rcf-lite 0.22.0 → 0.24.0

package/CHANGELOG.md

@@ -6,6 +6,44 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.24.0] - 2026-09-08
+
+rcf-lite 0.24.0 opens the Cloudflare line with six blueprints in one round: a Workers KV facade, cron triggers with an expression-router, durable objects covering strong-consistency and hibernatable WebSocket shapes, a Zero-Trust Access gate the admin console consumes, Turnstile with the pinned test keys running under a Playwright pack, and edge rate limiting with a committed manifest. Each blueprint verifies against the real Cloudflare engine through node-only probes, and the admin console reads the Access-gate capability to switch its sign-in surface.
+
+### Added
+
+- **Round 6 T-1: `platform-cloudflare-kv` v1.0.0 on the shelf (PR #166).** Workers KV facade as the sole reader of the KV namespace binding, a cache-aside helper, put, get, list-with-prefix, TTL, and metadata-only lifecycle events (`facadeReady`, `kvHit`, `kvMiss`, `kvWrite`). Probes drive miniflare inside the shared `packages/rcf-lite/test/fixtures/cf-platform/` fixture, plus one accountBound-skipped real-account eventual-consistency smoke. Declares `capabilities: ["keyValueStore"]`. Mints the new global topic `keyValueStoreContract`.
+- **Round 6 T-2: `platform-cloudflare-cron-triggers` v1.0.0 on the shelf (PR #167).** `scheduled()` handler contract with an expression-router, a skew-tolerance discipline, and metadata-only lifecycle events (`cronReady`, `cronFired`, `cronSkewed`, `cronStalled`, `cronUnmatched`). Probes drive `wrangler dev --test-scheduled` against the shared `cf-platform` fixture, plus one accountBound-skipped real-account scheduled smoke. Composes with `jobs-background` when the applied scheduler mode is `workerCron`. Declares `capabilities: ["scheduledTrigger"]`. Mints the new global topic `scheduledTriggerContract`.
+- **Round 6 T-3: `platform-cloudflare-durable-objects` v1.0.0 on the shelf (PR #168).** Two shapes in one blueprint, strong-consistency single-cell and hibernatable WebSocket hub, alongside a sole-reader AST scan on the DO namespace binding, a storage round-trip, an alarm-fires-once check, and a hub-broadcast check. Probes drive `wrangler dev` on workerd against the shared `cf-platform` fixture (runtime-guarantee-through-the-real-engine per the round-6 gate lesson), plus one accountBound-skipped real-account storage-backend smoke. Declares `capabilities: ["strongConsistencyCell", "hibernatableWebSocket"]`. Mints the new global topics `strongConsistencyCellContract` and `websocketHubContract`.
+- **Round 6 T-4: `edge-cloudflare-access` v1.0.0 on the shelf, with `application-admin-console` 1.1.0 folded into the same PR (PR #169).** JWT validator as the sole reader of the `Cf-Access-Jwt-Assertion` header, an Access application shape, an audit-event record with metadata-only secrecy, and a real-account gated-URL probe that runs accountBound-skipped without a Cloudflare account. Declares `capabilities: ["zeroTrustGate"]`. Mints the new global topic `edgeAuthenticationGate`. In the same PR, `application-admin-console` bumps to 1.1.0 declaring consumption of `zeroTrustGate`: when Access is applied, the admin console reads the applied-sidecar and switches its sign-in surface to the Access-gated shape (no local login form; principal reduction reads from `request.auth`). Absent `zeroTrustGate`, the admin console falls back to the v1.0.0 behaviour.
+- **Round 6 T-5: `edge-cloudflare-turnstile` v1.0.0 on the shelf (PR #170).** Client widget mount pinned to the Cloudflare Turnstile host only, server-side siteverify against `https://challenges.cloudflare.com/turnstile/v0/siteverify`, a refuse-if-token-missing guard, and a magic-link mint-surface hook. Node probes drive the fixture, and a Playwright pack runs four checks against Cloudflare live siteverify using the pinned test sitekeys `1x00000000000000000000AA` (always-pass), `2x00000000000000000000AB` (always-fail) and `3x00000000000000000000FF` (forced-interactive) with their paired secrets. Declares `capabilities: ["humanCheck"]`. Mints the new global topic `humanVerificationGate`. First `uiBearing: true` FBS on the shelf.
+- **Round 6 T-6: `edge-cloudflare-rate-limiting` v1.0.0 on the shelf (PR #171).** Local manifest under `cloudflare/rate-limits/*.json`, manifest presence and schema validation, a drift-audit shape against the applied Cloudflare account, and metadata-only rate-limit events. One accountBound-skipped real-account burst-and-429 probe. Declares `capabilities: ["edgeRateLimit"]`. Mints the new global topic `edgeThrottleContract`.
+- **Authoring standard capability table extended.** `packages/rcf-lite/docs/blueprint-authoring.md` section 6a gains seven new rows: `keyValueStore`, `scheduledTrigger`, `strongConsistencyCell`, `hibernatableWebSocket`, `zeroTrustGate`, `humanCheck`, `edgeRateLimit`. Chunk-zero-style append, loader unchanged.
+
+### Changed
+
+- **`application-admin-console` v1.0.0 to v1.1.0 (PR #169).** Declares optional consumption of `zeroTrustGate` and switches sign-in surface accordingly. No new elicit; `principalDirectory` remains the sole hard requirement.
