Tenant workspace Durable Object

Each agency tenant maps to one deterministic TenantWorkspaceDO, backed by Durable Object SQLite storage. The object is the coordination atom for drafts, publishing, version history, and later live collaboration.

For managed Cloudflare hosting, the beta topology places each tenant in its own Workers for Platforms user Worker and script-specific Durable Object namespace. See Tenant-specific Workers and Durable Objects. The existing storage API remains stable while deployment and routing move from a shared Worker binding to the isolated tenant execution boundary.

The public Worker resolves a domain and serves cached published HTML without calling the object on a cache hit. Studio, API, CLI, and MCP requests authenticate and authorize at the Worker boundary, then invoke typed RPC methods on the tenant workspace.

Initial RPC operations

• getDocument(siteId, state) returns a typed document and version.
• saveDraft(siteId, document, expectedVersion, actorId) provides optimistic concurrency and writes an immutable version record.
• publish(siteId, expectedDraftVersion, actorId) copies a verified draft to the published state and writes a published version record.
• listVersions(siteId, limit) lists immutable draft/published version metadata.
• restoreDraft(siteId, sourceVersion, expectedDraftVersion, actorId) restores an immutable version by writing a new optimistic-concurrency-protected draft.
• recordAudit(event) and listAudit(siteId, limit) persist and retrieve tenant-local command audit metadata after Worker authorization.
• beginCommand, completeCommand, and abortCommand provide exclusive, durable idempotency claims and replay results.
• getResource, saveResourceDraft, and publishResource version settings, navigation, forms, and redirects independently from page layout.
• getTheme, switchThemePagesDraft, publishSiteBundle, and scheduled bundle publication keep versioned theme pins tenant-local and atomically pair the theme with pages, navigation, and redirects in draft and published state.

Later additions include audit-event queries, scheduled publishing alarms, presence/WebSockets, and snapshot export. These features must not put public rendering or raw asset bytes on the Durable Object critical path.

TenantWorkspaceDocumentStore is the Cloudflare hosting adapter that maps the generic runtime DocumentStore contract to that object. It selects the deterministic tenant workspace, applies a schema-validated section patch, verifies the expected draft version, and saves a new immutable version.

TenantWorkspaceResourceStore provides the equivalent typed adapter for non-page CMS resources. Each resource family has independent draft/published versions and optimistic concurrency, so changing navigation does not rewrite a page document and publishing settings does not implicitly publish form changes.

TenantWorkspaceThemeStore is the safe theme-switch adapter. It rejects cross-tenant actors and delegates paired document/theme transactions to the tenant object. Hosts must not implement theme switching as an unrelated document save followed by an unrelated theme-pin update.