rcf-lite 0.21.0 → 0.22.0

package/blueprints/application-account-settings/contributions/tacs/tac-2601-application-account-settings-shell.json

@@ -0,0 +1,41 @@
+{
+  "tacId": "TAC-2601-application-account-settings-shell",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Account settings shell",
+  "purpose": "Owns the rendered settings surface: the top-level tabs landmark, the surface-manifest read at load, the conditional rendering of every applied surface (profile always; security, sessions, notifications, theme conditional), the tabs interaction contract (ARIA APG), and the shared page layout every surface renders within. The shell is the base surface every AC in this blueprint anchors on.",
+  "responsibilities": [
+    "Read the applied capability sidecar (rcf/blueprints/application-account-settings.applied.json) at load and configure the tab set (AC-25101-1).",
+    "Render a single primary navigation landmark carrying an accessible name and rendering only applied surfaces (AC-25101-1, AC-25101-2).",
+    "Render the profile surface unconditionally as the active tab on /account (AC-25102-1).",
+    "Delegate the security, sessions, notification-preferences and theme surfaces to their respective TACs (TAC-2603, TAC-2604) or render inline for notifications and theme.",
+    "Route unauthenticated principals to the empty-error-states forbidden state (T-1) rather than inventing a bespoke denied UI."
+  ],
+  "internalStructure": "One shell module that mounts the surface, reads the applied capabilities sidecar, and renders the tabs landmark, the page-layout scaffolding, and the tabpanel-level containers for each conditional surface. The framework is not prescribed; the shell interfaces are what the project realises against React, Vue, Svelte or vanilla DOM.",
+  "interfaces": [
+    {
+      "name": "renderShell",
+      "kind": "factory",
+      "description": "renderShell({ capsSidecarUrl, surfaceRegistry, sessionGuard, themeAdapter, notificationsAdapter }) -> { mount(rootElement), unmount() }. The project supplies the capsSidecarUrl (where the sidecar is served from), the surfaceRegistry (maps a capability string to a surface component), the sessionGuard (returns whether the current principal has an authenticated session), the themeAdapter (persists the theme per the elicited persistence strategy) and the notificationsAdapter (reads and writes preferences through the applied notifications blueprint)."
+    },
+    {
+      "name": "capabilitiesSidecar",
+      "kind": "shape",
+      "description": "{ slug, version, appliedAt, appliedCapabilities: string[], appliedElicitations: {}, allowNoAuthYet?: boolean, notes?: string }. Written by apply, read by the shell."
+    }
+  ],
+  "dependencies": [
+    {
+      "name": "Capability discovery",
+      "kind": "tac",
+      "tacId": "TAC-2602-application-account-settings-capability-discovery",
+      "description": "The shell reads the surface-manifest through discovery."
+    }
+  ],
+  "tradeoffs": "The shell reads the sidecar file the apply verb writes; a runtime probe against manifest.blueprints[] would be more dynamic but ties the shell to the deploy-target having filesystem read access, which not every deploy target grants. The sidecar contract is deterministic and cacheable.",
+  "notes": "Composes on application-empty-error-states (T-1) for the forbidden and empty-list states rather than inventing bespoke denied UI. Known mechanism-reach gap: the shell contract cannot prove keyboard focus does not escape the tabs region in every framework rendering; project-side smoke tests supplement the pack. See README Known mechanism-reach gaps.",
+  "createdAt": "2026-09-06T20:55:46Z",
+  "updatedAt": "2026-09-06T20:55:46Z"
+}

package/blueprints/application-account-settings/contributions/tacs/tac-2602-application-account-settings-capability-discovery.json

