@platformatic/kafka 2.1.0 → 2.2.0

package/dist/clients/consumer/utils.js

@@ -1,3 +1,9 @@
 export function partitionKey(topic, partition) {
     return `${topic}:${partition}`;
 }
+export function nextFetchEpoch(epoch) {
+    if (epoch < 0) {
+        return 0;
+    }
+    return epoch >= 0x7fffffff ? 1 : epoch + 1;
+}

package/dist/clients/producer/producer.js

@@ -2,7 +2,7 @@ import { randomUUID } from 'crypto';
 import { createPromisifiedCallback, kCallbackPromise, runConcurrentCallbacks } from "../../apis/callbacks.js";
 import { FindCoordinatorKeyTypes, ProduceAcks } from "../../apis/enumerations.js";
 import { createDiagnosticContext, producerInitIdempotentChannel, producerSendsChannel, producerTransactionsChannel } from "../../diagnostic.js";
-import { GenericError, UserError } from "../../errors.js";
+import { findErrorBy, NetworkError, UserError } from "../../errors.js";
 import { runAsyncSeries } from "../../registries/abstract.js";
 import { kInstance, kTransaction, kTransactionAddOffsets, kTransactionAddPartitions, kTransactionCancel, kTransactionCommitOffset, kTransactionEnd, kTransactionFindCoordinator, kTransactionPrepare } from "../../symbols.js";
 import { emitExperimentalApiWarning, NumericMap } from "../../utils.js";
@@ -342,7 +342,7 @@ export class Producer extends Base {
         }
         const transactionalId = this.#transaction.id;
         this[kPerformDeduplicated]('findCoordinator', deduplicateCallback => {
-            this[kPerformWithRetry]('findCoordinator', retryCallback => {
+            this[kPerformWithRetry]('findCoordinator', (retryCallback, attempt) => {
                 this[kGetBootstrapConnection]((error, connection) => {
                     if (error) {
                         retryCallback(error);
@@ -353,9 +353,14 @@ export class Producer extends Base {
                             retryCallback(error);
                             return;
                         }
-                        api(connection, FindCoordinatorKeyTypes.TRANSACTION, [transactionalId], retryCallback);
+                        api(connection, FindCoordinatorKeyTypes.TRANSACTION, [transactionalId], (error, response) => {
+                            if (response && api.version < 4) {
+                                response.coordinators[0].key = transactionalId;
+                            }
+                            retryCallback(error, response);
+                        });
                     });
-                });
+                }, attempt);
             }, (error, response) => {
                 if (error) {
                     deduplicateCallback(error);
@@ -531,11 +536,8 @@ export class Producer extends Base {
     #initIdempotentProducer(options, callback) {
         const transactionalId = this.#transaction?.id;
         this[kPerformDeduplicated]('initProducerId', deduplicateCallback => {
-            this[kPerformWithRetry]('initProducerId', retryCallback => {
-                const connector = transactionalId
-                    ? this.#getCoordinatorConnection.bind(this)
-                    : this[kGetBootstrapConnection].bind(this);
-                connector((error, connection) => {
+            this[kPerformWithRetry]('initProducerId', (retryCallback, attempt) => {
+                const onConnection = (error, connection) => {
                     if (error) {
                         retryCallback(error);
                         return;
@@ -549,7 +551,16 @@ export class Producer extends Base {
                             retryCallback(this.#handleError(error), response);
                         });
                     });
-                });
+                };
+                // The transactional path fails over inside #getCoordinatorConnection (via
+                // #findCoordinator -> kGetBootstrapConnection). The idempotent path must thread
+                // `attempt` so kGetBootstrapConnection rotates past a reachable-but-hung broker.
+                if (transactionalId) {
+                    this.#getCoordinatorConnection(onConnection);
+                }
+                else {
+                    this[kGetBootstrapConnection](onConnection, attempt);
+                }
             }, (error, response) => {
                 if (error) {
                     this.#handleFencingError(error);
@@ -685,9 +696,16 @@ export class Producer extends Base {
             }
             // Track nodes so that we can get their ID for delayed write reporting
             const nodes = [];
+            const sequenceSnapshot = produceOptions.sequences ? new NumericMap() : undefined;
+            if (sequenceSnapshot) {
+                for (const [partitionKey, messagesCount] of messagesPerPartition) {
+                    sequenceSnapshot.set(partitionKey, this.#sequences.postIncrement(partitionKey, messagesCount, 0));
