@vibesdotdev/integrations-kafka 0.0.0-stage → 1.0.0-rc.4

package/AUDIT-CODE.md

@@ -0,0 +1,40 @@
+# Kafka provider audit
+
+This audit covers the canonical `integrations/kafka` owner and
+`@vibesdotdev/integrations-kafka` package.
+
+## Capability union
+
+- `src/connections.ts` owns KafkaJS connection purposes, producer/consumer/admin
+  access, custom consumers, request-queue protection, and disconnect handling.
+- `src/kafka-connector.impl.ts` owns the provider connector implementations.
+- `src/admin.ts`, `src/topics.ts`, `src/message-schemas.ts`, and `src/kafka.ts`
+  own admin operations, topic definitions, wire schemas, and environment
+  configuration.
+- `src/kafka-event-adapter.impl.ts` owns the runtime `events/adapter`
+  implementation; `src/kafka-event-adapter.descriptor.ts` declares its neutral
+  runtime contract.
+- `src/kafka.plugin.ts` registers the `kafka` substrate and event-adapter
+  descriptor/loaders under the bare plugin id `integrations-kafka`.
+
+## Canonical public entrypoints
+
+The package exports `.`, `./plugin`, `./substrate`, `./connector`,
+`./connections`, `./admin`, `./topics`, `./message-schemas`, `./schemas/kafka`,
+`./config`, `./event-adapter`, and `./event-adapter/descriptor`. There is no
+provider alias package or retired scoped plugin id.
+
+## Consumer boundary
+
+Chat bridges should replace the retired package specifier with
+`@vibesdotdev/integrations-kafka` while preserving the existing
+`./connections` and `./topics` subpaths. Runtime composition registers the
+`integrations-kafka` plugin after `events` and
+`integrations/base`; the plugin resolves the default `kafka` event
+adapter without a direct Chat-to-Kafka implementation fork.
+
+## Verification
+
+The focused provider suite covers schemas, configuration, connection guards,
+and runtime plugin composition. Build and typecheck must run from this package;
+packed external imports must resolve every documented subpath.

package/AUDIT-SEAL.md

@@ -0,0 +1,12 @@
+# Kafka provider seal receipt
+
+Package: `@vibesdotdev/integrations-kafka@0.1.0-rc.0`
+
+The provider owns Kafka transport behavior and registers the canonical bare
+runtime plugin id `integrations-kafka`. The runtime event-adapter descriptor and
+loader are provider-owned; generic event kinds remain Framework-owned.
+
+The package exposes the provider's documented subpaths, keeps `kafkajs` behind
+the provider boundary, and does not publish a compatibility package or legacy
+plugin identity. Final SHA, tree, artifact digest, and fresh-clone evidence are
+recorded in the Integrations migration receipt after the successor push.

