@eventferry/kafka 3.0.0 → 3.1.0

package/dist/index.d.cts

@@ -20,17 +20,108 @@ interface KafkaDriver {
      */
     readonly transactional: boolean;
 }
+/**
+ * TLS configuration for client connections. Pass a full {@link TlsConfig}
+ * when the cluster requires CA pinning, mutual TLS (client cert + key), or a
+ * specific SNI host. Plain `ssl: true` keeps the previous behavior (one-way
+ * TLS using the driver's default trust store).
+ *
+ * `rejectUnauthorized` is intentionally NOT a knob here — TLS verification is
+ * non-negotiable. Dev clusters with self-signed certs pass their CA via `ca`.
+ */
+interface TlsConfig {
+    /** PEM-encoded CA bundle. Buffers and strings both accepted. */
+    ca?: string | Buffer | Array<string | Buffer>;
+    /** PEM-encoded client certificate (required for mTLS). */
+    cert?: string | Buffer;
+    /** PEM-encoded private key for the client certificate (required for mTLS). */
+    key?: string | Buffer;
+    /** Passphrase for an encrypted private key. */
+    passphrase?: string;
+    /** SNI host. Useful when broker address doesn't match the cert SAN. */
+    servername?: string;
+}
+/**
+ * Username + password SASL: PLAIN and SCRAM-SHA-256/512. The conventional
+ * "API key + secret" shape used by Confluent Cloud, Aiven, on-prem SCRAM.
+ */
+interface SaslPasswordConfig {
+    mechanism: "plain" | "scram-sha-256" | "scram-sha-512";
+    username: string;
+    password: string;
+}
+/**
+ * Token returned by an OAUTHBEARER provider.
+ *
+ * Driver asymmetry (verified against `kafkajs/types/index.d.ts` and
+ * `@confluentinc/kafka-javascript/types/kafkajs.d.ts`):
+ *
+ * - `kafkajs` reads only `value`. Other fields are silently ignored.
+ * - `@confluentinc/kafka-javascript` REQUIRES `value` + `principal` + `lifetime`
+ *   and accepts an optional `extensions` map. Passing only `{ value }` throws.
+ *
+ * Cross-driver portable providers MUST populate all four. eventferry treats
+ * `principal` / `lifetime` / `extensions` as optional in the type to support
+ * kafkajs-only setups; supplying them is a no-op there.
+ */
+interface OauthBearerToken {
+    /** The bearer token string (JWT, opaque, …). */
+    value: string;
+    /** Principal name. REQUIRED on the confluent driver. */
+    principal?: string;
+    /** Lifetime in MILLISECONDS. REQUIRED on the confluent driver. */
+    lifetime?: number;
+    /** SASL extensions to send alongside the token (e.g. for OIDC scopes). */
+    extensions?: Record<string, string>;
+}
+/**
+ * SASL/OAUTHBEARER: bring-your-own token provider. The function is invoked
+ * by the underlying client on demand (NOT on a fixed timer); cache the
+ * token in your provider if you want to amortise issuance cost.
+ *
+ * Required for Azure Event Hubs, Confluent Cloud with OAuth/SSO, and any
+ * OIDC-fronted Kafka. For AWS MSK IAM, wrap the AWS SigV4 signer in this
+ * callback.
+ */
+interface SaslOauthbearerConfig {
+    mechanism: "oauthbearer";
+    oauthBearerProvider: () => Promise<OauthBearerToken>;
+}
+/**
+ * Discriminated union over the SASL mechanisms eventferry supports today.
+ * Add new mechanisms by extending this union and mapping them in each driver.
+ */
+type SaslConfig = SaslPasswordConfig | SaslOauthbearerConfig;
 /** Shared connection config accepted by both drivers. */
 interface KafkaConnectionConfig {
     brokers: string[];
     clientId?: string;
-    ssl?: boolean;
-    sasl?: {
-        mechanism: "plain" | "scram-sha-256" | "scram-sha-512";
