tinybird 4.5.11.dev0__py3-none-any.whl → 4.5.12.dev0__py3-none-any.whl

tinybird/tb/__cli__.py

@@ -4,5 +4,5 @@ __description__ = 'Tinybird Command Line Tool'
 __url__ = 'https://www.tinybird.co/docs/forward/commands'
 __author__ = 'Tinybird'
 __author_email__ = 'support@tinybird.co'
-__version__ = '4.5.11.dev0'
-__revision__ = 'e0b2a62'
+__version__ = '4.5.12.dev0'
+__revision__ = '6a70694'

tinybird/tb/client.py

@@ -1010,16 +1010,29 @@ class TinyB:
         kafka_sasl_mechanism="PLAIN",
         kafka_security_protocol="SASL_SSL",
         kafka_ssl_ca_pem=None,
+        kafka_sasl_oauthbearer_method=None,
+        kafka_sasl_oauthbearer_aws_region=None,
+        kafka_sasl_oauthbearer_aws_role_arn=None,
+        kafka_sasl_oauthbearer_aws_external_id=None,
     ):
+        is_oauthbearer = kafka_sasl_mechanism == "OAUTHBEARER"
         params = {
             "service": "kafka",
             "kafka_security_protocol": kafka_security_protocol,
             "kafka_sasl_mechanism": kafka_sasl_mechanism,
             "kafka_bootstrap_servers": kafka_bootstrap_servers,
-            "kafka_sasl_plain_username": kafka_key,
-            "kafka_sasl_plain_password": kafka_secret,
             "name": kafka_connection_name,
         }
+        if is_oauthbearer:
+            params["kafka_sasl_oauthbearer_method"] = kafka_sasl_oauthbearer_method
+            params["kafka_sasl_oauthbearer_aws_region"] = kafka_sasl_oauthbearer_aws_region
+            params["kafka_sasl_oauthbearer_aws_role_arn"] = kafka_sasl_oauthbearer_aws_role_arn
+            # external_id is optional; the server fills it in from the workspace if absent.
+            if kafka_sasl_oauthbearer_aws_external_id:
+                params["kafka_sasl_oauthbearer_aws_external_id"] = kafka_sasl_oauthbearer_aws_external_id
+        else:
+            params["kafka_sasl_plain_username"] = kafka_key
+            params["kafka_sasl_plain_password"] = kafka_secret
 
         if kafka_schema_registry_url:
             params["kafka_schema_registry_url"] = kafka_schema_registry_url
@@ -1185,7 +1198,8 @@ class TinyB:
     def get_access_read_policy(self, service: str, bucket: Optional[str] = None) -> Dict[str, Any]:
         params = {}
         if bucket:
-            params["bucket"] = bucket
+            # The Kafka endpoint scopes the policy via `msk_cluster_arn`, not `bucket`.
+            params["msk_cluster_arn" if service == "kafka" else "bucket"] = bucket
         return self._req(f"/v0/integrations/{service}/policies/read-access-policy?{urlencode(params)}")
 
     def sql_get_format(self, sql: str, with_clickhouse_format: bool = False) -> str:

tinybird/tb/modules/branch.py

@@ -7,7 +7,7 @@ from typing import Any, Dict, List, Optional, Tuple
 
 import click
 
-from tinybird.tb.modules.cli import cli
+from tinybird.tb.modules.cli import _looks_like_uuid, cli, ensure_valid_workspace_name
 from tinybird.tb.modules.common import (
     MAIN_BRANCH,
     create_workspace_branch,
@@ -93,7 +93,8 @@ def branch_ls(sort: bool) -> None:
     help="Wait for data branch jobs to finish, showing a progress bar. Disabled by default.",
 )
 def create_branch(branch_name: Optional[str], last_partition: bool, ignore_datasources: List[str], wait: bool) -> None:
-    create_workspace_branch(branch_name, last_partition, False, list(ignore_datasources), wait)
+    normalized_branch_name = ensure_valid_workspace_name(branch_name) if branch_name else branch_name
+    create_workspace_branch(normalized_branch_name, last_partition, False, list(ignore_datasources), wait)
 
 
 @branch.command(name="rm", short_help="Removes an branch from the workspace. It can't be recovered.")
@@ -194,11 +195,14 @@ def clear_branch(
     if branch_name_or_id:
         if branch_name_or_id == MAIN_BRANCH:
             raise CLIException(FeedbackManager.error_not_allowed_in_main_branch())
+        lookup_branch_name_or_id = (
+            branch_name_or_id if _looks_like_uuid(branch_name_or_id) else ensure_valid_workspace_name(branch_name_or_id)
+        )
         workspace_to_clear = next(
             (
                 workspace
                 for workspace in workspace_branches
-                if workspace["name"] == branch_name_or_id or workspace["id"] == branch_name_or_id
+                if workspace["name"] == lookup_branch_name_or_id or workspace["id"] == lookup_branch_name_or_id
             ),
             None,
         )
@@ -210,11 +214,16 @@ def clear_branch(
             raise CLIBranchException(FeedbackManager.error_not_a_branch(cli=get_cli_name()))
 
     if not workspace_to_clear:
-        raise CLIBranchException(FeedbackManager.error_branch(branch=branch_name_or_id or "", cli=get_cli_name()))
+        raise CLIBranchException(
+            FeedbackManager.error_branch(
+                branch=lookup_branch_name_or_id if branch_name_or_id else "",
+                cli=get_cli_name(),
+            )
+        )
 
     branch_name = workspace_to_clear["name"]
     if yes or click.confirm(FeedbackManager.warning_confirm_clear_workspace()):
-        was_current_branch = workspace_to_clear["id"] == config.get("id")
+        was_current_branch = workspace_to_clear["id"] == config["id"]
         client = config.get_client(token=current_main_workspace.get("token"))
         try:
             client.delete_branch(workspace_to_clear["id"])

tinybird/tb/modules/cli.py

@@ -68,6 +68,7 @@ PROJECT_TYPE_TYPESCRIPT = "ts-sdk"
 PROJECT_TYPE_PYTHON = "python-sdk"
 PROJECT_TYPE_CLI = "cli"
 PROJECT_TYPES = {PROJECT_TYPE_TYPESCRIPT, PROJECT_TYPE_PYTHON, PROJECT_TYPE_CLI}
+UUID_PATTERN = re.compile(r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", re.IGNORECASE)
 
 
 CLI_PROJECT_MARKERS = (
@@ -163,16 +164,44 @@ def is_main_git_branch(branch_name: Optional[str]) -> bool:
     return branch_name in {"main", "master"}
 
 
-def sanitize_branch_name(branch_name: str) -> str:
+def sanitize_branch_name(branch_name: str, *, enforce_workspace_prefix_rules: bool = True) -> str:
     sanitized = re.sub(r"[^a-zA-Z0-9_]", "_", branch_name)
     sanitized = re.sub(r"_+", "_", sanitized)
-    return sanitized.strip("_")
+    sanitized = sanitized.strip("_")
+    if enforce_workspace_prefix_rules:
+        if sanitized and sanitized[0].isdigit():
+            sanitized = f"branch_{sanitized}"
+        if sanitized.startswith("d_"):
+            sanitized = f"branch_{sanitized}"
+    return sanitized
+
+
+def _looks_like_uuid(value: str) -> bool:
+    return bool(UUID_PATTERN.fullmatch(value))
+
+
+def ensure_valid_workspace_name(name: str, *, context: str = "Branch") -> str:
+    sanitized = sanitize_branch_name(name)
+    if not sanitized:
+        raise CLIException(
+            FeedbackManager.error(
+                message=(
+                    f"{context} name '{name}' is not valid. "
+                    "Name must start with a letter and contain only letters, numbers, and underscores."
+                )
+            )
+        )
+
+    if sanitized != name:
+        click.echo(FeedbackManager.warning_branch_name_sanitized(context=context, original=name, sanitized=sanitized))
+
+    return sanitized
 
 
 def get_tinybird_branch_name_from_git_branch(branch_name: Optional[str]) -> Optional[str]:
     if not branch_name:
         return None
-    sanitized = sanitize_branch_name(branch_name)
+    sanitized = sanitize_branch_name(branch_name, enforce_workspace_prefix_rules=False)
     return sanitized or None
 