+                }
+                produceOptions = { ...produceOptions, sequences: sequenceSnapshot };
+            }
             runConcurrentCallbacks('Producing messages failed.', messagesByDestination, ([destination, destinationMessages], concurrentCallback) => {
                 nodes.push(destination);
-                this.#performSingleDestinationSend(topics, destinationMessages, this[kOptions].timeout, sendOptions.acks, sendOptions.autocreateTopics, sendOptions.repeatOnStaleMetadata, produceOptions, concurrentCallback);
+                this.#performSingleDestinationSend(topics, destinationMessages, this[kOptions].timeout, sendOptions.acks, sendOptions.autocreateTopics, sendOptions.repeatOnStaleMetadata, produceOptions, true, concurrentCallback);
             }, (error, apiResults) => {
                 this.#metricsProducedMessages?.inc(messages.length);
                 const results = {};
@@ -710,14 +728,16 @@ export class Producer extends Base {
                                     partition: partitionResponse.index,
                                     offset: partitionResponse.baseOffset
                                 });
-                                const partitionKey = `${name}:${partitionResponse.index}`;
-                                this.#sequences.postIncrement(partitionKey, messagesPerPartition.get(partitionKey), 0);
                             }
                         }
                         results.offsets = topics;
                     }
                 }
                 if (error) {
+                    if (sendOptions.idempotent && !this.#transaction) {
+                        this.#producerInfo = undefined;
+                        this.#sequences.clear();
+                    }
                     ;
                     error.produced = results;
                     callback(error);
@@ -728,53 +748,94 @@ export class Producer extends Base {
             });
         });
     }
-    #performSingleDestinationSend(topics, messages, timeout, acks, autocreateTopics, repeatOnStaleMetadata, produceOptions, callback) {
-        // Get the metadata with the topic/partitions informations
-        this[kMetadata]({ topics, autocreateTopics }, (error, metadata) => {
-            if (error) {
-                callback(error);
-                return;
-            }
-            const { topic, partition } = messages[0];
-            const leader = metadata.topics.get(topic).partitions[partition].leader;
-            this[kPerformWithRetry]('produce', retryCallback => {
+    #performSingleDestinationSend(topics, messages, timeout, acks, autocreateTopics, repeatOnStaleMetadata, produceOptions, recoverOnProducerStateLoss, callback) {
+        const { topic, partition } = messages[0];
+        let refreshMetadata = false;
+        this[kPerformWithRetry]('produce', retryCallback => {
+            this[kMetadata]({ topics, autocreateTopics, forceUpdate: refreshMetadata }, (error, metadata) => {
+                if (error) {
+                    refreshMetadata = NetworkError.isRetryable(error);
+                    retryCallback(error);
+                    return;
+                }
+                refreshMetadata = false;
+                const leader = metadata.topics.get(topic).partitions[partition].leader;
                 this[kGetConnection](metadata.brokers.get(leader), (error, connection) => {
                     if (error) {
+                        refreshMetadata = NetworkError.isRetryable(error);
                         retryCallback(error);
                         return;
                     }
                     this[kGetApi]('Produce', (error, api) => {
                         if (error) {
+                            refreshMetadata = NetworkError.isRetryable(error);
                             retryCallback(error);
                             return;
                         }
-                        api(connection, acks, timeout, messages, produceOptions, retryCallback);
+                        api(connection, acks, timeout, messages, produceOptions, (error, response) => {
+                            refreshMetadata = NetworkError.isRetryable(error);
+                            retryCallback(error, response);
+                        });
                     });
                 });
-            }, (error, results) => {
-                if (error) {
-                    // If the last error was due to stale metadata, we retry the operation with this set of messages
-                    // since the partition is already set, it should attempt on the new destination
-                    /* c8 ignore next 3 - Hard to test */
-                    const kafkaError = GenericError.isGenericError(error)
-                        ? error
-                        : null;
