repoaccess-core 0.2.0

package/src/config.ts

@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Gary Stupak
+
+import type { ProductConfig, ProductTeamMap } from './types'
+
+/**
+ * Light runtime guard that a config-authored `productTeamMap` carries the reserved `defaults` key.
+ * The typed `RepoAccessConfig` already enforces this at compile time; this catches a
+ * hand-authored config that was cast/loosened, failing loudly at startup rather than silently
+ * granting nothing. (Replaces the old JSON-string `parseProductTeamMap`.)
+ */
+export function assertProductTeamMap(map: ProductTeamMap): ProductTeamMap {
+  if (
+    typeof map !== 'object' ||
+    map === null ||
+    typeof map.defaults !== 'object' ||
+    map.defaults === null
+  ) {
+    throw new Error('productTeamMap must be an object with a `defaults` key')
+  }
+  return map
+}
+
+/**
+ * Resolve a product's config: `map[adapter]?.[product_id] ?? map.defaults` (whole-object
+ * fallback). `defaults` is a reserved key - an adapter literally named "defaults" cannot shadow
+ * the fallback.
+ */
+export function resolveProductConfig(
+  map: ProductTeamMap,
+  adapter: string,
+  productId: string,
+): ProductConfig {
+  const perAdapter =
+    adapter === 'defaults'
+      ? undefined
+      : (map[adapter] as Record<string, ProductConfig> | undefined)
+  return perAdapter?.[productId] ?? map.defaults
+}

