youeduc-sdk-messaging 0.0.0 → 0.5.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 YouEduc
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,218 @@
+# youeduc-sdk-messaging
+
+SDK Node.js de mensageria assíncrona orientada a eventos sobre **Apache Kafka**, construída sobre
+`@confluentinc/kafka-javascript` (librdkafka). Publica eventos validados por JSON Schema e os consome com retry por
+tópicos, DLQ, deduplicação, commit manual de offsets e observabilidade (OpenTelemetry + logs estruturados com `pino`).
+
+- Pacote: `youeduc-sdk-messaging`; TypeScript (tipos incluídos), **ESM only**, Node >= 22, Kafka >= 3.x.
+- Existe uma SDK Python equivalente, publicada no PyPI com o mesmo nome, que segue o mesmo protocolo (tópicos,
+  headers, retry/DLQ e telemetria): um serviço Node publica e um serviço Python consome, e o contrário. As duas saem
+  sempre com a mesma versão.
+
+## Instalação
+
+Fixe sempre uma versão exata:
+
+```bash
+npm install --save-exact youeduc-sdk-messaging@X.Y.Z
+```
+
+Conferir a versão instalada:
+
+```bash
+node --input-type=module -e "import { version } from 'youeduc-sdk-messaging'; console.log(version)"
+```
+
+- **ESM only**: em TypeScript use `"module": "NodeNext"` (ou `"moduleResolution": "Bundler"`) para os `exports` do
+  pacote (inclusive o subpath `/redis`) resolverem. Projetos CommonJS (NestJS, por exemplo) podem usar
+  `require('youeduc-sdk-messaging')` a partir do **Node 22.12** (`require(esm)` sem flag), com `"module": "NodeNext"`
+  no `tsconfig.json`; no Node 22.0–22.11 use `await import('youeduc-sdk-messaging')`.
+- Dependências de runtime (fixadas): `@confluentinc/kafka-javascript`, `@opentelemetry/api`, `ajv`, `ajv-formats` e
+  `pino`. O `redis` é *peer dependency* opcional, só para o subpath `youeduc-sdk-messaging/redis`. SDK e exporters
+  do OpenTelemetry ficam a cargo da aplicação.
+
+### Módulo nativo (librdkafka)
+
+`@confluentinc/kafka-javascript` é um módulo nativo: no `npm install`/`npm ci`, o script de instalação dele baixa um
+binário pré-compilado (com o librdkafka embutido) para a versão do Node, o sistema, a libc e a arquitetura.
+
+- Não instale com `--ignore-scripts` (ou rode `npm rebuild @confluentinc/kafka-javascript` em seguida): sem o binário,
+  o erro só aparece em runtime, ao conectar.
+- O build precisa alcançar `github.com` (de onde vem o binário), além do registry npm.
+- Rode o `npm ci` com a **mesma imagem base** do runtime: `node_modules` instalado em glibc (Debian) não funciona em
+  musl (Alpine), e vice-versa. Recomendado: `node:22-bookworm-slim`; Alpine 3.20+ também tem binário.
+- Importar a SDK não carrega o librdkafka: ele só é carregado no primeiro uso do cliente Kafka (`start()`,
+  `ensureTopics`, `replayDlq`).
+
+## Publicar
+
+```ts
+import { FileSystemSchemaLoader, KafkaConfig, Messaging } from 'youeduc-sdk-messaging';
+
+const messaging = new Messaging(KafkaConfig.fromEnv(), {   // KAFKA_BOOTSTRAP_SERVERS etc.
+  service: 'enrollment-api',                               // kebab-case; vai no header `producer`
+  environment: 'production',
+  schemaLoader: new FileSystemSchemaLoader('schemas'),
+});
+
+await messaging.start();
+try {
+  const result = await messaging.publish(
+    'enrollment', 'student', 'enrolled', 'v1',             // domain, aggregate, event, version
+    { student_id: 's-123', course_id: 'c-9' },
+    {
+      key: 's-123',                                        // define a partição (ordem por chave)
+      idempotencyKey: 'enrollment-987',                    // opcional; chave de dedup preferida
+    },
+  );
+  console.log(result.messageId, result.topic, result.partition, result.offset);
+} finally {
+  await messaging.stop();                                  // um Messaging por processo: pare só no shutdown
+}
+```
+
+O evento vai para o tópico `enrollment.events.v1` com `event_type = "student.enrolled"` e é validado contra
+`schemas/enrollment/student-enrolled/v1.json` (JSON Schema Draft 2020-12) antes de sair. `publish` aguarda o ack do
+broker; payload inválido rejeita com `SchemaValidationError` sem enviar nada, e erro do Kafka rejeita com
+`PublishError`.
