Architecture — Internal

Overview

Two Cloudflare Workers sharing one D1 database (littlebig-licenses) and one R2 bucket (littlebig-plugin-zips).

                        ┌──────────────────────────────────┐
WordPress Plugin ──────▶│  wp-luminary-proxy (Worker)      │
  (Silver/Gold)         │  - /v1/analyse                   │
                        │  - /v1/scan-config               │
                        │  - /v1/threat-feed               │◀── Public WAF clients
  (Bronze)              │  - /v1/proxy/scan (legacy)       │
                        └──────────┬───────────────────────┘
                                   │ reads LICENSE_DB
                                   ▼
                        ┌──────────────────────────────────┐
Admin tooling ─────────▶│  license-server (Worker)         │
                        │  - /v1/admin/* (Bearer)          │
                        │  - /v1/license/validate          │
                        │  - /v1/license/deactivate        │
                        │  - /v1/update/:slug              │
                        └──────────┬───────────────────────┘
                                   │
                         ┌─────────┴──────────┐
                         │  D1: littlebig-     │   R2: littlebig-plugin-zips
                         │  licenses           │   (ZIP delivery via signed URLs)
                         └─────────────────────┘

Cloudflare resources

Resource	CF name	Binding
D1 database	littlebig-licenses	LICENSE_DB (both Workers)
R2 bucket	littlebig-plugin-zips	PLUGIN_ZIPS (license-server only)

D1 Schema

See full schema at schema/migrations/0001_initial.sql and schema/migrations/0002_threat_intel.sql in littlebig-core.

Core tables (0001)

Table	Purpose
products	Product catalog (id, slug, name, type)
tiers	Tier definitions per product (seat_limit, features JSON)
licenses	Issued licenses (key, status, expires_at, features_override)
activations	Active domain bindings per license
local_patterns	Patterns that identify local dev domains
license_credits	Per-license credit balance
credit_transactions	Audit log of credit debits/grants
plugin_versions	ZIP inventory for update delivery

Threat intel tables (0002)

Table	Purpose
threat_reports	Per-scan anonymized threat records
pattern_stats	Aggregated pattern frequency across all scans

Secrets

Stored via wrangler secret put — never in wrangler.toml.

Secret	Worker
ADMIN_TOKEN	Both
ANTHROPIC_API_KEY	wp-luminary-proxy only
X402_WALLET_ADDRESS	wp-luminary-proxy only

Local path

Monorepo at ~/Development/littlebig-core. GitLab remote named source at git@gitlab.com:littlebigco/littlebig-core.git.