@confluentinc/mcp-confluent 1.2.2 → 1.4.0

package/dist/confluent/config-telemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-telemetry.js","sourceRoot":"","sources":["../../src/confluent/config-telemetry.ts"],"names":[],"mappings":"AAqCA;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAsB,EACtB,SAAiC,EACjC,UAAoC;IAEpC,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC;SACzD,GAAG,CAA0B,CAAC,IAAI,EAAE,EAAE,CACrC,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAClD;SACA,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClB,OAAO;QACL,YAAY,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU;QACrD,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC1C,eAAe;KAChB,CAAC;AACJ,CAAC"}

package/dist/confluent/direct-client-manager.d.ts

@@ -0,0 +1,43 @@
+/**
+ * @fileoverview Direct (api-key) client manager — adds a native Kafka client to the
+ * REST/Schema-Registry surfaces inherited from {@link BaseClientManager}.
+ */
+import { GlobalConfig, KafkaJS } from "@confluentinc/kafka-javascript";
+import { type DirectConnectionConfig } from "../config/models.js";
+import { BaseClientManager, type BaseClientManagerConfig, type ConsumerBuildOptions } from "../confluent/base-client-manager.js";
+import { type ClientManager } from "../confluent/client-manager.js";
+export interface DirectClientManagerConfig extends BaseClientManagerConfig {
+    kafka: GlobalConfig;
+}
+/**
+ * Direct API-key client manager. Adds a native Kafka client (admin, producer, consumer)
+ * authenticated via SASL/PLAIN on top of the REST clients in {@link BaseClientManager}.
+ */
+export declare class DirectClientManager extends BaseClientManager implements ClientManager {
+    private readonly kafkaConfig;
+    private readonly kafkaClient;
+    private readonly adminClient;
+    private readonly producer;
+    constructor(config: DirectClientManagerConfig);
+    /** @inheritdoc */
+    getConsumer(sessionId?: string): Promise<KafkaJS.Consumer>;
+    /** @inheritdoc */
+    getKafkaClient(): KafkaJS.Kafka;
+    /** @inheritdoc */
+    getAdminClient(): Promise<KafkaJS.Admin>;
+    /** @inheritdoc */
+    getProducer(): Promise<KafkaJS.Producer>;
+    /** @inheritdoc */
+    getKafkaAdminClient(_clusterId?: string, _envId?: string): Promise<KafkaJS.Admin>;
+    /** @inheritdoc */
+    getKafkaProducer(_clusterId?: string, _envId?: string): Promise<KafkaJS.Producer>;
+    /** @inheritdoc */
+    buildKafkaConsumer(opts?: ConsumerBuildOptions): Promise<KafkaJS.Consumer>;
+    /** @inheritdoc */
+    disconnect(): Promise<void>;
+}
+/**
+ * Constructs a {@link DirectClientManager} from a single direct connection config.
+ */
+export declare function constructDirectClientManager(conn: DirectConnectionConfig): DirectClientManager;
+//# sourceMappingURL=direct-client-manager.d.ts.map

package/dist/confluent/direct-client-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"direct-client-manager.d.ts","sourceRoot":"","sources":["../../src/confluent/direct-client-manager.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EAC1B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAKtE,MAAM,WAAW,yBAA0B,SAAQ,uBAAuB;IACxE,KAAK,EAAE,YAAY,CAAC;CACrB;AAED;;;GAGG;AACH,qBAAa,mBACX,SAAQ,iBACR,YAAW,aAAa;IAExB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAe;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsB;IAClD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA2B;IACvD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA8B;gBAE3C,MAAM,EAAE,yBAAyB;IAkC7C,kBAAkB;IACZ,WAAW,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;IAIhE,kBAAkB;IAClB,cAAc,IAAI,OAAO,CAAC,KAAK;IAI/B,kBAAkB;IACZ,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;IAI9C,kBAAkB;IACZ,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;IAI9C,kBAAkB;IACZ,mBAAmB,CACvB,UAAU,CAAC,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;IAIzB,kBAAkB;IACZ,gBAAgB,CACpB,UAAU,CAAC,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;IAI5B,kBAAkB;IACZ,kBAAkB,CACtB,IAAI,CAAC,EAAE,oBAAoB,GAC1B,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;IA0B5B,kBAAkB;IACZ,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;CAKlC;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,sBAAsB,GAC3B,mBAAmB,CAqDrB"}

