@confluentinc/mcp-confluent 1.2.2 → 1.4.0

package/dist/config/models.js

@@ -0,0 +1,406 @@
+import { validateBootstrapServers } from "../config/validation.js";
+import { logLevels } from "../logger.js";
+import { TransportType } from "../mcp/transports/types.js";
+import { z } from "zod";
+/**
+ * Root configuration object representing the entire MCP server configuration.
+ * Validated and constructed from parsed YAML via {@link mcpConfigSchema}.
+ */
+export class MCPServerConfiguration {
+    /** Named connection map. Corresponds to the `connections` block at the root of the YAML configuration. */
+    connections;
+    /** MCP server operational settings. Corresponds to the `server` block at the root of the YAML configuration. */
+    server;
+    constructor(data) {
+        this.connections = data.connections;
+        // DEFAULT_SERVER_CONFIG is declared after the schemas below; it is always
+        // initialized before any MCPServerConfiguration instance is created at runtime.
+        this.server = data.server ?? DEFAULT_SERVER_CONFIG;
+    }
+    /**
+     * Returns the single defined connection in the configuration.
+     *
+     * @returns the single defined connection
+     * @throws Error if 0 or more than 1 connection is defined.
+     */
+    getSoleConnection() {
+        const connectionNames = Object.keys(this.connections);
+        if (connectionNames.length === 0) {
+            throw new Error("No connections defined in configuration");
+        }
+        if (connectionNames.length > 1) {
+            throw new Error("Multiple connections defined in configuration; only one is supported currently");
+        }
+        // must be exactly one connection at this point, so return it.
+        return this.connections[connectionNames[0]];
+    }
+    /**
+     * Returns the sole connection narrowed to {@link DirectConnectionConfig}, throwing
+     * if it is OAuth-typed. Use from callers that need to read service-block fields
+     * (e.g., `kafka.cluster_id`, `flink.environment_id`) — the throw replaces what
+     * would otherwise be a `conn.type === "direct"` guard at every read site.
+     */
+    getSoleDirectConnection() {
+        const conn = this.getSoleConnection();
+        if (conn.type !== "direct") {
+            throw new Error(`Expected sole connection to be a direct connection; got type "${conn.type}"`);
+        }
+        return conn;
+    }
+    getConnectionNames() {
+        return Object.keys(this.connections).sort((a, b) => a.localeCompare(b));
+    }
+}
+/* And now, Zod schemas for validation of MCPServerConfiguration and contained objects. */
+/**
+ * librdkafka property keys that have named YAML equivalents and must not appear in
+ * `extra_properties`. Authoring them there is an error in YAML-configured connections;
+ * use `bootstrap_servers` or the `auth` block instead.
+ *
+ * Note: this restriction applies only to YAML-authored configs. The `-k` /
+ * `--kafka-config-file` CLI flag is a higher-precedence override mechanism and is
+ * permitted to supply these keys (env vars are always lowest precedence).
+ */
+export const KAFKA_PROTECTED_EXTRA_PROPERTY_KEYS = [
+    "bootstrap.servers",
+    "sasl.username",
+    "sasl.password",
+];
+/**
+ * Requires at least one primary connectivity field (`bootstrap_servers` or `rest_endpoint`).
+ *
+ * (`cluster_id` and `env_id` are intentionally excluded: they are per-call defaults
+ * resolved at handler runtime. Each handler accepts the value as a tool argument and
+ * falls back to this block when the argument is absent, throwing only if neither
+ * source supplies it. Either field can therefore be omitted from config and supplied
+ * at call time, so partial presence is valid.)
+ */
+function kafkaBlockHasConnectivity(k) {
+    return k.bootstrap_servers !== undefined || k.rest_endpoint !== undefined;
+}
+const apiKeyAuthSchema = z
+    .object({
+    type: z.literal("api_key"),
+    key: z.string().trim().min(1, "auth.key cannot be empty"),
+    secret: z.string().trim().min(1, "auth.secret cannot be empty"),
+})
+    .strict();
+const authConfigSchema = z.discriminatedUnion("type", [apiKeyAuthSchema]);
+/** Zod schema for direct connection type */
+const directConnectionSchema = z
+    .object({
+    type: z.literal("direct"),
+    confluent_cloud: z
+        .object({
+        endpoint: z
+            .string()
+            .trim()
+            .check(z.url({ error: "confluent_cloud.endpoint must be a valid URL" }))
+            .optional(),
+        auth: authConfigSchema,
+        organization_id: z
+            .string()
+            .trim()
+            .min(1, "confluent_cloud.organization_id cannot be empty")
+            .optional(),
+    })
+        .strict()
+        .optional(),
+    kafka: z
+        .object({
+        bootstrap_servers: z
+            .string()
+            .trim()
+            .min(1, "bootstrap_servers cannot be empty")
+            .superRefine((value, ctx) => {
+            try {
+                validateBootstrapServers(value);
+            }
+            catch (error) {
+                ctx.addIssue({
+                    code: "custom",
+                    message: error instanceof Error ? error.message : String(error),
+                });
+            }
+        })
+            .optional(),
