@fireemu/darwin-arm64 0.42.0 → 0.44.0

package/bin/runner-python/fireemu_runner/manifest.py

@@ -0,0 +1,370 @@
+"""The endpoints the Python SDK declares, as fireemu's canonical manifest.
+
+`firebase_functions.private.serving.get_functions()` returns the decorated functions, each with a
+`__firebase_endpoint__` (the SDK's `ManifestEndpoint`, the same v1alpha1 endpoint schema the Node
+SDK produces). This module is the Python counterpart of `describe()` in
+`tools/runner-node/index.mjs`: it resolves option expressions, treats `None` and the SDK's reset
+sentinel as unset, and maps each trigger to the daemon's `functions[]` entry
+(`crates/fireemu-adapter-functions/src/manifest_json.rs`). A function it cannot serve is reported
+under `ignored[]`, never dropped.
+"""
+
+import enum
+import math
+from typing import Any
+
+from firebase_functions.params import Expression
+from firebase_functions.private.util import Sentinel
+
+DEFAULT_REGION = "us-central1"
+
+_FIRESTORE_PREFIX = "google.cloud.firestore."
+_PUBSUB_EVENT = "google.cloud.pubsub.topic.v1.messagePublished"
+_STORAGE_EVENTS = frozenset(
+    "google.cloud.storage.object.v1." + kind for kind in ("finalized", "deleted", "archived", "metadataUpdated")
+)
+_DATABASE_EVENTS = frozenset("google.firebase.database.ref.v1." + kind for kind in ("created", "updated", "deleted", "written"))
+# Products the official emulator has a trigger service for and fireemu does not serve, matched on a substring of
+# the event type as the Node runner does (`DEFERRED_TRIGGER_PRODUCTS` in `tools/runner-node/index.mjs`).
+_UNSERVED_PRODUCTS = (
+    ("remoteconfig", "remoteConfig", "deferred", "deferred: Remote Config has no emulator in the active supported surface"),
+    ("dataconnect", "dataconnect", "deferred", "deferred: the Data Connect emulator is not in the active supported surface"),
+    ("ailogic", "ai", "notPlanned", "not planned: Firebase AI Logic blocking triggers have no local emulator"),
+    ("analytics", "analytics", "notPlanned", "not planned: Google Analytics triggers have no local emulator"),
+    ("testing", "testLab", "notPlanned", "not planned: Test Lab triggers have no local emulator"),
+)
+_SCHEDULE_RETRY_FIELDS = frozenset(("retryCount", "maxRetrySeconds", "minBackoffSeconds", "maxBackoffSeconds", "maxDoublings"))
+_TASK_RETRY_FIELDS = frozenset(("maxAttempts", "maxRetrySeconds", "minBackoffSeconds", "maxBackoffSeconds", "maxDoublings"))
+_TASK_RATE_FIELDS = frozenset(("maxConcurrentDispatches", "maxDispatchesPerSecond"))
+_BLOCKING_AUTH_EVENTS = ("beforeCreate", "beforeSignIn", "beforeSendEmail", "beforeSendSms")
+
+
+class Unserved(Exception):
+    """A function the runner reports under `ignored[]`."""
+
+    def __init__(self, trigger_type: str, scope: str, reason: str):
+        super().__init__(reason)
+        self.trigger_type = trigger_type
+        self.scope = scope
+        self.reason = reason
+
+
+def _unset(value: Any) -> bool:
+    return value is None or isinstance(value, Sentinel)
+
+
+def _resolved(value: Any, field: str) -> Any:
+    """An option's concrete value, or None when it is unset. Expressions read their parameter."""
