wasm: add experimental browser runtime and SDK

[edsiper]

Fluent Bit depends on native facilities that are unavailable in browsers. This PR adds an experimental Emscripten build profile and an asynchronous JavaScript SDK that run the engine in workers, ingest application logs, and export through browser Fetch.

The SDK supports start/stop/restart, bounded command admission, configuration assets, opt-in IndexedDB storage, namespace locking, checkpoint recovery, and status counters. Input acceptance is not a remote delivery acknowledgement. Persistent checkpoints require a stopped engine; failed checkpoints block restart until recovery succeeds.

Scope

• Pin Emscripten 6.0.9 and cross-compile SHA-256-pinned Lua 5.4.9, OpenSSL 3.5.8, and libyaml 0.2.5.
• Adapt engine lifecycle and the legacy/NG HTTP clients to Fetch, including cancellation and rejection of unsupported browser modes.
• Add the SDK, TypeScript declarations, browser demo, lifecycle/storage/startup fault tests, and optimized/ASan CI jobs.
• Preserve terminal SDK states when application callbacks force destruction during start/stop. Drain shutdown logs and remaining pthread workers, then explicitly close the SDK worker after its final reply.
• Keep compact sparse Lua arrays while treating very large numeric keys as maps. A record containing {[1000000000] = 7} remains small instead of expanding into a billion-element array. Add native and browser regression coverage.

The branch is rebased onto master 6dd3c50e4. Its flb_libco, Monkey, cmetrics, cprofiles, and ctraces trees match that base exactly. The required libco/Monkey browser support is already bundled on master; only ChunkIO browser filesystem changes remain in a separate bundled-library commit. Upstream dependency references: flb_libco #14, Monkey #448, and ChunkIO #116. No Emscripten SDK sources are patched.

Validation — 2026-09-30

Linux, Emscripten 6.0.9, Chromium 151, and Valgrind 3.23.0. Native verification used an isolated worktree whose tracked source was checked against the final branch; native and WASM builds did not share generated headers.

• Optimized WASM: 17/17 CTests passed. ASan WASM: 19/19 CTests passed.
• Real Chromium SDK and full HTTPS page suites passed in both configurations, including Lua, HTTP/Loki/OTLP, lifecycle reuse, persistent recovery, and teardown.
• Pthread startup-failure suites passed three times per configuration: 162 fault cases, including 18 delayed-handshake cases, with the original five-second worker-cleanup check retained.
• 23 Node contract tests, TypeScript 5.9.3 strict consumer check, and 15 Python browser-harness tests passed.
• Fresh native build: 8/8 focused CTests passed for Lua, SQL, YAML, scheduler, input chunks, engine, backlog, and lib output.
• Native functional integration: 118 passed, including startup helpers and the new large-key Lua regressions.
• Native strict-Valgrind integration: 112 passed: 27 Lua cases plus 85 HTTP/stdout/backlog/server cases, with strict memory checks enabled.
• Lua and SQL unit binaries passed strict Valgrind with zero errors and no remaining allocations.
• Full PR commit-range prefix lint and whitespace checks pass.

The ASan browser suites reject AddressSanitizer and LeakSanitizer diagnostics. Valgrind verifies native paths; it cannot instrument browser WASM. Hosted CI on the updated PR head is running. The system-library Clang job encountered a GitHub Server Error in the CMake setup action before Fluent Bit configuration; GitHub blocks retrying that job until its containing workflow run finishes.

Native verification commands, from the isolated worktree:

FLUENT_BIT_BINARY=/tmp/flb-wasm-native-fixes-20260930/build/bin/fluent-bit /home/edsiper/c/fluent-bit/tests/integration/.venv/bin/python -m pytest tests/integration/test_fluent_bit_manager_startup.py tests/integration/scenarios/filter_lua tests/integration/scenarios/out_http tests/integration/scenarios/out_stdout tests/integration/scenarios/in_storage_backlog tests/integration/scenarios/in_http tests/integration/scenarios/internal_http_server -q
FLUENT_BIT_BINARY=/tmp/flb-wasm-native-fixes-20260930/build/bin/fluent-bit VALGRIND=1 VALGRIND_STRICT=1 /home/edsiper/c/fluent-bit/tests/integration/.venv/bin/python -m pytest tests/integration/scenarios/filter_lua -q
FLUENT_BIT_BINARY=/tmp/flb-wasm-native-fixes-20260930/build/bin/fluent-bit VALGRIND=1 VALGRIND_STRICT=1 /home/edsiper/c/fluent-bit/tests/integration/.venv/bin/python -m pytest tests/integration/scenarios/out_http tests/integration/scenarios/out_stdout tests/integration/scenarios/in_storage_backlog tests/integration/scenarios/in_http tests/integration/scenarios/internal_http_server -q

Build and browser commands are documented in the browser guide.

Draft / production gates

The API remains experimental and requires a secure, cross-origin-isolated browser context and trusted application configuration. Outstanding work includes backlog budgets, delivery/drop observability, crash-safe delivery semantics, real quota/eviction/corruption/upgrade tests, Firefox/WebKit/mobile and production CSP/bundler qualification, long-running pressure tests, and release/security processes. Default ASan passes; optional stack-use-after-return still has the documented toolchain cleanup limitation. This draft does not claim production readiness.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}