@confluentinc/mcp-confluent 1.3.0 → 1.5.0

package/dist/confluent/oauth/auth0-config.js

@@ -3,41 +3,81 @@ export const OAUTH_CALLBACK_PORT = 26640;
 export const OAUTH_CALLBACK_PATH = "/gateway/v1/callback-local-mcp-docs";
 const OAUTH_CALLBACK_URL = `http://${OAUTH_CALLBACK_HOST}:${OAUTH_CALLBACK_PORT}${OAUTH_CALLBACK_PATH}`;
 const OAUTH_SCOPES = "email openid offline_access";
-const AUTH0_CONFIGS = {
+/**
+ * The Confluent Cloud base domain per Auth0 environment. Every CCloud REST
+ * surface this server reaches is the same domain with a different prefix
+ * (`api.`, `api.telemetry.`, regional `flink.<region>.<cloud>.`), so the base
+ * domain is the single source of truth and each surface's URL is derived from
+ * it (see the `get*UrlForEnv` helpers below). `devel`/`stag` are
+ * internal-dev-only; a wrong derived URL there is a one-line fix here.
+ */
+const CCLOUD_DOMAINS = {
+    devel: "devel.cpdev.cloud",
+    stag: "stag.cpdev.cloud",
+    prod: "confluent.cloud",
+};
+/**
+ * Per-environment Auth0 login identity. These are the only values that do NOT
+ * derive from {@link CCLOUD_DOMAINS}: login lives on a separate domain family
+ * (`login.confluent.io` / `login-stag.confluent-dev.io`) and the client ids are
+ * opaque Auth0 application identifiers.
+ */
+const AUTH0_CLIENTS = {
     devel: {
         clientId: "D8DV9ee7XrKX4ncAc6vJtBFgIzTMNgoY",
         domain: "login.confluent-dev.io",
-        apiUrl: "https://devel.cpdev.cloud",
-        cloudRestUrl: "https://api.devel.cpdev.cloud",
-        callbackUrl: OAUTH_CALLBACK_URL,
-        scopes: OAUTH_SCOPES,
     },
     stag: {
         clientId: "adtjckxmHbjddhNK36PvcXIDDbrJUMDH",
         domain: "login-stag.confluent-dev.io",
-        apiUrl: "https://stag.cpdev.cloud",
-        cloudRestUrl: "https://api.stag.cpdev.cloud",
-        callbackUrl: OAUTH_CALLBACK_URL,
-        scopes: OAUTH_SCOPES,
     },
     prod: {
         clientId: "cZ0wejEDJLNocYDJ54mAmGK21klrv21h",
         domain: "login.confluent.io",
-        apiUrl: "https://confluent.cloud",
-        cloudRestUrl: "https://api.confluent.cloud",
-        callbackUrl: OAUTH_CALLBACK_URL,
-        scopes: OAUTH_SCOPES,
     },
 };
-export function getAuth0Config(environment) {
-    return AUTH0_CONFIGS[environment];
+/**
+ * Returns the Confluent Cloud session/login API base URL (no `api.` prefix) for
+ * the given Auth0 environment — the host that serves `/api/sessions` and
+ * `/api/access_tokens` during the token-exchange chain.
+ */
+export function getApiUrlForEnv(environment) {
+    return `https://${CCLOUD_DOMAINS[environment]}`;
 }
 /**
- * Returns the Confluent Cloud REST API base URL for the given Auth0 environment.
- * Used by {@link OAuthClientManager} to derive the cloud surface's base URL when
- * the OAuth path doesn't carry an explicit `confluent_cloud.endpoint`.
+ * Returns the Confluent Cloud REST API base URL (`api.` prefix) for the given
+ * Auth0 environment. Used by {@link OAuthClientManager} to derive the cloud
+ * surface's base URL when the OAuth path doesn't carry an explicit
+ * `confluent_cloud.endpoint`.
  */
 export function getCloudRestUrlForEnv(environment) {
-    return AUTH0_CONFIGS[environment].cloudRestUrl;
+    return `https://api.${CCLOUD_DOMAINS[environment]}`;
+}
+/**
+ * Returns the Confluent Cloud Telemetry REST API base URL
+ * (`api.telemetry.` prefix) for the given Auth0 environment. Used by
+ * {@link OAuthClientManager} to point the telemetry/metrics surface at the
+ * right host under OAuth.
+ */
+export function getTelemetryRestUrlForEnv(environment) {
+    return `https://api.telemetry.${CCLOUD_DOMAINS[environment]}`;
+}
+/**
+ * Returns the regional Confluent Cloud Flink REST API base URL
+ * (`flink.<region>.<cloud>.` prefix) for the given Auth0 environment. Unlike
+ * the cloud/telemetry surfaces, the Flink host is regional, so {@link
+ * OAuthClientManager} can only build this per call once it has resolved the
+ * compute pool's `cloud` + `region` (via `GET /fcpm/v2/compute-pools/{id}`).
+ */
+export function getFlinkRestUrlForRegion(environment, cloud, region) {
+    return `https://flink.${region}.${cloud.toLowerCase()}.${CCLOUD_DOMAINS[environment]}`;
+}
+export function getAuth0Config(environment) {
+    return {
+        ...AUTH0_CLIENTS[environment],
+        apiUrl: getApiUrlForEnv(environment),
+        callbackUrl: OAUTH_CALLBACK_URL,
+        scopes: OAUTH_SCOPES,
+    };
 }
 //# sourceMappingURL=auth0-config.js.map

