AbstractProtected ReadonlyenvProtected Optional ReadonlystateAbsent in node tests; present under workerd.
ProtectedtenantThe tenant this instance serves, decoded from its own thread id — the same salted-prefix decode used for runIds (one decode, tenantOfMemoryId to tenantOfRunId). Throws on a name carrying no valid tenant prefix: a hand-built or client-chosen threadId never reaches a tenant-scoped store.
ProtectedthreadThe thread this instance serves, recovered from its OWN idFromName identity
— unforgeable at this boundary (id.name is populated only for
idFromName-created ids). Throws rather than defaulting: a thread DO that
cannot name itself cannot scope anything it stores.
Protected AbstractbuildBuild this DO's storage + runtime + pubsub identity via init(). Called once, lazily — one init() per instance is what makes its pubsub the isolate's ONE identity (pubsub.ts), so never call init() again from a route.
Protected AbstractrouteServe a request whose tenant has already been asserted against this
instance's identity. Abstract because the skeleton hosts no routes of its
own: the durable-agent host drives the loop through scope.init.runtime,
and the signals package mounts signal routes on the same asserted scope.
Per-thread Durable Object base. Hosts subclass it, supply
build()(their init() wiring) androute()(their thread routes), and bind the subclass under a wrangler namespace addressedidFromName(threadId).route()runs only AFTER the tenant assertion, so a track adding a route cannot forget it — the reason the dispatch is a template method rather than a fetch() each subclass writes.