+
+## Consumir
+
+```ts
+import {
+  type ConsumedMessage,
+  FileSystemSchemaLoader,
+  KafkaConfig,
+  Messaging,
+  PermanentProcessingError,
+} from 'youeduc-sdk-messaging';
+
+async function onEnrolled(message: ConsumedMessage, signal: AbortSignal): Promise<void> {
+  if (!('course_id' in message.payload)) {
+    throw new PermanentProcessingError('course_id ausente');       // vai direto para a DLQ
+  }
+  // Resolver = sucesso; qualquer outra rejeição = retry. Repasse o signal ao I/O cancelável:
+  // ele é abortado no timeout de processamento ou no prazo de drenagem do shutdown.
+  await fetch('https://seats.internal/reserve', { method: 'POST', body: JSON.stringify(message.payload), signal });
+}
+
+const messaging = new Messaging(KafkaConfig.fromEnv(), {
+  service: 'learning-worker',                                      // também é o consumer group padrão
+  environment: 'production',
+  schemaLoader: new FileSystemSchemaLoader('schemas'),
+});
+await messaging.start();
+
+const consumer = messaging.consumer({
+  domain: 'enrollment',
+  version: 'v1',
+  handlers: { 'student.enrolled': onEnrolled },                    // event_type -> handler
+  processingTimeoutMs: 60_000,
+});
+await consumer.start();
+
+for (const signal of ['SIGINT', 'SIGTERM'] as const) {
+  // Para os consumers (o registro em voo termina e o progresso é commitado) e só depois fecha o producer.
+  process.once(signal, () => void messaging.stop({ drainTimeoutMs: 30_000 }));
+}
+try {
+  await consumer.wait();                                           // rejeita com o erro fatal, se houve
+} finally {
+  await messaging.stop();                                          // idempotente
+}
+```
+
+Eventos do domínio sem handler são ignorados e o offset avança. Os tópicos (principal, retry e DLQ do grupo) precisam
+existir antes do consumer iniciar: crie-os por IaC ou, em desenvolvimento, com `messaging.ensureTopics(...)`.
+
+## Garantias
+
+| Garantia | Como |
+|---|---|
+| **At-least-once** no consumo | O offset só é commitado depois do desfecho final (sucesso, DLQ, ignorada) ou do envio **confirmado** para retry/DLQ. Um handler pode rodar mais de uma vez para a mesma mensagem: **handlers devem ser idempotentes** ou usar um `DuplicateChecker`. |
+| **Ordem por chave** | Mensagens com a mesma `key` vão para a mesma partição e são processadas em sequência. Uma mensagem que vai para retry sai da ordem. |
+| **Producer idempotente** | Um producer por processo, `acks=all` e idempotência ligada, compartilhado por publish, retry e DLQ. |
+| **Schema obrigatório** | Todo payload é validado no publish e no consumo. |
+| **Sem PII em logs** | Logs, spans, métricas e erros de schema nunca incluem valores do payload nem a `key`. |
+
+Não há exactly-once nem transações Kafka.
+
+## Retry e DLQ
+
+A política padrão (`new RetryPolicy()`) reprocessa uma falha transitória após **30 s, 5 min, 1 h e 12 h**; a quinta
+falha vai para a DLQ. Cada atraso tem um tópico de retry por consumer group (`{tópico}.{grupo}.retry.30s` ...
+`.retry.12h`) e a DLQ é `{tópico}.{grupo}.dlq`. A mensagem de retry é relida só pelo próprio grupo e nunca volta ao
+tópico principal; enquanto espera, a partição de retry fica pausada sem bloquear as demais.
+
+- `PermanentProcessingError` (ou subclasse), payload inválido e falha de schema vão direto para a DLQ.
+- Qualquer outra rejeição, inclusive timeout de processamento, segue a política de retry.
+- Política própria: `new RetryPolicy({ delaysMs: [10_000, 60_000, 300_000] })` (segundos inteiros); `delaysMs: []`
+  desativa o retry.
+- A DLQ nunca marca a deduplicação, então `replayDlq(...)` pode reprocessar as mensagens.
+
+## Prefixo de ambiente
+
+Para homologação e produção no mesmo cluster, `resourcePrefix` (kebab-case, como `hmg` ou `prd`) vira o primeiro
+segmento do tópico principal e do consumer group, e por consequência de retry, DLQ e replay:
+
+```ts
+new Messaging(kafka, { service: 'catalogo-api', environment: 'homologacao', schemaLoader: loader, resourcePrefix: 'hmg' });
+// tópico: hmg.usuarios.events.v1   grupo: hmg.catalogo-api
+// retry:  hmg.usuarios.events.v1.catalogo-api.retry.30s   DLQ: hmg.usuarios.events.v1.catalogo-api.dlq
+```
+
+Prefixar também o grupo impede que réplicas dos dois ambientes dividam as partições do mesmo `group.id`. Sem prefixo,
+os nomes não mudam.