package/dist/confluent/oauth/auth0-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth0-config.js","sourceRoot":"","sources":["../../../src/confluent/oauth/auth0-config.ts"],"names":[],"mappings":"AAKA,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAC/C,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AACzC,MAAM,CAAC,MAAM,mBAAmB,GAAG,qCAAqC,CAAC;AACzE,MAAM,kBAAkB,GAAG,UAAU,mBAAmB,IAAI,mBAAmB,GAAG,mBAAmB,EAAE,CAAC;AACxG,MAAM,YAAY,GAAG,6BAA6B,CAAC;AACnD,MAAM,aAAa,GAA0C;IAC3D,KAAK,EAAE;QACL,QAAQ,EAAE,kCAAkC;QAC5C,MAAM,EAAE,wBAAwB;QAChC,MAAM,EAAE,2BAA2B;QACnC,YAAY,EAAE,+BAA+B;QAC7C,WAAW,EAAE,kBAAkB;QAC/B,MAAM,EAAE,YAAY;KACrB;IACD,IAAI,EAAE;QACJ,QAAQ,EAAE,kCAAkC;QAC5C,MAAM,EAAE,6BAA6B;QACrC,MAAM,EAAE,0BAA0B;QAClC,YAAY,EAAE,8BAA8B;QAC5C,WAAW,EAAE,kBAAkB;QAC/B,MAAM,EAAE,YAAY;KACrB;IACD,IAAI,EAAE;QACJ,QAAQ,EAAE,kCAAkC;QAC5C,MAAM,EAAE,oBAAoB;QAC5B,MAAM,EAAE,yBAAyB;QACjC,YAAY,EAAE,6BAA6B;QAC3C,WAAW,EAAE,kBAAkB;QAC/B,MAAM,EAAE,YAAY;KACrB;CACF,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,WAA6B;IAC1D,OAAO,aAAa,CAAC,WAAW,CAAC,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAA6B;IACjE,OAAO,aAAa,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC;AACjD,CAAC"}
+{"version":3,"file":"auth0-config.js","sourceRoot":"","sources":["../../../src/confluent/oauth/auth0-config.ts"],"names":[],"mappings":"AAKA,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAC/C,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AACzC,MAAM,CAAC,MAAM,mBAAmB,GAAG,qCAAqC,CAAC;AACzE,MAAM,kBAAkB,GAAG,UAAU,mBAAmB,IAAI,mBAAmB,GAAG,mBAAmB,EAAE,CAAC;AACxG,MAAM,YAAY,GAAG,6BAA6B,CAAC;AAEnD;;;;;;;GAOG;AACH,MAAM,cAAc,GAAqC;IACvD,KAAK,EAAE,mBAAmB;IAC1B,IAAI,EAAE,kBAAkB;IACxB,IAAI,EAAE,iBAAiB;CACxB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,aAAa,GAGf;IACF,KAAK,EAAE;QACL,QAAQ,EAAE,kCAAkC;QAC5C,MAAM,EAAE,wBAAwB;KACjC;IACD,IAAI,EAAE;QACJ,QAAQ,EAAE,kCAAkC;QAC5C,MAAM,EAAE,6BAA6B;KACtC;IACD,IAAI,EAAE;QACJ,QAAQ,EAAE,kCAAkC;QAC5C,MAAM,EAAE,oBAAoB;KAC7B;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,WAA6B;IAC3D,OAAO,WAAW,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAA6B;IACjE,OAAO,eAAe,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,WAA6B;IAE7B,OAAO,yBAAyB,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,WAA6B,EAC7B,KAAa,EACb,MAAc;IAEd,OAAO,iBAAiB,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,WAA6B;IAC1D,OAAO;QACL,GAAG,aAAa,CAAC,WAAW,CAAC;QAC7B,MAAM,EAAE,eAAe,CAAC,WAAW,CAAC;QACpC,WAAW,EAAE,kBAAkB;QAC/B,MAAM,EAAE,YAAY;KACrB,CAAC;AACJ,CAAC"}

package/dist/confluent/oauth/callback-pages.d.ts

@@ -1,4 +1,12 @@
-export declare function renderSuccessPage(): string;
+/**
+ * Render the OAuth success page. The `copiedPath` and `streamPath` placeholders
+ * in the template are replaced with the same constants the server registers
+ * its handlers under, so the page and server can't drift on path naming.
+ */
+export declare function renderSuccessPage(opts: {
+    copiedPath: string;
+    streamPath: string;
+}): string;
 export declare function renderErrorPage(message: string): string;
 /** Test-only: reset the module-level template cache. */
 export declare function _resetCallbackPageCacheForTests(): void;

package/dist/confluent/oauth/callback-pages.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"callback-pages.d.ts","sourceRoot":"","sources":["../../../src/confluent/oauth/callback-pages.ts"],"names":[],"mappings":"AAuCA,wBAAgB,iBAAiB,IAAI,MAAM,CAG1C;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGvD;AAED,wDAAwD;AACxD,wBAAgB,+BAA+B,IAAI,IAAI,CAGtD"}
+{"version":3,"file":"callback-pages.d.ts","sourceRoot":"","sources":["../../../src/confluent/oauth/callback-pages.ts"],"names":[],"mappings":"AAuCA;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CAOT;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGvD;AAED,wDAAwD;AACxD,wBAAgB,+BAA+B,IAAI,IAAI,CAGtD"}

package/dist/confluent/oauth/callback-pages.js

@@ -6,7 +6,7 @@ const PARTIALS = {
     "{#include logo/}": "logo.html",
 };
 const TEMPLATES_DIR_URL = new URL("../../../assets/oauth-templates/", import.meta.url);
-let cachedSuccessPage;
+let cachedSuccessTemplate;
 let cachedFailureTemplate;
 function readTemplate(fileName) {
     return fs.readFileSync(new URL(fileName, TEMPLATES_DIR_URL), "utf-8");
@@ -22,9 +22,18 @@ function escapeHtml(value) {
         .replaceAll('"', """)
         .replaceAll("'", "'");
 }
-export function renderSuccessPage() {
-    cachedSuccessPage ??= inlinePartials(readTemplate(SUCCESS_TEMPLATE_FILE));
-    return cachedSuccessPage;
+/**
+ * Render the OAuth success page. The `copiedPath` and `streamPath` placeholders
+ * in the template are replaced with the same constants the server registers
+ * its handlers under, so the page and server can't drift on path naming.
+ */
+export function renderSuccessPage(opts) {
+    cachedSuccessTemplate ??= inlinePartials(readTemplate(SUCCESS_TEMPLATE_FILE));
+    // Replacer-function form so `$&`, `$$`, etc. in path values are taken literally
+    // rather than processed as String.prototype.replace substitution patterns.
+    return cachedSuccessTemplate
+        .replaceAll("{{copiedPath}}", () => opts.copiedPath)
+        .replaceAll("{{streamPath}}", () => opts.streamPath);
 }
 export function renderErrorPage(message) {
     cachedFailureTemplate ??= inlinePartials(readTemplate(FAILURE_TEMPLATE_FILE));
@@ -32,7 +41,7 @@ export function renderErrorPage(message) {
 }
 /** Test-only: reset the module-level template cache. */
 export function _resetCallbackPageCacheForTests() {
-    cachedSuccessPage = undefined;
+    cachedSuccessTemplate = undefined;
     cachedFailureTemplate = undefined;
 }
 //# sourceMappingURL=callback-pages.js.map

