Load Cloudflare runtime dependencies from R2

Author: chubes4

packages/runtime-cloudflare/README.md

@@ -16,15 +16,15 @@ The Worker forwards browser cookies directly to Playground and disables Playgrou
 
 The bundled MDI source is pinned to immutable commit `2a8ee7f6a46e1d64b4606f1ee3c97e14032dc96c` from [MDI PR #139](https://github.com/Automattic/markdown-database-integration/pull/139). The bundle generator, worker provenance, and source-contract test use the same revision.
 
-WordPress server files and browser assets are separate deployment artifacts, never Worker-module imports. `generate:cloudflare-wordpress-runtime-corpus` downloads the pinned WordPress release once. It emits a deterministic server ZIP containing only `isWordPressRuntimeFile()` entries and one concatenated browser-asset blob containing the complete supported `wp-admin`, `wp-includes`, and bundled-theme surface. Checked-in manifests record the content-addressed R2 keys, hashes, budgets, and each browser asset's exact byte range. Cold boot validates and streams the server ZIP into PHP MEMFS. Browser requests use one bounded R2 range read, validate the selected bytes, and populate an immutable artifact-versioned Worker cache without fetching or decoding the WordPress release at request time.
+WordPress server files, browser assets, and pinned runtime dependencies are separate deployment artifacts, never Worker-module imports. `generate:cloudflare-wordpress-runtime-corpus` emits a deterministic server ZIP containing only `isWordPressRuntimeFile()` entries, one concatenated browser-asset blob containing the complete supported `wp-admin`, `wp-includes`, and bundled-theme surface, and the pinned SQLite integration ZIP. Checked-in manifests record content-addressed R2 keys, hashes, budgets, provenance, and each browser asset's exact byte range. Cold boot validates and streams the server ZIP into PHP MEMFS while loading SQLite integration from R2. Browser requests use one bounded R2 range read, validate the selected bytes, and populate an immutable artifact-versioned Worker cache. Runtime requests never fetch WordPress or SQLite integration release archives from third-party origins.
 
 Canonical Cloudflare boots patch only the assembled PHP MEMFS copy of `/wordpress/wp-settings.php` after the R2 WordPress corpus is materialized and before WordPress executes. The disabled-cron scheduling policy requires exactly one canonical `do_action( 'init' );` needle and fails closed otherwise. When `DISABLE_WP_CRON` is true, it removes only core's `wp_cron`, `wp_schedule_delete_old_privacy_export_files`, and `wp_schedule_update_checks` callbacks through public `remove_action()` before executing the original `init` call once. This prevents browser requests from recreating cron work that cannot execute in the PHP-WASM/MDI shutdown path. Durable cron execution belongs to a separate explicit queue or scheduled-Worker contract.
 ## Verification
 
 1. Run `npm run generate:cloudflare-canonical-mdi-seed` and `npm run generate:cloudflare-wordpress-runtime-corpus` to regenerate deterministic runtime artifacts and manifests.
-2. Run `npm run provision:cloudflare-wordpress-runtime-corpus -- --local --persist-to <directory>` to verify and upload both exact content-addressed artifacts into isolated local R2 storage. For an authorized deployment, run the provisioner with `--remote` and require both uploads to succeed before deploying the Worker that imports their manifests.
+2. Run `npm run provision:cloudflare-wordpress-runtime-corpus -- --local --persist-to <directory>` to verify and upload all exact content-addressed artifacts into isolated local R2 storage. For an authorized deployment, run the provisioner with `--remote` and require every upload to succeed before deploying the Worker that imports their manifests.
 3. Run `npm run test:cloudflare-runtime` for routing, canonical-state, artifact validation, source contract, and TypeScript coverage.
 4. Run `npm run cloudflare:dry-run` to compile the Worker without creating Cloudflare resources.
-5. Run `npm run cloudflare:local-gate` for isolated local workerd evidence. It generates and provisions both artifacts before workerd starts, then injects stable test-only admin-password and auth-secret values, verifies the login form, cookie-authenticated admin redirect, authenticated REST post publication, public rendering, representative frontend/admin/editor assets, PHP diagnostics, an existing authenticated cookie after cold restart, and a fresh login after restart.
+5. Run `npm run cloudflare:local-gate` for isolated local workerd evidence. It generates and provisions all artifacts before workerd starts, then injects stable test-only admin-password and auth-secret values, verifies the login form, cookie-authenticated admin redirect, authenticated REST post publication, public rendering, representative frontend/admin/editor assets, PHP diagnostics, an existing authenticated cookie after cold restart, and a fresh login after restart.
 