-        username: string;
-        password: string;
-    };
+    /**
+     * TLS configuration. `true` enables one-way TLS using the driver's default
+     * trust store; a {@link TlsConfig} object lets you supply a custom CA,
+     * client cert (for mTLS), and SNI host.
+     */
+    ssl?: boolean | TlsConfig;
+    sasl?: SaslConfig;
 }
+/**
+ * Choice of partitioner. Only honored by the kafkajs driver — the confluent
+ * driver uses librdkafka's `consistent_random` (key-aware sticky) and
+ * partitioner override is out of scope for this release.
+ *
+ * - `"java-compatible"` (recommended for greenfield): kafkajs's
+ *   `Partitioners.JavaCompatiblePartitioner`. Matches the Java client's
+ *   murmur2-based hash so producers across language boundaries land on the
+ *   same partition for the same key.
+ * - `"legacy"`: kafkajs's pre-v2 partitioner. Use when migrating an existing
+ *   topic where hash continuity matters.
+ * - `"default"`: kafkajs's current default. Equivalent to legacy in v2 but
+ *   may change with major kafkajs releases.
+ *
+ * Setting this also silences the noisy `KafkaJSPartitionerNotSpecified`
+ * warning kafkajs emits when no partitioner choice is made explicitly.
+ */
+type KafkaJsPartitionerChoice = "default" | "legacy" | "java-compatible";
 interface ProducerBehaviorConfig {
     /** Enable idempotent producer (dedup + ordering). Default true. */
     idempotent?: boolean;
@@ -45,6 +136,46 @@ interface ProducerBehaviorConfig {
     acks?: number;
     /** Compression codec. Driver maps to its native enum. */
     compression?: "none" | "gzip" | "snappy" | "lz4" | "zstd";
+    /**
+     * (confluent only) How long the producer waits to accumulate records before
+     * flushing a partition batch. Default 0 (ship-immediately). Increase to
+     * 10–50ms for higher throughput at the cost of latency.
+     */
+    lingerMs?: number;
+    /** (confluent only) Maximum bytes per partition batch before forced flush. */
+    batchSize?: number;
+    /**
+     * Max concurrent unacknowledged producer requests. MUST be ≤5 when
+     * `idempotent: true`. Higher = throughput; lower = stricter ordering on
+     * non-idempotent producers (no other path preserves order on retry).
+     */
+    maxInFlightRequests?: number;
+    /** Per-request broker-ack timeout. Default 30 s. */
+    requestTimeoutMs?: number;
+    /**
+     * (confluent only) End-to-end timeout for a record from produce() call to
+     * terminal success / failure (includes retries). Defaults to 120 s.
+     * If this exceeds the relay's `claimTimeoutMs`, the reaper may double-
+     * publish a slow record — set both coherently.
+     */
+    deliveryTimeoutMs?: number;
+    /**
+     * (confluent only) Max bytes of a single record (after compression).
+     * MUST be ≤ broker's `message.max.bytes`. Defaults to 1 MB.
+     */
+    maxRequestSize?: number;
+    /**
+     * Broker-side ceiling on how long a transaction can stay open before
+     * auto-abort. Maps to `transaction.timeout.ms`. Default 60 s; capped by
+     * the broker's `transaction.max.timeout.ms`.
+     */
+    transactionTimeoutMs?: number;
+    /**
+     * (kafkajs only) Choice of partitioner. See
+     * {@link KafkaJsPartitionerChoice} for the options. Setting any value
+     * silences kafkajs's `KafkaJSPartitionerNotSpecified` warning.
+     */
+    partitioner?: KafkaJsPartitionerChoice;
 }
 type DriverKind = "kafkajs" | "confluent";
 