package/LICENSE

@@ -0,0 +1,126 @@
+Business Source License 1.1
+
+Parameters
+
+Licensor:             VIBES DEV LLC
+Licensed Work:        @vibesdotdev/integrations-kafka
+                      The Licensed Work is (c) 2026 VIBES DEV LLC.
+Additional Use Grant: In this grant, "Vibes Platform" means the hosted services VIBES DEV LLC
+                      operates at vibes.dev and its subdomains.
+
+                      You may make production use of the Licensed Work, including commercial
+                      use, subject to the limits below. Permitted production use includes:
+                      building, operating and selling your own applications, agents and services
+                      on or with the Vibes Platform; self-hosting the Licensed Work for use inside
+                      your own organization; and providing consulting, integration or development
+                      services to clients who build on the Vibes Platform.
+
+                      The production use permitted above does not include use that:
+
+                      (a) offers third parties a hosted, managed or embedded service that
+                          substitutes for the Vibes Platform or a material part of it (including
+                          agent hosting; fleet, sandbox or container provisioning; package
+                          registry; source hosting and continuous integration; and managed AI,
+                          storage, secrets or messaging), where the Licensed Work provides a
+                          material part of that service's value and that service earns more than
+                          US$1,000,000 in gross revenue in any twelve-month period;
+                      (b) sells, rents, sublicenses or white-labels the Licensed Work, or access
+                          to Vibes Platform functionality, as a product in its own right;
+                      (c) removes, disables or works around entitlement checks, usage metering,
+                          quotas or plan limits, or reaches Vibes Platform features the user's
+                          account is not entitled to;
+                      (d) scrapes, bulk-exports or harvests data or content from the Vibes
+                          Platform or its users other than through documented interfaces and
+                          within their terms, or uses outputs or data obtained from the Vibes
+                          Platform to train or improve a product that competes with it;
+                      (e) violates applicable law, infringes anyone's rights, commits fraud or
+                          deception, conducts unlawful surveillance or harassment, distributes
+                          malware, or accesses systems without authorization; or
+                      (f) violates applicable antitrust or competition law.
+
+                      A written permission from the Licensor extends this grant.
+Change Date:          Four years from the date the Licensed Work is published.
+Change License:       MIT
+
+For information about alternative licensing arrangements for the Licensed Work,
+contact VIBES DEV LLC through https://vibes.dev.
+
+Notice
+
+The Business Source License (this document, or the "License") is not an Open
+Source license. However, the Licensed Work will eventually be made available
+under an Open Source License, as stated in this License.
+
+-----------------------------------------------------------------------------
+
+Business Source License 1.1
+
+License text copyright © 2017 MariaDB Corporation Ab, All Rights Reserved.
+"Business Source License" is a trademark of MariaDB Corporation Ab.
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, above, permitting limited
+production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this
+License, whichever comes first, the Licensor hereby grants you rights under
+the terms of the Change License, and the rights granted in the paragraph
+above terminate.
+
+If your use of the Licensed Work does not comply with the requirements
+currently in effect as described in this License, you must purchase a
+commercial license from the Licensor, its affiliated entities, or authorized
+resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works
+of the Licensed Work, are subject to this License. This License applies
+separately for each version of the Licensed Work and the Change Date may vary
+for each version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy
+of the Licensed Work. If you receive the Licensed Work in original or
+modified form from a third party, the terms and conditions set forth in this
+License apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically
+terminate your rights under this License for the current and all other
+versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of
+Licensor or its affiliates (provided that you may use a trademark or logo of
+Licensor as expressly required by this License).
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
+AN “AS IS” BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
+EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
+TITLE.
+
+MariaDB hereby grants you permission to use this License’s text to license
+your works, and to refer to it using the trademark “Business Source License”,
+as long as you comply with the Covenants of Licensor below.
+
+Covenants of Licensor
+
+In consideration of the right to use this License’s text and the “Business
+Source License” name and trademark, Licensor covenants to MariaDB, and to all
+other recipients of the licensed work to be provided by Licensor:
+
+1. To specify as the Change License the GPL Version 2.0 or any later version,
+   or a license that is compatible with GPL Version 2.0 or a later version,
+   where “compatible” means that software provided under the Change License can
+   be included in a program with software provided under GPL Version 2.0 or a
+   later version. Licensor may specify additional Change Licenses without
+   limitation.
+
+2. To either: (a) specify an additional grant of rights to use that does not
+   impose any additional restriction on the right granted in this License, as
+   the Additional Use Grant; or (b) insert the text “None”.
+
+3. To specify a Change Date.
+
+4. Not to modify this License in any other way.