 This document describes local candidate verification only. It does not claim remote deployment.

packages/runtime-cloudflare/assets/sqlite-database-integration-artifact.json

@@ -0,0 +1,14 @@
+{
+  "schema": "wp-codebox/runtime-archive-artifact/v1",
+  "name": "sqlite-database-integration",
+  "key": "runtime/archives/sqlite-database-integration/f3bf0ac0bd80d374456c3742c3e2f987d060e8e35f4fe99925de2404ce05cbfb.zip",
+  "archive": {
+    "sha256": "f3bf0ac0bd80d374456c3742c3e2f987d060e8e35f4fe99925de2404ce05cbfb",
+    "size": 267173
+  },
+  "source": {
+    "url": "https://github.com/WordPress/sqlite-database-integration/releases/download/v2.2.23/plugin-sqlite-database-integration.zip",
+    "version": "2.2.23",
+    "identity": "\"0x8DE9712B1086587\""
+  }
+}

packages/runtime-cloudflare/src/runtime-archive-artifact.ts

@@ -0,0 +1,38 @@
+export const RUNTIME_ARCHIVE_ARTIFACT_SCHEMA = "wp-codebox/runtime-archive-artifact/v1"
+export const RUNTIME_ARCHIVE_MAX_BYTES = 8 * 1024 * 1024
+
+export interface RuntimeArchiveArtifactManifest {
+  schema: typeof RUNTIME_ARCHIVE_ARTIFACT_SCHEMA
+  name: string
+  key: string
+  archive: { sha256: string; size: number }
+  source: { url: string; version?: string; identity?: string }
+}
+
+export function runtimeArchiveArtifactKey(name: string, sha256: string): string {
+  if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(name)) throw new Error("Runtime archive artifact name is invalid.")
+  if (!/^[a-f0-9]{64}$/.test(sha256)) throw new Error("Runtime archive artifact hash must be a SHA-256 digest.")
+  return `runtime/archives/${name}/${sha256}.zip`
+}
+
+export function validateRuntimeArchiveArtifactManifest(manifest: RuntimeArchiveArtifactManifest): void {
+  if (manifest.schema !== RUNTIME_ARCHIVE_ARTIFACT_SCHEMA) throw new Error("Runtime archive artifact schema is invalid.")
+  if (manifest.key !== runtimeArchiveArtifactKey(manifest.name, manifest.archive.sha256)) throw new Error("Runtime archive artifact key is not content addressed.")
+  if (!Number.isSafeInteger(manifest.archive.size) || manifest.archive.size < 1 || manifest.archive.size > RUNTIME_ARCHIVE_MAX_BYTES) throw new Error("Runtime archive artifact size is outside the allowed budget.")
+  if (!manifest.source.url.startsWith("https://")) throw new Error("Runtime archive artifact source URL is invalid.")
+}
+
+export async function readRuntimeArchiveArtifact(bucket: R2Bucket, manifest: RuntimeArchiveArtifactManifest): Promise<Uint8Array> {
+  validateRuntimeArchiveArtifactManifest(manifest)
+  const object = await bucket.get(manifest.key)
+  if (!object) throw new Error(`Runtime archive artifact is unavailable: ${manifest.key}`)
+  if (object.size !== manifest.archive.size) throw new Error("Runtime archive artifact size does not match its manifest.")
+  const bytes = new Uint8Array(await object.arrayBuffer())
+  if (await sha256Hex(bytes) !== manifest.archive.sha256) throw new Error("Runtime archive artifact hash does not match its manifest.")
+  return bytes
+}
+
+async function sha256Hex(bytes: Uint8Array): Promise<string> {
+  const digest = await crypto.subtle.digest("SHA-256", Uint8Array.from(bytes).buffer)
+  return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("")
+}