package/dist/confluent/oauth/callback-pages.js.map

@@ -1 +1 @@
-{"version":3,"file":"callback-pages.js","sourceRoot":"","sources":["../../../src/confluent/oauth/callback-pages.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,6BAA6B,CAAC;AAEjD,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AACtD,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAEtD,MAAM,QAAQ,GAA2B;IACvC,oBAAoB,EAAE,aAAa;IACnC,kBAAkB,EAAE,WAAW;CAChC,CAAC;AAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,kCAAkC,EAClC,MAAM,CAAC,IAAI,CAAC,GAAG,CAChB,CAAC;AAEF,IAAI,iBAAqC,CAAC;AAC1C,IAAI,qBAAyC,CAAC;AAE9C,SAAS,YAAY,CAAC,QAAgB;IACpC,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,iBAAiB,CAAC,EAAE,OAAO,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CACpC,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,CAC7B,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,EAChD,QAAQ,CACT,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,iBAAiB,KAAK,cAAc,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC1E,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,qBAAqB,KAAK,cAAc,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC9E,OAAO,qBAAqB,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,+BAA+B;IAC7C,iBAAiB,GAAG,SAAS,CAAC;IAC9B,qBAAqB,GAAG,SAAS,CAAC;AACpC,CAAC"}
+{"version":3,"file":"callback-pages.js","sourceRoot":"","sources":["../../../src/confluent/oauth/callback-pages.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,6BAA6B,CAAC;AAEjD,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AACtD,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAEtD,MAAM,QAAQ,GAA2B;IACvC,oBAAoB,EAAE,aAAa;IACnC,kBAAkB,EAAE,WAAW;CAChC,CAAC;AAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,kCAAkC,EAClC,MAAM,CAAC,IAAI,CAAC,GAAG,CAChB,CAAC;AAEF,IAAI,qBAAyC,CAAC;AAC9C,IAAI,qBAAyC,CAAC;AAE9C,SAAS,YAAY,CAAC,QAAgB;IACpC,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,iBAAiB,CAAC,EAAE,OAAO,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CACpC,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,CAC7B,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,EAChD,QAAQ,CACT,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAGjC;IACC,qBAAqB,KAAK,cAAc,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC9E,gFAAgF;IAChF,2EAA2E;IAC3E,OAAO,qBAAqB;SACzB,UAAU,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;SACnD,UAAU,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,qBAAqB,KAAK,cAAc,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC9E,OAAO,qBAAqB,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,+BAA+B;IAC7C,qBAAqB,GAAG,SAAS,CAAC;IAClC,qBAAqB,GAAG,SAAS,CAAC;AACpC,CAAC"}

package/dist/confluent/oauth/pkce-login.d.ts

@@ -2,8 +2,27 @@ import { type TokenChainResult } from "../../confluent/oauth/token-chain.js";
 import type { Auth0Config } from "../../confluent/oauth/types.js";
 /** Maximum time to wait for the user to complete the browser PKCE flow. */
 export declare const PKCE_LOGIN_TIMEOUT_MS = 120000;
+/** Path the success page POSTs to when the user copies the install hint. */
+export declare const SKILLS_HINT_COPIED_PATH = "/skills-hint-copied";
+/**
+ * Path the success page opens an EventSource to. The open connection is what
+ * keeps the callback server alive past the OAuth redirect: as long as the page
+ * is in a tab, the stream is connected and beacons land on a live listener.
+ * When the tab closes, the stream disconnects and the server tears down.
+ */
+export declare const SKILLS_HINT_STREAM_PATH = "/skills-hint-stream";
+/**
+ * Safety cap on how long the callback server can stay bound after a successful
+ * auth. The stream-disconnect path is the normal closer; this is just the
+ * "user left the tab open and walked away" backstop. Kept tight (60s) because
+ * a lingering listener will collide with the next PKCE attempt — if a token
+ * refresh fails non-transiently inside this window and triggers a fresh login,
+ * the second attempt errors with `port_in_use` when in fact it's this same
+ * session's leftover listener still holding the port.
+ */
+export declare const SUCCESS_PAGE_MAX_LIFETIME_MS = 60000;
 /** Reasons a PKCE login can fail. Carried on {@link PkceLoginError}. */
-export type PkceLoginFailureReason = "timeout" | "user_aborted" | "port_in_use" | "auth0_unreachable" | "configuration";
+export type PkceLoginFailureReason = "timeout" | "user_aborted" | "port_in_use" | "auth0_unreachable" | "callback_server_error" | "configuration";
 /** Structured error so callers can react to the cause of a failed PKCE login. */
 export declare class PkceLoginError extends Error {
     readonly reason: PkceLoginFailureReason;

package/dist/confluent/oauth/pkce-login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pkce-login.d.ts","sourceRoot":"","sources":["../../../src/confluent/oauth/pkce-login.ts"],"names":[],"mappings":"AAiBA,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAGjE,2EAA2E;AAC3E,eAAO,MAAM,qBAAqB,SAAU,CAAC;AAE7C,wEAAwE;AACxE,MAAM,MAAM,sBAAsB,GAC9B,SAAS,GACT,cAAc,GACd,aAAa,GACb,mBAAmB,GACnB,eAAe,CAAC;AAEpB,iFAAiF;AACjF,qBAAa,cAAe,SAAQ,KAAK;aAErB,MAAM,EAAE,sBAAsB;gBAA9B,MAAM,EAAE,sBAAsB,EAC9C,OAAO,EAAE,MAAM;CAKlB;AAwBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAChC,WAAW,EAAE,WAAW,EACxB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,gBAAgB,CAAC,CAqJ3B"}
+{"version":3,"file":"pkce-login.d.ts","sourceRoot":"","sources":["../../../src/confluent/oauth/pkce-login.ts"],"names":[],"mappings":"AAiBA,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAIjE,2EAA2E;AAC3E,eAAO,MAAM,qBAAqB,SAAU,CAAC;AAE7C,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD,wEAAwE;AACxE,MAAM,MAAM,sBAAsB,GAC9B,SAAS,GACT,cAAc,GACd,aAAa,GACb,mBAAmB,GACnB,uBAAuB,GACvB,eAAe,CAAC;AAEpB,iFAAiF;AACjF,qBAAa,cAAe,SAAQ,KAAK;aAErB,MAAM,EAAE,sBAAsB;gBAA9B,MAAM,EAAE,sBAAsB,EAC9C,OAAO,EAAE,MAAM;CAKlB;AAwBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAChC,WAAW,EAAE,WAAW,EACxB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,gBAAgB,CAAC,CA2P3B"}