+        auth: authConfigSchema.optional(),
+        rest_endpoint: z
+            .string()
+            .trim()
+            .check(z.url({ error: "kafka.rest_endpoint must be a valid URL" }))
+            .optional(),
+        cluster_id: z
+            .string()
+            .trim()
+            .min(1, "kafka.cluster_id cannot be empty")
+            .optional(),
+        env_id: z
+            .string()
+            .trim()
+            .startsWith("env-", "kafka.env_id must start with 'env-'")
+            .optional(),
+        extra_properties: z
+            .record(z.string(), z.string())
+            .superRefine((props, ctx) => {
+            const found = KAFKA_PROTECTED_EXTRA_PROPERTY_KEYS.filter((k) => Object.hasOwn(props, k));
+            if (found.length > 0) {
+                ctx.addIssue({
+                    code: "custom",
+                    message: `extra_properties must not include ${found.join(", ")} — use the named YAML fields (bootstrap_servers, auth) instead`,
+                });
+            }
+        })
+            .optional(),
+    })
+        .strict()
+        .refine(kafkaBlockHasConnectivity, {
+        message: "kafka block must contain at least one of 'bootstrap_servers' or 'rest_endpoint'",
+    })
+        .optional(),
+    schema_registry: z
+        .object({
+        endpoint: z
+            .string()
+            .trim()
+            .check(z.url({ error: "schema_registry.endpoint must be a valid URL" })),
+        auth: authConfigSchema.optional(),
+    })
+        .strict()
+        .optional(),
+    tableflow: z
+        .object({
+        auth: authConfigSchema,
+    })
+        .strict()
+        .optional(),
+    telemetry: z
+        .object({
+        endpoint: z
+            .string()
+            .trim()
+            .check(z.url({ error: "telemetry.endpoint must be a valid URL" }))
+            .optional(),
+        // Optional in raw input: absent auth falls back to confluent_cloud.auth in
+        // the connection-level transform, so TelemetryDirectConfig.auth is always
+        // non-null after parsing. See the transform below and TelemetryDirectConfig.
+        auth: authConfigSchema.optional(),
+    })
+        .strict()
+        .refine((t) => t.endpoint !== undefined || t.auth !== undefined, {
+        message: "telemetry block must contain at least 'endpoint' or 'auth'",
+    })
+        .optional(),
+    flink: z
+        .object({
+        endpoint: z
+            .string()
+            .trim()
+            .check(z.url({ error: "flink.endpoint must be a valid URL" })),
+        auth: authConfigSchema,
+        environment_id: z
+            .string()
+            .trim()
+            .startsWith("env-", "flink.environment_id must start with 'env-'"),
+        organization_id: z
+            .string()
+            .trim()
+            .min(1, "flink.organization_id cannot be empty"),
+        compute_pool_id: z
+            .string()
+            .trim()
+            .startsWith("lfcp-", "flink.compute_pool_id must start with 'lfcp-'"),
+        catalog_name: z
+            .string()
+            .trim()
+            .min(1, "flink.catalog_name cannot be empty")
+            .optional(),
+        database_name: z
+            .string()
+            .trim()
+            .min(1, "flink.database_name cannot be empty")
+            .optional(),
+    })
+        .strict()
+        .optional(),
+})
+    .strict();
+export const CONFLUENT_CLOUD_DEFAULT_ENDPOINT = "https://api.confluent.cloud";
+const TELEMETRY_DEFAULT_ENDPOINT = "https://api.telemetry.confluent.cloud";
+/** Zod schema for the OAuth (PKCE) connection arm. */
+const oauthConnectionSchema = z
+    .object({
+    type: z.literal("oauth"),
+    ccloud_env: z.enum(["devel", "stag", "prod"]).default("prod"),
+    kafka_debug: z
+        .string()
+        .trim()
+        .min(1, "kafka_debug cannot be empty")
+        .optional(),
+})
+    .strict();
+/**
+ * Discriminated union of all connection types: direct (api-key) and oauth (PKCE).
+ */
+const connectionConfigSchema = z
+    .discriminatedUnion("type", [directConnectionSchema, oauthConnectionSchema])
+    // superRefine call is placed here (after the union) rather than on directConnectionSchema
+    // because wrapping a ZodObject in ZodEffects breaks z.discriminatedUnion's discriminant lookup.
+    .superRefine((data, ctx) => {
+    // Reject endpoint-only telemetry when there is no auth available from either
+    // telemetry.auth or the confluent_cloud.auth fallback. Without this check the
+    // transform below would pass undefined to the ! assertion on auth, producing a
+    // TelemetryDirectConfig with auth set to undefined at runtime despite the type.
+    if (data.type === "direct" &&
+        data.telemetry?.endpoint !== undefined &&
+        data.telemetry?.auth === undefined &&
+        data.confluent_cloud?.auth === undefined) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["telemetry", "endpoint"],
+            message: "telemetry.endpoint is set but no auth is available — provide telemetry.auth or confluent_cloud.auth",
+        });
+    }
+})
+    .transform((data) => {
+    // OAuth connections carry no service blocks — pass through untouched so the
+    // direct-arm telemetry/cc resolution below doesn't spread `undefined` onto them.