 

tinybird/tb/modules/common.py

@@ -1105,26 +1105,57 @@ def is_url_valid(url):
         return False
 
 
-def validate_kafka_bootstrap_servers(host_and_port):
-    if not isinstance(host_and_port, str):
-        raise CLIException(FeedbackManager.error_kafka_bootstrap_server())
-    parts = host_and_port.split(":")
+def _parse_kafka_host_port(entry: str) -> tuple[str, int]:
+    """Parse a single Kafka bootstrap entry of the form 'host' or 'host:port'.
+
+    Raises CLIException on malformed input. Defaults the port to 9092 when omitted.
+    """
+    parts = entry.split(":")
     if len(parts) > 2:
         raise CLIException(FeedbackManager.error_kafka_bootstrap_server())
     host = parts[0]
     port_str = parts[1] if len(parts) == 2 else "9092"
     try:
-        port = int(port_str)
+        return host, int(port_str)
     except Exception:
         raise CLIException(FeedbackManager.error_kafka_bootstrap_server())
-    with closing(socket.socket(socket.AF_INET, socket.SOCK_STREAM)) as sock:
-        try:
-            sock.settimeout(3)
-            sock.connect((host, port))
-        except TimeoutError:
-            raise CLIException(FeedbackManager.error_kafka_bootstrap_server_conn_timeout(host=host, port=port))
-        except Exception:
-            raise CLIException(FeedbackManager.error_kafka_bootstrap_server_conn(host=host, port=port))
+
+
+def validate_kafka_bootstrap_servers(host_and_port):
+    """Validate a Kafka bootstrap-servers string (single entry or comma-separated list).
+
+    Format is checked for every entry. Connectivity is then probed per entry — Kafka
+    only needs one reachable bootstrap broker to discover the rest of the cluster,
+    so the validator passes as long as at least one host accepts a TCP connection.
+    The last connection error is re-raised when every host is unreachable.
+    """
+    if not isinstance(host_and_port, str):
+        raise CLIException(FeedbackManager.error_kafka_bootstrap_server())
+
+    entries = [e.strip() for e in host_and_port.split(",") if e.strip()]
+    if not entries:
+        raise CLIException(FeedbackManager.error_kafka_bootstrap_server())
+
+    # Format-check every entry up front so the user hears about all bad ones at
+    # once rather than discovering them sequentially.
+    hosts = [_parse_kafka_host_port(e) for e in entries]
+
+    last_error: Optional[CLIException] = None
+    for host, port in hosts:
+        with closing(socket.socket(socket.AF_INET, socket.SOCK_STREAM)) as sock:
+            try:
+                sock.settimeout(3)
+                sock.connect((host, port))
+                return  # at least one reachable broker is enough
+            except TimeoutError:
+                last_error = CLIException(
+                    FeedbackManager.error_kafka_bootstrap_server_conn_timeout(host=host, port=port)
+                )
+            except Exception:
+                last_error = CLIException(FeedbackManager.error_kafka_bootstrap_server_conn(host=host, port=port))
+
+    if last_error is not None:
+        raise last_error
 
 
 def validate_kafka_key(s):
@@ -1137,9 +1168,11 @@ def validate_kafka_secret(s):
         raise CLIException("Password format is not correct, it must be a string")
 
 
-def validate_string_connector_param(param, s):
+def validate_string_connector_param(param: str, s: str) -> None:
     if not isinstance(s, str):
         raise CLIConnectionException(param + " format is not correct, it must be a string")
+    if not s or not s.strip():
+        raise CLIConnectionException(param + " cannot be empty")
 
 
 def validate_connection_name(client, connection_name, service):

tinybird/tb/modules/connection.py

@@ -40,6 +40,18 @@ from tinybird.tb.modules.feedback_manager import FeedbackManager, get_cli_name
 from tinybird.tb.modules.project import Project
 from tinybird.tb.modules.secret import save_secret_to_env_file
 
+
+def _upper_or_none(_ctx: click.Context, _param: click.Parameter, value: Optional[str]) -> Optional[str]:
+    """Click callback that uppercases the option value if present.
+
+    Kafka SASL mechanisms and security protocols are matched case-sensitively
+    downstream (CLI, client, server), so we normalize at the flag layer to
+    accept user input like `--sasl-mechanism oauthbearer` without silently
+    falling through the case-sensitive branches and breaking the request.
+    """
+    return value.upper() if value else value
+
+
 DATA_CONNECTOR_SETTINGS: Dict[DataConnectorType, List[str]] = {
     DataConnectorType.KAFKA: [
         "kafka_bootstrap_servers",
@@ -247,15 +259,22 @@ def connection_create_gcs(ctx: Context) -> None:
 @click.option("--schema-registry-url", default=None, help="Avro Confluent Schema Registry URL")
 @click.option(
     "--sasl-mechanism",
-    default="PLAIN",
+    default=None,
+    callback=_upper_or_none,
     help="Authentication method for connection-based protocols. Defaults to 'PLAIN'",
 )
 @click.option(
     "--security-protocol",
-    default="SASL_SSL",
+    default=None,
+    callback=_upper_or_none,
     help="Security protocol for connection-based protocols. Defaults to 'SASL_SSL'",
 )
 @click.option("--ssl-ca-pem", default=None, help="Path or content of the CA Certificate file in PEM format")
+@click.option(
+    "--oauthbearer-aws-external-id",
+    default=None,
+    help="Pre-shared external_id for the AWS assume-role call (OAUTHBEARER+AWS only). If omitted, the wizard prompts for one and falls back to a Tinybird-generated value.",
+)
 @click.pass_context
 def connection_create_kafka_cmd(
     ctx: Context,
@@ -268,6 +287,7 @@ def connection_create_kafka_cmd(
     sasl_mechanism: Optional[str],
     security_protocol: Optional[str],
     ssl_ca_pem: Optional[str],
+    oauthbearer_aws_external_id: Optional[str],
 ) -> None:
     env: str = ctx.ensure_object(dict)["env"]
     project: Project = ctx.ensure_object(dict)["project"]
@@ -295,6 +315,7 @@ def connection_create_kafka_cmd(
         sasl_mechanism=sasl_mechanism,
         security_protocol=security_protocol,
         ssl_ca_pem=ssl_ca_pem,
+        oauthbearer_aws_external_id=oauthbearer_aws_external_id,
     )
 
     if not result["error"]:

tinybird/tb/modules/connection_kafka.py

@@ -4,26 +4,289 @@
 # - But please, **do not** interleave utility functions and command definitions.
 
 import re
+import uuid
 from datetime import datetime
-from typing import Any, Dict, Optional
+from typing import Any, Dict, Optional, Tuple
 
 import click
+import pyperclip
 from click import Context
 from confluent_kafka.admin import AdminClient
 
 from tinybird.tb.client import TinyB
 from tinybird.tb.modules.common import (
     echo_safe_humanfriendly_tables_format_smart_table,
+    get_aws_iamrole_policies,
     get_kafka_connection_name,
     validate_kafka_bootstrap_servers,
+    validate_string_connector_param,
 )
 from tinybird.tb.modules.create import generate_kafka_connection_with_secrets
 from tinybird.tb.modules.exceptions import CLIConnectionException, CLIException
 from tinybird.tb.modules.feedback_manager import FeedbackManager
+from tinybird.tb.modules.local_common import get_tinybird_local_client
 from tinybird.tb.modules.project import Project
 from tinybird.tb.modules.secret import save_secret_to_env_file
 from tinybird.tb.modules.telemetry import add_telemetry_event
 