package/README.md

@@ -1,3 +1,77 @@
-# Temporary Holding Version
+# @vibesdotdev/integrations-kafka
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Kafka eventing substrate for Vibes runtime consumers. Provides KafkaJS
+connections, provider clients, admin, topics, schemas, configuration, and the
+runtime event adapter.
+
+## Owns
+
+- **Connections** (`./connections`): Connection management and purpose-specific
+  Kafka clients.
+- **Provider clients** (`./connector`): Producer, consumer, and admin adapters.
+- **Admin** (`./admin`): Topic administration.
+- **Topics** (`./topics`): Topic catalog and retention configuration.
+- **Schemas** (`./message-schemas`, `./schemas/kafka`): Kafka wire and connection
+  schemas.
+- **Config** (`./config`): Runtime config-manifest reader.
+- **Event adapter** (`./event-adapter`): Runtime events adapter implementation.
+
+## Does not own
+
+- **Domain-specific event payloads** → owned by domain packages (e.g. chat,
+workers, tools) that consume these envelopes.
+- **Job execution** → worker and app owners. Kafka is transport only.
+- **Broker provisioning** → infrastructure packages.
+
+## Hard rules
+
+- `kafkajs` is internal to this package. Features publish through the typed
+helpers or via job submission — never by importing `kafkajs` directly.
+- Connections read the runtime's declared build qualifier at use. Build-scope acquisition refuses with `UNAVAILABLE / kafka-build-scope`; operational failures remain typed and observable.
+- Domain packages own domain event payload schemas; this package owns Kafka wire
+  and connection schemas.
+
+## Public entrypoints
+
+`.`, `./plugin`, `./node.plugin`, `./substrate`, `./connector`, `./connections`, `./admin`,
+`./topics`, `./message-schemas`, `./schemas/kafka`, `./config`, and
+`./event-adapter`, `./event-adapter/descriptor`, `./chat/realtime-transport`,
+`./workers`, `./workers/plugin`, `./workers/consumer.plugin`, and `./workers/provider-jobs-schema`.
+
+Compose `./plugin` with `./node.plugin` on Node Kafka hosts. The universal
+plugin registers contracts without loading KafkaJS. Resolve `getKafkaClient(runtime)`
+for the runtime-owned connection, admin and subscription lifecycle. Synchronous
+accessors require client activation. See [SPEC.md](SPEC.md) for typed refusals.
+
+Workers cloud hosts compose `./workers/plugin`; consumer hosts add
+`./workers/consumer.plugin` and the Workers plugin. Both use the same persistent
+host-injected `workers-kafka/db` context. Invalid or missing store capabilities
+refuse with `UNAVAILABLE / queue-store-context-unavailable`; no memory fallback
+is used. `cancelJob` validates and persists the complete Workers attribution
+and reason, then includes them with the admitted stamp in local and distributed
+events; `updateJob` is not a cancellation path and refuses `cancelled` with
+`INVALID_INPUT / cancel-provenance-required`. Historical rows remain absent;
+retry and fresh failed-row admission clear provenance. Application migrations
+must add nullable JSON `cancellation` to `provider_jobs` (`TEXT NULL` for
+SQLite/libSQL or `JSONB NULL` for PostgreSQL) without backfilling old rows. See
+[workers SPEC](src/workers/SPEC.md).
+
+`readKafkaBaseConfig` returns brokers and TLS only. Connector configuration and
+resolution results keep canonical credential references; the Node KafkaJS
+construction boundary resolves them with `runtime.resolveCredential` and passes
+the result only to KafkaJS. Authenticated clients are available through
+`getKafkaClient(runtime)` and the `kafka-producer`, `kafka-consumer` and
+`kafka-admin` provider `getConnector()` entrypoints.
+
+## Verification
+
+`bun run check`, `bun run test`, and `bun run build` from package root.
+Check includes all source and test suites without emitting files; build uses
+`tsconfig.build.json` to emit production source into `dist/`.
+
+## Links
+
+- [runtime/SPEC.md](../../../framework/runtime/SPEC.md)
+- [runtime-plugin/SPEC.md](../../../framework/runtime-plugin/SPEC.md)
+- [logging/SPEC.md](../../../framework/logging/SPEC.md)
+- [workers/SPEC.md](../../../framework/workers/SPEC.md)

package/SEALED.md

@@ -0,0 +1,13 @@
+# Kafka provider candidate
+
+Status: candidate, release-gated
+
+`@vibesdotdev/integrations-kafka@0.1.0-rc.0` owns Kafka connections, provider
+connector implementations, schemas, configuration, topic catalog, admin
+operations, and the runtime event adapter. Framework owns the generic events
+kinds and schemas. Consumers compose `integrations-kafka`; they do not import
+KafkaJS or maintain a duplicate transport.
+
+The release receipt must include package build/check/test, every documented
+export, packed external imports, exact private Forge main/tree, and the Chat
+manifest migration proof.