+
+## Deduplicação
+
+`InMemoryDuplicateChecker` serve a um processo só. Para várias réplicas, use o store Redis do subpath
+`youeduc-sdk-messaging/redis` (instale `redis`, o cliente oficial node-redis), com um `namespace` por sistema e
+ambiente:
+
+```bash
+npm install --save-exact redis
+```
+
+```ts
+import { RedisDedupStore } from 'youeduc-sdk-messaging/redis';
+
+const store = RedisDedupStore.fromUrl('redis://redis:6379/0', { namespace: 'hmgcatalogo_api' });
+const consumer = messaging.consumer({
+  domain: 'enrollment',
+  version: 'v1',
+  handlers: { 'student.enrolled': onEnrolled },
+  duplicateChecker: store.checker('learning-worker'),              // o mesmo nome do consumer group
+});
+// no shutdown, depois de messaging.stop():
+await store.close();
+```
+
+A chave é marcada só depois do sucesso do handler; retry e DLQ não marcam. O formato da chave é o mesmo da SDK
+Python: consumers das duas linguagens podem compartilhar o mesmo Redis.
+
+## Contratos embutidos
+
+Os schemas e tipos dos eventos corporativos vêm no pacote, na mesma versão da SDK:
+
+```ts
+import { contracts } from 'youeduc-sdk-messaging';
+
+const loader = contracts.schemaLoader();   // InMemorySchemaLoader com todos os schemas embutidos
+const payload = { versao: 3, ocorrido_em: '2026-10-07T09:00:00-03:00', login: 'maria.silva' } satisfies contracts.usuarios.UsuarioDesativado;
+```
+
+Para combinar com schemas próprios do serviço:
+`new ChainSchemaLoader(new FileSystemSchemaLoader('schemas'), contracts.schemaLoader())`.
+
+## Configuração
+
+`KafkaConfig.fromEnv()` lê `KAFKA_BOOTSTRAP_SERVERS` (obrigatória), `KAFKA_CLIENT_ID`, `KAFKA_SECURITY_PROTOCOL`
+(`PLAINTEXT`, `SSL`, `SASL_PLAINTEXT`, `SASL_SSL`), `KAFKA_SASL_MECHANISM`, `KAFKA_SASL_USERNAME` e
+`KAFKA_SASL_PASSWORD`. Express, NestJS, Next.js, AdonisJS e serviços sem framework também podem montar tudo a partir
+de um mapa `SDK_MESSAGING` (`SERVICE`, `ENVIRONMENT`, `KAFKA`, `REDIS`, `RESOURCE_PREFIX`...) com
+`MessagingSettings.fromMapping`, e rodar os consumers num processo próprio com `serveConsumers`.
+
+## Licença
+
+MIT.

package/dist/admin.d.ts

@@ -0,0 +1,61 @@
+/** Topic provisioning (bootstrap/dev use; in production prefer IaC). */
+import type { ClientConfig, KafkaConfig } from './config.js';
+import { type Logger } from './logger.js';
+/** Topic definition in the KafkaJS admin API. */
+export interface AdminTopicConfig {
+    topic: string;
+    numPartitions: number;
+    replicationFactor: number;
+    configEntries: Array<{
+        name: string;
+        value: string;
+    }>;
+}
+/** Subset of the KafkaJS `Admin` used here (the confluent admin client satisfies it). */
+export interface KafkaAdminLike {
+    connect(): Promise<void>;
+    /** Resolves `true` when created, `false` when it already existed; per-topic errors reject. */
+    createTopics(options: {
+        topics: AdminTopicConfig[];
+        timeout?: number;
+    }): Promise<boolean>;
+    disconnect(): Promise<void>;
+}
+export type AdminFactory = (config: ClientConfig) => KafkaAdminLike | Promise<KafkaAdminLike>;
+/** Default factory: `new KafkaJS.Kafka().admin(config)` (native module loaded on first use). */
+export declare const createConfluentAdmin: AdminFactory;
+export interface EnsureTopicsOptions {
+    /** Default 3. */
+    numPartitions?: number;
+    /** Default 1. */
+    replicationFactor?: number;
+    /** Topic configs applied to every created topic (e.g. `{"retention.ms": "604800000"}`). */
+    topicConfigs?: Readonly<Record<string, string>>;
+    /** Timeout of each create request. Default 30 000 ms. */
+    timeoutMs?: number;
+    /** Admin factory (tests inject fakes). Default {@link createConfluentAdmin}. */
+    adminFactory?: AdminFactory;
+    /** Default: the SDK default logger. */
+    logger?: Logger;
+}
+/** One topic to create: name, partitions and configs (spec §2.6, per topic kind). */
+export interface TopicSpec {
+    topic: string;
+    numPartitions: number;
+    topicConfigs?: Readonly<Record<string, string>> | undefined;
+}
+export type CreateTopicsOptions = Omit<EnsureTopicsOptions, 'numPartitions' | 'topicConfigs'>;
+/**
+ * Creates the topics that do not exist yet and returns the names created.
