Architecture — Internal

Overview

The licensing core is two Cloudflare Workers sharing one D1 database (littlebig-licenses) and one R2 bucket (littlebig-plugin-zips). Around it sit the other LittleBig Workers:

Worker	Address	Role
`littlebig-license-server`	license.littlebig.co	Licenses, catalog, Paddle webhook and provisioning, community access, daily check, mail
`littlebig-products-admin`	products.andredaus.com	Admin screen (behind Cloudflare Access); calls the license server
`littlebig-auth-server`	auth.littlebig.co, auth.andredaus.com	Login (BetterAuth), sign-in emails
`littlebig-cms`	cms.littlebig.co	EmDash CMS; its `license-catalog` plugin offers the price picker
`littlebig-co`	littlebig.co (preview.littlebig.co until the domain switch)	The website

External systems: Paddle (sandbox only), FluentCommunity on community.littlebig.co (REST API, plus the littlebig-community-bridge WordPress plugin), toSend (transactional mail from notify.littlebig.co and notify.andredaus.com), UserCheck (disposable and no-mail-server domains).

                        ┌──────────────────────────────────┐
WordPress Plugin ──────▶│  wp-luminary-proxy (Worker)      │
  (Silver/Gold)         │  - /v1/analyse                   │
                        │  - /v1/scan-config               │
                        │  - /v1/threat-feed               │◀── Public WAF clients
  (Bronze)              │  - /v1/proxy/scan (legacy)       │
                        └──────────┬───────────────────────┘
                                   │ reads LICENSE_DB
                                   ▼
                        ┌──────────────────────────────────┐
Admin tooling ─────────▶│  license-server (Worker)         │
                        │  - /v1/admin/* (Bearer)          │
                        │  - /v1/license/validate          │
                        │  - /v1/license/deactivate        │
                        │  - /v1/update/:slug              │
                        └──────────┬───────────────────────┘
                                   │
                         ┌─────────┴──────────┐
                         │  D1: littlebig-     │   R2: littlebig-plugin-zips
                         │  licenses           │   (ZIP delivery via signed URLs)
                         └─────────────────────┘

Cloudflare resources

Resource	CF name	Binding
D1 database	`littlebig-licenses`	`LICENSE_DB` (both Workers)
R2 bucket	`littlebig-plugin-zips`	`PLUGIN_ZIPS` (license-server only)

D1 Schema

See full schema at schema/migrations/0001_initial.sql and schema/migrations/0002_threat_intel.sql in littlebig-core.

Core tables (0001)

Table	Purpose
`products`	Product catalog (id, slug, name, type)
`tiers`	Tier definitions per product (seat_limit, features JSON)
`licenses`	Issued licenses (key, status, expires_at, features_override)
`activations`	Active domain bindings per license
`local_patterns`	Patterns that identify local dev domains
`license_credits`	Per-license credit balance
`credit_transactions`	Audit log of credit debits/grants
`plugin_versions`	ZIP inventory for update delivery

Threat intel tables (0002)

Table	Purpose
`threat_reports`	Per-scan anonymized threat records
`pattern_stats`	Aggregated pattern frequency across all scans

Shared Secrets Store and cache

One Cloudflare Secrets Store (id 5d5f065f0cb3473aa120e71eb685d3c6) holds the keys several Workers use, so each is rotated in one place: the admin token, the Paddle API key, tosend-api-key, usercheck-api-key. One KV namespace (USERCHECK_CACHE) is shared by the auth server, the newsletter and the license server so a domain is checked once.

How a purchase becomes access

Paddle webhook ─▶ license-server ─▶ license row ─▶ communityClient ─▶ FluentCommunity
                      │                                  └▶ community_grants ledger
                      └▶ mail via toSend (plugins only)
Daily check (Reconcile page) compares licenses, Paddle and the community and repairs drift.

Details: Community Access and Product Admin.

Secrets

Classic secrets are stored via wrangler secret put and never in wrangler.toml. Shared keys live in the Secrets Store (above); each Worker’s page lists its own.

Secret	Worker
`ADMIN_TOKEN`	Both
`ANTHROPIC_API_KEY`	`wp-luminary-proxy` only
`X402_WALLET_ADDRESS`	`wp-luminary-proxy` only

Local path

Monorepo at ~/Development/littlebig-core. GitLab remote named source at git@gitlab.com:littlebigco/littlebig-core.git.