@wp-playground/remote 3.1.61 → 3.1.62

package/lib/blueprints-worker.d.ts

@@ -1,9 +1,15 @@
 import type { EmscriptenDownloadMonitor } from '@php-wasm/progress';
 import { PlaygroundWorkerEndpoint, type WorkerBootOptions } from './playground-worker-endpoint';
+import type { PHP } from '@php-wasm/universal';
 export declare class PlaygroundWorkerEndpointBlueprints extends PlaygroundWorkerEndpoint {
     constructor(monitor: EmscriptenDownloadMonitor, privateReady: () => void, privateError: (error: Error) => void);
     private ready;
     private failed;
-    /** Boot PHP using the app document's origin choice, including when script bytes are cached. */
-    boot({ scope, useWordPressSandbox, mounts, wpVersion, wordPressZip, sqliteDriverVersion, phpVersion, sapiName, extensions, withNetworking, shouldInstallWordPress, wordpressInstallMode, blueprint, corsProxyUrl, pathAliases, }: WorkerBootOptions): Promise<void>;
+    /** Boot PHP for the build-configured WordPress origin and this site's mounts. */
+    boot({ scope, mounts, wpVersion, wordPressZip, sqliteDriverVersion, phpVersion, sapiName, extensions, withNetworking, shouldInstallWordPress, wordpressInstallMode, blueprint, corsProxyUrl, pathAliases, }: WorkerBootOptions): Promise<void>;
+    /**
+     * Migrates mounted site data once per public URL and saves it before recording
+     * completion. New sites only need the record for their first save.
+     */
+    protected migrateSiteUrl(php: PHP, siteUrl: string): Promise<void>;
 }

package/lib/boot-playground-remote.d.ts

@@ -11,6 +11,10 @@ export declare const serviceWorkerUrl: URL;
  * origin configured, the rendered WordPress iframe uses wordPressSiteUrl; this
  * document and PHP do not move.
  *
+ * Finish activating the app service worker before starting PHP's module worker.
+ * WebKit can interrupt that worker's script download if a service-worker update
+ * takes over during the download, leaving the embed on its "Try again" screen.
+ *
  * The returned API's boot() method starts PHP and connects HTTP requests to it.
  * With separate origins it creates a hidden WordPress-origin request iframe;
  * with one origin a dedicated runtime uses the existing service-worker listener.

package/lib/config.d.ts

@@ -5,18 +5,13 @@
  */
 export declare const playgroundOrigin: string;
 /**
- * Fixed sandbox origin available to ?reprint sessions. The flag selects this
- * origin; its value must never supply a hostname. Normal sessions keep WordPress
- * on the app origin. PHP, OPFS, and directory handles stay there in both modes.
+ * Render every WordPress page on the build-configured sandbox, regardless of
+ * feature flags. PHP, OPFS, and picked directory handles stay on the app origin.
+ * For example, playground.wordpress.net runs PHP while wpsandbox.wordpress.net
+ * serves its WordPress pages. Query parameters must not move those pages back
+ * onto the app origin, where their scripts could directly read saved files.
  * Loopback development offers the remote server's existing port; standalone and
  * custom hosts without a configured sandbox keep one origin.
  */
-export declare const wordPressSandboxOrigin: string;
-/**
- * Select once for this document. remote.html sends its choice in PHP boot options.
- * Helper and thumbnail documents already on the sandbox origin keep
- * that origin even though ordinary WordPress URLs do not contain the flag.
- * Service workers route by their own origin, never by a tab's startup flag.
- */
 export declare const wordPressSiteUrl: string;
 export declare const DOCROOT = "/wordpress";

package/lib/connect-shared-runtime.d.ts

@@ -5,7 +5,7 @@ export type SharedRuntimeAPI = PlaygroundWorkerEndpoint & {
     finishSharedRuntimeInitialization(): Promise<void>;
 };
 /**
- * Join this site's shared PHP worker, preserving remote.html's origin choice.
+ * Join this site's shared PHP worker using the build-configured WordPress origin.
  * Sandbox sessions use the HTTP helper, not a direct app-service-worker port.
  */
 export declare function connectSharedRuntime(scope: string, version: string, clientVersion: string, onProgress?: (caption: string) => void): Promise<{

package/lib/connect-wordpress-origin.d.ts

@@ -4,7 +4,7 @@ import type { PlaygroundWorkerEndpoint } from './playground-worker-endpoint';
  * Connect WordPress HTTP requests on a separate origin to this app-origin PHP worker.
  *
  * For example, remote.html on playground.wordpress.net runs PHP, but the visible
- * WordPress iframe loads wp.playground.wordpress.net/scope:site-a/. The WordPress
+ * WordPress iframe loads wpsandbox.wordpress.net/scope:site-a/. The WordPress
  * service worker cannot message remote.html directly: it can only reach windows
  * on its own origin. This function creates a hidden WordPress-origin iframe as
  * a sibling of the visible WordPress iframe. Requests take this path:
@@ -24,9 +24,16 @@ import type { PlaygroundWorkerEndpoint } from './playground-worker-endpoint';
  * and listener remain for the lifetime of remote.html. If no ready message arrives
  * within 30 seconds, both are removed and the promise rejects.
  *
+ * The helper URL includes the buildVersion of the app loading this iframe.
+ * A WordPress worker installed during a previous visit may still be running.
+ * If the URL names a different buildVersion, that worker must let the request
+ * reach the server rather than generate HTML naming its own release's script,
+ * which the server may no longer serve. The deployed helper then registers
+ * the deployed WordPress worker and waits for it to activate.
+ *
  * After connection, reject app-service-worker HTTP requests for this scope with
- * 404. That worker also serves ordinary, same-origin sites. Returning this site's
- * HTML there would let its scripts run on the app origin with app storage access.
+ * 404. Returning this site's HTML there would let its scripts run on the app
+ * origin with app storage access, bypassing the sandbox origin entirely.
  * The rejection listener lasts with remote.html and survives worker restarts.
  *
  * The scope selects a PHP instance; it does not prove which WordPress page made