package/dist/confluent/oauth/pkce-login.js

@@ -3,9 +3,29 @@ import { OAUTH_CALLBACK_HOST, OAUTH_CALLBACK_PATH, OAUTH_CALLBACK_PORT, } from "
 import { renderErrorPage, renderSuccessPage, } from "../../confluent/oauth/callback-pages.js";
 import { generateCodeChallenge, generateCodeVerifier, generateOpaqueToken, } from "../../confluent/oauth/crypto-utils.js";
 import { executeFullTokenChain, } from "../../confluent/oauth/token-chain.js";
+import { TelemetryEvent, TelemetryService } from "../../confluent/telemetry.js";
 import { logger } from "../../logger.js";
 /** Maximum time to wait for the user to complete the browser PKCE flow. */
 export const PKCE_LOGIN_TIMEOUT_MS = 120_000;
+/** Path the success page POSTs to when the user copies the install hint. */
+export const SKILLS_HINT_COPIED_PATH = "/skills-hint-copied";
+/**
+ * Path the success page opens an EventSource to. The open connection is what
+ * keeps the callback server alive past the OAuth redirect: as long as the page
+ * is in a tab, the stream is connected and beacons land on a live listener.
+ * When the tab closes, the stream disconnects and the server tears down.
+ */
+export const SKILLS_HINT_STREAM_PATH = "/skills-hint-stream";
+/**
+ * Safety cap on how long the callback server can stay bound after a successful
+ * auth. The stream-disconnect path is the normal closer; this is just the
+ * "user left the tab open and walked away" backstop. Kept tight (60s) because
+ * a lingering listener will collide with the next PKCE attempt — if a token
+ * refresh fails non-transiently inside this window and triggers a fresh login,
+ * the second attempt errors with `port_in_use` when in fact it's this same
+ * session's leftover listener still holding the port.
+ */
+export const SUCCESS_PAGE_MAX_LIFETIME_MS = 60_000;
 /** Structured error so callers can react to the cause of a failed PKCE login. */
 export class PkceLoginError extends Error {
     reason;
@@ -62,9 +82,78 @@ export async function runPkceLogin(auth0Config, signal) {
         resolveCode = resolve;
         rejectFlow = reject;
     });
+    // Tracks whether the success page was served. After success, the server's
+    // lifetime is driven by the success page's EventSource: it stays bound while
+    // the tab is open and closes when the stream disconnects (or when the safety
+    // timer fires).
+    let successServed = false;
+    let serverClosed = false;
+    let lifetimeTimer;
+    const streamClients = new Set();
+    const closeServerOnce = () => {
+        if (serverClosed || !bound)
+            return;
+        serverClosed = true;
+        if (lifetimeTimer) {
+            clearTimeout(lifetimeTimer);
+            lifetimeTimer = undefined;
+        }
+        for (const client of streamClients)
+            client.end();
+        streamClients.clear();
+        server.close();
+    };
     const server = nodeHttp.createServer((req, res) => {
         const reqUrl = req.url ?? "";
         const parsed = new URL(reqUrl, "http://127.0.0.1");
+        if (parsed.pathname === SKILLS_HINT_COPIED_PATH) {
+            // Only reachable once we've served the success page. Anything earlier
+            // would be a stray request on localhost, not a copy of the install hint.
+            if (!successServed) {
+                res.writeHead(404);
+                res.end();
+                return;
+            }
+            if (req.method !== "POST") {
+                res.writeHead(405, { Allow: "POST" });
+                res.end();
+                return;
+            }
+            try {
+                TelemetryService.getInstance().track(TelemetryEvent.AGENT_SKILLS_HINT_COPIED, {});
+            }
+            catch (err) {
+                logger.warn({ err }, "Failed to track agent-skills hint copied event");
+            }
+            res.writeHead(204);
+            res.end();
+            return;
+        }
+        if (parsed.pathname === SKILLS_HINT_STREAM_PATH) {
+            // Same gate as the beacon: the stream only makes sense once the success
+            // page has been served. Pre-auth requests get a 404.
+            if (!successServed) {
+                res.writeHead(404);
+                res.end();
+                return;
+            }
+            res.writeHead(200, {
+                "Content-Type": "text/event-stream",
+                "Cache-Control": "no-cache",
+                Connection: "keep-alive",
+            });
+            // Flush headers so the browser considers the EventSource "open".
+            res.write(": connected\n\n");
+            streamClients.add(res);
+            req.on("close", () => {
+                streamClients.delete(res);
+                // When the last tab closes and auth already succeeded, the listener
+                // has no further reason to exist.
+                if (successServed && streamClients.size === 0)
+                    closeServerOnce();
+            });
+            return;
+        }
         if (parsed.pathname !== OAUTH_CALLBACK_PATH) {
             sendHtml(res, 404, renderErrorPage("Not found"));
             return;
@@ -85,7 +174,11 @@ export async function runPkceLogin(auth0Config, signal) {
             sendHtml(res, 400, renderErrorPage("Missing authorization code"));
             return;
         }
-        sendHtml(res, 200, renderSuccessPage());
+        sendHtml(res, 200, renderSuccessPage({
+            copiedPath: SKILLS_HINT_COPIED_PATH,
+            streamPath: SKILLS_HINT_STREAM_PATH,
+        }));
+        successServed = true;
         resolveCode(code);
     });
     let bound = false;
@@ -102,10 +195,12 @@ export async function runPkceLogin(auth0Config, signal) {
         server.listen(OAUTH_CALLBACK_PORT, OAUTH_CALLBACK_HOST, () => {
             bound = true;
             server.off("error", onBindError);
-            // Replace the bind-time rejector with a log-only listener so a stray
-            // post-bind socket error doesn't escape as an uncaught 'error' event.
+            // Post-bind socket errors must reject the in-flight flow, not just warn: if the listener
+            // dies mid-callback (EMFILE, broken TLS upgrade, etc.) the user would otherwise hang on
+            // `codePromise` until `PKCE_LOGIN_TIMEOUT_MS` (minutes) instead of failing fast.
             server.on("error", (err) => {
                 logger.warn({ err }, "PKCE callback server post-bind error");
+                rejectFlow(new PkceLoginError("callback_server_error", `PKCE callback listener errored after bind: ${err.message}`));
             });
             resolve();
         });
@@ -126,11 +221,13 @@ export async function runPkceLogin(auth0Config, signal) {
     let authCode;
     try {
         await Promise.race([bindResult, abortPromise]);
+        const authUrl = buildAuthorizationUrl(auth0Config, codeChallenge, state);
+        // log the URL so users whose default browser misbehaves can open it manually. safe to log:
+        // the URL carries only the one-time PKCE code_challenge + state, both bound to this single
+        // login attempt and discarded once the callback resolves.
+        logger.info({ authUrl }, "Opening Auth0 authorization URL");
         try {
-            await Promise.race([
-                nodeOpen.open(buildAuthorizationUrl(auth0Config, codeChallenge, state)),
-                abortPromise,
-            ]);
+            await Promise.race([nodeOpen.open(authUrl), abortPromise]);
         }
         catch (err) {
             // Preserve user_aborted from the race; wrap any other open() failure.
@@ -147,8 +244,20 @@ export async function runPkceLogin(auth0Config, signal) {
             signal.removeEventListener("abort", abortListener);
         }
         clearTimeout(timer);
-        if (bound)
-            server.close();
+        if (bound) {
+            if (successServed) {
+                // The success page's EventSource keeps the listener alive while the
+                // browser tab is open; stream-disconnect calls closeServerOnce. The
+                // timer + unref'd server are the "tab left open" backstop so this
+                // listener can never keep the process alive on its own.
+                server.unref?.();
+                lifetimeTimer = setTimeout(closeServerOnce, SUCCESS_PAGE_MAX_LIFETIME_MS);
+                lifetimeTimer.unref?.();
+            }
+            else {
+                closeServerOnce();
+            }
+        }
     }
     logger.info("PKCE auth code received; exchanging for token chain");
     try {