package/dist/confluent/direct-client-manager.js

@@ -0,0 +1,154 @@
+/**
+ * @fileoverview Direct (api-key) client manager — adds a native Kafka client to the
+ * REST/Schema-Registry surfaces inherited from {@link BaseClientManager}.
+ */
+import { CONFLUENT_CLOUD_DEFAULT_ENDPOINT, } from "../config/models.js";
+import { BaseClientManager, } from "../confluent/base-client-manager.js";
+import { kafkaDeps } from "../confluent/node-deps.js";
+import { AsyncLazy, Lazy } from "../lazy.js";
+import { kafkaLogger, logger } from "../logger.js";
+/**
+ * Direct API-key client manager. Adds a native Kafka client (admin, producer, consumer)
+ * authenticated via SASL/PLAIN on top of the REST clients in {@link BaseClientManager}.
+ */
+export class DirectClientManager extends BaseClientManager {
+    kafkaConfig;
+    kafkaClient;
+    adminClient;
+    producer;
+    constructor(config) {
+        super(config);
+        this.kafkaConfig = config.kafka;
+        this.kafkaClient = new Lazy(() => new kafkaDeps.Kafka({
+            ...this.kafkaConfig,
+            kafkaJS: {
+                logger: kafkaLogger,
+                // we need to do this since typescript will complain that we are missing configs like `brokers` even though we are passing them in kafkaConfig above
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            },
+        }));
+        this.adminClient = new AsyncLazy(async () => {
+            logger.info("Connecting Kafka Admin");
+            const admin = this.kafkaClient.get().admin();
+            await admin.connect();
+            return admin;
+        }, (admin) => admin.disconnect());
+        this.producer = new AsyncLazy(async () => {
+            logger.info("Connecting Kafka Producer");
+            const producer = this.kafkaClient.get().producer();
+            await producer.connect();
+            return producer;
+        }, (producer) => producer.disconnect());
+    }
+    /** @inheritdoc */
+    async getConsumer(sessionId) {
+        return this.buildKafkaConsumer({ groupId: sessionId });
+    }
+    /** @inheritdoc */
+    getKafkaClient() {
+        return this.kafkaClient.get();
+    }
+    /** @inheritdoc */
+    async getAdminClient() {
+        return this.adminClient.get();
+    }
+    /** @inheritdoc */
+    async getProducer() {
+        return this.producer.get();
+    }
+    /** @inheritdoc */
+    async getKafkaAdminClient(_clusterId, _envId) {
+        return this.getAdminClient();
+    }
+    /** @inheritdoc */
+    async getKafkaProducer(_clusterId, _envId) {
+        return this.getProducer();
+    }
+    /** @inheritdoc */
+    async buildKafkaConsumer(opts) {
+        const baseGroupId = this.kafkaConfig["group.id"] || "mcp-confluent";
+        const groupId = opts?.groupId
+            ? `${baseGroupId}-${opts.groupId}`
+            : baseGroupId;
+        const offsetReset = opts?.offsetReset ?? this.kafkaConfig["auto.offset.reset"] ?? "earliest";
+        const consumerConfig = {
+            ...this.kafkaConfig,
+            "group.id": groupId,
+            "auto.offset.reset": offsetReset,
+            // The consume-messages tool is a read-only snapshot; never a topic
+            // creator. Hardcode auto-create off so a typo'd topic name can't
+            // silently bring a topic into existence via librdkafka's
+            // default-`true` for this setting.
+            "allow.auto.create.topics": false,
+            // Same hardcode-rather-than-honor logic: this tool is a snapshot
+            // read, not a stream resumption. Committing offsets back would
+            // silently shift the start position for the next call — not part
+            // of the tool contract.
+            "enable.auto.commit": false,
+        };
+        return this.kafkaClient.get().consumer(consumerConfig);
+    }
+    /** @inheritdoc */
+    async disconnect() {
+        await this.adminClient.close();
+        await this.producer.close();
+        this.kafkaClient.close();
+    }
+}
+/**
+ * Constructs a {@link DirectClientManager} from a single direct connection config.
+ */
+export function constructDirectClientManager(conn) {
+    const kafkaClientConfig = {
+        "client.id": "mcp-confluent",
+        ...(conn.kafka?.bootstrap_servers && {
+            "bootstrap.servers": conn.kafka.bootstrap_servers,
+        }),
+        ...(conn.kafka?.auth
+            ? {
+                "security.protocol": "sasl_ssl",
+                "sasl.mechanisms": "PLAIN",
+                "sasl.username": conn.kafka.auth.key,
+                "sasl.password": conn.kafka.auth.secret,
+            }
+            : {}),
+        ...conn.kafka?.extra_properties,
+    };
+    return new DirectClientManager({
+        kafka: kafkaClientConfig,
+        endpoints: {
+            cloud: conn.confluent_cloud?.endpoint ?? CONFLUENT_CLOUD_DEFAULT_ENDPOINT,
+            flink: conn.flink?.endpoint,
+            schemaRegistry: conn.schema_registry?.endpoint,
+            kafka: conn.kafka?.rest_endpoint,
+            telemetry: conn.telemetry?.endpoint,
+        },
+        auth: {
+            cloud: {
+                apiKey: conn.confluent_cloud?.auth.key,
+                apiSecret: conn.confluent_cloud?.auth.secret,
+            },
+            tableflow: {
+                apiKey: conn.tableflow?.auth.key,
+                apiSecret: conn.tableflow?.auth.secret,
+            },
+            flink: {
+                apiKey: conn.flink?.auth.key,
+                apiSecret: conn.flink?.auth.secret,
+            },
+            schemaRegistry: {
+                apiKey: conn.schema_registry?.auth?.key,
+                apiSecret: conn.schema_registry?.auth?.secret,
+            },
+            kafka: {
+                apiKey: conn.kafka?.auth?.key,
+                apiSecret: conn.kafka?.auth?.secret,
+            },
+            telemetry: {
+                apiKey: conn.telemetry?.auth.key,
+                apiSecret: conn.telemetry?.auth.secret,
+            },
+        },
+    });
+}
+//# sourceMappingURL=direct-client-manager.js.map