+    if _unset(value):
+        return None
+    if isinstance(value, enum.Enum):
+        return value.value
+    if isinstance(value, Expression):
+        resolved = value.value
+        if resolved is None:
+            raise Unserved("unknown", "unsupported", f"{field} expression did not resolve to a value")
+        return resolved
+    return value
+
+
+def _non_negative_integer(value: Any, field: str):
+    resolved = _resolved(value, field)
+    if resolved is None:
+        return None
+    if isinstance(resolved, bool) or not isinstance(resolved, int) or resolved < 0:
+        raise Unserved("unknown", "unsupported", f"{field} did not resolve to a non-negative integer")
+    return resolved
+
+
+def _first_region(endpoint) -> str | None:
+    regions = _resolved(endpoint.region, "region")
+    if regions is None:
+        return None
+    values = [_resolved(region, "region") for region in (regions if isinstance(regions, list) else [regions])]
+    for value in values:
+        if not isinstance(value, str) or not value:
+            raise Unserved("unknown", "unsupported", "region did not resolve to a non-empty string")
+    return values[0] if values else None
+
+
+def _platform_options(endpoint) -> dict | None:
+    options: dict[str, Any] = {}
+    for field, key in (
+        ("availableMemoryMb", "availableMemoryMb"),
+        ("minInstances", "minInstances"),
+        ("maxInstances", "maxInstances"),
+    ):
+        value = _non_negative_integer(getattr(endpoint, field), field)
+        if value is not None:
+            options[key] = value
+    for field, key in (("ingressSettings", "ingressSettings"), ("serviceAccountEmail", "serviceAccountEmail")):
+        value = _resolved(getattr(endpoint, field), field)
+        if value is not None:
+            options[key] = value
+    invoker = (endpoint.httpsTrigger or {}).get("invoker") if isinstance(endpoint.httpsTrigger, dict) else None
+    if invoker:
+        options["invoker"] = invoker
+    vpc = endpoint.vpc if isinstance(endpoint.vpc, dict) else None
+    if vpc:
+        if not _unset(vpc.get("connector")):
+            options["vpcConnector"] = vpc["connector"]
+        egress = _resolved(vpc.get("egressSettings"), "vpc.egressSettings")
+        if egress is not None:
+            options["vpcEgressSettings"] = egress
+        if isinstance(vpc.get("networkInterfaces"), list):
+            options["networkInterfaces"] = vpc["networkInterfaces"]
+    if isinstance(endpoint.labels, dict) and endpoint.labels:
+        options["labels"] = endpoint.labels
+    cpu = _resolved(endpoint.cpu, "cpu")
+    if cpu is not None:
+        options["cpu"] = str(cpu)
+    if isinstance(endpoint.secretEnvironmentVariables, list):
+        secrets = [secret["key"] for secret in endpoint.secretEnvironmentVariables if secret.get("key")]
+        if secrets:
+            options["secrets"] = secrets
+    return options or None
+
+
+def _mapping(value) -> dict:
+    return value if isinstance(value, dict) else {}
+
+
+def _text(filters: dict, key: str, field: str, family: str, *, required: bool = False, allow_empty: bool = True):
+    """A string filter, resolved. Absent is None (or an error when required); another type is an error."""
+    value = _resolved(filters.get(key), field)
+    if value is None and not required:
+        return None
+    if not isinstance(value, str) or (not allow_empty and not value):
+        what = "a string" if allow_empty else "a non-empty string"
+        raise Unserved(family, "unsupported", f"{field} did not resolve to {what}")
+    return value
+
+
+def _firestore_trigger(event_trigger: dict) -> dict:
+    filters = _mapping(event_trigger.get("eventFilters"))
+    patterns = _mapping(event_trigger.get("eventFilterPathPatterns"))
+    # The SDK keeps a document path without wildcards in `eventFilters.document` and one with
+    # wildcards in `eventFilterPathPatterns.document` (`options.py:1065-1075`).
+    document = _text(patterns, "document", "eventFilterPathPatterns.document", "firestore") or _text(
+        filters, "document", "eventFilters.document", "firestore"
+    )
+    if not document:
+        raise Unserved("firestore", "unsupported", "the Firestore trigger names no document (eventFilters.document)")
+    return {
+        "type": "firestore",
+        "eventType": event_trigger["eventType"],
+        "database": _text(filters, "database", "eventFilters.database", "firestore") or "(default)",
+        "document": document,
+    }
+
+
+def _pubsub_trigger(event_trigger: dict) -> dict:
+    topic = _text(_mapping(event_trigger.get("eventFilters")), "topic", "eventFilters.topic", "pubsub", required=True, allow_empty=False)
+    # A full resource name is reduced to the short name the daemon matches on.
