@fireemu/linux-x64 0.10.0 → 0.12.0

package/README.md

@@ -1,7 +1,7 @@
 # @fireemu/linux-x64
 
 The [fireemu](https://www.npmjs.com/package/fireemu) daemon built for `linux-x64`
-(Rust target `x86_64-unknown-linux-musl`), version 0.10.0.
+(Rust target `x86_64-unknown-linux-musl`), version 0.12.0.
 
 Statically linked against musl: any glibc or musl distribution, including distroless and Alpine.
 

package/bin/runner-node/index.mjs

@@ -22,6 +22,7 @@ import { blockingResult } from "./blocking-response.mjs";
 import { boundLogMessage, createInvocationLogger } from "./log-context.mjs";
 import { invocationFailure } from "./invocation-error.mjs";
 import { InvocationBudget, readFrames } from "./protocol.mjs";
+import { deliverSchedule, v1ScheduleContext } from "./schedule-delivery.mjs";
 import { collectFunctions, exportNamespace } from "./discovery.mjs";
 import { FrameWriter } from "./output.mjs";
 import { installDiagnosticOutput } from "./diagnostic-output.mjs";
@@ -619,7 +620,14 @@ function describeSchedule(base, value) {
     SCHEDULE_RETRY_FIELDS, base.generation === 1 ? V1_SCHEDULE_DURATIONS : undefined);
   return {
     ...base,
-    retry: (retryConfig.retryCount ?? 0) > 0,
+    // Production retries a Gen2 job (HTTP target) with a retry window and no count until the window ends (a job with
+    // `maxRetryDuration: 30s` and no `retryCount` was attempted four times in run 156715222b86ea44), so a window
+    // alone is a retry declaration there too. A Gen1 schedule's job targets Pub/Sub, so Cloud Scheduler's retry covers
+    // the publish and never the handler: `schedFailV1`'s handler threw at each occurrence, ran once per occurrence,
+    // and every attempt of its job finished without an error. A Gen1 handler is not retried at all.
+    retry:
+      base.generation !== 1 &&
+      ((retryConfig.retryCount ?? 0) > 0 || (retryConfig.maxRetrySeconds ?? 0) > 0),
     trigger: { type: "schedule", schedule, timeZone, retryConfig },
   };
 }
@@ -1056,6 +1064,40 @@ function describe(name, fn, instrumentation) {
 
 // v1 functions are called as (data, context) with the legacy event shapes.
 