@@ -0,0 +1,28 @@
+{
+  "tacId": "TAC-2602-application-account-settings-capability-discovery",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Account settings capability discovery",
+  "purpose": "The apply-time reader that translates the applied blueprint set and any custom-auth elicits into an appliedCapabilities[] array, and enforces the requiresAppliedCapabilities gate.",
+  "responsibilities": [
+    "Read the union of capabilities[] declarations across applied blueprints (AC-25101-1, AC-25107-1, AC-25108-1).",
+    "Add capabilities the operator asserted through the four custom-auth-provides-* elicits (AC-25101-1).",
+    "Refuse at apply when no applied blueprint declares principalDirectory and --allow-no-auth-yet is not passed (AC-25109-1).",
+    "Write the sidecar file capturing appliedCapabilities, appliedElicitations, allowNoAuthYet and any scaffolding note (AC-25109-2)."
+  ],
+  "internalStructure": "One helper module reused verbatim from application-admin-console (readAppliedCapabilities), read from the applied sidecar file by the pack and the shell.",
+  "interfaces": [
+    {
+      "name": "readAppliedCapabilities",
+      "kind": "function",
+      "description": "readAppliedCapabilities(projectRoot) -> Promise<string[]>. Reads rcf/blueprints/application-account-settings.applied.json and returns appliedCapabilities[] or []. Never throws."
+    }
+  ],
+  "dependencies": [],
+  "tradeoffs": "The sidecar path is stable and versioned; a schema minor bump on rcf-schemas can promote appliedCapabilities[] onto the applied-record shape directly, at which point the helper reads the manifest record instead. Kept file-scoped for v1.",
+  "notes": "Known mechanism-reach gap: a project that declares a capability outside the section 6a vocabulary passes the loader shape check but the shell records no surface for it. Documented in README.",
+  "createdAt": "2026-09-06T20:55:46Z",
+  "updatedAt": "2026-09-06T20:55:46Z"
+}

package/blueprints/application-account-settings/contributions/tacs/tac-2603-application-account-settings-hosted-ui-bridge.json

@@ -0,0 +1,35 @@
+{
+  "tacId": "TAC-2603-application-account-settings-hosted-ui-bridge",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Hosted identity UI bridge",
+  "purpose": "The security surface bridge between the applied auth blueprint and the operator-elicited hosted-UI destination.",
+  "responsibilities": [
+    "When credentialSelfService is applied, render the self-service branch (password change, MFA management) (AC-25103-1).",
+    "When hostedIdentityUi is applied AND security-surface-shape=hosted-link-out, render an <a data-role=\"hosted-link-out\" href=\"{hosted-identity-url}\"> with rel=\"noopener\" (AC-25104-1).",
+    "When hostedIdentityUi is applied AND security-surface-shape=hosted-embed, render an <iframe data-role=\"hosted-embed\" title=\"Account security\" src=\"{hosted-identity-url}\" sandbox=\"allow-scripts allow-forms allow-same-origin\"> (AC-25104-1).",
+    "Refuse at apply when the operator answers security-surface-shape but no applied blueprint declares credentialSelfService or hostedIdentityUi (AC-25110-1)."
+  ],
+  "internalStructure": "One security-surface module reading the elicited security-surface-shape and hosted-identity-url from the sidecar and dispatching to the appropriate render helper. The framework is not prescribed.",
+  "interfaces": [
+    {
+      "name": "renderSecuritySurface",
+      "kind": "factory",
+      "description": "renderSecuritySurface({ appliedCapabilities, appliedElicitations }) -> { mount(root), unmount() }. Reads security-surface-shape and hosted-identity-url from appliedElicitations."
+    }
+  ],
+  "dependencies": [
+    {
+      "name": "Capability discovery",
+      "kind": "tac",
+      "tacId": "TAC-2602-application-account-settings-capability-discovery",
+      "description": "The bridge reads the applied capability set from the sidecar the discovery helper writes."
+    }
+  ],
+  "tradeoffs": "A hosted-embed carries the sandbox attribute at a conservative default (allow-scripts allow-forms allow-same-origin); a hosted-UI provider that requires additional sandbox tokens is a v1.1.0 minor bump (extending the elicits with a sandbox-tokens field). ADR-2602 records the choice.",
+  "notes": "Known mechanism-reach gap: the bridge cannot itself prove the hosted UI actually loads at the elicited URL; the pack asserts the DOM shape and the operator asserts the URL is reachable.",
+  "createdAt": "2026-09-06T20:55:46Z",
+  "updatedAt": "2026-09-06T20:55:46Z"
+}

package/blueprints/application-account-settings/contributions/tacs/tac-2604-application-account-settings-session-store.json