+ *
+ * An existing topic is not an error. Any other per-topic error throws `MessagingError` listing
+ * each topic and its error; request-level errors (connection, timeout) propagate as thrown by
+ * the client. Each topic is created by its own request, so "created" vs "already existed" is
+ * known per topic (the KafkaJS API only reports it per request).
+ */
+export declare function ensureTopics(config: KafkaConfig, topics: Iterable<string>, options?: EnsureTopicsOptions): Promise<string[]>;
+/**
+ * Like {@link ensureTopics}, with partitions and configs per topic. Repeated names: the first
+ * definition wins.
+ */
+export declare function createTopics(config: KafkaConfig, specs: Iterable<TopicSpec>, options?: CreateTopicsOptions): Promise<string[]>;

package/dist/admin.js

@@ -0,0 +1,143 @@
+/** Topic provisioning (bootstrap/dev use; in production prefer IaC). */
+import { MessagingError } from './errors.js';
+import { defaultLogger } from './logger.js';
+import { KafkaErrorCodes } from './transport.js';
+import { errorFields, pyRepr } from './util.js';
+/** Default factory: `new KafkaJS.Kafka().admin(config)` (native module loaded on first use). */
+export const createConfluentAdmin = async (config) => {
+    const { KafkaJS } = (await import('@confluentinc/kafka-javascript')).default;
+    return new KafkaJS.Kafka({}).admin(config);
+};
+function describeFailure(topic, failure) {
+    const code = typeof failure.code === 'number' ? failure.code : undefined;
+    const kind = typeof failure.type === 'string' && failure.type !== ''
+        ? failure.type
+        : typeof failure.name === 'string'
+            ? failure.name
+            : 'Error';
+    let detail = code === undefined ? kind : `${kind} (error code ${code})`;
+    const message = typeof failure.message === 'string' ? failure.message : '';
+    if (message)
+        detail += `: ${message}`;
+    return `${pyRepr(topic)}: ${detail}`;
+}
+/** Per-topic failures carried by a `KafkaJSAggregateError` (each with `topic`), else `null`. */
+function topicFailures(error) {
+    const errors = error?.errors;
+    if (!Array.isArray(errors) || errors.length === 0)
+        return null;
+    if (!errors.every((item) => typeof item === 'object' && item !== null && 'topic' in item))
+        return null;
+    return errors;
+}
+/**
+ * Creates the topics that do not exist yet and returns the names created.
+ *
+ * An existing topic is not an error. Any other per-topic error throws `MessagingError` listing
+ * each topic and its error; request-level errors (connection, timeout) propagate as thrown by
+ * the client. Each topic is created by its own request, so "created" vs "already existed" is
+ * known per topic (the KafkaJS API only reports it per request).
+ */
+export async function ensureTopics(config, topics, options = {}) {
+    if (typeof topics === 'string') {
+        throw new TypeError("'topics' must be an iterable of topic names, not a string");
+    }
+    const names = [...new Set(topics)];
+    if (names.length === 0)
+        return [];
+    for (const name of names)
+        requireTopicName(name);
+    const numPartitions = options.numPartitions ?? 3;
+    requireCount('num_partitions', numPartitions);
+    const { numPartitions: _n, topicConfigs, ...rest } = options;
+    return createTopics(config, names.map((topic) => ({ topic, numPartitions, topicConfigs })), rest);
+}
+function requireTopicName(name) {
+    if (typeof name !== 'string' || name === '') {
+        throw new TypeError(`topic names must be non-empty strings; got ${typeof name === 'string' ? pyRepr(name) : String(name)}`);
+    }
+}
+function requireCount(name, value) {
+    if (typeof value !== 'number' || !Number.isInteger(value) || value < 1) {
+        throw new RangeError(`'${name}' must be >= 1; got ${String(value)}`);
+    }
+}
+/**
+ * Like {@link ensureTopics}, with partitions and configs per topic. Repeated names: the first
+ * definition wins.