package/lib/playground-client.d.ts

@@ -66,8 +66,12 @@ export interface WebClientMixin extends ProgressReceiver {
      *
      * @param name The tool name as announced by `onWebMCPToolsChanged`.
      * @param args The tool input.
+     * @param callId An optional identifier used to cancel this call. Use a fresh ID
+     * for each invocation; an already-pending ID is rejected.
      */
-    callWebMCPTool(name: string, args: Record<string, unknown>): Promise<unknown>;
+    callWebMCPTool(name: string, args: Record<string, unknown>, callId?: string): Promise<unknown>;
+    /** Signals cancellation to a pending tool inside the WordPress document. */
+    cancelWebMCPTool(callId: string): Promise<void>;
     /**
      * The onDownloadProgress event listener.
      */

package/lib/playground-worker-endpoint.d.ts

@@ -13,8 +13,6 @@ export interface MountDescriptor {
     initialSyncDirection: 'opfs-to-memfs' | 'memfs-to-opfs';
 }
 export type WorkerBootOptions = {
-    /** remote.html selects this from its startup flag, not the cached worker URL. */
-    useWordPressSandbox?: boolean;
     wpVersion?: string;
     /** A caller-provided WordPress archive used instead of downloading one. */
     wordPressZip?: File;
@@ -73,8 +71,8 @@ export declare abstract class PlaygroundWorkerEndpoint extends PHPWorker {
     private emailParsingQueue;
     protected downloadMonitor: EmscriptenDownloadMonitor;
     constructor(monitor: EmscriptenDownloadMonitor);
-    /** Use the boot message's choice so a cached script cannot select another tab's mode. */
-    protected computeSiteUrl(scope: string, useWordPressSandbox?: boolean): string;
+    /** Give PHP the same public WordPress origin used by its iframe and HTTP helper. */
+    protected computeSiteUrl(scope: string): string;
     /**
      * Create the PHP runtime pool and route siteUrl requests into its WordPress files.
      *

package/lib/webmcp-frame-bridge.d.ts

@@ -12,11 +12,16 @@ export interface WebMCPToolDescriptor {
     annotations?: {
         readOnlyHint?: boolean;
         destructiveHint?: boolean;
+        consequentialHint?: boolean;
+        untrustedContentHint?: boolean;
+        debugging?: boolean;
     };
 }
 export interface WebMCPFrameBridge {
     subscribe(listener: (tools: WebMCPToolDescriptor[]) => void): void;
-    callTool(name: string, args: Record<string, unknown>): Promise<unknown>;
+    /** Use a fresh call ID for each invocation; pending duplicates are rejected. */
+    callTool(name: string, args: Record<string, unknown>, callId?: string): Promise<unknown>;
+    cancelTool(callId: string): void;
 }
 /**
  * Mirrors the WordPress document's WebMCP tools into this frame and forwards

package/lib/wordpress-bridge-path.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Give each app build its own helper document URL.
+ *
+ * For example, a browser can still run release A's WordPress worker after
+ * release B is deployed. A's helper HTML names A's script, which B may no longer
+ * serve. Including B's buildVersion in the helper path lets that request reach
+ * the server, so the deployed helper can load its script and update the worker
+ * before PHP startup finishes.
+ */
+export declare function getWordPressBridgePath(buildVersion: string): string;
+/**
+ * Recognize the unversioned /wordpress-bridge.html and its build-version aliases.
+ * Servers map every alias to the deployed release's wordpress-bridge.html file;
+ * the version cannot select a historical release, an app document, or PHP.
+ * Git builds use a hexadecimal commit ID; builds outside Git use a timestamp.
+ */
+export declare function isWordPressBridgePath(pathname: string): boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@wp-playground/remote",
-	"version": "3.1.61",
+	"version": "3.1.62",
 	"description": "WordPress Playground remote host",
 	"repository": {
 		"type": "git",
@@ -25,5 +25,5 @@
 		"access": "public",
 		"directory": "../../../dist/packages/playground/remote"
 	},
-	"gitHead": "1e779217fceedb5b29b1359a196dc97ce40f31de"
+	"gitHead": "8c52f103f3ce30668994c0e75c2c530b82097a5e"
 }

package/lib/wordpress-origin.d.ts

@@ -1,9 +0,0 @@
-/**
- * Select the configured sandbox for ?reprint; never take a hostname from its value.
- *
- * For example, app/remote.html?reprint selects the sandbox. A WordPress page
- * already on that sandbox keeps it without putting ?reprint on every navigation.
- * Other app documents use the app origin.
- * The presence of the flag enables the sandbox, even for ?reprint=0.
- */
-export declare function selectWordPressOrigin(context: URL, appOrigin: string, sandboxOrigin: string): string;