@@ -0,0 +1,40 @@
+{
+  "tacId": "TAC-2604-application-account-settings-session-store",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Session store contract",
+  "purpose": "The sessions surface bridge between the applied blueprints session-inventory source and the terminate-write flow.",
+  "responsibilities": [
+    "Read the active-session inventory from the applied provider (an auth blueprint declaring sessionInventory, or observability-logging 1.2.0+ as the logging-projection provider) (AC-25105-1, AC-25106-1).",
+    "Render one row per session enumerated by data-session-id with device and last-active columns and a terminate action (AC-25105-1).",
+    "Open an ARIA APG dialog-modal on terminate with focus-trap, aria-labelledby to the heading and focus-return to the neighbouring row on close (AC-25105-2).",
+    "Announce the terminate-success via <div role=\"status\" aria-live=\"polite\" data-role=\"session-terminated-announce\">Session ended</div> (AC-25105-2)."
+  ],
+  "internalStructure": "One sessions-surface module with a read-inventory helper and a terminate-write helper. The read-inventory helper dispatches to the applied providers session-inventory API; the terminate-write helper dispatches to the same providers terminate API. The framework is not prescribed.",
+  "interfaces": [
+    {
+      "name": "renderSessionsSurface",
+      "kind": "factory",
+      "description": "renderSessionsSurface({ inventoryAdapter, terminateAdapter }) -> { mount(root), unmount() }. The project supplies the two adapters against the applied provider."
+    },
+    {
+      "name": "sessionRecord",
+      "kind": "shape",
+      "description": "{ sessionId, deviceLabel, lastActive (ISO-8601), currentSession (boolean) }. The current session cannot be terminated by itself (the operator signs out from the shell instead); the pack asserts the surface renders every session, the terminate control is present on every non-current row, and the current row (data-current-session=\"true\") does not carry the terminate action."
+    }
+  ],
+  "dependencies": [
+    {
+      "name": "Capability discovery",
+      "kind": "tac",
+      "tacId": "TAC-2602-application-account-settings-capability-discovery",
+      "description": "The sessions surface reads the applied capability set to gate on sessionInventory."
+    }
+  ],
+  "tradeoffs": "Re-authenticate before terminate is elicited (reauth-window ADR-2604) with a default of true. A project that ships a short-lived session token can set reauth-window=never; ADR-2604 records the choice and its risk.",
+  "notes": "Known mechanism-reach gap: the read-inventory adapter contract cannot prove the applied provider actually returns a device label the operator will recognise (User-Agent parsing varies); the pack asserts the DOM shape.",
+  "createdAt": "2026-09-06T20:55:46Z",
+  "updatedAt": "2026-09-06T20:55:46Z"
+}

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25101.json

@@ -0,0 +1,34 @@
+{
+  "usId": "application-account-settings-US-25101",
+  "prdId": "PRD-001",
+  "reqId": "application-account-settings-REQ-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Settings shell renders only applied surfaces and the profile tab is always active",
+  "asA": "authenticated principal reaching my account page",
+  "iWant": "a settings shell whose tabs mirror the union of applied capabilities and whose profile tab is always active",
+  "soThat": "I can find the surfaces my project has actually shipped without dead links, and I never see a tab whose feature is not wired up",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-25101-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "Given an authenticated principal AND an applied auth blueprint declaring principalDirectory, GET /account renders the shell as an ARIA APG tabs region [role=\"tablist\"] with one [role=\"tab\"] per applied capability plus the always-on profile tab; a tab whose capability is not in the applied set does NOT render (no disabled shell). Probed by pack check AC-25101-1."
+    },
+    {
+      "id": "AC-25101-2",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The shell landmark is <nav data-role=\"account-settings-nav\" aria-label=\"Account settings\"> with a single accessible name; heading order follows h1 (page) then h2 (active tab) per WCAG 2.4.6."
+    }
+  ],
+  "tacIds": [
+    "TAC-2601-application-account-settings-shell",
+    "TAC-2602-application-account-settings-capability-discovery"
+  ],
+  "tags": [
+    "blueprint:application-account-settings"
+  ],
+  "createdAt": "2026-09-06T20:55:46Z",
+  "updatedAt": "2026-09-06T20:55:46Z"
+}