+
+## [0.23.0] - 2026-09-07
+
+rcf-lite 0.23.0 adds the infrastructure spine four blueprints wide: a Postgres store with a facade contract and forward-only migrations, an S3-shape object store with a Cloudflare R2 first adapter, a Cloudflare Queues producer and consumer with dead-letter semantics, and a background-jobs discipline that refuses to apply until a queue is applied. Each blueprint verifies against the real engine with node-only probes, and the four surfaces compose through the capability mechanism the round-3 admin console shipped.
+
+### Added
+
+- **Round 5 T-1: `persistence-data-postgres` v1.0.0 on the shelf (PR #155).** Postgres facade as the sole reader of the `pg` client, numbered forward-only migrations with per-file transactions, prepared-statement discipline enforced by a source-tree AST scan, a transactional-atomicity helper, scheduled `pg_dump` recovery plus vendor point-in-time recovery, and a connection-pool posture per deploy target. Declares `capabilities: ["relationalStore"]`. Conflicts by design with `persistence-data-sqlite` and `persistence-data-d1` on `persistenceStore` and `migrationDiscipline`. Reserves the round-6 Hyperdrive adapter slot at the driver ADR boundary. Six probes drive `postgres:17-alpine` in the shared `packages/rcf-lite/test/fixtures/infra-postgres/` fixture; probe reports land under `.rcf/reports/blueprints/persistence-data-postgres/` and set the round-5 ship-time evidence precedent.
+- **Round 5 T-2: `object-storage-s3` v1.0.0 on the shelf, with `security-secrets-management` 1.0.1 folded into the same PR (PR #157).** S3-API facade, Cloudflare R2 as the first adapter, MinIO as the local dev target, put, get, delete, list, a presigned-URL contract with a bounded TTL, multipart upload above an elicited threshold, and metadata-only lifecycle events. Refuses composition without `security-secrets-management` applied; the override `--allow-no-secrets-yet` records a note on `source.notes`. In the same PR, `security-secrets-management` bumps to 1.0.1 declaring `capabilities: ["secretsProvider"]` so the bare-project refusal fires end to end. Declares `capabilities: ["objectStorage"]`. Mints the new global topic `objectStorageContract`. Five probes run against MinIO plus one accountBound-skipped R2 smoke.
+- **Round 5 T-3: `messaging-queue-cloudflare` v1.0.0 on the shelf (PR #159).** Producer facade, consumer registration on the Worker's `queue` handler, publish, consume, ack, retry with the attempt counter, dead-letter contract per Cloudflare Queues docs (default retries 3, DLQ 4-day retention), batch consume, and metadata-only lifecycle events. One blueprint, contract plus first adapter. Declares `capabilities: ["queue"]`. Mints the new global topic `deliverySemantics`. Reserved slug `messaging-queue-postgres` sibling documented, deferred pending demand. Five probes drive `wrangler dev` locally plus one accountBound-skipped concurrency smoke that runs against a real account when `CI_HAS_CLOUDFLARE_ACCOUNT` is set.
+- **Round 5 T-4: `jobs-background` v1.0.0 on the shelf (PR #163).** Job-definition contract (name, handler, input schema, retry policy, timeout), scheduler contract (cron and one-shot delayed), retry contract on top of the applied queue, and a metadata-only job-run event log. Refuses to apply on a bare project with exit 3 and the stable message id `jobs-background-no-queue`; the `--allow-no-queue-yet` override records a note on `source.notes`. Declares `capabilities: ["backgroundJobs"]`. Mints the new global topic `backgroundJobModel`. Reserves the round-6 Workflows scheduler-mode slot at the ADR boundary. Five probes: apply-time refusal, apply-time override, fake-clock cron, retry-and-fail, event-secrecy.
+- **Authoring standard capability table extended.** `packages/rcf-lite/docs/blueprint-authoring.md` section 6a gains four new rows: `relationalStore`, `objectStorage`, `queue`, `backgroundJobs`. Chunk-zero-style append, loader unchanged.
+
+#### Also in this release
+
+- **Round 6 T-0: `deploy-cloudflare-workers` v1.1.0 to v1.2.0 (PR #164).** Additive minor bump that blesses the Workers-with-static-assets shape as the SPA-on-Workers deploy shape. Adds two new elicits (`assets-directory`, `run-worker-first`), ADR-1306 carrying the verbatim Cloudflare Pages landing-page recommendation, the `cf-platform` shared sample-app fixture under `packages/rcf-lite/test/fixtures/cf-platform/`, and the `assets-manifest-scan` probe that parses the applied fixture wrangler.toml and asserts the `[assets]` block presence, `run_worker_first` presence and absence of the Pages-only `pages_build_output_dir` field. No capability minted, no new global topic, no runtime dependency added; the shipped v1.1.0 contribution set carries through unchanged.
+
+### Fixed
+
+- **CLI stdout truncation on large outputs (PR #159).** `bin/rcf.js` now flushes stdout before `process.exit` at both exit sites. Previously, stdout was truncated at the 65536-byte pipe buffer on outputs past that size; first hit by `rcf audit coverage --format mermaid` on the umbrella tree.
+
 ## [0.22.0] - 2026-09-07
 
