@fireemu/win32-x64 0.7.0 → 0.8.0

package/bin/runner-node/invocation-error.mjs

@@ -0,0 +1,29 @@
+import { boundLogMessage } from './log-context.mjs';
+
+// User callbacks may reject with anything, including throwing getters or a
+// revoked Proxy. Error formatting must not reject a second time and strand the
+// daemon's invocation waiter. Do not invoke arbitrary toString/toJSON hooks.
+export function invocationFailure(error) {
+  let message = 'Function invocation failed';
+  if (typeof error === 'string') {
+    message = error;
+  } else {
+    try {
+      const candidate = error?.message;
+      if (typeof candidate === 'string') message = candidate;
+    } catch {
+      // Fixed fallback. The accessor's thrown value is not itself formatted.
+    }
+  }
+  let diagnostic = message;
+  try {
+    const stack = error?.stack;
+    if (typeof stack === 'string') diagnostic = stack;
+  } catch {
+    // Preserve the usable message when only stack access fails.
+  }
+  return {
+    message: boundLogMessage(message, 4096),
+    diagnostic: boundLogMessage(diagnostic),
+  };
+}

package/bin/runner-node/output.mjs

@@ -0,0 +1,204 @@
+// A bounded, ordered writer for the runner's private stdout protocol channel.
+// Limits are local resource policies, not Firebase quotas. They count encoded
+// pending frames (including the stream's in-flight write), not process-wide RSS.
+import { performance } from 'node:perf_hooks';
+import { MAX_FRAME_BYTES } from './protocol.mjs';
+
+export const MAX_PENDING_BYTES = 32 * 1024 * 1024;
+export const MAX_PENDING_FRAMES = 1024;
+export const MAX_OUTPUT_WAIT_MS = 30_000;
+export const OUTPUT_FINISH_MS = 1_000;
+
+export class OutputError extends Error {
+  constructor(reason) {
+    super(`runner output failed (${reason})`);
+    this.name = 'OutputError';
+  }
+}
+
+function limit(value, maximum, name) {
+  if (!Number.isSafeInteger(value) || value < 1 || value > maximum) {
+    throw new TypeError(`invalid output ${name}`);
+  }
+  return value;
+}
+
+export class FrameWriter {
+  #stream;
+  #write;
+  #onError;
+  #maxBytes;
+  #maxFrames;
+  #waitMs;
+  #finishMs;
+  #queue = [];
+  #current = null;
+  #bytes = 0;
+  #frames = 0;
+  #blocked = false;
+  #blockedAt = 0;
+  #writing = false;
+  #encoding = false;
+  #failed = false;
+  #closing = false;
+  #closeAt = Infinity;
+  #finishPromise;
+  #finishResolve;
+  #timer = null;
+
+  constructor(stream, {
+    onError,
+    maxBytes = MAX_PENDING_BYTES,
+    maxFrames = MAX_PENDING_FRAMES,
+    waitMs = MAX_OUTPUT_WAIT_MS,
+    finishMs = OUTPUT_FINISH_MS,
+  } = {}) {
+    if (typeof stream?.write !== 'function' || typeof stream?.on !== 'function' ||
+        typeof onError !== 'function') throw new TypeError('output stream and onError required');
+    this.#stream = stream;
+    // Capture before index.mjs redirects user stdout writes to stderr.
+    this.#write = stream.write.bind(stream);
+    this.#onError = onError;
+    this.#maxBytes = limit(maxBytes, MAX_PENDING_BYTES, 'bytes');
+    this.#maxFrames = limit(maxFrames, MAX_PENDING_FRAMES, 'frames');
+    this.#waitMs = limit(waitMs, MAX_OUTPUT_WAIT_MS, 'wait');
+    this.#finishMs = limit(finishMs, OUTPUT_FINISH_MS, 'finish wait');
+    stream.on('drain', () => {
+      if (this.#failed) return;
+      this.#blocked = false;
+      this.#pump();
+    });
+    // Keep the error listener after failure: a write callback can fail before
+    // the stream emits 'error'. Neither event may become an unhandled error.