+ */
+export async function createTopics(config, specs, options = {}) {
+    const unique = new Map();
+    for (const spec of specs) {
+        requireTopicName(spec.topic);
+        requireCount('num_partitions', spec.numPartitions);
+        if (!unique.has(spec.topic))
+            unique.set(spec.topic, spec);
+    }
+    if (unique.size === 0)
+        return [];
+    const replicationFactor = options.replicationFactor ?? 1;
+    requireCount('replication_factor', replicationFactor);
+    const names = [...unique.keys()];
+    const timeout = options.timeoutMs ?? 30_000;
+    const logger = options.logger ?? defaultLogger();
+    const factory = options.adminFactory ?? createConfluentAdmin;
+    const admin = await factory(config.clientConfig());
+    const created = [];
+    const failures = [];
+    try {
+        await admin.connect();
+        const results = await Promise.allSettled([...unique.values()].map((spec) => admin.createTopics({
+            topics: [
+                {
+                    topic: spec.topic,
+                    numPartitions: spec.numPartitions,
+                    replicationFactor,
+                    configEntries: Object.entries(spec.topicConfigs ?? {}).map(([name, value]) => ({
+                        name,
+                        value,
+                    })),
+                },
+            ],
+            timeout,
+        })));
+        let requestError;
+        results.forEach((result, index) => {
+            const topic = names[index];
+            if (result.status === 'fulfilled') {
+                if (result.value)
+                    created.push(topic);
+                return;
+            }
+            const perTopic = topicFailures(result.reason);
+            if (perTopic === null) {
+                requestError ??= result.reason;
+                return;
+            }
+            for (const failure of perTopic) {
+                if (failure.code === KafkaErrorCodes.ERR_TOPIC_ALREADY_EXISTS)
+                    continue;
+                failures.push(describeFailure(typeof failure.topic === 'string' ? failure.topic : topic, failure));
+            }
+        });
+        if (requestError !== undefined)
+            throw requestError;
+    }
+    finally {
+        await closeQuietly(admin, logger);
+    }
+    if (created.length > 0)
+        logger.info('kafka_topics_created', { messaging: { topics: created } });
+    if (failures.length > 0)
+        throw new MessagingError(`failed to create topics: ${failures.join('; ')}`);
+    return created;
+}
+async function closeQuietly(admin, logger) {
+    try {
+        await admin.disconnect();
+    }
+    catch (error) {
+        logger.warn('kafka_admin_close_failed', { error: errorFields(error) });
+    }
+}
+//# sourceMappingURL=admin.js.map

package/dist/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAGxE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAe,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAoBhD,gGAAgG;AAChG,MAAM,CAAC,MAAM,oBAAoB,GAAiB,KAAK,EAAE,MAAM,EAAE,EAAE;IACjE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7E,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAA8B,CAAC;AAC1E,CAAC,CAAC;AAyBF,SAAS,eAAe,CAAC,KAAa,EAAE,OAAqB;IAC3D,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,MAAM,IAAI,GACR,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,EAAE;QACrD,CAAC,CAAC,OAAO,CAAC,IAAI;QACd,CAAC,CAAC,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;YAChC,CAAC,CAAC,OAAO,CAAC,IAAI;YACd,CAAC,CAAC,OAAO,CAAC;IAChB,IAAI,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,gBAAgB,IAAI,GAAG,CAAC;IACxE,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,IAAI,OAAO;QAAE,MAAM,IAAI,KAAK,OAAO,EAAE,CAAC;IACtC,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;AACvC,CAAC;AAED,gGAAgG;AAChG,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,MAAM,GAAI,KAAqC,EAAE,MAAM,CAAC;IAC9D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvG,OAAO,MAAwB,CAAC;AAClC,CAAC;AAWD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAmB,EACnB,MAAwB,EACxB,OAAO,GAAwB,EAAE;IAEjC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC;IACjD,YAAY,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;IAC9C,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAC7D,OAAO,YAAY,CACjB,MAAM,EACN,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,EAC9D,IAAI,CACL,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACrC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,SAAS,CACjB,8CAA8C,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CACvG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,KAAc;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,UAAU,CAAC,IAAI,IAAI,uBAAuB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAmB,EACnB,KAA0B,EAC1B,OAAO,GAAwB,EAAE;IAEjC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,YAAY,CAAC,gBAAgB,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,CAAC,CAAC;IACzD,YAAY,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,IAAI,oBAAoB,CAAC;IAE7D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IACnD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAChC,KAAK,CAAC,YAAY,CAAC;YACjB,MAAM,EAAE;gBACN;oBACE,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,aAAa,EAAE,IAAI,CAAC,aAAa;oBACjC,iBAAiB;oBACjB,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;wBAC7E,IAAI;wBACJ,KAAK;qBACN,CAAC,CAAC;iBACJ;aACF;YACD,OAAO;SACR,CAAC,CACH,CACF,CAAC;QACF,IAAI,YAAqB,CAAC;QAC1B,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;YAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAW,CAAC;YACrC,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,IAAI,MAAM,CAAC,KAAK;oBAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACtC,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC;gBAC/B,OAAO;YACT,CAAC;YACD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,CAAC,wBAAwB;oBAAE,SAAS;gBACxE,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;YACrG,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,YAAY,KAAK,SAAS;YAAE,MAAM,YAAY,CAAC;IACrD,CAAC;YAAS,CAAC;QACT,MAAM,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IAChG,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,4BAA4B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrG,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAAqB,EAAE,MAAc;IAC/D,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;AACH,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Connection parameters shared by producer, consumer and admin (Python `KafkaConfig`).