package/src/create-worker.ts

@@ -0,0 +1,156 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Gary Stupak
+
+import { Hono } from 'hono'
+import type {
+  AccessWorkflowParams,
+  ApiCallbackPing,
+  PaymentAdapter,
+  RepoAccessConfig,
+} from './types'
+import { captureRawRequest } from './raw-request'
+import { apiCallbackInstanceId, workflowInstanceId } from './workflow-id'
+import { timingSafeEqualString, verifyRequest } from './verify'
+import { makeClaimGet, makeClaimPost } from './claim'
+import { defaultClaimTemplate, type ClaimTemplate } from './claim-template'
+
+export interface CreateWorkerOptions {
+  adapters: PaymentAdapter[]
+  /**
+   * Deployment config as a typed object - `githubOrg`, `productTeamMap`, branding,
+   * outbound `eventWebhook`. Non-secret config no longer comes from `wrangler vars`; secrets stay in
+   * the env. The Workflow path receives the SAME object via `createAccessWorkflow(config, adapters)`.
+   */
+  config: RepoAccessConfig
+  /**
+   * Claim-page HTML template. The open extension point: a downstream worker supplies its
+   * own `ClaimTemplate` to restyle every claim state without forking the controller. Defaults to
+   * core's `defaultClaimTemplate`.
+   */
+  claimTemplate?: ClaimTemplate
+}
+
+/**
+ * Composition root. Core exports this; the example entry composes `[stripe]`, Pro
+ * composes `[stripe, paddle, …]`. The router code is identical across core/pro - only the adapter
+ * list differs. No provider-specific branches live here.
+ */
+export function createWorker({
+  adapters,
+  config,
+  claimTemplate = defaultClaimTemplate,
+}: CreateWorkerOptions) {
+  const adaptersByName = new Map(
+    adapters.map((adapter) => [adapter.name, adapter]),
+  )
+  const app = new Hono<{ Bindings: CloudflareBindings }>()
+
+  // Liveness only - never leak config/secrets. (route map: hono skill)
+  app.get('/health', (c) => c.json({ status: 'ok' }))
+
+  // Claim flow. GET renders the JSON projection or the injected HTML template
+  // (defaultClaimTemplate unless overridden) after KV token validation; POST validates the
+  // handle inline → single-flights via ClaimGuard → enqueues a grant in `username` mode under
+  // the id `{adapter}-claim_completed-{transaction_id}-{handle}`. The route does NOT delete the token -
+  // the workflow terminal step consumes it on success / retains it on user-not-found. See
+  // `claim.tsx` (controller) + `claim-template.tsx` (view contract).
+  app.get('/claim/:token', makeClaimGet(claimTemplate, config))
+  app.post('/claim/:token', makeClaimPost(claimTemplate, config))
+
+  /**
+   * Inbound payment webhooks. The request path does ONLY: resolve adapter → capture raw body →
+   * [verify | secret-path check] → enqueue the Workflow (deterministic id) → ack. No GitHub calls,
+   * no outbound events, all side effects run inside the Workflow. Target < 100 ms.
+   *
+   * Three verification kinds, branched here:
+   *   - hmac: timing-safe signature check → `parse(raw)` → enqueue the parsed `event`.
+   *   - shared_secret_header: timing-safe compare a fixed header against the adapter's configured
+   *     secret (fail-closed). Like hmac, the body is then authentic and parsed on the ack path - no
+   *     fetch. Shares the hmac code path below (verifyRequest dispatches by kind).
+   *   - api_callback: there is no signature. The `:secret_path` segment IS the credential
+   *     (timing-safe compared against the adapter's configured path, fail-closed). The authoritative
+   *     entity fetch is outbound I/O, so it is deferred to a durable Workflow step - the ack path
+   *     enqueues only the RAW ping (no fetch, no parse here).
+   */
+  app.post('/wh/:adapter/:secret_path', async (c) => {