+    short = topic.rsplit("/topics/", 1)[-1] if "/topics/" in topic else topic
+    if not short:
+        raise Unserved("pubsub", "unsupported", "eventFilters.topic resolved to an empty topic")
+    return {"type": "pubsub", "topic": short}
+
+
+def _storage_trigger(event_trigger: dict, event_type: str) -> dict:
+    bucket = _text(_mapping(event_trigger.get("eventFilters")), "bucket", "eventFilters.bucket", "storage")
+    trigger = {"type": "storage", "eventType": event_type}
+    if bucket is not None:
+        trigger["bucket"] = bucket
+    return trigger
+
+
+def _database_trigger(event_trigger: dict, event_type: str) -> dict:
+    filters = _mapping(event_trigger.get("eventFilters"))
+    patterns = _mapping(event_trigger.get("eventFilterPathPatterns"))
+    # The SDK keeps a reference without wildcards in `eventFilters` and one with wildcards in
+    # `eventFilterPathPatterns`; the Node runner reads the patterns first as well.
+    reference = _text(patterns, "ref", "eventFilterPathPatterns.ref", "database")
+    if reference is None:
+        reference = _text(filters, "ref", "eventFilters.ref", "database", required=True)
+    instance = _text(patterns, "instance", "eventFilterPathPatterns.instance", "database")
+    if instance is None:
+        instance = _text(filters, "instance", "eventFilters.instance", "database")
+    return {
+        "type": "database",
+        "eventType": event_type,
+        "ref": "/" + reference.strip("/"),
+        "instance": instance if instance is not None else "*",
+    }
+
+
+def _eventarc_trigger(event_trigger: dict, event_type: str, channel: str) -> dict:
+    filters = _mapping(event_trigger.get("eventFilters"))
+    return {
+        "type": "eventarc",
+        "eventType": event_type,
+        "channel": channel,
+        "filters": {key: _text(filters, key, f"eventFilters.{key}", "eventarc", required=True) for key in filters},
+    }
+
+
+def _event_trigger(event_trigger: dict) -> dict:
+    """The canonical trigger of an `eventTrigger`, or `Unserved` for an event type fireemu does not serve."""
+    event_type = str(_resolved(event_trigger.get("eventType"), "eventType") or "")
+    if event_type.startswith(_FIRESTORE_PREFIX):
+        return _firestore_trigger({**event_trigger, "eventType": event_type})
+    if event_type == _PUBSUB_EVENT:
+        return _pubsub_trigger(event_trigger)
+    if event_type in _STORAGE_EVENTS:
+        return _storage_trigger(event_trigger, event_type)
+    if event_type in _DATABASE_EVENTS:
+        return _database_trigger(event_trigger, event_type)
+    # `onCustomEventPublished` is the only SDK trigger that names a channel.
+    channel = _text(event_trigger, "channel", "eventTrigger.channel", "eventarc")
+    if channel is not None:
+        return _eventarc_trigger(event_trigger, event_type, channel)
+    for fragment, trigger_type, scope, reason in _UNSERVED_PRODUCTS:
+        if fragment in event_type:
+            raise Unserved(trigger_type, scope, reason)
+    family = "storage" if event_type.startswith("google.cloud.storage.") else (
+        "database" if event_type.startswith("google.firebase.database.") else "unknown"
+    )
+    raise Unserved(family, "unsupported", f"event type {event_type} is not recognised")
+
+
+def _record(value, field: str, family: str) -> dict:
+    """An options record: absent is empty, an object is itself, anything else is an error."""