+# SASL mechanisms that authenticate with a username/password pair (the "key" + "secret"
+# the wizard collects). OAUTHBEARER is intentionally excluded — its credentials come
+# from the AWS IAM role flow, not from a key/secret prompt.
+SASL_MECHANISMS_WITH_CREDENTIALS = ("PLAIN", "SCRAM-SHA-256", "SCRAM-SHA-512")
+
+
+def run_kafka_aws_iamrole_connection_flow(
+    config: Dict[str, Any],
+    client: TinyB,
+    connection_name: str,
+    external_id_override: Optional[str] = None,
+) -> Tuple[str, str, str, str, Optional[TinyB], Optional[TinyB]]:
+    """Interactive AWS IAM Role connection flow for Kafka (MSK).
+
+    Walks the user through creating an IAM access policy and role with the trust
+    policy that includes the AWS account IDs of the selected environments
+    (local, cloud, or both), then returns everything the caller needs to write
+    the `.connection` file and store the role ARN as a secret.
+    """
+    service = "kafka"
+
+    msk_cluster_arn = click.prompt(
+        FeedbackManager.highlight(
+            message="? MSK Cluster ARN (e.g., arn:aws:kafka:us-east-1:123456789012:cluster/my-cluster/...)"
+        ),
+        prompt_suffix="\n> ",
+    )
+    validate_string_connector_param("MSK Cluster ARN", msk_cluster_arn)
+
+    # ARN can be either ".../cluster/NAME" or ".../cluster/NAME/UUID"; cluster
+    # name is the second-to-last segment when a UUID is present, otherwise last.
+    if "/" in msk_cluster_arn:
+        arn_parts = msk_cluster_arn.split("/")
+        cluster_name = arn_parts[-2] if len(arn_parts) >= 3 else arn_parts[-1]
+    else:
+        cluster_name = "cluster"
+
+    try:
+        region = msk_cluster_arn.split(":")[3]
+    except (IndexError, AttributeError):
+        region = ""
+
+    if not region or not region.strip():
+        region = click.prompt(
+            FeedbackManager.highlight(message="? Region (the region where the MSK cluster is located)"),
+            default="us-east-1",
+            show_default=True,
+            prompt_suffix="\n> ",
+        )
+    validate_string_connector_param("Region", region)
+
+    cloud_client, local_client = _choose_environments_and_init_clients(config)
+
+    # Policy fetch can fail if the server doesn't have AWS credentials (typical for
+    # tb local) or if the role already exists out-of-band. We don't want that to
+    # abort the wizard — the user can still paste a known role ARN + external_id
+    # at the end. Show a warning and continue with placeholder text so the
+    # walkthrough steps below still display something sensible.
+    try:
+        access_policy, trust_policy, external_id = get_aws_iamrole_policies(
+            client,
+            service=service,
+            policy="read",
+            bucket=msk_cluster_arn,
+            external_id_seed=connection_name,
+            cloud_client=cloud_client,
+            local_client=local_client,
+        )
+    except Exception as e:
+        click.echo(
+            FeedbackManager.warning(
+                message=(
+                    f"⚠ Could not auto-generate IAM policies from Tinybird ({e}). "
+                    "Continuing anyway — you can still paste a pre-existing Role ARN + External ID below."
+                )
+            )
+        )
+        access_policy = "<could not generate — see your AWS admin or use an existing policy>"
+        trust_policy = "<could not generate — see your AWS admin or use an existing role>"
+        external_id = ""
+
+    click.echo(FeedbackManager.gray(message="\n» Step 1: AWS Authentication"))
+    click.echo(
+        FeedbackManager.info(
+            message="Please log into your AWS Console. We'll guide you through creating the necessary permissions: https://console.aws.amazon.com/"
+        )
+    )
+    click.echo(
+        FeedbackManager.info(
+            message="You'll be creating a single IAM Policy and Role to access your Kafka data. Using IAM Roles improves security by providing temporary credentials and following least privilege principles."
+        )
+    )
+    click.echo(FeedbackManager.click_enter_to_continue())
+    input()
+
+    access_policy_copied = False
+    try:
+        pyperclip.copy(access_policy)
+        access_policy_copied = True
+    except Exception:
+        pass
+
+    click.echo(FeedbackManager.gray(message="» Step 2: Create IAM Policy"))
+    click.echo(
+        FeedbackManager.info(
+            message=f"1. Go to AWS IAM > Create Policy: https://console.aws.amazon.com/iamv2/home?region={region}#/policies/create"
+        )
+    )
+    click.echo(FeedbackManager.info(message="2. Select the JSON tab"))
+    if access_policy_copied:
+        click.echo(FeedbackManager.info(message="3. Paste the following policy (already copied to clipboard):"))
+    else:
+        click.echo(FeedbackManager.info(message="3. Copy and paste the following policy:"))
+    click.echo(FeedbackManager.highlight(message=f"\n{access_policy}\n"))
+    click.echo(
+        FeedbackManager.info(
+            message=f"4. Name the policy something meaningful (e.g., TinybirdKafkaAccess-{cluster_name})"
+        )
+    )
+    click.echo(FeedbackManager.info(message="5. Click 'Create policy'"))
+    click.echo(FeedbackManager.click_enter_to_continue())
+    input()
+
+    trust_policy_copied = False
+    try:
+        pyperclip.copy(trust_policy)
+        trust_policy_copied = True
+    except Exception:
+        pass
+
+    click.echo(FeedbackManager.gray(message="» Step 3: Create IAM Role"))
+    click.echo(
+        FeedbackManager.info(
+            message=f"1. Go to AWS IAM > Create Role: https://console.aws.amazon.com/iamv2/home?region={region}#/roles/create"
+        )
+    )
+    click.echo(FeedbackManager.info(message='2. Choose "Custom trust policy"'))
+    if trust_policy_copied:
+        click.echo(FeedbackManager.info(message="3. Paste the following trust policy (already copied to clipboard):"))
+    else:
+        click.echo(FeedbackManager.info(message="3. Paste the following trust policy:"))
+    click.echo(FeedbackManager.highlight(message=f"\n{trust_policy}\n"))
+    click.echo(FeedbackManager.info(message="4. Click Next, search for and select the policy you just created"))
+    click.echo(
+        FeedbackManager.info(message=f"5. Name the role something meaningful (e.g., TinybirdKafkaRole-{cluster_name})")
+    )
+    click.echo(FeedbackManager.info(message="6. Click 'Create role'"))
+    click.echo(FeedbackManager.info(message="7. Copy the Role ARN from the role details page"))
+
+    role_arn = click.prompt(
+        FeedbackManager.highlight(message="? Please enter the ARN of the role you just created"),
+        show_default=False,
+    )
+    validate_string_connector_param("Role ARN", role_arn)
+
+    # Allow a pre-shared external_id (e.g. when the role's trust policy was set up
+    # out-of-band with a specific External ID agreed between the cluster owner and
+    # Tinybird). Flag wins; otherwise prompt; empty answer keeps the server-generated one.
+    if external_id_override and external_id_override.strip():
+        external_id = external_id_override.strip()
+    else:
+        provided = click.prompt(
+            FeedbackManager.highlight(
+                message="? External ID (optional, leave blank to use the Tinybird-generated one shown in the trust policy above)"
+            ),
+            default="",
+            show_default=False,
+        )
+        if provided and provided.strip():
+            external_id = provided.strip()
+
+    return role_arn, region, external_id, msk_cluster_arn, cloud_client, local_client
+
+
+def _choose_environments_and_init_clients(
+    config: Dict[str, Any],
+) -> Tuple[Optional[TinyB], Optional[TinyB]]:
+    """Ask the user which environments the connection targets and initialize the
+    corresponding clients (used to create the role-ARN secret in both)."""
+    click.echo(
+        FeedbackManager.highlight(
+            message="? Which environments will use this connection? (the role-ARN secret will be created in the selected envs)"
+        )
+    )
+    click.echo("  [1] Local only")
+    click.echo("  [2] Cloud only")
+    click.echo("  [3] Both")
+    env_choice = click.prompt("\nSelect option", default=3, type=int)
+
+    if env_choice == 1:
+        use_local, use_cloud = True, False
+    elif env_choice == 2:
+        use_local, use_cloud = False, True
+    else:
+        if env_choice != 3:
+            click.echo(FeedbackManager.warning(message="Invalid option. Defaulting to 'Both'."))
+        use_local, use_cloud = True, True
+
+    local_client: Optional[TinyB] = None
+    cloud_client: Optional[TinyB] = None
+
+    if use_local:
+        try:
+            local_client, _ = get_tinybird_local_client(config)
+        except Exception as e:
+            click.echo(FeedbackManager.warning(message=f"Failed to initialize local client: {e}"))
+
+    if use_cloud:
+        try:
+            cloud_client = TinyB(token=config.get("token", ""), host=config.get("host", ""), staging=False)
+        except Exception as e:
+            click.echo(FeedbackManager.warning(message=f"Failed to initialize cloud client: {e}"))
+
+    return cloud_client, local_client
+
+
+def run_kafka_aws_iamrole_existing_role_flow(
+    config: Dict[str, Any],
+    external_id_override: Optional[str] = None,
+) -> Tuple[str, str, str, str, Optional[TinyB], Optional[TinyB]]:
+    """Fast path for users who already have an IAM role configured for MSK.
+
+    Skips the policy fetch and the AWS Console walkthrough entirely. Collects
+    region + role ARN + external ID + env choice for secret storage.
+    """
+    region = click.prompt(
+        FeedbackManager.highlight(message="? AWS region of the MSK cluster"),
+        default="us-east-1",
+        show_default=True,
+    )
+    validate_string_connector_param("Region", region)
+
+    role_arn = click.prompt(
+        FeedbackManager.highlight(message="? IAM Role ARN to assume for MSK"),
+        show_default=False,
+    )
+    validate_string_connector_param("Role ARN", role_arn)
+
+    external_id = ""
+    if external_id_override and external_id_override.strip():
+        external_id = external_id_override.strip()
+    else:
+        provided = click.prompt(
+            FeedbackManager.highlight(
+                message="? External ID (leave blank to let Tinybird derive one from the workspace)"
+            ),
+            default="",
+            show_default=False,
+        )
+        if provided and provided.strip():
+            external_id = provided.strip()
+
+    cloud_client, local_client = _choose_environments_and_init_clients(config)
+
+    # msk_cluster_arn is never written to the .connection file — return "" since
+    # the caller ignores it on this code path.
+    return role_arn, region, external_id, "", cloud_client, local_client
+
 
 def connection_create_kafka(
     ctx: Context,
@@ -36,10 +299,12 @@ def connection_create_kafka(
     sasl_mechanism: Optional[str] = None,
     security_protocol: Optional[str] = None,
     ssl_ca_pem: Optional[str] = None,
+    oauthbearer_aws_external_id: Optional[str] = None,
 ) -> dict[str, Any]:
     obj: Dict[str, Any] = ctx.ensure_object(dict)
     click.echo(FeedbackManager.gray(message="\n» Creating Kafka connection..."))
     project: Project = ctx.ensure_object(dict)["project"]
+    client: TinyB = ctx.ensure_object(dict)["client"]
     name = get_kafka_connection_name(project.folder, connection_name)
     error: Optional[str] = None
 
