAC;gBACH,UAAU,GAAG,MAAM,qCAAqC,CACtD,IAAI,CAAC,WAAW,CAAC,MAAM,EACvB,UAAU,CAAC,KAAK,CACjB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;gBAC5C,UAAU,GAAG,MAAM,qCAAqC,CACtD,IAAI,CAAC,WAAW,CAAC,MAAM,EACvB,UAAU,CAAC,KAAK,CACjB,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO;YAEzB,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC3B,GAAG,IAAI;gBACP,iBAAiB,EAAE,UAAU,CAAC,KAAK;gBACnC,qBAAqB,EAAE,YAAY,GAAG,+BAA+B;gBACrE,cAAc,EAAE,UAAU,CAAC,KAAK;gBAChC,kBAAkB,EAAE,YAAY,GAAG,4BAA4B;aAChE,CAAC,CAAC,CAAC;YACJ,wDAAwD;YACxD,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;YAC1D,IAAI,CAAC,qBAAqB,GAAG,CAAC,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,kBAAkB,CAAC,KAAc;QACvC,IAAI,CAAC,qBAAqB,IAAI,CAAC,CAAC;QAChC,MAAM,WAAW,GACf,IAAI,CAAC,qBAAqB,GAAG,kCAAkC;YAC/D,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,GAAG;YACZ,GAAG,IAAI,CAAC,MAAM;YACd,YAAY,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE;SACvC,CAAC;QACF,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CACT,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,qBAAqB,EAAE,EAC/C,+CAA+C,CAChD,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CACV,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,qBAAqB,EAAE,EAC/C,gEAAgE,CACjE,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACH,gBAAgB;QACd,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,sEAAsE;YACtE,qEAAqE;YACrE,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC5C,CAAC;IAEO,mBAAmB;QACzB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;YACvD,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,oEAAoE;QACpE,qBAAqB;QACrB,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CACT,2EAA2E,CAC5E,CAAC;YACF,OAAO;QACT,CAAC;QACD,sEAAsE;QACtE,iEAAiE;QACjE,sDAAsD;QACtD,qEAAqE;QACrE,sEAAsE;QACtE,oDAAoD;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAC1B,IAAI,CAAC,cAAc,CAAC,qBAAqB;YACvC,GAAG;YACH,+BAA+B,EACjC,KAAK,CACN,CAAC;QACF,MAAM,CAAC,IAAI,CACT;YACE,OAAO,EAAE,WAAW;YACpB,WAAW,EAAE,IAAI,IAAI,CACnB,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAC1C,CAAC,WAAW,EAAE;YACf,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,WAAW,CAAC,CAAC,WAAW,EAAE;SACnD,EACD,8BAA8B,CAC/B,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE;YACxC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YACzB,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO;YACzB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACvB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,0BAA0B,CAAC,CAAC;YACtD,CAAC;YACD,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7B,CAAC,EAAE,WAAW,CAAC,CAAC;IAClB,CAAC;IAED,2EAA2E;IAC3E,eAAe;QACb,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAChC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,YAAY,CAClB,SAAmE;QAEnE,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACvD,CAAC;CACF"}

package/dist/confluent/oauth/auth0-config.d.ts

@@ -0,0 +1,12 @@
+import type { Auth0Config, Auth0Environment } from "../../confluent/oauth/types.js";
+export declare const OAUTH_CALLBACK_HOST = "127.0.0.1";
+export declare const OAUTH_CALLBACK_PORT = 26640;
+export declare const OAUTH_CALLBACK_PATH = "/gateway/v1/callback-local-mcp-docs";
+export declare function getAuth0Config(environment: Auth0Environment): Auth0Config;
+/**
+ * Returns the Confluent Cloud REST API base URL for the given Auth0 environment.
+ * Used by {@link OAuthClientManager} to derive the cloud surface's base URL when
+ * the OAuth path doesn't carry an explicit `confluent_cloud.endpoint`.
+ */
+export declare function getCloudRestUrlForEnv(environment: Auth0Environment): string;
+//# sourceMappingURL=auth0-config.d.ts.map