@@ -78,6 +209,8 @@ declare class KafkaJsDriver implements KafkaDriver {
     disconnect(): Promise<void>;
     sendBatch(messages: PublishableMessage[]): Promise<PublishResult[]>;
 }
+/** Internal — used by tests. Resets the dedup so warnings can be observed in isolation. */
+declare function _resetKafkajsWarnDedup(): void;
 
 /**
  * Classify a kafkajs producer error into a {@link PublishErrorKind} so the
@@ -144,6 +277,28 @@ declare class ConfluentDriver implements KafkaDriver {
  */
 declare function classifyConfluentError(err: unknown): PublishErrorKind;
 
+/**
+ * Translate eventferry's normalized `KafkaConnectionConfig` into the shape
+ * expected by `@confluentinc/kafka-javascript`'s `KafkaJS.Kafka` constructor.
+ *
+ * Returns an object with two parts:
+ *   - `kafkaJS`: the kafkajs-compatible config layer (clientId, brokers, and
+ *     simple ssl/sasl when no advanced TLS is needed).
+ *   - top-level keys: librdkafka-style config (e.g. `ssl.ca.pem`,
+ *     `security.protocol`) used when the user supplies a {@link TlsConfig}.
+ *
+ * Why a separate translator: the kafkajs-compat layer accepts the simple
+ * `ssl: true` boolean but the verified path for mTLS (CA + cert + key) is
+ * librdkafka's `ssl.*.pem` keys. The translator picks the right surface
+ * based on what the caller supplied. Buffer inputs are coerced to strings —
+ * librdkafka accepts PEM strings, NOT Buffers.
+ */
+interface ConfluentClientConfig {
+    kafkaJS: Record<string, unknown>;
+    librdkafka: Record<string, unknown>;
+}
+declare function buildConfluentClientConfig(opts: KafkaConnectionConfig & ProducerBehaviorConfig): ConfluentClientConfig;
+
 interface KafkaPublisherOptions extends KafkaConnectionConfig, ProducerBehaviorConfig {
     /** Which underlying client to use. Default "kafkajs". */
     driver?: DriverKind;
@@ -173,4 +328,4 @@ declare class KafkaPublisher implements Publisher {
     get transactional(): boolean;
 }
 
-export { ConfluentDriver, type ConfluentDriverOptions, type DriverKind, type KafkaConnectionConfig, type KafkaDriver, KafkaJsDriver, type KafkaJsDriverOptions, KafkaPublisher, type KafkaPublisherOptions, type ProducerBehaviorConfig, classifyConfluentError, classifyKafkajsError };
+export { type ConfluentClientConfig, ConfluentDriver, type ConfluentDriverOptions, type DriverKind, type KafkaConnectionConfig, type KafkaDriver, KafkaJsDriver, type KafkaJsDriverOptions, type KafkaJsPartitionerChoice, KafkaPublisher, type KafkaPublisherOptions, type OauthBearerToken, type ProducerBehaviorConfig, type SaslConfig, type SaslOauthbearerConfig, type SaslPasswordConfig, type TlsConfig, _resetKafkajsWarnDedup, buildConfluentClientConfig, classifyConfluentError, classifyKafkajsError };