@@ -81,40 +346,6 @@ def connection_create_kafka(
         except Exception as e:
             raise CLIConnectionException(FeedbackManager.error(message=str(e)))
 
-    key = click.prompt(FeedbackManager.highlight(message="? Kafka key"))
-
-    assert isinstance(key, str)
-
-    secret_required = click.confirm(
-        FeedbackManager.info(message="  ? Do you want to store the Kafka key in a .env.local file? [Y/n]"),
-        default=True,
-        show_default=False,
-    )
-
-    if secret_required:
-        tb_secret_key = str(click.prompt(FeedbackManager.info(message="    ? Secret name")))
-        try:
-            save_secret_to_env_file(project=project, name=tb_secret_key, value=key)
-        except Exception as e:
-            raise CLIConnectionException(FeedbackManager.error(message=str(e)))
-
-    secret = secret or click.prompt(FeedbackManager.highlight(message="? Kafka secret"), hide_input=True)
-
-    assert isinstance(secret, str)
-
-    secret_required = click.confirm(
-        FeedbackManager.info(message="  ? Do you want to store the Kafka secret in a .env.local file? [Y/n]"),
-        default=True,
-        show_default=False,
-    )
-
-    if secret_required:
-        tb_secret_secret = str(click.prompt(FeedbackManager.info(message="    ? Secret name")))
-        try:
-            save_secret_to_env_file(project=project, name=tb_secret_secret, value=secret)
-        except Exception as e:
-            raise CLIConnectionException(FeedbackManager.error(message=str(e)))
-
     security_protocol_options = ["SASL_SSL", "SASL_PLAINTEXT", "PLAINTEXT"]
     security_protocol = security_protocol or click.prompt(
         FeedbackManager.highlight(message="? Security Protocol (SASL_SSL, SASL_PLAINTEXT, PLAINTEXT) [SASL_SSL]"),
@@ -127,17 +358,132 @@ def connection_create_kafka(
     if security_protocol not in security_protocol_options:
         raise CLIConnectionException(FeedbackManager.error(message=f"Invalid security protocol: {security_protocol}"))
 
-    sasl_mechanism_options = ["PLAIN", "SCRAM-SHA-256", "SCRAM-SHA-512"]
-    sasl_mechanism = sasl_mechanism or click.prompt(
-        FeedbackManager.highlight(message="? SASL Mechanism (PLAIN, SCRAM-SHA-256, SCRAM-SHA-512) [PLAIN]"),
-        type=click.Choice(sasl_mechanism_options),
-        show_default=False,
-        show_choices=False,
-        default="PLAIN",
-    )
+    kafka_sasl_oauthbearer_method: Optional[str] = None
+    kafka_sasl_oauthbearer_aws_region: Optional[str] = None
+    kafka_sasl_oauthbearer_aws_role_arn: Optional[str] = None
+    kafka_sasl_oauthbearer_aws_external_id: Optional[str] = None
+    tb_secret_aws_role_arn: Optional[str] = None
+    # Track if the role-ARN secret was already created in cloud during the OAUTHBEARER
+    # flow so we don't prompt the user a second time in the cloud-secrets block below.
+    aws_role_arn_secret_created_in_cloud = False
+
+    # PLAINTEXT doesn't use SASL, so skip the mechanism prompt entirely.
+    if security_protocol == "PLAINTEXT":
+        sasl_mechanism = None
+    else:
+        sasl_mechanism_options = ["PLAIN", "SCRAM-SHA-256", "SCRAM-SHA-512", "OAUTHBEARER"]
+        sasl_mechanism = sasl_mechanism or click.prompt(
+            FeedbackManager.highlight(
+                message="? SASL Mechanism (PLAIN, SCRAM-SHA-256, SCRAM-SHA-512, OAUTHBEARER) [PLAIN]"
+            ),
+            type=click.Choice(sasl_mechanism_options),
+            show_default=False,
+            show_choices=False,
+            default="PLAIN",
+        )
+        if sasl_mechanism not in sasl_mechanism_options:
+            raise CLIConnectionException(FeedbackManager.error(message=f"Invalid SASL mechanism: {sasl_mechanism}"))
 
-    if sasl_mechanism not in sasl_mechanism_options:
-        raise CLIConnectionException(FeedbackManager.error(message=f"Invalid SASL mechanism: {sasl_mechanism}"))
+    if sasl_mechanism == "OAUTHBEARER":
+        kafka_sasl_oauthbearer_method = "AWS"
+
+        # Fast-path for users who already have the IAM role + trust policy set up
+        # (common: the role is owned by the same team as the MSK cluster and the
+        # external_id was pre-shared). Skips policy fetch + AWS Console walkthrough.
+        has_existing_role = click.confirm(
+            FeedbackManager.highlight(
+                message="? Do you already have an IAM role configured for this MSK cluster? [y/N]"
+            ),
+            default=False,
+            show_default=False,
+        )
+
+        if has_existing_role:
+            (
+                kafka_sasl_oauthbearer_aws_role_arn,
+                kafka_sasl_oauthbearer_aws_region,
+                kafka_sasl_oauthbearer_aws_external_id,
+                _,
+                cloud_client,
+                local_client,
+            ) = run_kafka_aws_iamrole_existing_role_flow(
+                config=obj["config"],
+                external_id_override=oauthbearer_aws_external_id,
+            )
+        else:
+            (
+                kafka_sasl_oauthbearer_aws_role_arn,
+                kafka_sasl_oauthbearer_aws_region,
+                kafka_sasl_oauthbearer_aws_external_id,
+                _,
+                cloud_client,
+                local_client,
+            ) = run_kafka_aws_iamrole_connection_flow(
+                config=obj["config"],
+                client=client,
+                connection_name=name,
+                external_id_override=oauthbearer_aws_external_id,
+            )
+
+        # Auto-store the role ARN as a secret (in local + cloud per the user's choice
+        # of environments) so the .connection file can reference it via tb_secret().
+        unique_suffix = uuid.uuid4().hex[:8]
+        secret_name = f"kafka_role_arn_{name}_{unique_suffix}"
+        secret_created = False
+
+        if local_client and kafka_sasl_oauthbearer_aws_role_arn:
+            try:
+                save_secret_to_env_file(project=project, name=secret_name, value=kafka_sasl_oauthbearer_aws_role_arn)
+                secret_created = True
+            except Exception as e:
+                click.echo(FeedbackManager.warning(message=f"Failed to create secret in local: {e}"))
+
+        if cloud_client and kafka_sasl_oauthbearer_aws_role_arn:
+            try:
+                cloud_client.create_secret(name=secret_name, value=kafka_sasl_oauthbearer_aws_role_arn)
+                secret_created = True
+                aws_role_arn_secret_created_in_cloud = True
+            except Exception as e:
+                click.echo(FeedbackManager.warning(message=f"Failed to create secret in cloud: {e}"))
+
+        if secret_created:
+            tb_secret_aws_role_arn = secret_name
+        else:
+            click.echo(
+                FeedbackManager.warning(
+                    message="No secrets were created. The role ARN will be stored directly in the connection file."
+                )
+            )
+
+    # PLAIN/SCRAM still need a username + password.
+    if sasl_mechanism in SASL_MECHANISMS_WITH_CREDENTIALS:
+        key = key or click.prompt(FeedbackManager.highlight(message="? Kafka key"))
+        assert isinstance(key, str)
+
+        if click.confirm(
+            FeedbackManager.info(message="  ? Do you want to store the Kafka key in a .env.local file? [Y/n]"),
+            default=True,
+            show_default=False,
+        ):
+            tb_secret_key = str(click.prompt(FeedbackManager.info(message="    ? Secret name")))
+            try:
+                save_secret_to_env_file(project=project, name=tb_secret_key, value=key)
+            except Exception as e:
+                raise CLIConnectionException(FeedbackManager.error(message=str(e)))
+
+        secret = secret or click.prompt(FeedbackManager.highlight(message="? Kafka secret"), hide_input=True)
+        assert isinstance(secret, str)
+
+        if click.confirm(
+            FeedbackManager.info(message="  ? Do you want to store the Kafka secret in a .env.local file? [Y/n]"),
+            default=True,
+            show_default=False,
+        ):
+            tb_secret_secret = str(click.prompt(FeedbackManager.info(message="    ? Secret name")))
+            try:
+                save_secret_to_env_file(project=project, name=tb_secret_secret, value=secret)
+            except Exception as e:
+                raise CLIConnectionException(FeedbackManager.error(message=str(e)))
 
     if not schema_registry_url:
         schema_registry_url = click.prompt(
@@ -168,6 +514,15 @@ def connection_create_kafka(
                 except Exception as e:
                     raise CLIConnectionException(FeedbackManager.error(message=str(e)))
 