package/dist/confluent/direct-client-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"direct-client-manager.js","sourceRoot":"","sources":["../../src/confluent/direct-client-manager.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EACL,gCAAgC,GAEjC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,GAGlB,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAMrD;;;GAGG;AACH,MAAM,OAAO,mBACX,SAAQ,iBAAiB;IAGR,WAAW,CAAe;IAC1B,WAAW,CAAsB;IACjC,WAAW,CAA2B;IACtC,QAAQ,CAA8B;IAEvD,YAAY,MAAiC;QAC3C,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC;QAChC,IAAI,CAAC,WAAW,GAAG,IAAI,IAAI,CACzB,GAAG,EAAE,CACH,IAAI,SAAS,CAAC,KAAK,CAAC;YAClB,GAAG,IAAI,CAAC,WAAW;YACnB,OAAO,EAAE;gBACP,MAAM,EAAE,WAAW;gBACnB,oJAAoJ;gBACpJ,8DAA8D;aACxD;SACT,CAAC,CACL,CAAC;QACF,IAAI,CAAC,WAAW,GAAG,IAAI,SAAS,CAC9B,KAAK,IAAI,EAAE;YACT,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;YACtC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;YAC7C,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,CAC9B,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,IAAI,SAAS,CAC3B,KAAK,IAAI,EAAE;YACT,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;YACnD,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,QAAQ,CAAC;QAClB,CAAC,EACD,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,CACpC,CAAC;IACJ,CAAC;IAED,kBAAkB;IAClB,KAAK,CAAC,WAAW,CAAC,SAAkB;QAClC,OAAO,IAAI,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,kBAAkB;IAClB,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,CAAC;IAED,kBAAkB;IAClB,KAAK,CAAC,cAAc;QAClB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,CAAC;IAED,kBAAkB;IAClB,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;IAC7B,CAAC;IAED,kBAAkB;IAClB,KAAK,CAAC,mBAAmB,CACvB,UAAmB,EACnB,MAAe;QAEf,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC;IAC/B,CAAC;IAED,kBAAkB;IAClB,KAAK,CAAC,gBAAgB,CACpB,UAAmB,EACnB,MAAe;QAEf,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC5B,CAAC;IAED,kBAAkB;IAClB,KAAK,CAAC,kBAAkB,CACtB,IAA2B;QAE3B,MAAM,WAAW,GACd,IAAI,CAAC,WAAW,CAAC,UAAU,CAAY,IAAI,eAAe,CAAC;QAC9D,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO;YAC3B,CAAC,CAAC,GAAG,WAAW,IAAI,IAAI,CAAC,OAAO,EAAE;YAClC,CAAC,CAAC,WAAW,CAAC;QAChB,MAAM,WAAW,GACf,IAAI,EAAE,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,IAAI,UAAU,CAAC;QAC3E,MAAM,cAAc,GAAG;YACrB,GAAG,IAAI,CAAC,WAAW;YACnB,UAAU,EAAE,OAAO;YACnB,mBAAmB,EAAE,WAAW;YAChC,mEAAmE;YACnE,iEAAiE;YACjE,yDAAyD;YACzD,mCAAmC;YACnC,0BAA0B,EAAE,KAAK;YACjC,iEAAiE;YACjE,+DAA+D;YAC/D,iEAAiE;YACjE,wBAAwB;YACxB,oBAAoB,EAAE,KAAK;SAC5B,CAAC;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IACzD,CAAC;IAED,kBAAkB;IAClB,KAAK,CAAC,UAAU;QACd,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,IAA4B;IAE5B,MAAM,iBAAiB,GAAiB;QACtC,WAAW,EAAE,eAAe;QAC5B,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,iBAAiB,IAAI;YACnC,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB;SAClD,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI;YAClB,CAAC,CAAC;gBACE,mBAAmB,EAAE,UAAU;gBAC/B,iBAAiB,EAAE,OAAO;gBAC1B,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG;gBACpC,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM;aACxC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,IAAI,CAAC,KAAK,EAAE,gBAAgB;KAChC,CAAC;IAEF,OAAO,IAAI,mBAAmB,CAAC;QAC7B,KAAK,EAAE,iBAAiB;QACxB,SAAS,EAAE;YACT,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,IAAI,gCAAgC;YACzE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ;YAC3B,cAAc,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ;YAC9C,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,aAAa;YAChC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ;SACpC;QACD,IAAI,EAAE;YACJ,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,GAAG;gBACtC,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM;aAC7C;YACD,SAAS,EAAE;gBACT,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG;gBAChC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM;aACvC;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG;gBAC5B,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM;aACnC;YACD,cAAc,EAAE;gBACd,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,GAAG;gBACvC,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,MAAM;aAC9C;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG;gBAC7B,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM;aACpC;YACD,SAAS,EAAE;gBACT,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG;gBAChC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM;aACvC;SACF;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/confluent/middleware.d.ts