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25102.json

@@ -0,0 +1,27 @@
+{
+  "usId": "application-account-settings-US-25102",
+  "prdId": "PRD-001",
+  "reqId": "application-account-settings-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Profile surface renders form with WCAG 1.3.5 autocomplete tokens on every identifier",
+  "asA": "authenticated principal editing my profile",
+  "iWant": "name, email, birthday and country inputs whose autocomplete tokens follow WCAG 1.3.5 exactly, and save success and failure announcements that keyboard-only and screen-reader users can rely on",
+  "soThat": "my browser autofill fires correctly and my success and failure feedback is announced",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-25102-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "GET /account/profile renders a <form data-surface=\"profile\"> with inputs carrying autocomplete tokens \"name\" on the full-name field, \"email\" on the email field, \"bday\" on the birthday field and \"country\" on the country field; save-success renders <div role=\"status\" aria-live=\"polite\">Profile saved</div>; save-failure per field carries aria-invalid=\"true\" and aria-describedby pointing to a rendered error message. Probed by pack check AC-25102-1."
+    }
+  ],
+  "tacIds": [
+    "TAC-2601-application-account-settings-shell"
+  ],
+  "tags": [
+    "blueprint:application-account-settings"
+  ],
+  "createdAt": "2026-09-06T20:55:46Z",
+  "updatedAt": "2026-09-06T20:55:46Z"
+}

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25103.json

@@ -0,0 +1,27 @@
+{
+  "usId": "application-account-settings-US-25103",
+  "prdId": "PRD-001",
+  "reqId": "application-account-settings-REQ-003",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Security surface self-service branch renders when credentialSelfService applied",
+  "asA": "authenticated principal managing my credentials in-place",
+  "iWant": "a security surface rendering a self-service password-change and MFA-management branch when the applied auth blueprint declares credentialSelfService",
+  "soThat": "I can change my password and manage second factors without leaving the product",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-25103-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "When credentialSelfService is in the applied capability set, GET /account/security renders <div data-surface=\"security\" data-branch=\"self-service\"> containing a [data-role=\"change-password\"] form and a [data-role=\"mfa-management\"] region. Absent from render when credentialSelfService is not applied. Probed by pack check AC-25105-1 (unified security check)."
+    }
+  ],
+  "tacIds": [
+    "TAC-2603-application-account-settings-hosted-ui-bridge"
+  ],
+  "tags": [
+    "blueprint:application-account-settings"
+  ],
+  "createdAt": "2026-09-06T20:55:46Z",
+  "updatedAt": "2026-09-06T20:55:46Z"
+}

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25104.json

@@ -0,0 +1,27 @@
+{
+  "usId": "application-account-settings-US-25104",
+  "prdId": "PRD-001",
+  "reqId": "application-account-settings-REQ-003",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Security surface hosted-UI branch renders when hostedIdentityUi applied",
+  "asA": "authenticated principal reaching security surfaces on a hosted identity provider",
+  "iWant": "a link-out or embed branch that hands me to the hosted account page cleanly",
+  "soThat": "the shipped surface takes me to the provider that owns credential storage",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-25104-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "When hostedIdentityUi is in the applied capability set AND the operator elicited security-surface-shape=hosted-link-out, GET /account/security renders <a data-role=\"hosted-link-out\" href=\"{hosted-identity-url}\" rel=\"noopener\"> with an accessible label carrying the destination provider name; when security-surface-shape=hosted-embed, renders <iframe data-role=\"hosted-embed\" title=\"Account security\" src=\"{hosted-identity-url}\" sandbox=\"allow-scripts allow-forms allow-same-origin\">. Probed by pack check AC-25105-1."
+    }
+  ],
+  "tacIds": [
+    "TAC-2603-application-account-settings-hosted-ui-bridge"
+  ],
+  "tags": [
+    "blueprint:application-account-settings"
+  ],
+  "createdAt": "2026-09-06T20:55:46Z",
+  "updatedAt": "2026-09-06T20:55:46Z"
+}

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25105.json

@@ -0,0 +1,33 @@
+{
+  "usId": "application-account-settings-US-25105",
+  "prdId": "PRD-001",
+  "reqId": "application-account-settings-REQ-004",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Sessions surface lists active sessions and terminates via dialog-modal when sessionInventory applied",
+  "asA": "authenticated principal reviewing my active sessions",
+  "iWant": "a listing of every active session by device and last-active timestamp with a terminate control that confirms via a modal",
+  "soThat": "I can sign out a device I no longer control without leaving the surface",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-25105-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "When sessionInventory is in the applied capability set, GET /account/sessions renders <div data-surface=\"sessions\"> containing a table whose rows are enumerated by data-session-id, each row carrying [data-column=\"device\"], [data-column=\"lastActive\"] and a [data-action=\"terminate\"] control. Absent when sessionInventory is not applied. Probed by pack check AC-25106-1."
+    },
+    {
+      "id": "AC-25105-2",
+      "testable": true,
+      "scope": "runtime",
+      "description": "Clicking [data-action=\"terminate\"] opens <div role=\"dialog\" aria-modal=\"true\" data-role=\"terminate-confirm\" aria-labelledby=\"terminate-confirm-heading\"> with the row focus-trapped inside the dialog; on confirm the row is removed and <div role=\"status\" aria-live=\"polite\" data-role=\"session-terminated-announce\">Session ended</div> is announced; focus returns to the neighbouring row on close."
+    }
+  ],
+  "tacIds": [
+    "TAC-2604-application-account-settings-session-store"
+  ],
+  "tags": [
+    "blueprint:application-account-settings"
+  ],
+  "createdAt": "2026-09-06T20:55:46Z",
+  "updatedAt": "2026-09-06T20:55:46Z"
+}