package/dist/admin.d.ts

@@ -0,0 +1,20 @@
+import type { VibesRuntime } from '@vibesdotdev/kernel';
+/** Topic operations share the semantic client's connection owner. */
+export declare class KafkaAdmin {
+    private readonly runtime;
+    constructor(runtime: VibesRuntime);
+    private getAdmin;
+    private run;
+    createTopics(): Promise<void>;
+    listTopics(): Promise<string[]>;
+    deleteTopics(topics: string[]): Promise<void>;
+    describeCluster(): Promise<{
+        topics: Array<import("kafkajs").ITopicMetadata>;
+    } | null>;
+    getTopicMetadata(topics?: string[]): Promise<{
+        topics: Array<import("kafkajs").ITopicMetadata>;
+    } | null>;
+    disconnect(): Promise<void>;
+}
+export declare function getKafkaAdmin(runtime: VibesRuntime): KafkaAdmin;
+//# sourceMappingURL=admin.d.ts.map

package/dist/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAOxD,qEAAqE;AACrE,qBAAa,UAAU;IACV,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,YAAY;IAElD,OAAO,CAAC,QAAQ;YAIF,GAAG;IAOX,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAa7B,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAK/B,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD,eAAe;;;IACf,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE;;;IAE5B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;CAGjC;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,YAAY,cAA+C"}

package/dist/admin.js

@@ -0,0 +1,51 @@
+import { CapabilityError, CaughtFailureSchema, valueFreeFailure } from '@vibesdotdev/kernel';
+import { requireKafkaClient } from "./client.js";
+import { getKafkaConnections, KafkaConnectionPurpose } from "./connections.js";
+import { topicConfigurationsSchema } from "./topics.js";
+/** Topic operations share the semantic client's connection owner. */
+export class KafkaAdmin {
+    runtime;
+    constructor(runtime) {
+        this.runtime = runtime;
+    }
+    getAdmin() {
+        return getKafkaConnections(this.runtime).getAdmin(KafkaConnectionPurpose.CHAT);
+    }
+    async run(operation) {
+        const admin = await this.getAdmin();
+        if (!admin)
+            return null; // Declared build scope intentionally has no broker resources.
+        try {
+            return await operation(admin);
+        }
+        catch (error) {
+            throw new CapabilityError('Kafka admin operation failed.', 'UNAVAILABLE', { reason: 'kafka-admin-operation-failed', details: { failure: valueFreeFailure(CaughtFailureSchema.parse(error)) } });
+        }
+    }
+    async createTopics() {
+        const configs = topicConfigurationsSchema.parse({});
+        await this.run(admin => admin.createTopics({
+            topics: Object.entries(configs).map(([topic, config]) => ({
+                topic, numPartitions: config.partitions, replicationFactor: config.replicationFactor,
+                configEntries: [
+                    { name: 'retention.ms', value: config.retentionMs.toString() },
+                    { name: 'segment.ms', value: config.segmentMs.toString() }
+                ]
+            }))
+        }));
+    }
+    async listTopics() {
+        const metadata = await this.run(admin => admin.fetchTopicMetadata());
+        return metadata ? metadata.topics.map(topic => topic.name) : [];
+    }
+    async deleteTopics(topics) {
+        await this.run(admin => admin.deleteTopics({ topics }));
+    }
+    describeCluster() { return this.run(admin => admin.fetchTopicMetadata()); }
+    getTopicMetadata(topics) { return this.run(admin => admin.fetchTopicMetadata({ topics: topics ?? [] })); }
+    async disconnect() {
+        await getKafkaConnections(this.runtime).disconnect(KafkaConnectionPurpose.CHAT);
+    }
+}
+export function getKafkaAdmin(runtime) { return requireKafkaClient(runtime).admin; }
+//# sourceMappingURL=admin.js.map