@@ -1,18 +1,46 @@
 import { Middleware } from "openapi-fetch";
+/**
+ * Thrown by the bearer middleware when the token getter returns undefined —
+ * typically because OAuth bootstrap has not completed (or has been cleared by
+ * shutdown) at the moment a request is about to be sent. Surfaces a clear
+ * message for callers; tool handlers can catch it explicitly to return
+ * `{ isError: true }` instead of letting it propagate as a protocol-level
+ * error from the MCP transport.
+ */
+export declare class BearerTokenUnavailableError extends Error {
+    constructor(message: string);
+}
+/**
+ * Build a {@link Middleware} that attaches `Authorization: Bearer <token>`
+ * read from `getToken()` and sets a `User-Agent` header containing this
+ * package's version. The closure is supplied by the caller; this middleware
+ * has no knowledge of where the token comes from or when it expires. Throws
+ * {@link BearerTokenUnavailableError} when `getToken` returns `undefined`.
+ */
+export declare const createBearerMiddleware: (getToken: () => string | undefined) => Middleware;
 export interface ConfluentEndpoints {
     cloud?: string;
-    tableflow?: string;
     flink?: string;
     schemaRegistry?: string;
     kafka?: string;
     telemetry?: string;
 }
-export interface ConfluentAuth {
+/**
+ * Discriminated union over the two authentication shapes the middleware
+ * understands. The `api_key` variant's `type` field is optional so existing
+ * call sites that pass `{ apiKey, apiSecret }` keep working.
+ */
+export type ConfluentAuth = {
+    type?: "api_key";
     apiKey?: string;
     apiSecret?: string;
-}
+} | {
+    type: "oauth";
+    getToken: () => string | undefined;
+};
 /**
- * Creates a middleware that adds Authorization header using the provided auth credentials
+ * Creates a middleware that attaches an Authorization header. Dispatches on
+ * the `type` discriminator: `oauth` → bearer; `api_key` (or unset) → Basic.
  */
 export declare const createAuthMiddleware: (auth: ConfluentAuth) => Middleware;
 //# sourceMappingURL=middleware.d.ts.map

package/dist/confluent/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/confluent/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAG3C,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,GAAI,MAAM,aAAa,KAAG,UAkBzD,CAAC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/confluent/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAG3C;;;;;;;GAOG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,GACjC,UAAU,MAAM,MAAM,GAAG,SAAS,KACjC,UAYD,CAAC;AAEH,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAE1D;;;GAGG;AACH,eAAO,MAAM,oBAAoB,GAAI,MAAM,aAAa,KAAG,UAK1D,CAAC"}

package/dist/confluent/middleware.js

@@ -1,9 +1,53 @@
 import { logger } from "../logger.js";
 import pkg from "../../package.json" with { type: "json" };
 /**
- * Creates a middleware that adds Authorization header using the provided auth credentials
+ * Thrown by the bearer middleware when the token getter returns undefined —
+ * typically because OAuth bootstrap has not completed (or has been cleared by
+ * shutdown) at the moment a request is about to be sent. Surfaces a clear
+ * message for callers; tool handlers can catch it explicitly to return
+ * `{ isError: true }` instead of letting it propagate as a protocol-level
+ * error from the MCP transport.
  */
-export const createAuthMiddleware = (auth) => ({
+export class BearerTokenUnavailableError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "BearerTokenUnavailableError";
+    }
+}
+/**
+ * Build a {@link Middleware} that attaches `Authorization: Bearer <token>`
+ * read from `getToken()` and sets a `User-Agent` header containing this
+ * package's version. The closure is supplied by the caller; this middleware
+ * has no knowledge of where the token comes from or when it expires. Throws
+ * {@link BearerTokenUnavailableError} when `getToken` returns `undefined`.
+ */
+export const createBearerMiddleware = (getToken) => ({
+    async onRequest({ request }) {
+        const token = getToken();
+        if (!token) {
+            throw new BearerTokenUnavailableError("OAuth token is not currently available.");
+        }
+        request.headers.set("Authorization", `Bearer ${token}`);
+        request.headers.set("User-Agent", `mcp-confluent-local/${pkg.version}`);
+        return request;
+    },
+});
+/**
+ * Creates a middleware that attaches an Authorization header. Dispatches on
+ * the `type` discriminator: `oauth` → bearer; `api_key` (or unset) → Basic.
+ */
+export const createAuthMiddleware = (auth) => {
+    if (auth.type === "oauth") {
+        return createBearerMiddleware(auth.getToken);
+    }
+    return createApiKeyMiddleware(auth);
+};
+/**
+ * Original Basic-auth middleware, unchanged from before the discriminated
+ * union was introduced. Extracted to a named factory so {@link createAuthMiddleware}
+ * can dispatch to it without inlining its body.
+ */
+const createApiKeyMiddleware = (auth) => ({
     async onRequest({ request }) {
         logger.debug({ request }, "Processing request");
         if (auth.apiKey && auth.apiSecret) {