+// An RFC 3339 time with exactly three fractional digits (the extra digits are cut), or the input
+// unchanged when it is not a time.
+function millisecondTimestamp(time) {
+  const parsed = new Date(time);
+  return Number.isNaN(parsed.getTime()) ? time : parsed.toISOString();
+}
+
+// The members of a 2nd gen Storage event's `data` in the order production hands them over (recorded,
+// FE v5 production run functions-events-formal-20261004T182904Z-a9621bfae74fe9bc: kind, id, selfLink,
+// name, bucket, generation, metageneration, contentType, timeCreated, updated, [timeDeleted],
+// storageClass, timeStorageClassUpdated, size, md5Hash, mediaLink, [metadata], crc32c, etag; the order
+// of all 44 recorded v2 frames is in tests/fixtures/production-storage-v5-v2-member-orders.json).
+// The runtime's JSON lists members by name; a member the recordings never showed follows the recorded
+// ones in name order.
+const STORAGE_OBJECT_MEMBERS = [
+  "kind", "id", "selfLink", "name", "bucket", "generation", "metageneration", "contentType",
+  "timeCreated", "updated", "timeDeleted", "storageClass", "timeStorageClassUpdated", "size", "md5Hash",
+  "mediaLink", "metadata", "crc32c", "etag",
+];
+function storageObjectInRecordedOrder(data) {
+  if (data === null || typeof data !== "object" || Array.isArray(data)) return data;
+  const ordered = {};
+  for (const key of STORAGE_OBJECT_MEMBERS) {
+    if (Object.hasOwn(data, key)) ordered[key] = data[key];
+  }
+  for (const key of Object.keys(data).sort()) {
+    if (!Object.hasOwn(ordered, key)) ordered[key] = data[key];
+  }
+  return ordered;
+}
+
+/** Whether the daemon runs the strict profile (production's behaviour where the official emulator differs). */
+const strictProfile = () => process.env.FIREEMU_HTTP_PROFILE === "strict";
+
 function v1Context(msg) {
   const event = msg.event;
   switch (msg.trigger) {
@@ -1078,15 +1120,26 @@ function v1Context(msg) {
         eventType: legacy,
         // A string: firebase-functions rewrites a legacy event type's resource into
         // { service, name } itself (makeCloudFunction); an object here would be nested.
-        resource: event.source,
+        resource: [event.project, event.database, event.document].every(
+          value => typeof value === "string" && value.length > 0,
+        )
+          ? `projects/${event.project}/databases/${event.database}/documents/${event.document}`
+          : event.source,
         params: event.params || {},
+        // Production's Gen1 Firestore context has an empty `notSupported` member (all 60 recorded frames).
+        notSupported: {},
       };
     }
     case "storage": {
       const o = event.data;
       return {
         eventId: event.id,
-        timestamp: event.time,
+        // Production hands a 1st gen Storage handler a timestamp with exactly three fractional
+        // digits (observed 2026-10-01: `2026-10-01T08:49:26.577Z`, after the object's
+        // `timeCreated` of `.486Z`). The runtime admits the event later than it creates the
+        // object, so the timestamp is cut from the admission instant the frame carries; the
+        // CloudEvent time of a finalize event is the creation instant.
+        timestamp: millisecondTimestamp(msg.admittedAt ?? event.time),
         eventType: {
           "google.cloud.storage.object.v1.finalized": "google.storage.object.finalize",
           "google.cloud.storage.object.v1.deleted": "google.storage.object.delete",
@@ -1095,15 +1148,20 @@ function v1Context(msg) {
         }[event.type],
         // The official emulator's legacy storage event resource: no generation suffix, and
         // a `type` member (its createLegacyEventRequestBody).
+        // Members in the order production hands them over (recorded, FE v5, 2026-10-04: name,
+        // service, type; the order is observable through Object.keys and JSON.stringify).
         resource: {
-          service: "storage.googleapis.com",
           name: `projects/_/buckets/${o.bucket}/objects/${o.name}`,
+          service: "storage.googleapis.com",
           type: "storage#object",
         },
         params: {},
       };
     }
     case "schedule":
+      // The strict profile hands a Gen1 handler the context of the Pub/Sub message production's Scheduler
+      // published (run 156715222b86ea44): see schedule-delivery.mjs.
+      if (strictProfile()) return v1ScheduleContext(event);
       return {
         eventId: event.id,
         timestamp: event.time,
@@ -1113,11 +1171,18 @@ function v1Context(msg) {
       };
     case "pubsub": {
       const topic = String(event.source || "").replace(/^\/\/pubsub\.googleapis\.com\//, "");
+      // Production (functions-events-formal run a9621bfae74fe9bc, handler pubsubPublishedV1): the
+      // timestamp has exactly three fraction digits and the resource carries the message type.
       return {
         eventId: event.id,
-        timestamp: event.time,
+        timestamp: millisecondTimestamp(event.time),
         eventType: "google.pubsub.topic.publish",
-        resource: { service: "pubsub.googleapis.com", name: topic },
+        // Members in the order of the recorded frames (FE v5 and v7: name, service, type).
+        resource: {
+          name: topic,
+          service: "pubsub.googleapis.com",
+          type: "type.googleapis.com/google.pubsub.v1.PubsubMessage",
+        },
         params: {},
       };
     }
@@ -1137,6 +1202,8 @@ function v1Context(msg) {
             : "providers/firebase.auth/eventTypes/user.create",
         resource: project,
         params: {},
+        // As Firestore's: all 28 recorded Gen1 Auth frames carry an empty `notSupported` member.
+        notSupported: {},
       };
     }
     default:
@@ -1346,6 +1413,54 @@ async function makeHttpServer(functions, manifest) {
   });
 }
 