+    if _unset(value):
+        return {}
+    if not isinstance(value, dict):
+        raise Unserved(family, "unsupported", f"{field} must be an object")
+    return value
+
+
+def _numbers(value, field: str, allowed: frozenset, family: str) -> dict:
+    """The numbers of a retry or rate record. A member the SDK left unset is null on the wire."""
+    record = _record(value, field, family)
+    numbers: dict[str, Any] = {}
+    for key, original in record.items():
+        if key not in allowed:
+            raise Unserved(family, "unsupported", f"{field}.{key} is not supported")
+        resolved = _resolved(original, f"{field}.{key}")
+        if resolved is None:
+            numbers[key] = None
+            continue
+        if isinstance(resolved, bool) or not isinstance(resolved, (int, float)) or not math.isfinite(resolved):
+            raise Unserved(family, "unsupported", f"{field}.{key} did not resolve to a finite number")
+        numbers[key] = resolved
+    return numbers
+
+
+def _schedule_trigger(trigger) -> tuple[dict, bool]:
+    """The canonical trigger of a `scheduleTrigger` and whether the function retries."""
+    record = _record(trigger, "scheduleTrigger", "schedule")
+    schedule = _text(record, "schedule", "scheduleTrigger.schedule", "schedule", required=True, allow_empty=False)
+    time_zone = _text(record, "timeZone", "scheduleTrigger.timeZone", "schedule")
+    # The SDK keeps a deployment expression as braced CEL; this runner resolves values, it does not evaluate CEL.
+    if "{{" in schedule or (time_zone is not None and "{{" in time_zone):
+        raise Unserved("schedule", "unsupported", "scheduleTrigger contains an unresolved deployment expression")
+    retry_config = _numbers(record.get("retryConfig"), "scheduleTrigger.retryConfig", _SCHEDULE_RETRY_FIELDS, "schedule")
+    # A Gen2 job with a retry window and no count is retried until the window ends (run 156715222b86ea44), so a
+    # window alone declares a retry too.
+    retry = (retry_config.get("retryCount") or 0) > 0 or (retry_config.get("maxRetrySeconds") or 0) > 0
+    described: dict[str, Any] = {"type": "schedule", "schedule": schedule}
+    if time_zone is not None:
+        described["timeZone"] = time_zone
+    described["retryConfig"] = retry_config
+    return described, retry
+
+
+def _task_queue_trigger(queue) -> dict:
+    record = _record(queue, "taskQueueTrigger", "tasks")
+    return {
+        "type": "tasks",
+        "retryConfig": _numbers(record.get("retryConfig"), "taskQueueTrigger.retryConfig", _TASK_RETRY_FIELDS, "tasks"),
+        "rateLimits": _numbers(record.get("rateLimits"), "taskQueueTrigger.rateLimits", _TASK_RATE_FIELDS, "tasks"),
+    }
+
+
+def _blocking_trigger(blocking) -> dict:
+    record = _record(blocking, "blockingTrigger", "blocking")
+    event_type = str(_resolved(record.get("eventType"), "blockingTrigger.eventType") or "")
+    if not any(event_type.endswith(event) for event in _BLOCKING_AUTH_EVENTS):
+        for fragment, trigger_type, scope, reason in _UNSERVED_PRODUCTS:
+            if fragment in event_type:
+                raise Unserved(trigger_type, scope, reason)
+        raise Unserved("blocking", "unsupported", f"blocking identity event {event_type} is not served")
+    options = record.get("options") if isinstance(record.get("options"), dict) else {}
+    return {
+        "type": "blockingAuth",
+        "eventType": event_type,
+        "accessToken": options.get("accessToken") is True,
+        "idToken": options.get("idToken") is True,
+        "refreshToken": options.get("refreshToken") is True,
+    }
+
+
+def describe_endpoint(name: str, endpoint, app_check_verified: bool = False) -> dict:
+    """The canonical `functions[]` entry of one endpoint, or `Unserved` when it cannot be served."""