+    const adapter = adaptersByName.get(c.req.param('adapter'))
+    if (!adapter) return c.notFound() // unknown adapter → 404
+
+    // Read the raw body byte-exact BEFORE any parse (HMAC depends on it).
+    const raw = await captureRawRequest(c.req.raw)
+
+    if (adapter.verification.kind === 'api_callback') {
+      // First-line credential (replaces HMAC for api_callback): timing-safe compare the path segment
+      // against the adapter's configured secret path. Unset secret OR mismatch → 401, fail-closed,
+      // BEFORE any fetch/parse/enqueue. No outbound I/O on the ack path.
+      const expected = adapter.verification.secretPath(c.env)
+      const provided = c.req.param('secret_path')
+      if (!expected || !timingSafeEqualString(provided, expected)) {
+        console.log(
+          JSON.stringify({
+            level: 'warn',
+            msg: 'webhook secret-path rejected',
+            adapter: adapter.name,
+          }),
+        )
+        return c.text('unauthorized', 401)
+      }
+
+      // The event isn't known until the entity is fetched (in the Workflow), so the id hashes the raw
+      // ping body: identical retried pings dedupe; distinct events (different bodies) get distinct ids.
+      const id = await apiCallbackInstanceId(adapter.name, raw.bodyText)
+      const ping: ApiCallbackPing = {
+        bodyText: raw.bodyText,
+        form: Object.fromEntries(raw.bodyForm ?? []),
+      }
+      const params: AccessWorkflowParams = { adapter: adapter.name, ping }
+      await c.env.ACCESS_WORKFLOW.createBatch([{ id, params }])
+      return c.text('ok', 200)
+    }
+
+    // hmac | shared_secret_header - execute the adapter's declared check (timing-safe compare +
+    // optional tolerance, or a timing-safe header-secret compare). Reject BEFORE enqueue on failure.
+    const verification = await verifyRequest(adapter, raw, c.env)
+    if (!verification.ok) {
+      // Structured warn on verification failure - never log signatures/secrets/body.
+      // Visibility into rejected webhooks without leaking anything sensitive.
+      console.log(
+        JSON.stringify({
+          level: 'warn',
+          msg: 'webhook verification failed',
+          adapter: adapter.name,
+        }),
+      )
+      return c.text('invalid signature', 401)
+    }
+
+    // Optional interactive-handshake hook. Runs ONLY after verify passed (so it can never bypass
+    // auth), BEFORE parse → enqueue. A returned Response IS the ack (e.g. answering a Telegram
+    // pre_checkout_query); `null` falls through to the normal parse path. No-op for adapters that
+    // omit it - the hmac/api_callback paths stay byte-identical. The hook's own outbound (the ack
+    // call back to the provider) is the adapter's bounded concern.
+    if (adapter.handle) {
+      const handled = await adapter.handle(raw, c.env)
+      if (handled) return handled
+    }
+
+    const event = adapter.parse(raw)
+    if (!event) return c.text('unprocessable entity', 400) // malformed/unrecognized → 400
+
+    // Deterministic Workflow id = the idempotency key (`-`-joined, see workflow-id.ts -
+    // the runtime rejects the `:` separator). This IS the dedupe mechanism - no KV bookkeeping.
+    // `createBatch` is idempotent: a duplicate id (within the instance retention window) is silently
+    // skipped (NOT thrown), so we still ack 200. (Workflows API, verified against docs + runtime)
+    const id = await workflowInstanceId(
+      adapter.name,
+      event.event_type,
+      event.transaction_id,
+    )
+    const params: AccessWorkflowParams = { adapter: adapter.name, event }
+    await c.env.ACCESS_WORKFLOW.createBatch([{ id, params }])
+
+    return c.text('ok', 200)
+  })
+
+  return app
+}