 rcf-lite 0.22.0 fills the visual shelf with five application blueprints (empty and error states, file upload with a WCAG keyboard gate, a multi-step forms wizard, a self-service account settings area, and a first-run onboarding tour). Account settings reuses the admin-console capability-gating mechanism, so the five settings surfaces only render when the applied auth blueprint declares the capability. The four shipped auth blueprints and the logging blueprint pick up additive capability declarations in the same release.

package/bin/rcf.js

@@ -267,9 +267,20 @@ export function isSameEntryPoint(metaUrl, argvPath) {
 const isMain = process.argv[1] && isSameEntryPoint(import.meta.url, process.argv[1]);
 if (isMain) {
   main(process.argv.slice(2))
-    .then((code) => process.exit(code))
+    .then((code) => {
+      // Await stdout drain before exit so large payloads (mermaid or
+      // JSON output above ~64KiB) are not truncated when a parent
+      // captures stdout via child_process execFile / spawn. process.exit
+      // otherwise races the OS pipe flush and drops the tail; the
+      // golden fixture tests hit this once the dogfood tree crosses
+      // the pipe buffer size. write('', cb) fires the callback once
+      // pending buffer flushes, then process.exit(code) tears down
+      // immediately - keeping the long-running mcp stdio subcommand
+      // path unchanged (mcp resolves once its own done promise fires).
+      process.stdout.write('', () => process.exit(code));
+    })
     .catch((err) => {
       process.stderr.write(`[rcf] unexpected failure: ${err.message}\n${err.stack}\n`);
-      process.exit(1);
+      process.stdout.write('', () => process.exit(1));
     });
 }

package/blueprints/application-account-settings/docs/topics.md

@@ -19,7 +19,7 @@ The blueprint claims no new global topics at v1.0.0. Account-settings is a consu
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -27,6 +27,14 @@ The blueprint claims no new global topics at v1.0.0. Account-settings is a consu
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-admin-console/CHANGELOG.md