package/dist/confluent/oauth/auth0-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth0-config.d.ts","sourceRoot":"","sources":["../../../src/confluent/oauth/auth0-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,gBAAgB,EACjB,MAAM,+BAA+B,CAAC;AAEvC,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAC/C,eAAO,MAAM,mBAAmB,QAAQ,CAAC;AACzC,eAAO,MAAM,mBAAmB,wCAAwC,CAAC;AA8BzE,wBAAgB,cAAc,CAAC,WAAW,EAAE,gBAAgB,GAAG,WAAW,CAEzE;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,gBAAgB,GAAG,MAAM,CAE3E"}

package/dist/confluent/oauth/auth0-config.js

@@ -0,0 +1,43 @@
+export const OAUTH_CALLBACK_HOST = "127.0.0.1";
+export const OAUTH_CALLBACK_PORT = 26640;
+export const OAUTH_CALLBACK_PATH = "/gateway/v1/callback-local-mcp-docs";
+const OAUTH_CALLBACK_URL = `http://${OAUTH_CALLBACK_HOST}:${OAUTH_CALLBACK_PORT}${OAUTH_CALLBACK_PATH}`;
+const OAUTH_SCOPES = "email openid offline_access";
+const AUTH0_CONFIGS = {
+    devel: {
+        clientId: "D8DV9ee7XrKX4ncAc6vJtBFgIzTMNgoY",
+        domain: "login.confluent-dev.io",
+        apiUrl: "https://devel.cpdev.cloud",
+        cloudRestUrl: "https://api.devel.cpdev.cloud",
+        callbackUrl: OAUTH_CALLBACK_URL,
+        scopes: OAUTH_SCOPES,
+    },
+    stag: {
+        clientId: "adtjckxmHbjddhNK36PvcXIDDbrJUMDH",
+        domain: "login-stag.confluent-dev.io",
+        apiUrl: "https://stag.cpdev.cloud",
+        cloudRestUrl: "https://api.stag.cpdev.cloud",
+        callbackUrl: OAUTH_CALLBACK_URL,
+        scopes: OAUTH_SCOPES,
+    },
+    prod: {
+        clientId: "cZ0wejEDJLNocYDJ54mAmGK21klrv21h",
+        domain: "login.confluent.io",
+        apiUrl: "https://confluent.cloud",
+        cloudRestUrl: "https://api.confluent.cloud",
+        callbackUrl: OAUTH_CALLBACK_URL,
+        scopes: OAUTH_SCOPES,
+    },
+};
+export function getAuth0Config(environment) {
+    return AUTH0_CONFIGS[environment];
+}
+/**
+ * Returns the Confluent Cloud REST API base URL for the given Auth0 environment.
+ * Used by {@link OAuthClientManager} to derive the cloud surface's base URL when
+ * the OAuth path doesn't carry an explicit `confluent_cloud.endpoint`.
+ */
+export function getCloudRestUrlForEnv(environment) {
+    return AUTH0_CONFIGS[environment].cloudRestUrl;
+}
+//# sourceMappingURL=auth0-config.js.map

package/dist/confluent/oauth/auth0-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth0-config.js","sourceRoot":"","sources":["../../../src/confluent/oauth/auth0-config.ts"],"names":[],"mappings":"AAKA,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAC/C,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AACzC,MAAM,CAAC,MAAM,mBAAmB,GAAG,qCAAqC,CAAC;AACzE,MAAM,kBAAkB,GAAG,UAAU,mBAAmB,IAAI,mBAAmB,GAAG,mBAAmB,EAAE,CAAC;AACxG,MAAM,YAAY,GAAG,6BAA6B,CAAC;AACnD,MAAM,aAAa,GAA0C;IAC3D,KAAK,EAAE;QACL,QAAQ,EAAE,kCAAkC;QAC5C,MAAM,EAAE,wBAAwB;QAChC,MAAM,EAAE,2BAA2B;QACnC,YAAY,EAAE,+BAA+B;QAC7C,WAAW,EAAE,kBAAkB;QAC/B,MAAM,EAAE,YAAY;KACrB;IACD,IAAI,EAAE;QACJ,QAAQ,EAAE,kCAAkC;QAC5C,MAAM,EAAE,6BAA6B;QACrC,MAAM,EAAE,0BAA0B;QAClC,YAAY,EAAE,8BAA8B;QAC5C,WAAW,EAAE,kBAAkB;QAC/B,MAAM,EAAE,YAAY;KACrB;IACD,IAAI,EAAE;QACJ,QAAQ,EAAE,kCAAkC;QAC5C,MAAM,EAAE,oBAAoB;QAC5B,MAAM,EAAE,yBAAyB;QACjC,YAAY,EAAE,6BAA6B;QAC3C,WAAW,EAAE,kBAAkB;QAC/B,MAAM,EAAE,YAAY;KACrB;CACF,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,WAA6B;IAC1D,OAAO,aAAa,CAAC,WAAW,CAAC,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAA6B;IACjE,OAAO,aAAa,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC;AACjD,CAAC"}