packages/runtime-cloudflare/src/worker.ts

@@ -14,6 +14,7 @@ import { deriveWordPressAuthConstants, type WordPressAuthConstant } from "./word
 import { isWordPressRuntimeFile, wordpressStaticArchivePath, wordpressStaticContentType } from "./wordpress-runtime-corpus.js"
 import { materializeWordPressRuntimeArtifact, type WordPressRuntimeArtifactManifest } from "./wordpress-runtime-artifact.js"
 import { validateWordPressStaticArtifactManifest, type WordPressStaticArtifactManifest } from "./wordpress-static-artifact.js"
+import { readRuntimeArchiveArtifact, type RuntimeArchiveArtifactManifest } from "./runtime-archive-artifact.js"
 import type { MarkdownPointer } from "./state-coordinator.js"
 export { WordPressStateCoordinator } from "./state-coordinator.js"
 import markdownDatabaseIntegrationRuntime from "../assets/markdown-database-integration-runtime.zip"
@@ -23,12 +24,12 @@ import markdownPrimaryBootstrapIndex from "../assets/markdown-primary-bootstrap-
 import wordpressInstallSeed from "../assets/wordpress-install-seed.sqlite"
 import wordpressRuntimeArtifactManifest from "../assets/wordpress-runtime-artifact.json" with { type: "json" }
 import wordpressStaticArtifactManifest from "../assets/wordpress-static-artifact.json" with { type: "json" }
+import sqliteIntegrationArtifactManifest from "../assets/sqlite-database-integration-artifact.json" with { type: "json" }
 
 const PHP_VERSION = "8.5.8"
 const wordpressStaticArtifact = wordpressStaticArtifactManifest as WordPressStaticArtifactManifest
 validateWordPressStaticArtifactManifest(wordpressStaticArtifact)
 const wordpressStaticFiles = new Map(wordpressStaticArtifact.files.map((file) => [file.path, file]))
-const SQLITE_INTEGRATION_ARCHIVE_URL = "https://github.com/WordPress/sqlite-database-integration/releases/download/v2.2.23/plugin-sqlite-database-integration.zip"
 const MARKDOWN_DATABASE_INTEGRATION_REVISION = "2a8ee7f6a46e1d64b4606f1ee3c97e14032dc96c"
 const SITE_URL = "https://wp-codebox-runtime.invalid"
 const DATABASE_PATH = "/wordpress/wp-content/database/.ht.sqlite"
@@ -684,13 +685,12 @@ async function runBootProbe(phase: string, bucket: R2Bucket): Promise<Response>
   if (phase === "wordpress-archive" || phase === "sqlite-archive") {
     const archiveBytes = phase === "wordpress-archive"
       ? (await readWordPressRuntimeArtifact(bucket)).byteLength
-      : (await fetchArchive(SQLITE_INTEGRATION_ARCHIVE_URL, "sqlite-database-integration.zip")).size
+      : (await readSqliteIntegrationArtifact(bucket)).size
     return probeResponse(phase, { archiveBytes })
   }
 
   if (phase === "archives") {
-    const wordpressBytes = await readWordPressRuntimeArtifact(bucket)
-    const sqliteZip = await fetchArchive(SQLITE_INTEGRATION_ARCHIVE_URL, "sqlite-database-integration.zip")
+    const [wordpressBytes, sqliteZip] = await Promise.all([readWordPressRuntimeArtifact(bucket), readSqliteIntegrationArtifact(bucket)])
     return probeResponse(phase, { wordpressArchiveBytes: wordpressBytes.byteLength, sqliteArchiveBytes: sqliteZip.size })
   }
 
@@ -888,6 +888,8 @@ async function bootWordPressRuntime(
   shouldPatchCanonicalRuntimePoliciesAtInit = false,
   uploadFiles?: RuntimeFile[],
 ): Promise<{ php: PHP; requestHandler: PHPRequestHandler; wordpressVersion: string }> {
+  if (includeSqlite && !runtimeBucket) throw new Error("SQLite integration artifact requires WORDPRESS_STATE_BUCKET.")
+  const sqliteIntegrationPluginZip = includeSqlite ? readSqliteIntegrationArtifact(runtimeBucket!) : undefined
   const requestHandler = await bootWordPressAndRequestHandler({
     createPhpRuntime,
     constants: {
@@ -934,7 +936,7 @@ async function bootWordPressRuntime(
     phpVersion: "8.5",
     siteUrl,
     wordPressZip: undefined,
-    sqliteIntegrationPluginZip: includeSqlite ? fetchArchive(SQLITE_INTEGRATION_ARCHIVE_URL, "sqlite-database-integration.zip") : undefined,
+    sqliteIntegrationPluginZip,
     wordpressInstallMode,
   })
   const php = await requestHandler.getPrimaryPhp()
@@ -1088,6 +1090,12 @@ async function readWordPressRuntimeArtifact(bucket: R2Bucket): Promise<Uint8Arra
   return bytes
 }
 