@@ -1,5 +1,17 @@
 # application-admin-console CHANGELOG
 
+## 1.1.0 (2026-09-07)
+
+### Added
+
+- Consume the `zeroTrustGate` capability optionally at apply-time via the shipped `readAppliedCapabilities()` helper (the T-5 visual-round mechanism). When `zeroTrustGate` is in the applied capability set, `/admin/sign-in` renders the Access-gated sign-in surface: `[data-surface=access-gated]` with no local login form, plus a `[data-role=principal-read]` element carrying the principal email read from `request.auth`. When `zeroTrustGate` is absent the surface falls back to the local `security-auth-*` surface with `[data-surface=local-login]` and the existing local form. Additive minor: `requiresAppliedCapabilities.capabilities[]` stays `["principalDirectory"]` (Q4 default per Cloudflare round 6 spec section 5.4.1: making Access-gate hard is a v2.0 change).
+- 6 new contributions on the admin-console shelf entry: 1 REQ (`application-admin-console-REQ-014`), 2 USs (`application-admin-console-US-21815` Access-gated sign-in, `application-admin-console-US-21816` fallback branch), 1 TAC (`TAC-2214-application-admin-console-access-gated-signin-surface`), 1 ADR (`ADR-2214-application-admin-console-consume-zero-trust-gate`, scope global on new topic `adminConsoleSignInSurface` with `standardsTraceClause: Cloudflare round 6 spec section 5.4 (admin-console v1.1.0 delta)` and `recommendedDefault: true`) and 1 pack check (`AC-21815-1`) on the existing `application-admin-console.pack.mjs`.
+- Sign-in route extension on the shipped `packages/rcf-lite/test/fixtures/probe-pack-application-admin-console/` fixture: a new `/admin/sign-in` route that renders the Access-gated or local-login surface based on the applied caps (`?caps=zeroTrustGate` picks the gated branch). The existing `?caps=` combinations are preserved; the `AC-21815-1` pack check exercises both branches.
+
+### Composition
+
+- Rides the T-4 PR alongside `edge-cloudflare-access` v1.0.0 (round-4 T-4 capability-minor pattern). The Access-gated surface reads `request.auth.email`, which the shipped `edge-cloudflare-access` JWT validator sets after JWKS verification.
+
 ## 1.0.0 (visual round T-5, spec 2026-09-04)
 
 - First ratified version of the shelf's admin-console blueprint. Six REQs (console shell with no dead links, conditional users, conditional roles with Owner + Admin + Member + Viewer baseline, conditional orgs, conditional audit-log, access-denied plus request-access), nine USs 21101-21109 binding 16 runtime-observable ACs, four TACs 2201-2204 (shell, capability discovery, permission matrix, audit view consuming datatable), four ADRs 2201-2204 (capability vocabulary, baseline roles, invite transport, audit retention). No new global topics.

package/blueprints/application-admin-console/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "application-admin-console",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "category": "application",
   "requiresAppliedCapabilities": {
     "capabilities": [
@@ -221,6 +221,39 @@
       "path": "adrs/adr-2204-application-admin-console-audit-retention.json",
       "elicited": true,
       "standardsTraceClause": "generic enterprise practice"
+    },
+    {
+      "id": "application-admin-console-REQ-014",
+      "kind": "req",
+      "path": "requirements/application-admin-console-req-014.json"
+    },
+    {
+      "id": "application-admin-console-US-21815",
+      "kind": "us",
+      "path": "user-stories/application-admin-console-us-21815.json"
+    },
+    {
+      "id": "application-admin-console-US-21816",
+      "kind": "us",
+      "path": "user-stories/application-admin-console-us-21816.json"
+    },
+    {
+      "id": "TAC-2214-application-admin-console-access-gated-signin-surface",
+      "kind": "tac",
+      "path": "tacs/tac-2214-application-admin-console-access-gated-signin-surface.json"
+    },
+    {
+      "id": "ADR-2214-application-admin-console-consume-zero-trust-gate",
+      "kind": "adr",
+      "path": "adrs/adr-2214-application-admin-console-consume-zero-trust-gate.json",
+      "scope": "global",
+      "topic": "adminConsoleSignInSurface",
+      "recommendedDefault": true,
+      "elicited": false,
+      "standardsTraceClause": "Cloudflare round 6 spec section 5.4 (admin-console v1.1.0 delta)"
     }
+  ],
+  "optionalCapabilities": [
+    "zeroTrustGate"
   ]
 }

package/blueprints/application-admin-console/contributions/adrs/adr-2214-application-admin-console-consume-zero-trust-gate.json