package/dist/index.d.ts

@@ -20,17 +20,108 @@ interface KafkaDriver {
      */
     readonly transactional: boolean;
 }
+/**
+ * TLS configuration for client connections. Pass a full {@link TlsConfig}
+ * when the cluster requires CA pinning, mutual TLS (client cert + key), or a
+ * specific SNI host. Plain `ssl: true` keeps the previous behavior (one-way
+ * TLS using the driver's default trust store).
+ *
+ * `rejectUnauthorized` is intentionally NOT a knob here — TLS verification is
+ * non-negotiable. Dev clusters with self-signed certs pass their CA via `ca`.
+ */
+interface TlsConfig {
+    /** PEM-encoded CA bundle. Buffers and strings both accepted. */
+    ca?: string | Buffer | Array<string | Buffer>;
+    /** PEM-encoded client certificate (required for mTLS). */
+    cert?: string | Buffer;
+    /** PEM-encoded private key for the client certificate (required for mTLS). */
+    key?: string | Buffer;
+    /** Passphrase for an encrypted private key. */
+    passphrase?: string;
+    /** SNI host. Useful when broker address doesn't match the cert SAN. */
+    servername?: string;
+}
+/**
+ * Username + password SASL: PLAIN and SCRAM-SHA-256/512. The conventional
+ * "API key + secret" shape used by Confluent Cloud, Aiven, on-prem SCRAM.
+ */
+interface SaslPasswordConfig {
+    mechanism: "plain" | "scram-sha-256" | "scram-sha-512";
+    username: string;
+    password: string;
+}
+/**
+ * Token returned by an OAUTHBEARER provider.
+ *
+ * Driver asymmetry (verified against `kafkajs/types/index.d.ts` and
+ * `@confluentinc/kafka-javascript/types/kafkajs.d.ts`):
+ *
+ * - `kafkajs` reads only `value`. Other fields are silently ignored.
+ * - `@confluentinc/kafka-javascript` REQUIRES `value` + `principal` + `lifetime`
+ *   and accepts an optional `extensions` map. Passing only `{ value }` throws.
+ *
+ * Cross-driver portable providers MUST populate all four. eventferry treats
+ * `principal` / `lifetime` / `extensions` as optional in the type to support
+ * kafkajs-only setups; supplying them is a no-op there.
+ */
+interface OauthBearerToken {
+    /** The bearer token string (JWT, opaque, …). */
+    value: string;
+    /** Principal name. REQUIRED on the confluent driver. */
+    principal?: string;
+    /** Lifetime in MILLISECONDS. REQUIRED on the confluent driver. */
+    lifetime?: number;
+    /** SASL extensions to send alongside the token (e.g. for OIDC scopes). */
+    extensions?: Record<string, string>;
+}
+/**
+ * SASL/OAUTHBEARER: bring-your-own token provider. The function is invoked
+ * by the underlying client on demand (NOT on a fixed timer); cache the
+ * token in your provider if you want to amortise issuance cost.
+ *
+ * Required for Azure Event Hubs, Confluent Cloud with OAuth/SSO, and any
+ * OIDC-fronted Kafka. For AWS MSK IAM, wrap the AWS SigV4 signer in this
+ * callback.
+ */
+interface SaslOauthbearerConfig {
+    mechanism: "oauthbearer";
+    oauthBearerProvider: () => Promise<OauthBearerToken>;
+}
+/**
+ * Discriminated union over the SASL mechanisms eventferry supports today.
+ * Add new mechanisms by extending this union and mapping them in each driver.
+ */
+type SaslConfig = SaslPasswordConfig | SaslOauthbearerConfig;
 /** Shared connection config accepted by both drivers. */
 interface KafkaConnectionConfig {
     brokers: string[];
     clientId?: string;
-    ssl?: boolean;
-    sasl?: {
-        mechanism: "plain" | "scram-sha-256" | "scram-sha-512";