+    # Skip the role-ARN secret in this check if it was already created in cloud
+    # by the OAUTHBEARER flow above.
+    has_secrets_needing_cloud_creation = (
+        tb_secret_bootstrap_servers
+        or tb_secret_key
+        or tb_secret_secret
+        or tb_secret_ssl_ca_pem
+        or (tb_secret_aws_role_arn and not aws_role_arn_secret_created_in_cloud)
+    )
     create_in_cloud = (
         click.confirm(
             FeedbackManager.highlight(
@@ -176,8 +531,7 @@ def connection_create_kafka(
             default=True,
             show_default=False,
         )
-        if obj["env"] == "local"
-        and (tb_secret_bootstrap_servers or tb_secret_key or tb_secret_secret or tb_secret_ssl_ca_pem)
+        if obj["env"] == "local" and has_secrets_needing_cloud_creation
         else False
     )
 
@@ -194,24 +548,36 @@ def connection_create_kafka(
         )
         if tb_secret_bootstrap_servers:
             prod_client.create_secret(name=tb_secret_bootstrap_servers, value=bootstrap_servers)
-        if tb_secret_key:
+        # tb_secret_key/tb_secret_secret are only set in the PLAIN/SCRAM branch,
+        # where key/secret are guaranteed strings.
+        if tb_secret_key and key is not None:
             prod_client.create_secret(name=tb_secret_key, value=key)
-        if tb_secret_secret:
+        if tb_secret_secret and secret is not None:
             prod_client.create_secret(name=tb_secret_secret, value=secret)
         if tb_secret_ssl_ca_pem and ssl_ca_pem:
             prod_client.create_secret(name=tb_secret_ssl_ca_pem, value=ssl_ca_pem)
+        if tb_secret_aws_role_arn and kafka_sasl_oauthbearer_aws_role_arn and not aws_role_arn_secret_created_in_cloud:
+            prod_client.create_secret(name=tb_secret_aws_role_arn, value=kafka_sasl_oauthbearer_aws_role_arn)
         click.echo(FeedbackManager.success(message="✓ Secrets created!"))
 
-    click.echo(FeedbackManager.gray(message="» Validating connection..."))
-
     topics: list[str] = []
-    try:
-        topics = list_kafka_topics(bootstrap_servers, key, secret, security_protocol, sasl_mechanism, ssl_ca_pem)
-        click.echo(FeedbackManager.success(message="✓ Connection is valid"))
-    except Exception as e:
-        error = str(e)
-        click.echo(FeedbackManager.error(message=f"Connection is not valid: {e}"))
-        add_telemetry_event("connection_error", error=error)
+    if sasl_mechanism in SASL_MECHANISMS_WITH_CREDENTIALS:
+        click.echo(FeedbackManager.gray(message="» Validating connection..."))
+        try:
+            assert key is not None and secret is not None
+            topics = list_kafka_topics(bootstrap_servers, key, secret, security_protocol, sasl_mechanism, ssl_ca_pem)
+            click.echo(FeedbackManager.success(message="✓ Connection is valid"))
+        except Exception as e:
+            error = str(e)
+            click.echo(FeedbackManager.error(message=f"Connection is not valid: {e}"))
+            add_telemetry_event("connection_error", error=error)
+    else:
+        # OAUTHBEARER (no AWS creds locally) and PLAINTEXT defer validation to deploy-time.
+        click.echo(
+            FeedbackManager.info(
+                message=f"⚠ Skipping local validation for {sasl_mechanism or 'PLAINTEXT'}. The connection will be validated on deploy."
+            )
+        )
 
     generate_kafka_connection_with_secrets(
         name=name,
@@ -226,6 +592,11 @@ def connection_create_kafka(
         ssl_ca_pem=ssl_ca_pem,
         tb_secret_ssl_ca_pem=tb_secret_ssl_ca_pem,
         schema_registry_url=schema_registry_url,
+        kafka_sasl_oauthbearer_method=kafka_sasl_oauthbearer_method,
+        kafka_sasl_oauthbearer_aws_region=kafka_sasl_oauthbearer_aws_region,
+        kafka_sasl_oauthbearer_aws_role_arn=kafka_sasl_oauthbearer_aws_role_arn,
+        kafka_sasl_oauthbearer_aws_external_id=kafka_sasl_oauthbearer_aws_external_id,
+        tb_secret_aws_role_arn=tb_secret_aws_role_arn,
         folder=project.folder,
     )
     click.echo(FeedbackManager.info_file_created(file=f"connections/{name}.connection"))

tinybird/tb/modules/create.py

@@ -561,35 +561,58 @@ def persist_tinybird_config(root_folder: str, project_type: str, dev_mode: str,
 def generate_kafka_connection_with_secrets(
     name: str,
     bootstrap_servers: str,
-    key: str,
-    secret: str,
+    key: Optional[str],
+    secret: Optional[str],
     tb_secret_bootstrap_servers: Optional[str],
     tb_secret_key: Optional[str],
     tb_secret_secret: Optional[str],
     security_protocol: str,
-    sasl_mechanism: str,
+    sasl_mechanism: Optional[str],
     ssl_ca_pem: Optional[str],
     tb_secret_ssl_ca_pem: Optional[str],
     schema_registry_url: Optional[str],
     folder: str,
+    kafka_sasl_oauthbearer_method: Optional[str] = None,
+    kafka_sasl_oauthbearer_aws_region: Optional[str] = None,
+    kafka_sasl_oauthbearer_aws_role_arn: Optional[str] = None,
+    kafka_sasl_oauthbearer_aws_external_id: Optional[str] = None,
+    tb_secret_aws_role_arn: Optional[str] = None,
 ) -> Path:
     kafka_bootstrap_servers = (
         inject_tb_secret(tb_secret_bootstrap_servers) if tb_secret_bootstrap_servers else bootstrap_servers
     )
-    kafka_key = inject_tb_secret(tb_secret_key) if tb_secret_key else key
-    kafka_secret = inject_tb_secret(tb_secret_secret) if tb_secret_secret else secret
-    kafka_ssl_ca_pem = inject_tb_secret(tb_secret_ssl_ca_pem) if tb_secret_ssl_ca_pem else ssl_ca_pem
     content = f"""TYPE kafka
 KAFKA_BOOTSTRAP_SERVERS {kafka_bootstrap_servers}
 KAFKA_SECURITY_PROTOCOL {security_protocol or "SASL_SSL"}
-KAFKA_SASL_MECHANISM {sasl_mechanism or "PLAIN"}
-KAFKA_KEY {kafka_key}
-KAFKA_SECRET {kafka_secret}
 """
+    # PLAINTEXT skips SASL entirely.
+    if sasl_mechanism:
+        content += f"KAFKA_SASL_MECHANISM {sasl_mechanism}\n"
+
+    if sasl_mechanism == "OAUTHBEARER" and kafka_sasl_oauthbearer_method == "AWS":
+        content += f"KAFKA_SASL_OAUTHBEARER_METHOD {kafka_sasl_oauthbearer_method}\n"
+        if kafka_sasl_oauthbearer_aws_region:
+            content += f"KAFKA_SASL_OAUTHBEARER_AWS_REGION {kafka_sasl_oauthbearer_aws_region}\n"
+        if kafka_sasl_oauthbearer_aws_role_arn:
+            kafka_role_arn = (
+                inject_tb_secret(tb_secret_aws_role_arn)
+                if tb_secret_aws_role_arn
+                else kafka_sasl_oauthbearer_aws_role_arn
+            )
+            content += f"KAFKA_SASL_OAUTHBEARER_AWS_ROLE_ARN {kafka_role_arn}\n"
+        if kafka_sasl_oauthbearer_aws_external_id:
+            content += f"KAFKA_SASL_OAUTHBEARER_AWS_EXTERNAL_ID {kafka_sasl_oauthbearer_aws_external_id}\n"
+    elif sasl_mechanism in ("PLAIN", "SCRAM-SHA-256", "SCRAM-SHA-512"):
+        kafka_key = inject_tb_secret(tb_secret_key) if tb_secret_key else key
+        kafka_secret = inject_tb_secret(tb_secret_secret) if tb_secret_secret else secret
+        content += f"KAFKA_KEY {kafka_key}\nKAFKA_SECRET {kafka_secret}\n"
+
     if schema_registry_url:
-        content += f"""KAFKA_SCHEMA_REGISTRY_URL {schema_registry_url}\n"""
+        content += f"KAFKA_SCHEMA_REGISTRY_URL {schema_registry_url}\n"
+
+    kafka_ssl_ca_pem = inject_tb_secret(tb_secret_ssl_ca_pem) if tb_secret_ssl_ca_pem else ssl_ca_pem
     if kafka_ssl_ca_pem:
-        content += f"""KAFKA_SSL_CA_PEM >\n    {kafka_ssl_ca_pem}\n"""
+        content += f"KAFKA_SSL_CA_PEM >\n    {kafka_ssl_ca_pem}\n"
     content += """# Learn more at https://www.tinybird.co/docs/forward/get-data-in/connectors/kafka#kafka-connection-settings
 """
 