package/dist/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE7F,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAExD,qEAAqE;AACrE,MAAM,OAAO,UAAU;IACO;IAA7B,YAA6B,OAAqB;QAArB,YAAO,GAAP,OAAO,CAAc;IAAG,CAAC;IAE9C,QAAQ;QACf,OAAO,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC;IAEO,KAAK,CAAC,GAAG,CAAI,SAAuC;QAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,CAAC,8DAA8D;QACvF,IAAI,CAAC;YAAC,OAAO,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QACtC,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,IAAI,eAAe,CAAC,+BAA+B,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAAC,CAAC;IACnN,CAAC;IAED,KAAK,CAAC,YAAY;QACjB,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC;YAC1C,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;gBACzD,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,UAAU,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBACpF,aAAa,EAAE;oBACd,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE;oBAC9D,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE;iBAC1D;aACD,CAAC,CAAC;SACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU;QACf,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC;QACrE,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAgB;QAClC,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,eAAe,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3E,gBAAgB,CAAC,MAAiB,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAErH,KAAK,CAAC,UAAU;QACf,MAAM,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACjF,CAAC;CACD;AAED,MAAM,UAAU,aAAa,CAAC,OAAqB,IAAI,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC"}

package/dist/auth/sasl.node.impl.d.ts

@@ -0,0 +1,18 @@
+import { Kafka, type KafkaConfig } from 'kafkajs';
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import type { KafkaQueueTimerOwner } from '../request-queue-timeout-guard.ts';
+import type { KafkaVendorClient } from '../schemas/kafka.ts';
+import { type KafkaPublicConfig, type KafkaSasl } from '../schemas/contracts.ts';
+type KafkaConstructionConfig = KafkaPublicConfig & {
+    sasl?: KafkaSasl;
+    clientId?: string;
+};
+type KafkaConstructionOptions = Omit<Partial<KafkaConfig>, 'brokers' | 'ssl' | 'sasl'>;
+/**
+ * Resolve credential references and construct KafkaJS inside the Node boundary.
+ * The resolved password is neither passed to a callback nor retained in public
+ * configuration; only KafkaJS receives it in its constructor options.
+ */
+export declare function createAuthenticatedKafka(runtime: VibesRuntime, config: KafkaConstructionConfig, options?: KafkaConstructionOptions, owner?: KafkaQueueTimerOwner): Promise<Kafka & KafkaVendorClient>;
+export {};
+//# sourceMappingURL=sasl.node.impl.d.ts.map

package/dist/auth/sasl.node.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sasl.node.impl.d.ts","sourceRoot":"","sources":["../../src/auth/sasl.node.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAIxD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAA4C,KAAK,iBAAiB,EAAE,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAE3H,KAAK,uBAAuB,GAAG,iBAAiB,GAAG;IAClD,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,KAAK,wBAAwB,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,SAAS,GAAG,KAAK,GAAG,MAAM,CAAC,CAAC;AAEvF;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,uBAAuB,EAC/B,OAAO,GAAE,wBAA6B,EACtC,KAAK,GAAE,oBAGN,GACC,OAAO,CAAC,KAAK,GAAG,iBAAiB,CAAC,CAgDpC"}