package/dist/confluent/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/confluent/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAgB3D;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,IAAmB,EAAc,EAAE,CAAC,CAAC;IACxE,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE;QACzB,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,oBAAoB,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,OAAO,CAAC,GAAG,CACjB,eAAe,EACf,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAC9E,CAAC;QACJ,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;YACrD,MAAM,CAAC,IAAI,CACT,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAC3D,wBAAwB,OAAO,oCAAoC,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,uBAAuB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxE,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/confluent/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAE3D;;;;;;;GAOG;AACH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,QAAkC,EACtB,EAAE,CAAC,CAAC;IAChB,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE;QACzB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,2BAA2B,CACnC,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,uBAAuB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxE,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAC,CAAC;AAmBH;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,IAAmB,EAAc,EAAE;IACtE,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1B,OAAO,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,CAAC,IAG/B,EAAc,EAAE,CAAC,CAAC;IACjB,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE;QACzB,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,oBAAoB,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,OAAO,CAAC,GAAG,CACjB,eAAe,EACf,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAC9E,CAAC;QACJ,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;YACrD,MAAM,CAAC,IAAI,CACT,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAC3D,wBAAwB,OAAO,oCAAoC,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,uBAAuB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxE,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAC,CAAC"}

package/dist/confluent/node-deps.d.ts

@@ -1,12 +1,22 @@
+import { KafkaJS } from "@confluentinc/kafka-javascript";
+import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { Analytics } from "@segment/analytics-node";
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import * as dotenv from "dotenv";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { createServer as httpCreateServer } from "node:http";
 import { arch, homedir, platform, release } from "node:os";
 export declare const buildConfig: {
     TELEMETRY_WRITE_KEY: string;
 };
+export declare const dotenvLib: {
+    config: typeof dotenv.config;
+};
 export declare const fs: {
+    existsSync: typeof existsSync;
     readFileSync: typeof readFileSync;
     writeFileSync: typeof writeFileSync;
+    appendFileSync: typeof appendFileSync;
     mkdirSync: typeof mkdirSync;
 };
 export declare const os: {
@@ -17,47 +27,31 @@ export declare const os: {
 };
 export declare const path: {
     join: (...paths: string[]) => string;
+    resolve: (...paths: string[]) => string;
+    dirname: (path: string) => string;
+    basename: (path: string, suffix?: string) => string;
 };
 export declare const segment: {
     Analytics: typeof Analytics;
 };
-export declare const config: {
-    env: {
-        HTTP_PORT: number;
-        HTTP_HOST: string;
-        HTTP_MCP_ENDPOINT_PATH: string;
-        SSE_MCP_ENDPOINT_PATH: string;
-        SSE_MCP_MESSAGE_ENDPOINT_PATH: string;
-        LOG_LEVEL: "info" | "fatal" | "error" | "warn" | "debug" | "trace";
-        MCP_AUTH_DISABLED: boolean;
-        DO_NOT_TRACK: boolean;
-        MCP_ALLOWED_HOSTS: string[];
-        MCP_API_KEY?: string | undefined;
-        BOOTSTRAP_SERVERS?: string | undefined;
-        KAFKA_API_KEY?: string | undefined;
-        KAFKA_API_SECRET?: string | undefined;
-        FLINK_API_KEY?: string | undefined;
-        FLINK_API_SECRET?: string | undefined;
-        CONFLUENT_CLOUD_API_KEY?: string | undefined;
-        CONFLUENT_CLOUD_API_SECRET?: string | undefined;
-        SCHEMA_REGISTRY_API_KEY?: string | undefined;
-        SCHEMA_REGISTRY_API_SECRET?: string | undefined;
-        TABLEFLOW_API_KEY?: string | undefined;
-        TABLEFLOW_API_SECRET?: string | undefined;
-        FLINK_ENV_ID?: string | undefined;
-        FLINK_ORG_ID?: string | undefined;
-        FLINK_REST_ENDPOINT?: string | undefined;
-        FLINK_COMPUTE_POOL_ID?: string | undefined;
-        FLINK_ENV_NAME?: string | undefined;
-        FLINK_DATABASE_NAME?: string | undefined;
-        KAFKA_CLUSTER_ID?: string | undefined;
-        KAFKA_ENV_ID?: string | undefined;
-        CONFLUENT_CLOUD_REST_ENDPOINT?: string | undefined;
-        SCHEMA_REGISTRY_ENDPOINT?: string | undefined;
-        KAFKA_REST_ENDPOINT?: string | undefined;
-        TELEMETRY_ENDPOINT?: string | undefined;
-        TELEMETRY_API_KEY?: string | undefined;
-        TELEMETRY_API_SECRET?: string | undefined;
-    };
+export declare const nodeFetch: {
+    fetch: typeof fetch;
+};
+export declare const nodeCrypto: {
+    randomBytes: (size: number) => Buffer;
+    randomUUID: () => string;
+};
+export declare const nodeHttp: {
+    createServer: typeof httpCreateServer;
+};
+export declare const nodeOpen: {
+    open: (target: string) => Promise<void>;
+};
+export declare const sdkTransports: {
+    StreamableHTTPServerTransport: typeof StreamableHTTPServerTransport;
+    SSEServerTransport: typeof SSEServerTransport;
+};
+export declare const kafkaDeps: {
+    Kafka: typeof KafkaJS.Kafka;
 };
 //# sourceMappingURL=node-deps.d.ts.map