tinybird/tb/modules/datafile/build.py

@@ -816,6 +816,10 @@ def process_file(
 
         if not skip_connectors:
             try:
+                is_oauthbearer = params.get("kafka_sasl_mechanism") == "OAUTHBEARER"
+                # PLAINTEXT brokers have no SASL at all, so a key/secret pair is
+                # neither produced by the wizard nor expected on the wire.
+                is_plaintext = params.get("kafka_security_protocol") == "PLAINTEXT"
                 connector_params = {
                     "kafka_bootstrap_servers": params.get("kafka_bootstrap_servers", None),
                     "kafka_key": params.get("kafka_key", None),
@@ -825,6 +829,16 @@ def process_file(
                     "kafka_schema_registry_url": params.get("kafka_schema_registry_url", None),
                     "kafka_ssl_ca_pem": get_ca_pem_content(params.get("kafka_ssl_ca_pem", None), filename),
                     "kafka_sasl_mechanism": params.get("kafka_sasl_mechanism", None),
+                    # Explicit default — None would be dropped by the client's
+                    # `if value is not None` filter, leaving the server to pick
+                    # its own protocol instead of the SASL_SSL we want.
+                    "kafka_security_protocol": params.get("kafka_security_protocol", "SASL_SSL"),
+                    "kafka_sasl_oauthbearer_method": params.get("kafka_sasl_oauthbearer_method", None),
+                    "kafka_sasl_oauthbearer_aws_region": params.get("kafka_sasl_oauthbearer_aws_region", None),
+                    "kafka_sasl_oauthbearer_aws_role_arn": params.get("kafka_sasl_oauthbearer_aws_role_arn", None),
+                    "kafka_sasl_oauthbearer_aws_external_id": params.get(
+                        "kafka_sasl_oauthbearer_aws_external_id", None
+                    ),
                 }
 
                 connector = tb_client.get_connection(**connector_params)
@@ -832,11 +846,24 @@ def process_file(
                     click.echo(
                         FeedbackManager.info_creating_kafka_connection(connection_name=params["kafka_connection_name"])
                     )
-                    required_params = [
-                        connector_params["kafka_bootstrap_servers"],
-                        connector_params["kafka_key"],
-                        connector_params["kafka_secret"],
-                    ]
+                    if is_oauthbearer:
+                        required_params = [
+                            connector_params["kafka_bootstrap_servers"],
+                            connector_params["kafka_sasl_oauthbearer_method"],
+                            connector_params["kafka_sasl_oauthbearer_aws_region"],
+                            connector_params["kafka_sasl_oauthbearer_aws_role_arn"],
+                        ]
+                    elif is_plaintext:
+                        # No SASL, no credentials — only the broker address matters.
+                        required_params = [
+                            connector_params["kafka_bootstrap_servers"],
+                        ]
+                    else:
+                        required_params = [
+                            connector_params["kafka_bootstrap_servers"],
+                            connector_params["kafka_key"],
+                            connector_params["kafka_secret"],
+                        ]
 
                     if not all(required_params):
                         raise click.ClickException(

tinybird/tb/modules/feedback_manager.py

@@ -729,6 +729,9 @@ STEP 3: ADD KEY TO SERVICE ACCOUNT
     )
     warning_name_already_exists = warning_message("** Warning: {name} already exists, skipping")
     warning_dry_name_already_exists = warning_message("** [DRY RUN] {name} already exists, skipping")
+    warning_branch_name_sanitized = warning_message(
+        "** Warning: {context} name '{original}' is not valid; using '{sanitized}' instead."
+    )
     warning_datasource_cannot_be_pushed = warning_message(
         "** [DRY RUN] Failed pushing datasource. Top level object names must be unique. {name} cannot have same name as an existing pipe."
     )

tinybird/tb/modules/info.py

@@ -22,6 +22,7 @@ def info(ctx: click.Context, skip_local: bool) -> None:
     ctx_config = ctx.ensure_object(dict)["config"]
     project: Project = ctx.ensure_object(dict)["project"]
     output = ctx.ensure_object(dict)["output"]
+    selected_branch = ctx.ensure_object(dict).get("branch")
 
     if output not in {"human", "json"}:
         force_echo(FeedbackManager.error_invalid_output_format(formats=", ".join(["human", "json"])))
@@ -43,7 +44,7 @@ def info(ctx: click.Context, skip_local: bool) -> None:
     click.echo(FeedbackManager.highlight(message="\n» Project:"))
     project_table, project_columns = get_project_info(project.folder)
 
-    branches_summary = get_branches_summary(ctx_config)
+    branches_summary = get_branches_summary(ctx_config, selected_branch=selected_branch)
 
     if output == "human":
         click.echo(FeedbackManager.highlight(message="\n» Branches:"))
@@ -75,11 +76,14 @@ def info(ctx: click.Context, skip_local: bool) -> None:
             project_data = {column: project_table[0][i] for i, column in enumerate(project_columns)}
         response["project"] = project_data
 
-        response["branches"] = {
+        branches_data: dict[str, Any] = {
             "current": branches_summary["current"],
             "count": branches_summary["count"],
             "items": branches_summary["items"],
         }
+        if branches_summary.get("error"):
+            branches_data["error"] = branches_summary["error"]
+        response["branches"] = branches_data
 
         echo_json(response)
 
@@ -216,7 +220,7 @@ def get_project_info(project_path: Optional[str] = None) -> Tuple[Iterable[Any],
     return table, columns
 
 
-def get_branches_summary(ctx_config: Dict[str, Any]) -> Dict[str, Any]:
+def get_branches_summary(ctx_config: Dict[str, Any], selected_branch: Optional[str] = None) -> Dict[str, Any]:
     columns = ["name", "current", "token", "ui"]
 
     try:
@@ -235,30 +239,39 @@ def get_branches_summary(ctx_config: Dict[str, Any]) -> Dict[str, Any]:
             current_workspace = client.workspace_info(version="v1")
 
         main_workspace_name = current_workspace.get("name", "No workspace")
+        main_workspace_id = current_workspace.get("id")
+        main_workspace_token = current_workspace.get("token")
         if current_workspace.get("is_branch"):
             main_workspace_id = current_workspace.get("main")
             main_workspace = next((ws for ws in workspaces if ws.get("id") == main_workspace_id), None)
             if main_workspace and main_workspace.get("name"):
                 main_workspace_name = main_workspace["name"]
+                main_workspace_token = main_workspace.get("token") or main_workspace_token
 
         branches = client.branches().get("environments", [])
+        if not branches and api_host and main_workspace_token:
+            fallback_client = TinyB(main_workspace_token, host=api_host)
+            branches = fallback_client.branches().get("environments", [])
 
-        current_branch = "main"
-        if current_workspace.get("is_branch"):
-            current_branch = current_workspace.get("name", "main")
+        if main_workspace_id:
+            scoped_branches = [branch for branch in branches if branch.get("main") == main_workspace_id]
+            if scoped_branches:
+                branches = scoped_branches
 
-        items = []
+        all_items = []
         for branch in branches:
             branch_name = branch.get("name") or "No branch name"
             branch_token = branch.get("token") or "No token found"
-            branch_current = current_workspace.get("id") == branch.get("id")
+            branch_current = (
+                branch_name == selected_branch if selected_branch else current_workspace.get("id") == branch.get("id")
+            )
             branch_ui = (
                 f"{ui_host}/{main_workspace_name}~{branch_name}"
                 if ui_host and main_workspace_name and branch_name != "No branch name"
                 else "No UI URL found"
             )
 