+    if (data.type !== "direct")
+        return data;
+    // Resolve the raw (optional-field) telemetry input into a fully-populated
+    // TelemetryDirectConfig or undefined, applying two normalisation rules:
+    //   1. If telemetry.auth is absent, fall back to confluent_cloud.auth.
+    //   2. If telemetry.endpoint is absent, default to TELEMETRY_DEFAULT_ENDPOINT.
+    // If no telemetry block exists but confluent_cloud.auth is present, synthesise
+    // a telemetry block from it so callers never need to repeat the fallback logic.
+    const rawTelemetry = data.telemetry;
+    const ccAuth = data.confluent_cloud?.auth;
+    let resolvedTelemetry;
+    if (rawTelemetry) {
+        // superRefine above guarantees auth is non-null: endpoint-only telemetry without
+        // any auth fallback is rejected before this transform runs.
+        // Post-condition: resolvedTelemetry.auth is always non-null — hasTelemetry() is
+        // sufficient to gate telemetry-dependent tools; a separate auth check is redundant.
+        const auth = (rawTelemetry.auth ?? ccAuth);
+        const endpoint = rawTelemetry.endpoint ?? TELEMETRY_DEFAULT_ENDPOINT;
+        resolvedTelemetry = { endpoint, auth };
+    }
+    else if (ccAuth) {
+        resolvedTelemetry = {
+            endpoint: TELEMETRY_DEFAULT_ENDPOINT,
+            auth: ccAuth,
+        };
+    }
+    const resolvedCC = data.confluent_cloud
+        ? {
+            ...data.confluent_cloud,
+            endpoint: data.confluent_cloud.endpoint ?? CONFLUENT_CLOUD_DEFAULT_ENDPOINT,
+        }
+        : undefined;
+    // Cast required: TypeScript cannot verify that spreading `data` (whose optional-field
+    // types for confluent_cloud and telemetry) and overriding with fully resolved types
+    // satisfies ConnectionConfig.
+    return {
+        ...data,
+        confluent_cloud: resolvedCC,
+        telemetry: resolvedTelemetry,
+    };
+});
+// Server block schemas. Defaults are applied at each level so that omitting the
+// entire `server` block (or any sub-block) from YAML yields a fully-populated
+// ServerConfig with all fields set. MCPServerConfiguration.server is therefore
+// always non-optional and carries all operational settings.
+const serverHttpConfigSchema = z
+    .object({
+    port: z.coerce.number().int().positive().default(8080),
+    host: z.string().default("127.0.0.1"),
+    mcp_endpoint: z.string().default("/mcp"),
+    sse_endpoint: z.string().default("/sse"),
+    sse_message_endpoint: z.string().default("/messages"),
+})
+    .strict();
+const serverAuthConfigSchema = z
+    .object({
+    api_key: z
+        .string()
+        .min(32, "server.auth.api_key must be at least 32 characters")
+        .optional(),
+    disabled: z.boolean().default(false),
+    allowed_hosts: z
+        .array(z.string())
+        .default(() => ["localhost", "127.0.0.1"]),
+})
+    .strict()
+    .refine((auth) => !(auth.disabled === true && auth.api_key !== undefined), {
+    message: "server.auth.disabled and server.auth.api_key cannot both be set — remove the api_key or set disabled: false",
+});
+const serverAnalyticsConfigSchema = z
+    .object({
+    write_key: z
+        .string()
+        .trim()
+        .min(1, "server.analytics.write_key cannot be empty"),
+})
+    .strict();
+// Zod v4 requires .default() to receive a value (or factory) matching the schema's
+// output type. Since each sub-schema's output type has required fields (those with
+// their own .default() calls), we use factory functions so Zod resolves field-level
+// defaults lazily through the schema itself rather than requiring a full literal here.
+const serverConfigSchema = z
+    .object({
+    transports: z
+        .array(z.enum(Object.values(TransportType)))
+        .min(1, "server.transports must contain at least one transport")
+        .refine((arr) => new Set(arr).size === arr.length, {
+        message: "server.transports must not contain duplicate entries",
+    })
+        .default(() => [TransportType.STDIO]),
+    log_level: z
+        .enum(Object.keys(logLevels))
+        .default("info"),
+    do_not_track: z.boolean().default(false),
+    http: serverHttpConfigSchema.default(() => serverHttpConfigSchema.parse({})),
+    auth: serverAuthConfigSchema.default(() => serverAuthConfigSchema.parse({})),
+    analytics: serverAnalyticsConfigSchema.optional(),
+})
+    .strict();
+// Compile-time assertion: ServerConfig interface must remain compatible with the schema output.
+serverConfigSchema;
+/**
+ * The default server configuration produced when no `server` block is present in YAML
+ * or when MCPServerConfiguration is constructed without an explicit server argument.
+ * Derived from serverConfigSchema defaults — single source of truth.
+ */
+export const DEFAULT_SERVER_CONFIG = serverConfigSchema.parse({});
+/**
+ * Root configuration schema. This is the single validation and normalisation
+ * entry point shared by both configuration paths: YAML files (via
+ * {@link parseYamlConfiguration}) and environment variables (via
+ * {@link buildConfigFromEnvAndCli}). Transforms and cross-field rules defined here
+ * therefore apply equally to both.