+    stream.on('error', () => this.#fail('stream error'));
+    stream.on('close', () => this.#fail('stream closed'));
+    stream.on('finish', () => this.#fail('stream ended'));
+  }
+
+  get state() {
+    return Object.freeze({ pendingBytes: this.#bytes, pendingFrames: this.#frames,
+      backpressured: this.#blocked, failed: this.#failed, closing: this.#closing });
+  }
+
+  // true means admitted to the bounded queue, NOT delivered to the daemon.
+  send(message) {
+    if (this.#failed || this.#closing) return false;
+    if (this.#encoding) return this.#fail('reentrant serialization');
+    if (this.#frames >= this.#maxFrames) return this.#fail('frame queue limit');
+    let payload;
+    this.#encoding = true;
+    try {
+      const text = JSON.stringify(message);
+      if (typeof text !== 'string' || text[0] !== '{' || text.at(-1) !== '}') {
+        return this.#fail('message object');
+      }
+      const length = Buffer.byteLength(text, 'utf8');
+      if (length > MAX_FRAME_BYTES) return this.#fail('frame too large');
+      const prefix = `${length}\n`;
+      const size = Buffer.byteLength(prefix) + length;
+      if (this.#bytes + size > this.#maxBytes) return this.#fail('byte queue limit');
+      // One private Buffer/write per complete frame; never publish a length for
+      // a payload that fails size/serialization checks or replay a false write.
+      payload = Buffer.from(prefix + text, 'utf8');
+    } catch {
+      return this.#fail('serialization');
+    } finally {
+      this.#encoding = false;
+    }
+    if (this.#failed) return false;
+    this.#queue.push({ payload, size: payload.length, at: performance.now() });
+    this.#bytes += payload.length;
+    this.#frames += 1;
+    this.#pump();
+    return !this.#failed;
+  }
+
+  // Flush only already-admitted output on ordinary EOF/explicit shutdown.
+  // Does not wait for user callbacks, end process.stdout, or cancel side effects.
+  finish() {
+    if (this.#finishPromise) return this.#finishPromise;
+    this.#closing = true;
+    this.#closeAt = performance.now() + this.#finishMs;
+    this.#finishPromise = new Promise(resolve => { this.#finishResolve = resolve; });
+    if (this.#failed) this.#finishResolve(false);
+    else this.#pump();
+    return this.#finishPromise;
+  }
+
+  #fail(reason) {
+    if (this.#failed) return false;
+    this.#failed = true;
+    clearTimeout(this.#timer);
+    this.#timer = null;
+    this.#queue = [];
+    this.#current = null;
+    this.#bytes = 0;
+    this.#frames = 0;
+    this.#finishResolve?.(false);
+    // No raw payload or arbitrary error getters/stringification in diagnostics.
+    try { this.#onError(new OutputError(reason)); } catch { /* already failed */ }
+    return false;
+  }
+
+  #arm() {
+    clearTimeout(this.#timer);
+    this.#timer = null;
+    if (this.#failed) return;
+    const oldest = this.#current ?? this.#queue[0];
+    if (!oldest && !this.#blocked) {
+      if (this.#closing) this.#finishResolve?.(true);
+      return;
+    }
+    // Enqueues/drain/progress never renew the oldest frame's residence time.
+    let due = oldest ? oldest.at + this.#waitMs : Infinity;
+    if (this.#blocked) due = Math.min(due, this.#blockedAt + this.#waitMs);
+    due = Math.min(due, this.#closeAt);
+    const remaining = due - performance.now();
+    if (remaining <= 0) { this.#fail('deadline'); return; }
+    this.#timer = setTimeout(() => this.#arm(), Math.max(1, Math.ceil(remaining)));
+    // Intentionally referenced: pending output must not disappear on empty EOF.
