KL-300: Upgrade aedes to v0.51.3 with OTel instrumentation compatibility

[rajathongal-intangles]

Summary

Merges upstream aedes v0.51.3 (last CJS release before ESM migration in v1.0.0) and applies structural changes required by aedes-otel-instrumentation for OpenTelemetry auto-span creation.

Upstream merge (v0.50.0 → v0.51.3)

Bug fixes and improvements from upstream:

• v0.50.1: TypeScript module export fix for ES6 compliance
• v0.51.0: Add opts.keepaliveLimit option, fix closeSameClients for already-closed clients
• v0.51.1: Remove erroneous console.error
• v0.51.2: Fix — delete will from persistence on clean disconnect
• v0.51.3: Fix memory leak in connected clients counter

Dependency updates

Package	Before	After
mqemitter	^5.0.0	^6.0.0
mqtt-packet	^8.2.0	^9.0.0
retimer	^3.0.0	^4.0.0
hyperid	^3.1.1	^3.2.0
uuid	-	^10.0.0

Note: Consumers using mqemitter-redis must bump to ~6.1.0 to match mqemitter@^6.0.0.

OTel instrumentation compatibility changes

aedes-otel-instrumentation (v0.2.0) uses @opentelemetry/instrumentation's InstrumentationNodeModuleFile to monkey-patch aedes handler functions. The published npm package includes a postinstall: "patch-package" script but does NOT ship the patch files (patches/ is not in the files array). This means the patches are never applied, and the instrumentation silently fails to create spans.

We apply the equivalent changes directly in the fork so the instrumentation works out of the box.

1. Named exports (all handler + write files)

Changed from default exports to named exports so shimmer.wrap(moduleExports, 'handleConnect', ...) can locate the function:

- module.exports = handleConnect
+ module.exports = { handleConnect }

Files changed: connect.js, publish.js, subscribe.js, ping.js, puback.js, pubrec.js, pubrel.js, unsubscribe.js, handlers/index.js, write.js

All require() call sites updated to use destructuring (const { handleConnect } = require(...)).

2. Prototype methods for handler functions

Moved handle, preConnect, authenticate, authorizePublish, authorizeSubscribe from instance closures/properties to Aedes.prototype methods so aedes-otel-instrumentation can monkey-patch them:

  // Constructor
- this.preConnect = opts.preConnect
- this.authenticate = opts.authenticate
- this.authorizePublish = opts.authorizePublish
- this.authorizeSubscribe = opts.authorizeSubscribe
+ this._preConnect = opts.preConnect
+ this._authenticate = opts.authenticate
+ this._authorizePublish = opts.authorizePublish
+ this._authorizeSubscribe = opts.authorizeSubscribe

  // Prototype
+ Aedes.prototype.preConnect = function (client, packet, cb) {
+   this._preConnect(client, packet, cb)
+ }
+ Aedes.prototype.authenticate = function (client, user, pass, cb) {
+   this._authenticate(client, user, pass, cb)
+ }

3. wrapDeliveryFunc hook

New wrapDeliveryFunc option and prototype method — called in subscribe.js's addSubs() before registering the delivery function. Allows aedes-otel-instrumentation to wrap each subscription's delivery callback to create {topic} receive spans.

Breaking changes for consumers

aedes.handle must be bound when used as a callback

Since handle moved from a closure (capturing that) to a prototype method (using this), passing it as a callback requires .bind(aedes):

- server = require("net").createServer(aedes.handle);
+ server = require("net").createServer(aedes.handle.bind(aedes));

Direct property assignment still works

Overriding handlers at the instance level (e.g. aedes.authenticate = customFn) still works — instance properties shadow prototype methods.

What this enables

With these changes, aedes-otel-instrumentation can now auto-create:

• mqtt.connect spans (from handleConnect patch)
• {topic} publish spans (from handlePublish patch)
• {topic} receive spans (from wrapDeliveryFunc + handleSubscribe patch)
• Connection attribute propagation (from Aedes.prototype.handle patch)
• mqtt.server.duration and mqtt.client.duration metrics

Intangles customizations preserved

• emitPacket in aedes.js — IMEI regex filter + SUPPRESS_MQTT_EVENTS flag — unchanged
• aedes.d.ts CommonJS export declaration — unchanged

Why not v1.0.0?

Upstream v1.0.0+ migrated to ESM ("type": "module"), which is incompatible with the Backend's CommonJS require('aedes'). v0.51.3 is the last CJS release.

Related PRs

• intangles: Intangles/intangles#8495