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25106.json

@@ -0,0 +1,27 @@
+{
+  "usId": "application-account-settings-US-25106",
+  "prdId": "PRD-001",
+  "reqId": "application-account-settings-REQ-004",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Sessions surface hoists session inventory from an applied logging companion",
+  "asA": "authenticated principal on a project where the logger is the session store",
+  "iWant": "the sessions surface to read the applied logging companion inventory when sessionInventory arrives from observability-logging rather than from an auth blueprint",
+  "soThat": "the composition is the same regardless of which applied blueprint declared sessionInventory",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-25106-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The sessions surface reads sessionInventory from the union of applied capabilities across auth AND logging providers; the render contract of AC-25105-1 is identical whether the capability was supplied by an auth blueprint (security-auth-clerk 1.3.0, security-auth-keycloak 1.2.0, security-auth-oauth2 1.2.0) or by observability-logging 1.2.0."
+    }
+  ],
+  "tacIds": [
+    "TAC-2604-application-account-settings-session-store"
+  ],
+  "tags": [
+    "blueprint:application-account-settings"
+  ],
+  "createdAt": "2026-09-06T20:55:46Z",
+  "updatedAt": "2026-09-06T20:55:46Z"
+}

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25107.json

@@ -0,0 +1,27 @@
+{
+  "usId": "application-account-settings-US-25107",
+  "prdId": "PRD-001",
+  "reqId": "application-account-settings-REQ-005",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Notification-preferences surface renders when application-notifications-in-app applied",
+  "asA": "authenticated principal managing notification preferences",
+  "iWant": "a preferences surface with per-category silence and per-channel opt-in controls only when the notifications blueprint is applied",
+  "soThat": "the shipped surface never lies about what preferences my product actually supports",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-25107-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "When application-notifications-in-app is in the applied-blueprint set, GET /account/notifications renders <div data-surface=\"notifications\"> with [data-role=\"category-silence\"] entries per category and [data-role=\"channel-opt-in\"] entries per channel; save-success and save-failure announcements follow the profile surface contract. Absent when notifications-in-app is not applied. Probed by pack check AC-25107-1."
+    }
+  ],
+  "tacIds": [
+    "TAC-2601-application-account-settings-shell"
+  ],
+  "tags": [
+    "blueprint:application-account-settings"
+  ],
+  "createdAt": "2026-09-06T20:55:46Z",
+  "updatedAt": "2026-09-06T20:55:46Z"
+}

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25108.json

@@ -0,0 +1,27 @@
+{
+  "usId": "application-account-settings-US-25108",
+  "prdId": "PRD-001",
+  "reqId": "application-account-settings-REQ-006",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Theme surface renders light/dark/system radiogroup when application-spa applied",
+  "asA": "authenticated principal on an SPA project",
+  "iWant": "a theme surface with a light, dark and system option persisted per the theme-persistence elicit",
+  "soThat": "my theme choice sticks the way the project decided",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-25108-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "When application-spa is in the applied-blueprint set, GET /account/theme renders <div data-surface=\"theme\" role=\"radiogroup\" aria-label=\"Theme\"> containing three <input type=\"radio\" name=\"theme\" value=\"light|dark|system\"> options; selecting an option flips the data-theme attribute on the html element and persists per the theme-persistence elicit (spa-local-storage default, server-scoped, or none). Probed by pack check AC-25108-1."
+    }
+  ],
+  "tacIds": [
+    "TAC-2601-application-account-settings-shell"
+  ],
+  "tags": [
+    "blueprint:application-account-settings"
+  ],
+  "createdAt": "2026-09-06T20:55:46Z",
+  "updatedAt": "2026-09-06T20:55:46Z"
+}