-            items.append(
+            all_items.append(
                 {
                     "name": branch_name,
                     "current": branch_current,
@@ -267,16 +280,27 @@ def get_branches_summary(ctx_config: Dict[str, Any]) -> Dict[str, Any]:
                 }
             )
 
+        items = all_items
+        error: Optional[str] = None
+        if selected_branch:
+            items = [branch for branch in all_items if branch["name"] == selected_branch]
+            if not items:
+                error = f"Branch '{selected_branch}' not found."
+
+        current_branch = selected_branch or "main"
+        if not selected_branch and current_workspace.get("is_branch"):
+            current_branch = current_workspace.get("name", "main")
+
         items.sort(key=lambda branch: (not branch["current"], branch["name"]))
         table = [(branch["name"], branch["current"], branch["token"], branch["ui"]) for branch in items]
 
         return {
             "current": current_branch,
-            "count": len(items),
+            "count": len(all_items),
             "items": items,
             "table": table,
             "columns": columns,
-            "error": None,
+            "error": error,
         }
     except Exception:
         return {

tinybird/tb/modules/preview.py

@@ -6,6 +6,7 @@ from click.core import ParameterSource
 from tinybird.tb.client import TinyB
 from tinybird.tb.modules.cli import (
     cli,
+    ensure_valid_workspace_name,
     get_current_git_branch,
     sanitize_branch_name,
 )
@@ -16,7 +17,7 @@ from tinybird.tb.modules.project import Project
 
 
 def generate_preview_branch_name(git_branch: Optional[str]) -> str:
-    branch_part = sanitize_branch_name(git_branch or "")
+    branch_part = sanitize_branch_name(git_branch or "", enforce_workspace_prefix_rules=False)
     return f"tmp_ci_{branch_part or 'unknown'}"
 
 
@@ -113,7 +114,7 @@ def preview(ctx: click.Context, dry_run: bool, check: bool, name: Optional[str])
     output: str = obj.get("output", "human")
 
     git_branch = get_current_git_branch()
-    preview_name = name or generate_preview_branch_name(git_branch)
+    preview_name = ensure_valid_workspace_name(name) if name else generate_preview_branch_name(git_branch)
 
     if dry_run:
         click.echo(FeedbackManager.info(message=f"[dry-run] Preview target '{preview_name}' (cloud)"))

{tinybird-4.5.11.dev0.dist-info → tinybird-4.5.12.dev0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: tinybird
-Version: 4.5.11.dev0
+Version: 4.5.12.dev0
 Summary: Tinybird Command Line Tool
 Home-page: https://www.tinybird.co/docs/forward/commands
 Author: Tinybird
@@ -52,10 +52,22 @@ The Tinybird command-line tool allows you to use all the Tinybird functionality
 Changelog
 ----------
 
-4.5.10
+4.5.12
 *******
 
+- `Fixed` `tb info` now lists branches and marks the current branch correctly when running on a branch.
+
+
+4.5.11
+*******
+
+- `Added` `tb connection create kafka` now supports SASL ``OAUTHBEARER`` for Amazon MSK clusters with IAM-based authentication. The wizard asks up-front whether the user already has an IAM role for the cluster — if yes, it collects region + role ARN + external ID directly; if no, it walks the user through creating the IAM access policy and trust policy in the AWS Console, copying them to the clipboard.
+- `Added` ``--oauthbearer-aws-external-id`` flag (and matching interactive prompt) so users can supply a pre-shared external ID instead of the one Tinybird auto-generates for the connection.
+- `Added` ``PLAINTEXT`` security protocol now skips the SASL mechanism prompt entirely.
+- `Added` ``.connection`` files generated by the wizard now emit ``KAFKA_SASL_OAUTHBEARER_METHOD``, ``KAFKA_SASL_OAUTHBEARER_AWS_REGION``, ``KAFKA_SASL_OAUTHBEARER_AWS_ROLE_ARN``, and ``KAFKA_SASL_OAUTHBEARER_AWS_EXTERNAL_ID``, with the role ARN stored as a ``tb_secret``.
+- `Fixed` ``tb connection create kafka`` now accepts comma-separated bootstrap-server lists (e.g. ``b-1.kafka:9092,b-2.kafka:9092``) instead of rejecting them as malformed. Validation passes as soon as any one broker is reachable, matching Kafka bootstrap semantics.
 - `Fixed` `tb init` now persists `folder` in `tinybird.config.json`, so subsequent resource creation targets the configured project folder instead of the repository root.
+- `Fixed` Branch names derived from Git refs are now sanitized in `tb preview --name` and `tb branch create/rm/clear`, preventing CI/CD failures with invalid workspace names.
 
