Site resources: navigation, settings, and redirects

Navigation, global settings, and redirects are first-class typed resources rather than strings embedded in page sections.

Navigation

addNavigationItem, updateNavigationItem, and removeNavigationItem operate on stable navigation-item IDs. They preserve the schema-bounded tree, reject duplicate IDs and unknown targets, and enforce the root/child item limits. Deleting a parent intentionally removes its child subtree; the editor must present that consequence before confirmation.

Global settings

patchSiteSettings accepts only the explicitly patchable settings fields, deep-merges contact and SEO objects, then validates the full resulting settings record. Unknown fields cannot slip into persisted site configuration.

Redirects

Redirects are bounded to same-site absolute paths in the initial model. validateRedirects rejects duplicate sources and direct or indirect redirect loops before a redirect set can be published. External redirects, regex rules, and unbounded rewrite code are deliberately out of scope.

Each resource mutation still requires its corresponding command permission, expected resource version, audit event, and publish/preview behavior in the hosting command layer.

The Cloudflare adapter persists all four resource families in tenant Durable Object SQLite through TenantWorkspaceResourceStore. Draft and published states are independent per resource kind, every save creates an immutable version row, and every value is revalidated at the runtime/DO boundary. Provisioning initializes matching draft/published defaults; the public layout consumes published settings/navigation and the authenticated management UI edits and publishes each family.

Forms validate submissions against the published definition, apply a tenant-local abuse-rate bucket, and keep submission values in the tenant Durable Object. Listing submissions requires forms.view; public rendering and public MCP receive no submission binding.