@@ -0,0 +1,25 @@
+{
+  "adrId": "ADR-2214-application-admin-console-consume-zero-trust-gate",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.1.0",
+  "status": "accepted",
+  "title": "Admin-console reads zeroTrustGate at apply-time and switches sign-in surface (scope global, adminConsoleSignInSurface)",
+  "context": "application-admin-console v1.0.0 shipped with principalDirectory as the sole hard requirement; the sign-in surface was local per whatever security-auth-* was applied. Round-6 T-4 introduces edge-cloudflare-access with the zeroTrustGate capability; a composed deployment needs the admin-console to flip its sign-in surface deterministically so the Access-gated deployment stops rendering the local login form.",
+  "decision": "application-admin-console v1.1.0 reads appliedCapabilities via readAppliedCapabilities at apply-time (the T-5 visual-round mechanism). When zeroTrustGate is present the sign-in surface renders access-gated (no local form, principal reads from request.auth); when absent the surface falls back to whatever security-auth-* is applied. Q4 default per spec 5.4.1: zeroTrustGate is CONSUMED OPTIONALLY; principalDirectory remains the sole hard requirement (making Access-gate hard is a v2.0 change). The adminConsoleSignInSurface topic scope is global on this blueprint at v1.1.0; the topic string is adminConsoleSignInSurface (camelCase, one concept per topic).",
+  "consequences": "The v1.1.0 admin-console remains backward-compatible with every v1.0.0 deployment. An Access-gated deployment automatically stops rendering the local login form (the shipped pack check AC-21815-1 catches a stray local-login region under zeroTrustGate). The fallback branch (local-login surface) ships in v1.1.0 unchanged; a v2.0.0 that makes Access-gate hard would remove the fallback branch (breaking-change). Standards trace clause: Cloudflare round 6 spec section 5.4 (admin-console v1.1.0 delta).",
+  "alternativesConsidered": [
+    {
+      "name": "Make zeroTrustGate a hard requirement on admin-console v1.1.0",
+      "summary": "Add zeroTrustGate to requiresAppliedCapabilities.capabilities[]; admin-console apply refuses without it.",
+      "reasonNotChosen": "Breaks every v1.0.0 deployment that never adopted Cloudflare Access; violates the additive-minor contract. Making Access-gate hard is a v2.0.0 change per the Q4 default in spec section 5.4.1."
+    },
+    {
+      "name": "Ship two admin-console blueprints (local-only and access-gated)",
+      "summary": "Split the surface across two slugs so the operator picks at apply.",
+      "reasonNotChosen": "Doubles the shelf surface area and duplicates every other contribution. The applied-capability read is the shipped mechanism for exactly this composition (T-5 visual-round)."
+    }
+  ],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-014.json

@@ -0,0 +1,17 @@
+{
+  "reqId": "application-admin-console-REQ-014",
+  "prdId": "PRD-001",
+  "title": "Consume zeroTrustGate optionally when applied alongside a zeroTrustGate provider",
+  "description": "application-admin-console v1.1.0 reads the appliedCapabilities set at apply-time via the shipped readAppliedCapabilities() helper (the T-5 visual-round mechanism). When zeroTrustGate is present alongside the sole hard requirement principalDirectory, the admin-console renders the Access-gated sign-in surface (no local login form; principal reads from request.auth via [data-role=principal-read]). When zeroTrustGate is absent the admin-console falls back to the local security-auth-* sign-in surface unchanged from v1.0.0. Q4 default per spec section 5.4.1: consumption is OPTIONAL; requiresAppliedCapabilities.capabilities[] remains [principalDirectory] (making Access-gate hard is a v2.0 change).",
+  "category": "functional",
+  "domain": "application",
+  "priority": "must",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.4.1) alongside edge-cloudflare-access v1.0.0. Round-4 T-4 capability-minor pattern: the admin-console minor rides the edge-cloudflare-access PR.",
+  "tags": [
+    "blueprint:application-admin-console"
+  ],
+  "version": "1.1.0",
+  "status": "approved",
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/application-admin-console/contributions/tacs/tac-2214-application-admin-console-access-gated-signin-surface.json