-        username: string;
-        password: string;
-    };
+    /**
+     * TLS configuration. `true` enables one-way TLS using the driver's default
+     * trust store; a {@link TlsConfig} object lets you supply a custom CA,
+     * client cert (for mTLS), and SNI host.
+     */
+    ssl?: boolean | TlsConfig;
+    sasl?: SaslConfig;
 }
+/**
+ * Choice of partitioner. Only honored by the kafkajs driver — the confluent
+ * driver uses librdkafka's `consistent_random` (key-aware sticky) and
+ * partitioner override is out of scope for this release.
+ *
+ * - `"java-compatible"` (recommended for greenfield): kafkajs's
+ *   `Partitioners.JavaCompatiblePartitioner`. Matches the Java client's
+ *   murmur2-based hash so producers across language boundaries land on the
+ *   same partition for the same key.
+ * - `"legacy"`: kafkajs's pre-v2 partitioner. Use when migrating an existing
+ *   topic where hash continuity matters.
+ * - `"default"`: kafkajs's current default. Equivalent to legacy in v2 but
+ *   may change with major kafkajs releases.
+ *
+ * Setting this also silences the noisy `KafkaJSPartitionerNotSpecified`
+ * warning kafkajs emits when no partitioner choice is made explicitly.
+ */
+type KafkaJsPartitionerChoice = "default" | "legacy" | "java-compatible";
 interface ProducerBehaviorConfig {
     /** Enable idempotent producer (dedup + ordering). Default true. */
     idempotent?: boolean;
@@ -45,6 +136,46 @@ interface ProducerBehaviorConfig {
     acks?: number;
     /** Compression codec. Driver maps to its native enum. */
     compression?: "none" | "gzip" | "snappy" | "lz4" | "zstd";
+    /**
+     * (confluent only) How long the producer waits to accumulate records before
+     * flushing a partition batch. Default 0 (ship-immediately). Increase to
+     * 10–50ms for higher throughput at the cost of latency.
+     */
+    lingerMs?: number;
+    /** (confluent only) Maximum bytes per partition batch before forced flush. */
+    batchSize?: number;
+    /**
+     * Max concurrent unacknowledged producer requests. MUST be ≤5 when
+     * `idempotent: true`. Higher = throughput; lower = stricter ordering on
+     * non-idempotent producers (no other path preserves order on retry).
+     */
+    maxInFlightRequests?: number;
+    /** Per-request broker-ack timeout. Default 30 s. */
+    requestTimeoutMs?: number;
+    /**
+     * (confluent only) End-to-end timeout for a record from produce() call to
+     * terminal success / failure (includes retries). Defaults to 120 s.
+     * If this exceeds the relay's `claimTimeoutMs`, the reaper may double-
+     * publish a slow record — set both coherently.
+     */
+    deliveryTimeoutMs?: number;
+    /**
+     * (confluent only) Max bytes of a single record (after compression).
+     * MUST be ≤ broker's `message.max.bytes`. Defaults to 1 MB.
+     */
+    maxRequestSize?: number;
+    /**
+     * Broker-side ceiling on how long a transaction can stay open before
+     * auto-abort. Maps to `transaction.timeout.ms`. Default 60 s; capped by
+     * the broker's `transaction.max.timeout.ms`.
+     */
+    transactionTimeoutMs?: number;
+    /**
+     * (kafkajs only) Choice of partitioner. See
+     * {@link KafkaJsPartitionerChoice} for the options. Setting any value
+     * silences kafkajs's `KafkaJSPartitionerNotSpecified` warning.
+     */
+    partitioner?: KafkaJsPartitionerChoice;
 }
 type DriverKind = "kafkajs" | "confluent";
 