package/src/events.ts

@@ -0,0 +1,195 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Gary Stupak
+
+import type { NormalizedEvent, RepoAccessConfig } from './types'
+import { validateWebhookUrl } from './ssrf'
+
+// Outbound event envelopes. The envelope shape + a structured-log sink shipped first; the signed-HTTP
+// delivery sink was added behind the SAME EventSink interface (so callers don't change).
+// Delivery runs in a Workflow step AFTER the GitHub side effect and must never block or fail the
+// grant: transient failures throw (the durable engine retries), and the emit step swallows the
+// final exhaustion (see workflow emitEvent()).
+
+export type OutboundEventType =
+  | 'access.granted'
+  | 'access.failed'
+  | 'access.revoked'
+  | 'claim.pending'
+  | 'claim.completed'
+
+export interface EventEnvelope {
+  event_id: string
+  event_type: OutboundEventType
+  timestamp: string
+  product_id: string
+  transaction_id: string
+  buyer_email: string | null
+  org: string
+  // Per-event fields: github_username (string|null), teams (string[]), status/reason/claim_url/
+  // trigger (string). A flat scalar/array union - not a recursive JSON type - keeps the envelope
+  // Serializable cheaply across the `step.do` boundary that emits it (avoids TS2589).
+  [extra: string]: EnvelopeField
+}
+
+/** Value type for an envelope's per-event extra fields (see the index signature above). */
+export type EnvelopeField = string | string[] | null
+
+/** Build the base envelope + per-type fields. event_id is THIS delivery's id (not the txn). */
+export function buildEnvelope(
+  org: string,
+  type: OutboundEventType,
+  event: NormalizedEvent,
+  extra: Record<string, EnvelopeField> = {},
+): EventEnvelope {
+  return {
+    event_id: crypto.randomUUID(),
+    event_type: type,
+    timestamp: new Date().toISOString(),
+    product_id: event.product_id,
+    transaction_id: event.transaction_id,
+    buyer_email: event.buyer_email,
+    org,
+    ...extra,
+  }
+}
+
+/** A delivery sink. The default logs; a signed-HTTP + SSRF-guarded sink is also provided. */
+export type EventSink = (envelope: EventEnvelope) => void | Promise<void>
+
+// The envelope legitimately carries buyer_email (PII) and, on claim.pending, claim_url (a single-use
+// bearer token) for delivery to the seller - but the LOG fallback must contain neither.
+// buyer_email is redacted; claim_url is dropped entirely (the full URL still reaches the
+// outbound HTTP sink via deliver(); only this log line omits it).
+export const logSink: EventSink = (envelope) => {
+  const { buyer_email, claim_url: _claim_url, ...rest } = envelope
+  console.log(
+    JSON.stringify({
+      level: 'info',
+      msg: 'event',
+      ...rest,
+      buyer_email: buyer_email ? '[redacted]' : null,
+    }),
+  )
+}
+
+// --- signed HTTP delivery ------------------------------------
+
+const DELIVERY_TIMEOUT_MS = 10_000
+
+const encoder = new TextEncoder()
+
+/**
+ * HMAC-SHA256 over the canonical `${ts}.${body}` string, hex. Deliberately mirrors our inbound
+ * Stripe-style scheme (verify.ts) so a seller verifies our deliveries with the same recipe they
+ * already use for inbound webhooks.
+ */
+async function signDelivery(
+  secret: string,
+  ts: string,
+  body: string,
+): Promise<string> {
+  const key = await crypto.subtle.importKey(
+    'raw',
+    encoder.encode(secret),
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign'],
+  )
+  const mac = await crypto.subtle.sign(
+    'HMAC',
+    key,
+    encoder.encode(`${ts}.${body}`),
+  )
+  return [...new Uint8Array(mac)]
+    .map((b) => b.toString(16).padStart(2, '0'))
+    .join('')
+}
+
+function safeHost(raw: string): string {
+  try {
+    return new URL(raw).host
+  } catch {
+    return '(unparseable)'
+  }
+}
+
+/**
+ * POST the signed envelope to the configured delivery URL. Returns (no-op) for config conditions
+ * that a retry can't fix - destination unset, secret missing (fail-closed: never send unsigned), or
+ * the SSRF guard rejecting the URL. THROWS on a transient delivery failure (non-2xx, timeout,
+ * network) so the durable Workflow engine retries the emit step. The destination +
+ * allowlist come from `config.eventWebhook`; the signing secret stays in env.
+ */
+async function deliver(
+  env: CloudflareBindings,
+  config: RepoAccessConfig,
+  envelope: EventEnvelope,
+): Promise<void> {
+  const url = config.eventWebhook?.url
+  if (!url) return // optional destination unset → nothing to deliver
+
+  const secret = env.EVENT_WEBHOOK_SECRET // optional secret → string | undefined (see worker-env.d.ts)
+  if (!secret) {
+    // Fail-closed, consistent with inbound: a configured URL with no secret must NOT send unsigned.
+    console.log(
+      JSON.stringify({
+        level: 'error',
+        msg: 'event delivery misconfigured: eventWebhook.url set but EVENT_WEBHOOK_SECRET missing',
+      }),
+    )
+    return
+  }
+
+  const check = validateWebhookUrl(url, {
+    allowlist: config.eventWebhook?.allowlist,
+  })
+  if (!check.ok) {
+    console.log(
+      JSON.stringify({
+        level: 'error',
+        msg: 'event delivery blocked by SSRF guard',
+        reason: check.reason,
+        host: safeHost(url),
+      }),
+    )
+    return
+  }
+
+  const body = JSON.stringify(envelope)
+  const ts = String(Math.floor(Date.now() / 1000))
+  const signature = await signDelivery(secret, ts, body)
+
+  const controller = new AbortController()
+  const timer = setTimeout(() => controller.abort(), DELIVERY_TIMEOUT_MS)
+  try {
+    const res = await fetch(check.url.toString(), {
+      method: 'POST',
+      body,
+      headers: {
+        'content-type': 'application/json',
+        'x-repoaccess-signature': `sha256=${signature}`,
+        'x-repoaccess-timestamp': ts,
+      },
+      redirect: 'manual', // never follow a redirect to an internal target
+      signal: controller.signal,
+    })
+    // redirect:'manual' surfaces a 3xx as-is; any non-2xx (incl. a redirect) is a delivery failure.
+    if (!res.ok) throw new Error(`event delivery: HTTP ${res.status}`)
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
+/**
+ * Production sink: structured log (always, redacted) + signed HTTP delivery. Swapped in by
+ * `AccessWorkflow.run`; `executeAccessWorkflow` still defaults to `logSink` for tests/local.
+ */
+export function createEventSink(
+  env: CloudflareBindings,
+  config: RepoAccessConfig,
+): EventSink {
+  return async (envelope) => {
+    logSink(envelope)
+    await deliver(env, config, envelope)
+  }
+}