+let writtenFirestoreCodec;
+
+function firestoreProtoTimestamp(value) {
+  if (typeof value !== "string") return value;
+  const match = /^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.(\d{1,9}))?(Z|[+-]\d{2}:\d{2})$/.exec(value);
+  if (!match) throw new Error("invalid Firestore protobuf timestamp");
+  const milliseconds = Date.parse(`${match[1]}${match[3]}`);
+  if (!Number.isFinite(milliseconds)) throw new Error("invalid Firestore protobuf timestamp");
+  return { seconds: Math.floor(milliseconds / 1000), nanos: Number((match[2] ?? "").padEnd(9, "0")) };
+}
+
+function firestoreProtoFields(fields) {
+  return Object.fromEntries(Object.entries(fields ?? {}).map(([key, value]) => {
+    const converted = { ...value };
+    if (value.timestampValue !== undefined) converted.timestampValue = firestoreProtoTimestamp(value.timestampValue);
+    if (value.mapValue !== undefined) converted.mapValue = { fields: firestoreProtoFields(value.mapValue.fields) };
+    if (value.arrayValue !== undefined) {
+      converted.arrayValue = { values: (value.arrayValue.values ?? []).map(item => firestoreProtoFields({ item }).item) };
+    }
+    return [key, converted];
+  }));
+}
+
+function writtenFirestoreEvent(event) {
+  if (!["google.cloud.firestore.document.v1.written", "google.cloud.firestore.document.v1.written.withAuthContext"].includes(event.type) ||
+      !event.datacontenttype?.includes("application/json")) return event;
+  // The SDK's protobuf decoder derives missing snapshot paths from typed metadata,
+  // independently of the canonical database source. Reuse the codebase's shipped codec.
+  if (!writtenFirestoreCodec) {
+    const require = createRequire(join(sourceDir, "package.json"));
+    const { root } = firebaseFunctionsPackage(require);
+    writtenFirestoreCodec = require(join(root, "protos/compiledFirestore.js")).google.events.cloud.firestore.v1.DocumentEventData;
+  }
+  const data = { ...event.data };
+  for (const side of ["value", "oldValue"]) {
+    if (data[side] === undefined || data[side] === null) continue;
+    const document = { ...data[side], fields: firestoreProtoFields(data[side].fields) };
+    for (const time of ["createTime", "updateTime"]) {
+      if (document[time] !== undefined) document[time] = firestoreProtoTimestamp(document[time]);
+    }
+    data[side] = document;
+  }
+  const message = writtenFirestoreCodec.fromObject(data);
+  const invalid = writtenFirestoreCodec.verify(message);
+  if (invalid) throw new Error(`invalid Firestore protobuf event: ${invalid}`);
+  return { ...event, datacontenttype: "application/protobuf", data: Buffer.from(writtenFirestoreCodec.encode(message).finish()) };
+}
+
 async function invoke(functions, manifest, msg) {
   const spec = manifest.functions.find((f) => f.name === msg.function);
   if (!spec) throw new Error("unknown function");
@@ -1372,12 +1487,23 @@ async function invoke(functions, manifest, msg) {
       }
       switch (msg.trigger) {
         case "schedule": {
+          // The strict profile calls the function the way production's Scheduler does, through its HTTP wrapper,
+          // so the SDK builds the event from the scheduler headers (job id, Los Angeles time, `context` getter)
+          // and its own error handling runs. A bare handler (no separate wrapper) is called directly.
+          if (strictProfile() && typeof fn.run === "function" && fn.run !== fn) {
+            await deliverSchedule(fn, msg.event.data);
+            return;
+          }
           const run = fn.run || fn;
           await run(msg.event.data);
           return;
         }
         case "firestore":
+          await fn(writtenFirestoreEvent(msg.event));
+          return;
         case "storage":
+          await fn({ ...msg.event, data: storageObjectInRecordedOrder(msg.event.data) });
+          return;
         case "pubsub":
         // A custom event reaches the handler as the CloudEvent itself, exactly as the official
         // Eventarc emulator POSTs it to the functions emulator.