+ *
+ * `clientConfig()` converts them to the librdkafka configuration accepted by
+ * `@confluentinc/kafka-javascript` (`new KafkaJS.Kafka().producer(config)` etc.).
+ */
+import { inspect } from 'node:util';
+export declare const SECURITY_PROTOCOLS: readonly ['PLAINTEXT', 'SSL', 'SASL_PLAINTEXT', 'SASL_SSL'];
+export type SecurityProtocol = (typeof SECURITY_PROTOCOLS)[number];
+/**
+ * TLS material (the Node equivalent of Python's `ssl_context`). Without it, `SSL`/`SASL_SSL`
+ * still verify the broker certificate against the system CAs and check the hostname.
+ */
+export interface KafkaSslOptions {
+    /** File/dir with CA certificates (`ssl.ca.location`). Default: probe the system CAs. */
+    caLocation?: string;
+    /** CA certificates in PEM (`ssl.ca.pem`). */
+    caPem?: string;
+    /** Client certificate for mTLS (`ssl.certificate.location` / `ssl.certificate.pem`). */
+    certificateLocation?: string;
+    certificatePem?: string;
+    /** Client key for mTLS (`ssl.key.location` / `ssl.key.pem`) and its password. */
+    keyLocation?: string;
+    keyPem?: string;
+    keyPassword?: string;
+}
+export interface KafkaConfigInit {
+    bootstrapServers: string;
+    clientId?: string | null | undefined;
+    securityProtocol?: string | undefined;
+    /** Required with `SASL_*` (e.g. `PLAIN`, `SCRAM-SHA-512`). */
+    saslMechanism?: string | null | undefined;
+    saslUsername?: string | null | undefined;
+    saslPassword?: string | null | undefined;
+    ssl?: KafkaSslOptions | null | undefined;
+}
+/** librdkafka configuration (string keys, scalar values). */
+export type ClientConfig = Record<string, string | number | boolean>;
+/** Environment-like mapping (`process.env`). */
+export type Environment = Readonly<Record<string, string | undefined>>;
+/**
+ * Validated, immutable connection settings. The SASL password and the TLS material are kept in
+ * private fields: they never appear in `JSON.stringify`, `console.log` or `util.inspect`.
+ */
+export declare class KafkaConfig {
+    #private;
+    readonly bootstrapServers: string;
+    readonly clientId: string | null;
+    readonly securityProtocol: SecurityProtocol;
+    readonly saslMechanism: string | null;
+    readonly saslUsername: string | null;
+    constructor(init: KafkaConfigInit);
+    get saslPassword(): string | null;
+    get ssl(): Readonly<KafkaSslOptions> | null;
+    /**
+     * Reads `{prefix}BOOTSTRAP_SERVERS` (required), `CLIENT_ID`, `SECURITY_PROTOCOL`,
+     * `SASL_MECHANISM`, `SASL_USERNAME` and `SASL_PASSWORD`. TLS material is not read from the
+     * environment (build `ssl` in code); without it, TLS uses the system CAs.
+     */
+    static fromEnv(options?: {
+        prefix?: string;
+        env?: Environment;
+    }): KafkaConfig;
+    /**
+     * Common librdkafka configuration for producer, consumer and admin (Python `client_kwargs()`).
+     *
+     * With TLS (`SSL`/`SASL_SSL`) the broker certificate is always verified and the hostname
+     * checked; without explicit CA material the system CAs are probed (`ssl.ca.location=probe`).
+     */
+    clientConfig(): ClientConfig;
+    /** Safe representation (no password, no TLS material). */
+    toJSON(): Record<string, unknown>;
+    [inspect.custom](): string;
+}

package/dist/config.js

@@ -0,0 +1,128 @@
+/**
+ * Connection parameters shared by producer, consumer and admin (Python `KafkaConfig`).
+ *
+ * `clientConfig()` converts them to the librdkafka configuration accepted by
+ * `@confluentinc/kafka-javascript` (`new KafkaJS.Kafka().producer(config)` etc.).