 4.5.9
 *******

{tinybird-4.5.11.dev0.dist-info → tinybird-4.5.12.dev0.dist-info}/RECORD

@@ -17,32 +17,32 @@ tinybird/datafile/exceptions.py,sha256=8rw2umdZjtby85QbuRKFO5ETz_eRHwUY5l7eHsy1w
 tinybird/datafile/parse_connection.py,sha256=GxmGp_XnWbDZPDbh_PBxitlIMqZRYfDwxMBw-JQBp1g,1890
 tinybird/datafile/parse_datasource.py,sha256=yd58HrUF4yNJXLn6OsvKGpZJpvrcjLGAeJG1lgBe_zk,1891
 tinybird/datafile/parse_pipe.py,sha256=-9bbgVuiWRyDYydrLVflDBt8GstZotMy6dklsrc6MUY,3859
-tinybird/tb/__cli__.py,sha256=HxxzL877RFiQy3_jlzD0hoa-Yu7k_2Pm-CXcwOrtIV8,246
+tinybird/tb/__cli__.py,sha256=2w-3VoyDce1czZ4H8qw7uO_Z7c589_0ZwLs7nXauCjA,246
 tinybird/tb/check_pypi.py,sha256=Gp0HkHHDFMSDL6nxKlOY51z7z1Uv-2LRexNTZSHHGmM,552
 tinybird/tb/cli.py,sha256=IjiGfNIpxSxi1odK1kMj9s8lEhx3sAUgGA263XdmyR0,1119
-tinybird/tb/client.py,sha256=RM8VQwPZFonfvejuTf3oT09XbJmq7pD5VLzFt4zoBGM,53910
+tinybird/tb/client.py,sha256=reEc7efMfEgv4aZFizIZ2iGsOeTo8D2CKeOOBidI7fk,54883
 tinybird/tb/config.py,sha256=CGCfBbCMlmVcBHQ0IMGc2IE4O2-1tZEPyD564JZoTbw,5659
-tinybird/tb/modules/branch.py,sha256=lMxtkmtE1qWpKUO2B21-5S56-kfr03lrZnPTtds32Xw,9309
+tinybird/tb/modules/branch.py,sha256=QxcMPc_4xhw8WPz85YZ5L6SQZY-lZrF3CleujBEBJQU,9746
 tinybird/tb/modules/build.py,sha256=bGFoFppR_UbGUMDWFGDzfJ4nT3CGFwzCzl2o4OpwR2o,10420
 tinybird/tb/modules/build_common.py,sha256=dxNRfvLcgJ6AwU4hsNDPaQT8QwirVCJzw4VLZaBoImM,23867
 tinybird/tb/modules/cicd.py,sha256=IO4qqsoLRXcubALb7vx_QnRpg3zIIxfaVO9bGomlESY,8267
-tinybird/tb/modules/cli.py,sha256=w-vxzolnTEQZpHh2DRnbPtZPmgUmIMGiCdSAStAY12o,40748
-tinybird/tb/modules/common.py,sha256=7gUs_yUvqhNZpUStQicgunp2vXgfy4Gk2NAp5UWfRgE,91922
+tinybird/tb/modules/cli.py,sha256=n_B9EapB1eYOWOfRHN1Jefip6LcmYrkLDIz5GoGCJhA,41889
+tinybird/tb/modules/common.py,sha256=AoibuekIqBJ6IW3tlp4uzxb5Q3upqhjOlqjxXR-wFxc,93337
 tinybird/tb/modules/config.py,sha256=Z47lMZxFeX68b62bTzgj9379zn-9eT4cPbrcMJ_xTGQ,11431
-tinybird/tb/modules/connection.py,sha256=SzTguZEjH_wrfloeFTiXT4cBSQkVsKy2gz2OWYDsPQo,15352
-tinybird/tb/modules/connection_kafka.py,sha256=Ay9VqRUehjq_5bSFCNXfYrSo-wsa2FrVpISShmFxYRs,17172
+tinybird/tb/modules/connection.py,sha256=sPR9PAZNSZnbFqsBKos9Fmr8PsAGIuk57bjZU5mhUsA,16290
+tinybird/tb/modules/connection_kafka.py,sha256=Qc8uUNl5SvUcUGb_aG3AirYKw6673FoX1Sfdlzgz6Y8,33530
 tinybird/tb/modules/connection_s3.py,sha256=-Sj9d7xAJXbpr8JHioCqrO2hneJ1spoBE4QpYEfiyS8,16565
 tinybird/tb/modules/copy.py,sha256=Apzjxiyinp6KmgamypPKEe3BAnpxG7MwYcSYkHiG8sA,6033
-tinybird/tb/modules/create.py,sha256=raZVlGkEHOfyNzvqlQNQ_oCEUbN1xxxyKhwgCbocVRo,21204
+tinybird/tb/modules/create.py,sha256=KpqqVznYOU0OZfsxzZsMAWKoFULo0pJRiOSaACdtRoE,22506
 tinybird/tb/modules/datasource.py,sha256=52P3qz4Su9OCNOyXy5JnbkN3miMgxsfJ5AdJiJ9nFAI,64455
 tinybird/tb/modules/deployment.py,sha256=TNDlvaYmk-zouvaAdMXlyFPbgbnMKQOt76xpZBggJI0,21184
 tinybird/tb/modules/deployment_common.py,sha256=fLPWNNs8ZwSkWHJjLeqQUqTbKqnnhW1y8yKffBdDCo0,31948
 tinybird/tb/modules/deprecations.py,sha256=XXekrzPO9v12F1ToQDUGzLYJJ2wrEUlGKOkLCSdfHiM,4935
 tinybird/tb/modules/endpoint.py,sha256=yRTh6rQFJ98LA0hSC8rPD3EcDaJj41gk9oCsgcZPu_c,12112
 tinybird/tb/modules/exceptions.py,sha256=_1BHy0OixEkeF0fOCu1_1Pj8pJS4BNfUyucqCViJGTw,5958
-tinybird/tb/modules/feedback_manager.py,sha256=W7ePUzaLh37h1M-Bf_qACRcIbs2UiL8ZNjwUWYprSK8,77521
+tinybird/tb/modules/feedback_manager.py,sha256=_tlMzju93UaOX7rk_EBpl95IdTqIC53DMBYZuKFph0A,77673
 tinybird/tb/modules/fmt.py,sha256=ejQC1-2mK42saA2R9DA-CENYgu06SUoiCoX4bCtRXT8,3734
-tinybird/tb/modules/info.py,sha256=8k3GHJByr4afc5jrNKnuuXwKFHVADcS1fTLFu1Hlo_8,11706
+tinybird/tb/modules/info.py,sha256=oO2DpPT-hpQ2Gf_TBAJHQ_xIfc1WCBpiGWhiIeM_K4w,13042
 tinybird/tb/modules/infra.py,sha256=J9Noe9aZo5Y9ZKAhqh9jnv8azfivXLLHQ2a9TeMWN9s,32673
 tinybird/tb/modules/job.py,sha256=gjUceRkepgseQe1Q23G8B25R06r2UfdEIIXlIaqBA5E,3079
 tinybird/tb/modules/job_common.py,sha256=3rdRH9F9kCRL_dBa5fghB27xgHqnO3oulBeIb1AcSbE,687
@@ -58,7 +58,7 @@ tinybird/tb/modules/logs.py,sha256=uSQi_A6QIFOjAoj1h8XOI_51AQ3uk5UEg2TjYbZxDJA,2
 tinybird/tb/modules/materialization.py,sha256=SaomNeaAzLWtcnsZdetYBxEq0ihY1cRzh23n3Z1P_c4,5643
 tinybird/tb/modules/open.py,sha256=ddABA4guIrBhrCKXYpkH4cfiAcFOG2B1eVePk5BEXto,1799
 tinybird/tb/modules/pipe.py,sha256=xPKtezhnWZ6k_g82r4XpgKslofhuIxb_PvynH4gdUzI,2393
-tinybird/tb/modules/preview.py,sha256=8GVTHTmxWPqYjTs3-6mQ1ie8XCLrAQQ8aogDhCpnWMI,4549
+tinybird/tb/modules/preview.py,sha256=712lVUgFE2a1qCmBGVrU_JyiaRyo5-S0dypcBxmKlnM,4659
 tinybird/tb/modules/project.py,sha256=Js8f_VjzEI3cITaw5a_X2wgZ6kiO-VQq8LSx688ScDA,8697
 tinybird/tb/modules/project_commands.py,sha256=t7h5JJWNA5eGth_Nrj0fak5B9eyVPGeDluF-41OBkhw,1877
 tinybird/tb/modules/py_project.py,sha256=DE3N-GPhcvVulELMINZQmw0zG6xZ1YeVkyJt1vn2E4I,7799
@@ -76,7 +76,7 @@ tinybird/tb/modules/ts_project.py,sha256=XeDN-3gthT7GZYIFn0l-y5RJaofB_2T-I8gq6dL
 tinybird/tb/modules/watch.py,sha256=sXv-Un5d9S_p4P_I4aQe_StRJCXR_NloAxFFRPDs6Hw,8734
 tinybird/tb/modules/workspace.py,sha256=7shWyyZD9IT32EeP0aEgsZGk0U1ZdT6hWnVfctRoIJk,8939
 tinybird/tb/modules/workspace_members.py,sha256=8oQLTczEh9cIdD3iF-N3SJuqLtKdF-_g-YzeVaqKGP0,9486
-tinybird/tb/modules/datafile/build.py,sha256=YRmTfxzkXlmXYsJLsQxMoI2BtgBcE0jG3g9F2dZWQ0k,50105
+tinybird/tb/modules/datafile/build.py,sha256=Xd9umDi1BvJbirl0N_1rZ-DijvoU7DgZiURiE7DpA9o,52005
 tinybird/tb/modules/datafile/build_common.py,sha256=2yNdxe49IMA9wNvl25NemY2Iaz8L66snjOdT64dm1is,4511
 tinybird/tb/modules/datafile/build_datasource.py,sha256=keAx2lchYoxEDXQfTBtAe94Oyr4zfw3kWMumBFNtYso,16914
 tinybird/tb/modules/datafile/build_pipe.py,sha256=VYrQULliQ2fs4rLvRvwJwI0L45zrWa15CP_09CLP03Y,11225
@@ -97,8 +97,8 @@ tinybird/tb_cli_modules/config.py,sha256=0kFDmsDcjKon32rgFGMHHKSbv4j5dOrXtVOlyuA
 tinybird/tb_cli_modules/exceptions.py,sha256=pmucP4kTF4irIt7dXiG-FcnI-o3mvDusPmch1L8RCWk,3367
 tinybird/tb_cli_modules/regions.py,sha256=QjsL5H6Kg-qr0aYVLrvb1STeJ5Sx_sjvbOYO0LrEGMk,166
 tinybird/tb_cli_modules/telemetry.py,sha256=W098H6jmS4kpE7hN3tadaREBTf7oMocel-lkKWN0pU8,10466
-tinybird-4.5.11.dev0.dist-info/METADATA,sha256=qNQYezXXWrrqV49qB2PzbKw-pi9WJJBP4DcvFcNV_eQ,10963
-tinybird-4.5.11.dev0.dist-info/WHEEL,sha256=beeZ86-EfXScwlR_HKu4SllMC9wUEj_8Z_4FJ3egI2w,91
-tinybird-4.5.11.dev0.dist-info/entry_points.txt,sha256=LwdHU6TfKx4Qs7BqqtaczEZbImgU7Abe9Lp920zb_fo,43
-tinybird-4.5.11.dev0.dist-info/top_level.txt,sha256=ZIQJTPCzMqnfDzM_hEGZrJqDSEcKnIK_49T86DGWpyQ,78
-tinybird-4.5.11.dev0.dist-info/RECORD,,
+tinybird-4.5.12.dev0.dist-info/METADATA,sha256=XbnvMWb-DpNVAEBHXrnCp54kdLoqC17QPIM26bgyUX4,12487
+tinybird-4.5.12.dev0.dist-info/WHEEL,sha256=beeZ86-EfXScwlR_HKu4SllMC9wUEj_8Z_4FJ3egI2w,91
+tinybird-4.5.12.dev0.dist-info/entry_points.txt,sha256=LwdHU6TfKx4Qs7BqqtaczEZbImgU7Abe9Lp920zb_fo,43
+tinybird-4.5.12.dev0.dist-info/top_level.txt,sha256=ZIQJTPCzMqnfDzM_hEGZrJqDSEcKnIK_49T86DGWpyQ,78
+tinybird-4.5.12.dev0.dist-info/RECORD,,