Bound the Cloudflare WordPress runtime

Author: chubes4

package.json

@@ -95,6 +95,8 @@
     "smoke": "tsx scripts/run-smoke.ts",
     "test:redaction": "tsx tests/redaction.test.ts",
     "test:cloudflare-runtime": "tsx tests/cloudflare-runtime.test.ts && node ./node_modules/typescript/bin/tsc -p packages/runtime-cloudflare --noEmit",
+    "test:cloudflare-wordpress-auth": "tsx tests/cloudflare-wordpress-auth.test.ts",
+    "test:cloudflare-wordpress-archive-corpus": "tsx tests/cloudflare-wordpress-archive-corpus.test.ts",
     "test:agent-task-contracts": "tsx tests/agent-task-contracts.test.ts && tsx tests/agent-task-canonical-evidence.test.ts && npm run test:agent-task-workflow-interface && npm run test:runtime-sources-materialization && tsx tests/agent-task-reusable-workflow.test.ts",
     "test:agent-task-workflow-interface": "tsx tests/run-agent-task-reusable-workflow-interface.test.ts",
     "test:agent-task-runtime-package-staging": "tsx tests/agent-task-runtime-package-staging.test.ts",

packages/runtime-cloudflare/README.md

@@ -8,15 +8,19 @@ The entry Worker executes PHP-WASM and WordPress. The named `WordPressStateCoord
 
 On cold start, the entry Worker uses the acquired pointer to rebuild PHP-WASM's disposable SQLite index from canonical MDI Markdown and JSON files. A missing pointer materializes the packaged canonical MDI seed and boots one PHP-WASM primary runtime. The build-time PHP CLI generator creates that archive from `wordpress-install-seed.sqlite` through MDI's public `bootstrap_existing_cache()` API, validates its pinned MDI revision and input digest, and never packages SQLite. The runtime updates `siteurl` and `home` through WordPress APIs using the request origin and sets the admin password from `WORDPRESS_ADMIN_PASSWORD`; only WordPress's password hash is canonical. Bootstrap persists and CAS-promotes this mutation before serving the next request.
 
+Canonical browser, health, and mutation boots require the separately managed `WORDPRESS_AUTH_SECRET` Worker secret. The entry Worker derives the eight WordPress auth keys and salts from that secret with a versioned, site-scoped (`default`) SHA-256 domain separator before `wp-load.php`. It never logs, persists, or returns the secret or derived values. Configure it independently from the bootstrap password with `wrangler secret put WORDPRESS_AUTH_SECRET --config packages/runtime-cloudflare/wrangler.jsonc`; rotating `WORDPRESS_ADMIN_PASSWORD` does not rotate authentication salts or invalidate sessions.
+
 After each mutating HTTP request, the entry runtime invokes MDI's explicit request-boundary flush, collects canonical files, stores immutable content-addressed R2 objects and a revision manifest, then commits the new pointer through the held lease. GET, HEAD, and asset requests release without promotion. Failed requests abort their leases; stale leases recover by token/version/expiry checks. The entry isolate can cache one runtime only for the exact acquired pointer revision and exits it after promotion or when another isolate advances the pointer. It does not persist SQLite. Existing manifests are reused when canonical file hashes have not changed.
 
+The Worker forwards browser cookies directly to Playground and disables Playground's internal cookie store, preventing an empty per-isolate store from replacing a valid browser session after cold restart. `?phase=canonical-auth` is a boolean-only diagnostic for the canonical runtime; it reports cookie parsing and verification stages without returning credential, token, hash, or salt material.
+
 The bundled MDI source is pinned to immutable commit `1870fb41279e7eb5946e506c9c7406f1f1ea6dc3` from [MDI PR #127](https://github.com/Automattic/markdown-database-integration/pull/127). The bundle generator, worker provenance, and source-contract test use the same revision.
 
 ## Verification
 
 1. Run `npm run generate:cloudflare-canonical-mdi-seed` to regenerate the deterministic canonical MDI archive and provenance manifest.
 2. Run `npm run test:cloudflare-runtime` for routing, canonical-state, generator reproducibility, filtered archive, source contract, and TypeScript coverage.
 3. Run `npm run cloudflare:dry-run` to compile the Worker without creating Cloudflare resources.
-4. Run `npm run cloudflare:local-gate` for isolated local workerd evidence. It injects a test admin password and verifies the login form, cookie-authenticated admin redirect, authenticated REST post publication, public rendering, representative frontend/admin assets, PHP diagnostics, and the same login/post checks after a cold restart using the persisted R2/DO state.
+4. Run `npm run cloudflare:local-gate` for isolated local workerd evidence. It injects stable test-only admin-password and auth-secret values, verifies the login form, cookie-authenticated admin redirect, authenticated REST post publication, public rendering, representative frontend/admin/editor assets, PHP diagnostics, an existing authenticated cookie after cold restart, and a fresh login after restart.
 