@@ -0,0 +1,32 @@
+{
+  "tacId": "TAC-2214-application-admin-console-access-gated-signin-surface",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.1.0",
+  "status": "approved",
+  "name": "Access-gated sign-in surface with principal-read-from-request contract",
+  "purpose": "Names the sign-in surface shape the admin-console renders when zeroTrustGate is in the applied capability set. The Access-gated shape carries [data-surface=access-gated], no local form, and a [data-role=principal-read] element rendering the principal email read from request.auth. The fallback shape (zeroTrustGate absent) carries [data-surface=local-login] with the security-auth-* local login form. The two are mutually exclusive on any /admin/sign-in render.",
+  "responsibilities": [
+    "Render the Access-gated surface with [data-surface=access-gated] when zeroTrustGate is in appliedCapabilities (AC-21815-1).",
+    "Render the local-login surface with [data-surface=local-login] when zeroTrustGate is absent (AC-21816-1).",
+    "Read the principal email from request.auth and render it in [data-role=principal-read] on the gated branch.",
+    "Never render both surfaces on the same request; ensure the two are mutually exclusive per applied set."
+  ],
+  "internalStructure": "Applied-capability-driven surface pick in the sign-in route. The applied-sidecar (rcf/blueprints/application-admin-console.applied.json) records the appliedCapabilities set; the shipped readAppliedCapabilities() helper reads it at apply-time (T-5 visual-round mechanism). No new elicits on the admin-console side: the sign-in seam is deterministic once the applied set is known.",
+  "interfaces": [
+    {
+      "name": "GET /admin/sign-in",
+      "kind": "route",
+      "summary": "Sign-in surface route the admin-console shell renders per applied-capability set."
+    }
+  ],
+  "dependencies": [
+    {
+      "name": "T-4 edge-cloudflare-access v1.0.0 (zeroTrustGate provider)",
+      "kind": "blueprint",
+      "description": "Applied alongside admin-console v1.1.0 to compose the Access-gated sign-in surface."
+    }
+  ],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21815.json

@@ -0,0 +1,27 @@
+{
+  "usId": "application-admin-console-US-21815",
+  "prdId": "PRD-001",
+  "reqId": "application-admin-console-REQ-014",
+  "version": "1.1.0",
+  "status": "approved",
+  "title": "Access-gated sign-in surface renders when zeroTrustGate is applied",
+  "asA": "shelf consumer applying application-admin-console v1.1.0 with zeroTrustGate in the applied capability set",
+  "iWant": "the sign-in surface to render as Access-gated with no local login form and to read the principal from request.auth",
+  "soThat": "the admin console composes with edge-cloudflare-access at the sign-in seam and never re-collects credentials in an Access-gated deployment",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-21815-1",
+      "description": "When application-admin-console v1.1.0 is applied with zeroTrustGate in appliedCapabilities, GET /admin/sign-in renders a region with [data-surface=access-gated], no [data-surface=local-login] region is present, and a [data-role=principal-read] element renders the principal email read from request.auth. The shipped pack check AC-21815-1 on application-admin-console.pack.mjs asserts all three (fires only when zeroTrustGate is in the applied set).",
+      "given": "the extended admin-console pack fixture on ?caps=principalDirectory,roleModel,auditLog,zeroTrustGate",
+      "when": "the pack drives GET /admin/sign-in",
+      "then": "the DOM carries [data-surface=access-gated], no [data-surface=local-login], and a [data-role=principal-read] with the request.auth email",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-2214-application-admin-console-access-gated-signin-surface"
+  ],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21816.json

@@ -0,0 +1,27 @@
+{
+  "usId": "application-admin-console-US-21816",
+  "prdId": "PRD-001",
+  "reqId": "application-admin-console-REQ-014",
+  "version": "1.1.0",
+  "status": "approved",
+  "title": "Falls back to security-auth-* local login when zeroTrustGate is absent",
+  "asA": "shelf consumer applying application-admin-console v1.1.0 WITHOUT zeroTrustGate in the applied capability set",
+  "iWant": "the sign-in surface to render as the local security-auth-* surface with no Access-gated region",
+  "soThat": "the v1.1.0 admin-console remains backward-compatible with every v1.0.0 deployment that never adopted Access",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-21816-1",
+      "description": "When application-admin-console v1.1.0 is applied without zeroTrustGate in appliedCapabilities, GET /admin/sign-in renders a region with [data-surface=local-login] and no [data-surface=access-gated] region is present. The local login form ships with data-role=local-login-form and data-action=local-sign-in controls.",
+      "given": "the extended admin-console pack fixture on ?caps=principalDirectory,roleModel,auditLog",
+      "when": "the pack drives GET /admin/sign-in",
+      "then": "the DOM carries [data-surface=local-login] and no [data-surface=access-gated]",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-2214-application-admin-console-access-gated-signin-surface"
+  ],
+  "createdAt": "2026-09-07T16:00:00.000Z",
+  "updatedAt": "2026-09-07T16:00:00.000Z"
+}

package/blueprints/application-admin-console/docs/topics.md

@@ -19,7 +19,7 @@ The blueprint claims no new global topics at v1.0.0. The console is a consumer o
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -27,6 +27,14 @@ The blueprint claims no new global topics at v1.0.0. The console is a consumer o
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-admin-console/guide/application-admin-console.md