+ *
+ * Parsed output is wrapped in {@link MCPServerConfiguration} by
+ * parseYamlConfiguration().
+ */
+export const mcpConfigSchema = z
+    .object({
+    connections: z
+        .record(z.string().trim().min(1, "Connection name cannot be empty"), connectionConfigSchema)
+        .refine(enforceSingleConnectionOnly, "Exactly one connection must be defined (multiple connections not yet supported)"),
+    server: serverConfigSchema.default(() => DEFAULT_SERVER_CONFIG),
+})
+    .strict();
+/** Format Zod issues into a human-readable string */
+export function formatZodIssues(issues) {
+    return issues
+        .map((issue) => {
+        const path = issue.path.join(".");
+        return path ? `  - ${path}: ${issue.message}` : `  - ${issue.message}`;
+    })
+        .join("\n");
+}
+// Temporary guard: remove when multi-connection support (#151) lands.
+function enforceSingleConnectionOnly(connections) {
+    return Object.keys(connections).length === 1;
+}
+//# sourceMappingURL=models.js.map

package/dist/config/models.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.js","sourceRoot":"","sources":["../../src/config/models.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAmLxB;;;GAGG;AACH,MAAM,OAAO,sBAAsB;IACjC,0GAA0G;IACjG,WAAW,CAA6C;IACjE,gHAAgH;IACvG,MAAM,CAAe;IAE9B,YAAY,IAGX;QACC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,0EAA0E;QAC1E,gFAAgF;QAChF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,qBAAqB,CAAC;IACrD,CAAC;IAED;;;;;OAKG;IACH,iBAAiB;QACf,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,gFAAgF,CACjF,CAAC;QACJ,CAAC;QAED,8DAA8D;QAC9D,OAAO,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,CAAE,CAAE,CAAC;IAChD,CAAC;IAED;;;;;OAKG;IACH,uBAAuB;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,iEAAiE,IAAI,CAAC,IAAI,GAAG,CAC9E,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kBAAkB;QAChB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;CACF;AAED,0FAA0F;AAE1F;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG;IACjD,mBAAmB;IACnB,eAAe;IACf,eAAe;CACP,CAAC;AAEX;;;;;;;;GAQG;AACH,SAAS,yBAAyB,CAAC,CAGlC;IACC,OAAO,CAAC,CAAC,iBAAiB,KAAK,SAAS,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS,CAAC;AAC5E,CAAC;AAED,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC;IACzD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,6BAA6B,CAAC;CAChE,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,gBAAgB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAE1E,4CAA4C;AAC5C,MAAM,sBAAsB,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzB,eAAe,EAAE,CAAC;SACf,MAAM,CAAC;QACN,QAAQ,EAAE,CAAC;aACR,MAAM,EAAE;aACR,IAAI,EAAE;aACN,KAAK,CACJ,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC,CACjE;aACA,QAAQ,EAAE;QACb,IAAI,EAAE,gBAAgB;QACtB,eAAe,EAAE,CAAC;aACf,MAAM,EAAE;aACR,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,EAAE,iDAAiD,CAAC;aACzD,QAAQ,EAAE;KACd,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;IACb,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,iBAAiB,EAAE,CAAC;aACjB,MAAM,EAAE;aACR,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,EAAE,mCAAmC,CAAC;aAC3C,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC1B,IAAI,CAAC;gBACH,wBAAwB,CAAC,KAAK,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAChE,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;aACD,QAAQ,EAAE;QACb,IAAI,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QACjC,aAAa,EAAE,CAAC;aACb,MAAM,EAAE;aACR,IAAI,EAAE;aACN,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;aAClE,QAAQ,EAAE;QACb,UAAU,EAAE,CAAC;aACV,MAAM,EAAE;aACR,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,EAAE,kCAAkC,CAAC;aAC1C,QAAQ,EAAE;QACb,MAAM,EAAE,CAAC;aACN,MAAM,EAAE;aACR,IAAI,EAAE;aACN,UAAU,CAAC,MAAM,EAAE,qCAAqC,CAAC;aACzD,QAAQ,EAAE;QACb,gBAAgB,EAAE,CAAC;aAChB,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;aAC9B,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC1B,MAAM,KAAK,GAAG,mCAAmC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7D,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CACxB,CAAC;YACF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,qCAAqC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gEAAgE;iBAC/H,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;aACD,QAAQ,EAAE;KACd,CAAC;SACD,MAAM,EAAE;SACR,MAAM,CAAC,yBAAyB,EAAE;QACjC,OAAO,EACL,iFAAiF;KACpF,CAAC;SACD,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC;SACf,MAAM,CAAC;QACN,QAAQ,EAAE,CAAC;aACR,MAAM,EAAE;aACR,IAAI,EAAE;aACN,KAAK,CACJ,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC,CACjE;QACH,IAAI,EAAE,gBAAgB,CAAC,QAAQ,EAAE;KAClC,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;IACb,SAAS,EAAE,CAAC;SACT,MAAM,CAAC;QACN,IAAI,EAAE,gBAAgB;KACvB,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