package/dist/auth/sasl.node.impl.js

@@ -0,0 +1,62 @@
+import { Kafka } from 'kafkajs';
+import {} from '@vibesdotdev/kernel';
+import { getLogger } from '@vibesdotdev/logging';
+import { loadKafkaSettings } from "../config/kafka.config.descriptor.js";
+import { armKafkaClientQueues, createKafkaRequestQueueTimeoutGuard } from "../request-queue-timeout-guard.js";
+import { KafkaPublicConfigSchema, KafkaSaslSchema } from "../schemas/contracts.js";
+/**
+ * Resolve credential references and construct KafkaJS inside the Node boundary.
+ * The resolved password is neither passed to a callback nor retained in public
+ * configuration; only KafkaJS receives it in its constructor options.
+ */
+export async function createAuthenticatedKafka(runtime, config, options = {}, owner = {
+    signal: runtime.lifecycle.signal,
+    timeout: (callback, delayMs) => runtime.lifecycle.timeout(callback, delayMs)
+}) {
+    const publicConfig = KafkaPublicConfigSchema.parse({
+        brokers: config.brokers,
+        ssl: config.ssl
+    });
+    const settings = await loadKafkaSettings(runtime);
+    const saslReference = config.sasl ?? (settings.saslUsername ? {
+        mechanism: settings.saslMechanism,
+        username: settings.saslUsername,
+        password: { source: 'secret', key: 'KAFKA_SASL_PASSWORD' }
+    } : undefined);
+    let sasl;
+    if (saslReference) {
+        const parsedSasl = KafkaSaslSchema.parse(saslReference);
+        const credential = await runtime.resolveCredential(parsedSasl.password);
+        if (!credential.ok)
+            throw credential.error;
+        const credentials = { username: parsedSasl.username, password: credential.value };
+        switch (parsedSasl.mechanism) {
+            case 'plain':
+                sasl = { mechanism: 'plain', ...credentials };
+                break;
+            case 'scram-sha-256':
+                sasl = { mechanism: 'scram-sha-256', ...credentials };
+                break;
+            case 'scram-sha-512':
+                sasl = { mechanism: 'scram-sha-512', ...credentials };
+                break;
+        }
+    }
+    const vendorConfig = {
+        ...options,
+        brokers: publicConfig.brokers,
+        ssl: publicConfig.ssl,
+        clientId: config.clientId ?? options.clientId
+    };
+    if (sasl)
+        vendorConfig.sasl = sasl;
+    const ensureGuard = createKafkaRequestQueueTimeoutGuard({
+        building: () => runtime.scope.qualifiers?.building === true,
+        logger: getLogger('kafka', runtime).child('connections')
+    });
+    await ensureGuard();
+    const client = new Kafka(vendorConfig);
+    armKafkaClientQueues(owner, client);
+    return client;
+}
+//# sourceMappingURL=sasl.node.impl.js.map

package/dist/auth/sasl.node.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sasl.node.impl.js","sourceRoot":"","sources":["../../src/auth/sasl.node.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAoB,MAAM,SAAS,CAAC;AAClD,OAAO,EAAqB,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,mCAAmC,EAAE,MAAM,mCAAmC,CAAC;AAG9G,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAA0C,MAAM,yBAAyB,CAAC;AAS3H;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,OAAqB,EACrB,MAA+B,EAC/B,UAAoC,EAAE,EACtC,QAA8B;IAC7B,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM;IAChC,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5E;IAED,MAAM,YAAY,GAAG,uBAAuB,CAAC,KAAK,CAAC;QAClD,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,EAAE,MAAM,CAAC,GAAG;KACf,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QAC7D,SAAS,EAAE,QAAQ,CAAC,aAAa;QACjC,QAAQ,EAAE,QAAQ,CAAC,YAAY;QAC/B,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAiB,EAAE,GAAG,EAAE,qBAAqB,EAAE;KACnE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAEf,IAAI,IAAyB,CAAC;IAC9B,IAAI,aAAa,EAAE,CAAC;QACnB,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACxE,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,MAAM,UAAU,CAAC,KAAK,CAAC;QAC3C,MAAM,WAAW,GAAG,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;QAClF,QAAQ,UAAU,CAAC,SAAS,EAAE,CAAC;YAC9B,KAAK,OAAO;gBACX,IAAI,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,WAAW,EAAE,CAAC;gBAC9C,MAAM;YACP,KAAK,eAAe;gBACnB,IAAI,GAAG,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,WAAW,EAAE,CAAC;gBACtD,MAAM;YACP,KAAK,eAAe;gBACnB,IAAI,GAAG,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,WAAW,EAAE,CAAC;gBACtD,MAAM;QACR,CAAC;IACF,CAAC;IAED,MAAM,YAAY,GAAgB;QACjC,GAAG,OAAO;QACV,OAAO,EAAE,YAAY,CAAC,OAAO;QAC7B,GAAG,EAAE,YAAY,CAAC,GAAG;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ;KAC7C,CAAC;IACF,IAAI,IAAI;QAAE,YAAY,CAAC,IAAI,GAAG,IAAI,CAAC;IAEnC,MAAM,WAAW,GAAG,mCAAmC,CAAC;QACvD,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,KAAK,IAAI;QAC3D,MAAM,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;KACxD,CAAC,CAAC;IACH,MAAM,WAAW,EAAE,CAAC;IAEpB,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;IACvC,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC;AACf,CAAC"}