package/src/fetch-entity.ts

@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Gary Stupak
+
+import { validateWebhookUrl, type SsrfOptions } from './ssrf'
+import type { VerifiedEntity } from './types'
+
+/**
+ * Guarded outbound fetch for `api_callback` entity verification - the core guardrail that closes the
+ * ADR-0036 security-gate Medium. An adapter's `fetchEntity` builds the provider URL (with the
+ * untrusted lookup id `encodeURIComponent`'d - that part the adapter must still do) and calls this
+ * helper instead of bare `fetch`, so every entity fetch gets the same protections the outbound event
+ * sink already has (`src/events.ts`): https-only, SSRF guard (`src/ssrf.ts` - reject private/reserved
+ * IP-literal hosts), `redirect: 'manual'` (never follow a 3xx to an internal target), and a
+ * per-attempt `AbortController` timeout.
+ *
+ * Return/throw semantics match `resolveApiCallbackEvent`'s retry model (`src/workflow.ts`):
+ *   - **2xx** → parsed JSON entity.
+ *   - **404** → `null` (a *definitive* not-found - a forged/unknown id → the adapter returns `null` →
+ *     terminal `access.failed`, with no retry storm).
+ *   - **everything else** → THROW: other non-2xx (incl. a 3xx surfaced by `redirect: 'manual'`, and
+ *     auth errors like 401/403), network errors, the timeout abort, and SSRF/non-https rejects. The
+ *     durable fetch-entity step retries a throw; on exhaustion it becomes `access.failed`. Throwing
+ *     (not returning `null`) on these keeps an ambiguous/transient failure from masquerading as a
+ *     clean "forged id".
+ *
+ * Never follows redirects; never reads a non-2xx body beyond its status. The auth token belongs in
+ * `opts.headers` (`Authorization: Bearer …`), keeping it out of the URL and logs.
+ */
+
+const DEFAULT_TIMEOUT_MS = 10_000
+
+export interface FetchEntityOptions {
+  /** Request headers - put the provider auth token here (e.g. `Authorization: Bearer <token>`). */
+  headers?: Record<string, string>
+  /** Per-attempt timeout (default 10s). */
+  timeoutMs?: number
+  /** SSRF options (e.g. a host allowlist); https-only is enforced regardless. */
+  ssrf?: SsrfOptions
+}
+
+function is2xx(status: number): boolean {
+  return status >= 200 && status < 300
+}
+
+export async function fetchVerifiedEntity(
+  url: string,
+  opts: FetchEntityOptions = {},
+  // Reserved for future env-derived fetch policy (e.g. an SSRF allowlist / http opt-in from config);
+  // kept in the signature so adapters call a stable `fetchVerifiedEntity(url, opts, env)` shape.
+  _env?: CloudflareBindings,
+): Promise<VerifiedEntity | null> {
+  const check = validateWebhookUrl(url, opts.ssrf) // https-only + private/reserved-IP reject
+  if (!check.ok) {
+    // Security reject → throw (the step retries, then access.failed) rather than a silent null.
+    throw new Error(`fetchVerifiedEntity blocked: ${check.reason}`)
+  }
+
+  const controller = new AbortController()
+  const timer = setTimeout(
+    () => controller.abort(),
+    opts.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+  )
+  try {
+    const res = await fetch(check.url.toString(), {
+      method: 'GET',
+      headers: opts.headers,
+      redirect: 'manual', // never follow a redirect to an internal target
+      signal: controller.signal,
+    })
+    if (res.status === 404) return null // definitive not-found / forged id → terminal
+    if (!is2xx(res.status)) {
+      // Other non-2xx (incl. a manual-redirect 3xx and 401/403/5xx) → transient/ambiguous → retry.
+      throw new Error(`fetchVerifiedEntity: HTTP ${res.status}`)
+    }
+    return (await res.json()) as VerifiedEntity
+  } finally {
+    clearTimeout(timer)
+  }
+}