;IACb,SAAS,EAAE,CAAC;SACT,MAAM,CAAC;QACN,QAAQ,EAAE,CAAC;aACR,MAAM,EAAE;aACR,IAAI,EAAE;aACN,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;aACjE,QAAQ,EAAE;QACb,2EAA2E;QAC3E,0EAA0E;QAC1E,6EAA6E;QAC7E,IAAI,EAAE,gBAAgB,CAAC,QAAQ,EAAE;KAClC,CAAC;SACD,MAAM,EAAE;SACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE;QAC/D,OAAO,EAAE,4DAA4D;KACtE,CAAC;SACD,QAAQ,EAAE;IACb,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,QAAQ,EAAE,CAAC;aACR,MAAM,EAAE;aACR,IAAI,EAAE;aACN,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;QAChE,IAAI,EAAE,gBAAgB;QACtB,cAAc,EAAE,CAAC;aACd,MAAM,EAAE;aACR,IAAI,EAAE;aACN,UAAU,CAAC,MAAM,EAAE,6CAA6C,CAAC;QACpE,eAAe,EAAE,CAAC;aACf,MAAM,EAAE;aACR,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,EAAE,uCAAuC,CAAC;QAClD,eAAe,EAAE,CAAC;aACf,MAAM,EAAE;aACR,IAAI,EAAE;aACN,UAAU,CAAC,OAAO,EAAE,+CAA+C,CAAC;QACvE,YAAY,EAAE,CAAC;aACZ,MAAM,EAAE;aACR,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,EAAE,oCAAoC,CAAC;aAC5C,QAAQ,EAAE;QACb,aAAa,EAAE,CAAC;aACb,MAAM,EAAE;aACR,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,EAAE,qCAAqC,CAAC;aAC7C,QAAQ,EAAE;KACd,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,gCAAgC,GAAG,6BAA6B,CAAC;AAC9E,MAAM,0BAA0B,GAAG,uCAAuC,CAAC;AAE3E,sDAAsD;AACtD,MAAM,qBAAqB,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7D,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,EAAE,6BAA6B,CAAC;SACrC,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;GAEG;AACH,MAAM,sBAAsB,GAAG,CAAC;KAC7B,kBAAkB,CAAC,MAAM,EAAE,CAAC,sBAAsB,EAAE,qBAAqB,CAAC,CAAC;IAC5E,0FAA0F;IAC1F,gGAAgG;KAC/F,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,6EAA6E;IAC7E,8EAA8E;IAC9E,+EAA+E;IAC/E,gFAAgF;IAChF,IACE,IAAI,CAAC,IAAI,KAAK,QAAQ;QACtB,IAAI,CAAC,SAAS,EAAE,QAAQ,KAAK,SAAS;QACtC,IAAI,CAAC,SAAS,EAAE,IAAI,KAAK,SAAS;QAClC,IAAI,CAAC,eAAe,EAAE,IAAI,KAAK,SAAS,EACxC,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC;YAC/B,OAAO,EACL,qGAAqG;SACxG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC;KACD,SAAS,CAAC,CAAC,IAAI,EAAoB,EAAE;IACpC,4EAA4E;IAC5E,iFAAiF;IACjF,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxC,0EAA0E;IAC1E,wEAAwE;IACxE,uEAAuE;IACvE,+EAA+E;IAC/E,+EAA+E;IAC/E,gFAAgF;IAChF,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC;IAC1C,IAAI,iBAAoD,CAAC;IAEzD,IAAI,YAAY,EAAE,CAAC;QACjB,iFAAiF;QACjF,4DAA4D;QAC5D,gFAAgF;QAChF,oFAAoF;QACpF,MAAM,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,MAAM,CAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,IAAI,0BAA0B,CAAC;QACrE,iBAAiB,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;SAAM,IAAI,MAAM,EAAE,CAAC;QAClB,iBAAiB,GAAG;YAClB,QAAQ,EAAE,0BAA0B;YACpC,IAAI,EAAE,MAAM;SACb,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe;QACrC,CAAC,CAAC;YACE,GAAG,IAAI,CAAC,eAAe;YACvB,QAAQ,EACN,IAAI,CAAC,eAAe,CAAC,QAAQ,IAAI,gCAAgC;SACpE;QACH,CAAC,CAAC,SAAS,CAAC;IAEd,sFAAsF;IACtF,oFAAoF;IACpF,8BAA8B;IAC9B,OAAO;QACL,GAAG,IAAI;QACP,eAAe,EAAE,UAAU;QAC3B,SAAS,EAAE,iBAAiB;KACT,CAAC;AACxB,CAAC,CAAC,CAAC;AAEL,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,4DAA4D;AAE5D,MAAM,sBAAsB,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACxC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACxC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;CACtD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,sBAAsB,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,EAAE,oDAAoD,CAAC;SAC7D,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACpC,aAAa,EAAE,CAAC;SACb,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;CAC7C,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE;IACzE,OAAO,EACL,6GAA6G;CAChH,CAAC,CAAC;AAEL,MAAM,2BAA2B,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,EAAE,4CAA4C,CAAC;CACxD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,mFAAmF;AACnF,mFAAmF;AACnF,oFAAoF;AACpF,uFAAuF;AACvF,MAAM,kBAAkB,GAAG,CAAC;KACzB,MAAM,CAAC;IACN,UAAU,EAAE,CAAC;SACV,KAAK,CACJ,CAAC,CAAC,IAAI,CACJ,MAAM,CAAC,MAAM,CAAC,aAAa,CAAwC,CACpE,CACF;SACA,GAAG,CAAC,CAAC,EAAE,uDAAuD,CAAC;SAC/D,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,EAAE;QACjD,OAAO,EAAE,sDAAsD;KAChE,CAAC;SACD,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACvC,SAAS,EAAE,CAAC;SACT,IAAI,CACH,MAAM,CAAC,IAAI,CAAC,SAAS,CAGpB,CACF;SACA,OAAO,CAAC,MAAM,CAAC;IAClB,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACxC,IAAI,EAAE,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,CACxC,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC,CACjC;IACD,IAAI,EAAE,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,CACxC,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC,CACjC;IACD,SAAS,EAAE,2BAA2B,CAAC,QAAQ,EAAE;CAClD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,gGAAgG;AAChG,kBAAoD,CAAC;AAErD;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAElE;;;;;;;;;GASG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,WAAW,EAAE,CAAC;SACX,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,iCAAiC,CAAC,EAC3D,sBAAsB,CACvB;SACA,MAAM,CACL,2BAA2B,EAC3B,iFAAiF,CAClF;IACH,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC;CAChE,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,qDAAqD;AACrD,MAAM,UAAU,eAAe,CAAC,MAA4B;IAC1D,OAAO,MAAM;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC;IACzE,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,sEAAsE;AACtE,SAAS,2BAA2B,CAClC,WAAoC;IAEpC,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AAC/C,CAAC"}