+ */
+import { inspect } from 'node:util';
+import { pyRepr } from './util.js';
+export const SECURITY_PROTOCOLS = ['PLAINTEXT', 'SSL', 'SASL_PLAINTEXT', 'SASL_SSL'];
+const TLS_PROTOCOLS = ['SSL', 'SASL_SSL'];
+/**
+ * Validated, immutable connection settings. The SASL password and the TLS material are kept in
+ * private fields: they never appear in `JSON.stringify`, `console.log` or `util.inspect`.
+ */
+export class KafkaConfig {
+    bootstrapServers;
+    clientId;
+    securityProtocol;
+    saslMechanism;
+    saslUsername;
+    #saslPassword;
+    #ssl;
+    constructor(init) {
+        if (typeof init.bootstrapServers !== 'string' || init.bootstrapServers.trim() === '') {
+            throw new TypeError("'bootstrap_servers' must not be empty");
+        }
+        const protocol = init.securityProtocol ?? 'PLAINTEXT';
+        if (!SECURITY_PROTOCOLS.includes(protocol)) {
+            throw new TypeError(`'security_protocol' must be one of (${SECURITY_PROTOCOLS.map(pyRepr).join(', ')}); got ${pyRepr(String(protocol))}`);
+        }
+        const mechanism = init.saslMechanism ?? null;
+        if (protocol.startsWith('SASL') && mechanism === null) {
+            throw new TypeError("'sasl_mechanism' is required for SASL security protocols");
+        }
+        this.bootstrapServers = init.bootstrapServers;
+        this.clientId = init.clientId ?? null;
+        this.securityProtocol = protocol;
+        this.saslMechanism = mechanism;
+        this.saslUsername = init.saslUsername ?? null;
+        this.#saslPassword = init.saslPassword ?? null;
+        this.#ssl = init.ssl ? Object.freeze({ ...init.ssl }) : null;
+        Object.freeze(this);
+    }
+    get saslPassword() {
+        return this.#saslPassword;
+    }
+    get ssl() {
+        return this.#ssl;
+    }
+    /**
+     * Reads `{prefix}BOOTSTRAP_SERVERS` (required), `CLIENT_ID`, `SECURITY_PROTOCOL`,
+     * `SASL_MECHANISM`, `SASL_USERNAME` and `SASL_PASSWORD`. TLS material is not read from the
+     * environment (build `ssl` in code); without it, TLS uses the system CAs.
+     */
+    static fromEnv(options = {}) {
+        const prefix = options.prefix ?? 'KAFKA_';
+        const env = options.env ?? process.env;
+        const servers = env[`${prefix}BOOTSTRAP_SERVERS`];
+        if (servers === undefined) {
+            throw new TypeError(`environment variable ${prefix}BOOTSTRAP_SERVERS is required`);
+        }
+        return new KafkaConfig({
+            bootstrapServers: servers,
+            clientId: env[`${prefix}CLIENT_ID`],
+            securityProtocol: env[`${prefix}SECURITY_PROTOCOL`] ?? 'PLAINTEXT',
+            saslMechanism: env[`${prefix}SASL_MECHANISM`],
+            saslUsername: env[`${prefix}SASL_USERNAME`],
+            saslPassword: env[`${prefix}SASL_PASSWORD`],
+        });
+    }
+    /**
+     * Common librdkafka configuration for producer, consumer and admin (Python `client_kwargs()`).
+     *
+     * With TLS (`SSL`/`SASL_SSL`) the broker certificate is always verified and the hostname
+     * checked; without explicit CA material the system CAs are probed (`ssl.ca.location=probe`).