@@ -78,6 +209,8 @@ declare class KafkaJsDriver implements KafkaDriver {
     disconnect(): Promise<void>;
     sendBatch(messages: PublishableMessage[]): Promise<PublishResult[]>;
 }
+/** Internal — used by tests. Resets the dedup so warnings can be observed in isolation. */
+declare function _resetKafkajsWarnDedup(): void;
 
 /**
  * Classify a kafkajs producer error into a {@link PublishErrorKind} so the
@@ -144,6 +277,28 @@ declare class ConfluentDriver implements KafkaDriver {
  */
 declare function classifyConfluentError(err: unknown): PublishErrorKind;
 
+/**
+ * Translate eventferry's normalized `KafkaConnectionConfig` into the shape
+ * expected by `@confluentinc/kafka-javascript`'s `KafkaJS.Kafka` constructor.
+ *
+ * Returns an object with two parts:
+ *   - `kafkaJS`: the kafkajs-compatible config layer (clientId, brokers, and
+ *     simple ssl/sasl when no advanced TLS is needed).
+ *   - top-level keys: librdkafka-style config (e.g. `ssl.ca.pem`,
+ *     `security.protocol`) used when the user supplies a {@link TlsConfig}.
+ *
+ * Why a separate translator: the kafkajs-compat layer accepts the simple
+ * `ssl: true` boolean but the verified path for mTLS (CA + cert + key) is
+ * librdkafka's `ssl.*.pem` keys. The translator picks the right surface
+ * based on what the caller supplied. Buffer inputs are coerced to strings —
+ * librdkafka accepts PEM strings, NOT Buffers.
+ */
+interface ConfluentClientConfig {
+    kafkaJS: Record<string, unknown>;
+    librdkafka: Record<string, unknown>;
+}
+declare function buildConfluentClientConfig(opts: KafkaConnectionConfig & ProducerBehaviorConfig): ConfluentClientConfig;
+
 interface KafkaPublisherOptions extends KafkaConnectionConfig, ProducerBehaviorConfig {
     /** Which underlying client to use. Default "kafkajs". */
     driver?: DriverKind;
@@ -173,4 +328,4 @@ declare class KafkaPublisher implements Publisher {
     get transactional(): boolean;
 }
 
-export { ConfluentDriver, type ConfluentDriverOptions, type DriverKind, type KafkaConnectionConfig, type KafkaDriver, KafkaJsDriver, type KafkaJsDriverOptions, KafkaPublisher, type KafkaPublisherOptions, type ProducerBehaviorConfig, classifyConfluentError, classifyKafkajsError };
+export { type ConfluentClientConfig, ConfluentDriver, type ConfluentDriverOptions, type DriverKind, type KafkaConnectionConfig, type KafkaDriver, KafkaJsDriver, type KafkaJsDriverOptions, type KafkaJsPartitionerChoice, KafkaPublisher, type KafkaPublisherOptions, type OauthBearerToken, type ProducerBehaviorConfig, type SaslConfig, type SaslOauthbearerConfig, type SaslPasswordConfig, type TlsConfig, _resetKafkajsWarnDedup, buildConfluentClientConfig, classifyConfluentError, classifyKafkajsError };

package/dist/index.js

@@ -86,6 +86,12 @@ var CODE_TO_KIND = /* @__PURE__ */ new Map([
 ]);
 