package/dist/confluent/node-deps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-deps.d.ts","sourceRoot":"","sources":["../../src/confluent/node-deps.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAGpD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAG3D,eAAO,MAAM,WAAW;;CAA0B,CAAC;AACnD,eAAO,MAAM,EAAE;;;;CAA6C,CAAC;AAC7D,eAAO,MAAM,EAAE;;;;;CAAuC,CAAC;AACvD,eAAO,MAAM,IAAI;;CAAW,CAAC;AAC7B,eAAO,MAAM,OAAO;;CAAgB,CAAC;AACrC,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAoB,CAAC"}
+{"version":3,"file":"node-deps.d.ts","sourceRoot":"","sources":["../../src/confluent/node-deps.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAEjC,OAAO,EACL,cAAc,EACd,UAAU,EACV,SAAS,EACT,YAAY,EACZ,aAAa,EACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAG3D,eAAO,MAAM,WAAW;;CAA0B,CAAC;AACnD,eAAO,MAAM,SAAS;;CAA4B,CAAC;AACnD,eAAO,MAAM,EAAE;;;;;;CAMd,CAAC;AACF,eAAO,MAAM,EAAE;;;;;CAAuC,CAAC;AACvD,eAAO,MAAM,IAAI;;;;;CAAuC,CAAC;AACzD,eAAO,MAAM,OAAO;;CAAgB,CAAC;AACrC,eAAO,MAAM,SAAS;;CAA8B,CAAC;AAIrD,eAAO,MAAM,UAAU;wBACD,MAAM,KAAG,MAAM;sBACnB,MAAM;CACvB,CAAC;AACF,eAAO,MAAM,QAAQ;;CAAqC,CAAC;AAG3D,eAAO,MAAM,QAAQ;mBACE,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;CAQ5C,CAAC;AACF,eAAO,MAAM,aAAa;;;CAGzB,CAAC;AAGF,eAAO,MAAM,SAAS;;CAA2B,CAAC"}

package/dist/confluent/node-deps.js

@@ -1,14 +1,55 @@
-// Wrappers for easier stubbing in tests since sinon can't stub ES module imports directly
+// Wrappers for easier stubbing in tests — ESM live bindings can't be stubbed at runtime,
+// but property access on these namespace objects can be (via `vi.spyOn`).
+import { KafkaJS } from "@confluentinc/kafka-javascript";
+import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { Analytics } from "@segment/analytics-node";
 import { TELEMETRY_WRITE_KEY } from "../build-config.js";
-import envProxy from "../env.js";
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import * as dotenv from "dotenv";
+import { randomBytes, randomUUID } from "node:crypto";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync, } from "node:fs";
+import { createServer as httpCreateServer } from "node:http";
 import { arch, homedir, platform, release } from "node:os";
-import { join } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 export const buildConfig = { TELEMETRY_WRITE_KEY };
-export const fs = { readFileSync, writeFileSync, mkdirSync };
+export const dotenvLib = { config: dotenv.config };
+export const fs = {
+    existsSync,
+    readFileSync,
+    writeFileSync,
+    appendFileSync,
+    mkdirSync,
+};
 export const os = { homedir, platform, release, arch };
-export const path = { join };
+export const path = { join, resolve, dirname, basename };
 export const segment = { Analytics };
-export const config = { env: envProxy };
+export const nodeFetch = { fetch: globalThis.fetch };
+// Wrapped as a single-signature arrow so spies don't have to disambiguate
+// between the sync and callback overloads of the underlying `node:crypto`
+// `randomBytes`. The codebase only uses the sync form.
+export const nodeCrypto = {
+    randomBytes: (size) => randomBytes(size),
+    randomUUID: () => randomUUID(),
+};
+export const nodeHttp = { createServer: httpCreateServer };
+// `open` is loaded lazily so non-OAuth runs don't pay the import cost (it
+// pulls in is-wsl, default-browser, etc.).
+export const nodeOpen = {
+    open: async (target) => {
+        // skip during integration test runs: playwright drives auth headlessly, so a system-browser
+        // open is redundant and would race on the OAuth callback port.
+        // eslint-disable-next-line no-restricted-syntax -- localized test seam, not a config read
+        if (process.env.INTEGRATION_TEST === "1")
+            return;
+        const { default: open } = await import("open");
+        await open(target);
+    },
+};
+export const sdkTransports = {
+    StreamableHTTPServerTransport,
+    SSEServerTransport,
+};
+// KafkaJS constructor wrapped so tests can spy on `kafkaDeps.Kafka` and return
+// a mock Kafka instance without needing vi.mock on the external module.
+export const kafkaDeps = { Kafka: KafkaJS.Kafka };
 //# sourceMappingURL=node-deps.js.map