-                    const hasStaleMetadata = kafkaError?.findBy('hasStaleMetadata', true);
-                    if (hasStaleMetadata && repeatOnStaleMetadata) {
-                        this.clearMetadata();
-                        this.#performSingleDestinationSend(topics, messages, timeout, acks, autocreateTopics, false, produceOptions, callback);
-                        return;
-                    }
-                    callback(error, results);
+            });
+        }, (error, results) => {
+            if (error) {
+                // If the last error was due to stale metadata, we retry the operation with this set of messages
+                // since the partition is already set, it should attempt on the new destination
+                /* c8 ignore next - Hard to test */
+                const hasStaleMetadata = findErrorBy(error, 'hasStaleMetadata', true);
+                if (hasStaleMetadata && repeatOnStaleMetadata) {
+                    this.clearMetadata();
+                    this.#performSingleDestinationSend(topics, messages, timeout, acks, autocreateTopics, false, produceOptions, recoverOnProducerStateLoss, callback);
                     return;
                 }
-                callback(error, results);
-            }, 0, [], error => {
-                /* c8 ignore next 3 - Hard to test */
-                if (!repeatOnStaleMetadata || !GenericError.isGenericError(error)) {
-                    return false;
+                if (recoverOnProducerStateLoss && !this.#transaction && this.#isProducerStateLost(error)) {
+                    this.#recoverIdempotentProducer(messages, produceOptions, (error, recoveredProduceOptions) => {
+                        if (error) {
+                            callback(error);
+                            return;
+                        }
+                        this.#performSingleDestinationSend(topics, messages, timeout, acks, autocreateTopics, repeatOnStaleMetadata, recoveredProduceOptions, false, callback);
+                    });
+                    return;
                 }
-                return !!error.findBy('hasStaleMetadata', true);
+                callback(error, results);
+                return;
+            }
+            callback(error, results);
+        }, 0, [], error => {
+            /* c8 ignore next 3 - Hard to test */
+            if (!repeatOnStaleMetadata) {
+                return false;
+            }
+            return !!findErrorBy(error, 'hasStaleMetadata', true);
+        });
+    }
+    #isProducerStateLost(error) {
+        return !!(findErrorBy(error, 'apiId', 'UNKNOWN_PRODUCER_ID') || findErrorBy(error, 'apiId', 'OUT_OF_ORDER_SEQUENCE_NUMBER'));
+    }
+    #recoverIdempotentProducer(messages, produceOptions, callback) {
+        this.#producerInfo = undefined;
+        this.#sequences.clear();
+        this.initIdempotentProducer({}, (error, producerInfo) => {
+            if (error) {
+                callback(error);
+                return;
+            }
+            const sequences = new NumericMap();
+            const messagesPerPartition = new NumericMap();
+            for (const { topic, partition } of messages) {
+                messagesPerPartition.postIncrement(`${topic}:${partition}`, 1, 0);
+            }
+            for (const [partitionKey, messagesCount] of messagesPerPartition) {
+                sequences.set(partitionKey, this.#sequences.postIncrement(partitionKey, messagesCount, 0));
+            }
+            callback(null, {
+                ...produceOptions,
+                producerId: producerInfo.producerId,
+                producerEpoch: producerInfo.producerEpoch,
+                sequences
             });
         });
     }
@@ -805,20 +866,17 @@ export class Producer extends Base {
         });
     }
     #handleFencingError(error) {
-        if (error.findBy?.('producerFenced', true)) {
+        if (findErrorBy(error, 'producerFenced', true)) {
             this.#producerInfo = undefined;
             this.#transaction = undefined;
         }
     }
     #handleError(error) {
-        const kafkaError = error;
-        if (kafkaError) {
-            if (kafkaError.findBy('code', 'PLT_KFK_NETWORK') ||
-                kafkaError.findBy('apiId', 'COORDINATOR_LOAD_IN_PROGRESS') ||
-                kafkaError.findBy('apiId', 'COORDINATOR_NOT_AVAILABLE') ||
-                kafkaError.findBy('apiId', 'NOT_COORDINATOR')) {
-                this.#coordinatorId = undefined;
-            }
+        if (findErrorBy(error, 'code', 'PLT_KFK_NETWORK') ||
+            findErrorBy(error, 'apiId', 'COORDINATOR_LOAD_IN_PROGRESS') ||
+            findErrorBy(error, 'apiId', 'COORDINATOR_NOT_AVAILABLE') ||
+            findErrorBy(error, 'apiId', 'NOT_COORDINATOR')) {
+            this.#coordinatorId = undefined;
         }
         return error;
     }