 // src/kafkajs-driver.ts
+var UNSUPPORTED_BY_KAFKAJS = [
+  "lingerMs",
+  "batchSize",
+  "deliveryTimeoutMs",
+  "maxRequestSize"
+];
 var KafkaJsDriver = class {
   transactional;
   producer = null;
@@ -98,6 +104,7 @@ var KafkaJsDriver = class {
         "KafkaJsDriver: transactionalId is required when transactional=true"
       );
     }
+    warnUnsupportedKafkajsOptions(opts);
   }
   async connect() {
     this.producer = await this.createProducer();
@@ -112,13 +119,36 @@ var KafkaJsDriver = class {
     const kafka = new mod.Kafka({
       clientId: this.opts.clientId ?? "eventferry",
       brokers: this.opts.brokers,
+      // kafkajs accepts `ssl: tls.ConnectionOptions` directly — Buffer + PEM
+      // string both supported. Our TlsConfig is a structural subset of that
+      // (`rejectUnauthorized` intentionally omitted; the cluster CA goes via
+      // `ca`). No translation needed.
       ssl: this.opts.ssl,
+      // SASL: PLAIN / SCRAM-SHA-256 / SCRAM-SHA-512 / OAUTHBEARER. kafkajs's
+      // shape matches ours; for OAUTHBEARER kafkajs reads only `value` from
+      // the provider's returned token (other fields are ignored).
       sasl: this.opts.sasl
     });
+    const createPartitioner = resolveCreatePartitioner(
+      mod.Partitioners,
+      this.opts.partitioner,
+      this.transactional
+    );
     return kafka.producer({
       idempotent: this.opts.idempotent ?? true,
-      maxInFlightRequests: this.transactional ? 1 : void 0,
-      transactionalId: this.transactional ? this.opts.transactionalId : void 0
+      // Idempotent / transactional producers cap maxInFlight at 5. When the
+      // user picks transactional we force 1 to keep strict ordering across
+      // retries on classic (non-idempotent) clusters that haven't migrated
+      // to the broker-side fence.
+      maxInFlightRequests: this.transactional ? 1 : this.opts.maxInFlightRequests,
+      transactionalId: this.transactional ? this.opts.transactionalId : void 0,
+      // kafkajs accepts these directly when set; undefined falls through to
+      // the kafkajs default.
+      requestTimeout: this.opts.requestTimeoutMs,
+      transactionTimeout: this.opts.transactionTimeoutMs,
+      // Setting any partitioner choice silences kafkajs's
+      // KafkaJSPartitionerNotSpecified warning.
+      createPartitioner
     });
   }
   async disconnect() {
@@ -164,7 +194,12 @@ function groupByTopic(messages, compression) {
     arr.push({
       key: m.key,
       value: m.value,
-      headers: m.headers
+      headers: m.headers,
+      // Per-message partition override. When set, kafkajs routes the record
+      // to this exact partition; when undefined, the configured partitioner
+      // chooses. We keep the key here too because compacted topics need it
+      // even when partition is pinned.
+      ...m.partition !== void 0 ? { partition: m.partition } : {}
     });
     byTopic.set(m.topic, arr);
   }
@@ -174,6 +209,32 @@ function groupByTopic(messages, compression) {
     ...compression && compression !== "none" ? { compression } : {}
   }));
 }
+function resolveCreatePartitioner(partitioners, choice, transactional) {
+  if (!partitioners) return void 0;
+  const effective = choice ?? (transactional ? "default" : "java-compatible");
+  switch (effective) {
+    case "java-compatible":
+      return partitioners.JavaCompatiblePartitioner;
+    case "legacy":
+      return partitioners.LegacyPartitioner;
+    case "default":
+      return partitioners.DefaultPartitioner;
+  }
+}
+var warnedKafkajsKeys = /* @__PURE__ */ new Set();
+function warnUnsupportedKafkajsOptions(opts) {
+  for (const key of UNSUPPORTED_BY_KAFKAJS) {
+    if (opts[key] === void 0) continue;
+    if (warnedKafkajsKeys.has(key)) continue;
+    warnedKafkajsKeys.add(key);
+    console.warn(
+      `[@eventferry/kafka] '${key}' is not configurable on the kafkajs driver and was ignored. Switch to the confluent driver (driver: "confluent") for fine-grained tuning, or remove the option to silence this warning.`
+    );
+  }
+}
+function _resetKafkajsWarnDedup() {
+  warnedKafkajsKeys.clear();
+}
 async function importKafkaJs() {
   try {
     return await import("kafkajs");
@@ -282,6 +343,71 @@ var NAME_TO_KIND = /* @__PURE__ */ new Map([
   ["ERR_THROTTLING_QUOTA_EXCEEDED", "quota"]
 ]);
 