package/dist/config/validation.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Validates a Kafka bootstrap servers string.
+ * Expects comma-separated host:port pairs where port is in range 1-65535.
+ *
+ * @param value - Bootstrap servers string (e.g., "localhost:9092" or "host1:9092,host2:9093")
+ * @throws Error with specific message if validation fails
+ */
+export declare function validateBootstrapServers(value: string): void;
+//# sourceMappingURL=validation.d.ts.map

package/dist/config/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/config/validation.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAsD5D"}

package/dist/config/validation.js

@@ -0,0 +1,46 @@
+/**
+ * Validates a Kafka bootstrap servers string.
+ * Expects comma-separated host:port pairs where port is in range 1-65535.
+ *
+ * @param value - Bootstrap servers string (e.g., "localhost:9092" or "host1:9092,host2:9093")
+ * @throws Error with specific message if validation fails
+ */
+export function validateBootstrapServers(value) {
+    if (!value || typeof value !== "string") {
+        throw new Error("Value must be a non-empty string");
+    }
+    const servers = value.split(",").map((s) => s.trim());
+    // Check for empty entries (trailing/consecutive commas)
+    if (servers.includes("")) {
+        throw new Error("Invalid format: empty server entries (check for trailing or consecutive commas)");
+    }
+    for (const server of servers) {
+        // Must contain exactly one colon separating host and port
+        const parts = server.split(":");
+        if (parts.length !== 2) {
+            throw new Error(`Invalid format '${server}': must be host:port`);
+        }
+        const [host, portStr] = parts;
+        // Host must be non-empty
+        if (!host || host.trim().length === 0) {
+            throw new Error(`Invalid server '${server}': host cannot be empty`);
+        }
+        // Port must be non-empty and valid
+        if (!portStr) {
+            throw new Error(`Invalid server '${server}': port cannot be empty`);
+        }
+        // Port must be a valid integer in range 1-65535
+        const port = Number.parseInt(portStr, 10);
+        if (Number.isNaN(port)) {
+            throw new TypeError(`Invalid server '${server}': port '${portStr}' is not numeric`);
+        }
+        if (port < 1 || port > 65535) {
+            throw new Error(`Invalid server '${server}': port ${port} out of range (1-65535)`);
+        }
+        // Ensure port string is purely numeric (no trailing characters)
+        if (port.toString() !== portStr) {
+            throw new Error(`Invalid server '${server}': port '${portStr}' contains non-numeric characters`);
+        }
+    }
+}
+//# sourceMappingURL=validation.js.map

package/dist/config/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../src/config/validation.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAEtD,wDAAwD;IACxD,IAAI,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,0DAA0D;QAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,sBAAsB,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;QAE9B,yBAAyB;QACzB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,yBAAyB,CAAC,CAAC;QACtE,CAAC;QAED,mCAAmC;QACnC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,yBAAyB,CAAC,CAAC;QACtE,CAAC;QAED,gDAAgD;QAChD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CACjB,mBAAmB,MAAM,YAAY,OAAO,kBAAkB,CAC/D,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,mBAAmB,MAAM,WAAW,IAAI,yBAAyB,CAClE,CAAC;QACJ,CAAC;QAED,gEAAgE;QAChE,IAAI,IAAI,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,mBAAmB,MAAM,YAAY,OAAO,mCAAmC,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/confluent/base-client-manager.d.ts

@@ -0,0 +1,133 @@
+/**
+ * @fileoverview Abstract {@link BaseClientManager} that owns every Confluent Cloud
+ * REST client and the Schema Registry SDK client. Concrete subclasses live in
+ * sibling files ({@link DirectClientManager} for api-key auth + native Kafka,
+ * plus the OAuth variant introduced in the OAuth wiring ticket).