package/dist/clients/serde.d.ts

@@ -17,7 +17,7 @@ export interface Deserializers<Key, Value, HeaderKey, HeaderValue> {
     headerValue: Deserializer<HeaderValue>;
 }
 export type BeforeHookPayloadType = 'key' | 'value' | 'headerKey' | 'headerValue';
-export type BeforeDeserializationHook = (payload: Buffer, type: BeforeHookPayloadType, message: MessageToConsume, callback: Callback<void>) => void | Promise<void>;
+export type BeforeDeserializationHook = (payload: Buffer | null, type: BeforeHookPayloadType, message: MessageToConsume, callback: Callback<void>) => void | Promise<void>;
 export type BeforeSerializationHook<Key, Value, HeaderKey, HeaderValue> = (payload: unknown, type: BeforeHookPayloadType, message: MessageToProduce<Key, Value, HeaderKey, HeaderValue>, callback: Callback<void>) => void | Promise<void>;
 export declare function stringSerializer(data?: string): Buffer | undefined;
 export declare function stringDeserializer(data?: string | Buffer): string | undefined;

package/dist/errors.d.ts

@@ -14,6 +14,7 @@ export declare class GenericError extends Error {
     static isGenericError(error: Error): error is GenericError | MultipleErrors;
     constructor(code: ErrorCode, message: string, { cause, ...rest }?: ErrorProperties);
     findBy<ErrorType extends GenericError = GenericError>(property: string, value: unknown): ErrorType | null;
+    toString(): string;
 }
 export declare class MultipleErrors extends AggregateError {
     code: string;
@@ -25,7 +26,9 @@ export declare class MultipleErrors extends AggregateError {
     static isMultipleErrors(error: Error): error is MultipleErrors;
     constructor(message: string, errors: Error[], { cause, ...rest }?: ErrorProperties);
     findBy<ErrorType extends GenericError | MultipleErrors = MultipleErrors>(property: string, value: unknown): ErrorType | null;
+    toString(): string;
 }
+export declare function findErrorBy<ErrorType extends GenericError = GenericError>(error: Error | null | undefined, property: string, value: unknown): ErrorType | null;
 export * from './protocol/errors.ts';
 export declare class AuthenticationError extends GenericError {
     static code: ErrorCode;
@@ -33,6 +36,7 @@ export declare class AuthenticationError extends GenericError {
 }
 export declare class NetworkError extends GenericError {
     static code: ErrorCode;
+    static isRetryable(error: Error | null | undefined): boolean;
     constructor(message: string, properties?: ErrorProperties);
 }
 export declare class ProtocolError extends GenericError {