package/src/github.ts

@@ -0,0 +1,140 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Gary Stupak
+
+// Minimal GitHub REST client over `fetch` - no Octokit/SDK, no Node APIs (Workers-only). Auth is a
+// fine-grained PAT (Members: R&W) from env.GITHUB_TOKEN (a secret); the org is passed in by the
+// caller from `config.githubOrg`. Teams are addressed by SLUG (the product→team map
+// carries slugs).
+
+import type { Json } from './types'
+
+const GITHUB_API = 'https://api.github.com'
+const USER_AGENT = 'repoaccess-worker' // GitHub rejects requests without a User-Agent.
+const API_VERSION = '2022-11-28'
+
+/** Serializable result (returned from inside step.do - must not contain a live Response). */
+export interface GithubResult {
+  status: number
+  json: Json
+  retryAfterSec: number | null
+  rateLimitRemaining: number | null
+  rateLimitResetSec: number | null
+}
+
+function header(value: string | null): number | null {
+  if (value === null || value === '') return null
+  const n = Number(value)
+  return Number.isFinite(n) ? n : null
+}
+
+async function githubRequest(
+  env: CloudflareBindings,
+  method: string,
+  path: string,
+  body?: unknown,
+): Promise<GithubResult> {
+  const init: RequestInit = {
+    method,
+    headers: {
+      Authorization: `Bearer ${env.GITHUB_TOKEN}`,
+      Accept: 'application/vnd.github+json',
+      'X-GitHub-Api-Version': API_VERSION,
+      'User-Agent': USER_AGENT,
+      ...(body !== undefined ? { 'Content-Type': 'application/json' } : {}),
+    },
+    body: body !== undefined ? JSON.stringify(body) : undefined,
+  }
+  const res = await fetch(`${GITHUB_API}${path}`, init)
+  const text = await res.text()
+  let json: Json = null
+  if (text) {
+    try {
+      json = JSON.parse(text)
+    } catch {
+      json = text
+    }
+  }
+  return {
+    status: res.status,
+    json,
+    retryAfterSec: header(res.headers.get('retry-after')),
+    rateLimitRemaining: header(res.headers.get('x-ratelimit-remaining')),
+    rateLimitResetSec: header(res.headers.get('x-ratelimit-reset')),
+  }
+}
+
+// Path segments are URL-encoded as defense-in-depth (usernames are validated upstream and
+// slugs come from trusted config, but never interpolate raw user input into a URL path).
+const enc = encodeURIComponent
+
+export const github = {
+  getTeamMembership: (
+    env: CloudflareBindings,
+    org: string,
+    slug: string,
+    username: string,
+  ) =>
+    githubRequest(
+      env,
+      'GET',
+      `/orgs/${enc(org)}/teams/${enc(slug)}/memberships/${enc(username)}`,
+    ),
+
+  addTeamMembership: (
+    env: CloudflareBindings,
+    org: string,
+    slug: string,
+    username: string,
+  ) =>
+    githubRequest(
+      env,
+      'PUT',
+      `/orgs/${enc(org)}/teams/${enc(slug)}/memberships/${enc(username)}`,
+    ),
+
+  removeTeamMembership: (
+    env: CloudflareBindings,
+    org: string,
+    slug: string,
+    username: string,
+  ) =>
+    githubRequest(
+      env,
+      'DELETE',
+      `/orgs/${enc(org)}/teams/${enc(slug)}/memberships/${enc(username)}`,
+    ),
+
+  listInvitations: (env: CloudflareBindings, org: string) =>
+    githubRequest(env, 'GET', `/orgs/${enc(org)}/invitations?per_page=100`),
+
+  cancelInvitation: (
+    env: CloudflareBindings,
+    org: string,
+    invitationId: number,
+  ) =>
+    githubRequest(
+      env,
+      'DELETE',
+      `/orgs/${enc(org)}/invitations/${invitationId}`,
+    ),
+
+  removeOrgMembership: (
+    env: CloudflareBindings,
+    org: string,
+    username: string,
+  ) =>
+    githubRequest(
+      env,
+      'DELETE',
+      `/orgs/${enc(org)}/memberships/${enc(username)}`,
+    ),
+}
+
+/** 429, or 403 carrying a rate-limit signal (primary or secondary limit). */
+export function isRateLimited(result: GithubResult): boolean {
+  if (result.status === 429) return true
+  if (result.status === 403) {
+    return result.rateLimitRemaining === 0 || result.retryAfterSec !== null
+  }
+  return false
+}