+async function readSqliteIntegrationArtifact(bucket: R2Bucket): Promise<File> {
+  const manifest = sqliteIntegrationArtifactManifest as RuntimeArchiveArtifactManifest
+  const bytes = await readRuntimeArchiveArtifact(bucket, manifest)
+  return new File([Uint8Array.from(bytes).buffer], "sqlite-database-integration.zip", { type: "application/zip" })
+}
+
 async function serveWordPressUpload(request: Request, bucket: R2Bucket, coordinator: DurableObjectStub): Promise<Response | null> {
   if (request.method !== "GET" && request.method !== "HEAD") return null
   const url = new URL(request.url)
@@ -1220,12 +1228,6 @@ function createPhpRuntime() {
   )
 }
 
-async function fetchArchive(url: string, name: string): Promise<File> {
-  const response = await fetch(url)
-  if (!response.ok) throw new Error(`Unable to fetch ${name}: ${response.status}.`)
-  return new File([await response.arrayBuffer()], name, { type: "application/zip" })
-}
-
 function instantiatePrecompiledWasm(module: WebAssembly.Module) {
   return (imports: WebAssembly.Imports, receiveInstance: (instance: WebAssembly.Instance, wasmModule: WebAssembly.Module) => void) => receiveInstance(new WebAssembly.Instance(module, imports), module)
 }

scripts/generate-cloudflare-wordpress-runtime-corpus.ts

@@ -5,13 +5,17 @@ import { decodeZip, encodeZip } from "@php-wasm/stream-compression"
 import { isWordPressRuntimeFile, isWordPressStaticAsset } from "../packages/runtime-cloudflare/src/wordpress-runtime-corpus.js"
 import { WORDPRESS_RUNTIME_ARTIFACT_SCHEMA, wordpressRuntimeArtifactKey, type WordPressRuntimeArtifactManifest } from "../packages/runtime-cloudflare/src/wordpress-runtime-artifact.js"
 import { WORDPRESS_STATIC_ARTIFACT_SCHEMA, validateWordPressStaticArtifactManifest, wordpressStaticArtifactKey, type WordPressStaticArtifactManifest } from "../packages/runtime-cloudflare/src/wordpress-static-artifact.js"
+import { RUNTIME_ARCHIVE_ARTIFACT_SCHEMA, runtimeArchiveArtifactKey, validateRuntimeArchiveArtifactManifest, type RuntimeArchiveArtifactManifest } from "../packages/runtime-cloudflare/src/runtime-archive-artifact.js"
 