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25109.json

@@ -0,0 +1,33 @@
+{
+  "usId": "application-account-settings-US-25109",
+  "prdId": "PRD-001",
+  "reqId": "application-account-settings-REQ-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Bare-SPA apply-time refusal names the two remedies and honours --allow-no-auth-yet",
+  "asA": "operator applying the account-settings blueprint on a bare SPA",
+  "iWant": "a refusal that names the two remedies (apply an auth blueprint, or override for a scaffolding pass) and an override that records a note on the sidecar",
+  "soThat": "the account surfaces never activate silently on a project with no identity",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-25109-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "rcf define blueprint add ./blueprints/application-account-settings on a project with no applied blueprint declaring principalDirectory exits 3 and prints the [application-account-settings-bare-spa] refusal message quoting the required capability, the applied-blueprint list and the two suggested next steps."
+    },
+    {
+      "id": "AC-25109-2",
+      "testable": true,
+      "scope": "runtime",
+      "description": "Passing --allow-no-auth-yet applies the blueprint and writes rcf/blueprints/application-account-settings.applied.json with allowNoAuthYet:true, empty appliedCapabilities and a scaffolding-pass note; rcf define validate flags the sidecar note on read-back."
+    }
+  ],
+  "tacIds": [
+    "TAC-2602-application-account-settings-capability-discovery"
+  ],
+  "tags": [
+    "blueprint:application-account-settings"
+  ],
+  "createdAt": "2026-09-06T20:55:46Z",
+  "updatedAt": "2026-09-06T20:55:46Z"
+}

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25110.json

@@ -0,0 +1,27 @@
+{
+  "usId": "application-account-settings-US-25110",
+  "prdId": "PRD-001",
+  "reqId": "application-account-settings-REQ-003",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Q3 refusal at apply when no security capability declared and security-surface-shape elicited",
+  "asA": "operator applying on a project that declares principalDirectory but neither credentialSelfService nor hostedIdentityUi",
+  "iWant": "a Q3-per-spec refusal at apply naming the two remedies when the security-surface-shape elicit is answered",
+  "soThat": "no auth-managed-elsewhere placeholder ships silently",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-25110-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "When no applied blueprint declares credentialSelfService OR hostedIdentityUi and the operator answers --answer security-surface-shape=self-service (or =hosted-link-out or =hosted-embed), apply exits 3 with the two-remedy message: (a) apply an auth blueprint that declares one of the two security capabilities, or (b) drop the security tab from scope by not answering security-surface-shape."
+    }
+  ],
+  "tacIds": [
+    "TAC-2603-application-account-settings-hosted-ui-bridge"
+  ],
+  "tags": [
+    "blueprint:application-account-settings"
+  ],
+  "createdAt": "2026-09-06T20:55:46Z",
+  "updatedAt": "2026-09-06T20:55:46Z"
+}