package/dist/errors.js

@@ -45,6 +45,9 @@ export class GenericError extends Error {
         }
         return null;
     }
+    toString() {
+        return `Error ${this.code}: ${this.message}`;
+    }
 }
 export class MultipleErrors extends AggregateError {
     code;
@@ -91,6 +94,21 @@ export class MultipleErrors extends AggregateError {
         }
         return null;
     }
+    toString() {
+        return `Error ${this.code}: ${this.message} (caused by: ${this.errors.map(error => error.toString()).join(', ')})`;
+    }
+}
+// findBy only exists on the library's own error classes, but errors also come from user code, Node
+// internals and third parties. This brand checks first, so classification is total: an error that
+// cannot be classified reports no match instead of throwing. Use it for any error whose origin is
+// not statically known.
+export function findErrorBy(error, property, value) {
+    if (!error || !GenericError.isGenericError(error)) {
+        return null;
+    }
+    // GenericError and MultipleErrors declare findBy with different generic defaults, so the union is
+    // not callable. The brand check above guarantees the call is safe either way.
+    return error.findBy(property, value);
 }
 export * from "./protocol/errors.js";
 export class AuthenticationError extends GenericError {
@@ -101,6 +119,10 @@ export class AuthenticationError extends GenericError {
 }
 export class NetworkError extends GenericError {
     static code = 'PLT_KFK_NETWORK';
+    static isRetryable(error) {
+        const networkError = findErrorBy(error, 'code', NetworkError.code);
+        return networkError?.canRetry === true;
+    }
     constructor(message, properties = {}) {
         super(NetworkError.code, message, { canRetry: true, ...properties });
     }

package/dist/network/connection-pool.js

@@ -1,6 +1,6 @@
 import { createPromisifiedCallback, kCallbackPromise, runConcurrentCallbacks } from "../apis/callbacks.js";
 import { connectionsPoolGetsChannel, createDiagnosticContext, notifyCreation } from "../diagnostic.js";
-import { MultipleErrors } from "../errors.js";
+import { MultipleErrors, NetworkError } from "../errors.js";
 import { TypedEventEmitter } from "../events.js";
 import { Connection, ConnectionStatuses } from "./connection.js";
 let currentInstance = 0;
@@ -92,7 +92,17 @@ export class ConnectionPool extends TypedEventEmitter {
     }
     #get(broker, callback) {
         if (this.#closed) {
-            callback(new Error('Connection pool is closed.'));
+            // A closed pool never reopens, so this must not be retried. It also has to be a library error:
+            // clients classify errors via findBy, which only exists on GenericError subclasses.
+            callback(new NetworkError('Connection pool is closed.', { canRetry: false, closed: true, broker }));
+            return;
+        }
+        if (broker == null || broker.host == null || broker.port == null) {
+            callback(new NetworkError('Cannot get a connection: the broker is not available in the current cluster metadata.', {
+                canRetry: true,
+                hasStaleMetadata: true,
+                broker
+            }));
             return;
         }
         const key = `${broker.host}:${broker.port}`;