+    if endpoint.platform != "gcfv2":
+        raise Unserved("unknown", "unsupported", "endpoint platform is not recognised")
+    described: dict[str, Any] = {"name": name, "entryPoint": name, "generation": 2}
+    region = _first_region(endpoint)
+    if region:
+        described["region"] = region
+    timeout = _non_negative_integer(endpoint.timeoutSeconds, "timeoutSeconds")
+    if timeout:
+        described["timeoutSeconds"] = timeout
+    concurrency = _non_negative_integer(endpoint.concurrency, "concurrency")
+    if concurrency is not None:
+        described["concurrency"] = concurrency
+    options = _platform_options(endpoint)
+    if options:
+        described["platformOptions"] = options
+    if endpoint.taskQueueTrigger is not None:
+        described["trigger"] = _task_queue_trigger(endpoint.taskQueueTrigger)
+        return described
+    if endpoint.httpsTrigger is not None:
+        described["trigger"] = {"type": "http", "callable": False}
+    elif endpoint.callableTrigger is not None:
+        described["trigger"] = {"type": "http", "callable": True}
+        if app_check_verified:
+            # The SDK verifies the token itself, against the App Check emulator's keys, and never consumes it.
+            described["trigger"]["consumeAppCheckToken"] = "disabled"
+    elif endpoint.scheduleTrigger is not None:
+        described["trigger"], described["retry"] = _schedule_trigger(endpoint.scheduleTrigger)
+    elif endpoint.blockingTrigger is not None:
+        described["trigger"] = _blocking_trigger(endpoint.blockingTrigger)
+    elif endpoint.eventTrigger is not None:
+        described["trigger"] = _event_trigger(endpoint.eventTrigger)
+        retry = _resolved(endpoint.eventTrigger.get("retry"), "eventTrigger.retry")
+        if retry is not None and not isinstance(retry, bool):
+            raise Unserved(described["trigger"]["type"], "unsupported", "eventTrigger.retry did not resolve to a boolean")
+        described["retry"] = retry is True
+    else:
+        raise Unserved("unknown", "unsupported", "the endpoint declares no trigger")
+    return described
+
+
+def build_manifest(functions: dict, app_check_verified: bool = False) -> dict:
+    """`{"functions": [...], "ignored": [...]}` for the decorated functions of a codebase.
+
+    `app_check_verified` says the Admin SDK verifies App Check tokens against the emulator's keys (`appcheck.py`).
+    """
+    served: list[dict] = []
+    ignored: list[dict] = []
+    for name, function in functions.items():
+        endpoint = function.__firebase_endpoint__
+        try:
+            served.append(describe_endpoint(name, endpoint, app_check_verified))
+        except Unserved as unserved:
+            try:
+                region = _first_region(endpoint) or DEFAULT_REGION
+            except Unserved:
+                region = DEFAULT_REGION
+            ignored.append(
+                {
+                    "name": name,
+                    "region": region,
+                    "triggerType": unserved.trigger_type,
+                    "scope": unserved.scope,
+                    "reason": unserved.reason,
+                }
+            )
+    return {"functions": served, "ignored": ignored}

package/bin/runner-python/fireemu_runner/request_view.py

@@ -0,0 +1,65 @@
+"""The HTTP request a CloudEvent function runs inside.
+
+functions-framework serves a CloudEvent function from a Flask view and calls the function inside the request context, so
+`flask.request` shows the delivered request. Production's raw twins were recorded on 2026-11-04 (sandbox run
+PYCHECK-EVENTS-20261104-01): `POST /` with the binary-mode `ce-*` headers, `content-type`, `content-length` and, in the strict
+profile, constants every recorded frame carries (the sender's user agent, the encodings, the protocol) plus Cloud Run's plain
+`traceparent` header. The body is the text the delivery had, not a re-encoding of the event: the layouts recorded per family are in
+`bodies.py` (strict Pub/Sub and Storage; Eventarc keeps the publisher's text), and the emulator and unset profiles carry the framed JSON value text
+of the data as the daemon sent it (a publisher's surrounding white space is trimmed upstream; a Pub/Sub body is the exception, it gets the SDK's snake-case aliases and is rewritten compactly). A Realtime Database body was not recorded. Header policy: a name that is not an HTTP token (or has an underscore) is
+left out of the request, a control character other than TAB in a value becomes a space, and of two names that differ only in case the first one
+is the header; the event the function receives is never changed by the view. The OIDC `Authorization`, `Forwarded`, `X-Forwarded-For`, `Function-Execution-Id`, `X-Cloud-Trace-Context`,
+`From`, `Accept` and the Cloud Run host have no local source and are not invented.