package/dist/confluent/oauth/callback-pages.d.ts

@@ -0,0 +1,5 @@
+export declare function renderSuccessPage(): string;
+export declare function renderErrorPage(message: string): string;
+/** Test-only: reset the module-level template cache. */
+export declare function _resetCallbackPageCacheForTests(): void;
+//# sourceMappingURL=callback-pages.d.ts.map

package/dist/confluent/oauth/callback-pages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-pages.d.ts","sourceRoot":"","sources":["../../../src/confluent/oauth/callback-pages.ts"],"names":[],"mappings":"AAuCA,wBAAgB,iBAAiB,IAAI,MAAM,CAG1C;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGvD;AAED,wDAAwD;AACxD,wBAAgB,+BAA+B,IAAI,IAAI,CAGtD"}

package/dist/confluent/oauth/callback-pages.js

@@ -0,0 +1,38 @@
+import { fs } from "../../confluent/node-deps.js";
+const SUCCESS_TEMPLATE_FILE = "callback-success.html";
+const FAILURE_TEMPLATE_FILE = "callback-failure.html";
+const PARTIALS = {
+    "{#include styles/}": "styles.html",
+    "{#include logo/}": "logo.html",
+};
+const TEMPLATES_DIR_URL = new URL("../../../assets/oauth-templates/", import.meta.url);
+let cachedSuccessPage;
+let cachedFailureTemplate;
+function readTemplate(fileName) {
+    return fs.readFileSync(new URL(fileName, TEMPLATES_DIR_URL), "utf-8");
+}
+function inlinePartials(template) {
+    return Object.entries(PARTIALS).reduce((acc, [directive, fileName]) => acc.replace(directive, readTemplate(fileName)), template);
+}
+function escapeHtml(value) {
+    return value
+        .replaceAll("&", "&")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;")
+        .replaceAll("'", "&#39;");
+}
+export function renderSuccessPage() {
+    cachedSuccessPage ??= inlinePartials(readTemplate(SUCCESS_TEMPLATE_FILE));
+    return cachedSuccessPage;
+}
+export function renderErrorPage(message) {
+    cachedFailureTemplate ??= inlinePartials(readTemplate(FAILURE_TEMPLATE_FILE));
+    return cachedFailureTemplate.replace("{{error}}", () => escapeHtml(message));
+}
+/** Test-only: reset the module-level template cache. */
+export function _resetCallbackPageCacheForTests() {
+    cachedSuccessPage = undefined;
+    cachedFailureTemplate = undefined;
+}
+//# sourceMappingURL=callback-pages.js.map

package/dist/confluent/oauth/callback-pages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-pages.js","sourceRoot":"","sources":["../../../src/confluent/oauth/callback-pages.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,6BAA6B,CAAC;AAEjD,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AACtD,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAEtD,MAAM,QAAQ,GAA2B;IACvC,oBAAoB,EAAE,aAAa;IACnC,kBAAkB,EAAE,WAAW;CAChC,CAAC;AAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,kCAAkC,EAClC,MAAM,CAAC,IAAI,CAAC,GAAG,CAChB,CAAC;AAEF,IAAI,iBAAqC,CAAC;AAC1C,IAAI,qBAAyC,CAAC;AAE9C,SAAS,YAAY,CAAC,QAAgB;IACpC,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,iBAAiB,CAAC,EAAE,OAAO,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CACpC,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,CAC7B,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,EAChD,QAAQ,CACT,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,iBAAiB,KAAK,cAAc,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC1E,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,qBAAqB,KAAK,cAAc,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC9E,OAAO,qBAAqB,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,+BAA+B;IAC7C,iBAAiB,GAAG,SAAS,CAAC;IAC9B,qBAAqB,GAAG,SAAS,CAAC;AACpC,CAAC"}

