Cloudflare control plane

D1 is WiseWig’s small, indexed platform control plane. It does not hold rendered pages or mutable draft documents; those remain tenant-local in TenantWorkspaceDO.

The initial D1 schema contains:

• tenants and agency memberships;
• sites and verified hostname-to-site routing;
• current client site-role assignments;
• later release/pinning, domain verification, and provisioning metadata.

D1ControlPlane resolves a normalized, verified hostname to { tenantId, siteId, slug }, checks tenant membership, and returns only valid current site roles. A malformed hostname is rejected before it reaches D1. All dynamic values are prepared-statement bindings.

The Worker uses this control-plane lookup before any private command or tenant Durable Object call. A public cache hit should avoid it entirely; on a miss, the lookup finds the published site route without exposing draft or membership data.