+     */
+    clientConfig() {
+        const config = {
+            'bootstrap.servers': this.bootstrapServers,
+            'security.protocol': this.securityProtocol.toLowerCase(),
+        };
+        if (this.clientId !== null)
+            config['client.id'] = this.clientId;
+        if (this.saslMechanism !== null) {
+            config['sasl.mechanisms'] = this.saslMechanism;
+            if (this.saslUsername !== null)
+                config['sasl.username'] = this.saslUsername;
+            if (this.#saslPassword !== null)
+                config['sasl.password'] = this.#saslPassword;
+        }
+        if (TLS_PROTOCOLS.includes(this.securityProtocol)) {
+            const ssl = this.#ssl ?? {};
+            config['enable.ssl.certificate.verification'] = true;
+            config['ssl.endpoint.identification.algorithm'] = 'https';
+            if (ssl.caLocation !== undefined)
+                config['ssl.ca.location'] = ssl.caLocation;
+            if (ssl.caPem !== undefined)
+                config['ssl.ca.pem'] = ssl.caPem;
+            if (ssl.caLocation === undefined && ssl.caPem === undefined)
+                config['ssl.ca.location'] = 'probe';
+            if (ssl.certificateLocation !== undefined)
+                config['ssl.certificate.location'] = ssl.certificateLocation;
+            if (ssl.certificatePem !== undefined)
+                config['ssl.certificate.pem'] = ssl.certificatePem;
+            if (ssl.keyLocation !== undefined)
+                config['ssl.key.location'] = ssl.keyLocation;
+            if (ssl.keyPem !== undefined)
+                config['ssl.key.pem'] = ssl.keyPem;
+            if (ssl.keyPassword !== undefined)
+                config['ssl.key.password'] = ssl.keyPassword;
+        }
+        return config;
+    }
+    /** Safe representation (no password, no TLS material). */
+    toJSON() {
+        return {
+            bootstrapServers: this.bootstrapServers,
+            clientId: this.clientId,
+            securityProtocol: this.securityProtocol,
+            saslMechanism: this.saslMechanism,
+            saslUsername: this.saslUsername,
+        };
+    }
+    [inspect.custom]() {
+        return `KafkaConfig ${inspect(this.toJSON())}`;
+    }
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAEnC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,UAAU,CAAU,CAAC;AAE9F,MAAM,aAAa,GAAsB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;AAqC7D;;;GAGG;AACH,MAAM,OAAO,WAAW;IACb,gBAAgB,CAAS;IACzB,QAAQ,CAAgB;IACxB,gBAAgB,CAAmB;IACnC,aAAa,CAAgB;IAC7B,YAAY,CAAgB;IAC5B,aAAa,CAAgB;IAC7B,IAAI,CAAmC;IAEhD,YAAY,IAAqB;QAC/B,IAAI,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrF,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,IAAI,WAAW,CAAC;QACtD,IAAI,CAAE,kBAAwC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,SAAS,CACjB,uCAAuC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CACrH,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;QAC7C,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACtD,MAAM,IAAI,SAAS,CAAC,0DAA0D,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAC9C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;QACtC,IAAI,CAAC,gBAAgB,GAAG,QAA4B,CAAC;QACrD,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;QAC9C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;QAC/C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,GAA2C,EAAE;QACjE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC;QAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACvC,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,MAAM,mBAAmB,CAAC,CAAC;QAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,SAAS,CAAC,wBAAwB,MAAM,+BAA+B,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,IAAI,WAAW,CAAC;YACrB,gBAAgB,EAAE,OAAO;YACzB,QAAQ,EAAE,GAAG,CAAC,GAAG,MAAM,WAAW,CAAC;YACnC,gBAAgB,EAAE,GAAG,CAAC,GAAG,MAAM,mBAAmB,CAAC,IAAI,WAAW;YAClE,aAAa,EAAE,GAAG,CAAC,GAAG,MAAM,gBAAgB,CAAC;YAC7C,YAAY,EAAE,GAAG,CAAC,GAAG,MAAM,eAAe,CAAC;YAC3C,YAAY,EAAE,GAAG,CAAC,GAAG,MAAM,eAAe,CAAC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,YAAY;QACV,MAAM,MAAM,GAAiB;YAC3B,mBAAmB,EAAE,IAAI,CAAC,gBAAgB;YAC1C,mBAAmB,EAAE,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE;SACzD,CAAC;QACF,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;YAAE,MAAM,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QAChE,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YAChC,MAAM,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC;YAC/C,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI;gBAAE,MAAM,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;YAC5E,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI;gBAAE,MAAM,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC;QAChF,CAAC;QACD,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAClD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;YAC5B,MAAM,CAAC,qCAAqC,CAAC,GAAG,IAAI,CAAC;YACrD,MAAM,CAAC,uCAAuC,CAAC,GAAG,OAAO,CAAC;YAC1D,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS;gBAAE,MAAM,CAAC,iBAAiB,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC;YAC7E,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;gBAAE,MAAM,CAAC,YAAY,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC;YAC9D,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;gBAAE,MAAM,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC;YACjG,IAAI,GAAG,CAAC,mBAAmB,KAAK,SAAS;gBAAE,MAAM,CAAC,0BAA0B,CAAC,GAAG,GAAG,CAAC,mBAAmB,CAAC;YACxG,IAAI,GAAG,CAAC,cAAc,KAAK,SAAS;gBAAE,MAAM,CAAC,qBAAqB,CAAC,GAAG,GAAG,CAAC,cAAc,CAAC;YACzF,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS;gBAAE,MAAM,CAAC,kBAAkB,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC;YAChF,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;gBAAE,MAAM,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;YACjE,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS;gBAAE,MAAM,CAAC,kBAAkB,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC;QAClF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,0DAA0D;IAC1D,MAAM;QACJ,OAAO;YACL,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;IACJ,CAAC;IAED,CAAC,OAAO,CAAC,MAAM,CAAC;QACd,OAAO,eAAe,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;IACjD,CAAC;CACF"}