Workspaces — the stack

two workers · four backends · one access gate
Clients same API for all three App Worker workspaces.plannotator.ai · Hono · one deploy Durable Objects Backends one source of truth per data type loads the app Bearer wsk_live_… WebSocket · Yjs metadata reads / writes init-safe upgrade → same DO checkpoint · 2–10s debounce git push commits → D1 pointer check + cached body cold miss · readAt(sha) hosted login redirect JWKS · verified at the edge sandboxed iframe reads blobs @sha image upload / read image bytes (hash-pinned) Browser Vite + React SPA session cookie · WebSocket Agent / CLI curl + API key same /v1 surface, HTTP only Anyone with a link no account · no cookie the link is the keys Static assets SPA shell · edge-cached /auth/* login · callback · logout authenticate session | api key | anon → one Identity resolveAccess() the one gate open·public·private·org /v1 route handlers documents · workspaces · comments · versions · keys · me /parties/* WS door onBeforeConnect → gate agent edit bridge applyAgentEdit() RPC /s/* public reads cookieless · cacheable · never mounts authenticate Document DO one per document Yjs merge · live fan-out SQLite hot tier humans + agents, one writer Workspace coordinator one per workspace · lazy sole pusher to the repo expiry alarm WorkOS identity · hosted AuthKit · orgs we store only IDs D1 metadata source of truth workspaces · documents · annotations api_keys · commits projection Cloudflare Artifacts content + version history one git repo per workspace docs as files · version = blob SHA KV + Cache API visibility pointer (fail-closed) public body cache · JWKS cache reconstructible only — never truth R2 image/asset bytes · per-workspace prefix content-hash keys · written once, never mutated usercontent Worker separate domain · cookieless untrusted HTML can never touch a login
research/ARCHITECTURE.md v2 · spec.yaml 0.13.0

    Click anything

    node detail

    Every box is clickable. The chips up top light up the request paths — Create, Live edit, Agent edit, Public read, Login, HTML render.