package/dist/confluent/oauth/pkce-login.js.map

@@ -1 +1 @@
-{"version":3,"file":"pkce-login.js","sourceRoot":"","sources":["../../../src/confluent/oauth/pkce-login.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,eAAe,EACf,iBAAiB,GAClB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,qBAAqB,GAEtB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAU7C,iFAAiF;AACjF,MAAM,OAAO,cAAe,SAAQ,KAAK;IAErB;IADlB,YACkB,MAA8B,EAC9C,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAwB;QAI9C,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAY;IACjE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;IACtE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB,CAC5B,WAAwB,EACxB,aAAqB,EACrB,KAAa;IAEb,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS,EAAE,WAAW,CAAC,QAAQ;QAC/B,aAAa,EAAE,MAAM;QACrB,YAAY,EAAE,WAAW,CAAC,WAAW;QACrC,KAAK,EAAE,WAAW,CAAC,MAAM;QACzB,cAAc,EAAE,aAAa;QAC7B,qBAAqB,EAAE,MAAM;QAC7B,KAAK;KACN,CAAC,CAAC;IACH,OAAO,WAAW,WAAW,CAAC,MAAM,cAAc,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,WAAwB,EACxB,MAAoB;IAEpB,0EAA0E;IAC1E,yBAAyB;IACzB,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,cAAc,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,cAAc,CACtB,eAAe,EACf,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;IAC5C,MAAM,aAAa,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IAEpC,IAAI,WAAW,GAA2B,GAAG,EAAE,CAAC,SAAS,CAAC;IAC1D,IAAI,UAAU,GAAkC,GAAG,EAAE,CAAC,SAAS,CAAC;IAChE,MAAM,WAAW,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1D,WAAW,GAAG,OAAO,CAAC;QACtB,UAAU,GAAG,MAAM,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAChD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,QAAQ,KAAK,mBAAmB,EAAE,CAAC;YAC5C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;YAC5B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,UAAU,EAAE,CAAC;YACf,QAAQ,CACN,GAAG,EACH,GAAG,EACH,eAAe,CAAC,0BAA0B,UAAU,EAAE,CAAC,CACxD,CAAC;YACF,UAAU,CACR,IAAI,cAAc,CAChB,cAAc,EACd,gCAAgC,UAAU,EAAE,CAC7C,CACF,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,4BAA4B,CAAC,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACxC,WAAW,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,MAAM,UAAU,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACvD,MAAM,WAAW,GAAG,CAAC,GAA0B,EAAE,EAAE;YACjD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC9B,MAAM,CACJ,IAAI,cAAc,CAChB,aAAa,EACb,QAAQ,mBAAmB,uEAAuE,CACnG,CACF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CACJ,IAAI,cAAc,CAChB,eAAe,EACf,0CAA0C,mBAAmB,IAAI,mBAAmB,KAAK,GAAG,CAAC,OAAO,EAAE,CACvG,CACF,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,GAAG,EAAE;YAC3D,KAAK,GAAG,IAAI,CAAC;YACb,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YACjC,qEAAqE;YACrE,sEAAsE;YACtE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACzB,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,sCAAsC,CAAC,CAAC;YAC/D,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,KAAgD,CAAC;IACrD,MAAM,cAAc,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QACtD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,MAAM,CACJ,IAAI,cAAc,CAChB,SAAS,EACT,8BAA8B,qBAAqB,IAAI,CACxD,CACF,CAAC;QACJ,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,iEAAiE;IACjE,IAAI,aAAuC,CAAC;IAC5C,MAAM,YAAY,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QACpD,aAAa,GAAG,GAAG,EAAE,CACnB,MAAM,CAAC,IAAI,cAAc,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAC,CAAC;QACnE,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,IAAI,CAAC;gBACjB,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,WAAW,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;gBACvE,YAAY;aACb,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,IAAI,GAAG,YAAY,cAAc;gBAAE,MAAM,GAAG,CAAC;YAC7C,MAAM,IAAI,cAAc,CACtB,eAAe,EACf,2BAA2B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9E,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC;IAC7E,CAAC;YAAS,CAAC;QACT,qEAAqE;QACrE,uEAAuE;QACvE,IAAI,MAAM,IAAI,aAAa,EAAE,CAAC;YAC5B,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACrD,CAAC;QACD,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,KAAK;YAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,OAAO,MAAM,qBAAqB,CAAC,WAAW,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,cAAc,CACtB,mBAAmB,EACnB,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"pkce-login.js","sourceRoot":"","sources":["../../../src/confluent/oauth/pkce-login.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,eAAe,EACf,iBAAiB,GAClB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,qBAAqB,GAEtB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAE7C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE7D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAWnD,iFAAiF;AACjF,MAAM,OAAO,cAAe,SAAQ,KAAK;IAErB;IADlB,YACkB,MAA8B,EAC9C,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAwB;QAI9C,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAY;IACjE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;IACtE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB,CAC5B,WAAwB,EACxB,aAAqB,EACrB,KAAa;IAEb,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS,EAAE,WAAW,CAAC,QAAQ;QAC/B,aAAa,EAAE,MAAM;QACrB,YAAY,EAAE,WAAW,CAAC,WAAW;QACrC,KAAK,EAAE,WAAW,CAAC,MAAM;QACzB,cAAc,EAAE,aAAa;QAC7B,qBAAqB,EAAE