+  }
+
+  #pump() {
+    if (this.#failed || this.#writing) return;
+    if (this.#stream.destroyed || this.#stream.writableEnded) {
+      this.#fail('stream unavailable'); return;
+    }
+    const pending = this.#current ?? this.#queue[0];
+    if (pending && (performance.now() >= pending.at + this.#waitMs ||
+                    performance.now() >= this.#closeAt)) {
+      this.#fail('deadline'); return;
+    }
+    this.#writing = true;
+    try {
+      while (!this.#failed && !this.#current && !this.#blocked && this.#queue.length) {
+        const entry = this.#queue.shift();
+        this.#current = entry;
+        let returned;
+        try {
+          returned = this.#write(entry.payload, error => {
+            if (this.#failed) return;
+            if (error) { this.#fail('write callback'); return; }
+            if (performance.now() >= entry.at + this.#waitMs ||
+                performance.now() >= this.#closeAt) { this.#fail('deadline'); return; }
+            if (this.#current !== entry) { this.#fail('write callback order'); return; }
+            this.#current = null;
+            this.#bytes -= entry.size;
+            this.#frames -= 1;
+            this.#pump();
+          });
+        } catch {
+          this.#fail('write'); break;
+        }
+        if (returned !== true && returned !== false) { this.#fail('write return'); break; }
+        if (returned === false) {
+          this.#blocked = true;
+          this.#blockedAt = entry.at;
+        }
+      }
+    } finally {
+      this.#writing = false;
+    }
+    this.#arm();
+  }
+}

package/bin/runner-node/protocol.mjs

@@ -0,0 +1,280 @@
+// Runtime -> runner: canonical decimal byte length, LF, UTF-8 JSON object.
+// Keep the byte cap in sync with fireemu-adapter-functions/src/protocol.rs.
+// This is a trusted local pipe, not an authentication or arbitrary-code sandbox.
+import { TextDecoder } from 'node:util';
+import { performance } from 'node:perf_hooks';
+import { setTimeout, clearTimeout } from 'node:timers';
+
+export const MAX_FRAME_BYTES = 16 * 1024 * 1024;
+// Local pipe safety policies, not Firebase invocation deadlines or quotas.
+export const MAX_INPUT_FRAME_WAIT_MS = 30_000;
+export const MAX_ACTIVE_INVOCATIONS = 4096;
+export const MAX_ACTIVE_INVOCATION_BYTES = 64 * 1024 * 1024;
+const MAX_HEADER_BYTES = String(MAX_FRAME_BYTES).length;
+const decoder = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
+
+export class ProtocolError extends Error {
+  constructor(reason) {
+    // Fixed diagnostics only: JSON.parse errors can include user payload bytes.
+    super(`invalid runner frame (${reason})`);
+    this.name = 'ProtocolError';
+  }
+}
+
+function object(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function text(value) {
+  return typeof value === 'string' && value.length > 0;
+}
+
+function decodeMessage(payload) {
+  let message;
+  try {
+    message = JSON.parse(decoder.decode(payload));
+  } catch {
+    throw new ProtocolError('UTF-8 or JSON');
+  }
+  if (!object(message)) throw new ProtocolError('message object');
+  if (message.type === 'shutdown') return message;
+  if (message.type !== 'invoke' || !text(message.invocationId) ||
+      !text(message.function) || !text(message.trigger) || !object(message.event) ||
+      (message.entryPoint !== undefined && !text(message.entryPoint))) {
+    throw new ProtocolError('message fields');
+  }
+  return message;
+}
+
+// At most one capped body allocation is retained. Chunking never causes repeated
+// concatenation of the growing body, and an over-limit header fails before that
+// allocation. Handlers run only after a complete frame has been decoded.