package/blueprints/application-account-settings/docs/topics.md

@@ -0,0 +1,48 @@
+# application-account-settings: coordination vocabulary
+
+## Global topics
+
+The blueprint claims no new global topics at v1.0.0. Account-settings is a consumer of the identity capability set the applied auth blueprints (and the observability-logging companion) declare through `capabilities[]`; every ADR (capability-vocabulary extension, security-surface-shape, theme-persistence, reauth-window) is non-global.
+
+## Deliberately unclaimed topics
+
+- `themePersistence` (the shape of theme persistence). Reserved for the applied `application-spa` blueprint's own ADR set; the account-settings blueprint offers the operator surface for choosing the theme and hands the persistence to the SPA blueprint via the elicited `theme-persistence` answer.
+- `sessionInventory` (the shape of a session-inventory record). Reserved for the applied provider's ADR set (an auth blueprint, or observability-logging as the logging-projection provider). The account-settings blueprint reads the inventory through the applied provider's interface.
+- `credentialSelfService` (the shape of a credential surface). Reserved for the applied auth blueprint's ADR set for the same reason.
+- `hostedIdentityUi` (the shape of a hosted identity portal). Reserved for the applied auth blueprint's ADR set for the same reason.
+
+## Shelf id band and suffix block
+
+| Blueprint | US band | ADR/TAC suffix block | Status | Global topics |
+|---|---|---|---|---|
+| application-datatable | 17101-17899 | 18xx | shipped v1.0.0 | none |
+| application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
+| application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
+| application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
+| application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
+| application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
+| application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
+| application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
+| persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+
+The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
+
+## Cross-references
+
+- `application-empty-error-states` (T-1, shipped v1.0.0): the shell composes on the `forbidden` and `empty-list` states rather than inventing bespoke access-denied UI. Every project applying `application-account-settings` should also apply `application-empty-error-states`.
+- `application-admin-console` (T-5, shipped v1.0.0): shares the capability-declaration mechanism (`capabilities[]` on identity blueprints) and the apply-time discovery, refusal and custom-auth elicitation. The two blueprints are separate consumers (the account-settings surface is per-principal; the admin-console surface is per-operator-with-admin-scope) and never render the same surface.
+
+## Probe pack
+
+`probe-packs/application-account-settings.pack.mjs` ships five capability-gated checks anchored to blueprint AC ids:
+
+- `AC-25101-1` shell tabs mirror applied caps (always fires; guard on the leak branch)
+- `AC-25102-1` profile autocomplete tokens (always fires)
+- `AC-25105-1` security surface branch matches applied + elicit (fires when `credentialSelfService` or `hostedIdentityUi` is applied)
+- `AC-25106-1` sessions rows and dialog-modal (fires when `sessionInventory` is applied)
+- `AC-25108-1` theme radiogroup and persistence (fires when the theme-persistence elicit is answered, mirroring the `application-spa` applied gate)
+
+The pack applies to any FBS binding `TAC-2601-application-account-settings-shell` or whose navModel routes name an `/account`, `/settings` or `/profile` path. See `packages/rcf-lite/docs/blueprint-authoring.md` section 8c for the pack authoring rules.

package/blueprints/application-account-settings/guide/application-account-settings.md

@@ -0,0 +1,30 @@
+# application-account-settings: operator guide
+
+## When to reach for it
+
+Your project applies at least one shelf `security-auth-*` blueprint (or a custom identity source declaring `principalDirectory` via the elicitation phase). You need an account-settings surface that lets each authenticated principal edit their profile, manage credentials, review sessions, adjust notification preferences and pick a theme. You want the surface to configure itself from the applied capability set rather than demand configuration.
+
+## When NOT to reach for it
+
+You are shipping a fully-featured, opinionated account product (a bespoke SaaS account console with 15 tabs, tightly-coupled billing, invoice history and organisation settings). Adopt this blueprint only when a vendor-neutral shell composed from the applied identity blueprints suits your project better than a fixed opinionated console.
+
+You want an anonymous product (no principal, no profile). The blueprint refuses at apply on a bare SPA; `--allow-no-auth-yet` accepts the refusal for a scaffolding pass but the surfaces will not activate until an identity capability is applied.
+
+## What stays your call
+
+- Which shelf auth blueprint you apply first (or whether you supply custom auth via the four `custom-auth-provides-*` elicits).
+- The `security-surface-shape` (self-service, hosted-link-out or hosted-embed). No recommended default: the shape leaks the vendor's identity architecture.
+- The `hosted-identity-url` when the security surface is a hosted-link-out or hosted-embed.
+- The `theme-persistence` strategy (spa-local-storage default, server-scoped, none).
+- The `reauth-window` (never, 5, 15 or 60 minutes) applied to high-value changes.
+
+## Mechanism-reach gaps
+
+The blueprint's README lists the runtime-observable ACs the pack does NOT bind directly. Every gap is a candidate for a v1.1.0 minor bump extending the pack; the shipped v1.0.0 pack anchors the five load-bearing surface checks. Combine with the round-3 T-1 datatable pack to reach the sessions and notification-preferences shells' state-region contract.
+
+## Promotion signals
+
+- The security-surface-shape choice drifts across two or more projects on the same auth vendor: candidate for a per-vendor default on the auth blueprint's own elicit set (a Clerk 1.4.0 with a `hosted-link-out` recommended default, say).
+- A dedicated `application-tenancy-orgs` blueprint ships: candidate for the account-settings shell to add an organisation-membership surface in a v1.1.0 minor bump.
+- A dedicated audit-history surface is needed at the account scope: candidate for a v1.1.0 minor bump reusing the `auditLog` capability with no new vocabulary.
+- The Q3 refusal fires often in support tickets: candidate for a shell-side "auth managed elsewhere" placeholder as an opt-in via a new elicit `security-surface-suppression=explicit-none`.