@@ -27,3 +27,27 @@ The blueprint's README lists the runtime-observable ACs the pack does NOT bind d
 - The role catalogue label vocabulary drifts across three or more applied auth blueprints: candidate for a `roleModel` global topic in a v1.1.0 minor.
 - The tenancy shape needs a real shelf provider: candidate for the `application-tenancy-orgs` blueprint (spec section 11).
 - A dedicated audit-log blueprint ships: candidate for the console to consume it directly via `capabilities: ["auditLog"]` rather than through the logging companion.
+
+## v1.1.0 minor: Access-gate consumption (Cloudflare round 6 T-4)
+
+Applying `edge-cloudflare-access` v1.0.0 alongside `application-admin-console` v1.1.0 flips the sign-in surface on `/admin/sign-in`. The admin-console reads `appliedCapabilities` at apply-time via the shipped `readAppliedCapabilities()` helper (the T-5 visual-round mechanism).
+
+- With `zeroTrustGate` in the applied set: the sign-in page renders `[data-surface=access-gated]` with no local login form. A `[data-role=principal-read]` element carries the principal email the `edge-cloudflare-access` JWT validator attached to `request.auth`. The shipped pack check `AC-21815-1` on `application-admin-console.pack.mjs` asserts the shape.
+- Without `zeroTrustGate`: the sign-in page renders `[data-surface=local-login]` with the local `security-auth-*` form unchanged from v1.0.0. Every v1.0.0 deployment continues to work; the minor is strictly additive.
+
+The Q4 default (spec section 5.4.1) is: consumption is OPTIONAL. `requiresAppliedCapabilities.capabilities[]` remains `["principalDirectory"]`; making Access-gate hard is a v2.0 change (the fallback branch would be removed).
+
+Composed apply-line, one project:
+
+```
+rcf define blueprint add application-admin-console --version 1.1.0
+rcf define blueprint add edge-cloudflare-access --version 1.0.0 --answer access-application-host=admin.example.com --answer access-audience=<audience> --answer access-jwks-url=https://<team>.cloudflareaccess.com/cdn-cgi/access/certs --answer access-policy-shape=email-domain
+```
+
+Fall-back apply-line (no Access; the v1.1.0 admin-console behaves identically to v1.0.0):
+
+```
+rcf define blueprint add application-admin-console --version 1.1.0
+```
+
+Standards trace clause for the ADR: `Cloudflare round 6 spec section 5.4 (admin-console v1.1.0 delta)`.

package/blueprints/application-admin-console/probe-packs/application-admin-console.pack.mjs