package/src/index.production.ts

@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Gary Stupak
+
+import { createWorker } from './create-worker'
+import { createAccessWorkflow } from './workflow'
+import { stripe } from './adapters/stripe'
+import { production as config } from './repoaccess.config'
+
+/**
+ * Core PRODUCTION worker entry - selected by wrangler's per-env `main` override
+ * (`[env.production].main`). Identical composition to `src/index.ts`, but bound to the
+ * `production` config profile. This file is a deploy entry only (never the npm barrel), so it
+ * re-exports just the binding classes wrangler must resolve from `main`.
+ */
+export { ClaimGuard } from './claim-guard'
+// Same adapter list to both factories (ack path + Workflow path) - see src/index.ts.
+const adapters = [stripe]
+export class AccessWorkflow extends createAccessWorkflow(config, adapters) {}
+export default createWorker({ adapters, config })

package/src/index.ts

@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2026 Gary Stupak
+
+import { createWorker } from './create-worker'
+import { createAccessWorkflow } from './workflow'
+import { stripe } from './adapters/stripe'
+import { sandbox as config } from './repoaccess.config'
+
+// --- public surface (the npm barrel; `exports['.']`) -------------------------
+// Re-export everything a downstream worker composes core from via the package dependency.
+export { createWorker } from './create-worker'
+export type { CreateWorkerOptions } from './create-worker'
+// Config-as-code: the factory that binds the Workflow class to a typed config, plus the
+// config contract types a deployer authors in their own `repoaccess.config.ts`.
+export { createAccessWorkflow } from './workflow'
+// The claim-page template contract - the open extension point a downstream worker implements to
+// restyle the claim flow; core ships the default template.
+export { defaultClaimTemplate } from './claim-template'
+export type { Branding, ClaimView, ClaimTemplate } from './claim-template'
+// Guarded outbound fetch for api_callback adapters' `fetchEntity` (https-only + SSRF + redirect:manual
+// + timeout). Use it instead of bare `fetch` so every entity verification gets the same protections.
+export { fetchVerifiedEntity } from './fetch-entity'
+export type { FetchEntityOptions } from './fetch-entity'
+// The adapter contract - the authoritative shapes an external adapter implements (see AGENTS.md).
+export type {
+  PaymentAdapter,
+  VerificationStrategy,
+  NormalizedEvent,
+  RawRequest,
+  VerifiedEntity,
+  GrantMode,
+  RevokePolicy,
+  ProductConfig,
+  ProductTeamMap,
+  RepoAccessConfig,
+  EventWebhookConfig,
+} from './types'
+// The claim single-flight Durable Object - exported so the CLAIM_GUARD binding resolves.
+export { ClaimGuard } from './claim-guard'
+
+// --- core example/sandbox worker entry (core's own `main`) -------------------
+/**
+ * Core example entry (sandbox/default env). Composes the free-core adapter set - just Stripe - with
+ * the neutral `sandbox` config. Pro composes `[stripe, paddle, …]` from its own
+ * entry; the router code is identical, only the adapter list + config differ.
+ *
+ * `AccessWorkflow` MUST be exported from `main` (wrangler `class_name`) so the ACCESS_WORKFLOW binding
+ * resolves. `extends createAccessWorkflow(config, adapters)` makes it a class (value AND type) bound
+ * to config - the runtime constructs it, so config can't be injected any other way. The adapter list
+ * is passed to BOTH `createWorker` (ack path) and `createAccessWorkflow` (Workflow path) so an
+ * api_callback adapter can run its entity fetch + parse in-step; keep the two lists identical.
+ */
+const adapters = [stripe]
+export class AccessWorkflow extends createAccessWorkflow(config, adapters) {}
+export default createWorker({ adapters, config })