package/dist/confluent/node-deps.js.map

@@ -1 +1 @@
-{"version":3,"file":"node-deps.js","sourceRoot":"","sources":["../../src/confluent/node-deps.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,QAAQ,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,mBAAmB,EAAE,CAAC;AACnD,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;AAC7D,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACvD,MAAM,CAAC,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC;AAC7B,MAAM,CAAC,MAAM,OAAO,GAAG,EAAE,SAAS,EAAE,CAAC;AACrC,MAAM,CAAC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC"}
+{"version":3,"file":"node-deps.js","sourceRoot":"","sources":["../../src/confluent/node-deps.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,0EAA0E;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EACL,cAAc,EACd,UAAU,EACV,SAAS,EACT,YAAY,EACZ,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE7D,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,mBAAmB,EAAE,CAAC;AACnD,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;AACnD,MAAM,CAAC,MAAM,EAAE,GAAG;IAChB,UAAU;IACV,YAAY;IACZ,aAAa;IACb,cAAc;IACd,SAAS;CACV,CAAC;AACF,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACvD,MAAM,CAAC,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACzD,MAAM,CAAC,MAAM,OAAO,GAAG,EAAE,SAAS,EAAE,CAAC;AACrC,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;AACrD,0EAA0E;AAC1E,0EAA0E;AAC1E,uDAAuD;AACvD,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,WAAW,EAAE,CAAC,IAAY,EAAU,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC;IACxD,UAAU,EAAE,GAAW,EAAE,CAAC,UAAU,EAAE;CACvC,CAAC;AACF,MAAM,CAAC,MAAM,QAAQ,GAAG,EAAE,YAAY,EAAE,gBAAgB,EAAE,CAAC;AAC3D,0EAA0E;AAC1E,2CAA2C;AAC3C,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,IAAI,EAAE,KAAK,EAAE,MAAc,EAAiB,EAAE;QAC5C,4FAA4F;QAC5F,+DAA+D;QAC/D,0FAA0F;QAC1F,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,GAAG;YAAE,OAAO;QACjD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;CACF,CAAC;AACF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,6BAA6B;IAC7B,kBAAkB;CACnB,CAAC;AACF,+EAA+E;AAC/E,wEAAwE;AACxE,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC"}