+// src/confluent-config.ts
+function buildConfluentClientConfig(opts) {
+  const kafkaJS = {
+    clientId: opts.clientId ?? "eventferry",
+    brokers: opts.brokers
+  };
+  const librdkafka = {};
+  if (opts.lingerMs !== void 0) librdkafka["linger.ms"] = opts.lingerMs;
+  if (opts.batchSize !== void 0) librdkafka["batch.size"] = opts.batchSize;
+  if (opts.maxInFlightRequests !== void 0) {
+    librdkafka["max.in.flight.requests.per.connection"] = opts.maxInFlightRequests;
+  }
+  if (opts.requestTimeoutMs !== void 0) {
+    librdkafka["request.timeout.ms"] = opts.requestTimeoutMs;
+  }
+  if (opts.deliveryTimeoutMs !== void 0) {
+    librdkafka["delivery.timeout.ms"] = opts.deliveryTimeoutMs;
+  }
+  if (opts.maxRequestSize !== void 0) {
+    librdkafka["message.max.bytes"] = opts.maxRequestSize;
+  }
+  if (opts.transactionTimeoutMs !== void 0) {
+    librdkafka["transaction.timeout.ms"] = opts.transactionTimeoutMs;
+  }
+  const tlsRequested = opts.ssl === true || isTlsConfig(opts.ssl);
+  const saslRequested = !!opts.sasl;
+  if (saslRequested && tlsRequested) {
+    librdkafka["security.protocol"] = "sasl_ssl";
+  } else if (tlsRequested) {
+    librdkafka["security.protocol"] = "ssl";
+  } else if (saslRequested) {
+    librdkafka["security.protocol"] = "sasl_plaintext";
+  }
+  if (isTlsConfig(opts.ssl)) {
+    const tls = opts.ssl;
+    if (tls.ca !== void 0) {
+      librdkafka["ssl.ca.pem"] = stringifyPem(tls.ca);
+    }
+    if (tls.cert !== void 0) {
+      librdkafka["ssl.certificate.pem"] = stringifyPem(tls.cert);
+    }
+    if (tls.key !== void 0) {
+      librdkafka["ssl.key.pem"] = stringifyPem(tls.key);
+    }
+    if (tls.passphrase !== void 0) {
+      librdkafka["ssl.key.password"] = tls.passphrase;
+    }
+  } else if (opts.ssl === true) {
+    kafkaJS["ssl"] = true;
+  }
+  if (opts.sasl) {
+    kafkaJS["sasl"] = opts.sasl;
+  }
+  return { kafkaJS, librdkafka };
+}
+function isTlsConfig(v) {
+  return typeof v === "object" && v !== null;
+}
+function stringifyPem(input) {
+  if (Array.isArray(input)) {
+    return input.map((x) => typeof x === "string" ? x : x.toString("utf8")).join("\n");
+  }
+  return typeof input === "string" ? input : input.toString("utf8");
+}
+
 // src/confluent-driver.ts
 var ConfluentDriver = class {
   transactional;
@@ -306,13 +432,10 @@ var ConfluentDriver = class {
    */
   async createProducer() {
     const mod = await importConfluent();
+    const { kafkaJS, librdkafka } = buildConfluentClientConfig(this.opts);
     const kafka = new mod.KafkaJS.Kafka({
-      kafkaJS: {
-        clientId: this.opts.clientId ?? "eventferry",
-        brokers: this.opts.brokers,
-        ssl: this.opts.ssl,
-        sasl: this.opts.sasl
-      }
+      kafkaJS,
+      ...librdkafka
     });
     return kafka.producer({
       kafkaJS: {
@@ -373,7 +496,14 @@ function groupByTopic2(messages) {
   const byTopic = /* @__PURE__ */ new Map();
   for (const m of messages) {
     const arr = byTopic.get(m.topic) ?? [];
-    arr.push({ key: m.key, value: m.value, headers: m.headers });
+    arr.push({
+      key: m.key,
+      value: m.value,
+      headers: m.headers,
+      // Per-message partition override. librdkafka honors an explicit
+      // partition value; undefined leaves the default partitioner in charge.
+      ...m.partition !== void 0 ? { partition: m.partition } : {}
+    });
     byTopic.set(m.topic, arr);
   }
   return [...byTopic.entries()].map(([topic, msgs]) => ({
@@ -445,6 +575,8 @@ export {
   ConfluentDriver,
   KafkaJsDriver,
   KafkaPublisher,
+  _resetKafkajsWarnDedup,
+  buildConfluentClientConfig,
   classifyConfluentError,
   classifyKafkajsError
 };