package/dist/network/connection.js

@@ -4,7 +4,8 @@ import { createConnection } from 'node:net';
 import { connect as createTLSConnection } from 'node:tls';
 import { createPromisifiedCallback, kCallbackPromise } from "../apis/callbacks.js";
 import { allowedSASLMechanisms, SASLMechanisms } from "../apis/enumerations.js";
-import { saslAuthenticateV2, saslHandshakeV1 } from "../apis/index.js";
+import { clientSoftwareName, clientSoftwareVersion } from "../clients/base/options.js";
+import { apiVersionsV1, saslAuthenticateV0, saslAuthenticateV1, saslAuthenticateV2, saslHandshakeV1 } from "../apis/index.js";
 import { connectionsApiChannel, connectionsConnectsChannel, createDiagnosticContext, notifyCreation } from "../diagnostic.js";
 import { AuthenticationError, NetworkError, TimeoutError, UnexpectedCorrelationIdError, UserError } from "../errors.js";
 import { TypedEventEmitter } from "../events.js";
@@ -50,7 +51,10 @@ export class Connection extends TypedEventEmitter {
     #responseReader;
     #socket;
     #socketMustBeDrained;
+    #detectMissingTLS;
     #reauthenticationTimeout;
+    // Negotiated once per connection: reauthentication runs the same path again.
+    #saslAuthenticateApi;
     constructor(clientId, options = {}) {
         super();
         this.setMaxListeners(0);
@@ -75,6 +79,7 @@ export class Connection extends TypedEventEmitter {
         this.#responseBuffer = new DynamicBuffer();
         this.#responseReader = new Reader(this.#responseBuffer);
         this.#socketMustBeDrained = false;
+        this.#detectMissingTLS = !this.#options.tls;
         notifyCreation('connection', this);
     }
     /* c8 ignore next 3 - Simple getter */
@@ -120,6 +125,7 @@ export class Connection extends TypedEventEmitter {
                 return callback[kCallbackPromise];
             }
             this.#status = ConnectionStatuses.CONNECTING;
+            this.#detectMissingTLS = !this.#options.tls;
             const connectionOptions = {
                 timeout: this.#options.connectTimeout
             };
@@ -129,7 +135,7 @@ export class Connection extends TypedEventEmitter {
             }
             /* c8 ignore next 13 - Hard to test */
             const connectingSocketTimeoutHandler = () => {
-                const error = new TimeoutError(`Connection to ${host}:${port} timed out.`);
+                const error = new TimeoutError(`Connection to ${host}:${port} timed out.`, { canRetry: true });
                 diagnosticContext.error = error;
                 this.#socket.destroy();
                 this.#status = ConnectionStatuses.ERROR;
@@ -219,7 +225,7 @@ export class Connection extends TypedEventEmitter {
             this.#socket?.destroy();
             callback(new TimeoutError(this.#host
                 ? `Connection to ${this.#host}:${this.#port} timed out.`
-                : `Connection ready timed out after ${this.#options.connectTimeout}ms.`));
+                : `Connection ready timed out after ${this.#options.connectTimeout}ms.`, { canRetry: true }));
         }, this.#options.connectTimeout);
         this.once('connect', onConnect);
         this.once('error', onError);
@@ -258,7 +264,9 @@ export class Connection extends TypedEventEmitter {
         return callback[kCallbackPromise];
     }
     send(apiKey, apiVersion, createPayload, responseParser, hasRequestHeaderTaggedFields, hasResponseHeaderTaggedFields, callback) {
-        const correlationId = ++this.#correlationId;
+        // Correlation ID is a 32-bit integer in the protocol, so we need to wrap around after 2^31 - 1
+        const correlationId = (this.#correlationId + 1) & 0x7fffffff;
+        this.#correlationId = correlationId;
         const diagnostic = createDiagnosticContext({
             connection: this,
             operation: 'send',
@@ -335,28 +343,71 @@ export class Connection extends TypedEventEmitter {
             this.#onConnectionError(host, port, diagnosticContext, new UserError(`SASL mechanism ${mechanism} not supported.`));
             return;
         }
-        saslHandshakeV1.api(this, mechanism, (error, response) => {
+        this.#negotiateSaslAuthenticate(saslAuthenticate => {
+            saslHandshakeV1.api(this, mechanism, (error, response) => {
+                if (error) {
+                    this.#onConnectionError(host, port, diagnosticContext, new AuthenticationError('Cannot find a suitable SASL mechanism.', { cause: error }));
+                    return;
+                }
+                this.emit('sasl:handshake', response.mechanisms);
+                const callback = this.#onSaslAuthenticate.bind(this, host, port, diagnosticContext);
+                if (authenticate) {
+                    authenticate(mechanism, this, saslAuthenticate, username, password, token, callback);
+                }
+                else if (mechanism === SASLMechanisms.PLAIN) {
+                    saslPlain.authenticate(saslAuthenticate, this, username, password, callback);
+                }
+                else if (mechanism === SASLMechanisms.OAUTHBEARER) {
+                    saslOAuthBearer.authenticate(saslAuthenticate, this, token, oauthBearerExtensions, callback);
+                }
+                else if (mechanism === SASLMechanisms.GSSAPI) {
+                    callback(new UserError('No custom SASL/GSSAPI authenticator provided.'));