+ */
+import type { KafkaJS } from "@confluentinc/kafka-javascript";
+import { SchemaRegistryClient } from "@confluentinc/schemaregistry";
+import { type ConfluentCloudRestClientManager, type ConfluentRestClient, type SchemaRegistryClientHandler } from "../confluent/client-manager.js";
+import { ConfluentAuth, ConfluentEndpoints } from "../confluent/middleware.js";
+export interface BaseClientManagerConfig {
+    endpoints: ConfluentEndpoints;
+    auth: {
+        cloud: ConfluentAuth;
+        flink: ConfluentAuth;
+        tableflow: ConfluentAuth;
+        schemaRegistry: ConfluentAuth;
+        kafka: ConfluentAuth;
+        telemetry: ConfluentAuth;
+    };
+}
+/**
+ * Holds every Confluent Cloud REST client (cloud, tableflow, flink,
+ * schema-registry REST, kafka REST, telemetry) and the Schema Registry SDK
+ * client. Native Kafka admin/producer/consumer clients are declared abstract
+ * here so subclasses can supply the implementation that fits their auth model:
+ * api-key + SASL/PLAIN in {@link DirectClientManager}, or DPAT +
+ * SASL/OAUTHBEARER in OAuthClientManager.
+ *
+ * The `getSchemaRegistrySdkClient(envId?)` accessor has a default
+ * implementation that delegates to the no-arg `getSchemaRegistryClient()`.
+ * That covers direct connections (the arg is ignored). OAuth subclasses
+ * override it to auto-resolve the SR cluster from the supplied environment
+ * id (single SR per environment is the CCloud invariant) and build a
+ * bearer-authenticated SDK client per call.
+ */
+export declare abstract class BaseClientManager implements ConfluentCloudRestClientManager, SchemaRegistryClientHandler {
+    private confluentCloudBaseUrl;
+    private confluentCloudFlinkBaseUrl;
+    private confluentCloudSchemaRegistryBaseUrl;
+    private confluentCloudKafkaRestBaseUrl;
+    private confluentCloudTelemetryBaseUrl;
+    private readonly confluentCloudFlinkRestClient;
+    private readonly confluentCloudRestClient;
+    private readonly confluentCloudTableflowRestClient;
+    private readonly confluentCloudSchemaRegistryRestClient;
+    private readonly confluentCloudKafkaRestClient;
+    private readonly confluentCloudTelemetryRestClient;
+    private readonly schemaRegistryClient;
+    constructor(config: BaseClientManagerConfig);
+    /** @inheritdoc */
+    getConfluentCloudFlinkRestClient(): ConfluentRestClient;
+    /** @inheritdoc */
+    getConfluentCloudRestClient(): ConfluentRestClient;
+    /** @inheritdoc */
+    getConfluentCloudTableflowRestClient(): ConfluentRestClient;
+    /** @inheritdoc */
+    getConfluentCloudSchemaRegistryRestClient(): ConfluentRestClient;
+    /** @inheritdoc */
+    getSchemaRegistryRestClient(_envId?: string): Promise<ConfluentRestClient>;
+    /** @inheritdoc */
+    getConfluentCloudKafkaRestClient(_clusterId?: string, _envId?: string): Promise<ConfluentRestClient>;
+    /** @inheritdoc */
+    getConfluentCloudTelemetryRestClient(): ConfluentRestClient;
+    /** @inheritdoc */
+    getSchemaRegistryClient(): SchemaRegistryClient;
+    /**
+     * Environment-aware Schema Registry SDK client accessor. Under direct, the
+     * arg is ignored and the existing single-instance Lazy is returned. Under
+     * OAuth, `envId` (`env-...`) is required; the SR cluster (`lsrc-...`) is
+     * auto-resolved from the environment (single SR per environment is the
+     * CCloud invariant). The SR client itself is built per-call (no cache)
+     * because the DPAT is captured in the SDK's axios headers at construction
+     * time; endpoint resolution happens fresh on every call too.
+     */
+    getSchemaRegistrySdkClient(_envId?: string): Promise<SchemaRegistryClient>;
+    /**
+     * Cluster-aware Kafka admin client. Under direct, args are ignored and the
+     * manager-owned `AsyncLazy` singleton admin is returned (manager controls
+     * its lifetime). Under OAuth, args are required and a fresh admin is built
+     * per call — the caller owns the lifetime and must dispose via
+     * `disposeIfOAuth(runtime, connId, admin)` in a `try { ... } finally { ... }`
+     * block (helper at `@src/confluent/tools/cluster-arg-resolvers.js`).
+     */
+    abstract getKafkaAdminClient(clusterId?: string, envId?: string): Promise<KafkaJS.Admin>;
+    /**
+     * Cluster-aware Kafka producer. Same direct/OAuth lifecycle asymmetry as
+     * {@link getKafkaAdminClient}.