+"""
+
+import contextlib
+import re
+
+import flask
+from werkzeug.test import EnvironBuilder
+
+from .events import is_strict
+
+_APP = flask.Flask("fireemu-cloudevent")
+# What an HTTP header may be called: a token without an underscore. Header names with an underscore are dropped by the usual
+# servers, and Werkzeug folds `foo_bar` into `foo-bar`; both are UNRECORDED, so such an attribute stays out of the request
+# (the event keeps it).
+_HEADER_NAME = re.compile(r"[!#$%&'*+.^`|~0-9A-Za-z-]+")
+# A control character other than the tab cannot be in a header value; it becomes a space, as a line break does.
+_CONTROL = re.compile(r"[\x00-\x08\x0a-\x1f\x7f]")
+# Constant in every recorded Eventarc delivery (the four raw twins of run 57ab27296dedaedc).
+_STRICT_CONSTANTS = {
+    "user-agent": "APIs-Google; (+https://developers.google.com/webmasters/APIs-Google.html)",
+    "accept-encoding": "gzip, deflate, br",
+    "x-forwarded-proto": "https",
+}
+
+
+def request_headers(headers: dict, event: dict) -> dict:
+    """The headers of the request: the event's binary-mode headers, and in the strict profile the recorded constants and the
+    trace context as the plain `traceparent` header.
+
+    The request is what a server would have received, so a name that is not a header name is left out, and when two names
+    differ only in case the first one stays. A control character in a value other than the tab, a line break included, is
+    replaced by a space. The event the function receives keeps every attribute and its text.
+    """
+    view = {}
+    taken = set()
+    for name, value in headers.items():
+        if _HEADER_NAME.fullmatch(name) and name.lower() not in taken:
+            taken.add(name.lower())
+            view[name] = _CONTROL.sub(" ", value)
+    if is_strict():
+        view.update(_STRICT_CONSTANTS)
+        traceparent = event.get("traceparent")
+        if isinstance(traceparent, str):
+            view["traceparent"] = _CONTROL.sub(" ", traceparent)
+    return view
+
+
+@contextlib.contextmanager
+def delivery_request(headers: dict, body: bytes, event: dict):
+    """Runs the block inside the Flask request context of the delivery described by `headers` and `body`."""
+    environ = EnvironBuilder(method="POST", path="/", headers=request_headers(headers, event), data=body).get_environ()
+    with _APP.request_context(environ):
+        yield

package/bin/runner-python/fireemu_runner/scheduler.py

@@ -0,0 +1,87 @@
+"""Scheduled runs: the request Cloud Scheduler sends a Gen2 function, built in process.
+
+A Gen2 `on_schedule` function is an HTTP function. Production's Scheduler calls it with `POST /`, the job id in
+`X-CloudScheduler-JobName` and the schedule time in `X-CloudScheduler-ScheduleTime`, and judges the attempt by the
+status the SDK wrapper answers: 200, or 500 when the handler raised (the wrapper logs the error and answers its
+message, `scheduler_fn.py:99-137`). The Node runner does the same in the strict profile
+(`tools/runner-node/schedule-delivery.mjs`, recorded in run 156715222b86ea44).