package/bin/runner-node/schedule-delivery.mjs

@@ -0,0 +1,208 @@
+// How the strict profile delivers a scheduled run the way production's Cloud Scheduler does, recorded in the second
+// SCHEDULED-FUNCTIONS delivery recording (run 156715222b86ea44, 2026-10-05, 97 handler frames, project
+// fireemu-oracle-sbx, us-central1):
+//
+// - a Gen2 `onSchedule` function is called as an HTTP function: `POST /` with `x-cloudscheduler: true`, the job's id in
+//   `x-cloudscheduler-jobname` (not its resource name) and the schedule time in `x-cloudscheduler-scheduletime`
+//   written in America/Los_Angeles with its offset (`2026-10-05T01:45:00-07:00`) whatever the job's own time zone
+//   (UTC and Asia/Tokyo jobs alike), `user-agent: Google-Cloud-Scheduler`, an empty body. The SDK builds the event
+//   from those headers, including the non-enumerable `context` getter, and answers 200, or 500 when the handler
+//   throws (after logging the error); the Scheduler judges the attempt by that status.
+// - a Gen1 `pubsub.schedule` handler gets the context of a Pub/Sub message published to the job's topic: a
+//   17-digit message id as `eventId`, the topic as `resource.name`, `resource.type` the PubsubMessage type, and the
+//   message's publish time (milliseconds at most, trailing zeros dropped) as `timestamp`.
+//
+// The Authorization (OIDC) header, trace headers, `forwarded` and `x-forwarded-for` of the recording are not
+// reproduced: nothing here can sign a token for Google, and the others carry a trace id and a client address.
+import { createHash } from "node:crypto";
+
+const INSTANT = /^(\d{4})-(\d\d)-(\d\d)T(\d\d):(\d\d):(\d\d)(?:\.(\d{1,9}))?Z$/;
+
+function parseInstant(value, what) {
+  const match = typeof value === "string" ? INSTANT.exec(value) : null;
+  if (!match) throw new Error(`the ${what} is not an RFC 3339 UTC instant: ${String(value)}`);
+  const [year, month, day, hour, minute, second] = match.slice(1, 7).map(Number);
+  const millis = Date.UTC(year, month - 1, day, hour, minute, second);
+  const back = new Date(millis);
+  if (
+    back.getUTCFullYear() !== year ||
+    back.getUTCMonth() !== month - 1 ||
+    back.getUTCDate() !== day ||
+    back.getUTCHours() !== hour ||
+    back.getUTCMinutes() !== minute ||
+    back.getUTCSeconds() !== second
+  )
+    throw new Error(`the ${what} is not an RFC 3339 UTC instant: ${value}`);
+  return { millis, fraction: (match[7] ?? "").replace(/0+$/, ""), digits: match[7] ?? "" };
+}
+
+const LOS_ANGELES = new Intl.DateTimeFormat("en-US", {
+  timeZone: "America/Los_Angeles",
+  hourCycle: "h23",
+  year: "numeric",
+  month: "2-digit",
+  day: "2-digit",
+  hour: "2-digit",
+  minute: "2-digit",
+  second: "2-digit",
+});
+
+/** An RFC 3339 UTC instant written in America/Los_Angeles with its offset, the fraction kept without trailing zeros. */
+export function schedulerTimestamp(instant) {
+  const { millis, fraction } = parseInstant(instant, "scheduled time");
+  const parts = Object.fromEntries(
+    LOS_ANGELES.formatToParts(new Date(millis)).map((part) => [part.type, part.value]),
+  );
+  const local = Date.UTC(
+    Number(parts.year),
+    Number(parts.month) - 1,
+    Number(parts.day),
+    Number(parts.hour),
+    Number(parts.minute),
+    Number(parts.second),
+  );
+  const offset = (local - millis) / 60_000;
+  const sign = offset < 0 ? "-" : "+";
+  const abs = Math.abs(offset);
+  const clock = `${parts.hour}:${parts.minute}:${parts.second}`;
+  const zone = `${sign}${String(Math.floor(abs / 60)).padStart(2, "0")}:${String(abs % 60).padStart(2, "0")}`;
+  return `${parts.year}-${parts.month}-${parts.day}T${clock}${fraction ? "." + fraction : ""}${zone}`;
+}
+
+/** The job id: the last segment of a job's resource name (an id passes through). */
+export function schedulerJobId(jobName) {
+  if (typeof jobName !== "string" || jobName.length === 0)
+    throw new Error("the scheduled run names no job name");
+  return jobName.split("/").at(-1);
+}
+
+const NAME = /^[A-Za-z0-9-]+$/;
+
+/**
+ * The public host of a function: `<region>-<project>.cloudfunctions.net`, from the project and location of a job's
+ * resource name (recorded: `us-central1-<project>.cloudfunctions.net` in all 76 distinct Gen2 frames of run 2 and the 3
+ * of run 1; the host is the host of the job's `httpTarget.uri`, which firebase-tools writes). Only us-central1 was
+ * recorded: for another region the host follows the same rule, unrecorded, and no handler can read it. A job id alone