+export class FrameDecoder {
+  #onFrame;
+  #length = 0;
+  #digits = 0;
+  #body = null;
+  #offset = 0;
+  #ended = false;
+  #failed = false;
+  #now;
+  #waitMs;
+  #lastTime = null;
+  #deadline = null;
+
+  constructor(onFrame, { frameWaitMs = MAX_INPUT_FRAME_WAIT_MS,
+    now = () => performance.now() } = {}) {
+    if (typeof onFrame !== 'function' || typeof now !== 'function') {
+      throw new TypeError('onFrame and now must be functions');
+    }
+    if (!Number.isSafeInteger(frameWaitMs) || frameWaitMs < 1 ||
+        frameWaitMs > MAX_INPUT_FRAME_WAIT_MS) throw new TypeError('invalid input frame wait');
+    this.#onFrame = onFrame;
+    this.#waitMs = frameWaitMs;
+    this.#now = now;
+  }
+
+  #time() {
+    let value;
+    try { value = this.#now(); } catch { throw new ProtocolError('input clock'); }
+    if (typeof value !== 'number' || !Number.isFinite(value) || value < 0 ||
+        (this.#lastTime !== null && value < this.#lastTime)) {
+      throw new ProtocolError('input clock');
+    }
+    this.#lastTime = value;
+    return value;
+  }
+
+  #check(now = this.#time()) {
+    if (this.#deadline !== null && now >= this.#deadline) {
+      throw new ProtocolError('input frame deadline');
+    }
+  }
+
+  #fail(error) {
+    this.#failed = true;
+    this.#body = null;
+    this.#deadline = null;
+    throw error;
+  }
+
+  // Null when between frames. Partial headers and bodies share one deadline,
+  // measured from the first observed byte, never renewed by progress.
+  remainingTime() {
+    if (this.#failed) throw new ProtocolError('closed');
+    if (this.#ended || this.#deadline === null) return null;
+    try {
+      const now = this.#time();
+      this.#check(now);
+      return this.#deadline - now;
+    } catch (error) { return this.#fail(error); }
+  }
+
+  push(chunk) {
+    if (this.#failed) throw new ProtocolError('closed');
+    if (this.#ended) return;
+    try {
+      if (!Buffer.isBuffer(chunk)) throw new ProtocolError('non-byte input');
+      if (chunk.length === 0) { this.remainingTime(); return; }
+      // All bytes in a coalesced chunk arrived together. A slow synchronous
+      // onFrame must not give its trailing frame a fresh receive-time budget.
+      const receivedAt = this.#time();
+      this.#check(receivedAt);
+      let at = 0;
+      while (at < chunk.length && !this.#ended) {
+        if (this.#deadline === null) {
+          this.#deadline = receivedAt + this.#waitMs;
+          if (!Number.isFinite(this.#deadline) || this.#deadline <= receivedAt) {
+            throw new ProtocolError('input clock');
+          }
+        }
+        this.#check();
+        if (this.#body === null) {
+          const byte = chunk[at++];
+          if (byte === 10) {
+            if (this.#digits === 0) throw new ProtocolError('empty length');
+            this.#body = Buffer.allocUnsafe(this.#length);
+          } else {
+            if (byte < 48 || byte > 57 || (this.#digits === 0 && byte === 48)) {
+              throw new ProtocolError('decimal length');
+            }
+            this.#digits += 1;
+            this.#length = this.#length * 10 + byte - 48;
+            if (this.#digits > MAX_HEADER_BYTES || this.#length > MAX_FRAME_BYTES) {
+              throw new ProtocolError('frame too large');
+            }
+          }
+        } else {
+          const count = Math.min(chunk.length - at, this.#length - this.#offset);
+          chunk.copy(this.#body, this.#offset, at, at + count);
+          at += count;
+          this.#offset += count;
+          if (this.#offset !== this.#length) continue;
+          const message = decodeMessage(this.#body);
+          // Timers can run late. Check after decoding, before any user callback,
+          // so a late final chunk cannot race the timer into successful dispatch.
+          this.#check();
+          const payloadBytes = this.#length;
+          this.#body = null;
+          this.#offset = 0;
+          this.#length = 0;
+          this.#digits = 0;
+          this.#deadline = null;
+          // Byte accounting is the actual received payload length, not a
+          // caller-supplied field or a second JSON serialization.
+          if (this.#onFrame(message, payloadBytes) === false) this.#ended = true;
+        }
+      }
+    } catch (error) { this.#fail(error); }
+  }
+
+  end() {
+    if (this.#failed) throw new ProtocolError('closed');
+    if (this.#ended) return;
+    this.#ended = true;
+    if (this.#digits !== 0 || this.#body !== null) {
+      this.#fail(new ProtocolError('truncated'));
+    }
+  }
+}
+
+// Keep the active callback and environment-queue inputs bounded independently
+// of the output queue. A lease releases once, including on callback rejection.