,MAAM;QAC7B,KAAK;KACN,CAAC,CAAC;IACH,OAAO,WAAW,WAAW,CAAC,MAAM,cAAc,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,WAAwB,EACxB,MAAoB;IAEpB,0EAA0E;IAC1E,yBAAyB;IACzB,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,cAAc,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,cAAc,CACtB,eAAe,EACf,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;IAC5C,MAAM,aAAa,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IAEpC,IAAI,WAAW,GAA2B,GAAG,EAAE,CAAC,SAAS,CAAC;IAC1D,IAAI,UAAU,GAAkC,GAAG,EAAE,CAAC,SAAS,CAAC;IAChE,MAAM,WAAW,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1D,WAAW,GAAG,OAAO,CAAC;QACtB,UAAU,GAAG,MAAM,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,gBAAgB;IAChB,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,aAAwD,CAAC;IAC7D,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEhD,MAAM,eAAe,GAAG,GAAS,EAAE;QACjC,IAAI,YAAY,IAAI,CAAC,KAAK;YAAE,OAAO;QACnC,YAAY,GAAG,IAAI,CAAC;QACpB,IAAI,aAAa,EAAE,CAAC;YAClB,YAAY,CAAC,aAAa,CAAC,CAAC;YAC5B,aAAa,GAAG,SAAS,CAAC;QAC5B,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,aAAa;YAAE,MAAM,CAAC,GAAG,EAAE,CAAC;QACjD,aAAa,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAChD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,QAAQ,KAAK,uBAAuB,EAAE,CAAC;YAChD,sEAAsE;YACtE,yEAAyE;YACzE,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBACtC,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,gBAAgB,CAAC,WAAW,EAAE,CAAC,KAAK,CAClC,cAAc,CAAC,wBAAwB,EACvC,EAAE,CACH,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,gDAAgD,CAAC,CAAC;YACzE,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,uBAAuB,EAAE,CAAC;YAChD,wEAAwE;YACxE,qDAAqD;YACrD,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBACjB,cAAc,EAAE,mBAAmB;gBACnC,eAAe,EAAE,UAAU;gBAC3B,UAAU,EAAE,YAAY;aACzB,CAAC,CAAC;YACH,iEAAiE;YACjE,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAC7B,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC1B,oEAAoE;gBACpE,kCAAkC;gBAClC,IAAI,aAAa,IAAI,aAAa,CAAC,IAAI,KAAK,CAAC;oBAAE,eAAe,EAAE,CAAC;YACnE,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,mBAAmB,EAAE,CAAC;YAC5C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;YAC5B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,UAAU,EAAE,CAAC;YACf,QAAQ,CACN,GAAG,EACH,GAAG,EACH,eAAe,CAAC,0BAA0B,UAAU,EAAE,CAAC,CACxD,CAAC;YACF,UAAU,CACR,IAAI,cAAc,CAChB,cAAc,EACd,gCAAgC,UAAU,EAAE,CAC7C,CACF,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,4BAA4B,CAAC,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,QAAQ,CACN,GAAG,EACH,GAAG,EACH,iBAAiB,CAAC;YAChB,UAAU,EAAE,uBAAuB;YACnC,UAAU,EAAE,uBAAuB;SACpC,CAAC,CACH,CAAC;QACF,aAAa,GAAG,IAAI,CAAC;QACrB,WAAW,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,MAAM,UAAU,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACvD,MAAM,WAAW,GAAG,CAAC,GAA0B,EAAE,EAAE;YACjD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC9B,MAAM,CACJ,IAAI,cAAc,CAChB,aAAa,EACb,QAAQ,mBAAmB,uEAAuE,CACnG,CACF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CACJ,IAAI,cAAc,CAChB,eAAe,EACf,0CAA0C,mBAAmB,IAAI,mBAAmB,KAAK,GAAG,CAAC,OAAO,EAAE,CACvG,CACF,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,GAAG,EAAE;YAC3D,KAAK,GAAG,IAAI,CAAC;YACb,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YACjC,yFAAyF;YACzF,wFAAwF;YACxF,iFAAiF;YACjF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACzB,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,sCAAsC,CAAC,CAAC;gBAC7D,UAAU,CACR,IAAI,cAAc,CAChB,uBAAuB,EACvB,8CAA8C,GAAG,CAAC,OAAO,EAAE,CAC5D,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,KAAgD,CAAC;IACrD,MAAM,cAAc,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QACtD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,MAAM,CACJ,IAAI,cAAc,CAChB,SAAS,EACT,8BAA8B,qBAAqB,IAAI,CACxD,CACF,CAAC;QACJ,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,iEAAiE;IACjE,IAAI,aAAuC,CAAC;IAC5C,MAAM,YAAY,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QACpD,aAAa,GAAG,GAAG,EAAE,CACnB,MAAM,CAAC,IAAI,cAAc,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAC,CAAC;QACnE,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,qBAAqB,CAAC,WAAW,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;QACzE,2FAA2F;QAC3F,2FAA2F;QAC3F,0DAA0D;QAC1D,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,iCAAiC,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,IAAI,GAAG,YAAY,cAAc;gBAAE,MAAM,GAAG,CAAC;YAC7C,MAAM,IAAI,cAAc,CACtB,eAAe,EACf,2BAA2B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9E,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC;IAC7E,CAAC;YAAS,CAAC;QACT,qEAAqE;QACrE,uEAAuE;QACvE,IAAI,MAAM,IAAI,aAAa,EAAE,CAAC;YAC5B,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACrD,CAAC;QACD,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,aAAa,EAAE,CAAC;gBAClB,oEAAoE;gBACpE,oEAAoE;gBACpE,kEAAkE;gBAClE,wDAAwD;gBACxD,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;gBACjB,aAAa,GAAG,UAAU,CACxB,eAAe,EACf,4BAA4B,CAC7B,CAAC;gBACF,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACN,eAAe,EAAE,CAAC;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,OAAO,MAAM,qBAAqB,CAAC,WAAW,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,cAAc,CACtB,mBAAmB,EACnB,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/confluent/oauth/types.d.ts