+                }
+                else {
+                    saslScramSha.authenticate(saslAuthenticate, this, mechanism.substring(6), username, password, defaultCrypto, callback);
+                }
+            });
+        });
+    }
+    /**
+     * Chooses the SaslAuthenticate version to authenticate with.
+     *
+     * The version cannot be assumed: v1 arrived in Apache Kafka 2.0 and v2 in 2.4, so pinning the
+     * newest makes authentication fail outright on older brokers, which answer an unparseable request
+     * with InvalidRequestException and drop the connection.
+     *
+     * Brokers accept ApiVersions before authentication precisely so that clients can ask, and it has
+     * to happen before SaslHandshake: once the handshake is sent the connection only accepts
+     * SaslAuthenticate. The result is cached because reauthentication runs this path again.
+     *
+     * SaslHandshake itself stays at v1. v0 signals the pre-1.0 flow, where the SASL tokens are written
+     * raw on the wire rather than wrapped in SaslAuthenticate requests, which this package does not
+     * implement.
+     */
+    #negotiateSaslAuthenticate(callback) {
+        if (this.#saslAuthenticateApi) {
+            callback(this.#saslAuthenticateApi);
+            return;
+        }
+        const candidates = [
+            [2, saslAuthenticateV2.api],
+            [1, saslAuthenticateV1.api],
+            [0, saslAuthenticateV0.api]
+        ];
+        apiVersionsV1.api(this, clientSoftwareName, clientSoftwareVersion, (error, response) => {
+            let selected;
+            /* c8 ignore next 3 - Only reachable against a broker which refuses ApiVersions before authentication */
             if (error) {
-                this.#onConnectionError(host, port, diagnosticContext, new AuthenticationError('Cannot find a suitable SASL mechanism.', { cause: error }));
-                return;
-            }
-            this.emit('sasl:handshake', response.mechanisms);
-            const callback = this.#onSaslAuthenticate.bind(this, host, port, diagnosticContext);
-            if (authenticate) {
-                authenticate(mechanism, this, saslAuthenticateV2.api, username, password, token, callback);
-            }
-            else if (mechanism === SASLMechanisms.PLAIN) {
-                saslPlain.authenticate(saslAuthenticateV2.api, this, username, password, callback);
-            }
-            else if (mechanism === SASLMechanisms.OAUTHBEARER) {
-                saslOAuthBearer.authenticate(saslAuthenticateV2.api, this, token, oauthBearerExtensions, callback);
-            }
-            else if (mechanism === SASLMechanisms.GSSAPI) {
-                callback(new UserError('No custom SASL/GSSAPI authenticator provided.'));
+                selected = undefined;
             }
             else {
-                saslScramSha.authenticate(saslAuthenticateV2.api, this, mechanism.substring(6), username, password, defaultCrypto, callback);
+                const advertised = response.apiKeys.find(api => api.apiKey === saslAuthenticateV2.api.key);
+                selected = candidates.find(([version]) => advertised && version >= advertised.minVersion && version <= advertised.maxVersion)?.[1];
             }
+            // Falling back to the newest version keeps the previous behaviour for brokers which do not
+            // answer the probe, rather than failing a connection which would otherwise have worked.
+            this.#saslAuthenticateApi = selected ?? saslAuthenticateV2.api;
+            callback(this.#saslAuthenticateApi);
         });
     }
     /*
@@ -465,6 +516,27 @@ export class Connection extends TypedEventEmitter {
         correlation_id => INT32
     */
     #onData(chunk) {
+        if (this.#detectMissingTLS) {
+            this.#detectMissingTLS = false;
+            if (this.#isTLSRecord(chunk)) {
+                const error = new UserError('Broker requires TLS.');
+                this.#status = ConnectionStatuses.ERROR;
+                for (const request of this.#afterDrainRequests) {
+                    if (!request.noResponse) {
+                        clearTimeout(request.timeoutHandle);
+                        request.callback(error, undefined);
+                    }
+                }
+                this.#afterDrainRequests = [];
+                for (const request of this.#inflightRequests.values()) {
+                    clearTimeout(request.timeoutHandle);
+                    request.callback(error, undefined);
+                }
+                this.#inflightRequests.clear();
+                this.#socket.destroy();
+                return;
+            }
+        }
         this.#responseBuffer.append(chunk);
         // There is at least one message size to add
         // Note that here the initial position is always 0
@@ -545,6 +617,12 @@ export class Connection extends TypedEventEmitter {
         this.#socketMustBeDrained = false;
         this.emit('drain');
     }
+    #isTLSRecord(chunk) {
+        return (chunk.length >= 3 &&
+            (chunk[0] === 0x14 || chunk[0] === 0x15 || chunk[0] === 0x16 || chunk[0] === 0x17) &&
+            chunk[1] === 0x03 &&
+            chunk[2] <= 0x04);
+    }
     #onClose() {
         this.#status = ConnectionStatuses.CLOSED;
         this.emit('close');