+"""
+
+import datetime
+import os
+import re
+from zoneinfo import ZoneInfo
+
+import flask
+from werkzeug.test import EnvironBuilder
+
+_INSTANT = re.compile(r"^(\d{4})-(\d\d)-(\d\d)T(\d\d):(\d\d):(\d\d)(?:\.(\d{1,9}))?Z$")
+_LOS_ANGELES = ZoneInfo("America/Los_Angeles")
+_JOB_NAME = re.compile(r"projects/([^/]*)/locations/([^/]*)/jobs/")
+_NAME = re.compile(r"[A-Za-z0-9-]+")
+_MAX_ANSWER_CHARS = 256
+
+
+class SchedulerFailure(Exception):
+    """A scheduled attempt that failed: the run was malformed or the function answered 400 or more."""
+
+
+def _schedule_time(instant) -> str:
+    """The schedule time as the header carries it: Los Angeles with its offset in the strict profile (whatever the
+    job's own zone, as recorded), the daemon's UTC instant otherwise."""
+    match = _INSTANT.match(instant) if isinstance(instant, str) else None
+    if match is None:
+        raise SchedulerFailure(f"the scheduled time is not an RFC 3339 UTC instant: {instant!r}")
+    year, month, day, hour, minute, second = (int(part) for part in match.groups()[:6])
+    try:
+        moment = datetime.datetime(year, month, day, hour, minute, second, tzinfo=datetime.timezone.utc)
+    except ValueError:
+        raise SchedulerFailure(f"the scheduled time is not an RFC 3339 UTC instant: {instant!r}") from None
+    if os.environ.get("FIREEMU_HTTP_PROFILE", "emulator") != "strict":
+        return instant
+    local = moment.astimezone(_LOS_ANGELES)
+    fraction = (match.group(7) or "").rstrip("0")
+    offset = local.strftime("%z")
+    return local.strftime("%Y-%m-%dT%H:%M:%S") + (f".{fraction}" if fraction else "") + f"{offset[:3]}:{offset[3:]}"
+
+
+def _function_host(job: str) -> str | None:
+    """The public host of a function, `<region>-<project>.cloudfunctions.net`, from a job's resource name.
+
+    Recorded for us-central1 only (all 76 distinct Gen2 frames of run 156715222b86ea44); another region follows the
+    same rule, unrecorded. A name without a project and a location in this form invents no host (the Node runner's
+    `functionHost`).
+    """
+    match = _JOB_NAME.match(job)
+    if match is None or not _NAME.fullmatch(match.group(1)) or not _NAME.fullmatch(match.group(2)):
+        return None
+    return f"{match.group(2)}-{match.group(1)}.cloudfunctions.net"
+
+
+def scheduler_headers(data) -> dict:
+    """The headers of the request for one scheduled run (`{jobName, scheduleTime}`)."""
+    job = data.get("jobName") if isinstance(data, dict) else None
+    if not isinstance(job, str) or not job:
+        raise SchedulerFailure("the scheduled run names no job name")
+    host = _function_host(job)
+    return {
+        "x-cloudscheduler": "true",
+        "x-cloudscheduler-jobname": job.rsplit("/", 1)[-1],
+        "x-cloudscheduler-scheduletime": _schedule_time(data.get("scheduleTime")),
+        "user-agent": "Google-Cloud-Scheduler",
+        "content-length": "0",
+        # Constant in every recorded frame: the front end's encodings and protocol.
+        "accept-encoding": "gzip, deflate, br",
+        "x-forwarded-proto": "https",
+        **({"host": host} if host else {}),
+    }
+
+
+def deliver_schedule(function, data) -> None:
+    """Calls the SDK wrapper with the scheduler's request. Returns when it answers below 400; raises otherwise."""
+    environ = EnvironBuilder(method="POST", path="/", headers=scheduler_headers(data)).get_environ()
+    with flask.Flask("fireemu-scheduler").request_context(environ):
+        response = function(flask.request)
+    if response.status_code >= 400:
+        body = response.get_data(as_text=True)[:_MAX_ANSWER_CHARS]
+        raise SchedulerFailure(f"the scheduled function answered {response.status_code}" + (f": {body}" if body else ""))