@@ -2,9 +2,8 @@ export type Auth0Environment = "devel" | "stag" | "prod";
 export interface Auth0Config {
     clientId: string;
     domain: string;
+    /** Confluent Cloud session/login API base URL (no `api.` prefix, e.g. https://confluent.cloud for prod). Used by the token-exchange chain. */
     apiUrl: string;
-    /** Confluent Cloud REST API base URL for this environment (e.g. https://api.confluent.cloud for prod). */
-    cloudRestUrl: string;
     callbackUrl: string;
     scopes: string;
 }

package/dist/confluent/oauth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/confluent/oauth/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAEzD,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,0GAA0G;IAC1G,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC;IACrB,2FAA2F;IAC3F,6BAA6B,EAAE,MAAM,CAAC;IACtC,uFAAuF;IACvF,yBAAyB,EAAE,MAAM,CAAC;IAElC,iFAAiF;IACjF,iBAAiB,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,qBAAqB,EAAE,MAAM,CAAC;IAE9B,qFAAqF;IACrF,cAAc,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,kBAAkB,EAAE,MAAM,CAAC;IAE3B,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,EAAE,gBAAgB,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/confluent/oauth/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAEzD,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,8IAA8I;IAC9I,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC;IACrB,2FAA2F;IAC3F,6BAA6B,EAAE,MAAM,CAAC;IACtC,uFAAuF;IACvF,yBAAyB,EAAE,MAAM,CAAC;IAElC,iFAAiF;IACjF,iBAAiB,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,qBAAqB,EAAE,MAAM,CAAC;IAE9B,qFAAqF;IACrF,cAAc,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,kBAAkB,EAAE,MAAM,CAAC;IAE3B,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,EAAE,gBAAgB,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB"}

package/dist/confluent/oauth-client-manager.d.ts

@@ -20,15 +20,15 @@
  */
 import type { KafkaJS } from "@confluentinc/kafka-javascript";
 import { SchemaRegistryClient } from "@confluentinc/schemaregistry";
-import { BaseClientManager } from "../confluent/base-client-manager.js";
+import { BaseClientManager, type ConsumerBuildOptions } from "../confluent/base-client-manager.js";
 import type { ConfluentRestClient } from "../confluent/client-manager.js";
 import { OAuthHolder } from "../confluent/oauth/oauth-holder.js";
 import type { Auth0Environment } from "../confluent/oauth/types.js";
 /**
  * Bearer-auth client manager. Wires every REST surface to the OAuth holder's
- * tokens — control plane (cloud / tableflow / telemetry) reads
+ * tokens — control plane (cloud / tableflow) reads
  * {@link OAuthHolder.getControlPlaneToken}; data plane (flink / schema-registry
- * REST / kafka REST) reads {@link OAuthHolder.getDataPlaneToken}. Cloud REST URL
+ * REST / kafka REST / telemetry) reads {@link OAuthHolder.getDataPlaneToken}. Cloud REST URL
  * is auto-derived from the CCloud env. Native Kafka clients (admin, producer,
  * consumer) are built fresh per call against bootstrap endpoints resolved
  * via the cmk REST API; SASL/OAUTHBEARER is configured via librdkafka's
@@ -38,6 +38,7 @@ import type { Auth0Environment } from "../confluent/oauth/types.js";
 export declare class OAuthClientManager extends BaseClientManager {
     private readonly holder;
     private readonly kafkaDebug;
+    private readonly env;
     /**
      * @param kafkaDebug Optional librdkafka `debug` contexts string, threaded
      *   through to every native Kafka client built by this manager. Sourced
@@ -50,13 +51,15 @@ export declare class OAuthClientManager extends BaseClientManager {
     /** @inheritdoc */
     getConfluentCloudKafkaRestClient(clusterId?: string, envId?: string): Promise<ConfluentRestClient>;
     /** @inheritdoc */
+    getFlinkRestClient(computePoolId?: string, envId?: string): Promise<ConfluentRestClient>;
+    /** @inheritdoc */
     getSchemaRegistryRestClient(envId?: string): Promise<ConfluentRestClient>;
     /** @inheritdoc */
     getKafkaAdminClient(clusterId?: string, envId?: string): Promise<KafkaJS.Admin>;
     /** @inheritdoc */
     getKafkaProducer(clusterId?: string, envId?: string): Promise<KafkaJS.Producer>;
     /** @inheritdoc */
-    buildKafkaConsumer(clusterId?: string, envId?: string, groupId?: string): Promise<KafkaJS.Consumer>;
+    buildKafkaConsumer(opts?: ConsumerBuildOptions): Promise<KafkaJS.Consumer>;
     /** @inheritdoc */
     disconnect(): Promise<void>;
     /**

package/dist/confluent/oauth-client-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-client-manager.d.ts","sourceRoot":"","sources":["../../src/confluent/oauth-client-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAgB,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAa5E,OAAO,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAqBtE;;;;;;;;;;GAUG;AACH,qBAAa,kBAAmB,SAAQ,iBAAiB;IACvD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAEhD;;;;;OAKG;gBACS,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,gBAAgB,EAAE,UAAU,CAAC,EAAE,MAAM;IA8B3E,kBAAkB;IACZ,0BAA0B,CAC9B,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,oBAAoB,CAAC;IA0BhC,kBAAkB;IACZ,gCAAgC,CACpC,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,mBAAmB,CAAC;IAoB/B,kBAAkB;IACZ,2BAA2B,CAC/B,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,mBAAmB,CAAC;IA0B/B,kBAAkB;IACZ,mBAAmB,CACvB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;IAuBzB,kBAAkB;IACZ,gBAAgB,CACpB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;IAQ5B,kBAAkB;IACZ,kBAAkB,CACtB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;IAY5B,kBAAkB;IACZ,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAKjC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,qBAAqB;IAW7B,OAAO,CAAC,kBAAkB;YAiBZ,qBAAqB;CAuDpC"}
+{"version":3,"file":"oauth-client-manager.d.ts","sourceRoot":"","sources":["../../src/confluent/oauth-client-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAgB,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,EAC1B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAkB5E,OAAO,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAqBtE;;;;;;;;;;GAUG;AACH,qBAAa,kBAAmB,SAAQ,iBAAiB;IACvD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAChD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAmB;IAEvC;;;;;OAKG;gBACS,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,gBAAgB,EAAE,UAAU,CAAC,EAAE,MAAM;IA+B3E,kBAAkB;IACZ,0BAA0B,CAC9B,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,oBAAoB,CAAC;IA0BhC,kBAAkB;IACZ,gCAAgC,CACpC,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,mBAAmB,CAAC;IAoB/B,kBAAkB;IACZ,kBAAkB,CACtB,aAAa,CAAC,EAAE,MAAM,EACtB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,mBAAmB,CAAC;IA0B/B,kBAAkB;IACZ,2BAA2B,CAC/B,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,mBAAmB,CAAC;IA0B/B,kBAAkB;IACZ,mBAAmB,CACvB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;IAuBzB,kBAAkB;IACZ,gBAAgB,CACpB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;IAQ5B,kBAAkB;IACZ,kBAAkB,CACtB,IAAI,CAAC,EAAE,oBAAoB,GAC1B,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;IAe5B,kBAAkB;IACZ,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAKjC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,qBAAqB;IAW7B,OAAO,CAAC,kBAAkB;YAiBZ,qBAAqB;CAuDpC"}