+// Counts measure encoded input payload bytes, not V8 heap size or retained user
+// references after a callback returns. HTTP callbacks are not part of this pipe.
+export class InvocationBudget {
+  #active = new Map();
+  #bytes = 0;
+  #failed = false;
+  #maxCount;
+  #maxBytes;
+
+  constructor({ maxCount = MAX_ACTIVE_INVOCATIONS,
+    maxBytes = MAX_ACTIVE_INVOCATION_BYTES } = {}) {
+    if (!Number.isSafeInteger(maxCount) || maxCount < 1 || maxCount > MAX_ACTIVE_INVOCATIONS ||
+        !Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > MAX_ACTIVE_INVOCATION_BYTES) {
+      throw new TypeError('invalid invocation limits');
+    }
+    this.#maxCount = maxCount;
+    this.#maxBytes = maxBytes;
+  }
+
+  get state() {
+    return Object.freeze({ count: this.#active.size, payloadBytes: this.#bytes, failed: this.#failed });
+  }
+
+  #fail(reason) {
+    this.#failed = true;
+    throw new ProtocolError(reason);
+  }
+
+  reserve(id, payloadBytes) {
+    if (this.#failed) throw new ProtocolError('closed');
+    if (!text(id) || !Number.isSafeInteger(payloadBytes) || payloadBytes < 1 ||
+        payloadBytes > MAX_FRAME_BYTES) this.#fail('invocation accounting');
+    if (this.#active.has(id)) this.#fail('duplicate active invocation');
+    if (this.#active.size >= this.#maxCount) this.#fail('active invocation count');
+    if (this.#bytes + payloadBytes > this.#maxBytes) this.#fail('active invocation bytes');
+    const ticket = { payloadBytes };
+    this.#active.set(id, ticket);
+    this.#bytes += payloadBytes;
+    let released = false;
+    return () => {
+      if (released) return;
+      released = true;
+      // An old lease cannot release a later invocation that reuses the ID.
+      if (this.#active.get(id) !== ticket) return;
+      this.#active.delete(id);
+      this.#bytes -= payloadBytes;
+    };
+  }
+}
+
+export function readFrames(input, onFrame, onEnd, onError, options = {}) {
+  let stopped = false;
+  let timer = null;
+  const disarm = () => { clearTimeout(timer); timer = null; };
+  const pause = () => { try { input.pause(); } catch { /* already stopped */ } };
+  const stop = error => {
+    if (stopped) return;
+    stopped = true;
+    disarm();
+    pause();
+    // No parser message (or raw bytes) may widen this fixed diagnostic.
+    onError(error instanceof ProtocolError ? error : new ProtocolError('dispatch'));
+  };
+  const frames = new FrameDecoder((message, payloadBytes) => {
+    const keepReading = onFrame(message, payloadBytes);
+    if (keepReading === false) {
+      stopped = true;
+      disarm();
+      pause();
+    }
+    return keepReading;
+  }, options);
+  const arm = () => {
+    disarm();
+    if (stopped) return;
+    let remaining;
+    try { remaining = frames.remainingTime(); } catch (error) { stop(error); return; }
+    if (remaining === null) return; // Idle runner and in-flight user work have no frame timer.
+    timer = setTimeout(arm, Math.max(1, Math.ceil(remaining)));
+    // Referenced while a partial frame is held; never refresh from the latest byte.
+  };
+  input.on('data', chunk => {
+    if (stopped) return;
+    try { frames.push(chunk); } catch (error) { stop(error); return; }
+    arm();
+  });
+  input.on('end', () => {
+    if (stopped) return;
+    try { frames.end(); } catch (error) { stop(error); return; }
+    stopped = true;
+    disarm();
+    onEnd();
+  });
+  input.on('error', () => stop(new ProtocolError('input stream')));
+  // A close without end is not a clean EOF (for example, a destroyed pipe).
+  input.on('close', () => {
+    if (!stopped) stop(new ProtocolError('input closed'));
+  });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fireemu/win32-x64",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "The fireemu daemon for win32-x64",
   "homepage": "https://github.com/t-k/fireemu#readme",
   "repository": {