 const sourceUrl = process.env.WORDPRESS_RUNTIME_ARCHIVE_URL ?? "https://downloads.wordpress.org/release/wordpress-7.0.2.zip"
 const sourceVersion = process.env.WORDPRESS_RUNTIME_VERSION ?? "7.0.2"
 const output = resolve(process.env.WORDPRESS_RUNTIME_ARTIFACT_OUTPUT ?? "artifacts/cloudflare-wordpress-runtime-corpus.zip")
 const manifestOutput = resolve("packages/runtime-cloudflare/assets/wordpress-runtime-artifact.json")
 const staticOutput = resolve(process.env.WORDPRESS_STATIC_ARTIFACT_OUTPUT ?? "artifacts/cloudflare-wordpress-static-corpus.bin")
 const staticManifestOutput = resolve("packages/runtime-cloudflare/assets/wordpress-static-artifact.json")
+const sqliteSourceUrl = "https://github.com/WordPress/sqlite-database-integration/releases/download/v2.2.23/plugin-sqlite-database-integration.zip"
+const sqliteOutput = resolve("artifacts/cloudflare-sqlite-database-integration.zip")
+const sqliteManifestOutput = resolve("packages/runtime-cloudflare/assets/sqlite-database-integration-artifact.json")
 const response = await fetch(sourceUrl)
 if (!response.ok || !response.body) throw new Error(`Unable to download WordPress archive: ${response.status}.`)
 const identity = response.headers.get("etag") ?? response.headers.get("last-modified") ?? undefined
@@ -59,9 +63,26 @@ const staticManifest: WordPressStaticArtifactManifest = {
 validateWordPressStaticArtifactManifest(staticManifest)
 await writeFile(staticOutput, staticBlob)
 await writeFile(staticManifestOutput, `${JSON.stringify(staticManifest, null, 2)}\n`)
+
+const sqliteResponse = await fetch(sqliteSourceUrl)
+if (!sqliteResponse.ok) throw new Error(`Unable to download SQLite integration archive: ${sqliteResponse.status}.`)
+const sqliteArchive = new Uint8Array(await sqliteResponse.arrayBuffer())
+const sqliteSha256 = sha256Hex(sqliteArchive)
+const sqliteIdentity = sqliteResponse.headers.get("etag") ?? sqliteResponse.headers.get("last-modified") ?? undefined
+const sqliteManifest: RuntimeArchiveArtifactManifest = {
+  schema: RUNTIME_ARCHIVE_ARTIFACT_SCHEMA,
+  name: "sqlite-database-integration",
+  key: runtimeArchiveArtifactKey("sqlite-database-integration", sqliteSha256),
+  archive: { sha256: sqliteSha256, size: sqliteArchive.byteLength },
+  source: { url: sqliteSourceUrl, version: "2.2.23", ...(sqliteIdentity ? { identity: sqliteIdentity } : {}) },
+}
+validateRuntimeArchiveArtifactManifest(sqliteManifest)
+await writeFile(sqliteOutput, sqliteArchive)
+await writeFile(sqliteManifestOutput, `${JSON.stringify(sqliteManifest, null, 2)}\n`)
 console.log(JSON.stringify({
   runtime: { key: manifest.key, bytes: archive.byteLength, files: manifest.files.length, sha256: archiveSha256 },
   static: { key: staticManifest.key, bytes: staticBlob.byteLength, files: staticManifest.files.length, sha256: staticSha256 },
+  sqlite: { key: sqliteManifest.key, bytes: sqliteArchive.byteLength, sha256: sqliteSha256 },
   source: manifest.source,
 }))
 

scripts/provision-cloudflare-wordpress-runtime-corpus.mjs

@@ -17,10 +17,15 @@ const staticManifest = JSON.parse(await readFile("packages/runtime-cloudflare/as
 const staticBlob = await readFile("artifacts/cloudflare-wordpress-static-corpus.bin")
 const staticActual = createHash("sha256").update(staticBlob).digest("hex")
 if (staticActual !== staticManifest.blob.sha256 || staticBlob.byteLength !== staticManifest.blob.size || staticManifest.key !== `runtime/wordpress-static/${staticActual}.bin`) throw new Error("Local WordPress static artifact does not match its content-addressed manifest.")
+const sqliteManifest = JSON.parse(await readFile("packages/runtime-cloudflare/assets/sqlite-database-integration-artifact.json", "utf8"))
+const sqliteArchive = await readFile("artifacts/cloudflare-sqlite-database-integration.zip")
+const sqliteActual = createHash("sha256").update(sqliteArchive).digest("hex")
+if (sqliteActual !== sqliteManifest.archive.sha256 || sqliteArchive.byteLength !== sqliteManifest.archive.size || sqliteManifest.key !== `runtime/archives/sqlite-database-integration/${sqliteActual}.zip`) throw new Error("Local SQLite integration artifact does not match its content-addressed manifest.")
 
 for (const artifact of [
   { key: manifest.key, size: manifest.archive.size, file: "artifacts/cloudflare-wordpress-runtime-corpus.zip" },
   { key: staticManifest.key, size: staticManifest.blob.size, file: "artifacts/cloudflare-wordpress-static-corpus.bin" },
+  { key: sqliteManifest.key, size: sqliteManifest.archive.size, file: "artifacts/cloudflare-sqlite-database-integration.zip" },
 ]) {
   const command = ["exec", "--", "wrangler", "r2", "object", "put", `wp-codebox-runtime-chubes/${artifact.key}`, "--file", artifact.file, local ? "--local" : "--remote"]
   if (persistTo) command.push("--persist-to", persistTo)