Tenant workspace Durable Object

Each agency tenant maps to one deterministic TenantWorkspaceDO, backed by Durable Object SQLite storage. The object is the coordination atom for drafts, publishing, version history, and later live collaboration.

The public Worker resolves a domain and serves cached published HTML without calling the object on a cache hit. Studio, API, CLI, and MCP requests authenticate and authorize at the Worker boundary, then invoke typed RPC methods on the tenant workspace.

Initial RPC operations

• getDocument(siteId, state) returns a typed document and version.
• saveDraft(siteId, document, expectedVersion, actorId) provides optimistic concurrency and writes an immutable version record.
• publish(siteId, expectedDraftVersion, actorId) copies a verified draft to the published state and writes a published version record.
• listVersions(siteId, limit) lists immutable draft/published version metadata.
• restoreDraft(siteId, sourceVersion, expectedDraftVersion, actorId) restores an immutable version by writing a new optimistic-concurrency-protected draft.
• recordAudit(event) and listAudit(siteId, limit) persist and retrieve tenant-local command audit metadata after Worker authorization.
• beginCommand, completeCommand, and abortCommand provide exclusive, durable idempotency claims and replay results.
• getResource, saveResourceDraft, and publishResource version settings, navigation, forms, and redirects independently from page layout.
• getTheme, switchThemeDraft, and publishSite keep versioned theme pins tenant-local and atomically pair a migrated layout with its document in draft and published state.

Later additions include audit-event queries, scheduled publishing alarms, presence/WebSockets, and snapshot export. These features must not put public rendering or raw asset bytes on the Durable Object critical path.

TenantWorkspaceDocumentStore is the Cloudflare hosting adapter that maps the generic runtime DocumentStore contract to that object. It selects the deterministic tenant workspace, applies a schema-validated section patch, verifies the expected draft version, and saves a new immutable version.

TenantWorkspaceResourceStore provides the equivalent typed adapter for non-page CMS resources. Each resource family has independent draft/published versions and optimistic concurrency, so changing navigation does not rewrite a page document and publishing settings does not implicitly publish form changes.

TenantWorkspaceThemeStore is the safe theme-switch adapter. It rejects cross-tenant actors and delegates paired document/theme transactions to the tenant object. Hosts must not implement theme switching as an unrelated document save followed by an unrelated theme-pin update.