package/dist/network/utils.js

@@ -1,12 +1,30 @@
+const BRACKETED_BROKER_RE = /^\[([^\]]+)](?::(\d*))?$/;
 export function parseBroker(broker, defaultPort = 9092) {
-    if (typeof broker === 'string') {
-        if (broker.includes(':')) {
-            const [host, port] = broker.split(':');
-            return { host, port: Number(port) };
-        }
-        else {
-            return { host: broker, port: defaultPort };
+    if (typeof broker !== 'string') {
+        const host = stripBrackets(broker.host);
+        if (host === broker.host) {
+            return broker;
         }
+        return { ...broker, host };
+    }
+    const bracketed = BRACKETED_BROKER_RE.exec(broker);
+    if (bracketed) {
+        return { host: bracketed[1], port: parsePort(bracketed[2], defaultPort) };
+    }
+    const separator = broker.lastIndexOf(':');
+    // Bare IPv6 addresses contain multiple colons and no port. The host:port form
+    // is unambiguous only with a single colon, or with brackets around the host.
+    if (separator === -1 || broker.indexOf(':') !== separator) {
+        return { host: broker, port: defaultPort };
+    }
+    return { host: broker.slice(0, separator), port: parsePort(broker.slice(separator + 1), defaultPort) };
+}
+function parsePort(port, defaultPort) {
+    return port === undefined || port.length === 0 ? defaultPort : Number(port);
+}
+function stripBrackets(host) {
+    if (host.startsWith('[') && host.endsWith(']')) {
+        return host.slice(1, -1);
     }
-    return broker;
+    return host;
 }

package/dist/protocol/definitions.js

@@ -7,5 +7,5 @@ export const EMPTY_BUFFER = Buffer.alloc(0);
 export const EMPTY_UUID = Buffer.alloc(UUID_SIZE);
 // Since it is serialized at either 0 (for nullable) or 1 (since length is stored as length + 1), it always uses a single byte
 export const EMPTY_OR_SINGLE_COMPACT_LENGTH_SIZE = INT8_SIZE;
-// TODO: Tagged fields are not supported yet
+// Flexible-version messages use this zero-length tagged-field section.
 export const EMPTY_TAGGED_FIELDS_BUFFER = Buffer.from([0]);

package/dist/protocol/reader.js

@@ -187,9 +187,13 @@ export class Reader {
         return this.readNullableString(compact, encoding) || '';
     }
     readUUID() {
-        const value = this.peekUUID();
+        const hex = this.peekUUID();
         this.position += UUID_SIZE;
-        return value.replace(/(.{8})(.{4})(.{4})(.{4})(.{12})/, '$1-$2-$3-$4-$5');
+        // Hyphenated by slicing rather than by a capture group regex. This runs once per topic per
+        // Fetch response from v13 up, and the regex form measured about fourteen times the cost, which
+        // made the newest Fetch versions measurably slower to decode than the ones identifying topics
+        // by name.
+        return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
     }
     readNullableBytes(compact = true) {
         let length;
@@ -300,11 +304,12 @@ export class Reader {
         }
         return reader();
     }
-    // TODO: Tagged fields are not supported yet
+    // Skip unknown tagged fields because codecs do not expose them to callers.
     readTaggedFields() {
-        const length = this.readVarInt();
-        if (length > 0) {
-            this.skip(length);
+        const length = this.readUnsignedVarInt();
+        for (let i = 0; i < length; i++) {
+            this.readUnsignedVarInt();
+            this.skip(this.readUnsignedVarInt());
         }
     }
 }