package/dist/confluent/oauth-client-manager.js

@@ -19,19 +19,19 @@
  * SDK client per call.
  */
 import { SchemaRegistryClient } from "@confluentinc/schemaregistry";
-import { BaseClientManager } from "../confluent/base-client-manager.js";
+import { BaseClientManager, } from "../confluent/base-client-manager.js";
 import { createAuthMiddleware, } from "../confluent/middleware.js";
 import { kafkaDeps } from "../confluent/node-deps.js";
-import { resolveKafkaBootstrap, resolveKafkaRestEndpoint, resolveSchemaRegistryClusterId, resolveSchemaRegistryEndpoint, } from "../confluent/oauth-resource-resolvers.js";
-import { getCloudRestUrlForEnv } from "../confluent/oauth/auth0-config.js";
+import { resolveFlinkComputePoolRegion, resolveKafkaBootstrap, resolveKafkaRestEndpoint, resolveSchemaRegistryClusterId, resolveSchemaRegistryEndpoint, } from "../confluent/oauth-resource-resolvers.js";
+import { getCloudRestUrlForEnv, getFlinkRestUrlForRegion, getTelemetryRestUrlForEnv, } from "../confluent/oauth/auth0-config.js";
 import { kafkaLogger } from "../logger.js";
 import createClient from "openapi-fetch";
 import { DATA_PLANE_TOKEN_LIFETIME_MS } from "./oauth/token-lifetimes.js";
 /**
  * Bearer-auth client manager. Wires every REST surface to the OAuth holder's
- * tokens — control plane (cloud / tableflow / telemetry) reads
+ * tokens — control plane (cloud / tableflow) reads
  * {@link OAuthHolder.getControlPlaneToken}; data plane (flink / schema-registry
- * REST / kafka REST) reads {@link OAuthHolder.getDataPlaneToken}. Cloud REST URL
+ * REST / kafka REST / telemetry) reads {@link OAuthHolder.getDataPlaneToken}. Cloud REST URL
  * is auto-derived from the CCloud env. Native Kafka clients (admin, producer,
  * consumer) are built fresh per call against bootstrap endpoints resolved
  * via the cmk REST API; SASL/OAUTHBEARER is configured via librdkafka's
@@ -41,6 +41,7 @@ import { DATA_PLANE_TOKEN_LIFETIME_MS } from "./oauth/token-lifetimes.js";
 export class OAuthClientManager extends BaseClientManager {
     holder;
     kafkaDebug;
+    env;
     /**
      * @param kafkaDebug Optional librdkafka `debug` contexts string, threaded
      *   through to every native Kafka client built by this manager. Sourced
@@ -57,12 +58,12 @@ export class OAuthClientManager extends BaseClientManager {
                 flink: undefined,
                 schemaRegistry: undefined,
                 kafka: undefined,
-                telemetry: undefined,
+                telemetry: getTelemetryRestUrlForEnv(env),
             },
             auth: {
                 cloud: { type: "oauth", getToken: cpToken },
                 tableflow: { type: "oauth", getToken: cpToken },
-                telemetry: { type: "oauth", getToken: cpToken },
+                telemetry: { type: "oauth", getToken: dpToken },
                 flink: { type: "oauth", getToken: dpToken },
                 schemaRegistry: { type: "oauth", getToken: dpToken },
                 kafka: { type: "oauth", getToken: dpToken },
@@ -70,6 +71,7 @@ export class OAuthClientManager extends BaseClientManager {
         });
         this.holder = holder;
         this.kafkaDebug = kafkaDebug;
+        this.env = env;
         // Eager construction: surface the cloud REST client at startup so a bad
         // endpoint or middleware wiring fails fast rather than at first tool call.
         this.getConfluentCloudRestClient();
@@ -115,6 +117,26 @@ export class OAuthClientManager extends BaseClientManager {
         return client;
     }
     /** @inheritdoc */
+    async getFlinkRestClient(computePoolId, envId) {
+        this.requireDataPlaneToken();
+        if (!computePoolId || !envId) {
+            throw new Error("computePoolId and environmentId are required under OAuth for Flink access. " +
+                "Discover the environment via list-environments, then call list-compute-pools " +
+                "with environmentId to discover the compute pool id (lfcp-...).");
+        }
+        // The Flink REST host is regional, so resolve the compute pool's cloud +
+        // region and derive the per-call base URL from the Auth0 env's base domain.
+        const { cloud, region } = await resolveFlinkComputePoolRegion(this.getConfluentCloudRestClient(), computePoolId, envId);
+        const baseUrl = getFlinkRestUrlForRegion(this.env, cloud, region);
+        const auth = {
+            type: "oauth",
+            getToken: () => this.holder.getDataPlaneToken(),
+        };
+        const client = createClient({ baseUrl });
+        client.use(createAuthMiddleware(auth));
+        return client;
+    }
+    /** @inheritdoc */
     async getSchemaRegistryRestClient(envId) {
         this.requireDataPlaneToken();
         if (!envId) {
@@ -171,15 +193,15 @@ export class OAuthClientManager extends BaseClientManager {
         return producer;
     }
     /** @inheritdoc */
-    async buildKafkaConsumer(clusterId, envId, groupId) {
-        this.requireClusterArgs(clusterId, envId);
-        const kafka = await this.buildOAuthKafkaClient(clusterId, envId);
+    async buildKafkaConsumer(opts) {
+        this.requireClusterArgs(opts?.clusterId, opts?.envId);
+        const kafka = await this.buildOAuthKafkaClient(opts.clusterId, opts.envId);
         return kafka.consumer({
             kafkaJS: {
-                groupId: groupId ?? "mcp-confluent",
+                groupId: opts?.groupId ?? "mcp-confluent",
                 autoCommit: false,
-                fromBeginning: true,
             },
+            "auto.offset.reset": opts?.offsetReset ?? "earliest",
         });
     }
     /** @inheritdoc */