+ * names neither, and then no host is invented.
+ */
+function functionHost(jobName) {
+  const match = /^projects\/([^/]*)\/locations\/([^/]*)\/jobs\//.exec(String(jobName));
+  return match && NAME.test(match[1]) && NAME.test(match[2])
+    ? `${match[2]}-${match[1]}.cloudfunctions.net`
+    : undefined;
+}
+
+/** The request production's Cloud Scheduler sends a Gen2 function, as an Express-like object. */
+export function schedulerRequest({ jobName, scheduleTime }) {
+  const host = functionHost(jobName);
+  const headers = {
+    "x-cloudscheduler": "true",
+    "x-cloudscheduler-jobname": schedulerJobId(jobName),
+    "x-cloudscheduler-scheduletime": schedulerTimestamp(scheduleTime),
+    "user-agent": "Google-Cloud-Scheduler",
+    "content-length": "0",
+    // constant in every recorded frame: the front end's encodings and protocol
+    "accept-encoding": "gzip, deflate, br",
+    "x-forwarded-proto": "https",
+    ...(host ? { host } : {}),
+  };
+  const header = (name) => headers[String(name).toLowerCase()];
+  return {
+    method: "POST",
+    url: "/",
+    originalUrl: "/",
+    headers,
+    header,
+    get: header,
+    body: undefined,
+    rawBody: undefined,
+  };
+}
+
+function responseDouble() {
+  const res = {
+    statusCode: 200,
+    answered: false,
+    status(code) {
+      res.statusCode = code;
+      return res;
+    },
+    sendStatus(code) {
+      res.statusCode = code;
+      res.answered = true;
+      return res;
+    },
+    send() {
+      res.answered = true;
+      return res;
+    },
+    json() {
+      res.answered = true;
+      return res;
+    },
+    end() {
+      res.answered = true;
+      return res;
+    },
+    setHeader() {
+      return res;
+    },
+    set() {
+      return res;
+    },
+    header() {
+      return res;
+    },
+  };
+  return res;
+}
+
+/**
+ * Calls a Gen2 scheduled function's HTTP wrapper with the scheduler's request. Resolves when the function answered
+ * with a status below 400; rejects when it answered 400 or more (the SDK's 500 for a handler that threw), threw, or
+ * never answered.
+ */
+export async function deliverSchedule(fn, data) {
+  const res = responseDouble();
+  await fn(schedulerRequest(data), res);
+  if (!res.answered) throw new Error("the scheduled function did not answer");
+  if (res.statusCode >= 400) throw new Error(`the scheduled function answered ${res.statusCode}`);
+}
+
+/** A Pub/Sub message id: 17 digits, the first a 2, derived from the event id (the same event, the same id). */
+export function pubsubMessageId(eventId) {
+  if (typeof eventId !== "string" || eventId.length === 0)
+    throw new Error("a Pub/Sub message id needs an event id");
+  const digest = createHash("sha256").update(eventId).digest();
+  const number = digest.readBigUInt64BE(0) % 10_000_000_000_000_000n;
+  return "2" + number.toString().padStart(16, "0");
+}
+
+/** The id of the message the runtime published for this occurrence, when it published one and the id has the recorded form. */
+function publishedMessageId(value) {
+  return typeof value === "string" && /^2\d{16}$/.test(value) ? value : null;
+}
+
+/** A publish time as Pub/Sub prints it to a Gen1 handler: milliseconds at most, trailing zeros dropped. */
+function publishTime(instant) {
+  const { millis, digits } = parseInstant(instant, "publish time");
+  const fraction = digits.padEnd(3, "0").slice(0, 3).replace(/0+$/, "");
+  return new Date(millis).toISOString().slice(0, 19) + (fraction ? "." + fraction : "") + "Z";
+}
+
+/** The context of a Gen1 `pubsub.schedule` handler: the message published to the job's topic. */
+export function v1ScheduleContext(event) {
+  const id = schedulerJobId(event?.data?.jobName);
+  const project = String(event.data.jobName).match(/^projects\/([^/]+)\//)?.[1];
+  return {
+    eventId: publishedMessageId(event.data.messageId) ?? pubsubMessageId(event.id),
+    eventType: "google.pubsub.topic.publish",
+    resource: {
+      name: project ? `projects/${project}/topics/${id}` : id,
+      service: "pubsub.googleapis.com",
+      type: "type.googleapis.com/google.pubsub.v1.PubsubMessage",
+    },
+    timestamp: publishTime(event.time),
+    params: {},
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fireemu/linux-x64",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "The fireemu daemon for linux-x64",
   "homepage": "https://github.com/t-k/fireemu#readme",
   "repository": {