package/dist/chat/realtime-transport/host.d.ts

@@ -0,0 +1,14 @@
+import type { SseMessage } from '../../schemas/realtime.ts';
+/** Host capabilities supplied by the Chat/app realtime surface. */
+export interface SseBridgeHost {
+    broadcastToChannel(channel: string, data: SseMessage): void;
+}
+export interface WebSocketBridgeHost {
+    broadcast(channel: string, data: SseMessage): number | void;
+}
+export interface KafkaRealtimeHosts {
+    sse: SseBridgeHost;
+    websocket: WebSocketBridgeHost;
+}
+export declare const unavailableSseBridgeHost: SseBridgeHost;
+//# sourceMappingURL=host.d.ts.map

package/dist/chat/realtime-transport/host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../../src/chat/realtime-transport/host.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAE5D,mEAAmE;AACnE,MAAM,WAAW,aAAa;IAC7B,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;CAC5D;AACD,MAAM,WAAW,mBAAmB;IACnC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAAC;CAC5D;AACD,MAAM,WAAW,kBAAkB;IAClC,GAAG,EAAE,aAAa,CAAC;IACnB,SAAS,EAAE,mBAAmB,CAAC;CAC/B;AACD,eAAO,MAAM,wBAAwB,EAAE,aAItC,CAAC"}

package/dist/chat/realtime-transport/host.js

@@ -0,0 +1,7 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+export const unavailableSseBridgeHost = {
+    broadcastToChannel() {
+        throw new CapabilityError('Kafka SSE bridge host is not registered.', 'UNAVAILABLE', { reason: 'kafka-realtime-host-unavailable' });
+    }
+};
+//# sourceMappingURL=host.js.map

package/dist/chat/realtime-transport/host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.js","sourceRoot":"","sources":["../../../src/chat/realtime-transport/host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AActD,MAAM,CAAC,MAAM,wBAAwB,GAAkB;IACtD,kBAAkB;QACjB,MAAM,IAAI,eAAe,CAAC,0CAA0C,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC,CAAC;IACrI,CAAC;CACD,CAAC"}