package/dist/confluent/oauth/crypto-utils.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Generates a cryptographically secure opaque access token.
+ * Returns a 64-character hex string (32 random bytes).
+ */
+export declare function generateOpaqueToken(): string;
+/**
+ * Generates a PKCE code verifier (RFC 7636).
+ * Returns a base64url-encoded string of 32 random bytes.
+ */
+export declare function generateCodeVerifier(): string;
+/**
+ * Generates a PKCE code challenge from a code verifier (RFC 7636, S256 method).
+ * Returns the base64url-encoded SHA-256 hash of the verifier.
+ */
+export declare function generateCodeChallenge(codeVerifier: string): string;
+//# sourceMappingURL=crypto-utils.d.ts.map

package/dist/confluent/oauth/crypto-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-utils.d.ts","sourceRoot":"","sources":["../../../src/confluent/oauth/crypto-utils.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAElE"}

package/dist/confluent/oauth/crypto-utils.js

@@ -0,0 +1,23 @@
+import { createHash, randomBytes } from "node:crypto";
+/**
+ * Generates a cryptographically secure opaque access token.
+ * Returns a 64-character hex string (32 random bytes).
+ */
+export function generateOpaqueToken() {
+    return randomBytes(32).toString("hex");
+}
+/**
+ * Generates a PKCE code verifier (RFC 7636).
+ * Returns a base64url-encoded string of 32 random bytes.
+ */
+export function generateCodeVerifier() {
+    return randomBytes(32).toString("base64url");
+}
+/**
+ * Generates a PKCE code challenge from a code verifier (RFC 7636, S256 method).
+ * Returns the base64url-encoded SHA-256 hash of the verifier.
+ */
+export function generateCodeChallenge(codeVerifier) {
+    return createHash("sha256").update(codeVerifier).digest("base64url");
+}
+//# sourceMappingURL=crypto-utils.js.map

package/dist/confluent/oauth/crypto-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-utils.js","sourceRoot":"","sources":["../../../src/confluent/oauth/crypto-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACvE,CAAC"}

package/dist/confluent/oauth/errors.d.ts

@@ -0,0 +1,27 @@
+/** A single auth-lifecycle error with transience flag. */
+export interface AuthError {
+    message: string;
+    /**
+     * True if expected to resolve on retry. False means the scheduler stops
+     * retrying until the context is cleared or re-authenticated.
+     */
+    isTransient: boolean;
+}
+/**
+ * Record of auth-lifecycle errors — one optional entry per phase.
+ * `signIn` is intentionally omitted: sign-in failures throw from
+ * {@link AuthContext.newFromInitialLogin} before any context exists, so they
+ * have no instance on which to be stored.
+ */
+export interface AuthErrors {
+    /** Populated when a token refresh attempt fails. */
+    tokenRefresh?: AuthError;
+    /**
+     * Populated when an active token health check fails. Not set today;
+     * reserved for a follow-up that adds a `/api/check_jwt` probe.
+     */
+    authStatusCheck?: AuthError;
+}
+/** True if any recorded error is flagged non-transient. */
+export declare function hasNonTransientError(errors: AuthErrors): boolean;
+//# sourceMappingURL=errors.d.ts.map

package/dist/confluent/oauth/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/confluent/oauth/errors.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,WAAW,EAAE,OAAO,CAAC;CACtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,oDAAoD;IACpD,YAAY,CAAC,EAAE,SAAS,CAAC;IACzB;;;OAGG;IACH,eAAe,CAAC,EAAE,SAAS,CAAC;CAC7B;AAED,2DAA2D;AAC3D,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAKhE"}

package/dist/confluent/oauth/errors.js

@@ -0,0 +1,6 @@
+/** True if any recorded error is flagged non-transient. */
+export function hasNonTransientError(errors) {
+    return (errors.tokenRefresh?.isTransient === false ||
+        errors.authStatusCheck?.isTransient === false);
+}
+//# sourceMappingURL=errors.js.map

package/dist/confluent/oauth/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/confluent/oauth/errors.ts"],"names":[],"mappings":"AA0BA,2DAA2D;AAC3D,MAAM,UAAU,oBAAoB,CAAC,MAAkB;IACrD,OAAO,CACL,MAAM,CAAC,YAAY,EAAE,WAAW,KAAK,KAAK;QAC1C,MAAM,CAAC,eAAe,EAAE,WAAW,KAAK,KAAK,CAC9C,CAAC;AACJ,CAAC"}