+     */
+    abstract getKafkaProducer(clusterId?: string, envId?: string): Promise<KafkaJS.Producer>;
+    /**
+     * Build a fresh Kafka consumer (per-call on both direct and OAuth — group
+     * membership has its own server-side lifecycle that doesn't compose with
+     * cached clients). The returned consumer is unconnected; the caller must
+     * call `connect()` and `disconnect()` (typically in a `try/finally`).
+     */
+    abstract buildKafkaConsumer(opts?: ConsumerBuildOptions): Promise<KafkaJS.Consumer>;
+    abstract disconnect(): Promise<void>;
+}
+/**
+ * Per-call options for {@link BaseClientManager.buildKafkaConsumer}. All
+ * fields are optional; each concrete manager validates only what its auth
+ * model requires (e.g. OAuth needs `clusterId` + `envId`, direct ignores
+ * both).
+ */
+export interface ConsumerBuildOptions {
+    /**
+     * Confluent Cloud logical Kafka cluster id (`lkc-...`). Required for
+     * OAuth (used to resolve the SASL/OAUTHBEARER bootstrap endpoint);
+     * ignored on direct (the bootstrap comes from connection config).
+     */
+    clusterId?: string;
+    /**
+     * Confluent Cloud environment id (`env-...`) that owns the cluster.
+     * Required for OAuth; ignored on direct.
+     */
+    envId?: string;
+    /**
+     * Consumer group identifier. On direct, appended as a suffix to the
+     * configured base group.id so concurrent MCP sessions don't share a
+     * group. On OAuth, used as the literal group id.
+     */
+    groupId?: string;
+    /**
+     * Reset policy for the consumer. Defaults to `"earliest"` when the
+     * caller omits it. Handlers that derive the value from per-call inputs
+     * (e.g. `consume-messages`, which inspects each topic entry's `start`
+     * field) pass it explicitly. Maps straight to librdkafka
+     * `auto.offset.reset`.
+     */
+    offsetReset?: "earliest" | "latest";
+}
+//# sourceMappingURL=base-client-manager.d.ts.map

package/dist/confluent/base-client-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-client-manager.d.ts","sourceRoot":"","sources":["../../src/confluent/base-client-manager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EACL,KAAK,+BAA+B,EACpC,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,EACjC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,aAAa,EACb,kBAAkB,EAEnB,MAAM,8BAA8B,CAAC;AAMtC,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,kBAAkB,CAAC;IAC9B,IAAI,EAAE;QACJ,KAAK,EAAE,aAAa,CAAC;QACrB,KAAK,EAAE,aAAa,CAAC;QACrB,SAAS,EAAE,aAAa,CAAC;QACzB,cAAc,EAAE,aAAa,CAAC;QAC9B,KAAK,EAAE,aAAa,CAAC;QACrB,SAAS,EAAE,aAAa,CAAC;KAC1B,CAAC;CACH;AAED;;;;;;;;;;;;;;GAcG;AACH,8BAAsB,iBACpB,YAAW,+BAA+B,EAAE,2BAA2B;IAEvE,OAAO,CAAC,qBAAqB,CAAqB;IAClD,OAAO,CAAC,0BAA0B,CAAqB;IACvD,OAAO,CAAC,mCAAmC,CAAqB;IAChE,OAAO,CAAC,8BAA8B,CAAqB;IAC3D,OAAO,CAAC,8BAA8B,CAAqB;IAC3D,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAA4B;IAC1E,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAA4B;IACrE,OAAO,CAAC,QAAQ,CAAC,iCAAiC,CAA4B;IAC9E,OAAO,CAAC,QAAQ,CAAC,sCAAsC,CAA4B;IACnF,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAA4B;IAC1E,OAAO,CAAC,QAAQ,CAAC,iCAAiC,CAA4B;IAC9E,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6B;gBAEtD,MAAM,EAAE,uBAAuB;IAkI3C,kBAAkB;IAClB,gCAAgC,IAAI,mBAAmB;IAIvD,kBAAkB;IAClB,2BAA2B,IAAI,mBAAmB;IAIlD,kBAAkB;IAClB,oCAAoC,IAAI,mBAAmB;IAI3D,kBAAkB;IAClB,yCAAyC,IAAI,mBAAmB;IAIhE,kBAAkB;IACZ,2BAA2B,CAC/B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,mBAAmB,CAAC;IAI/B,kBAAkB;IACZ,gCAAgC,CACpC,UAAU,CAAC,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,mBAAmB,CAAC;IAI/B,kBAAkB;IAClB,oCAAoC,IAAI,mBAAmB;IAI3D,kBAAkB;IAClB,uBAAuB,IAAI,oBAAoB;IAI/C;;;;;;;;OAQG;IACG,0BAA0B,CAC9B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,oBAAoB,CAAC;IAIhC;;;;;;;OAOG;IACH,QAAQ,CAAC,mBAAmB,CAC1B,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;IAEzB;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CACvB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;IAE5B;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,CACzB,IAAI,CAAC,EAAE,oBAAoB,GAC1B,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;IAE5B,QAAQ,CAAC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;CACrC;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;CACrC"}