@@ -38,7 +38,7 @@ function withUrl(runtimeUrl, path) {
 
 export default {
   packName: 'application-admin-console',
-  version: '1.0.0',
+  version: '1.1.0',
   blueprintSlug: 'application-admin-console',
   // Applies to any FBS that realises the console shell TAC or whose
   // navModel routes name an admin path. Names both `tacIds` and `route`
@@ -178,5 +178,30 @@ export default {
         return { verdict: 'pass', detail: 'auditRows=' + dom.ids.length + ' columns=' + JSON.stringify(dom.firstRowColumns) };
       },
     },
+      {
+      id: 'AC-21815-1',
+      severity: 'block',
+      description: 'Access-gated sign-in surface renders when zeroTrustGate is applied: [data-surface=access-gated] present, [data-surface=local-login] absent, and [data-role=principal-read] carries the principal email read from request.auth (T-4 admin-console v1.1.0 delta, Cloudflare round 6 spec 5.4.1)',
+      appliesTo: async ({ projectRoot }) => {
+        const caps = await readAppliedCapabilities(projectRoot);
+        return caps.includes('zeroTrustGate');
+      },
+      run: async ({ browser, runtimeUrl }) => {
+        if (!browser) return { verdict: 'fail', detail: 'no packBrowser wired' };
+        await browser.goto(withUrl(runtimeUrl, '/admin/sign-in?caps=principalDirectory,roleModel,auditLog,zeroTrustGate'));
+        const dom = await browser.evaluate(() => {
+          const gated = document.querySelector('[data-surface="access-gated"]');
+          const local = document.querySelector('[data-surface="local-login"]');
+          const principalRead = document.querySelector('[data-role="principal-read"]');
+          const principalText = principalRead ? principalRead.textContent.trim() : null;
+          return { gatedPresent: !!gated, localPresent: !!local, principalReadPresent: !!principalRead, principalText };
+        });
+        if (!dom.gatedPresent) return { verdict: 'fail', detail: 'Access-gated sign-in surface missing: [data-surface="access-gated"] not found on /admin/sign-in under applied zeroTrustGate' };
+        if (dom.localPresent) return { verdict: 'fail', detail: 'Access-gated sign-in surface leak: [data-surface="local-login"] rendered alongside access-gated under applied zeroTrustGate' };
+        if (!dom.principalReadPresent) return { verdict: 'fail', detail: '[data-role="principal-read"] element missing on the Access-gated surface' };
+        if (!dom.principalText || dom.principalText.length === 0) return { verdict: 'fail', detail: '[data-role="principal-read"] element carries an empty principal (expected the email read from request.auth)' };
+        return { verdict: 'pass', detail: 'Access-gated surface renders: gatedPresent=true localPresent=false principalRead="' + dom.principalText + '"' };
+      },
+    },
   ],
 };

package/blueprints/application-api-rest/docs/topics.md

@@ -42,7 +42,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -50,6 +50,14 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 Suffix-family ids (ADR, TAC): SPA numbers in the 2xx range, this package takes 3xx (ADR-301 to ADR-308, TAC-301 to TAC-306); the next blueprint should take 4xx.
 

package/blueprints/application-charts/docs/topics.md

@@ -18,7 +18,7 @@ The blueprint claims no new global topics at v1.0.0. The chart-component contrac
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -26,6 +26,14 @@ The blueprint claims no new global topics at v1.0.0. The chart-component contrac
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-dashboard/docs/topics.md

@@ -18,7 +18,7 @@ The blueprint claims no new global topics at v1.0.0. The dashboard-shell contrac
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -26,6 +26,14 @@ The blueprint claims no new global topics at v1.0.0. The dashboard-shell contrac
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-datatable/docs/topics.md

@@ -17,7 +17,7 @@ The blueprint claims no new global topics at v1.0.0. The datatable shell is a ge
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -25,6 +25,14 @@ The blueprint claims no new global topics at v1.0.0. The datatable shell is a ge
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-empty-error-states/docs/topics.md

@@ -18,7 +18,7 @@ The blueprint claims no new global topics at v1.0.0. Every ADR (HTTP status cont
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -26,6 +26,14 @@ The blueprint claims no new global topics at v1.0.0. Every ADR (HTTP status cont
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-error-handling/docs/topics.md

@@ -24,7 +24,7 @@
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -32,5 +32,13 @@
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.

package/blueprints/application-file-upload/docs/topics.md

@@ -19,7 +19,7 @@ The blueprint claims no new global topics at v1.0.0. Every ADR (transport branch
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -27,6 +27,14 @@ The blueprint claims no new global topics at v1.0.0. Every ADR (transport branch
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
 

package/blueprints/application-forms-wizard/docs/topics.md

@@ -18,7 +18,7 @@ The blueprint claims no new global topics at v1.0.0. Every ADR (navigation postu
 | application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
-| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.1.0 | `adminConsoleSignInSurface` |
 | application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
 | application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
 | application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
@@ -26,6 +26,14 @@ The blueprint claims no new global topics at v1.0.0. Every ADR (navigation postu
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorage` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
+| platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
+| platform-cloudflare-cron-triggers | 32101-32899 | 33xx | shipped v1.0.0 | `scheduledTriggerContract` |
+| platform-cloudflare-durable-objects | 33101-33899 | 34xx | shipped v1.0.0 | `strongConsistencyCellContract`, `websocketHubContract` |
+| edge-cloudflare-access | 34101-34899 | 35xx | shipped v1.0.0 | `edgeAuthenticationGate` |
+| edge-cloudflare-turnstile | 35101-35899 | 36xx | shipped v1.0.0 | `humanVerificationGate` |
+| edge-cloudflare-rate-limiting | 36101-36899 | 37xx | shipped v1.0.0 | `edgeThrottleContract` |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.