package/dist/chat/realtime-transport/index.d.ts

@@ -0,0 +1,15 @@
+/** Provider-owned Chat realtime projections backed by Kafka. */
+import { SSEKafkaBridge } from './sse-kafka-bridge.ts';
+import { WSKafkaBridge } from './ws-kafka-bridge.ts';
+import type { VibesRuntime } from '@vibesdotdev/kernel';
+import type { KafkaRealtimeHosts } from './host.ts';
+export type { KafkaRealtimeHosts, SseBridgeHost, WebSocketBridgeHost } from './host.ts';
+export { SSEKafkaBridge, mapKafkaAgentEventType } from './sse-kafka-bridge.ts';
+export type { SseBridgeConnection, SseMessage } from './sse-kafka-bridge.ts';
+export { WSKafkaBridge } from './ws-kafka-bridge.ts';
+/** Compose both provider bridges with the app-owned realtime hosts. */
+export declare function createKafkaRealtimeBridges(runtime: VibesRuntime, hosts: KafkaRealtimeHosts): {
+    sse: SSEKafkaBridge;
+    websocket: WSKafkaBridge;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/chat/realtime-transport/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/chat/realtime-transport/index.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAEpD,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,YAAY,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,uEAAuE;AACvE,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,YAAY,EACrB,KAAK,EAAE,kBAAkB;;;EAM1B"}

package/dist/chat/realtime-transport/index.js

@@ -0,0 +1,13 @@
+/** Provider-owned Chat realtime projections backed by Kafka. */
+import { SSEKafkaBridge } from "./sse-kafka-bridge.js";
+import { WSKafkaBridge } from "./ws-kafka-bridge.js";
+export { SSEKafkaBridge, mapKafkaAgentEventType } from "./sse-kafka-bridge.js";
+export { WSKafkaBridge } from "./ws-kafka-bridge.js";
+/** Compose both provider bridges with the app-owned realtime hosts. */
+export function createKafkaRealtimeBridges(runtime, hosts) {
+    return {
+        sse: new SSEKafkaBridge(runtime, hosts.sse),
+        websocket: new WSKafkaBridge(runtime, hosts.websocket)
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/chat/realtime-transport/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/chat/realtime-transport/index.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAKrD,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE/E,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,uEAAuE;AACvE,MAAM,UAAU,0BAA0B,CACxC,OAAqB,EACrB,KAAyB;IAEzB,OAAO;QACL,GAAG,EAAE,IAAI,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC;QAC3C,SAAS,EAAE,IAAI,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC;KACvD,CAAC;AACJ,CAAC"}

package/dist/chat/realtime-transport/lifecycle.d.ts

@@ -0,0 +1,30 @@
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import { RealtimeProjection } from './projection.ts';
+export declare class BridgeLifecycle {
+    private readonly runtime;
+    private readonly projection;
+    private readonly surface;
+    private readonly closeConnections;
+    private readonly consumers;
+    private owner?;
+    private starting?;
+    private stopping?;
+    private registered;
+    private active;
+    private closed;
+    private readonly id;
+    constructor(runtime: VibesRuntime, projection: RealtimeProjection, surface: 'sse' | 'ws', closeConnections: () => void);
+    start(): Promise<void>;
+    private activate;
+    private acquire;
+    private release;
+    stop(): Promise<void>;
+    private deactivate;
+    isRunning(): boolean;
+    getStats(): {
+        active: boolean;
+        consumers: string[];
+        consumerCount: number;
+    };
+}
+//# sourceMappingURL=lifecycle.d.ts.map

package/dist/chat/realtime-transport/lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../src/chat/realtime-transport/lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgD,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAOtG,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,qBAAa,eAAe;IAUf,OAAO,CAAC,QAAQ,CAAC,OAAO;IAAgB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAAsB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAAgB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAT9K,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAC9D,OAAO,CAAC,KAAK,CAAC,CAAc;IAC5B,OAAO,CAAC,QAAQ,CAAC,CAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,CAAgB;IACjC,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,QAAQ,CAAC,EAAE,CAA2C;gBAEjC,OAAO,EAAE,YAAY,EAAmB,UAAU,EAAE,kBAAkB,EAAmB,OAAO,EAAE,KAAK,GAAG,IAAI,EAAmB,gBAAgB,EAAE,MAAM,IAAI;IAE1L,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAOR,QAAQ;YAaR,OAAO;YA2CP,OAAO;IAUrB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAIP,UAAU;IAWxB,SAAS;IACT,QAAQ;;;;;CACR"}