 This document describes local candidate verification only. It does not claim remote deployment.

packages/runtime-cloudflare/src/request-routing.ts

@@ -3,6 +3,7 @@ export type WorkerRequestRoute =
   | { kind: "health" }
   | { kind: "r2-state" }
   | { kind: "r2-mutate" }
+  | { kind: "canonical-auth" }
   | { kind: "probe"; phase: string }
 
 export function routeWorkerRequest(request: Request): WorkerRequestRoute {
@@ -11,5 +12,6 @@ export function routeWorkerRequest(request: Request): WorkerRequestRoute {
   if (phase === "health") return { kind: "health" }
   if (phase === "r2-state") return { kind: "r2-state" }
   if (phase === "r2-mutate") return { kind: "r2-mutate" }
+  if (phase === "canonical-auth") return { kind: "canonical-auth" }
   return { kind: "probe", phase }
 }

packages/runtime-cloudflare/src/wordpress-auth.ts

@@ -0,0 +1,14 @@
+export const WORDPRESS_AUTH_CONSTANTS = ["AUTH_KEY", "SECURE_AUTH_KEY", "LOGGED_IN_KEY", "NONCE_KEY", "AUTH_SALT", "SECURE_AUTH_SALT", "LOGGED_IN_SALT", "NONCE_SALT"] as const
+
+export type WordPressAuthConstant = (typeof WORDPRESS_AUTH_CONSTANTS)[number]
+
+export async function deriveWordPressAuthConstants(rootSecret: string, site: string): Promise<Record<WordPressAuthConstant, string>> {
+  if (!rootSecret) throw new Error("WORDPRESS_AUTH_SECRET is required for canonical WordPress runtime boots.")
+  const encoder = new TextEncoder()
+  const entries = await Promise.all(WORDPRESS_AUTH_CONSTANTS.map(async (name) => {
+    const input = encoder.encode(`wp-codebox/wordpress-auth/v1\0${site}\0${name}\0${rootSecret}`)
+    const digest = await crypto.subtle.digest("SHA-256", input)
+    return [name, Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("")] as const
+  }))
+  return Object.fromEntries(entries) as Record<WordPressAuthConstant, string>
+}

packages/runtime-cloudflare/src/wordpress-runtime-corpus.ts

@@ -0,0 +1,33 @@
+export interface WordPressArchiveEntry {
+  path: string
+  uncompressedSize: number
+  isDirectory: boolean
+}
+
+const REQUIRED_RUNTIME_EXTENSION = /\.(?:php|json|crt|html)$/
+const RUNTIME_FONT_OR_IMAGE_EXTENSION = /\.(?:woff2?|ttf|otf|eot|svg|png|jpe?g|gif|webp|avif|ico)$/
+const RUNTIME_SCRIPT_OR_STYLE_EXTENSION = /\.(?:css|js|mjs)$/
+
+export function isWordPressRuntimeFile(path: string, archivePaths: ReadonlySet<string>): boolean {
+  if (!path.startsWith("wordpress/") || path.endsWith("/") || path.endsWith(".map")) return false
+  if (path.startsWith("wordpress/wp-content/themes/")) return true
+  if (REQUIRED_RUNTIME_EXTENSION.test(path)) return true
+  if (path.includes("/src/") || path.includes("/test/") || path.includes("/tests/") || path.includes("/node_modules/")) return false
+  if (RUNTIME_FONT_OR_IMAGE_EXTENSION.test(path)) return true
+  if (!RUNTIME_SCRIPT_OR_STYLE_EXTENSION.test(path)) return false
+  if (path.endsWith(".mjs") || path.endsWith(".min.js") || path.endsWith(".min.css")) return true
+
+  const minifiedSibling = path.replace(/\.(?:js|css)$/, (extension) => `.min${extension}`)
+  return !archivePaths.has(minifiedSibling)
+}
+
+export function summarizeWordPressRuntimeCorpus(entries: Iterable<WordPressArchiveEntry>) {
+  const entryList = Array.from(entries)
+  const archivePaths = new Set(entryList.map((entry) => entry.path))
+  const selected = entryList.filter((entry) => !entry.isDirectory && isWordPressRuntimeFile(entry.path, archivePaths))
+  return {
+    selected,
+    selectedFiles: selected.length,
+    selectedBytes: selected.reduce((total, entry) => total + entry.uncompressedSize, 0),
+  }
+}