package/dist/confluent/oauth/auth-context.d.ts

@@ -0,0 +1,94 @@
+import { type AuthErrors } from "../../confluent/oauth/errors.js";
+import type { Auth0Config, ConfluentTokenSet } from "../../confluent/oauth/types.js";
+/**
+ * Owns one user's Confluent OAuth lifecycle — token state plus the
+ * transformations that advance it. Internal state advances via atomic
+ * transform functions under {@link AuthContext.updateTokens} so each step is
+ * atomic and no caller mutates the token set directly.
+ */
+export declare class AuthContext {
+    private readonly auth0Config;
+    private internalTokens;
+    private cleared;
+    private refreshTimer;
+    private inflightRefresh;
+    private errors;
+    private failedRefreshAttempts;
+    private constructor();
+    /** Runs the auth code → CP → DP chain and wraps the result in a context. */
+    static newFromInitialLogin(auth0Config: Auth0Config, authCode: string, codeVerifier: string): Promise<AuthContext>;
+    /** Build a context from an already-acquired token set. */
+    static fromTokens(auth0Config: Auth0Config, tokens: ConfluentTokenSet): AuthContext;
+    /** Opaque access token — stable across refreshes. */
+    get accessToken(): string;
+    /**
+     * Current control-plane bearer token, or `undefined` if the context is
+     * cleared or the CP token has expired. Call this immediately before each
+     * API request — don't cache the returned string across awaits.
+     */
+    getControlPlaneToken(): string | undefined;
+    /**
+     * Current data-plane bearer token, or `undefined` if the context is
+     * cleared or the DP token has expired. Same usage guidance as
+     * {@link getControlPlaneToken}.
+     */
+    getDataPlaneToken(): string | undefined;
+    /**
+     * Readonly view of current auth-lifecycle errors. Consumers check this to decide
+     * whether to prompt re-auth (when a non-transient error has been flagged).
+     */
+    getErrors(): Readonly<AuthErrors>;
+    /** True when the refresh token is no longer usable (expired or cleared). */
+    refreshTokenExpired(now?: number): boolean;
+    /**
+     * Pure predicate: should the refresh loop call `refresh()` on this context
+     * right now? True when the refresh token is still live, no non-transient
+     * error has been recorded, and the CP token is within the refresh window.
+     */
+    shouldAttemptRefresh(now?: number): boolean;
+    /**
+     * Rotate the refresh token, then derive new CP and DP tokens. The rotated
+     * refresh token is persisted before the CP/DP leg so a phase-2 failure
+     * leaves the context with a valid (fresh) refresh token. The next scheduler
+     * tick still re-rotates (we don't cache the id_token across ticks), but the
+     * session isn't bricked by a partial failure.
+     *
+     * Single-flight: concurrent callers (e.g., the refresh loop + an explicit
+     * tool-triggered call) await the same in-flight promise. Refresh tokens are
+     * single-use, so overlapping calls would burn the same token.
+     */
+    refresh(): Promise<void>;
+    private doRefresh;
+    /**
+     * Records a refresh failure on the context. A failure is transient unless
+     * its message matches a known-permanent signal, or the consecutive failure
+     * counter hits {@link MAX_CONSECUTIVE_TRANSIENT_FAILURES}. A non-transient
+     * record flips `shouldAttemptRefresh` to `false` until the context is
+     * cleared / re-authenticated.
+     */
+    private recordRefreshError;
+    /**
+     * Mark this context as cleared — subsequent `refresh()` is a no-op, any
+     * running refresh loop is stopped, and the accessors (`getControlPlaneToken`,
+     * `getDataPlaneToken`) return `undefined`. Internal state is not exposed to
+     * consumers, so no field scrubbing is needed.
+     */
+    clear(): void;
+    /**
+     * Starts a background loop that refreshes the CP/DP token pair just before
+     * the CP token expires. The loop self-reschedules: each fire sets the next
+     * `setTimeout` at `controlPlaneExpiresAt - REFRESH_WINDOW_MS` from the
+     * post-refresh state, so the schedule tracks the actual token expiry.
+     */
+    startRefreshLoop(): void;
+    private scheduleNextRefresh;
+    /** Stops the background refresh loop. Safe to call even if not started. */
+    stopRefreshLoop(): void;
+    /**
+     * Applies a named transform to the token set. Each transform returns a
+     * whole new {@link ConfluentTokenSet}; callers never mutate the state
+     * directly.
+     */
+    private updateTokens;
+}
+//# sourceMappingURL=auth-context.d.ts.map

package/dist/confluent/oauth/auth-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-context.d.ts","sourceRoot":"","sources":["../../../src/confluent/oauth/auth-context.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,UAAU,EAEhB,MAAM,gCAAgC,CAAC;AAcxC,OAAO,KAAK,EACV,WAAW,EAEX,iBAAiB,EAGlB,MAAM,+BAA+B,CAAC;AAkBvC;;;;;GAKG;AACH,qBAAa,WAAW;IASpB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAR9B,OAAO,CAAC,cAAc,CAAoB;IAC1C,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,YAAY,CAA8C;IAClE,OAAO,CAAC,eAAe,CAA8B;IACrD,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,qBAAqB,CAAK;IAElC,OAAO;IAOP,4EAA4E;WAC/D,mBAAmB,CAC9B,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,WAAW,CAAC;IAqBvB,0DAA0D;IAC1D,MAAM,CAAC,UAAU,CACf,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,iBAAiB,GACxB,WAAW;IAId,qDAAqD;IACrD,IAAI,WAAW,IAAI,MAAM,CAExB;IAED;;;;OAIG;IACH,oBAAoB,IAAI,MAAM,GAAG,SAAS;IAO1C;;;;OAIG;IACH,iBAAiB,IAAI,MAAM,GAAG,SAAS;IAMvC;;;OAGG;IACH,SAAS,IAAI,QAAQ,CAAC,UAAU,CAAC;IAIjC,4EAA4E;IAC5E,mBAAmB,CAAC,GAAG,GAAE,MAAmB,GAAG,OAAO;IAQtD;;;;OAIG;IACH,oBAAoB,CAAC,GAAG,GAAE,MAAmB,GAAG,OAAO;IASvD;;;;;;;;;;OAUG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YAYhB,SAAS;IAiFvB;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAuB1B;;;;;OAKG;IACH,KAAK,IAAI,IAAI;IAKb;;;;;OAKG;IACH,gBAAgB,IAAI,IAAI;IAexB,OAAO,CAAC,mBAAmB;IAqD3B,2EAA2E;IAC3E,eAAe,IAAI,IAAI;IAQvB;;;;OAIG;IACH,OAAO,CAAC,YAAY;CAMrB"}